diff --git a/developer-simulation/.gitignore b/developer-simulation/.gitignore
new file mode 100644
index 0000000..8f66aca
--- /dev/null
+++ b/developer-simulation/.gitignore
@@ -0,0 +1,5 @@
+**/target/
+**/*.db/
+**/*.db-shm
+**/*.db-wal
+**/.DS_Store
diff --git a/developer-simulation/AUTOMATION_PROMPT.md b/developer-simulation/AUTOMATION_PROMPT.md
new file mode 100644
index 0000000..7405b8b
--- /dev/null
+++ b/developer-simulation/AUTOMATION_PROMPT.md
@@ -0,0 +1,156 @@
+# Daily automation instructions
+
+Run the BogKit developer simulation lab for the current date in
+`America/New_York`.
+
+The user explicitly authorized multi-agent work for this automation. Use a
+scenario designer, two independent simulated developers, and a skeptical
+reviewer. Keep the coordinator responsible for repository and GitHub writes.
+
+## Fixed targets
+
+- Repository: `flowercomputers/bogkit`
+- Base branch: `main`
+- Simulation branch: `ed/developer-simulation`
+- Pull request: the open PR whose head is `ed/developer-simulation`
+- Archive root: `developer-simulation/`
+- Daily PR marker: `<!-- bogkit-developer-simulation:YYYY-MM-DD -->`
+- Dashboard marker: `<!-- bogkit-developer-simulation-dashboard -->`
+
+## Safety boundary
+
+- Modify only `developer-simulation/`.
+- Never automatically edit BogKit core, existing examples, root workspace
+  configuration, or repository-wide documentation.
+- Never force-push, merge the PR, create another PR, or open issues.
+- Never commit credentials, private data, generated build output, databases,
+  large binary fixtures, or unjustified dependencies.
+- Stop and report a blocker if current changes, merge conflicts, missing GitHub
+  access, or an unexpected branch state make a safe run uncertain.
+
+## Preflight and idempotency
+
+1. Read `developer-simulation/README.md`, `coverage.json`, and recent reports.
+2. Verify GitHub access and resolve the open draft PR by its exact head branch.
+3. Fetch `origin`. Start from the current remote simulation branch and merge the
+   latest `origin/main` without rewriting history. Abort safely on conflict.
+4. Search both the branch and PR conversation for today's daily marker.
+   - If both exist, make no changes and finish successfully.
+   - If the report exists but the PR comment is missing, publish the existing
+     report, refresh the dashboard, and do not generate new trials.
+   - If a partial dated archive exists without a finished report, inspect and
+     resume only confirmed work. Do not create a second dated archive.
+
+## Scenario design
+
+Spawn a scenario-designer subagent without inherited conversation context. Do
+not let it inspect BogKit. Give it only the coverage ledger and ask for two
+substantially different, underexplored existing-software problems.
+
+Each scenario must specify:
+
+- a developer role and Rust experience level;
+- the existing system and baseline implementation;
+- the concrete pain, workload, data shape, and operational constraints;
+- measurable acceptance criteria and explicit non-goals;
+- a compact, self-contained prototype boundary.
+
+Do not reverse-engineer scenarios around Fold, ESE, or ANNy. Avoid repeating
+games, generic agent memory, media search, or repository search unless the
+coverage ledger shows a materially new workload or constraint.
+
+## Independent developer trials
+
+Create two separate sanitized temporary checkouts of current `origin/main`.
+They must not contain `developer-simulation/` or prior lab reports.
+
+Spawn one fresh simulator subagent per checkout without inherited conversation
+context. Give each only its persona, problem brief, assigned checkout, and these
+rules:
+
+- begin with the public README and examples;
+- behave as a developer with no prior BogKit knowledge;
+- do not read the other trial or prior lab work;
+- evaluate the stated baseline before choosing BogKit;
+- use only the BogKit components that fit, and allow a no-fit conclusion;
+- build the smallest meaningful runnable prototype or failure reproducer;
+- test, format, lint with warnings denied, and run the demonstration;
+- record the ordered discovery and friction trail, exact commands and observed
+  results, categorized findings, and a decision audit;
+- make no repository, GitHub, or automation writes.
+
+Run the simulators in parallel only when their directories are disjoint.
+
+## Skeptical review
+
+Spawn a separate reviewer after both trials finish. The reviewer may inspect
+both prototypes, current BogKit source, and prior reports, but makes no
+repository or GitHub writes.
+
+Require the reviewer to:
+
+- reproduce important behavior and any serious defect;
+- compare each solution with the scenario's baseline;
+- reject, soften, or relabel claims that exceed the evidence;
+- identify unnecessary dependencies, abstractions, or test scope;
+- audit consequential choices and unresolved uncertainty;
+- enforce the finding and candidate thresholds in `README.md`.
+
+The coordinator fixes rejected quality problems and reruns validation before
+archiving.
+
+## Archive and validation
+
+Archive accepted runnable prototypes in flat, uniquely named directories:
+
+```text
+developer-simulation/runs/YYYY-MM-DD--short-slug/
+```
+
+Each runnable Rust prototype must be a member of the nested workspace, use path
+dependencies on the checkout being tested, and include a README with exact
+reproduction instructions. Archive a blocked trial only as its minimal
+reproducer.
+
+Write one synthesis at `developer-simulation/reports/YYYY-MM-DD.md` following
+`REPORT_TEMPLATE.md`. Update `coverage.json` with both trials and independently
+recurring findings.
+
+Before publication:
+
+1. Run each new prototype's tests, formatting check, strict lint, and demo.
+2. Run the nested lab workspace tests and strict lint.
+3. Run `cargo test --workspace` from the BogKit root.
+4. Run `git diff --check`.
+5. Inspect every changed path and confirm it is under `developer-simulation/`.
+6. Scan the archive for secrets, generated databases, build output, and large
+   or binary files.
+
+## Publication
+
+Commit the dated archive with:
+
+```text
+simulation: YYYY-MM-DD developer trials
+```
+
+Push normally to `origin/ed/developer-simulation`. If the push is rejected,
+fetch and inspect the divergence; do not force-push.
+
+After the commit is confirmed on the remote:
+
+1. Append one top-level PR comment containing the daily report and its marker.
+2. Find the existing dashboard comment by its marker and replace its body with
+   a compact current dashboard:
+   - total trials and outcome counts;
+   - coverage summary;
+   - confirmed defects;
+   - recurring API or documentation friction;
+   - candidate improvements that meet the threshold;
+   - no-fit and positioning signals;
+   - links to every dated report comment and branch report.
+3. Verify the daily comment and dashboard through a fresh read.
+
+If the branch push succeeds but commenting fails, keep the branch evidence,
+retry only the missing comment step, and fail visibly. Never generate duplicate
+trials to repair a reporting failure.
diff --git a/developer-simulation/Cargo.lock b/developer-simulation/Cargo.lock
new file mode 100644
index 0000000..9469978
--- /dev/null
+++ b/developer-simulation/Cargo.lock
@@ -0,0 +1,1844 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 4
+
+[[package]]
+name = "anny"
+version = "0.0.1"
+
+[[package]]
+name = "anstream"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "824a212faf96e9acacdbd09febd34438f8f711fb84e09a8916013cd7815ca28d"
+dependencies = [
+ "anstyle",
+ "anstyle-parse",
+ "anstyle-query",
+ "anstyle-wincon",
+ "colorchoice",
+ "is_terminal_polyfill",
+ "utf8parse",
+]
+
+[[package]]
+name = "anstyle"
+version = "1.0.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "940b3a0ca603d1eade50a4846a2afffd5ef57a9feac2c0e2ec2e14f9ead76000"
+
+[[package]]
+name = "anstyle-parse"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "52ce7f38b242319f7cabaa6813055467063ecdc9d355bbb4ce0c68908cd8130e"
+dependencies = [
+ "utf8parse",
+]
+
+[[package]]
+name = "anstyle-query"
+version = "1.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "40c48f72fd53cd289104fc64099abca73db4166ad86ea0b4341abe65af83dadc"
+dependencies = [
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "anstyle-wincon"
+version = "3.0.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "291e6a250ff86cd4a820112fb8898808a366d8f9f58ce16d1f538353ad55747d"
+dependencies = [
+ "anstyle",
+ "once_cell_polyfill",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "atomic-polyfill"
+version = "1.0.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8cf2bce30dfe09ef0bfaef228b9d414faaf7e563035494d7fe092dba54b300f4"
+dependencies = [
+ "critical-section",
+]
+
+[[package]]
+name = "atomic-waker"
+version = "1.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1505bd5d3d116872e7271a6d4e16d81d0c8570876c8de68093a09ac269d8aac0"
+
+[[package]]
+name = "autocfg"
+version = "1.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f2032f911046de80f0a198e0901378627c33f59ea0ac00e363d481118bd70a53"
+
+[[package]]
+name = "axum"
+version = "0.8.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "31b698c5f9a010f6573133b09e0de5408834d0c82f8d7475a89fc1867a71cd90"
+dependencies = [
+ "axum-core",
+ "bytes",
+ "form_urlencoded",
+ "futures-util",
+ "http",
+ "http-body",
+ "http-body-util",
+ "hyper",
+ "hyper-util",
+ "itoa",
+ "matchit",
+ "memchr",
+ "mime",
+ "percent-encoding",
+ "pin-project-lite",
+ "serde_core",
+ "serde_json",
+ "serde_path_to_error",
+ "serde_urlencoded",
+ "sync_wrapper",
+ "tokio",
+ "tower",
+ "tower-layer",
+ "tower-service",
+ "tracing",
+]
+
+[[package]]
+name = "axum-core"
+version = "0.5.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "08c78f31d7b1291f7ee735c1c6780ccde7785daae9a9206026862dab7d8792d1"
+dependencies = [
+ "bytes",
+ "futures-core",
+ "http",
+ "http-body",
+ "http-body-util",
+ "mime",
+ "pin-project-lite",
+ "sync_wrapper",
+ "tower-layer",
+ "tower-service",
+ "tracing",
+]
+
+[[package]]
+name = "bitflags"
+version = "2.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b588b76d00fde79687d7646a9b5bdf3cc0f655e0bbd080335a95d7e96f3587da"
+
+[[package]]
+name = "block-buffer"
+version = "0.10.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3078c7629b62d3f0439517fa394996acacc5cbc91c5a20d8c658e77abd503a71"
+dependencies = [
+ "generic-array",
+]
+
+[[package]]
+name = "byteorder"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1fd0f2584146f6f2ef48085050886acf353beff7305ebd1ae69500e27c67f64b"
+
+[[package]]
+name = "byteorder-lite"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8f1fe948ff07f4bd06c30984e69f5b4899c516a3ef74f34df92a2df2ab535495"
+
+[[package]]
+name = "bytes"
+version = "1.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fc652a48c352aef3ea3aed32080501cf3ef6ed5da78602a020c991775b0aff04"
+
+[[package]]
+name = "byteview"
+version = "0.10.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0d74937895e761d5984206f82ca8ff7725d0fd8021921011921894b41ab1b9f7"
+
+[[package]]
+name = "caldav-recurrence-prototype"
+version = "0.1.0"
+dependencies = [
+ "chrono",
+ "fold",
+ "libc",
+ "serde",
+ "serde_json",
+ "sha2",
+]
+
+[[package]]
+name = "carrier-label-ambiguity"
+version = "0.1.0"
+
+[[package]]
+name = "catalog-compiler-prototype"
+version = "0.1.0"
+
+[[package]]
+name = "causal-canvas-compaction"
+version = "0.1.0"
+dependencies = [
+ "fold",
+ "serde",
+ "serde_json",
+ "sha2",
+]
+
+[[package]]
+name = "cc"
+version = "1.2.67"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e17dd265a7d0f31ef544e1b20e03add05d3b45b491b633b10d67145d2acc1a38"
+dependencies = [
+ "find-msvc-tools",
+ "shlex",
+]
+
+[[package]]
+name = "cfg-if"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801"
+
+[[package]]
+name = "chrono"
+version = "0.4.45"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1aa79e62e7697b8e29b513a68abacf485adcd1fe8284a4316c5ae868e6633327"
+dependencies = [
+ "num-traits",
+]
+
+[[package]]
+name = "ci-lease-coordinator"
+version = "0.0.0"
+dependencies = [
+ "fold",
+ "serde",
+ "serde_json",
+]
+
+[[package]]
+name = "clap"
+version = "4.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1ddb117e43bbf7dacf0a4190fef4d345b9bad68dfc649cb349e7d17d28428e51"
+dependencies = [
+ "clap_builder",
+ "clap_derive",
+]
+
+[[package]]
+name = "clap_builder"
+version = "4.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "714a53001bf66416adb0e2ef5ac857140e7dc3a0c48fb28b2f10762fc4b5069f"
+dependencies = [
+ "anstream",
+ "anstyle",
+ "clap_lex",
+ "strsim",
+]
+
+[[package]]
+name = "clap_derive"
+version = "4.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f2ce8604710f6733aa641a2b3731eaa1e8b3d9973d5e3565da11800813f997a9"
+dependencies = [
+ "heck",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "clap_lex"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c8d4a3bb8b1e0c1050499d1815f5ab16d04f0959b233085fb31653fbfc9d98f9"
+
+[[package]]
+name = "cnc-job-bundle-preflight"
+version = "0.1.0"
+dependencies = [
+ "serde",
+ "serde_json",
+]
+
+[[package]]
+name = "cobs"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0fa961b519f0b462e3a3b4a34b64d119eeaca1d59af726fe450bbba07a9fc0a1"
+dependencies = [
+ "thiserror",
+]
+
+[[package]]
+name = "cold-chain-repair"
+version = "0.1.0"
+dependencies = [
+ "fold",
+ "serde",
+ "serde_json",
+]
+
+[[package]]
+name = "colorchoice"
+version = "1.0.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1d07550c9036bf2ae0c684c4297d503f838287c83c53686d05370d0e139ae570"
+
+[[package]]
+name = "compare"
+version = "0.0.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ea0095f6103c2a8b44acd6fd15960c801dafebf02e21940360833e0673f48ba7"
+
+[[package]]
+name = "container-yard-planner"
+version = "0.1.0"
+dependencies = [
+ "serde",
+ "serde_json",
+]
+
+[[package]]
+name = "core-foundation"
+version = "0.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b2a6cd9ae233e7f62ba4e9353e81a88df7fc8a5987b8d445b4d90c879bd156f6"
+dependencies = [
+ "core-foundation-sys",
+ "libc",
+]
+
+[[package]]
+name = "core-foundation-sys"
+version = "0.8.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "773648b94d0e5d620f64f280777445740e61fe701025087ec8b57f45c791888b"
+
+[[package]]
+name = "cpufeatures"
+version = "0.2.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "59ed5838eebb26a2bb2e58f6d5b5316989ae9d08bab10e0e6d103e656d1b0280"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "crc32fast"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9481c1c90cbf2ac953f07c8d4a58aa3945c425b7185c9154d67a65e4230da511"
+dependencies = [
+ "cfg-if",
+]
+
+[[package]]
+name = "critical-section"
+version = "1.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "790eea4361631c5e7d22598ecd5723ff611904e3344ce8720784c93e3d83d40b"
+
+[[package]]
+name = "crossbeam-epoch"
+version = "0.9.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2d6914041f254d6e9176c01941b21115dcfb7089e55135a35411081bd106ef3f"
+dependencies = [
+ "crossbeam-utils",
+]
+
+[[package]]
+name = "crossbeam-skiplist"
+version = "0.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "df29de440c58ca2cc6e587ec3d22347551a32435fbde9d2bff64e78a9ffa151b"
+dependencies = [
+ "crossbeam-epoch",
+ "crossbeam-utils",
+]
+
+[[package]]
+name = "crossbeam-utils"
+version = "0.8.22"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "61803da095bee82a81bb1a452ecc25d3b2f1416d1897eb86430c6159ef717c17"
+
+[[package]]
+name = "crypto-common"
+version = "0.1.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "78c8292055d1c1df0cce5d180393dc8cce0abec0a7102adb6c7b1eef6016d60a"
+dependencies = [
+ "generic-array",
+ "typenum",
+]
+
+[[package]]
+name = "dashmap"
+version = "6.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e6361d5c062261c78a176addb82d4c821ae42bed6089de0e12603cd25de2059c"
+dependencies = [
+ "cfg-if",
+ "crossbeam-utils",
+ "hashbrown 0.14.5",
+ "lock_api",
+ "once_cell",
+ "parking_lot_core",
+]
+
+[[package]]
+name = "digest"
+version = "0.10.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9ed9a281f7bc9b7576e61468ba615a66a5c8cfdff42420a70aa82701a3b1e292"
+dependencies = [
+ "block-buffer",
+ "crypto-common",
+]
+
+[[package]]
+name = "dns-change-gate"
+version = "0.1.0"
+
+[[package]]
+name = "edge-spool-pressure"
+version = "0.1.0"
+dependencies = [
+ "fold",
+ "serde",
+]
+
+[[package]]
+name = "embedded-io"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ef1a6892d9eef45c8fa6b9e0086428a2cca8491aca8f787c534a3d6d0bcb3ced"
+
+[[package]]
+name = "embedded-io"
+version = "0.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "edd0f118536f44f5ccd48bcb8b111bdc3de888b58c74639dfb034a357d0f206d"
+
+[[package]]
+name = "enum_dispatch"
+version = "0.3.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "aa18ce2bc66555b3218614519ac839ddb759a7d6720732f979ef8d13be147ecd"
+dependencies = [
+ "once_cell",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "equivalent"
+version = "1.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "877a4ace8713b0bcf2a4e7eec82529c029f1d0619886d18145fea96c3ffe5c0f"
+
+[[package]]
+name = "errno"
+version = "0.3.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
+dependencies = [
+ "libc",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "ese"
+version = "0.1.0"
+dependencies = [
+ "minreq",
+ "serde_json",
+ "unicode-general-category",
+ "unicode-normalization",
+]
+
+[[package]]
+name = "fastq-barcode-spill"
+version = "0.1.0"
+
+[[package]]
+name = "fastrand"
+version = "2.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "da7c62ceae207dd37ea5b845da6a0696c799f85e97da1ab5b7910be3c1c80223"
+
+[[package]]
+name = "financial-snapshot-trial"
+version = "0.1.0"
+dependencies = [
+ "fold",
+ "serde",
+ "serde_json",
+]
+
+[[package]]
+name = "find-msvc-tools"
+version = "0.1.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5baebc0774151f905a1a2cc41989300b1e6fbb29aff0ceffa1064fdd3088d582"
+
+[[package]]
+name = "firewall-policy-impact"
+version = "0.1.0"
+dependencies = [
+ "serde",
+ "serde_json",
+]
+
+[[package]]
+name = "fjall"
+version = "3.1.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "420a84699b8ccbb1ed573e38e88f4f23637b45beab6432066452f834be469c57"
+dependencies = [
+ "byteorder-lite",
+ "byteview",
+ "dashmap",
+ "flume",
+ "log",
+ "lsm-tree",
+ "tempfile",
+ "xxhash-rust",
+]
+
+[[package]]
+name = "flash-config-journal"
+version = "0.0.0"
+
+[[package]]
+name = "flume"
+version = "0.12.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5e139bc46ca777eb5efaf62df0ab8cc5fd400866427e56c68b22e414e53bd3be"
+dependencies = [
+ "spin",
+]
+
+[[package]]
+name = "fold"
+version = "0.0.1"
+dependencies = [
+ "anny",
+ "fjall",
+ "fxhash",
+ "postcard",
+ "serde",
+]
+
+[[package]]
+name = "foreign-types"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f6f339eb8adc052cd2ca78910fda869aefa38d22d5cb648e6485e4d3fc06f3b1"
+dependencies = [
+ "foreign-types-shared",
+]
+
+[[package]]
+name = "foreign-types-shared"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "00b0228411908ca8685dba7fc2cdd70ec9990a6e753e89b6ac91a84c40fbaf4b"
+
+[[package]]
+name = "form_urlencoded"
+version = "1.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cb4cb245038516f5f85277875cdaa4f7d2c9a0fa0468de06ed190163b1581fcf"
+dependencies = [
+ "percent-encoding",
+]
+
+[[package]]
+name = "fraud-velocity-evaluation"
+version = "0.1.0"
+
+[[package]]
+name = "freight-clearing"
+version = "0.1.0"
+dependencies = [
+ "serde",
+ "serde_json",
+ "sha2",
+ "tempfile",
+]
+
+[[package]]
+name = "futures-channel"
+version = "0.3.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "07bbe89c50d7a535e539b8c17bc0b49bdb77747034daa8087407d655f3f7cc1d"
+dependencies = [
+ "futures-core",
+]
+
+[[package]]
+name = "futures-core"
+version = "0.3.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7e3450815272ef58cec6d564423f6e755e25379b217b0bc688e295ba24df6b1d"
+
+[[package]]
+name = "futures-task"
+version = "0.3.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "037711b3d59c33004d3856fbdc83b99d4ff37a24768fa1be9ce3538a1cde4393"
+
+[[package]]
+name = "futures-util"
+version = "0.3.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "389ca41296e6190b48053de0321d02a77f32f8a5d2461dd38762c0593805c6d6"
+dependencies = [
+ "futures-core",
+ "futures-task",
+ "pin-project-lite",
+ "slab",
+]
+
+[[package]]
+name = "fxhash"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c31b6d751ae2c7f11320402d34e41349dd1016f8d5d45e48c4312bc8625af50c"
+dependencies = [
+ "byteorder",
+]
+
+[[package]]
+name = "generic-array"
+version = "0.14.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "85649ca51fd72272d7821adaf274ad91c288277713d9c18820d8499a7ff69e9a"
+dependencies = [
+ "typenum",
+ "version_check",
+]
+
+[[package]]
+name = "getrandom"
+version = "0.2.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ff2abc00be7fca6ebc474524697ae276ad847ad0a6b3faa4bcb027e9a4614ad0"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "wasi",
+]
+
+[[package]]
+name = "getrandom"
+version = "0.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "300e883d756b2e4ec94e02791f39b04b522276138852cfc41d9fb7e904106099"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "r-efi",
+]
+
+[[package]]
+name = "hash32"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b0c35f58762feb77d74ebe43bdbc3210f09be9fe6742234d573bacc26ed92b67"
+dependencies = [
+ "byteorder",
+]
+
+[[package]]
+name = "hashbrown"
+version = "0.14.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e5274423e17b7c9fc20b6e7e208532f9b19825d82dfd615708b70edd83df41f1"
+
+[[package]]
+name = "hashbrown"
+version = "0.16.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "841d1cc9bed7f9236f321df977030373f4a4163ae1a7dbfe1a51a2c1a51d9100"
+
+[[package]]
+name = "heapless"
+version = "0.7.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cdc6457c0eb62c71aac4bc17216026d8410337c4126773b9c5daba343f17964f"
+dependencies = [
+ "atomic-polyfill",
+ "hash32",
+ "rustc_version",
+ "serde",
+ "spin",
+ "stable_deref_trait",
+]
+
+[[package]]
+name = "heck"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2304e00983f87ffb38b55b444b5e3b60a884b5d30c0fca7d82fe33449bbe55ea"
+
+[[package]]
+name = "homecare-gap-fill"
+version = "0.1.0"
+dependencies = [
+ "chrono",
+ "fold",
+ "serde",
+]
+
+[[package]]
+name = "http"
+version = "1.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6970f50e31d6fc17d3fa27329444bfa74e196cf62e95052a3f6fee181dba6425"
+dependencies = [
+ "bytes",
+ "itoa",
+]
+
+[[package]]
+name = "http-body"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ca2a8f2913ee65f60facd6a5905613afaa448497a0230cc41ce022d93290bc2c"
+dependencies = [
+ "bytes",
+ "http",
+]
+
+[[package]]
+name = "http-body-util"
+version = "0.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e9f41fd6a08e4d4ec69df65976da761afd5ad5e58a9d4acb46bd1c953a9e3ff2"
+dependencies = [
+ "bytes",
+ "futures-core",
+ "http",
+ "http-body",
+ "pin-project-lite",
+]
+
+[[package]]
+name = "http-cache-revalidation"
+version = "0.1.0"
+
+[[package]]
+name = "httparse"
+version = "1.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6dbf3de79e51f3d586ab4cb9d5c3e2c14aa28ed23d180cf89b4df0454a69cc87"
+
+[[package]]
+name = "httpdate"
+version = "1.0.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "df3b46402a9d5adb4c86a0cf463f42e19994e3ee891101b1841f30a545cb49a9"
+
+[[package]]
+name = "hyper"
+version = "1.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "55281c53a1894c864990125767da440a4e630446785086f52523b20033b74498"
+dependencies = [
+ "atomic-waker",
+ "bytes",
+ "futures-channel",
+ "futures-core",
+ "http",
+ "http-body",
+ "httparse",
+ "httpdate",
+ "itoa",
+ "pin-project-lite",
+ "smallvec",
+ "tokio",
+]
+
+[[package]]
+name = "hyper-util"
+version = "0.1.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "96547c2556ec9d12fb1578c4eaf448b04993e7fb79cbaad930a656880a6bdfa0"
+dependencies = [
+ "bytes",
+ "http",
+ "http-body",
+ "hyper",
+ "pin-project-lite",
+ "tokio",
+ "tower-service",
+]
+
+[[package]]
+name = "incremental-syntax-highlighting"
+version = "0.1.0"
+dependencies = [
+ "serde",
+ "serde_json",
+]
+
+[[package]]
+name = "instrument-decoder-trial"
+version = "0.1.0"
+
+[[package]]
+name = "interval-heap"
+version = "0.0.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "11274e5e8e89b8607cfedc2910b6626e998779b48a019151c7604d0adcb86ac6"
+dependencies = [
+ "compare",
+]
+
+[[package]]
+name = "is_terminal_polyfill"
+version = "1.70.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a6cb138bb79a146c1bd460005623e142ef0181e3d0219cb493e02f7d08a35695"
+
+[[package]]
+name = "itoa"
+version = "1.0.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8f42a60cbdf9a97f5d2305f08a87dc4e09308d1276d28c869c684d7777685682"
+
+[[package]]
+name = "lab-unit-gate"
+version = "0.1.0"
+dependencies = [
+ "serde",
+ "serde_json",
+ "sha2",
+ "tempfile",
+]
+
+[[package]]
+name = "libc"
+version = "0.2.189"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3eaf3ede3fee6db1a4c2ee091bf8a8b4dccdc6d17f656fb07896ee72867612f2"
+
+[[package]]
+name = "linux-raw-sys"
+version = "0.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "32a66949e030da00e8c7d4434b251670a91556f4144941d37452769c25d58a53"
+
+[[package]]
+name = "lock_api"
+version = "0.4.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "224399e74b87b5f3557511d98dff8b14089b3dadafcab6bb93eab67d3aace965"
+dependencies = [
+ "scopeguard",
+]
+
+[[package]]
+name = "log"
+version = "0.4.33"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0ceec5bc11778974d1bcb055b18002eba7f4b3518b6a0081b3af5f21666da9ad"
+
+[[package]]
+name = "lsm-tree"
+version = "3.1.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "055a908d502129cf63bedae52f2db222e4436d2da32a69df9b84ac9fb9147761"
+dependencies = [
+ "byteorder-lite",
+ "byteview",
+ "crossbeam-skiplist",
+ "enum_dispatch",
+ "interval-heap",
+ "log",
+ "quick_cache",
+ "rustc-hash",
+ "self_cell",
+ "sfa",
+ "tempfile",
+ "varint-rs",
+ "xxhash-rust",
+]
+
+[[package]]
+name = "mailbox-mirror-lab"
+version = "0.1.0"
+dependencies = [
+ "clap",
+ "fold",
+ "serde",
+ "serde_json",
+ "tempfile",
+]
+
+[[package]]
+name = "matchit"
+version = "0.8.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "47e1ffaa40ddd1f3ed91f717a33c8c0ee23fff369e3aa8772b9605cc1d22f4c3"
+
+[[package]]
+name = "memchr"
+version = "2.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cf8baf1c55e62ffcace7a9f06f4bd9cd3f0c4beb022d3b367256b91b87513d98"
+
+[[package]]
+name = "midi-scheduler-rt-model"
+version = "0.1.0"
+
+[[package]]
+name = "mime"
+version = "0.3.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6877bb514081ee2a7ff5ef9de3281f14a4dd4bceac4c09388074a6b5df8a139a"
+
+[[package]]
+name = "minreq"
+version = "2.14.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "05015102dad0f7d61691ca347e9d9d9006685a64aefb3d79eecf62665de2153d"
+dependencies = [
+ "native-tls",
+]
+
+[[package]]
+name = "mio"
+version = "1.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "30d65c71f1ce40ab09135ce117d742b9f8a19ff91a41a8b57ed50bc2de59c427"
+dependencies = [
+ "libc",
+ "wasi",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "mixed-version-contract-gate"
+version = "0.1.0"
+dependencies = [
+ "serde",
+ "serde_json",
+]
+
+[[package]]
+name = "native-tls"
+version = "0.2.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "465500e14ea162429d264d44189adc38b199b62b1c21eea9f69e4b73cb03bbf2"
+dependencies = [
+ "libc",
+ "log",
+ "openssl",
+ "openssl-probe",
+ "openssl-sys",
+ "schannel",
+ "security-framework",
+ "security-framework-sys",
+ "tempfile",
+]
+
+[[package]]
+name = "num-traits"
+version = "0.2.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "071dfc062690e90b734c0b2273ce72ad0ffa95f0c74596bc250dcfd960262841"
+dependencies = [
+ "autocfg",
+]
+
+[[package]]
+name = "ocr-redaction-remap"
+version = "0.1.0"
+dependencies = [
+ "serde",
+ "serde_json",
+ "sha2",
+ "unicode-normalization",
+ "unicode-segmentation",
+]
+
+[[package]]
+name = "offline-door-policy-fit-probe"
+version = "0.1.0"
+dependencies = [
+ "fold",
+ "libc",
+ "serde",
+]
+
+[[package]]
+name = "offline-flag-parity"
+version = "0.1.0"
+dependencies = [
+ "serde",
+ "serde_json",
+]
+
+[[package]]
+name = "offline-reconciliation"
+version = "0.1.0"
+dependencies = [
+ "fold",
+ "serde",
+ "serde_json",
+]
+
+[[package]]
+name = "once_cell"
+version = "1.21.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9f7c3e4beb33f85d45ae3e3a1792185706c8e16d043238c593331cc7cd313b50"
+
+[[package]]
+name = "once_cell_polyfill"
+version = "1.70.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "384b8ab6d37215f3c5301a95a4accb5d64aa607f1fcb26a11b5303878451b4fe"
+
+[[package]]
+name = "openssl"
+version = "0.10.76"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "951c002c75e16ea2c65b8c7e4d3d51d5530d8dfa7d060b4776828c88cfb18ecf"
+dependencies = [
+ "bitflags",
+ "cfg-if",
+ "foreign-types",
+ "libc",
+ "once_cell",
+ "openssl-macros",
+ "openssl-sys",
+]
+
+[[package]]
+name = "openssl-macros"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a948666b637a0f465e8564c73e89d4dde00d72d4d473cc972f390fc3dcee7d9c"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "openssl-probe"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7c87def4c32ab89d880effc9e097653c8da5d6ef28e6b539d313baaacfbafcbe"
+
+[[package]]
+name = "openssl-sys"
+version = "0.9.112"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "57d55af3b3e226502be1526dfdba67ab0e9c96fc293004e79576b2b9edb0dbdb"
+dependencies = [
+ "cc",
+ "libc",
+ "pkg-config",
+ "vcpkg",
+]
+
+[[package]]
+name = "parcel-delta-tiles"
+version = "0.1.0"
+dependencies = [
+ "serde",
+ "serde_json",
+]
+
+[[package]]
+name = "parking_lot_core"
+version = "0.9.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2621685985a2ebf1c516881c026032ac7deafcda1a2c9b7850dc81e3dfcb64c1"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "redox_syscall",
+ "smallvec",
+ "windows-link",
+]
+
+[[package]]
+name = "parts-catalog-evolution"
+version = "0.1.0"
+dependencies = [
+ "axum",
+ "http-body-util",
+ "serde",
+ "serde_json",
+ "tokio",
+ "tower",
+]
+
+[[package]]
+name = "percent-encoding"
+version = "2.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9b4f627cb1b25917193a259e49bdad08f671f8d9708acfd5fe0a8c1455d87220"
+
+[[package]]
+name = "pin-project-lite"
+version = "0.2.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a89322df9ebe1c1578d689c92318e070967d1042b512afbe49518723f4e6d5cd"
+
+[[package]]
+name = "pkg-config"
+version = "0.3.33"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "19f132c84eca552bf34cab8ec81f1c1dcc229b811638f9d283dceabe58c5569e"
+
+[[package]]
+name = "postcard"
+version = "1.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6764c3b5dd454e283a30e6dfe78e9b31096d9e32036b5d1eaac7a6119ccb9a24"
+dependencies = [
+ "cobs",
+ "embedded-io 0.4.0",
+ "embedded-io 0.6.1",
+ "heapless",
+ "serde",
+]
+
+[[package]]
+name = "proc-macro2"
+version = "1.0.107"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "985e7ec9bb745e6ce6535b544d84d6cd6f7ad8bd711c398938ae983b91a766d9"
+dependencies = [
+ "unicode-ident",
+]
+
+[[package]]
+name = "provenance-revocation-reproducer"
+version = "0.1.0"
+dependencies = [
+ "fold",
+ "serde",
+ "serde_json",
+]
+
+[[package]]
+name = "purchase-audit-comparison"
+version = "0.1.0"
+dependencies = [
+ "fold",
+ "serde",
+]
+
+[[package]]
+name = "quick_cache"
+version = "0.6.24"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b9c6658afe513a3b484e3abfdaa0d03ef3c0bbf017542c178dd55f94eb3051f9"
+dependencies = [
+ "equivalent",
+ "hashbrown 0.16.1",
+]
+
+[[package]]
+name = "quote"
+version = "1.0.47"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1fbf4db142a473a8d80c26bbf18454ed458bf8d26c8219c331daecfdbd079001"
+dependencies = [
+ "proc-macro2",
+]
+
+[[package]]
+name = "r-efi"
+version = "6.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f8dcc9c7d52a811697d2151c701e0d08956f92b0e24136cf4cf27b57a6a0d9bf"
+
+[[package]]
+name = "reach-rollup-lab"
+version = "0.1.0"
+
+[[package]]
+name = "receiving-slot-admission"
+version = "0.1.0"
+dependencies = [
+ "fold",
+ "serde",
+]
+
+[[package]]
+name = "redox_syscall"
+version = "0.5.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ed2bf2547551a7053d6fdfafda3f938979645c44812fbfcda098faae3f1a362d"
+dependencies = [
+ "bitflags",
+]
+
+[[package]]
+name = "remittance-reconciliation"
+version = "0.1.0"
+dependencies = [
+ "serde",
+ "serde_json",
+]
+
+[[package]]
+name = "repair-cafe-fold-trial"
+version = "0.1.0"
+dependencies = [
+ "fold",
+ "libc",
+ "serde",
+]
+
+[[package]]
+name = "return-reconciler-trial1"
+version = "0.1.0"
+dependencies = [
+ "serde",
+ "serde_json",
+ "tempfile",
+]
+
+[[package]]
+name = "revision-safe-manual-search-trial"
+version = "0.1.0"
+dependencies = [
+ "fold",
+]
+
+[[package]]
+name = "ring"
+version = "0.17.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a4689e6c2294d81e88dc6261c768b63bc4fcdb852be6d1352498b114f61383b7"
+dependencies = [
+ "cc",
+ "cfg-if",
+ "getrandom 0.2.17",
+ "libc",
+ "untrusted",
+ "windows-sys 0.52.0",
+]
+
+[[package]]
+name = "rustc-hash"
+version = "2.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6b1e7f9a428571be2dc5bc0505c13fb6bf936822b894ec87abf8a08a4e51742d"
+
+[[package]]
+name = "rustc_version"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cfcb3a22ef46e85b45de6ee7e79d063319ebb6594faafcf1c225ea92ab6e9b92"
+dependencies = [
+ "semver",
+]
+
+[[package]]
+name = "rustix"
+version = "1.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6fe4565b9518b83ef4f91bb47ce29620ca828bd32cb7e408f0062e9930ba190"
+dependencies = [
+ "bitflags",
+ "errno",
+ "libc",
+ "linux-raw-sys",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "ryu"
+version = "1.0.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9774ba4a74de5f7b1c1451ed6cd5285a32eddb5cccb8cc655a4e50009e06477f"
+
+[[package]]
+name = "schannel"
+version = "0.1.29"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "91c1b7e4904c873ef0710c1f407dde2e6287de2bebc1bbbf7d430bb7cbffd939"
+dependencies = [
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "scopeguard"
+version = "1.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49"
+
+[[package]]
+name = "security-framework"
+version = "3.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b7f4bc775c73d9a02cde8bf7b2ec4c9d12743edf609006c7facc23998404cd1d"
+dependencies = [
+ "bitflags",
+ "core-foundation",
+ "core-foundation-sys",
+ "libc",
+ "security-framework-sys",
+]
+
+[[package]]
+name = "security-framework-sys"
+version = "2.17.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6ce2691df843ecc5d231c0b14ece2acc3efb62c0a398c7e1d875f3983ce020e3"
+dependencies = [
+ "core-foundation-sys",
+ "libc",
+]
+
+[[package]]
+name = "self_cell"
+version = "1.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2ab42ca02749e120097e328d91d415325bdf43b1c72c4c8badf37375fe40a813"
+
+[[package]]
+name = "semver"
+version = "1.0.28"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8a7852d02fc848982e0c167ef163aaff9cd91dc640ba85e263cb1ce46fae51cd"
+
+[[package]]
+name = "serde"
+version = "1.0.229"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4148590afebada386688f18773da617792bf2ef03ffc1e4cbd2b1d45b023e0ba"
+dependencies = [
+ "serde_core",
+ "serde_derive",
+]
+
+[[package]]
+name = "serde_core"
+version = "1.0.229"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "67dca2c9c51e58a4791a4b1ed58308b39c64224d349a935ab5039aa360942a48"
+dependencies = [
+ "serde_derive",
+]
+
+[[package]]
+name = "serde_derive"
+version = "1.0.229"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e7a5d71263a5a7d47b41f6b3f06ba276f10cc18b0931f1799f710578e2309348"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.3",
+]
+
+[[package]]
+name = "serde_json"
+version = "1.0.151"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c841b55ecdae098c80dcae9cf767f6f8a0c2cdb3416bbef72181df4d0fe73f14"
+dependencies = [
+ "itoa",
+ "memchr",
+ "serde",
+ "serde_core",
+ "zmij",
+]
+
+[[package]]
+name = "serde_path_to_error"
+version = "0.1.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "10a9ff822e371bb5403e391ecd83e182e0e77ba7f6fe0160b795797109d1b457"
+dependencies = [
+ "itoa",
+ "serde",
+ "serde_core",
+]
+
+[[package]]
+name = "serde_urlencoded"
+version = "0.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d3491c14715ca2294c4d6a88f15e84739788c1d030eed8c110436aafdaa2f3fd"
+dependencies = [
+ "form_urlencoded",
+ "itoa",
+ "ryu",
+ "serde",
+]
+
+[[package]]
+name = "sfa"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a1296838937cab56cd6c4eeeb8718ec777383700c33f060e2869867bd01d1175"
+dependencies = [
+ "byteorder-lite",
+ "log",
+ "xxhash-rust",
+]
+
+[[package]]
+name = "sha2"
+version = "0.10.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a7507d819769d01a365ab707794a4084392c824f54a7a6a7862f8c3d0892b283"
+dependencies = [
+ "cfg-if",
+ "cpufeatures",
+ "digest",
+]
+
+[[package]]
+name = "shlex"
+version = "2.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f8fadd59c855ef2080decdef8ff161eb6661b86933c9d82e5ba29dc602a55aba"
+
+[[package]]
+name = "slab"
+version = "0.4.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0c790de23124f9ab44544d7ac05d60440adc586479ce501c1d6d7da3cd8c9cf5"
+
+[[package]]
+name = "smallvec"
+version = "1.15.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8ed6a63f02c8539c91a8685a86f4099661ba3da017932f6ebbea6de3f0fa7c90"
+
+[[package]]
+name = "snapshot-gc-safety"
+version = "0.1.0"
+dependencies = [
+ "serde_json",
+]
+
+[[package]]
+name = "socket2"
+version = "0.6.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c3d1e2c7f27f8d4cb10542a02c49005dbd6e93095799d6f3be745fae9f8fedd4"
+dependencies = [
+ "libc",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "spin"
+version = "0.9.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3763264f6b73151db08c50ff20d7d8a0b8796e021cdea7ceedad07b80155fa0e"
+dependencies = [
+ "lock_api",
+]
+
+[[package]]
+name = "stable_deref_trait"
+version = "1.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6ce2be8dc25455e1f91df71bfa12ad37d7af1092ae736f3a6cd0e37bc7810596"
+
+[[package]]
+name = "strsim"
+version = "0.11.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7da8b5736845d9f2fcb837ea5d9e2628564b3b043a70948a3f0b778838c5fb4f"
+
+[[package]]
+name = "support-case-finder"
+version = "0.1.0"
+dependencies = [
+ "anny",
+ "ese",
+ "fold",
+ "serde",
+]
+
+[[package]]
+name = "syn"
+version = "2.0.119"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "872831b642d1a07999a962a351ed35b955ea2cfc8f3862091e2a240a84f17297"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
+[[package]]
+name = "syn"
+version = "3.0.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "53e9bae58849f64dfa4f5d5ae372c8341f7305f82a3868709269343628b659a3"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
+[[package]]
+name = "sync_wrapper"
+version = "1.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0bf256ce5efdfa370213c1dabab5935a12e49f2c58d15e9eac2870d3b4f27263"
+
+[[package]]
+name = "tempfile"
+version = "3.27.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "32497e9a4c7b38532efcdebeef879707aa9f794296a4f0244f6f69e9bc8574bd"
+dependencies = [
+ "fastrand",
+ "getrandom 0.4.3",
+ "once_cell",
+ "rustix",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "thiserror"
+version = "2.0.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "09a43598840e33d5b0331f38c5e30d13bb11c11210a4b58f0d9b18a5a5eefcd9"
+dependencies = [
+ "thiserror-impl",
+]
+
+[[package]]
+name = "thiserror-impl"
+version = "2.0.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "43cbfe0cf76104d42a574802844187e84a305e531ed54455f11fbde0f10541cd"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.3",
+]
+
+[[package]]
+name = "tinyvec"
+version = "1.12.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bb4ebadaa0af04fab11ae01eb5f9fdb5f9c5b875506e210e71c07873528baa7f"
+dependencies = [
+ "tinyvec_macros",
+]
+
+[[package]]
+name = "tinyvec_macros"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20"
+
+[[package]]
+name = "tokio"
+version = "1.53.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d988bcd52dbe076d3d46903332f58c912b87a2c49b1428419a5845154762ffee"
+dependencies = [
+ "libc",
+ "mio",
+ "pin-project-lite",
+ "socket2",
+ "tokio-macros",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "tokio-macros"
+version = "2.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6328af13490e73a9b4694030fafd93f8c8c6a9dede33e821c3fc63eddf8042ba"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "tower"
+version = "0.5.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ebe5ef63511595f1344e2d5cfa636d973292adc0eec1f0ad45fae9f0851ab1d4"
+dependencies = [
+ "futures-core",
+ "futures-util",
+ "pin-project-lite",
+ "sync_wrapper",
+ "tokio",
+ "tower-layer",
+ "tower-service",
+ "tracing",
+]
+
+[[package]]
+name = "tower-layer"
+version = "0.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "121c2a6cda46980bb0fcd1647ffaf6cd3fc79a013de288782836f6df9c48780e"
+
+[[package]]
+name = "tower-service"
+version = "0.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8df9b6e13f2d32c91b9bd719c00d1958837bc7dec474d94952798cc8e69eeec3"
+
+[[package]]
+name = "tracing"
+version = "0.1.44"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "63e71662fa4b2a2c3a26f570f037eb95bb1f85397f3cd8076caed2f026a6d100"
+dependencies = [
+ "log",
+ "pin-project-lite",
+ "tracing-core",
+]
+
+[[package]]
+name = "tracing-core"
+version = "0.1.36"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "db97caf9d906fbde555dd62fa95ddba9eecfd14cb388e4f491a66d74cd5fb79a"
+dependencies = [
+ "once_cell",
+]
+
+[[package]]
+name = "transparency-checkpoint-verifier"
+version = "0.1.0"
+dependencies = [
+ "ring",
+ "serde",
+ "serde_json",
+ "tempfile",
+]
+
+[[package]]
+name = "typenum"
+version = "1.20.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6f5e870be6c3b371b77fe0ee0bafb859fa4964b4404c27de1d380043c4dda20"
+
+[[package]]
+name = "undo-history-lab"
+version = "0.1.0"
+dependencies = [
+ "crc32fast",
+ "fold",
+ "serde",
+ "serde_json",
+ "tempfile",
+]
+
+[[package]]
+name = "unicode-general-category"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0b993bddc193ae5bd0d623b49ec06ac3e9312875fdae725a975c51db1cc1677f"
+
+[[package]]
+name = "unicode-ident"
+version = "1.0.24"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e6e4313cd5fcd3dad5cafa179702e2b244f760991f45397d14d4ebf38247da75"
+
+[[package]]
+name = "unicode-normalization"
+version = "0.1.25"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5fd4f6878c9cb28d874b009da9e8d183b5abc80117c40bbd187a1fde336be6e8"
+dependencies = [
+ "tinyvec",
+]
+
+[[package]]
+name = "unicode-segmentation"
+version = "1.13.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c6f5d3c3b1bf09027a88a6bc961fc00497d651009560b5463668dc81b0fa87a8"
+
+[[package]]
+name = "untrusted"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8ecb6da28b8a351d773b68d5825ac39017e680750f980f3a1a85cd8dd28a47c1"
+
+[[package]]
+name = "utf8parse"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "06abde3611657adf66d383f00b093d7faecc7fa57071cce2578660c9f1010821"
+
+[[package]]
+name = "varint-rs"
+version = "2.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bfa6c38708f6257f1ec2ca7e5a11f9bbf58a27d7060078b6b333624968183d96"
+
+[[package]]
+name = "vcpkg"
+version = "0.2.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "accd4ea62f7bb7a82fe23066fb0957d48ef677f6eeb8215f372f52e48bb32426"
+
+[[package]]
+name = "version_check"
+version = "0.9.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0b928f33d975fc6ad9f86c8f283853ad26bdd5b10b7f1542aa2fa15e2289105a"
+
+[[package]]
+name = "wasi"
+version = "0.11.1+wasi-snapshot-preview1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ccf3ec651a847eb01de73ccad15eb7d99f80485de043efb2f370cd654f4ea44b"
+
+[[package]]
+name = "water-repair"
+version = "0.1.0"
+dependencies = [
+ "libc",
+ "serde",
+ "serde_json",
+ "tempfile",
+]
+
+[[package]]
+name = "webhook-scheduler"
+version = "0.1.0"
+
+[[package]]
+name = "windows-link"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f0805222e57f7521d6a62e36fa9163bc891acd422f971defe97d64e70d0a4fe5"
+
+[[package]]
+name = "windows-sys"
+version = "0.52.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "282be5f36a8ce781fad8c8ae18fa3f9beff57ec1b52cb3de0789201425d9a33d"
+dependencies = [
+ "windows-targets",
+]
+
+[[package]]
+name = "windows-sys"
+version = "0.61.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ae137229bcbd6cdf0f7b80a31df61766145077ddf49416a728b02cb3921ff3fc"
+dependencies = [
+ "windows-link",
+]
+
+[[package]]
+name = "windows-targets"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9b724f72796e036ab90c1021d4780d4d3d648aca59e491e6b98e725b84e99973"
+dependencies = [
+ "windows_aarch64_gnullvm",
+ "windows_aarch64_msvc",
+ "windows_i686_gnu",
+ "windows_i686_gnullvm",
+ "windows_i686_msvc",
+ "windows_x86_64_gnu",
+ "windows_x86_64_gnullvm",
+ "windows_x86_64_msvc",
+]
+
+[[package]]
+name = "windows_aarch64_gnullvm"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "32a4622180e7a0ec044bb555404c800bc9fd9ec262ec147edd5989ccd0c02cd3"
+
+[[package]]
+name = "windows_aarch64_msvc"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "09ec2a7bb152e2252b53fa7803150007879548bc709c039df7627cabbd05d469"
+
+[[package]]
+name = "windows_i686_gnu"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8e9b5ad5ab802e97eb8e295ac6720e509ee4c243f69d781394014ebfe8bbfa0b"
+
+[[package]]
+name = "windows_i686_gnullvm"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0eee52d38c090b3caa76c563b86c3a4bd71ef1a819287c19d586d7334ae8ed66"
+
+[[package]]
+name = "windows_i686_msvc"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "240948bc05c5e7c6dabba28bf89d89ffce3e303022809e73deaefe4f6ec56c66"
+
+[[package]]
+name = "windows_x86_64_gnu"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "147a5c80aabfbf0c7d901cb5895d1de30ef2907eb21fbbab29ca94c5b08b1a78"
+
+[[package]]
+name = "windows_x86_64_gnullvm"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "24d5b23dc417412679681396f2b49f3de8c1473deb516bd34410872eff51ed0d"
+
+[[package]]
+name = "windows_x86_64_msvc"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "589f6da84c646204747d1270a2a5661ea66ed1cced2631d546fdfb155959f9ec"
+
+[[package]]
+name = "xxhash-rust"
+version = "0.8.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "aee1b19627c7c60102ab80d3a9cbe18de90bfe03bfa6c3715447681f0e8c8af6"
+
+[[package]]
+name = "zmij"
+version = "1.0.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "29666d0abbfad1e3dc4dcf6144730dd3a3ab225bbbdac83319345b1b44ccfc1b"
diff --git a/developer-simulation/Cargo.toml b/developer-simulation/Cargo.toml
new file mode 100644
index 0000000..6a870e0
--- /dev/null
+++ b/developer-simulation/Cargo.toml
@@ -0,0 +1,12 @@
+[workspace]
+resolver = "3"
+members = ["runs/*"]
+
+[workspace.package]
+edition = "2024"
+publish = false
+
+[profile.release]
+codegen-units = 1
+lto = "thin"
+strip = true
diff --git a/developer-simulation/DASHBOARD_TEMPLATE.md b/developer-simulation/DASHBOARD_TEMPLATE.md
new file mode 100644
index 0000000..2fa4b5b
--- /dev/null
+++ b/developer-simulation/DASHBOARD_TEMPLATE.md
@@ -0,0 +1,43 @@
+# BogKit simulated-developer dashboard
+
+<!-- bogkit-developer-simulation-dashboard -->
+
+This comment is the rolling index for the daily developer simulation lab.
+Detailed reports are appended as immutable PR comments.
+
+## Current totals
+
+- Trials:
+- Adopted:
+- Partially adopted:
+- No fit:
+- Blocked:
+
+## Coverage
+
+- Roles:
+- Domains:
+- BogKit components considered:
+
+## Confirmed defects
+
+None yet.
+
+## Recurring friction
+
+None yet.
+
+## Candidate improvements
+
+Suggestions appear here only after two independent trials, or after one serious
+reproducible correctness defect.
+
+None yet.
+
+## No-fit and positioning signals
+
+None yet.
+
+## Reports
+
+No runs yet.
diff --git a/developer-simulation/README.md b/developer-simulation/README.md
new file mode 100644
index 0000000..ecd9872
--- /dev/null
+++ b/developer-simulation/README.md
@@ -0,0 +1,99 @@
+# BogKit developer simulation lab
+
+This directory is a living research corpus for daily trials by simulated
+developers who encounter BogKit without prior product knowledge.
+
+The goal is product feedback, not example volume. Every trial begins with an
+existing software problem and asks whether BogKit makes the solution measurably
+better, clearer, or simpler. A trial may conclude that BogKit is not a good fit.
+
+## Boundaries
+
+- Daily work stays under `developer-simulation/`.
+- The automation never changes `fold`, `anny`, `ese`, existing examples, or
+  other BogKit files.
+- Core changes remain proposals until a maintainer explicitly approves them.
+- Prototypes contain no credentials, private data, generated build output,
+  large binary fixtures, or unjustified dependencies.
+- A failed integration is reduced to the smallest useful reproducer.
+
+## Daily protocol
+
+1. Sync the simulation branch with the latest `origin/main` without rewriting
+   history.
+2. Read `coverage.json` and prior reports. Select underexplored combinations of
+   developer role, domain, workload, constraints, and BogKit components.
+3. Ask a scenario designer that has not inspected BogKit to produce two
+   realistic briefs. Each brief must define:
+   - the developer's role and level of Rust experience;
+   - an existing system and its current approach;
+   - the concrete problem, constraints, and baseline;
+   - acceptance criteria and explicit non-goals.
+4. Give each brief to a fresh simulator in a sanitized checkout of current
+   `main`. The simulator starts at the public README and examples. It must not
+   read prior simulation runs before finishing its own attempt.
+5. Each simulator builds the smallest meaningful prototype, runs it, tests it,
+   and records its discovery and debugging trail. It may adopt part of BogKit
+   or reject the toolkit.
+6. A separate skeptical reviewer reproduces important claims, challenges
+   unnecessary choices, and rejects vague or unsupported recommendations.
+7. Archive accepted prototypes in `runs/`, write the daily synthesis in
+   `reports/`, update `coverage.json`, and validate the full corpus.
+8. Commit and push the evidence before adding the immutable daily PR comment
+   and updating the rolling dashboard comment.
+
+## Archive contract
+
+Runnable trials live at:
+
+```text
+runs/YYYY-MM-DD--short-slug/
+```
+
+Each runnable directory is a member of this nested Cargo workspace and includes
+its own README. Package names must be unique. Path dependencies point to the
+current BogKit checkout so the archived code exercises the branch being tested.
+
+Daily reports live at:
+
+```text
+reports/YYYY-MM-DD.md
+```
+
+The report follows `REPORT_TEMPLATE.md`. Exact commands and observed results are
+required. Performance claims require a stated baseline, release-mode runs, and
+enough repetitions to avoid presenting a one-off timing as a conclusion.
+
+## Finding policy
+
+Findings use one of these categories:
+
+- correctness defect
+- performance problem
+- API friction
+- documentation gap
+- missing capability
+- poor product fit
+
+Every finding includes evidence, severity, confidence, a reproduction path, and
+the smallest plausible improvement. Prefer documentation or examples before a
+new API, and a small API correction before a new subsystem.
+
+A feature suggestion becomes a dashboard candidate only when:
+
+- two independent trials encounter the same need; or
+- one trial demonstrates a serious reproducible correctness problem.
+
+One-off ideas remain observations.
+
+## Idempotency
+
+Each daily report and PR comment uses the marker:
+
+```text
+<!-- bogkit-developer-simulation:YYYY-MM-DD -->
+```
+
+If the dated report and comment already exist, a repeated run does nothing. If
+the branch evidence exists but the comment is missing, the coordinator posts
+the missing comment without generating new trials.
diff --git a/developer-simulation/REPORT_TEMPLATE.md b/developer-simulation/REPORT_TEMPLATE.md
new file mode 100644
index 0000000..251c2de
--- /dev/null
+++ b/developer-simulation/REPORT_TEMPLATE.md
@@ -0,0 +1,61 @@
+# Developer simulation — YYYY-MM-DD
+
+<!-- bogkit-developer-simulation:YYYY-MM-DD -->
+
+## Trial 1 — title
+
+- Persona:
+- Existing system:
+- Problem:
+- Outcome: adopted / partially adopted / no fit / blocked
+- BogKit components considered:
+- BogKit components used:
+
+### Evidence
+
+- Commands:
+- Tests:
+- Demonstration:
+- Baseline comparison:
+
+### Friction trail
+
+Record the order in which the developer discovered, attempted, misunderstood,
+debugged, and resolved each important step.
+
+### Findings
+
+For each finding include category, severity, confidence, reproduction, and the
+smallest plausible improvement.
+
+### Decision audit
+
+List consequential implementation choices, alternatives rejected, and choices
+the simulator is not confident about.
+
+## Trial 2 — title
+
+Use the same structure as Trial 1.
+
+## Skeptical review
+
+- Claims reproduced:
+- Claims rejected or softened:
+- Unnecessary code or dependencies removed:
+- Remaining uncertainty:
+
+## Cross-run synthesis
+
+- New evidence:
+- Recurring evidence:
+- Candidate improvements:
+- Observations not yet promoted:
+- No-fit or positioning signals:
+
+## Validation
+
+- Trial-specific tests:
+- Strict lint and formatting:
+- Runnable demonstrations:
+- BogKit root workspace tests:
+- Archive and secret checks:
diff --git a/developer-simulation/coverage.json b/developer-simulation/coverage.json
new file mode 100644
index 0000000..93dbd7d
--- /dev/null
+++ b/developer-simulation/coverage.json
@@ -0,0 +1,1037 @@
+{
+  "version": 1,
+  "purpose": "Track coverage and prevent repetitive or reverse-engineered BogKit scenarios.",
+  "selection_policy": {
+    "daily_trials": 2,
+    "allow_no_fit": true,
+    "prefer_underexplored_combinations": true,
+    "candidate_threshold": "two independent trials or one serious reproducible correctness defect"
+  },
+  "prior_submission_coverage": [
+    {
+      "project": "Area denial",
+      "domain": "location-based multiplayer game",
+      "roles": ["game backend developer"],
+      "components": ["fold"]
+    },
+    {
+      "project": "bog-bench",
+      "domain": "agent tooling observability",
+      "roles": ["developer tools engineer"],
+      "components": ["fold"]
+    },
+    {
+      "project": "Obsidian base views",
+      "domain": "local-first knowledge interface",
+      "roles": ["desktop application developer"],
+      "components": ["fold"]
+    },
+    {
+      "project": "tompkins-audio-search",
+      "domain": "multimodal archive search",
+      "roles": ["media data engineer"],
+      "components": ["fold", "ese", "anny"]
+    },
+    {
+      "project": "seance",
+      "domain": "time-travel repository search",
+      "roles": ["developer tools engineer"],
+      "components": ["fold", "ese", "anny"]
+    },
+    {
+      "project": "MUDGarden",
+      "domain": "persistent simulated world",
+      "roles": ["game and agent systems developer"],
+      "components": ["fold"]
+    },
+    {
+      "project": "Untitled Mobile FPS",
+      "domain": "mobile multiplayer game",
+      "roles": ["mobile and game backend developer"],
+      "components": ["fold", "ese", "anny"]
+    }
+  ],
+  "underexplored_domains": [
+    "business workflow and audit",
+    "build and deployment infrastructure",
+    "edge telemetry and operations",
+    "embedded or resource-constrained software",
+    "data synchronization",
+    "fraud and anomaly detection",
+    "scheduling and marketplaces",
+    "ordinary CRUD systems with uncertain fit"
+  ],
+  "runs": [
+    {
+      "date": "2026-07-28",
+      "slug": "purchase-audit",
+      "persona": "finance software developer, intermediate Rust",
+      "domain": "business workflow and audit",
+      "constraints": [
+        "PostgreSQL remains source of truth",
+        "state and audit event require one transaction",
+        "role-protected seven-year audit retention"
+      ],
+      "components_considered": ["fold", "ese", "anny"],
+      "components_used": ["fold"],
+      "outcome": "no_fit",
+      "report": "reports/2026-07-28.md"
+    },
+    {
+      "date": "2026-07-28",
+      "slug": "offline-reconciliation",
+      "persona": "warehouse device developer, Rust beginner",
+      "domain": "data synchronization",
+      "constraints": [
+        "PostgreSQL remains source of truth",
+        "horizontally deployed API",
+        "duplicate, reordered, and interrupted uploads",
+        "no trusted cross-device clock"
+      ],
+      "components_considered": ["fold"],
+      "components_used": ["fold"],
+      "outcome": "local_proof_only_no_production_fit",
+      "report": "reports/2026-07-28.md"
+    },
+    {
+      "date": "2026-07-29",
+      "slug": "edge-spool-pressure",
+      "persona": "site reliability engineer, intermediate Rust",
+      "domain": "edge telemetry and operations",
+      "constraints": [
+        "strict 256 MiB allocated spool limit",
+        "64 MiB available memory",
+        "priority-preserving retention and explainable drops",
+        "process interruption during writes and uploads"
+      ],
+      "components_considered": ["fold", "ese", "anny"],
+      "components_used": ["fold"],
+      "outcome": "no_fit",
+      "report": "reports/2026-07-29.md"
+    },
+    {
+      "date": "2026-07-29",
+      "slug": "flash-config-journal",
+      "persona": "embedded controls developer, beginner-to-intermediate Rust",
+      "domain": "embedded or resource-constrained software",
+      "constraints": [
+        "128 KiB raw NOR flash with 4 KiB erase blocks",
+        "16 KiB working-memory target",
+        "power loss after any modeled written byte",
+        "bounded boot scan and wear distribution"
+      ],
+      "components_considered": ["fold", "ese", "anny"],
+      "components_used": [],
+      "outcome": "no_fit",
+      "report": "reports/2026-07-29.md"
+    },
+    {
+      "date": "2026-07-30",
+      "slug": "ci-lease-coordinator",
+      "persona": "CI platform engineer, intermediate Rust",
+      "domain": "build and deployment infrastructure",
+      "constraints": [
+        "three concurrently active coordinator replicas",
+        "duplicate, reordered, and late worker messages",
+        "100 post-acknowledgment process exits",
+        "100,000 queued jobs and 2,000 updates per second"
+      ],
+      "components_considered": ["fold", "ese", "anny"],
+      "components_used": ["fold"],
+      "outcome": "no_fit",
+      "report": "reports/2026-07-30.md"
+    },
+    {
+      "date": "2026-07-30",
+      "slug": "fraud-velocity-evaluation",
+      "persona": "fraud infrastructure developer, Rust beginner",
+      "domain": "fraud and anomaly detection",
+      "constraints": [
+        "four consumer replicas with partition reassignment",
+        "event-time windows with deterministic linked corrections",
+        "atomic durable-stream offset ownership",
+        "verified customer deletion and exact alert explanations"
+      ],
+      "components_considered": ["fold", "ese", "anny"],
+      "components_used": [],
+      "outcome": "no_fit",
+      "report": "reports/2026-07-30.md"
+    },
+    {
+      "date": "2026-07-31",
+      "slug": "homecare-gap-fill",
+      "persona": "scheduling-platform developer, intermediate Rust",
+      "domain": "home-care scheduling and dispatch",
+      "constraints": [
+        "SQLite remains authoritative",
+        "20,000 caregivers and 120,000 visits over 14 days",
+        "200 cancellation changes per second with stable assignments",
+        "deterministic explanations, restart recovery, and explicit time offsets"
+      ],
+      "components_considered": ["fold", "ese", "anny"],
+      "components_used": ["fold"],
+      "outcome": "no_fit",
+      "report": "reports/2026-07-31.md"
+    },
+    {
+      "date": "2026-07-31",
+      "slug": "parts-catalog-evolution",
+      "persona": "wholesale catalog backend developer, beginner-to-intermediate Rust",
+      "domain": "ordinary CRUD and runtime schema evolution",
+      "constraints": [
+        "existing SQLite file and HTTP shapes remain authoritative",
+        "250,000 products with category-specific nested attributes",
+        "conditional edits and resumable bulk import",
+        "single 512 MiB VM and storage below 1.5 times baseline"
+      ],
+      "components_considered": ["fold", "ese", "anny"],
+      "components_used": [],
+      "outcome": "no_fit",
+      "report": "reports/2026-07-31.md"
+    },
+    {
+      "date": "2026-08-01",
+      "slug": "offline-flag-parity",
+      "persona": "client-platform SDK developer, Rust beginner with production TypeScript experience",
+      "domain": "offline feature-flag evaluation and configuration admission",
+      "constraints": [
+        "5,000 flags and 50,000 ordered targeting rules",
+        "cross-implementation deterministic decisions and explanations",
+        "failed reload preserves the active in-process snapshot",
+        "64 MiB measured process-memory target and 250 microsecond p95 target"
+      ],
+      "components_considered": ["fold", "ese", "anny"],
+      "components_used": [],
+      "outcome": "no_fit",
+      "report": "reports/2026-08-01.md"
+    },
+    {
+      "date": "2026-08-01",
+      "slug": "cnc-job-bundle-preflight",
+      "persona": "manufacturing software engineer, intermediate Rust",
+      "domain": "offline manufacturing job-bundle validation and staging",
+      "constraints": [
+        "untrusted classic stored-ZIP subset with deterministic diagnostics",
+        "1,000 declared files and a streamed 2 GiB sparse-member check",
+        "32 MiB measured process-memory target",
+        "no final ready name until a complete rechecked copy succeeds"
+      ],
+      "components_considered": ["fold", "ese", "anny"],
+      "components_used": [],
+      "outcome": "no_fit",
+      "report": "reports/2026-08-01.md"
+    },
+    {
+      "date": "2026-08-02",
+      "slug": "carrier-label-ambiguity",
+      "persona": "fulfillment-platform engineer, intermediate Rust with strong TypeScript experience",
+      "domain": "fulfillment workflow and external purchase ambiguity",
+      "constraints": [
+        "carrier remains authoritative for charges and PostgreSQL for workflow state",
+        "20,000 shipments across 30 deterministic fault seeds",
+        "ambiguous timeouts, duplicate and reordered callbacks, and process exits",
+        "no automatic repurchase after an inconclusive carrier outcome"
+      ],
+      "components_considered": ["fold", "ese", "anny"],
+      "components_used": [],
+      "outcome": "no_fit",
+      "report": "reports/2026-08-02.md"
+    },
+    {
+      "date": "2026-08-02",
+      "slug": "snapshot-gc-safety",
+      "persona": "backup-tools maintainer, Rust beginner with production Python experience",
+      "domain": "backup retention and filesystem garbage-collection safety",
+      "constraints": [
+        "existing JSONL manifests and content-addressed blob layout remain authoritative",
+        "1,000,000 references across 10,000 manifests and 300,000 blobs",
+        "128 MiB measured process-memory target and bounded scratch space",
+        "cooperative publication lock, recoverable quarantine, and restart idempotence"
+      ],
+      "components_considered": ["fold", "ese", "anny"],
+      "components_used": [],
+      "outcome": "no_fit",
+      "report": "reports/2026-08-02.md"
+    },
+    {
+      "date": "2026-08-03",
+      "slug": "provenance-revocation-impact",
+      "persona": "release-security platform engineer, intermediate Rust",
+      "domain": "software supply-chain provenance and revocation impact",
+      "constraints": [
+        "PostgreSQL remains authoritative during continuous manifest ingestion",
+        "transitive revocation, missing manifests, duplicate edges, and malformed cycles",
+        "deterministic explanation paths and generation-safe publication",
+        "500,000-artifact and 5-million-edge scale target"
+      ],
+      "components_considered": ["fold", "ese", "anny"],
+      "components_used": ["fold"],
+      "outcome": "no_fit",
+      "report": "reports/2026-08-03.md"
+    },
+    {
+      "date": "2026-08-03",
+      "slug": "offline-door-policy-update",
+      "persona": "building-access systems developer, Rust beginner with production embedded-C experience",
+      "domain": "offline physical-access policy distribution",
+      "constraints": [
+        "fixed 16 MiB policy image and 4 MiB working-memory target",
+        "signed duplicated reordered skipped or truncated bundles",
+        "50,000 emergency revocations with monotonic versions",
+        "old-or-new recovery after every modeled 4 KiB flash write"
+      ],
+      "components_considered": ["fold", "ese", "anny"],
+      "components_used": ["fold"],
+      "outcome": "no_fit",
+      "report": "reports/2026-08-03.md"
+    },
+    {
+      "date": "2026-08-04",
+      "slug": "mixed-version-contract-gate",
+      "persona": "deployment-platform developer, intermediate Rust with production Go experience",
+      "domain": "mixed-version event-contract compatibility during rolling deployment",
+      "constraints": [
+        "300 services, 120 topics, 1,800 contracts, and 12,000 relationships",
+        "every permitted producer-consumer version pair evaluated deterministically",
+        "unsupported or malformed schema input must require review",
+        "five-second and 128 MiB one-process targets"
+      ],
+      "components_considered": ["fold", "ese", "anny"],
+      "components_used": [],
+      "outcome": "no_fit",
+      "report": "reports/2026-08-04.md"
+    },
+    {
+      "date": "2026-08-04",
+      "slug": "ocr-redaction-remap",
+      "persona": "public-records processing engineer, Rust beginner with production Python experience",
+      "domain": "OCR redaction remapping and publication safety",
+      "constraints": [
+        "5,000 page-streaming workload with 20 million scalars and 150,000 reviewed spans",
+        "ambiguous correspondence must conservatively cover or block",
+        "diagnostics must not contain OCR or matched text",
+        "controlled process resume and 64 MiB measured-memory target"
+      ],
+      "components_considered": ["fold", "ese", "anny"],
+      "components_used": [],
+      "outcome": "no_fit",
+      "report": "reports/2026-08-04.md"
+    },
+    {
+      "date": "2026-08-05",
+      "slug": "fastq-barcode-spill",
+      "persona": "sequencing-pipeline engineer, intermediate Rust with production Python experience",
+      "domain": "streaming genomic demultiplexing and bounded output fan-out",
+      "constraints": [
+        "one non-seekable pass over 1,000,000 paired FASTQ records",
+        "unique Hamming-distance-one correction with ambiguous ties",
+        "at most 24 sample output files open",
+        "no read or sample content in diagnostics and completion manifest only after validation"
+      ],
+      "components_considered": ["fold", "ese", "anny"],
+      "components_used": [],
+      "outcome": "no_fit",
+      "report": "reports/2026-08-05.md"
+    },
+    {
+      "date": "2026-08-05",
+      "slug": "parcel-delta-tiles",
+      "persona": "civic GIS platform developer, Rust beginner with production TypeScript experience",
+      "domain": "parcel geometry delta planning for map-tile invalidation",
+      "constraints": [
+        "authoritative old and new Polygon or MultiPolygon deltas without parcel-store access",
+        "closed-boundary tile contact with strict simple-topology admission",
+        "deterministic lexicographic plan and no partial output on invalid input",
+        "1,000 mixed edits with 200 vertices per line under five seconds and 256 MiB"
+      ],
+      "components_considered": ["fold", "ese", "anny"],
+      "components_used": [],
+      "outcome": "no_fit",
+      "report": "reports/2026-08-05.md"
+    },
+    {
+      "date": "2026-08-06",
+      "slug": "caldav-recurrence",
+      "persona": "CalDAV calendar maintainer, beginner-to-intermediate Rust",
+      "domain": "calendar recurrence and time-zone correctness",
+      "constraints": [
+        "SQLite remains authoritative",
+        "timed and all-day recurrence across DST gaps and folds",
+        "canonical overrides, deterministic ordering, and atomic publication",
+        "5,000 masters and 2,000,000 candidate occurrences"
+      ],
+      "components_considered": ["fold", "ese", "anny"],
+      "components_used": ["fold"],
+      "outcome": "no_fit",
+      "report": "reports/2026-08-06.md"
+    },
+    {
+      "date": "2026-08-06",
+      "slug": "http-cache-revalidation",
+      "persona": "edge reverse-proxy maintainer, intermediate Rust",
+      "domain": "HTTP cache revalidation and tag-purge safety",
+      "constraints": [
+        "separate metadata and content-addressed body authority",
+        "Vary-aware identity, freshness, stale-if-error, and single-flight revalidation",
+        "ordered tenant tag purges and modeled crash recovery",
+        "2,000,000 objects, 1,000,000 requests, and 100,000 purges"
+      ],
+      "components_considered": ["fold", "ese", "anny"],
+      "components_used": [],
+      "outcome": "no_fit",
+      "report": "reports/2026-08-06.md"
+    },
+    {
+      "date": "2026-08-07",
+      "slug": "localization-catalog-compiler",
+      "persona": "desktop build-tooling developer, intermediate Rust",
+      "domain": "localization catalog validation and deterministic compilation",
+      "constraints": [
+        "100,000 messages across 18 locales with nested fallbacks",
+        "missing plural branches, placeholder mismatches, invalid references, and duplicate IDs",
+        "offline CI with a 512 MiB memory limit and three-minute budget",
+        "complete source diagnostics and byte-for-byte deterministic runtime tables"
+      ],
+      "components_considered": ["fold", "ese", "anny"],
+      "components_used": [],
+      "outcome": "local_proof_only_no_production_fit",
+      "report": "reports/2026-08-07.md"
+    },
+    {
+      "date": "2026-08-07",
+      "slug": "webhook-scheduler",
+      "persona": "multi-tenant event-delivery backend developer, senior Rust",
+      "domain": "webhook delivery scheduling and external side-effect coordination",
+      "constraints": [
+        "200,000 events per hour across 10,000 tenants and 500 endpoints",
+        "per-endpoint ordering, tenant and endpoint rate limits, and bounded noisy-endpoint queues",
+        "at-least-once delivery across crashes with deterministic retry and dead-letter classification",
+        "fair recovery from a one-hour endpoint outage without retry storms"
+      ],
+      "components_considered": ["fold", "ese", "anny"],
+      "components_used": [],
+      "outcome": "no_fit",
+      "report": "reports/2026-08-07.md"
+    },
+    {
+      "date": "2026-08-08",
+      "slug": "remittance-reconciliation",
+      "persona": "revenue-cycle platform engineer, Rust beginner with production Java and SQL experience",
+      "domain": "medical remittance reconciliation and exact constrained assignment",
+      "constraints": [
+        "62,000 claim revisions and 50,000 remittance lines in one immutable nightly snapshot",
+        "exact integer-cent conservation with no silent double posting",
+        "deterministic output across ten input shuffles and complete uncertainty review",
+        "60-second four-core target with privacy-safe explanations"
+      ],
+      "components_considered": [
+        "fold",
+        "ese",
+        "anny"
+      ],
+      "components_used": [],
+      "outcome": "no_fit",
+      "report": "reports/2026-08-08.md"
+    },
+    {
+      "date": "2026-08-08",
+      "slug": "container-yard-planner",
+      "persona": "terminal-operating-system integration developer, Rust novice with production C# and SQL experience",
+      "domain": "advisory container-yard constraint planning",
+      "constraints": [
+        "48 bays by 6 rows with 1,050 to 1,300 containers and 40 to 120 ordered pickups",
+        "every intermediate move must satisfy capacity, weight, reefer, customs, maintenance, and hazardous-neighbor rules",
+        "deterministic replayable output with no executable partial plan",
+        "10-second target and at least 20 percent fewer relocations than nearest-legal-slot baseline"
+      ],
+      "components_considered": [
+        "fold",
+        "ese",
+        "anny"
+      ],
+      "components_used": [],
+      "outcome": "no_fit",
+      "report": "reports/2026-08-08.md"
+    },
+    {
+      "date": "2026-08-09",
+      "slug": "incremental-syntax-highlighting",
+      "persona": "desktop editor maintainer, three years of production Rust experience",
+      "domain": "incremental UTF-8 syntax highlighting and editor tooling",
+      "constraints": [
+        "exact equality with the authoritative full lexer after every valid edit",
+        "10 MiB and 200,000-line document with 2,000 deterministic edits",
+        "UTF-8 byte-coordinate safety and unchanged state after invalid edits",
+        "64 MiB incremental-index target and byte-for-byte reproducibility"
+      ],
+      "components_considered": [
+        "fold",
+        "ese",
+        "anny"
+      ],
+      "components_used": [],
+      "outcome": "no_fit",
+      "report": "reports/2026-08-09.md"
+    },
+    {
+      "date": "2026-08-09",
+      "slug": "firewall-policy-impact",
+      "persona": "network release-tooling engineer, Rust beginner with production Go experience",
+      "domain": "exact ordered firewall policy impact analysis",
+      "constraints": [
+        "exact first-match change regions and proposed-rule reachability",
+        "IPv4 and IPv6 policies with up to 50,000 ordered rules",
+        "deterministic replayable witnesses and no partial or stale verdict",
+        "15-second and 256 MiB target on the declared local machine"
+      ],
+      "components_considered": [
+        "fold",
+        "ese",
+        "anny"
+      ],
+      "components_used": [],
+      "outcome": "no_fit",
+      "report": "reports/2026-08-09.md"
+    },
+    {
+      "date": "2026-08-10",
+      "slug": "support-case-finder",
+      "persona": "customer-support platform developer, production TypeScript expert with six months of Rust experience",
+      "domain": "bilingual advisory duplicate-case retrieval beside authoritative PostgreSQL",
+      "constraints": [
+        "75,000 privacy-scrubbed English and Spanish cases with 2,000 daily changes",
+        "at least 72 percent recall at five on a private 200-query set and deterministic exact source references",
+        "2-core and 2 GiB CPU-only container with no query-time network access",
+        "failed refresh preserves the prior complete replaceable local index"
+      ],
+      "components_considered": [
+        "fold",
+        "ese",
+        "anny"
+      ],
+      "components_used": [
+        "fold",
+        "ese",
+        "anny"
+      ],
+      "outcome": "local_proof_only_no_production_fit",
+      "report": "reports/2026-08-10.md"
+    },
+    {
+      "date": "2026-08-10",
+      "slug": "repair-cafe-kiosk",
+      "persona": "repair-cafe volunteer developer, strong Python and SQL with intermediate Rust experience",
+      "domain": "offline single-writer tool-lending ledger and current inventory",
+      "constraints": [
+        "8,000 items, 1,200 borrowers, and 100,000 ordered historical events",
+        "atomic accepted-event and current-state updates with exact replay",
+        "fully offline single local data directory and 256 MiB process limit",
+        "embedded SQL baseline with familiar constraints, inspection, backup, and recovery"
+      ],
+      "components_considered": [
+        "fold",
+        "ese",
+        "anny"
+      ],
+      "components_used": [
+        "fold"
+      ],
+      "outcome": "no_fit",
+      "report": "reports/2026-08-10.md"
+    },
+    {
+      "date": "2026-08-11",
+      "slug": "cold-chain-repair",
+      "persona": "regional food-distributor platform engineer with six years of Python and one year of Rust",
+      "domain": "cold-chain incident-state repair from an authoritative NDJSON archive",
+      "constraints": [
+        "400 freezers and one million observations under 60 seconds and 384 MiB",
+        "exact event-time results under duplicates, late uploads, corrections, and backdated configurations",
+        "byte-identical canonical explanations across batch boundaries and retries",
+        "authoritative append-only archive with disposable derived state and tested process-exit boundaries"
+      ],
+      "components_considered": [
+        "fold",
+        "ese",
+        "anny"
+      ],
+      "components_used": [
+        "fold"
+      ],
+      "outcome": "no_fit",
+      "report": "reports/2026-08-11.md"
+    },
+    {
+      "date": "2026-08-11",
+      "slug": "receiving-slot-admission",
+      "persona": "warehouse-management backend engineer with eight years of TypeScript and PostgreSQL and three months of Rust",
+      "domain": "transactional receiving-dock slot admission across replicated services",
+      "constraints": [
+        "PostgreSQL remains authoritative for command state and audit in one transaction",
+        "six replicas, four-worker collision trials, and deterministic idempotent outcomes",
+        "hold, confirm, cancel, reschedule, and expiry decisions use injected database time",
+        "100000-command target of at least 250 per second and p95 below 40 ms on disposable PostgreSQL"
+      ],
+      "components_considered": [
+        "fold",
+        "ese",
+        "anny"
+      ],
+      "components_used": [
+        "fold"
+      ],
+      "outcome": "no_fit",
+      "report": "reports/2026-08-11.md"
+    },
+    {
+      "date": "2026-08-12",
+      "slug": "dns-change-gate",
+      "persona": "hosting-platform reliability engineer with seven years of Go and shell and four months of Rust",
+      "domain": "offline authoritative-DNS change admission over immutable master-file snapshots",
+      "constraints": [
+        "named-checkzone remains authoritative and the prototype is advisory only",
+        "10,000 zones and two million records per snapshot under a four-core Linux and 256 MiB target",
+        "exact deterministic parsing, comparison, policy evidence, and fail-closed expansion limits",
+        "contained immutable input trees and atomic complete-report publication"
+      ],
+      "components_considered": [
+        "fold",
+        "ese",
+        "anny"
+      ],
+      "components_used": [],
+      "outcome": "no_fit",
+      "report": "reports/2026-08-12.md"
+    },
+    {
+      "date": "2026-08-12",
+      "slug": "midi-scheduler-rt-model",
+      "persona": "production C++ audio developer with Rust Book experience and no shipped Rust callback",
+      "domain": "hard-real-time MIDI event scheduling for a desktop sequencer",
+      "constraints": [
+        "200,000 events, 50,000 tempo nodes, exact 960 PPQN conversion, and variable callback blocks",
+        "zero callback allocation, locks, system calls, logging, or panic with fixed-capacity overload handling",
+        "deterministic transport safety, duplicate-token rejection, and off-thread plan publication",
+        "10 million callback latency target with C++ retained unless every production safety gate is proved"
+      ],
+      "components_considered": [
+        "fold",
+        "ese",
+        "anny"
+      ],
+      "components_used": [],
+      "outcome": "no_fit",
+      "report": "reports/2026-08-12.md"
+    },
+    {
+      "date": "2026-08-13",
+      "slug": "multi-carrier-return-refund-reconciler",
+      "persona": "commerce-platform backend developer with seven years of TypeScript and PostgreSQL and four months of Rust",
+      "domain": "advisory multi-carrier return and refund reconciliation over an authoritative PostgreSQL snapshot",
+      "constraints": [
+        "25,000 returns, 40,000 parcels, 70,000 authorized lines, and 250,000 source events",
+        "exact integer-unit and integer-cent conservation with no automatic payment side effect",
+        "duplicate, conflicting, corrected, split-parcel, substituted-item, and ambiguous payment evidence",
+        "byte-identical complete-report publication with a 60-second and 512 MiB local target"
+      ],
+      "components_considered": [
+        "fold",
+        "ese",
+        "anny"
+      ],
+      "components_used": [],
+      "outcome": "no_fit",
+      "report": "reports/2026-08-13.md"
+    },
+    {
+      "date": "2026-08-13",
+      "slug": "municipal-water-meter-billing-repair",
+      "persona": "municipal-utility data engineer with nine years of SQL and Python and one year of Rust",
+      "domain": "offline water-meter billing repair from authoritative cumulative-reading exports",
+      "constraints": [
+        "100,000 service points, 120,000 meters, two million readings, and 200,000 billed intervals",
+        "exact register rollover, meter replacement, supersession, provenance, and adjustment-only output",
+        "input-order and batch independence with per-service fail-closed ambiguity",
+        "complete prior-report preservation across validation failure and real process exits"
+      ],
+      "components_considered": [
+        "fold",
+        "ese",
+        "anny"
+      ],
+      "components_used": [],
+      "outcome": "no_fit",
+      "report": "reports/2026-08-13.md"
+    },
+    {
+      "date": "2026-08-14",
+      "slug": "crash-safe-undo-history",
+      "persona": "vector-editor document-core maintainer with eight years of Swift and C++ and six months of Rust",
+      "domain": "crash-safe branching undo history for a local vector editor",
+      "constraints": [
+        "60,000 objects and 250,000 submitted actions with grouped edits, undo, redo, branching, and exact retry identity",
+        "canonical JSON remains the interchange format while acknowledged groups survive process exit",
+        "single writer with four read-only inspectors and a 20,000-group reversible compaction window",
+        "90-second, 256 MiB memory, 512 MiB storage, four-millisecond p95, and five-second reopen targets"
+      ],
+      "components_considered": [
+        "fold",
+        "ese",
+        "anny"
+      ],
+      "components_used": [
+        "fold"
+      ],
+      "outcome": "local_proof_only_no_production_fit",
+      "report": "reports/2026-08-14.md"
+    },
+    {
+      "date": "2026-08-14",
+      "slug": "epoch-safe-mailbox-mirror",
+      "persona": "desktop mail-sync maintainer with twelve years of Kotlin and SQLite and three months of Rust",
+      "domain": "epoch-safe disposable mailbox projection beside a remote authority",
+      "constraints": [
+        "80 mailboxes, 300,000 messages, and 600,000 decoded responses with duplicates and interrupted batches",
+        "exact UID-validity epoch isolation, stable identity lifecycle, cursor monotonicity, and atomic old-or-new visibility",
+        "one writer, eight concurrent readers, 384 MiB memory, and storage within 1.5 times SQLite",
+        "75-second processing, ten-millisecond count p95, five-second reopen, and deterministic recovery targets"
+      ],
+      "components_considered": [
+        "fold",
+        "ese",
+        "anny"
+      ],
+      "components_used": [
+        "fold"
+      ],
+      "outcome": "no_fit",
+      "report": "reports/2026-08-14.md"
+    },
+    {
+      "date": "2026-08-15",
+      "slug": "incremental-calculation-cache",
+      "persona": "financial-planning document-core maintainer with nine years of C# and eight months of Rust",
+      "domain": "offline incremental calculation cache for a large financial-planning workbook",
+      "constraints": [
+        "append-only authoritative journal with exact signed 128-bit formula and error semantics",
+        "one million populated cells and 2.4 million dependency edges across 160 worksheets",
+        "one writer and twelve readers with complete-generation visibility and deterministic snapshots",
+        "strict crash, disk, memory, initial-build, reopen, and batch-latency gates"
+      ],
+      "components_considered": [
+        "fold",
+        "ese",
+        "anny"
+      ],
+      "components_used": [
+        "fold"
+      ],
+      "outcome": "no_fit",
+      "report": "reports/2026-08-15.md"
+    },
+    {
+      "date": "2026-08-15",
+      "slug": "revision-safe-aircraft-manual-search",
+      "persona": "aircraft-maintenance tablet search maintainer with eleven years of Kotlin and four months of Rust",
+      "domain": "revision- and applicability-safe offline aircraft-maintenance manual retrieval",
+      "constraints": [
+        "2.4 million revisions with hard query-specific aircraft and effective-time eligibility",
+        "exact source evidence and zero ineligible or superseded results",
+        "sixteen readers during atomic offline generation updates with fixed reproducible model assets",
+        "strict memory, disk, build, latency, crash, determinism, and privacy gates"
+      ],
+      "components_considered": [
+        "fold",
+        "ese",
+        "anny"
+      ],
+      "components_used": [
+        "fold"
+      ],
+      "outcome": "no_fit",
+      "report": "reports/2026-08-15.md"
+    },
+    {
+      "date": "2026-08-16",
+      "slug": "causal-canvas-compaction",
+      "persona": "collaborative-canvas synchronization maintainer with seven years of TypeScript and Go and nine months of Rust",
+      "domain": "causal multi-writer canvas-history compaction and replay",
+      "constraints": [
+        "PostgreSQL remains authoritative while existing operation IDs, merge rules, and canonical JSON remain unchanged",
+        "five million operations across 100 documents with duplicates, causal reordering, and 30-day offline clients",
+        "complete-generation visibility, deterministic replay, bounded untrusted input, and exact conflicting-ID rejection",
+        "two CPU cores, one GiB memory, 40 percent retained-byte ceiling, and strict latency and reopen gates"
+      ],
+      "components_considered": [
+        "fold",
+        "ese",
+        "anny"
+      ],
+      "components_used": [
+        "fold"
+      ],
+      "outcome": "no_fit",
+      "report": "reports/2026-08-16.md"
+    },
+    {
+      "date": "2026-08-16",
+      "slug": "transparency-checkpoint-verifier",
+      "persona": "certificate-transparency monitor maintainer with eight years of Go and security operations and four months of Rust",
+      "domain": "offline cryptographic transparency-checkpoint verification and crash-safe advancement",
+      "constraints": [
+        "trusted Go and SQLite baseline with exact signed-checkpoint, proof, cursor, and decision semantics",
+        "eight million leaf hashes, 4,000 checkpoints, bounded envelopes, and 10,000 labeled adversarial cases",
+        "fail-closed verification, deterministic pending advancement, auditable raw proof bytes, and old-or-new publication",
+        "two CPU cores, 256 MiB memory, no network, and strict replay, p95, reopen, and malformed-input gates"
+      ],
+      "components_considered": [
+        "fold",
+        "ese",
+        "anny"
+      ],
+      "components_used": [],
+      "outcome": "no_fit",
+      "report": "reports/2026-08-16.md"
+    },
+    {
+      "date": "2026-08-17",
+      "slug": "corruption-resynchronizing-instrument-stream-decoder",
+      "persona": "laboratory gateway developer with nine years of C and C++ and two small Rust command-line tools",
+      "domain": "corruption-resynchronizing binary instrument stream decoding",
+      "constraints": [
+        "one million valid frames across 64 interleaved streams plus 25,000 deterministic damage cases",
+        "opaque payloads, exact marker-length-CRC proof, and immediate known-valid follower recovery",
+        "64 MiB process-memory ceiling, 8,192-byte per-stream retention bound, and no blocking I/O in consumption",
+        "chunk-independent deterministic output with 100,000 arbitrary-byte stress cases and strict throughput floors"
+      ],
+      "components_considered": [
+        "fold",
+        "ese",
+        "anny"
+      ],
+      "components_used": [],
+      "outcome": "no_fit",
+      "report": "reports/2026-08-17.md"
+    },
+    {
+      "date": "2026-08-17",
+      "slug": "mergeable-unique-installation-reach-rollups",
+      "persona": "analytics-infrastructure engineer with eight years of Kotlin and SQL and four months of Rust",
+      "domain": "bounded-memory mergeable unique-installation reach rollups",
+      "constraints": [
+        "12 million immutable records across 5,760 tenant-hour buckets and eight independently aggregated shards",
+        "2,880-observation accuracy matrix plus separately retained held-out evidence",
+        "portable byte-identical shard merge, duplicate idempotence, canonical output, and complete-file integrity",
+        "128 MiB candidate-memory ceiling, four-times exact-baseline reduction, and 1.5-times runtime ceiling"
+      ],
+      "components_considered": [
+        "fold",
+        "ese",
+        "anny"
+      ],
+      "components_used": [],
+      "outcome": "no_fit",
+      "report": "reports/2026-08-17.md"
+    },
+    {
+      "date": "2026-08-18",
+      "slug": "laboratory-unit-conversion-gate",
+      "persona": "healthcare-interface developer with eight years of Java and SQL and four months of Rust",
+      "domain": "exact laboratory-unit conversion admission",
+      "constraints": [
+        "authoritative PostgreSQL and Java conversion behavior with exact rational affine transforms and round-half-to-even",
+        "one million observations, 12,000 mappings, 20,000 generated arithmetic cases, and five full input shuffles",
+        "complete reference validation, bounded lines, stable privacy-safe reasons, and atomic canonical report publication",
+        "two CPU cores, 256 MiB memory, 30-second full-run target, and same-host Java comparison"
+      ],
+      "components_considered": [
+        "fold",
+        "ese",
+        "anny"
+      ],
+      "components_used": [],
+      "outcome": "no_fit",
+      "report": "reports/2026-08-18.md"
+    },
+    {
+      "date": "2026-08-18",
+      "slug": "freight-capacity-batch-clearing",
+      "persona": "freight-marketplace backend developer with six years of Ruby and PostgreSQL and five months of Rust",
+      "domain": "deterministic freight-capacity marketplace batch clearing",
+      "constraints": [
+        "PostgreSQL remains authoritative while advisory price-time clearing must ignore input order",
+        "650,000 orders across 5,000 markets with checked conservation, gross value, and a 645,000-fill cap",
+        "ten full shuffles, exact slow-reference comparison, bounded line reading, and atomic canonical proposal publication",
+        "two CPU cores, 512 MiB memory, 20-second full-run target, and same-host Ruby median comparison"
+      ],
+      "components_considered": [
+        "fold",
+        "ese",
+        "anny"
+      ],
+      "components_used": [],
+      "outcome": "no_fit",
+      "report": "reports/2026-08-18.md"
+    }
+  ],
+  "recurring_findings": [
+    {
+      "id": "document-storage-and-concurrency-boundaries",
+      "category": "documentation gap",
+      "independent_trial_count": 38,
+      "confidence": "high",
+      "candidate": true,
+      "summary": "The public onboarding should distinguish embedded source-of-truth use from external databases and calendar or cache body-store handoffs, external network authorities and cooperative filesystem protocols, horizontal or partitioned deployment, durable leases and ordered purges, strict disk quotas, raw-flash firmware and fixed controller images, atomic broker-offset ownership, exact recursive graph workloads, bounded stateless stream or geometry transformations, exact synchronous protocol framing, immutable externally mergeable partial-state batch rollups, exact numeric admission transforms, and deterministic one-shot market clearing that do not benefit from durable state.",
+      "smallest_improvement": "Add a concise component, storage, transaction, concurrency, operating-system, and hard-limit capability matrix.",
+      "sources": [
+        "purchase-audit",
+        "offline-reconciliation",
+        "edge-spool-pressure",
+        "flash-config-journal",
+        "ci-lease-coordinator",
+        "fraud-velocity-evaluation",
+        "homecare-gap-fill",
+        "parts-catalog-evolution",
+        "offline-flag-parity",
+        "cnc-job-bundle-preflight",
+        "carrier-label-ambiguity",
+        "snapshot-gc-safety",
+        "provenance-revocation-impact",
+        "offline-door-policy-update",
+        "mixed-version-contract-gate",
+        "ocr-redaction-remap",
+        "fastq-barcode-spill",
+        "parcel-delta-tiles",
+        "caldav-recurrence",
+        "http-cache-revalidation",
+        "support-case-finder",
+        "repair-cafe-kiosk",
+        "cold-chain-repair",
+        "receiving-slot-admission",
+        "dns-change-gate",
+        "midi-scheduler-rt-model",
+        "multi-carrier-return-refund-reconciler",
+        "municipal-water-meter-billing-repair",
+        "crash-safe-undo-history",
+        "epoch-safe-mailbox-mirror",
+        "incremental-calculation-cache",
+        "revision-safe-aircraft-manual-search",
+        "causal-canvas-compaction",
+        "transparency-checkpoint-verifier",
+        "corruption-resynchronizing-instrument-stream-decoder",
+        "mergeable-unique-installation-reach-rollups",
+        "laboratory-unit-conversion-gate",
+        "freight-capacity-batch-clearing"
+      ]
+    },
+    {
+      "id": "component-selective-project-scaffold",
+      "category": "API friction",
+      "independent_trial_count": 16,
+      "confidence": "high",
+      "candidate": true,
+      "summary": "Developers with Fold-only or no-component scenarios avoid the all-components starter or project scaffold because it adds unrelated crates and setup.",
+      "smallest_improvement": "Make project generation component-selective and keep the smallest Fold introduction free of unused ESE and ANNy dependencies.",
+      "sources": [
+        "purchase-audit",
+        "edge-spool-pressure",
+        "flash-config-journal",
+        "ci-lease-coordinator",
+        "mixed-version-contract-gate",
+        "ocr-redaction-remap",
+        "fastq-barcode-spill",
+        "parcel-delta-tiles",
+        "caldav-recurrence",
+        "http-cache-revalidation",
+        "repair-cafe-kiosk",
+        "receiving-slot-admission",
+        "dns-change-gate",
+        "midi-scheduler-rt-model",
+        "crash-safe-undo-history",
+        "incremental-calculation-cache"
+      ]
+    },
+    {
+      "id": "nameable-pipeline-and-reader-types",
+      "category": "API friction",
+      "independent_trial_count": 7,
+      "confidence": "high",
+      "candidate": true,
+      "summary": "Developers found composed pipeline and reader types difficult to name in ordinary reusable structs and helper signatures.",
+      "smallest_improvement": "Document type-alias, function-pointer, and ordinary helper-signature patterns for composed pipelines and readers; do not infer a new type-erasure subsystem.",
+      "sources": [
+        "ci-lease-coordinator",
+        "fraud-velocity-evaluation",
+        "homecare-gap-fill",
+        "support-case-finder",
+        "repair-cafe-kiosk",
+        "cold-chain-repair",
+        "receiving-slot-admission"
+      ]
+    },
+    {
+      "id": "fold-wtx-panic-writer-poisoning",
+      "category": "correctness defect",
+      "independent_trial_count": 2,
+      "confidence": "high",
+      "candidate": true,
+      "summary": "Catching a panic resumed by Fold's write transaction preserves committed data but poisons Fjall's single-writer lock, so every later write in the same process panics.",
+      "smallest_improvement": "Drop the underlying write transaction before resuming the user panic, then add Stream and KeyedStream regressions that prove rollback and a successful later write.",
+      "sources": [
+        "support-case-finder",
+        "epoch-safe-mailbox-mirror"
+      ]
+    },
+    {
+      "id": "fold-persisted-value-codec-panic",
+      "category": "correctness defect",
+      "independent_trial_count": 1,
+      "confidence": "high",
+      "candidate": true,
+      "summary": "Fold's public Serde bounds accept persisted value shapes that Postcard cannot deserialize, while internal unwraps turn the predictable incompatibility into a deterministic read-time panic after bytes have committed.",
+      "smallest_improvement": "Document Postcard-compatible Serde shapes at every persisted-value entry point and replace serialization and deserialization unwraps with recoverable typed errors where an API-compatible path exists.",
+      "sources": [
+        "cold-chain-repair"
+      ]
+    },
+    {
+      "id": "fold-fallible-storage-and-decode-apis",
+      "category": "API friction",
+      "independent_trial_count": 2,
+      "confidence": "high",
+      "candidate": true,
+      "summary": "Failure-aware consumers cannot handle several Fold open, keyspace, read, decode, commit, and checkpoint failures as typed errors because the convenience-only public paths panic.",
+      "smallest_improvement": "Add documented fallible variants for the existing storage and decoding boundaries while retaining convenience wrappers where useful.",
+      "sources": [
+        "causal-canvas-compaction",
+        "transparency-checkpoint-verifier"
+      ]
+    },
+    {
+      "id": "query-time-filtered-search",
+      "category": "missing capability",
+      "independent_trial_count": 2,
+      "confidence": "high",
+      "candidate": true,
+      "summary": "BM25 and HNSW expose global bounded candidate readers without a query-time predicate or allowed-key set, so post-filtering can lose the only eligible result below the candidate cutoff.",
+      "smallest_improvement": "First document that BM25 and HNSW return global candidates and that bounded post-filtering can lose eligible records; then evaluate a narrow allowed-key or predicate design without inferring a general search subsystem.",
+      "sources": [
+        "support-case-finder",
+        "revision-safe-aircraft-manual-search"
+      ]
+    },
+    {
+      "id": "ese-hermetic-model-assets",
+      "category": "documentation gap",
+      "independent_trial_count": 2,
+      "confidence": "high",
+      "candidate": true,
+      "summary": "Clean ESE builds fetch mutable model and tokenizer assets without documented identity, checksum verification, cache placement, language scope, or a preseeded offline workflow.",
+      "smallest_improvement": "Document model identity, language scope, cache location, and first-build network behavior; add a preseeded offline recipe and pin immutable asset revisions with checksum verification before considering model-selection APIs.",
+      "sources": [
+        "support-case-finder",
+        "revision-safe-aircraft-manual-search"
+      ]
+    }
+  ]
+}
diff --git a/developer-simulation/reports/2026-07-28.md b/developer-simulation/reports/2026-07-28.md
new file mode 100644
index 0000000..99fe2c6
--- /dev/null
+++ b/developer-simulation/reports/2026-07-28.md
@@ -0,0 +1,180 @@
+# Developer simulation — 2026-07-28
+
+<!-- bogkit-developer-simulation:2026-07-28 -->
+
+The inaugural run tested two practical systems selected before the scenario
+designer saw BogKit. Neither justified adding BogKit to the stated production
+architecture. That negative result is useful: both trials found a repeated
+onboarding gap around embedded storage, transaction boundaries, and
+single-writer deployment.
+
+## Trial 1 — Purchase-approval audit timeline
+
+- Persona: finance software developer with three years of Rust experience
+- Existing system: Rust and PostgreSQL purchase-request service
+- Problem: create a role-protected seven-year audit history in the same
+  transaction as each state mutation
+- Outcome: no fit
+- BogKit components considered: Fold, ESE, and ANNy
+- BogKit components used: Fold, only to reproduce the transaction boundary
+- Archive:
+  [`runs/2026-07-28--purchase-audit`](../runs/2026-07-28--purchase-audit)
+
+### Evidence
+
+- Eight tests passed, including a split-store partial-commit reproduction and
+  a retraction reproduction using real Fold.
+- Strict lint and source formatting checks passed.
+- The runnable comparison showed approved current state with only the older
+  create event after failure between the two stores.
+- The local in-memory baseline returned 10,000 events in 651–889 microseconds
+  across observed runs. This does not test PostgreSQL.
+
+### Friction trail
+
+The simulator started with the root README and starter example. The starter
+unexpectedly tried to build unused ESE and ANNy dependencies and download the
+embedding model. Source inspection then showed that Fold owns an embedded Fjall
+transaction; the chat example's atomic design makes Fold the source of truth.
+That cannot satisfy a mandatory PostgreSQL transaction boundary.
+
+### Findings
+
+1. **Poor product fit — critical, high confidence.** Fold cannot atomically
+   join the required PostgreSQL mutation, and replacing PostgreSQL is out of
+   scope. Smallest improvement: document the boundary; do not infer a new
+   PostgreSQL sink from one trial.
+2. **Scenario mismatch — high, high confidence.** A retractable `Bag` is not a
+   role-protected append-only audit table. This is intentional Fold behavior,
+   not a security defect.
+3. **Documentation gap — medium, high confidence.** The top-level description
+   does not surface embedded storage, external transaction limits, or the
+   single-writer architecture early.
+4. **Onboarding friction — medium, high confidence.** The starter declares ESE
+   and ANNy although its source uses only Fold, making the smallest example
+   depend on an embedding download.
+
+### Decision audit
+
+The PostgreSQL audit-table baseline was selected because it alone shares the
+required native transaction and role model. A Fold sidecar, Fold as source of
+truth, and a PostgreSQL outbox feeding Fold were rejected as partial-commit,
+requirement, or needless-duplication risks. ESE and ANNy were not applicable.
+
+## Trial 2 — Warehouse scanner offline reconciliation
+
+- Persona: warehouse device developer with six months of Rust experience
+- Existing system: offline SQLite scanners uploading current rows to a
+  Rust/PostgreSQL API
+- Problem: preserve duplicate, reordered, interrupted, and conflicting
+  operations without silent location loss
+- Outcome: useful local proof, no demonstrated BogKit advantage, no production
+  fit
+- BogKit components considered and used: Fold
+- Archive:
+  [`runs/2026-07-28--offline-reconciliation`](../runs/2026-07-28--offline-reconciliation)
+
+### Evidence
+
+- Seven tests passed: exact replay, divergent identity rejection, 128 shuffled
+  orders, interrupted retry, conflict visibility, checkpointed reopen, and a
+  20,000-operation threshold.
+- Strict lint and source formatting checks passed.
+- The demo exposed both conflicting locations and survived the synthetic
+  interruption after reopening.
+- Three release observations processed 20,000 synthetic operations in 54, 57,
+  and 76 milliseconds, all below five seconds.
+- No Fjall, SQLite, or PostgreSQL control was built. The snapshot scans and
+  recomputes all stored operations, so this does not demonstrate incremental
+  materialization value.
+
+### Friction trail
+
+The simulator read the public examples in order. Chat revealed single-owner
+writes; search revealed keyed replacement. The first online build failed DNS
+and succeeded offline. A caught-panic interruption rolled back state but
+printed a panic diagnostic and required reopening the writer. Strict lint then
+found and helped reduce an oversized diagnostic type.
+
+### Findings
+
+1. **Scenario data gap — critical, high confidence.** Device-local sequence and
+   timestamps cannot establish cross-device causality. The operation schema
+   needs a base revision or observed heads.
+2. **Poor product fit — high, high confidence.** The required source of truth
+   is horizontally deployed PostgreSQL; the proof uses an embedded
+   single-writer store.
+3. **Usage constraint — informational, high confidence.** Keyed upsert replaces
+   an existing value by design. The prototype safely implements
+   compare-and-reject with the existing transaction API; no new API is
+   proposed.
+4. **Test-harness caveat — informational, high confidence.** The synthetic
+   caught panic prints a diagnostic and reopens the store. It is not evidence
+   for a new recovery API.
+5. **Documentation gap — medium, high confidence.** The onboarding does not
+   quickly distinguish component, storage, and concurrency boundaries.
+
+### Decision audit
+
+The proof selected immutable identities, a conservative conflict frontier, and
+Fold as a convenient embedded transaction store. It rejected timestamp
+ordering and rejected Fold as the production source of truth. The evaluator
+softened the original “partial fit” claim because the proof did not compare a
+simpler store or use incremental projections.
+
+## Skeptical review
+
+- Claims reproduced: both transaction-boundary tests, all fifteen trial tests,
+  conflict output, strict lint, demos, and release threshold.
+- Claims rejected or softened:
+  - intentional retraction and serialized ordering are scenario mismatches, not
+    Fold defects;
+  - keyed replacement is a documented usage constraint, not high-severity API
+    friction;
+  - caught-panic reopen behavior is a harness caveat;
+  - the reconciliation proof shows no BogKit-specific performance or
+    incremental advantage.
+- Bloat rejected: no append-log terminal, insert-if-absent API, PostgreSQL
+  sink, or panic-recovery API is promoted from these trials.
+- Remaining uncertainty: no real PostgreSQL, crash, multi-process, permission,
+  concurrency, or production query-plan test was performed.
+
+## Cross-run synthesis
+
+### Candidate improvement
+
+Both independent trials had to inspect implementation or example internals to
+understand the same boundary. Add a concise public capability matrix covering:
+
+- embedded source-of-truth versus external database integration;
+- the transaction boundary;
+- the single-writer deployment shape;
+- which problems Fold, ESE, and ANNy each address.
+
+This is the only candidate promoted today because it met the two-trial
+threshold.
+
+### Observations not yet promoted
+
+- Remove unused ESE and ANNy dependencies from the starter example so the
+  smallest Fold introduction does not require the embedding model.
+- An immutable-event example could teach caller-side identity checks, but one
+  run is insufficient evidence for a new API.
+
+### No-fit and positioning signals
+
+Both scenarios kept PostgreSQL for fixed operational reasons. BogKit was
+strongest only when allowed to own embedded state. Public positioning should
+make that intended boundary easy to recognize so developers can select or
+reject the toolkit quickly.
+
+## Validation
+
+- Trial tests: 15 passed, 0 failed
+- Strict lint: passed with warnings denied
+- Formatting: all four archived Rust source files passed `rustfmt --check`
+- Runnable demonstrations: passed
+- Release threshold: 20,000 operations completed in 76 ms on final verification
+- BogKit root workspace tests: 45 unit and documentation tests passed
+- Generated archive check: no build output, databases, secrets, or binary
+  fixtures staged
diff --git a/developer-simulation/reports/2026-07-29.md b/developer-simulation/reports/2026-07-29.md
new file mode 100644
index 0000000..2a01765
--- /dev/null
+++ b/developer-simulation/reports/2026-07-29.md
@@ -0,0 +1,313 @@
+# Developer simulation — 2026-07-29
+
+<!-- bogkit-developer-simulation:2026-07-29 -->
+
+Two blind trials tested BogKit against operational limits that had not appeared
+in the archive: a strictly bounded edge-telemetry spool and raw-NOR firmware
+configuration storage. Both reached evidence-backed no-fit conclusions. The
+edge trial found useful Fold behavior before a hard disk-bound requirement
+failed. The firmware trial rejected BogKit before integration because its
+filesystem and allocation model does not match raw flash.
+
+## Trial 1 — Edge telemetry spool under disk pressure
+
+- Persona: site reliability engineer with intermediate Rust experience
+- Existing system: newline-delimited JSON files, whole-file retries, and
+  oldest-file deletion above a 256 MiB spool limit
+- Problem: preserve high-priority events, explain duplicates and drops, and
+  recover after process interruption without exceeding a hard allocated-disk
+  bound
+- Outcome: no fit for the strict disk bound
+- BogKit components considered: Fold, ESE, and ANNy
+- BogKit components used: Fold
+- Archive:
+  [`runs/2026-07-29--edge-spool-pressure`](../runs/2026-07-29--edge-spool-pressure)
+
+### Evidence
+
+- Commands:
+  - `cargo test -p edge-spool-pressure --all-targets --offline`
+  - `cargo clippy -p edge-spool-pressure --all-targets --offline -- -D warnings`
+  - `cargo run -p edge-spool-pressure --release --offline -- demo`
+- Tests: 10 passed, 0 failed.
+- Demonstration:
+  - The deterministic baseline modeled 1,000,000 events. It retained 770,212
+    and deleted 6,894 critical events under age-only deletion.
+  - The representative Fold run processed 20,000 events. It retained all 600
+    critical and 2,400 operational events, and durably accounted for every
+    debug drop in that run.
+  - After an interrupted write, the reopened store contained exactly the
+    pre-transaction event IDs.
+  - After an interrupted upload, all 120 retained IDs remained. The durable
+    intent reported 25 possible duplicates; the mock collector observed 7
+    actual duplicates after retry.
+  - Reopen and inspection took 4 ms on the host.
+- Baseline comparison:
+  - The newline-file model exposes one file-sized retry window of up to 12,064
+    events and cannot preserve critical traffic under age-only deletion.
+  - The Fold proof improved priority retention and duplicate explanation.
+  - It did not satisfy the hard disk requirement. A 1 MiB logical limit retained
+    1,048,512 logical bytes while the database allocated 3,305,472 bytes.
+  - The probe proves that logical accounting is not a physical cap and that the
+    evaluated public interface has no documented hard-cap guarantee. It does
+    not predict exact allocation at 256 MiB or test external filesystem quotas.
+
+### Friction trail
+
+The simulator began with the root README, then read the starter, time-series,
+chat, and search examples. It avoided the project generator because the
+scenario needed Fold but not ESE or ANNy. Fold's transactions, Bag ordering,
+aggregates, and durable state fit the accounting problem. Time-based retention
+did not express byte pressure or priority.
+
+The first online build failed to resolve the crates index and later succeeded
+with network access. A first implementation placed a complete Bag consistency
+scan on the write path; the simulator removed that diagnostic work before final
+measurement. Apparent file lengths were also misleading because the database
+uses sparse or preallocated files, so the final quota decision used allocated
+Unix blocks and was independently confirmed with `du`.
+
+### Findings
+
+1. **Baseline correctness defect — high severity, high confidence.** The
+   supplied age-only file policy deleted 6,894 modeled critical events.
+   Reproduction: run the `baseline` command. Smallest improvement: separate
+   priority budgets and record every eviction.
+2. **Baseline correctness defect — high severity, high confidence.** A
+   whole-file retry exposes the acknowledged prefix of a modeled 12,064-event
+   file to duplication without a durable intent or offset. This is not a
+   BogKit defect. Smallest improvement: persist the attempted batch or offset
+   before sending.
+3. **Documentation gap — medium severity, high confidence.** Public onboarding
+   does not state hard allocated-byte limits, compaction headroom, process
+   crash versus power-loss guarantees, or memory and thread bounds.
+   Reproduction: start at the README and examples, then build the quota probe.
+   Smallest improvement: document storage limits and durability boundaries.
+4. **Missing scenario capability — critical severity, high confidence for the
+   public guarantee gap.** The public interface has no documented hard
+   allocated-byte cap. Confidence is only medium for exact 256 MiB behavior
+   because that scale and external quotas were not tested. Smallest
+   improvement: document the unsupported boundary; add store-level controls
+   only if strict quotas are intended.
+5. **Prototype limitation — informational, high confidence.** The candidate
+   stage demonstrated roughly 2,200–2,500 events per second with its checkpoint
+   and verification work, below the 5,000-events-per-second burst in the brief.
+   Existing `Ranked` range scans were not evaluated, so the reviewer rejected
+   the original general performance claim and new range-scan proposal.
+6. **One-off API observation — informational, medium confidence.** The
+   prototype stores full events in upload intent so `Stream::remove` can retract
+   them. `KeyedStream` removes by key, and every durable intent needs some batch
+   representation. No API change is promoted.
+7. **Poor product fit — critical if selected, high confidence.** Useful
+   transaction and recovery evidence does not overcome the missing hard-cap
+   guarantee. Use a storage engine designed around a fixed ring or segment
+   budget.
+
+### Decision audit
+
+The simulator selected `Stream` and Bag to keep retained payloads in one
+iterable durable view, put priority first in serialization for deterministic
+ordering, and committed eviction with drop accounting. It recorded upload
+intent before delivery and cleared it with acknowledgement.
+
+It rejected time-based retention, count-based top-K retention, direct access to
+Fold's internal Fjall store, and a million-event Fold run after the quota
+prerequisite failed. The reviewer identified `Ranked` range scans as an
+untried alternative, so no range API or general Fold performance conclusion is
+retained.
+
+Unresolved: exact 256 MiB allocation, external quotas, sustained burst ingest,
+one-million-event Fold behavior, power loss, commit interruption inside the
+storage engine, compaction cycles, background threads, real HTTP buffering, and
+schema-order stability.
+
+## Trial 2 — Power-fail-safe raw-NOR configuration journal
+
+- Persona: embedded controls developer with beginner-to-intermediate Rust
+  experience
+- Existing system: one CBOR configuration blob and checksum overwritten in
+  place on 128 KiB of reserved NOR flash
+- Problem: keep either the complete old or new 2–24 KiB configuration after
+  power interruption, with bounded scan, memory, and wear
+- Outcome: no fit
+- BogKit components considered: Fold, ESE, and ANNy
+- BogKit components used: none
+- Archive:
+  [`runs/2026-07-29--flash-config-journal`](../runs/2026-07-29--flash-config-journal)
+
+### Evidence
+
+- Commands:
+  - `cargo test -p flash-config-journal --all-targets --offline -- --nocapture`
+  - `cargo clippy -p flash-config-journal --all-targets --offline -- -D warnings`
+  - `cargo run -p flash-config-journal --offline`
+- Tests: 5 passed, 0 failed.
+- Demonstration:
+  - The single-slot baseline loses its only valid configuration after a modeled
+    interrupted erase.
+  - The circular journal audited all 6,177 modeled write boundaries for one
+    2 KiB update and all 53,281 for one 24 KiB update. Every boundary booted the
+    complete old or complete new revision.
+  - Deterministic corruption of revision 101 made the file-backed emulator
+    recover complete revision 100.
+  - The image is exactly 131,072 bytes and every boot scan reads 32 block
+    starts.
+  - A test of 10,000 fixed 2 KiB updates produced 312–313 erases per block, a
+    0.32% imbalance.
+- Baseline comparison:
+  - A checksum detects the supplied in-place baseline's damage but cannot
+    recover the overwritten old value.
+  - The dependency-free reference journal keeps the active record untouched
+    until a final one-way commit byte publishes its replacement.
+  - Fold was rejected because its public entry point opens a filesystem-backed
+    Fjall database and does not expose raw read/program/erase operations,
+    `no_std`, fixed whole-stack memory, wear accounting, or a 32-block recovery
+    bound.
+
+### Friction trail
+
+The simulator began with the root README and starter example. The example's
+filesystem path established that BogKit persistence targets a host application
+database. Fold's crate documentation later described Fjall as “embedded,” but
+public onboarding did not define the operating-system, filesystem, allocator,
+or firmware boundary near its persistence claims.
+
+The simulator inspected all public examples and Fold's stream implementation,
+then avoided the all-components project scaffold and built a dependency-free
+reference journal. Formatting and strict lint each found one ordinary issue
+that was fixed before the final run.
+
+### Findings
+
+1. **Baseline correctness defect — critical severity, high confidence.** The
+   supplied in-place single-slot strategy can lose its only valid record after
+   an interrupted erase. This is not a BogKit defect. Reproduction: run
+   `baseline_single_blob_has_a_boundary_with_no_valid_configuration`. Smallest
+   improvement: keep the active copy until the replacement is checked and
+   committed.
+2. **API friction — medium severity under constrained builds, high
+   confidence.** The project scaffold adds Fold, ESE, ANNy, and Serde even when
+   a scenario needs fewer or no components. Reproduction: inspect
+   `scripts/new-project.sh`. Smallest improvement: make generation
+   component-selective.
+3. **Documentation gap — medium severity, high confidence.** Public onboarding
+   does not state the `std`, filesystem, allocator, and firmware boundaries
+   near persistence claims. The root README does not claim firmware support.
+   Smallest improvement: describe Fold as an in-process, filesystem-backed
+   database for `std` targets and list unsupported firmware constraints.
+4. **Missing capability — critical for this scenario, high confidence.** No raw
+   NOR interface, fixed recovery-I/O bound, `no_std` feature, erase geometry,
+   wear accounting, or fixed whole-stack memory contract appears in the
+   inspected public surface. Smallest improvement: document raw flash and
+   `no_std` as unsupported. A real capability would require a separate storage
+   engine.
+5. **Poor product fit — critical if selected, high confidence.** Fold
+   incrementally materializes application data in an LSM store. The controller
+   replaces one bounded opaque blob across 32 known erase blocks. Do not treat a
+   host filesystem transaction as a raw-NOR transaction.
+
+### Decision audit
+
+The simulator selected a whole-record circular journal, variable contiguous
+block runs, payload-first/header-second/commit-last publication, CRC-32,
+monotonic revisions, and streaming input with a declared final length.
+
+It rejected the existing single slot, two fixed slots with concentrated wear,
+Fold/Fjall, CBOR encoding inside the journal, and extra filesystem or checksum
+dependencies.
+
+The 1,024-byte value in the prototype is an explicit-buffer design budget, not
+a measured or mechanically enforced whole-stack bound. Host scan observations
+remained below 50 ms but varied across runs and do not prove MCU timing. Wear
+coverage is limited to fixed 2 KiB updates. Intermediate-size crash boundaries,
+mixed-size wear, real NOR interruption, bad blocks, endurance, rollover, read
+disturb, CRC collision, production encoding, and firmware stack use remain
+unresolved.
+
+## Skeptical review
+
+- Claims reproduced:
+  - all 10 edge tests, the million-event baseline, both process-exit cases, the
+    1 MiB logical-versus-allocated quota gap, full demo, and sampled host RSS;
+  - all 5 flash tests, the baseline failure, all 59,458 modeled byte boundaries,
+    the fixed-size wear test, and the file-backed corruption fallback.
+- Claims rejected or softened:
+  - baseline failures are not BogKit defects;
+  - the 1 MiB edge probe does not predict exact 256 MiB behavior;
+  - host RSS, recovery, scan, and stack observations are not production or
+    hardware guarantees;
+  - the edge linear-scan claim and proposed range API were rejected because
+    existing `Ranked` scans were not tried;
+  - flash wear evidence covers fixed 2 KiB updates, not mixed sizes.
+- Unnecessary code or dependencies removed: none. Edge uses Fold and Serde;
+  flash remains dependency-free. The standalone workspace boundary and
+  pre-archive paths were removed during relocation.
+- Remaining uncertainty: production storage, process, throughput, hardware,
+  and firmware behavior listed in each trial's decision audit.
+
+## Cross-run synthesis
+
+### New evidence
+
+Fold's atomic transactions, durable intent, and persistent views were useful
+for a representative edge spool, but they did not provide the fixed allocated
+disk guarantee the scenario required. The raw-NOR trial correctly rejected
+BogKit before integration.
+
+### Recurring evidence
+
+Four independent trials now needed source or example inspection to determine
+storage ownership, transaction, deployment, operating-system, or hard-limit
+boundaries.
+
+Three independent trials encountered the all-components starter or project
+scaffold while needing only Fold or no BogKit component.
+
+### Candidate improvements
+
+1. Expand the existing public capability matrix candidate to cover component
+   purpose, storage ownership, transaction scope, horizontal deployment,
+   filesystem and `std` requirements, strict quotas, and raw-flash non-goals.
+2. Make the project scaffold component-selective and keep the smallest Fold
+   introduction free of unused ESE and ANNy dependencies.
+
+Both meet the independent-trial threshold. Neither implies a new storage
+engine or core API.
+
+### Observations not yet promoted
+
+- Hard allocated-byte quota controls
+- Raw NOR support
+- Remove-by-key iteration changes
+- New range primitives
+
+These remain one-off ideas. Existing `Ranked` scans must be evaluated before
+any edge range proposal.
+
+### No-fit and positioning signals
+
+BogKit is strongest when it may own filesystem-backed application state and
+its storage engine's operational envelope is acceptable. A developer should be
+able to reject it quickly for external transactions, strict physical quotas,
+raw devices, or firmware targets without reading implementation details.
+
+## Validation
+
+- Trial-specific tests: 15 passed, 0 failed across the two new prototypes.
+- Strict lint and formatting: targeted formatting passed for all four archived
+  prototypes; the nested workspace passed Clippy with warnings denied. A
+  repository-wide format check found pre-existing differences in
+  `examples/search/src/main.rs`; the lab did not modify that file.
+- Runnable demonstrations:
+  - edge full release demo passed in 11.95 seconds on final verification;
+  - flash file-backed demo reopened revision 101, rejected it after
+    deterministic corruption, and recovered complete revision 100.
+- Nested lab workspace tests: 30 passed, 0 failed.
+- BogKit root workspace tests: 33 unit tests and 12 documentation tests passed,
+  0 failed. The first offline attempt could not download ESE's required model;
+  the required network-enabled rerun passed.
+- Archive and secret checks: changed paths are confined to
+  `developer-simulation/`; no generated build output, database, binary, large
+  fixture, credential pattern, or private key was found in the dated archive.
+- Diff and ledger checks: `git diff --check` and `jq empty coverage.json`
+  passed.
diff --git a/developer-simulation/reports/2026-07-30.md b/developer-simulation/reports/2026-07-30.md
new file mode 100644
index 0000000..8451ade
--- /dev/null
+++ b/developer-simulation/reports/2026-07-30.md
@@ -0,0 +1,302 @@
+# Developer simulation — 2026-07-30
+
+<!-- bogkit-developer-simulation:2026-07-30 -->
+
+Two blind trials tested underexplored distributed-system boundaries: durable CI
+job leasing across three active coordinators, and explainable payment-velocity
+screening across four partitioned consumers. Both reached reviewed no-fit
+conclusions. The prototypes produced useful local evidence, but neither
+demonstrated the required replicated authority and stream-ownership model.
+
+## Trial 1 — Crash-safe CI job leasing
+
+- Persona: CI platform engineer with intermediate Rust experience
+- Existing system: an in-memory build queue with periodic JSON snapshots,
+  30-second worker leases, and immutable object-store results
+- Problem: preserve dependency readiness, attempt fencing, and explainable
+  retry decisions across crashes, duplicate messages, and three concurrently
+  active coordinator replicas
+- Outcome: no fit
+- BogKit components considered: Fold, ESE, and ANNy
+- BogKit components used: Fold
+- Archive:
+  [`runs/2026-07-30--ci-lease-coordinator`](../runs/2026-07-30--ci-lease-coordinator)
+
+### Evidence
+
+- Commands:
+  - `cargo test -p ci-lease-coordinator --all-targets --offline`
+  - `cargo clippy -p ci-lease-coordinator --all-targets --offline --no-deps -- -D warnings`
+  - `cargo run --release -p ci-lease-coordinator --offline -- demo`
+  - `cargo run --release -p ci-lease-coordinator --offline -- bench /tmp/bogkit-ci-lease-benchmark-2026-07-30.db`
+- Tests: 4 passed, 0 failed.
+- Demonstration:
+  - The periodic-snapshot baseline acknowledged worker 7, restarted from the
+    older snapshot, and gave worker 8 the same attempt-1 fence.
+  - The Fold reference survived 100 child-process exits immediately after
+    acknowledged mutations.
+  - Duplicate and reordered messages were no-ops.
+  - Heartbeat at the exact deadline and completion far after the deadline were
+    rejected without changing the lease; the job was then reassigned as
+    attempt 2 and attempt 1 could not overwrite the winner.
+  - A second concurrent Fold opener was rejected. This is consistent with an
+    embedded single-writer store, not a BogKit defect.
+- Baseline and bounded measurements:
+  - A naïve in-place JSON rewrite wrote 20,248,904 bytes in 28–30 ms. It is
+    only a lower bound, not a crash-safe snapshot protocol, because it does not
+    write a temporary file, atomically replace the live file, and sync the
+    directory.
+  - Three 2,000-heartbeat local passes measured 334,115–348,759 updates/s with
+    0.108–0.126 ms p99 assigned batch-commit latency.
+  - Five local reopen-plus-lease observations were 0.162–0.170 seconds.
+  - The persistent directory was 16,309,086 apparent bytes for the synthetic
+    100,000-job graph.
+  - These numbers exclude batch formation, networking, scheduling, object
+    storage, and replica coordination.
+
+### Friction trail
+
+The simulator began with the root README and all public examples, then
+evaluated the JSON baseline before selecting Fold. Fold transactions and
+materialized ready/leased tables fit the single-writer state machine. Naming a
+composed pipeline inside an ordinary coordinator struct required explicit type
+aliases and function-pointer predicates.
+
+The first implementation passed its authored tests, but skeptical review found
+that a far-late heartbeat could revive an expired lease before the reaper ran.
+The coordinator added the same `deadline <= observed coordinator time` boundary
+used by the reaper to heartbeat and completion, added exact-deadline and
+far-past regression coverage, and reran every check before archival.
+
+The single-writer boundary appeared only after deeper API inspection and a
+concurrent-open probe. The prototype did not build three replica processes:
+the public storage contract already lacked the consensus, leader fencing, or
+replicated compare-and-swap needed to make that safe.
+
+### Findings
+
+1. **Baseline correctness defect — critical severity, high confidence.**
+   Periodic JSON snapshots can acknowledge a lease that is then forgotten,
+   allowing two workers to receive the same attempt fence. Reproduction: run
+   the `baseline` command. Smallest improvement: use a durable authority before
+   acknowledging the lease.
+2. **Poor product fit — critical if selected, high confidence.** Fold's useful
+   single-writer transaction model does not satisfy three concurrently active
+   coordinators. Smallest improvement: document the process and replication
+   boundary; do not infer a new consensus subsystem.
+3. **Documentation gap — medium severity, high confidence.** The root guide
+   and examples do not prominently state the single-writer/process boundary.
+   Smallest improvement: include it in the public capability matrix.
+4. **API friction — medium severity, medium confidence.** Composed pipeline
+   types are awkward to name in reusable structs. Type aliases and
+   function-pointer predicates worked. Smallest improvement: document that
+   pattern before considering type erasure.
+5. **Onboarding friction — medium severity, high confidence.** A Fold-only
+   prototype still reached unrelated ANNy code during dependency-inclusive
+   strict lint. Smallest improvement: keep the smallest component path
+   selective and free of unrelated setup where practical.
+6. **Prototype correctness defect — fixed before archival.** The original
+   heartbeat path could revive an expired attempt. This was application logic,
+   not a BogKit defect.
+
+### Decision audit
+
+The trial rejected periodic JSON snapshots because they lose acknowledged
+state and treated the measured in-place rewrite only as a lower-bound control,
+not a correct replacement. It selected keyed Fold records plus ready and leased
+materializations for the single-writer reference. It used coordinator time,
+explicit attempts, immutable result keys, and batches of at most 32
+heartbeats.
+
+It rejected inventing a replication wrapper because that wrapper would become
+the actual coordinator authority. The heartbeat replay check assumes the
+unchanged worker protocol already supplies a stable increasing message ID.
+Wide fan-in/fan-out graphs, cross-process commit interruption, power loss,
+batch queueing delay, and a real three-replica service remain untested.
+
+## Trial 2 — Explainable payment-velocity screening
+
+- Persona: fraud infrastructure developer with strong event-processing
+  experience and beginner Rust experience
+- Existing system: durable checkout stream, TypeScript rule consumer, and
+  independently expiring Redis counters for account, card, device, and IP
+  identifiers
+- Problem: deterministic event-time decisions, duplicate suppression, linked
+  late corrections, explainable alerts, replay, and customer deletion across
+  four consumer replicas with partition reassignment
+- Outcome: no fit
+- BogKit components considered: Fold, ESE, and ANNy
+- BogKit components used: none
+- Archive:
+  [`runs/2026-07-30--fraud-velocity-evaluation`](../runs/2026-07-30--fraud-velocity-evaluation)
+
+### Evidence
+
+- Commands:
+  - `cargo test -p fraud-velocity-evaluation --all-targets --offline`
+  - `cargo clippy -p fraud-velocity-evaluation --all-targets --offline -- -D warnings`
+  - `cargo run --release -p fraud-velocity-evaluation --offline -- demo`
+  - `cargo run --release -p fraud-velocity-evaluation --offline -- benchmark 100000 3`
+- Tests: 5 passed, 0 failed.
+- Demonstration:
+  - The Redis-style baseline counted one retry twice, allowed arrival-time TTL
+    expiry to disagree with a one-minute event-time relationship, and retained
+    no contribution list.
+  - Ten deliveries became nine unique events with one inert duplicate.
+  - One late event produced six linked corrections.
+  - The latest indexed decisions matched a separate naïve scan.
+  - Normal close/reopen replay produced 3,311 identical decision bytes. No
+    process crash or torn write was tested.
+  - Fifteen alert outcomes were internally reconstructable from retained
+    records; this is not an independent oracle for every historical revision.
+  - Four account-owned events were scrubbed, and the audit checked both account
+    and card identifiers in retained rows and indexes while preserving shared
+    device/IP counts.
+- Bounded measurements:
+  - Three sparse-key in-memory passes measured 951,640–1,080,871
+    deliveries/s, 0.002 ms p99, 134 corrections, and 50,056 alert outcomes.
+  - Every round produced digest `0fb37b9c0b65c76c`.
+  - The payload lower bound was 39.41 MiB.
+  - The required 30-minute, 20-million-event, real partition-transfer, and
+    durable deletion-compaction gates were not run.
+
+### Friction trail
+
+The simulator evaluated the Redis counter baseline before inspecting Fold.
+`Retain` was rejected because it uses transaction processing time. `TopK` was
+rejected because it keeps a count rather than a duration. The simulator found
+that `Ranked` and `KeyedRanked` do provide event-time range scans, but partial
+adoption would still leave multi-rule aggregation, two-ID deduplication, linked
+correction revisions, deletion, broker-offset atomicity, and partition transfer
+as consequential custom logic.
+
+The dependency-free reference model first left an empty account-index
+container after deletion; its own scan caught that defect. Skeptical review
+then found that the scan did not explicitly audit card identifiers. The
+archived version captures the deletion receipt and verifies both account and
+card removal from retained rows and indexes.
+
+### Findings
+
+1. **Baseline correctness defect — high severity, high confidence.** Retries
+   double-count because the supplied counter model checks neither event ID.
+   Smallest improvement: deduplicate on stable event and merchant identities.
+2. **Baseline correctness defect — high severity, high confidence.**
+   Arrival-time TTLs disagree with event-time windows and cannot deterministically
+   revise earlier decisions. Smallest improvement: retain event-time facts and
+   append linked corrections.
+3. **Baseline missing capability — high severity, high confidence.** Counters
+   cannot reconstruct exact alert contributors. Smallest improvement: retain a
+   bounded explanation record for alerts.
+4. **Poor product fit — critical if selected, high confidence.** No inspected
+   BogKit contract coordinates durable-stream offsets, partition ownership, or
+   state transfer across four consumers.
+5. **Missing composed capability — high severity, high confidence.** Fold
+   supplies event-time range indexing, but not the complete maintained
+   aggregation, correction, deduplication, deletion, and partition semantics.
+   Smallest improvement: document the boundary; do not infer a combined
+   operator from one trial.
+6. **API friction — medium severity, medium confidence.** Pipeline and reader
+   types were difficult for the Rust-beginner persona to name in ordinary
+   helper signatures. Smallest improvement: document reusable signature and
+   alias patterns.
+7. **Actual BogKit defect:** none demonstrated.
+
+### Decision audit
+
+The reference selected canonical arrival and event-time ordering, two-ID
+deduplication, append-only correction revisions, and contributor IDs only for
+alerts. Customer deletion removes account/card-owned state while preserving
+shared device/IP aggregates.
+
+It rejected partial Fold adoption because range indexing would not reduce the
+highest-risk custom semantics. A larger design could combine partition-local
+Fold ownership, an outbox/offset protocol, range indexes, custom corrections,
+and deletion compaction; this trial neither built nor ruled out that
+architecture. The persistent fixture ledger mutates memory before append/sync,
+cannot recover a torn final TSV row, and does not durably compact deletion.
+
+## Skeptical review
+
+- Claims reproduced: both baseline failures, all 8 original trial tests, both
+  no-fit prerequisites, both demonstrations, the concurrent-open boundary, the
+  local measurements, Fold's own 18 unit and 9 documentation tests, and the
+  archive scans.
+- Claims rejected or softened:
+  - the CI prototype's expired-heartbeat behavior was rejected and fixed;
+  - the JSON rewrite is not a correct crash-safe snapshot comparison;
+  - a same-process second-opener check is not a three-process replica test;
+  - the fraud replay is normal close/reopen, not crash recovery;
+  - Fold provides event-time range scans, though not the full scenario
+    semantics;
+  - alert reconstruction is internally checked, not an independent historical
+    oracle;
+  - the fraud benchmark is a sparse-key in-memory upper bound.
+- Unnecessary code or dependencies removed: the unused public event-order
+  helper was removed. The fraud prototype remains dependency-free. CI uses
+  Fold and Serde; Serde JSON is used by the baseline.
+- Remaining uncertainty: real replicated coordination, broker ownership,
+  wide dependency graphs, production crash/power behavior, load duration,
+  allocator/RSS overhead, durable deletion, and hardware-independent capacity.
+
+## Cross-run synthesis
+
+### New evidence
+
+Fold's transactions and materialized tables can support a carefully fenced
+single-writer CI state machine, but they do not provide the required replicated
+coordinator authority. Fold's ranked indexes can support event-time range
+queries, but the fraud scenario's complete partitioned correction system
+remains application architecture rather than a small component adoption.
+
+### Recurring evidence
+
+- Six independent trials now needed deeper inspection or a probe to understand
+  storage ownership, transactions, process boundaries, deployment shape,
+  operating-system limits, or stream ownership.
+- Four trials encountered unrelated setup or dependency surface while needing
+  only Fold or no BogKit component.
+- Two trials independently found composed pipeline or reader types difficult
+  to name in ordinary reusable code.
+
+### Candidate improvements
+
+1. **Public capability matrix** — six independent trials. Cover component
+   purpose, storage ownership, transaction scope, process and horizontal
+   deployment, filesystem and `std` requirements, strict quotas, raw-flash
+   non-goals, and atomic broker-offset ownership.
+2. **Component-selective project path** — four independent trials. Keep the
+   smallest component introduction free of unrelated dependencies and setup
+   where practical.
+3. **Nameable pipeline and reader patterns** — two independent trials. Document
+   type-alias, function-pointer, and ordinary helper-signature patterns. Do not
+   infer a new type-erasure subsystem.
+
+Distributed consensus, broker-offset coordination, crash-recovery examples,
+and a combined event-time correction operator remain observations or
+positioning boundaries, not promoted core-feature proposals.
+
+### No-fit and positioning signals
+
+BogKit remains strongest when one process may own filesystem-backed state and
+the application can build its semantics inside that authority. Developers
+should be able to reject it quickly when correctness depends on multiple active
+writers, external transaction or stream-offset atomicity, partition transfer,
+strict physical limits, raw devices, or firmware targets.
+
+## Validation
+
+- Trial-specific tests: 9 passed, 0 failed across the two corrected prototypes.
+- Targeted formatting: passed for both prototypes.
+- Strict lint: both prototypes and the full nested workspace passed with
+  warnings denied.
+- Runnable demonstrations: both passed after skeptical-review corrections.
+- Nested lab workspace tests: 39 passed, 0 failed.
+- BogKit root workspace tests: 33 unit tests and 12 documentation tests passed,
+  0 failed. The first offline attempt could not download ESE's model; the
+  required network-enabled rerun passed.
+- Diff and ledger checks: `git diff --check` and `jq empty coverage.json`
+  passed.
+- Archive and secret checks: changed paths are confined to
+  `developer-simulation/`; no generated build output, databases, binary
+  fixtures, credentials, private keys, or large files are included.
diff --git a/developer-simulation/reports/2026-07-31.md b/developer-simulation/reports/2026-07-31.md
new file mode 100644
index 0000000..1027fff
--- /dev/null
+++ b/developer-simulation/reports/2026-07-31.md
@@ -0,0 +1,315 @@
+# Developer simulation — 2026-07-31
+
+<!-- bogkit-developer-simulation:2026-07-31 -->
+
+Two blind trials tested underexplored ordinary-software boundaries: stable
+home-care rescheduling after cancellation bursts, and schema evolution in an
+existing SQLite wholesale catalog. Both reached reviewed no-fit conclusions
+for their stated production boundaries. The scheduling prototype still showed
+useful Fold behavior inside an isolated projection; the catalog baseline met
+its compact requirements without a BogKit component.
+
+## Trial 1 — Stable home-care gap filling
+
+- Persona: scheduling-platform developer with intermediate Rust experience
+- Existing system: a single-node Rust service imports caregiver availability
+  and visits into SQLite, then uses a full-rescan greedy scheduler
+- Problem: process cancellation bursts without destabilizing unaffected
+  assignments, violating constraints, or losing deterministic explanations
+- Outcome: no fit for the SQLite-authoritative handoff as implemented
+- BogKit components considered: Fold, ESE, and ANNy
+- BogKit components used: Fold in an isolated projection
+- Archive:
+  [`runs/2026-07-31--homecare-gap-fill`](../runs/2026-07-31--homecare-gap-fill)
+
+### Evidence
+
+- Commands:
+  - `cargo test -p homecare-gap-fill --all-targets --offline`
+  - `cargo fmt --manifest-path runs/2026-07-31--homecare-gap-fill/Cargo.toml -- --check`
+  - `cargo clippy -p homecare-gap-fill --all-targets --offline -- -D warnings`
+  - `cargo run -p homecare-gap-fill --release --offline`
+- Tests: 5 passed, including the reviewer-required regression for spurious
+  travel-conflict explanations.
+- Demonstration:
+  - The seeded representative run used 2,000 caregivers and 12,000 visits over
+    14 days, exactly 10% of the requested full scale.
+  - After 200 cancellation changes, the incremental path preserved 100% of
+    unaffected assignments. The sampled full-rescan baseline preserved 98.294%.
+  - Both paths filled 10,000 visits and 2,761 of 2,913 urgent visits.
+  - Independent validation found zero assignment violations after the review
+    fix and rejected an explicitly unfilled visit when a caregiver was actually
+    eligible.
+  - All measured runs produced deterministic digest `3a9719e0c8654377`.
+  - Normal reopen recovered in 47.200–50.022 ms across recorded runs. Recovery
+    after a child committed, checkpointed, and then aborted took
+    48.456–50.722 ms.
+  - Across the author, reviewer, and post-fix runs, sampled baseline p95 was
+    102.118–116.540 ms and incremental p95 was 5.244–5.517 ms.
+- Baseline comparison:
+  - The baseline met fill and urgent-coverage parity but missed the 99.5%
+    unaffected-assignment target.
+  - The local-change algorithm met the stability target at representative
+    scale. Fold atomically persisted the Fold-owned visits, outcomes, and
+    counts, but did not provide the scheduling algorithm.
+  - The required SQLite adapter, change feed, rebuild policy, idempotent handoff,
+    and cross-store transaction were absent. The isolated Fold result therefore
+    does not establish a safe production integration.
+
+### Friction trail
+
+The simulator began with the root README and then read the starter,
+time-series, chat, and search examples. It selected Fold only after the
+full-rescan baseline missed the stability target. Scheduling constraints,
+candidate selection, explanations, and the validator stayed in ordinary Rust;
+ESE and ANNy were rejected as unrelated.
+
+The first dependency resolution needed registry access. The first Fold-backed
+store used anonymous closures whose composed reader type was awkward to name;
+named functions made the store reusable. This is the third independent
+occurrence of the existing pipeline/reader naming friction.
+
+The skeptical reviewer then found that the independent validator returned
+`TRAVEL_CONFLICT` whenever earlier filters left a caregiver, without checking
+travel feasibility. A minimal one-caregiver reproducer was incorrectly
+accepted. The coordinator added an independent travel check, made an eligible
+unfilled visit an error, added a regression test, and reran the full trial.
+
+### Findings
+
+1. **Prototype correctness defect, fixed — high severity, high confidence.**
+   The original validator accepted a spurious travel-conflict reason without
+   proving travel blocked all remaining caregivers. Reproduction: the
+   `validator_rejects_spurious_travel_conflict` test now captures the reviewer's
+   reproducer. Smallest improvement: independently check travel and reject an
+   unfilled outcome whenever any caregiver is fully eligible.
+2. **Poor product fit — high severity, high confidence.** Fold's isolated
+   database does not share SQLite's authoritative transaction. Reproduction:
+   inspect `src/store.rs`; there is no SQLite adapter or handoff. Smallest
+   improvement: document source-of-truth and cross-store atomicity boundaries;
+   keep this scenario no-fit until synchronization and rebuild behavior are
+   proven.
+3. **Performance evidence scope — medium severity, high confidence at
+   representative scale.** The local p95 ranges are repeatable but do not prove
+   the 20,000-caregiver/120,000-visit, 1 GiB requirement. Reproduction: run the
+   release demo. Smallest improvement: add memory-bounded, full-scale,
+   multi-seed measurements before production use.
+4. **Time-boundary documentation — medium severity, high confidence.** The
+   parser tests explicit-offset instant arithmetic and rejects offset-free
+   strings; it does not apply IANA timezone rules or reject a nonexistent local
+   wall time paired with an explicit offset. Reproduction: run the time test.
+   Smallest improvement: put timezone-aware conversion and ambiguity policy at
+   the unimplemented import boundary.
+5. **API friction — low severity, high confidence.** Named functions or type
+   aliases were again needed for a reusable composed Fold store. Reproduction:
+   replace the named pipeline functions with closures and compile. Smallest
+   improvement: document ordinary type-alias and function-pointer patterns; do
+   not infer a type-erasure subsystem.
+
+### Decision audit
+
+The simulator retained the full rescan as a deterministic baseline, chose an
+incremental local-change scheduler to protect published assignments, and kept a
+separate validator rather than sharing scheduler eligibility code. Fold was
+used only to measure atomic keyed persistence and maintained counts.
+
+The reviewer rejected the initial “partial fit” label. SQLite must remain the
+authority, and no synchronization or atomic publication boundary exists. The
+final decision is no fit for the stated system, while retaining the isolated
+projection as useful lower-bound evidence. Full scale, peak memory, real
+SQLite integration, IANA-zone policy, mid-transaction crash injection, and
+production distributions remain unresolved.
+
+## Trial 2 — Evolving industrial parts catalog
+
+- Persona: wholesale catalog backend developer with beginner-to-intermediate
+  Rust experience
+- Existing system: an Axum and SQLite CRUD service with fixed product columns,
+  handwritten SQL, and category conditionals
+- Problem: add structured category revisions, reliable filters, conditional
+  patches, and resumable import without replacing the SQLite authority
+- Outcome: no fit for the authoritative catalog path
+- BogKit components considered: Fold, ESE, and ANNy
+- BogKit components used: none
+- Archive:
+  [`runs/2026-07-31--parts-catalog-evolution`](../runs/2026-07-31--parts-catalog-evolution)
+
+### Evidence
+
+- Commands:
+  - `cargo test -p parts-catalog-evolution --all-targets --offline`
+  - `cargo fmt --manifest-path runs/2026-07-31--parts-catalog-evolution/Cargo.toml -- --check`
+  - `cargo clippy -p parts-catalog-evolution --all-targets --offline -- -D warnings`
+  - `cargo run -p parts-catalog-evolution --release --offline -- demo`
+  - `cargo run -p parts-catalog-evolution --release --offline -- import-check 250000 2048`
+  - `cargo run -p parts-catalog-evolution --release --offline -- burst 250000`
+  - `cargo run -p parts-catalog-evolution --release --offline -- storage-check 250000 2048`
+- Tests: 9 passed, including changed-source and conflicting-duplicate import
+  regressions required by skeptical review.
+- Demonstration:
+  - The unrelated legacy table survived catalog initialization.
+  - A laptop revision-1 record remained readable after revision 2 activated,
+    then migrated explicitly to revision 2.
+  - Partial patching preserved omitted fields and rejected a stale version.
+  - Three exact/range query shapes agreed with a separately written in-memory
+    evaluator.
+  - The post-fix full import stopped after 7,000 committed rows, reopened,
+    validated its source fingerprint, and reached 250,000 total and distinct
+    IDs in 8.623 seconds.
+  - The post-fix burst measured 2.104 ms read p95 and 2.721 ms write p95. Across
+    all recorded runs the ranges were 1.518–4.037 ms and 1.389–2.721 ms.
+  - At 250,000 synthetic 2 KiB records, the indexed database used
+    1,139,924,992 bytes versus 1,039,552,512 bytes for the baseline, or 1.097x.
+- Baseline comparison:
+  - SQLite kept validation metadata, products, facets, conditional versions,
+    and import checkpoints in one transactional file.
+  - Fold would use a separate Fjall store and would not by itself supply runtime
+    validation, SQLite transaction integration, or online category revisions.
+  - A Fold sidecar's synchronization and storage cost were not measured; no
+    conclusion is made about optional future analytics.
+
+### Friction trail
+
+The simulator read the public README, examples, and relevant Fold operators
+before selecting a component. The starter and search examples demonstrated
+useful maintained views, but SQLite authority and evolving runtime data shapes
+made those views an unnecessary second store for the compact exact/range slice.
+ESE and ANNy were rejected because semantic search and recommendations were
+explicit non-goals.
+
+The sanitized copy did not have a cached maintained SQLite binding, so the
+prototype used a narrow system-`sqlite3` wrapper. This requires a linkable
+system library and is not a production recommendation.
+
+Skeptical review found that the original importer bound a job only to its total
+count and used unchecked `INSERT OR IGNORE`. The reviewer resumed one job with
+changed payload size and introduced a conflicting pre-existing ID; both paths
+advanced and could report a mixed import as complete. The coordinator added a
+generator/payload fingerprint, complete duplicate-content comparison, rollback
+before checkpoint advancement, and two regression tests.
+
+### Findings
+
+1. **Prototype correctness defect, fixed — high severity, high confidence.**
+   Count-only job identity and unchecked duplicate IDs could silently mix
+   sources or accept conflicting content. Reproduction: run the two importer
+   regression tests. Smallest improvement: persist a source fingerprint and
+   verify complete duplicate content before advancing the checkpoint.
+2. **Storage integration boundary — high severity, high confidence.** Fold is
+   not an extension of an existing SQLite transaction. Reproduction: public
+   examples open a Fold-owned path. Smallest improvement: document source-of-
+   truth ownership and a supported synchronization/rebuild pattern if one
+   exists.
+3. **Runtime schema mismatch — medium severity, high confidence.** This compact
+   prototype has three hardcoded Rust validators and one laptop revision; Fold
+   pipelines are also concrete startup-time Rust types. Reproduction: inspect
+   the validators and public pipeline construction. Smallest improvement:
+   document runtime-defined schemas as a fit boundary rather than implying a
+   new validation subsystem.
+4. **Concurrency and HTTP evidence gap — medium severity, high confidence.**
+   One mutex serializes SQLite access, the route smoke test covers POST/GET, and
+   no same-version race, second process, or real-service contract was tested.
+   Reproduction: inspect `app` and the HTTP test. Smallest improvement: add
+   route-level error coverage and a two-writer conflict test before claiming
+   service compatibility.
+5. **Performance and storage scope — medium severity, high confidence.** The
+   measured latency and 1.097x ratio cover in-process serialized requests and
+   synthetic 2 KiB rows in three categories, not a 512 MiB VM, network traffic,
+   mixed 2–20 KiB records, the real existing file, or a Fold sidecar.
+   Reproduction: run the scale commands. Smallest improvement: repeat under the
+   actual resource limit and data distribution.
+6. **Prototype dependency risk — medium severity, high confidence.** The direct
+   SQLite wrapper is smaller and less mature than a maintained binding and
+   requires system `sqlite3`. Reproduction: inspect `src/sqlite.rs`. Smallest
+   improvement: use a maintained binding, migration tooling, pooled reads, and
+   explicit error mapping for production.
+
+### Decision audit
+
+The simulator rejected optional-column growth, unvalidated JSON, Fold as the
+authority, a Fold sidecar for the compact exact/range slice, and ESE/ANNy. It
+chose SQLite products, schema metadata, facet indexes, version checks, and
+import checkpoints in one file.
+
+The no-fit conclusion is limited to this authoritative catalog path. The real
+HTTP contract, 30 runtime-defined categories, 512 MiB limit, mixed record sizes,
+same-version races, crash or power-loss injection, scalar-facet policy for
+deeper data, and production SQLite binding remain unresolved.
+
+## Skeptical review
+
+- Claims reproduced:
+  - Both formatting checks, both strict lints, all original tests, and both
+    release demonstrations.
+  - Scheduling stability, fill parity, deterministic digest, and committed
+    Fold-state recovery across repeated runs.
+  - Catalog full-count import, 1.097x storage ratio, three query shapes, and
+    repeated burst measurements.
+- Claims rejected or softened:
+  - Scheduling “partial fit,” independent reason validation before its fix,
+    IANA/DST language, full-scale performance, and cross-store atomicity.
+  - Catalog crash wording, general CRUD compatibility, concurrent-writer
+    evidence, general runtime schemas, real-data storage scope, and the
+    unmeasured claim that a Fold sidecar would exceed the budget.
+- Quality fixes required and completed:
+  - Independent travel feasibility plus a regression test.
+  - Import source identity, duplicate-content checking, rollback, and two
+    regressions.
+  - Removal of the catalog's unused optional Fold dependency and relocation of
+    its test-only HTTP body dependency.
+  - Nested-workspace manifests and archive-only reproduction instructions.
+- Remaining uncertainty:
+  - The full scheduling scale and memory limit; real SQLite/Fold handoff;
+    timezone rules; uncommitted-transaction crash points.
+  - The real catalog contract and data distribution; multi-process and
+    same-version concurrency; runtime-defined validators; crash/power loss;
+    production SQLite operations.
+
+No BogKit correctness defect was demonstrated. Both serious findings were
+prototype defects found by review and fixed before archival.
+
+## Cross-run synthesis
+
+- New evidence:
+  - SQLite-to-Fold synchronization and source-of-truth ownership independently
+    blocked both trials.
+  - Runtime-defined schema validation and conditional update APIs remain
+    one-trial observations.
+- Recurring evidence:
+  - The public capability and operational-boundary matrix is now supported by
+    eight independent trials.
+  - Nameable pipeline and reader patterns are now supported by three
+    independent trials.
+  - The component-selective project path remains supported by four trials; the
+    catalog's self-added optional Fold dependency was removed and is not counted.
+- Candidate improvements:
+  1. Public capability matrix covering component purpose, source-of-truth
+     storage, transaction and cross-store scope, process/horizontal deployment,
+     operating-system requirements, strict limits, raw-flash non-goals, and
+     broker ownership.
+  2. Component-selective project path that avoids unrelated setup.
+  3. Documentation for nameable composed pipeline and reader types.
+- Observations not yet promoted:
+  - Runtime schema validation, conditional upsert, SQLite sidecar integration,
+    pooled catalog concurrency, and scheduling-specific indexes.
+- No-fit or positioning signals:
+  - BogKit's embedded store can provide useful isolated evidence without being
+    safe for a system whose correctness boundary remains in SQLite. Public
+    onboarding should make cross-store atomicity and rebuild ownership clear.
+
+## Validation
+
+- Trial-specific tests: 5 scheduling tests and 9 catalog tests passed.
+- Strict lint and formatting: both new crates passed targeted formatting and
+  clippy with warnings denied. The complete nested workspace also passed strict
+  clippy. A repository-wide format check still reports pre-existing differences
+  in `examples/search/src/main.rs`; that file was not modified.
+- Runnable demonstrations: both demos and all three full-scale catalog commands
+  passed after review fixes.
+- Nested lab workspace tests: all 53 tests passed.
+- BogKit root workspace tests: all 45 unit and documentation tests passed after
+  allowing the ESE model download required by its build.
+- Archive and secret checks: `git diff --check`, coverage parsing, daily-marker
+  uniqueness, changed-path scope, large-file, database, symlink, binary, and
+  credential-pattern scans passed. Every intended changed path is under
+  `developer-simulation/`; generated targets and databases are ignored.
diff --git a/developer-simulation/reports/2026-08-01.md b/developer-simulation/reports/2026-08-01.md
new file mode 100644
index 0000000..aac0b75
--- /dev/null
+++ b/developer-simulation/reports/2026-08-01.md
@@ -0,0 +1,336 @@
+# Developer simulation — 2026-08-01
+
+<!-- bogkit-developer-simulation:2026-08-01 -->
+
+Two blind trials tested BogKit against substantially different one-shot local
+software problems: deterministic offline feature-flag evaluation and preflight
+validation of CNC job bundles. Both developers reached reviewed no-fit
+conclusions. Direct, dependency-light implementations met the bounded local
+criteria without Fold, ESE, or ANNy.
+
+Skeptical review preserved both no-fit decisions but rejected broader claims
+and found two high-severity CNC prototype defects before archival. The
+coordinator bounded flag-snapshot reads, narrowed its memory and portability
+claims, made CNC staging temporary and all-or-nothing for ordinary failures,
+rechecked copied content, added regressions, and reran the evidence. No BogKit
+correctness defect was demonstrated.
+
+## Trial 1 — Offline feature-flag parity
+
+- Persona: client-platform SDK developer, Rust beginner with production
+  TypeScript experience
+- Existing system: a TypeScript kiosk SDK loads JSON snapshots, evaluates
+  ordered targeting rules, and returns short decision explanations
+- Problem: preserve deterministic decisions and percentage assignments across
+  reloads and restarts while rejecting malformed snapshots without replacing
+  the last valid in-process configuration
+- Outcome: no fit for the bounded local evaluator
+- BogKit components considered: Fold, ESE, and ANNy
+- BogKit components used: none
+- Archive:
+  [`runs/2026-08-01--offline-flag-parity`](../runs/2026-08-01--offline-flag-parity)
+
+### Evidence
+
+- Commands:
+  - `cargo test -p offline-flag-parity --all-targets --offline`
+  - `cargo fmt --manifest-path runs/2026-08-01--offline-flag-parity/Cargo.toml -- --check`
+  - `cargo clippy -p offline-flag-parity --all-targets --offline -- -D warnings`
+  - `cargo run -p offline-flag-parity --release --offline -- verify runs/2026-08-01--offline-flag-parity/fixtures`
+  - `cargo run -p offline-flag-parity --release --offline -- demo runs/2026-08-01--offline-flag-parity/fixtures`
+  - `node runs/2026-08-01--offline-flag-parity/baseline/reference-evaluator.mjs runs/2026-08-01--offline-flag-parity/fixtures`
+  - `cargo run -p offline-flag-parity --release --offline -- generate-benchmark /private/tmp/offline-flag-parity-benchmark.json`
+  - `cargo run -p offline-flag-parity --release --offline -- bench /private/tmp/offline-flag-parity-benchmark.json`
+- Tests: 4 passed, including duplicate-key rejection, failed-reload retention,
+  a fixed hash vector, and a bounded-file-read regression added after review.
+- Demonstration:
+  - Rust and an independently written TypeScript-style JavaScript evaluator
+    matched all 250 stored golden decisions and their explanations on the
+    measured host.
+  - Recursively reversing JSON object-key order left all 250 results unchanged;
+    targeting rule arrays remained ordered and semantically significant.
+  - All 12 malformed fixtures were rejected. A valid reload changed the active
+    configuration, and the following invalid reload left that in-process
+    configuration and its decision unchanged.
+  - Ten fresh processes produced one fingerprint,
+    `99c04dd07bb96094`.
+  - Forty measured 20,000-evaluation batches across the developer and
+    post-review release runs had a worst p95 of 1.333 microseconds, below the
+    250-microsecond target.
+  - The corrected 6.2 MB, 5,000-flag/50,000-rule benchmark had sampled
+    same-size-reload RSS of 63,471,616–63,569,920 bytes in four fresh runs. It
+    passed the 64 MiB criterion with only about 3.5 MB of closest observed
+    headroom. This is measured prototype evidence, not a formal maximum.
+- Baseline comparison:
+  - Parse and validate a complete candidate, then replace one immutable
+    in-memory snapshot only after success.
+  - Ordered local lookup, a specified integer hash, and structured explanations
+    directly satisfy the compact evaluation path.
+  - Fold can maintain durable incremental views, but it does not supply JSON
+    admission or percentage semantics and would add unnecessary storage and
+    lifecycle work to this bounded hot path.
+
+### Friction trail
+
+The developer began with the root README and all four public examples, then
+defined the immutable TypeScript-style baseline before inspecting Fold's
+transaction and snapshot surface. The examples showed durable state,
+transactions, aggregates, and search, but no need in this scenario justified a
+BogKit component.
+
+The first ordinary Cargo command attempted an index refresh in the
+network-disabled copy; cached dependencies worked with `--offline`. A first
+fixed-bucket assertion used an incorrect expected value and was corrected only
+after an independent Node `BigInt` implementation matched Rust. The first large
+benchmark retained a generic JSON tree and built fixtures in-process, reaching
+146,587,648 bytes sampled RSS. Duplicate checking was made streaming and large
+fixture generation moved into its own process before the passing measurements.
+
+Skeptical review then found that `fs::read` could allocate an entire file before
+the 48 MiB policy check and that a 6.2 MB workload did not justify the broad
+memory wording. File reads now stop at 8 MiB plus one byte, a sparse oversized
+file is a regression case, and every memory statement is limited to the
+measured workload.
+
+### Findings
+
+1. **Input-validation correctness — high severity, high confidence.** Generic
+   JSON-to-map parsing can accept duplicate object keys with last-value-wins
+   behavior. Reproduction: run the duplicate-key unit test or verify
+   `fixtures/malformed/06-duplicate-flag-key.json`. Smallest improvement: keep
+   a streaming duplicate-key preflight or use a parser that rejects duplicates.
+   This is a configuration-admission concern, not a BogKit defect.
+2. **Prototype memory-bound defect, fixed — high severity, high confidence.**
+   The original whole-file read occurred before its size check and its 48 MiB
+   cap exceeded the measured evidence. Reproduction: the
+   `file_reader_stops_at_the_snapshot_limit` test uses an oversized sparse file.
+   Smallest improvement: cap the read itself and state only the measured memory
+   envelope.
+3. **Poor product fit — informational severity, high confidence for this
+   boundary.** The direct immutable evaluator met the bounded need without
+   durable incremental state, embeddings, or nearest-neighbor search.
+   Reproduction: compare the baseline, manifest, and public examples. Smallest
+   improvement: document component purposes and no-fit boundaries; do not infer
+   a new subsystem.
+4. **Performance and portability scope — medium severity, high confidence.**
+   The local latency and sampled RSS are repeatable, but the memory margin is
+   narrow and one arm64 macOS host running Rust and Node is not a platform
+   matrix. Reproduction: run the release benchmark and reference evaluator.
+   Smallest improvement: test real snapshots and a platform CI matrix before
+   production claims.
+5. **Persistence boundary — medium severity, high confidence.** Failed reloads
+   preserve the active snapshot only inside the current process. Reproduction:
+   inspect `Evaluator::reload_file`; no durable last-known-good publication is
+   implemented. Smallest improvement: assign persisted delivery ownership
+   before considering an embedded store.
+
+### Decision audit
+
+The developer kept ordered rules, order-insensitive JSON objects, strict
+candidate validation, a versionable FNV-1a 64 bucket contract, and explanations
+on every decision. Rust's process-randomized map hash, rule sorting, partial
+mutation, per-decision persistence, and all commercial flag formats were
+rejected.
+
+The no-fit conclusion is limited to the bounded offline evaluator. Actual kiosk
+snapshots and coercion rules, concurrent reloads, long-duration allocation,
+platform parity, fuzzing, and durable last-known-good delivery remain
+unresolved.
+
+## Trial 2 — CNC job-bundle preflight
+
+- Persona: manufacturing software engineer with intermediate Rust experience
+- Existing system: a Python ZIP preflight checks for `manifest.json` and
+  allowed filename extensions before a bundle reaches an on-premises
+  controller
+- Problem: classify incomplete or inconsistent bundles, stream size and digest
+  checks, produce deterministic diagnostics, and stage only a completely
+  rechecked valid bundle
+- Outcome: no fit for the one-shot bundle gate
+- BogKit components considered: Fold, ESE, and ANNy
+- BogKit components used: none
+- Archive:
+  [`runs/2026-08-01--cnc-job-bundle-preflight`](../runs/2026-08-01--cnc-job-bundle-preflight)
+
+### Evidence
+
+- Commands:
+  - `cargo test -p cnc-job-bundle-preflight --all-targets --offline`
+  - `cargo fmt --manifest-path runs/2026-08-01--cnc-job-bundle-preflight/Cargo.toml -- --check`
+  - `cargo clippy -p cnc-job-bundle-preflight --all-targets --offline -- -D warnings`
+  - `cargo run -p cnc-job-bundle-preflight --release --offline -- generate-fixtures /private/tmp/cnc-preflight-fixtures --include-huge`
+  - `cargo run -p cnc-job-bundle-preflight --release --offline -- demo /private/tmp/cnc-preflight-fixtures /private/tmp/cnc-preflight-staging`
+  - `cargo run -p cnc-job-bundle-preflight --release --offline -- check /private/tmp/cnc-preflight-fixtures/thousand-files.zip --tools /private/tmp/cnc-preflight-fixtures/tools.json`
+  - `/usr/bin/time -l target/release/cnc-job-bundle-preflight check /private/tmp/cnc-preflight-fixtures/oversized-2gib-sparse.zip --tools /private/tmp/cnc-preflight-fixtures/tools.json --staging /private/tmp/cnc-preflight-staging/oversized`
+- Tests: 6 passed, including skeptical-review regressions for file/parent path
+  collisions, incomplete-output cleanup, and content rechecking before final
+  naming.
+- Demonstration:
+  - The required valid, truncated, checksum-mismatched, undeclared, missing,
+    case-colliding, absolute-path, parent-traversal, missing-tool, and
+    multi-error fixtures were classified as expected. Only the valid bundle
+    received a final `ready` directory.
+  - Two complete multi-error outputs had identical SHA-256 digests and contained
+    15 stable-sorted diagnostics.
+  - A bundle with exactly 1,000 declared files passed with 1,001 archive members
+    including its manifest and 172,118 streamed bytes.
+  - The final archived-workspace 2 GiB sparse-member run streamed and hashed
+    2,147,483,919 bytes including the manifest in 17.00 seconds. It reported 1,998,848 bytes
+    maximum resident set, returned only the provisional `archive_oversized`
+    decision, and created no staged output.
+  - A selected staging root that was already a symbolic link failed closed and
+    left its target empty.
+- Baseline comparison:
+  - Python 3.14.6 rejected the physically truncated ZIP on open.
+  - The filename-only baseline still marked checksum mismatch, undeclared and
+    missing files, case collisions, unsafe names, a missing tool, and the
+    multi-error bundle ready.
+  - A direct streaming parser and manifest gate address this one-shot boundary;
+    durable views, embeddings, and nearest-neighbor search do not.
+
+### Friction trail
+
+The developer froze the runnable filename-only Python baseline before reading
+BogKit implementation details. Public examples did not address archive parsing,
+manifest validation, bounded streaming, or filesystem staging, so no BogKit
+component was selected.
+
+To remain offline, the prototype used Serde plus local classic stored-ZIP,
+SHA-256, and CRC32 code. Formatting and strict lint exposed ordinary quality
+issues before the first passing run. Python corrected the developer's predicted
+truncated-file baseline result. Sandboxed memory tools did not provide usable
+process accounting; a fresh read-only timed run supplied the accepted
+measurement.
+
+Skeptical review found two high-severity prototype defects: a late write failure
+could leave incomplete output carrying the final `ready` name, and the content
+copied during staging was not compared with the already validated first read.
+Staging now writes to a temporary directory, cleans incomplete output, rechecks
+byte count, CRC, and SHA-256, and renames only after all entries succeed. The
+review also required early entry-count and member-name bounds.
+
+### Findings
+
+1. **Baseline correctness defects — critical severity, high confidence.** The
+   filename-only baseline accepts unsafe names plus content, declaration, size,
+   and tool mismatches. Reproduction: run `baseline.py` over the generated
+   fixtures. Smallest improvement: validate all names and a bounded manifest,
+   then stream declared content before readiness. These are baseline defects,
+   not BogKit defects.
+2. **Prototype correctness defect, fixed — high severity, high confidence.** A
+   late staging failure could leave incomplete output named `ready`.
+   Reproduction: the `late_copy_failure_leaves_no_ready_or_pending_directory`
+   regression. Smallest improvement: stage to a temporary directory, clean it
+   on failure, and rename only after completion.
+3. **Prototype correctness defect, fixed — high severity, high confidence.**
+   The original second read for staging was not rechecked against validated
+   content. Reproduction: the
+   `copied_content_is_rechecked_before_ready_is_named` regression. Smallest
+   improvement: verify byte count, ZIP CRC, and declared SHA-256 on the copied
+   stream before final naming.
+4. **Compatibility limitation — medium severity, high confidence.** The local
+   parser intentionally rejects compression, ZIP64, data descriptors,
+   encryption, and multi-disk input and has no independent corpus or fuzzing.
+   Reproduction: inspect `src/archive.rs`. Smallest improvement: use a mature
+   bounded streaming library before production; keep the archived subset
+   explicit.
+5. **Product-policy gap — medium severity, high confidence.** The provisional
+   1 GiB total-member limit conflicts with the brief's occasional 2 GiB jobs.
+   Reproduction: the sparse fixture is rejected only as oversized. Smallest
+   improvement: make the local disk and size policy an explicit reviewed
+   configuration before deployment.
+6. **Poor product fit — informational severity, high confidence.** No BogKit
+   component improves the one-shot trust and copy boundary demonstrated here.
+   Reproduction: compare the baseline and public examples. Smallest improvement:
+   retain a direct tool; do not infer archive APIs in BogKit.
+
+### Decision audit
+
+The developer validated before staging, streamed members with bounded buffers,
+required exact UTF-8 relative names, rejected case collisions, checked manifest
+references and tool inventory, and used create-new destinations. Extraction
+before validation, member-sized allocation, a shell extractor, bundle repair,
+and forced BogKit adoption were rejected.
+
+After review, a completed temporary directory is renamed to `ready` only after
+copy rechecks. Existing destinations fail closed. Coordinated filesystem access,
+Unicode normalization, mature ZIP interoperability, crash persistence, the
+correct 2 GiB policy, and G-code semantics remain unresolved.
+
+## Skeptical review
+
+- Claims reproduced:
+  - Both targeted formatting checks, all 10 corrected tests, strict lints, and
+    release demonstrations.
+  - Flag golden/reference parity on one host, object-order invariance,
+    malformed-reload retention, restart fingerprints, repeated local latency,
+    and the corrected bounded-file read.
+  - CNC required classifications, stable diagnostics, 1,000-file boundary,
+    complete 2 GiB sparse stream, bounded measured RSS, and symbolic-link-root
+    failure.
+- Claims rejected or softened:
+  - Cross-machine flag parity, a whole-input 64 MiB guarantee, persistent
+    last-known-good recovery, and any formal maximum-memory claim.
+  - CNC production readiness, broad ZIP compatibility, complete filesystem
+    coordination, and the initial staging-safety claim before its fixes.
+- Quality fixes required and completed:
+  - Bounded flag file reads and an oversized sparse-file regression.
+  - Temporary CNC staging, incomplete-output cleanup, per-copy byte/CRC/SHA-256
+    checks, final rename, path-type collision detection, and early metadata
+    bounds, all with regressions.
+- Remaining uncertainty:
+  - Real flag schema parity, platform matrix, concurrent reloads, persisted
+    delivery ownership, fuzzing, and the narrow observed memory margin.
+  - Mature ZIP interoperability, independent parser corpus/fuzzing, coordinated
+    filesystem access, Unicode normalization, crash persistence, and the local
+    size policy.
+
+No BogKit correctness defect was demonstrated. The serious findings were
+prototype defects fixed before archival.
+
+## Cross-run synthesis
+
+- New evidence:
+  - Two independent developers rejected BogKit for compact one-shot local
+    validation paths after comparing direct baselines with public components.
+  - Immutable configuration admission and manufacturing bundle staging remain
+    domain-specific observations, not proposed BogKit subsystems.
+- Recurring evidence:
+  - The public capability and operational-boundary matrix is now supported by
+    ten independent trials.
+  - The component-selective project path remains supported by four trials.
+  - Nameable pipeline and reader patterns remain supported by three trials.
+- Candidate improvements:
+  1. Public capability matrix covering component purpose, source-of-truth
+     storage, transaction and process scope, deployment, operating-system
+     requirements, hard limits, and clear one-shot/no-component boundaries.
+  2. Component-selective project path that avoids unrelated setup.
+  3. Documentation for nameable composed pipeline and reader types.
+- Observations not yet promoted:
+  - A configuration-snapshot example, explicit no-component workspace
+    isolation, ZIP/bundle validation guidance, and persisted flag delivery are
+    one-trial or lab-specific observations.
+- No-fit or positioning signals:
+  - BogKit's durable incremental data tools need not be present in compact
+    immutable evaluators or one-shot validation gates. Public onboarding should
+    make component purpose clear enough that developers can make that decision
+    without reading implementation details.
+
+## Validation
+
+- Trial-specific tests: 4 flag tests and 6 CNC tests passed, including all
+  skeptical-review regressions.
+- Strict lint and formatting: both targeted formatting checks and strict lints
+  passed; the full nested workspace passed strict Clippy with warnings denied.
+- Runnable demonstrations: flag verification, the flag demo, Node reference,
+  restart fingerprints, repeated release benchmark, CNC normal corpus, stable
+  diagnostics, 1,000-file boundary, and final 2 GiB stream all passed their
+  expected exit and evidence checks.
+- Nested lab workspace tests: all 63 tests passed.
+- BogKit root workspace tests: all 45 unit and documentation tests passed after
+  allowing ESE's required build-model download.
+- Archive and secret checks: `git diff --check`, coverage JSON parsing,
+  marker uniqueness, changed-path scope, symlink, generated-target, database,
+  archive, model, binary, credential-pattern, and file-size scans passed. The
+  new archives are 360 KiB and 104 KiB, and every intended changed path is
+  under `developer-simulation/`.
diff --git a/developer-simulation/reports/2026-08-02.md b/developer-simulation/reports/2026-08-02.md
new file mode 100644
index 0000000..358dd92
--- /dev/null
+++ b/developer-simulation/reports/2026-08-02.md
@@ -0,0 +1,324 @@
+# Developer simulation — 2026-08-02
+
+<!-- bogkit-developer-simulation:2026-08-02 -->
+
+Two blind trials tested safety boundaries around external authorities: ambiguous
+carrier-label purchases whose workflow state remains in PostgreSQL, and bounded
+garbage collection over externally published backup manifests. Both developers
+reached reviewed no-fit conclusions. Direct prototypes met the bounded local
+criteria without Fold, ESE, or ANNy, but neither constitutes a production
+integration with the stated authoritative system.
+
+Skeptical review preserved both no-fit decisions while finding one serious
+correctness defect in each prototype. The carrier journal accepted an incomplete
+tail but did not remove it before later appends. The backup publisher checked its
+final name before, rather than while holding, the publication lock. Both defects
+were reproduced, fixed with regressions, and fully revalidated before archival.
+No BogKit correctness defect was demonstrated.
+
+## Trial 1 — Carrier-label ambiguity
+
+- Persona: fulfillment-platform engineer with intermediate Rust and strong
+  TypeScript experience
+- Existing system: a TypeScript service purchases labels through carrier APIs,
+  stores workflow state in PostgreSQL, retries jobs, and consumes callbacks
+- Problem: a request may time out after the carrier charged and created a label;
+  a retry can buy a duplicate while callbacks and reconciliation race
+- Outcome: no fit for the PostgreSQL-authoritative reliability core
+- BogKit components considered: Fold, ESE, and ANNy
+- BogKit components used: none
+- Archive:
+  [`runs/2026-08-02--carrier-label-ambiguity`](../runs/2026-08-02--carrier-label-ambiguity)
+
+### Evidence
+
+- Commands:
+  - `cargo test -p carrier-label-ambiguity --all-targets`
+  - `cargo fmt --manifest-path runs/2026-08-02--carrier-label-ambiguity/Cargo.toml -- --check`
+  - `cargo clippy -p carrier-label-ambiguity --all-targets -- -D warnings`
+  - `cargo run -p carrier-label-ambiguity --release -- demo --dir /private/tmp/carrier-label-demo/run`
+  - `cargo run -p carrier-label-ambiguity --release -- crash-demo --dir /private/tmp/carrier-label-crashes/run`
+  - `cargo run -p carrier-label-ambiguity --release -- acceptance --dir /private/tmp/carrier-label-acceptance/run --shipments 20000 --seeds 30`
+  - `runs/2026-08-02--carrier-label-ambiguity/scripts/measure-acceptance.sh target/release/carrier-label-ambiguity /private/tmp/carrier-label-measured/run /private/tmp/carrier-label-measured/output.log`
+- Tests: 3 passed, including callback order/duplication, a three-seed
+  end-to-end fixture, and the reviewer-required partial-tail → reopen → later
+  commit → second-reopen regression.
+- Demonstration:
+  - The small run completed 100 shipments with 10 ambiguous timeouts, 94 paid
+    labels, 5 review outcomes, 591 replayed decisions, and four simulated
+    restarts.
+  - Four real child-process exits around intent, carrier creation, confirmation,
+    and callback persistence recovered with one attempt and zero automatic
+    repurchases.
+  - The corrected 30-seed fixture completed 600,000 shipments, made exactly one
+    simulated carrier purchase call per shipment, replayed 3,478,477 decisions,
+    exposed 30,154 inconclusive outcomes as `needs_review`, and left no shipment
+    nonterminal.
+  - Maximum simulated convergence was 30 seconds, below the 60-second criterion.
+  - Developer, reviewer, and coordinator runs took 2.795–3.498 seconds and
+    sampled 11.48–18.20 MiB peak RSS on one arm64 macOS host, below 256 MiB.
+- Baseline comparison:
+  - The supplied unsafe retry policy can purchase again after a timeout that
+    already created a paid label.
+  - The prototype persists one intent before the network call, never purchases
+    again after that intent exists, and resolves missing evidence through carrier
+    lookup, a matching callback, or explicit human review.
+  - The local journal models an atomic PostgreSQL row-plus-history transaction;
+    it is not a PostgreSQL, network, multi-worker, or carrier integration test.
+  - Fold persists local incremental state but cannot make the carrier HTTP
+    operation atomic with PostgreSQL and would introduce a second authority.
+
+### Friction trail
+
+The developer began with the public root README and then read the starter,
+time-series, chat, and search examples. Fold's transactional writes, consistent
+reads, and maintained views were clear, while ESE and ANNy addressed unrelated
+search work. The required correctness boundary remained between PostgreSQL and an
+external carrier, so the developer selected no BogKit dependency.
+
+The first implementation retained decoded history and repeatedly rescanned it.
+The developer observed 293.66 MiB RSS, then moved verification to streaming replay
+with compact per-shipment counters. That discarded implementation was unavailable
+to the reviewer, so the historical number is not treated as independently
+reproduced evidence.
+
+Skeptical review then appended an incomplete final journal record, reopened
+successfully, committed another decision, and reproduced a checksum failure on the
+next reopen. The coordinator now truncates and syncs the recognized incomplete
+tail before returning a journal that may append. Review also found that the memory
+script could emit a false zero when process inspection was denied; it now fails
+without at least one valid sample.
+
+### Findings
+
+1. **Baseline duplicate-purchase risk — critical severity, high confidence.**
+   Automatic repurchase after an ambiguous timeout can create a second paid label.
+   Reproduction: run the deterministic acceptance fixture and inspect ambiguous
+   carrier-created outcomes. Smallest improvement: persist one attempt before the
+   request and prohibit repurchase whenever an attempt exists.
+2. **Unknown must be durable review state — critical severity, high confidence.**
+   The corrected fixture routed 30,154 inconclusive outcomes to review without a
+   second purchase. Reproduction: run the 30-seed acceptance command. Smallest
+   improvement: make ambiguity visible rather than interpreting missing evidence as
+   permission to retry.
+3. **Prototype partial-tail defect, fixed — high severity, high confidence.** The
+   original reopen ignored an incomplete tail but did not truncate it, so a later
+   append poisoned the journal. Reproduction: run
+   `journal_repairs_a_partial_tail_before_later_commits`. Smallest improvement:
+   truncate and sync the recognized tail before later writes.
+4. **Callback evidence scope — high severity, medium confidence.** Matching
+   duplicate/reordered callbacks are monotonic, but conflicting transactions or
+   prices, callback authentication, callback-before-creation, and concurrent
+   reconciliation are untested. Reproduction: inspect the reducer test. Smallest
+   improvement: define and test the production conflict policy before integration.
+5. **Poor product fit — high severity if forced, high confidence for this boundary.**
+   Fold does not own carrier/PostgreSQL atomicity, reconciliation, or review state.
+   Reproduction: compare the public Fold ownership model with the scenario's two
+   authorities. Smallest improvement: make authority and transaction boundaries
+   prominent in public onboarding; do not infer a workflow subsystem.
+6. **Durability and performance scope — medium severity, high confidence.** The
+   evidence covers sequential simulation and ordinary process exits after completed
+   local sync calls on one host, not power loss, production latency, or concurrent
+   workers. Reproduction: run the demos and measurement. Smallest improvement: add
+   database-enforced attempt uniqueness plus PostgreSQL/network/concurrency and
+   power-failure tests before production claims.
+
+### Decision audit
+
+The developer chose intent-before-network, no automatic repurchase, authoritative
+carrier evidence only when transaction and price agree, monotonic state changes,
+and atomic state-plus-history commits in the journal model. Automatic retry,
+absence-as-rejection, Fold as workflow authority, a Fold audit sidecar, retained
+decoded history, refunds, and carrier selection were rejected.
+
+The no-fit conclusion is limited to this PostgreSQL-authoritative reliability core.
+Carrier lookup semantics, real HTTP/database shapes, database-enforced concurrency,
+callback trust/conflicts, multi-worker races, kernel or power failure, and production
+deployment remain unresolved.
+
+## Trial 2 — Snapshot garbage-collection safety
+
+- Persona: backup-tools maintainer, Rust beginner with production Python experience
+- Existing system: a self-hosted daemon stores content-addressed blobs on POSIX and
+  publishes append-only JSONL snapshot manifests; a Python collector loads all
+  referenced hashes before direct deletion
+- Problem: bound collector memory while preventing malformed, newly published, or
+  crash-interrupted state from deleting live blobs
+- Outcome: no fit for the external manifest/publication/quarantine protocol
+- BogKit components considered: Fold, ESE, and ANNy
+- BogKit components used: none
+- Archive:
+  [`runs/2026-08-02--snapshot-gc-safety`](../runs/2026-08-02--snapshot-gc-safety)
+
+### Evidence
+
+- Commands:
+  - `cargo test -p snapshot-gc-safety --all-targets --offline`
+  - `cargo fmt --manifest-path runs/2026-08-02--snapshot-gc-safety/Cargo.toml -- --check`
+  - `cargo clippy -p snapshot-gc-safety --all-targets --offline -- -D warnings`
+  - `cargo build -p snapshot-gc-safety --release --offline`
+  - `python3 runs/2026-08-02--snapshot-gc-safety/acceptance.py target/release/snapshot-gc-safety`
+  - `target/release/snapshot-gc-safety fixture /private/tmp/snapshot-gc-scale`
+  - `python3 runs/2026-08-02--snapshot-gc-safety/measure.py --scratch /private/tmp/snapshot-gc-scale/.snapshot-gc -- target/release/snapshot-gc-safety plan /private/tmp/snapshot-gc-scale realistic`
+  - `target/release/snapshot-gc-safety verify-plan /private/tmp/snapshot-gc-scale realistic`
+  - `python3 runs/2026-08-02--snapshot-gc-safety/measure.py -- target/release/snapshot-gc-safety apply /private/tmp/snapshot-gc-scale realistic`
+  - `python3 runs/2026-08-02--snapshot-gc-safety/measure.py -- target/release/snapshot-gc-safety resume /private/tmp/snapshot-gc-scale realistic`
+- Tests: 3 Rust tests passed. The Python acceptance harness passed all 30 seeded
+  oracle repositories, malformed guards, publication during planning, publication
+  from quarantine, the reviewer-required forced same-name contention, every tested
+  quarantine/finalization crash boundary, and sequential idempotence.
+- Demonstration:
+  - The post-fix requested-scale plan read 1,000,000 references across 10,000
+    manifests and 300,000 blob entries, then selected all 51,000 eligible
+    unreachable blobs and zero referenced blobs.
+  - Planning took 1.485 seconds wall time, sampled 6,160,384 bytes peak RSS, and
+    used 38,376,656 bytes peak scratch against a 76,000,000-byte logical manifest
+    corpus.
+  - Apply quarantined all 51,000 candidates in 6.864 seconds. Resume removed all
+    51,000 in 2.963 seconds, restored none, and ended `complete`.
+  - A forced same-name race now yields exactly one successful publisher and one
+    existing-name failure; the successful manifest remains intact.
+- Baseline comparison:
+  - The frozen Python baseline directly deletes and has no quarantine, recovery,
+    or publisher fence.
+  - Its memory was highly variable: the developer observed 183,648,256 bytes,
+    while review sampled 124,436,480–133,971,968 bytes. The largest reviewed run
+    was only 245,760 bytes below 128 MiB, so the evidence supports inadequate
+    headroom, not a stable threshold breach.
+  - Fold would duplicate external manifest state and does not provide cooperative
+    publisher fencing, recoverable quarantine, or bounded external sorting.
+
+### Friction trail
+
+The developer read the public README and all four examples, then froze a runnable
+Python baseline before inspecting Fold's public persistence model. Atomic local
+transactions and snapshots were useful concepts, but no component owned the
+external manifest format, publication lock, quarantine, or bounded set difference.
+The prototype therefore used the standard library plus justified `serde_json`.
+
+The first online dependency resolution failed without registry access; cached
+dependencies worked offline. Strict lint corrected two file-open and extension
+checks. The developer moved unnecessary per-object directory syncs to phase commits
+and reran the crash matrix.
+
+Skeptical review forced two cooperative publishers to wait behind the publication
+lock after both passed the pre-lock final-name check. Both originally reported
+success, the second replaced the first append-only manifest, and later collection
+deleted the blob referenced only by the lost publication. The coordinator moved the
+final-name check under the lock, cleans the losing temporary file, and added a
+deterministic contention regression.
+
+### Findings
+
+1. **Baseline direct-deletion race — critical severity, high confidence.** A new
+   committed manifest can reference a blob after enumeration but before unlink.
+   Reproduction: compare the frozen baseline with the concurrent publisher test.
+   Smallest improvement: require temporary publication plus the shared lock and
+   recoverable quarantine.
+2. **Prototype same-name publication defect, fixed — critical severity, high
+   confidence.** Two cooperative publishers could both report success and one could
+   replace the other's append-only manifest. Reproduction: run the forced-contention
+   acceptance case. Smallest improvement: test the final name while holding the lock,
+   reject an existing destination, and remove the losing temporary file.
+3. **Malformed-input safeguard — critical severity, high confidence.** Truncated or
+   malformed committed manifests abort plan and apply before quarantine and identify
+   the file and record. Reproduction: run the acceptance harness. Smallest
+   improvement: preserve this fail-closed diagnostic in daemon integration.
+4. **Process-exit recovery — high severity, high confidence for tested boundaries.**
+   Resume preserved referenced blobs and completed after every injected ordinary
+   exit. Reproduction: run the crash matrix. Smallest improvement: qualify the real
+   filesystem and power-loss behavior before durability claims.
+5. **Memory evidence scope — medium severity, high confidence.** The external sorter
+   met the requested fixture limits, but manifest paths, chunk readers, and merge
+   state grow with the corpus; this is not an input-independent bound. Reproduction:
+   run the measured scale plan. Smallest improvement: state the measured workload and
+   extend the corpus shape before production sizing.
+6. **Poor product fit — medium severity, high confidence.** Fold does not own the
+   external publication/quarantine protocol. Reproduction: compare the public Fold
+   model with the runnable direct solution. Smallest improvement: document the
+   ownership boundary; do not infer a garbage-collection subsystem.
+
+### Decision audit
+
+The developer selected fixed binary hashes, external chunk sorting, a streaming
+merge, two-step quarantine/finalization, advisory publication locking, strict final
+newline validation, and full manifest revalidation under the lock. SQLite, Fold,
+probabilistic filters, direct unlink, and grace-period-only safety were rejected.
+
+Every real publisher must cooperate with the advisory lock. Same-filesystem rename,
+directory-sync support, lowercase blob filenames on a case-sensitive filesystem,
+publisher crash points, concurrent planners with one name, plan-file corruption,
+interrupted syscalls, kernel failure, and power loss remain unresolved.
+
+## Skeptical review
+
+- Claims reproduced:
+  - Both targeted formatting checks, all 6 Rust tests, both strict lints, both
+    release builds, both small demonstrations, carrier crash recovery, the full
+    carrier fixture, the full backup scale, and the backup acceptance matrix.
+  - Both no-fit conclusions against the current public BogKit contracts.
+- Claims rejected or softened:
+  - Carrier recovery before the incomplete-tail fix; production PostgreSQL/network,
+    concurrent-worker, callback-conflict, and power-loss implications; and a false
+    zero-memory result when process inspection was unavailable.
+  - Backup cooperative-publication safety before the same-name fix; a stable Python
+    memory-limit breach; input-independent bounded-memory, immutable-plan, and broad
+    filesystem durability wording.
+- Quality fixes required and completed:
+  - Carrier incomplete-tail truncation/sync, a second-reopen regression, and a
+    measurement failure when no RSS sample exists.
+  - Backup final-name checking under the publication lock, losing-temp cleanup, and a
+    forced two-publisher contention regression.
+- Remaining uncertainty:
+  - Real PostgreSQL/carrier integration, concurrent workflow workers, callback trust
+    and conflicts, hardware durability, and production distributions.
+  - Universal publisher cooperation, filesystem semantics, power failure, publisher
+    crash points, concurrent same-name planners, plan integrity, and corpus scaling.
+
+No BogKit correctness defect was demonstrated. The serious findings were defects in
+today's prototypes and were fixed before archival.
+
+## Cross-run synthesis
+
+- New evidence:
+  - Carrier/PostgreSQL atomicity and external manifest publication/quarantine are
+    application authority protocols, not capabilities supplied by BogKit.
+  - Conservative unknown/review handling and recoverable quarantine remain
+    domain-specific evidence, not proposed core subsystems.
+- Recurring evidence:
+  - The public capability and operational-boundary matrix is now supported by twelve
+    independent trials.
+  - The component-selective project path remains supported by four trials.
+  - Nameable pipeline and reader patterns remain supported by three trials.
+- Candidate improvements:
+  1. Public capability matrix covering component purpose, authoritative storage,
+     transaction and process scope, external authorities, cooperative filesystem
+     protocols, deployment, operating-system requirements, and hard limits.
+  2. Component-selective project path that avoids unrelated setup.
+  3. Documentation for nameable composed pipeline and reader types.
+- Observations not yet promoted:
+  - Workflow ambiguity patterns, publisher/quarantine protocols, external sorting,
+    and journal-tail recovery are one-trial or lab-specific observations.
+- No-fit or positioning signals:
+  - Embedded incremental data tools do not replace correctness protocols spanning an
+    external payment authority and PostgreSQL, or an externally published filesystem
+    corpus. Onboarding should make those ownership boundaries quickly visible.
+
+No new candidate was promoted. Today's two trials corroborate the existing public
+capability/operational-boundary matrix but do not meet a threshold for a new BogKit
+API or subsystem.
+
+## Validation
+
+- Trial-specific tests: 3 carrier and 3 snapshot tests passed, including both
+  skeptical-review regressions.
+- Strict lint and formatting: both targeted formatting checks and strict lints
+  passed; the complete nested workspace passed strict Clippy with warnings denied.
+- Runnable demonstrations: carrier small/crash/full-scale runs and backup
+  acceptance/small/full-scale runs passed after review corrections.
+- Nested lab workspace tests: all 69 tests passed.
+- BogKit root workspace tests: all 45 unit and documentation tests passed.
+- Archive and secret checks: `git diff --check`, coverage JSON parsing, marker
+  uniqueness, changed-path scope, generated-output, database, archive, model, binary,
+  credential-pattern, symlink, and file-size scans passed. Every intended changed
+  path is under `developer-simulation/`.
diff --git a/developer-simulation/reports/2026-08-03.md b/developer-simulation/reports/2026-08-03.md
new file mode 100644
index 0000000..a4eb917
--- /dev/null
+++ b/developer-simulation/reports/2026-08-03.md
@@ -0,0 +1,295 @@
+# Developer simulation — 2026-08-03
+
+<!-- bogkit-developer-simulation:2026-08-03 -->
+
+Two blind trials tested BogKit against substantially different existing-software
+problems: transitive software-provenance revocation and security-sensitive
+offline door-policy updates. Both developers reached reviewed no-fit conclusions
+after beginning with the public README and examples in separate sanitized copies
+of current `main`.
+
+Skeptical review preserved both decisions but rejected overclaims and found a
+high-severity defect in the door-policy prototype: a contiguous next version
+with the wrong base was mislabeled as a missing-version gap and produced an
+impossible range. The coordinator separated those failure modes, added a
+no-mutation/reopen regression, moved all generated state outside the archive,
+integrated both crates with the nested workspace lock, and reran all evidence.
+No BogKit correctness defect was demonstrated.
+
+## Trial 1 — Provenance revocation impact
+
+- Persona: release-security platform engineer with intermediate Rust and
+  PostgreSQL/CI experience
+- Existing system: PostgreSQL stores artifacts, dependency manifests,
+  attestations, releases, and cached promotion decisions; a nightly recursive
+  recomputation determines impact
+- Problem: quickly and deterministically block every release transitively
+  affected by revoked, missing, or cyclic provenance without introducing a
+  partially published decision generation
+- Outcome: no fit for the PostgreSQL-authoritative promotion gate
+- BogKit components considered: Fold, ESE, and ANNy
+- BogKit components used: Fold for the local input-fact persistence probe
+- Archive:
+  [`runs/2026-08-03--provenance-revocation-impact`](../runs/2026-08-03--provenance-revocation-impact)
+
+### Evidence
+
+- Commands:
+  - `cargo test --manifest-path developer-simulation/Cargo.toml -p provenance-revocation-reproducer --offline --locked`
+  - `cargo clippy --manifest-path developer-simulation/Cargo.toml -p provenance-revocation-reproducer --all-targets --offline --locked -- -D warnings`
+  - `cargo build --manifest-path developer-simulation/Cargo.toml -p provenance-revocation-reproducer --release --offline --locked`
+  - `provenance-revocation-reproducer generate | provenance-revocation-reproducer run <temp-state> candidate`
+  - `provenance-revocation-reproducer generate | provenance-revocation-reproducer run <temp-state> reference`
+  - an abort-on-panic release build with `PROVENANCE_CRASH=before_commit:1`
+    and `PROVENANCE_CRASH=after_commit:1`
+- Tests: 5 passed for transitive revocation, transitive missing manifests,
+  cycles, complete acyclic input, order independence, and duplicate-edge set
+  semantics.
+- Demonstration:
+  - The intentionally incomplete one-hop negative control matched only 1 of 3
+    decisions. It incorrectly approved a transitively revoked release and a
+    release containing a reachable cycle; both engines blocked the missing root.
+  - The reference produced stable tested paths
+    `app -> middle -> revoked-base` and `cycle-a -> cycle-b -> cycle-a`.
+  - Each tiny final Fold state occupied 48 KiB; this fixed overhead is not
+    evidence for the requested storage-ratio target.
+  - Abort before commit exited 134 and reopened without the artifact. Abort
+    after commit exited 134 and reopened with the artifact.
+- Baseline comparison:
+  - The real PostgreSQL baseline was evaluated conceptually, not reproduced.
+    Its recursive query can compute exact reachability from a transactionally
+    consistent authoritative snapshot, but nightly publication is too slow.
+  - The runnable slow reference loads Fold facts into ordinary Rust collections
+    and is only a bounded correctness oracle, not a PostgreSQL or production
+    performance baseline.
+  - The current public Fold operators do not supply joins, recursion, a feedback
+    edge, fixed-point iteration, or graph reachability. A custom `Push` node
+    could be written, but it would implement the graph engine and still leave a
+    PostgreSQL-to-local-store reconciliation protocol.
+
+### Friction trail
+
+The developer read the root README and all four public examples. Fold's atomic
+transactions, retractions, and snapshots looked useful, but the examples showed
+one delta moving through static branches rather than correlation of changing
+relations or recursive reachability. Public API inspection confirmed the absence
+of a supported join or fixed-point abstraction. A custom low-level operator was
+technically possible but would consume the prototype boundary while leaving the
+authoritative database handoff unsolved.
+
+The first standalone Cargo attempt tried to refresh the registry; cached offline
+resolution succeeded. Skeptical review later integrated the archive with the
+existing nested lock, reproduced all results on Fjall/lsm-tree 3.1.6, renamed
+the one-hop engine as a negative control, and required process-abort evidence so
+the report would not overstate ordinary Rust-unwind recovery.
+
+### Findings
+
+1. **No public join or recursive reachability — missing capability, blocker
+   severity, high confidence.** Reproduction: inspect the public operator list
+   and examples. Smallest improvement: document the boundary in the public
+   capability matrix. A recursive engine remains a one-trial observation, not a
+   threshold-qualified subsystem candidate.
+2. **PostgreSQL/local authority split — poor product fit, blocker severity, high
+   confidence.** Reproduction: compare the stated PostgreSQL authority with
+   Fold's local embedded store and process-owned stream. Smallest improvement:
+   keep computation/publication in the authoritative database unless a complete
+   source-offset and generation-publication protocol is assigned.
+3. **One-hop negative control approves unsafe releases — prototype correctness
+   defect, blocker severity, high confidence.** Reproduction: run both engines
+   over the three-query corpus. Smallest improvement: never use the negative
+   control as a gate; it is not an implemented Fold pipeline or a BogKit defect.
+4. **Scale and witness scope — performance/evidence limitation, major severity,
+   high confidence.** The requested 500,000-artifact/5-million-edge fixture,
+   100-updates-per-second concurrency, memory bound, and storage ratio were not
+   measured after correctness no-fit was established. Sorted traversal gives a
+   stable first witness on tested fixtures, not a globally minimal proof.
+
+### Decision audit
+
+The developer rejected nightly-only recomputation, a Fold side cache, a one-hop
+gate, ESE, ANNy, and a bespoke recursive `Push` node. The reviewed direction is
+an incremental reverse-dependency generation published atomically in PostgreSQL,
+or another proven recursive graph system that can preserve the named authority.
+The no-fit decision does not claim that arbitrary custom Rust inside Fold could
+never meet the numeric targets.
+
+## Trial 2 — Offline door policy update
+
+- Persona: building-access systems developer, Rust beginner with production
+  embedded-C experience
+- Existing system: PostgreSQL compiles a nightly sorted policy file for 2,000
+  intermittently connected controllers
+- Problem: safely apply frequent revocations and temporary grants under
+  duplicate, reordered, skipped, truncated, and power-interrupted delivery while
+  keeping a complete prior policy active until the new generation is verified
+- Outcome: no fit for the fixed-image controller safety boundary
+- BogKit components considered: Fold, ESE, and ANNy
+- BogKit components used: Fold for transactional keyed-state fit evidence
+- Archive:
+  [`runs/2026-08-03--offline-door-policy-update`](../runs/2026-08-03--offline-door-policy-update)
+
+### Evidence
+
+- Commands:
+  - `cargo test --manifest-path developer-simulation/Cargo.toml -p offline-door-policy-fit-probe --offline --locked`
+  - `cargo clippy --manifest-path developer-simulation/Cargo.toml -p offline-door-policy-fit-probe --all-targets --offline --locked -- -D warnings`
+  - `cargo build --manifest-path developer-simulation/Cargo.toml -p offline-door-policy-fit-probe --release --offline --locked`
+  - three release demonstrations using separate empty `/private/tmp` state roots
+- Tests: 2 passed, including the reviewer-required wrong-base/no-mutation/reopen
+  regression.
+- Demonstration:
+  - Zero mismatches across 20,000 generated authorization queries before and
+    20,000 after 50,000 revocations.
+  - The final nested-workspace runs applied 60,000 initial grants in 49-63 ms,
+    applied 50,000 revocations in 48-51 ms, and checkpointed in 4-5 ms.
+  - A wrong-base version 2 returned `BaseMismatch`, left coherent version-1
+    status, did not revoke the tested grant, and preserved it across reopen.
+  - The same active version was labeled `SameVersionIgnoredUnverified`; payload
+    identity and authenticity were not claimed.
+  - Old and skipped versions were rejected, contiguous repair succeeded, and
+    final active version 4 survived clean checkpoint/reopen.
+  - The open Fold directory had 14 files with a 67,115,332-byte sparse logical
+    extent and 3,129,344 allocated bytes. Clean close left 11 files with
+    3,072,778 logical and 3,104,768 allocated bytes.
+  - Whole-process host RSS was 25,526,272-26,820,608 bytes. It includes the
+    reference map, generated bundles, runtime, code, and database mappings, so
+    the 4 MiB controller-memory bound remains not demonstrated.
+- Baseline comparison:
+  - The naive in-place file baseline mixes old and new bytes after the first
+    modeled 4 KiB write.
+  - Fold correctly handled transactional grant retractions and version metadata
+    on the host, but uses a filesystem directory rather than the fixed 16 MiB
+    flash image and does not expose each physical 4 KiB write for exhaustive
+    power-cut injection.
+  - Signed framing, length/truncation checks, bundle identity, and key management
+    are application-specific work outside the probe.
+
+### Friction trail
+
+The developer selected Fold after the starter and time-series examples showed
+atomic keyed retractions and reopen. A pre-created regular 16 MiB file could not
+serve as the database path; the public constructor documents that store-open
+failure may panic. Host results were fast, but neither sparse filesystem layout
+nor whole-process RSS established the fixed flash or memory contract.
+
+Skeptical review reproduced the full evidence on the final nested dependency
+set, found the wrong-base classification defect, showed that rejected-gap status
+is process-local, and showed that same-version content was ignored without
+identity verification. The coordinator fixed the consequential wrong-base bug,
+narrowed both softer claims, moved runtime/test state to caller-supplied or
+unique temporary paths, and reran the suite and demonstration three times.
+
+### Findings
+
+1. **Wrong-base classification, fixed — prototype correctness defect, high
+   severity, high confidence.** Original reproduction: after active version 1,
+   version 2 based on version 0 returned `Missing { expected: 2, received: 2 }`
+   and `missing=2..1`. Smallest improvement completed: return `BaseMismatch`,
+   make no policy mutation, keep coherent status, and cover reopen.
+2. **Fixed/raw-flash mismatch — poor product fit, critical severity, high
+   confidence.** Reproduction: the regular-file-path probe and absence of a raw
+   block interface. Smallest improvement: retain fixed/raw flash as a documented
+   non-goal and use a purpose-built controller format; do not infer a new engine.
+3. **No controllable physical write-cut boundary — missing capability, critical
+   severity, high confidence.** Reproduction: Fold exposes logical transactions
+   and checkpoint, not every 4 KiB physical write. Smallest improvement: build
+   the controller-specific dual-generation recovery harness outside BogKit and
+   keep the boundary visible in onboarding.
+4. **Working-memory target not demonstrated — performance limitation, high
+   severity, medium confidence.** Reproduction: three whole-process RSS runs.
+   Smallest improvement: measure a real controller implementation with allocator
+   and storage telemetry; do not attribute the harness RSS to Fold.
+5. **Bundle trust and status scope — missing application capability, high
+   severity, high confidence.** Signed/truncated intake, same-version payload
+   identity, and persistent rejected-gap diagnostics were not implemented.
+   Smallest improvement: define them in the application wire/recovery protocol;
+   this does not qualify as a BogKit subsystem candidate.
+6. **Durability boundary can be overread — documentation gap, medium severity,
+   high confidence.** Smallest improvement: distinguish process commit,
+   checkpoint, filesystem behavior, fixed capacity, and raw-flash power cuts in
+   the public capability matrix.
+
+### Decision audit
+
+The developer rejected in-place file replacement, Fold on the controller, ESE,
+ANNy, and Fold only in the central compiler. A purpose-built fixed-image format
+with an inactive staging region, redundant activation record, streaming signed
+verification, monotonic version rules, and torn-write recovery owns the actual
+safety boundary. PostgreSQL remains the authoritative compiler input.
+
+## Skeptical review
+
+- Claims reproduced:
+  - Both final formatting checks, all 7 new tests, strict lints, release builds,
+    both provenance decisions, both abort boundaries, and three door runs.
+  - The absence of public join/recursive reachability, the local transaction
+    boundary, filesystem-directory storage, and both no-fit conclusions.
+- Claims rejected or softened:
+  - The one-hop negative control as a real Fold composition or BogKit defect;
+    the slow reference as a reproduced PostgreSQL baseline; globally minimal
+    witnesses; broad crash/power-loss implications; and scale claims.
+  - Door duplicate identity, persisted rejected-gap status, a Fold-specific
+    memory failure, general corruption behavior, hardware timing, and a signed
+    envelope as a core candidate.
+- Quality fixes required and completed:
+  - Distinct wrong-base handling with non-mutation/reopen regression.
+  - Caller-supplied/temporary state, nested-lock integration, removal of package
+    locks/generated databases/build output, archive READMEs, and all final reruns.
+- Remaining uncertainty:
+  - Production PostgreSQL ingestion/publication, correct incremental graph scale,
+    global witness policy, concurrency, memory, and storage amplification.
+  - Real signed bundles, controller hardware, fixed-image layout, persisted
+    diagnostics, wear, erase geometry, physical write atomicity, and power loss.
+
+No BogKit correctness defect was demonstrated. The serious defect was in the
+door-policy prototype and was fixed before archival.
+
+## Cross-run synthesis
+
+- New evidence:
+  - Exact recursive graph processing and fixed raw-flash policy activation sit
+    outside the current public BogKit abstractions for these two workloads.
+  - Provenance joins/recursion and signed door bundles remain one-trial
+    observations; neither qualifies as a new core API or subsystem candidate.
+- Recurring evidence:
+  - The public capability and operational-boundary matrix is now supported by
+    fourteen independent trials.
+  - The door trial independently repeats the July 29 raw-NOR/fixed-flash no-fit
+    boundary.
+  - The component-selective project path remains supported by four trials.
+  - Nameable pipeline and reader patterns remain supported by three trials.
+- Candidate improvements:
+  1. Public capability matrix covering component purpose, authoritative storage,
+     transaction/process scope, joins/recursion, external authorities,
+     filesystem/raw-flash boundaries, deployment, OS requirements, and hard
+     limits.
+  2. Component-selective project path that avoids unrelated setup.
+  3. Documentation for nameable composed pipeline and reader types.
+- Observations not yet promoted:
+  - Durable recursive provenance, canonical graph witnesses, signed delta
+    delivery, bundle identity, and controller activation formats.
+- No-fit or positioning signals:
+  - Embedded incremental state is not a substitute for an authority-safe
+    PostgreSQL graph publication protocol or a fixed-capacity raw-flash recovery
+    format with explicit physical fault injection.
+
+No new candidate was promoted.
+
+## Validation
+
+- Trial-specific tests: all 7 passed, including the skeptical-review regression.
+- Strict lint and formatting: every nested package passed its formatting check;
+  both new packages and the complete nested workspace passed strict Clippy with
+  warnings denied.
+- Runnable demonstrations: the provenance negative control/reference, both
+  process-abort boundaries, and all three corrected door runs passed with the
+  results above.
+- Nested lab workspace tests: all 76 tests passed.
+- BogKit root workspace tests: all 45 unit and documentation tests passed after
+  the sandboxed first attempt reached ESE's required model download and the
+  unchanged suite was rerun with network access.
+- Archive and secret checks: `git diff --check`, coverage JSON parsing, marker
+  uniqueness, changed-path scope, generated-output, database, archive, model,
+  binary, credential-pattern, symlink, and file-size scans passed. Every intended
+  changed path is under `developer-simulation/`.
diff --git a/developer-simulation/reports/2026-08-04.md b/developer-simulation/reports/2026-08-04.md
new file mode 100644
index 0000000..ac4ac4f
--- /dev/null
+++ b/developer-simulation/reports/2026-08-04.md
@@ -0,0 +1,285 @@
+# Developer simulation — 2026-08-04
+
+<!-- bogkit-developer-simulation:2026-08-04 -->
+
+Two blind trials tested BogKit against substantially different existing-software
+problems: mixed-version event-contract safety during rolling deployments and
+security-sensitive OCR redaction remapping after text correction. Both fresh
+developers began with the public README and examples in separate sanitized
+copies of current `main`, built runnable standalone prototypes, and reached
+reviewed no-fit conclusions.
+
+Skeptical review preserved both fit decisions but rejected initial quality
+claims and found four archive blockers. Duplicate raw JSON member names could
+false-allow a contract. The redaction mapper could cover the wrong repeated
+occurrence, trust stale completed files, and reconnect a stale checkpoint to
+truncated partial output. The coordinator fixed all four classes with exact
+regressions and reran the affected demos, strict checks, and full workloads.
+None was a BogKit correctness defect.
+
+## Trial 1 — Mixed-version contract gate
+
+- Persona: deployment-platform developer with intermediate Rust and production
+  Go experience
+- Existing system: repository-owned versioned JSON contracts and topology, with
+  a CI script that compares only adjacent versions
+- Problem: cover every supported producer-consumer version pair during rolling
+  deployment and return deterministic minimal counterexamples
+- Outcome: no fit for the bounded read-only compatibility gate
+- BogKit components considered: Fold, ESE, and ANNy
+- BogKit components used: none
+- Archive:
+  [`runs/2026-08-04--mixed-version-contract-gate`](../runs/2026-08-04--mixed-version-contract-gate)
+
+### Evidence
+
+- Commands:
+  - `cargo test --offline --locked --manifest-path developer-simulation/Cargo.toml -p mixed-version-contract-gate`
+  - `cargo clippy --offline --locked --manifest-path developer-simulation/Cargo.toml -p mixed-version-contract-gate --all-targets -- -D warnings`
+  - `cargo build --release --offline --locked --manifest-path developer-simulation/Cargo.toml -p mixed-version-contract-gate --bins`
+  - the archived generator and gate against external demo and workload
+    directories under `/private/tmp`
+  - `python3 .../oracle.py .../fixtures/semantic_cases.json`
+- Tests: 8 passed after the reviewer-required duplicate-member regression.
+- Demonstration:
+  - The independent Python oracle matched all 64 fixed semantic cases.
+  - The demo evaluated all 9 mixed-version pairs and blocked exactly the 3
+    producer versions incompatible with the narrowed consumer contract.
+  - Raw duplicate members at the root, contract, schema, topology, fleet, and
+    candidate layers now return `review-required`; the reviewer's exact
+    `{"type":"string","type":"integer"}` false allow is fixed.
+  - Skeptical review reversed and identically duplicated the full input and
+    obtained byte-identical output. A reverse relationship produced 18 bounded
+    pairs and the same 3 issues.
+  - The corrected full fixture contained 300 services, 120 topics, 1,800
+    contracts, 12,000 relationships, 25 candidates, and 108,000 evaluated
+    version pairs. The final nested-workspace run returned 237 issues and no
+    review issues in 0.52 seconds, with 119,144,448 bytes maximum RSS. Output
+    SHA-256 remained
+    `d5cbec30584c237b56d03a507292ffb4772234c34be1f47a5ebbb3436e4fd5d7`.
+- Baseline comparison:
+  - The stated existing gate was modeled but not preserved as a runnable
+    baseline, so no measured speed or correctness improvement over it is
+    claimed.
+  - The application-specific contract subset and default policy are not full
+    JSON Schema, Avro, or Protobuf semantics.
+  - Fold persistence would not remove strict parsing, recursive inclusion,
+    witness construction, or diagnostics from this bounded immutable pass.
+
+### Friction trail
+
+The developer read the public README and starter, timeseries, chat, and search
+examples before inspecting manifests or component source. A clean-target
+`cargo run -p starter --offline` reached ESE's model download even though the
+starter source uses only Fold. The developer then confirmed that both the
+starter manifest and project scaffold include all three components.
+
+After reading Fold's public stream and pipeline interfaces, the developer kept
+the gate standalone with `serde` and `serde_json`. Skeptical review reproduced
+the claimed workload but defeated `serde_json::Value`'s last-member-wins parsing
+with a raw duplicate type key. The coordinator added a duplicate-rejecting
+recursive JSON visitor and reran the complete evidence set.
+
+### Findings
+
+1. **Duplicate-member false allow, fixed — prototype correctness defect, high
+   severity, high confidence.** Reproduction: the reviewer's conflicting raw
+   `type` keys. Smallest improvement completed: reject duplicate object members
+   before conversion to `Value`, at every nesting level.
+2. **Unconditional starter/scaffold components — API friction and documentation
+   gap, moderate severity, high confidence.** Reproduction: the clean-target
+   starter run plus current manifests. Smallest improvement: remove unused
+   starter dependencies and make generated components opt-in; disclose ESE's
+   model artifact when selected.
+3. **Bounded batch analysis is poor product fit — informational severity, high
+   confidence.** Reproduction: compare the four immutable inputs and pure output
+   with Fold's durable runtime delta/materialization model. Smallest improvement:
+   document when plain in-memory analysis is preferable; no new core API is
+   justified.
+4. **Evidence scope — moderate severity, high confidence.** The fixed cases are
+   broad but not a formal inclusion proof; timing and memory are one generated
+   workload on one host.
+
+### Decision audit
+
+The developer chose a standalone strict parser, a documented small schema
+language, receiver-materialized defaults, one smallest witness per version pair,
+ordered semantic identities, fail-review behavior for unsupported input, and an
+in-memory touched-pair cache. Fold, ESE, ANNy, durable cross-job caching, full
+standards support, deployment orchestration, and application-semantic proofs
+were rejected. Formal exhaustiveness, arbitrary deeply nested witness
+minimality, and production contract semantics remain unresolved.
+
+## Trial 2 — OCR redaction remapping
+
+- Persona: public-records processing engineer, Rust beginner with production
+  Python experience
+- Existing system: human-reviewed UTF-8 offsets are clamped into OCR text after
+  Unicode cleanup and glyph regeneration
+- Problem: remap reviewed spans without exposing corrected sensitive text,
+  silently guessing ambiguity, or publishing incomplete geometry
+- Outcome: no fit for the independent page-local transformation
+- BogKit components considered: Fold, ESE, and ANNy
+- BogKit components used: none
+- Archive:
+  [`runs/2026-08-04--ocr-redaction-remap`](../runs/2026-08-04--ocr-redaction-remap)
+
+### Evidence
+
+- Commands:
+  - `cargo test --offline --locked --manifest-path developer-simulation/Cargo.toml -p ocr-redaction-remap`
+  - `cargo clippy --offline --locked --manifest-path developer-simulation/Cargo.toml -p ocr-redaction-remap --all-targets -- -D warnings`
+  - `developer-simulation/runs/2026-08-04--ocr-redaction-remap/run_demo.sh`
+  - a release build plus the exact external 5,000-page workload under
+    `/private/tmp`
+- Tests: 7 passed, including the reviewer's repeated-occurrence, changed-input,
+  truncated-output, changed-audit, stale-checkpoint, and short-partial
+  regressions.
+- Demonstration:
+  - The final fixture run checked 244 pages: 243 exact, 1 conservative, 0
+    blocked, 0 expected-rectangle mismatches, and no complete sentinel strings
+    in output or audit.
+  - Reversed and duplicated spans remained byte-identical. Controlled stops at
+    pages 73 and 191 resumed to the uninterrupted bytes.
+  - Invalid offsets, UTF-8 boundaries, missing geometry, and contradictory
+    geometry blocked with zero rectangles; invalid raw UTF-8 produced only a
+    static error code and line number.
+  - The reviewer's changed-first repeated secret is now conservatively covered
+    at the source-mapped region instead of being mislabeled exact at the
+    unchanged second occurrence.
+  - Completed resume now verifies exact paths, lengths, and SHA-256 values for
+    input, output, and audit. Changed input, truncated output, and changed audit
+    fail. Fresh runs invalidate stale state; short or changed partial prefixes
+    fail instead of being extended.
+  - The corrected nested-workspace 5,000-page, 20-million-ASCII-scalar,
+    150,000-span workload completed in 38.82 seconds with 5,947,392 bytes
+    maximum RSS. It emitted
+    5,000 output lines, 5,000 audit lines, and 600,000 exact rectangles. A
+    second full output and audit were byte-identical.
+- Baseline comparison:
+  - `baseline_clamp.py` deterministically shows partial exposure for the stated
+    stale-offset algorithm without printing the modeled secret. This is
+    conditional evidence about that algorithm, not proof of the production
+    implementation.
+  - Fold owns durable incremental views, while ESE and ANNy provide semantic
+    embeddings and approximate retrieval. None supplies authoritative Unicode
+    correspondence or glyph-redaction geometry.
+
+### Friction trail
+
+The developer followed the same public onboarding order independently and hit
+the same unused ESE model-download coupling before inspecting manifests. After
+freezing the clamping reproducer, the developer selected no BogKit component and
+built a page-streaming Rust transformer with bounded edit alignment, complete
+geometry validation, conservative fallbacks, content-free records, and
+controlled process checkpoints.
+
+Skeptical review reproduced the benign fixtures but constructed a changed first
+occurrence followed by an unchanged duplicate. The mapper redacted only the
+second occurrence. Review also changed completed input, truncated final output,
+and reconnected a stale checkpoint to short partial files. The coordinator fixed
+all three classes and reran every affected check and scale case.
+
+### Findings
+
+1. **Stale-offset clamp exposure — modeled baseline correctness defect,
+   critical severity, high confidence for the reproducer.** Smallest improvement:
+   stop clamping revised offsets; validate correspondence and block unresolved
+   mapping or geometry.
+2. **Wrong repeated occurrence, fixed — prototype confidentiality defect,
+   critical severity, high confidence.** Smallest improvement completed: compare
+   literal candidates with source-position edit mapping and conservatively cover
+   disagreement.
+3. **Completed and partial recovery integrity, fixed — prototype correctness
+   defects, critical severity, high confidence.** Smallest improvement completed:
+   strong final bindings, fresh-state invalidation, and prefix validation that
+   never extends a short file.
+4. **Unconditional starter/scaffold components — API friction and documentation
+   gap, moderate severity, high confidence.** This independently repeats Trial
+   1's setup evidence.
+5. **Page-local remapping is poor product fit — informational severity, high
+   confidence.** No current public component removes alignment, ambiguity, or
+   geometry work; approximate matching would be inappropriate.
+6. **Evidence scope — moderate severity, high confidence.** Sentinel checks are
+   not a general leakage proof, the workload is ASCII, metadata must be declared
+   non-sensitive by the caller, and recovery covers controlled process restart,
+   not filesystem or power-loss durability.
+
+### Decision audit
+
+The developer chose validated UTF-8 byte spans, Unicode grapheme rectangles,
+bounded normalization and edit mapping, conservative token/line coverage,
+complete one-to-one geometry, sorted duplicate handling, allow-listed identifier
+metadata, paired external outputs, prefix-validated checkpoints, and SHA-256-
+bound completion markers. Fold, ESE, ANNy, approximate cross-page matching, PDF
+processing, OCR, entity detection, bidirectional layout, and power-loss claims
+were rejected. Production normalization rules, edits beyond 256, arbitrary
+Unicode scale, metadata classification, and real filesystem failure remain
+unresolved.
+
+## Skeptical review
+
+- Claims reproduced:
+  - Both final no-fit decisions, starter/scaffold coupling, contract demo and
+    full workload, redaction baseline reproducer, fixture demo, controlled
+    resumes, malformed-input failures, and final scale run.
+- Claims rejected or softened:
+  - Strict contract parsing before duplicate-key rejection; a measured
+    existing-gate comparison; broad standards, Unicode, confidentiality,
+    portability, memory, durability, crash, power-loss, or sentinel-leakage
+    guarantees; and the original completed-resume claims.
+- Quality fixes required and completed:
+  - Recursive duplicate-member rejection.
+  - Source-correspondence validation for literal redaction matches.
+  - SHA-256-bound completed state and stale/short partial rejection.
+  - Nested-workspace integration, external generated state, archive READMEs,
+    and final reruns.
+- Remaining uncertainty:
+  - Formal contract inclusion and witness proofs, production schema semantics,
+    multi-host performance, full Unicode production corpora, authoritative
+    metadata classification, arbitrary layout, and storage/power failures.
+
+No BogKit correctness defect was demonstrated. The serious findings belonged to
+the modeled clamping baseline and the two prototypes and were fixed or narrowly
+classified before archival.
+
+## Cross-run synthesis
+
+- New evidence:
+  - Contract-language inclusion and reviewed Unicode/glyph correspondence are
+    application-specific subsystems outside the current public BogKit roles.
+  - Both trials independently encountered unconditional all-component starter
+    and scaffold dependencies.
+- Recurring evidence:
+  - The public capability and operational-boundary matrix is now supported by
+    16 independent trials.
+  - The component-selective project path is now supported by 6 trials.
+  - Nameable pipeline and reader patterns remain supported by 3 trials.
+- Candidate improvements:
+  1. Public capability and operational-boundary matrix.
+  2. Component-selective project path, including a true Fold-only starter.
+  3. Documentation for nameable composed pipeline and reader types.
+- Observations not yet promoted:
+  - Contract-language tooling, Unicode/glyph redaction, final-output binding,
+    and conservative correspondence APIs.
+- No-fit or positioning signals:
+  - BogKit's persistent local data semantics, embeddings, and approximate
+    retrieval should not replace bounded standards analysis or exact
+    security-sensitive document transformation when those components do not own
+    the authority or algorithm.
+
+No new candidate was promoted.
+
+## Validation
+
+- Trial-specific tests: all 15 corrected tests passed.
+- Strict lint and formatting: both new packages and the complete nested
+  workspace passed formatting and Clippy with warnings denied.
+- Runnable demonstrations: contract demo/oracle/full workload and corrected
+  redaction fixture/resume/full workload passed with the scoped results above.
+- Nested lab workspace tests: all 91 tests passed.
+- BogKit root workspace tests: all 45 unit and documentation tests passed.
+- Archive and secret checks: `git diff --check`, coverage JSON parsing, marker
+  uniqueness, changed-path scope, generated-output, database, archive, model,
+  binary, credential-pattern, symlink, and file-size scans passed. Every intended
+  changed path is under `developer-simulation/`.
diff --git a/developer-simulation/reports/2026-08-05.md b/developer-simulation/reports/2026-08-05.md
new file mode 100644
index 0000000..53c304a
--- /dev/null
+++ b/developer-simulation/reports/2026-08-05.md
@@ -0,0 +1,298 @@
+# Developer simulation — 2026-08-05
+
+<!-- bogkit-developer-simulation:2026-08-05 -->
+
+Two blind trials tested BogKit against unrelated existing-software problems:
+streaming paired-FASTQ demultiplexing with bounded output handles, and exact
+map-tile invalidation from authoritative parcel geometry deltas. Fresh
+developers began from the public README and examples in separate sanitized
+copies of current `main`. Both built runnable standalone Rust prototypes and
+reached reviewed no-fit conclusions.
+
+Skeptical review preserved both fit decisions but found correctness and evidence
+blockers in each prototype. The coordinator fixed case-insensitive output-name
+collisions, incomplete FASTQ identifier validation, a false-passing file-handle
+observer, duplicate JSON member acceptance, and invalid polygon topology
+acceptance. All affected tests, demonstrations, observers, and scale workloads
+were rerun. None of these findings was a BogKit correctness defect.
+
+## Trial 1 — Bounded FASTQ barcode spill
+
+- Persona: sequencing-pipeline engineer with intermediate Rust and production
+  Python experience
+- Existing system: a Python demultiplexer that routes paired reads by exact
+  barcode and keeps one output handle open per sample
+- Problem: stream 1,000,000 paired records to 384 sample destinations, apply
+  unique Hamming-distance-one correction, preserve ambiguous ties, and keep no
+  more than 24 sample output files open
+- Outcome: no fit for this stateless, one-pass byte router
+- BogKit components considered: Fold, ESE, and ANNy
+- BogKit components used: none
+- Archive:
+  [`runs/2026-08-05--fastq-barcode-spill`](../runs/2026-08-05--fastq-barcode-spill)
+
+### Evidence
+
+- Commands:
+  - `cargo test --offline --locked --manifest-path developer-simulation/Cargo.toml -p fastq-barcode-spill`
+  - `cargo clippy --offline --locked --manifest-path developer-simulation/Cargo.toml -p fastq-barcode-spill --all-targets -- -D warnings`
+  - `developer-simulation/runs/2026-08-05--fastq-barcode-spill/scripts/verify.sh`
+  - the archived `measure_open_files.py` observer against the release binary
+  - two release-mode 1,000,000-pair runs from a non-seekable generated pipe
+- Tests: 5 Rust tests and the corrected Python integration suite passed.
+- Demonstration:
+  - Clean exact-match outputs were byte-identical to the trial-created Python
+    baseline for every sample and unmatched file.
+  - Seeded unique one-base correction, unmatched routing, barcode-level ties
+    between two whitelist entries for the same sample, and ties across samples
+    all produced the expected classifications.
+  - Truncation, unequal sequence and quality lengths, mismatched pair IDs,
+    invalid identifiers, and colliding output aliases failed without a
+    completion manifest or sensitive read/sample content in diagnostics.
+  - An independent `lsof` observer measured 24 open FASTQ outputs across 45
+    successful polls; a forced observer failure now fails the check.
+  - The final mixed run processed exactly 1,000,000 pairs: 250,000 exact,
+    250,000 corrected, 250,000 ambiguous, and 250,000 unmatched. It completed
+    in 1.93 seconds, used 63,750,144 bytes maximum RSS, and reported 24 maximum
+    open writers.
+  - Two complete 387-file output trees produced the same SHA-256:
+    `88e0f8be6e3f5622b19d4cf530c1af20a2f69ce8ece18c3bf347a466e22cd644`.
+- Baseline comparison:
+  - The repository contained no production FASTQ implementation, so the Python
+    baseline is a minimal trial-created model of the stated exact-match and
+    all-handles-open behavior, not evidence about an unavailable production
+    program.
+  - Its 384-output failure under a 64-file process limit confirms the modeled
+    design pressure only. No production speedup claim is made.
+  - Fold maintains durable views; ESE and ANNy provide embeddings and
+    approximate retrieval. None removes the required parsing, exact barcode
+    classification, byte preservation, or file-descriptor management.
+
+### Friction trail
+
+The developer read the README, starter, timeseries, chat, and search examples,
+then inspected the project scaffold. Because the scaffold creates a public
+example with all three components, the developer made a standalone trial and
+modeled the unavailable Python baseline first. The first clean fixture contained
+an extra blank line, the first parser used record-relative error lines, and a
+naive correction path scanned every barcode. Those trial defects were fixed
+before final evidence.
+
+Round-robin samples caused excessive output reopening even with a bounded LRU,
+so the developer added per-destination buffers while preserving read order. A
+first piped benchmark raced barcode-map creation, and sandboxed macOS resource
+reporting could not read the RSS counter; both measurements were corrected and
+rerun. Skeptical review then reproduced the headline workload but showed that
+`Alpha`/`alpha` and reserved aliases could share a filename, malformed read IDs
+were accepted, and the external observer could pass without a valid sample. The
+coordinator added preflight name checks, explicit supported-ID validation, and a
+positive-observation requirement, then reran the suite, observer, and two full
+workloads.
+
+### Findings
+
+1. **Case-folded output collision, fixed — correctness defect, high severity,
+   high confidence.** Reproduction: use sample aliases differing only by ASCII
+   case or a reserved `Ambiguous`/`Unmatched` alias. Smallest improvement
+   completed: reject all case-folded filename collisions before output creation.
+2. **Incomplete identifier admission, fixed — correctness defect, moderate
+   severity, high confidence.** Reproduction: empty/control identifiers or
+   contradictory slash and CASAVA mate roles. Smallest improvement completed:
+   validate the documented identifier subset without echoing rejected data.
+3. **False-passing descriptor observer, fixed — evidence defect, high severity,
+   high confidence.** Reproduction: force the observer command to fail for every
+   poll. Smallest improvement completed: require successful positive polls and
+   retain the real 45-poll result.
+4. **All-component scaffold — API friction and documentation gap, moderate
+   severity, high confidence.** Reproduction: inspect the current project
+   generator. Smallest improvement: make components opt-in.
+5. **Stateless byte routing is poor product fit — informational severity, high
+   confidence.** Smallest improvement: state this boundary in the public
+   capability matrix; no new component is justified.
+6. **Evidence scope — moderate severity, high confidence.** Resource figures are
+   one generated workload on one host, the parser intentionally supports a
+   bounded identifier grammar, individual FASTQ lines are not length-capped,
+   and manifest creation does not claim filesystem power-loss durability.
+
+### Decision audit
+
+The developer chose a streaming paired-record reader, byte-preserving output,
+fixed-length exact and precomputed neighbor maps, barcode-level ambiguity,
+per-destination buffering, a 24-entry writer LRU, static privacy-safe errors,
+and an atomically renamed completion manifest. Fold, ESE, ANNy, one writer per
+sample, approximation, compression, parallel parsing, full FASTQ dialect
+support, and power-loss guarantees were rejected. Maximum record length,
+production barcode grammars, compressed input, and multi-host performance
+remain unresolved.
+
+## Trial 2 — Parcel delta tile planner
+
+- Persona: civic GIS platform developer, Rust beginner with production
+  TypeScript experience
+- Existing system: a stateless TypeScript job that scans map tiles touched by
+  authoritative old and new parcel geometries
+- Problem: produce the exact deterministic `z/x/y` invalidation plan for
+  Polygon and MultiPolygon deltas at zooms 12–16 without reading or writing a
+  parcel store
+- Outcome: no fit for this bounded, plan-only geometry transformation
+- BogKit components considered: Fold, ESE, and ANNy
+- BogKit components used: none
+- Archive:
+  [`runs/2026-08-05--parcel-delta-tiles`](../runs/2026-08-05--parcel-delta-tiles)
+
+### Evidence
+
+- Commands:
+  - `cargo test --offline --locked --manifest-path developer-simulation/Cargo.toml -p parcel-delta-tiles`
+  - `cargo clippy --offline --locked --manifest-path developer-simulation/Cargo.toml -p parcel-delta-tiles --all-targets -- -D warnings`
+  - `developer-simulation/runs/2026-08-05--parcel-delta-tiles/scripts/verify.sh`
+  - the archived Rust CLI and TypeScript mirror on a generated 1,000-edit,
+    200-distinct-vertex-per-line workload
+- Tests: 8 Rust tests passed after strict JSON and topology regressions.
+- Demonstration:
+  - Rust matched the TypeScript full-scan mirror on insertion, deletion,
+    translation, concavity, holes, MultiPolygon, edge/corner contact, and a
+    seeded 10,000-edit case.
+  - An independent analytical rectangle enumerator matched 500 edits and 34,650
+    expected tiles without sharing the polygon predicate.
+  - Ten permutations were byte-identical. Eleven malformed cases, including
+    recursive duplicate members, self-intersection, zero area, outside holes,
+    and overlapping holes, failed deterministically with empty stdout.
+  - The final 7,977,879-byte workload mixed inserts, deletes, replacements,
+    concave polygons, holes, MultiPolygons, four extents, and 1,000 lines with
+    200 distinct vertices each. Rust and the mirror produced the same 2,922
+    tile lines.
+  - On that workload Rust completed in 0.14 seconds with 2,670,592 bytes maximum
+    RSS. The trial-created TypeScript mirror took 11.99 seconds and 169,312,256
+    bytes maximum RSS on the same host and input.
+- Baseline comparison:
+  - No production TypeScript planner existed in the checkout. The archived
+    TypeScript program is a trial-created correctness mirror with an independent
+    full-tile enumeration but a shared intersection predicate, so it is not a
+    fully independent oracle and does not substantiate the brief's reported
+    production runtime.
+  - Fold's durable incremental state is unnecessary because each line already
+    carries authoritative old/new geometry and state access is prohibited. ESE
+    and ANNy do not solve exact polygon/tile intersection.
+
+### Friction trail
+
+The developer followed the public onboarding order, found no parcel baseline,
+and avoided the public-example scaffold. Restricted network access made the
+first ordinary Cargo run retry the registry, while the cached locked build
+worked offline. The initial planner was made explicitly lexicographic and its
+fixtures were broadened from rectangles to concavity, holes, MultiPolygons, and
+boundary-only contact.
+
+Skeptical review then defeated ordinary `serde_json::Value` parsing with
+duplicate members and showed that bowties, zero-area rings, outside holes, and
+overlapping holes were accepted. It also rejected calling the TypeScript mirror
+an independent oracle and found the first scale fixture too repetitive. The
+coordinator added recursive duplicate rejection and simple-topology admission,
+retained the analytical rectangle check as independent evidence, narrowed the
+mirror claim, diversified the scale fixture, and reran every check and both
+implementations.
+
+### Findings
+
+1. **Duplicate JSON members, fixed — correctness defect, high severity, high
+   confidence.** Reproduction: duplicate `old`, `new`, or nested geometry keys.
+   Smallest improvement completed: reject duplicates recursively before value
+   conversion and emit no partial plan.
+2. **Invalid polygon topology, fixed — correctness defect, high severity, high
+   confidence.** Reproduction: self-intersecting or zero-area rings, outside or
+   overlapping holes, or overlapping MultiPolygon exteriors. Smallest
+   improvement completed: strict simple-topology validation before planning.
+3. **Reference independence overstated, fixed — evidence defect, moderate
+   severity, high confidence.** Smallest improvement completed: label the
+   TypeScript program a mirror and separate the analytical rectangle oracle.
+4. **All-component scaffold — API friction and documentation gap, moderate
+   severity, high confidence.** This independently repeats Trial 1.
+5. **Authoritative stateless delta planning is poor product fit — informational
+   severity, high confidence.** Smallest improvement: document the boundary;
+   adding durable state would make this command less faithful to its contract.
+6. **Evidence scope — moderate severity, high confidence.** The implementation
+   handles strict simple planar GeoJSON polygons on synthetic data, not general
+   validity, antimeridian wrapping, geodesic edges, or production GIS corpora;
+   performance is one host and fixture.
+
+### Decision audit
+
+The developer chose strict line-at-a-time JSON admission, simple-topology
+validation, geometry-bounded candidate enumeration, closed-boundary contact,
+deduplication, and lexicographic rendering. Fold, ESE, ANNy, parcel persistence,
+rendering/publishing, deletion, spatial indexes, general polygon repair, and
+silent malformed-input recovery were rejected. Antimeridian semantics,
+geodesics, arbitrary GeoJSON, production topology policy, and multi-host scale
+remain unresolved.
+
+## Skeptical review
+
+- Claims reproduced:
+  - Both no-fit decisions; README/example/scaffold discovery; clean FASTQ
+    comparison; correction/tie/unmatched routing; million-pair counts and
+    checksum; descriptor bound; named GIS cases; analytical rectangles;
+    malformed behavior; deterministic permutations; and scale outputs.
+- Claims rejected or softened:
+  - Production-baseline comparisons, broad FASTQ parsing and memory claims,
+    descriptor evidence before positive-poll enforcement, an independent GIS
+    oracle, general GeoJSON validity, and multi-host performance.
+- Quality fixes required and completed:
+  - Case-folded and reserved output-name rejection.
+  - Supported FASTQ identifier validation and reliable external observation.
+  - Recursive duplicate-member rejection and strict simple-topology admission.
+  - More varied GIS scale data, nested-workspace integration, root-relative
+    archive scripts, external generated state, and complete evidence reruns.
+- Remaining uncertainty:
+  - Production inputs and baselines, adversarial record sizes, compressed
+    sequencing data, storage failures, general GIS validity, antimeridian and
+    geodesic semantics, and performance beyond the measured host.
+
+No BogKit correctness defect was demonstrated. The blockers belonged to the two
+trial prototypes and were fixed before archival.
+
+## Cross-run synthesis
+
+- New evidence:
+  - Stateless, one-pass exact transformations remain outside the useful public
+    roles of BogKit when the job has no durable read model, embedding, or
+    approximate-retrieval need.
+  - Strict input admission and an independent or analytically separable oracle
+    are essential before claiming exactness for streaming or geometry tools.
+- Recurring evidence:
+  - The public capability and operational-boundary matrix is now supported by
+    18 independent trials.
+  - The component-selective project path is now supported by 8 trials.
+  - Nameable pipeline and reader patterns remain supported by 3 trials.
+- Candidate improvements:
+  1. Public capability and operational-boundary matrix.
+  2. Component-selective project path, including a true Fold-only starter.
+  3. Documentation for nameable composed pipeline and reader types.
+- Observations not yet promoted:
+  - Strict JSON-member admission, FASTQ parsing, output-spill management,
+    geometry validity, and tile-intersection utilities.
+- No-fit or positioning signals:
+  - Do not add durable state merely to adopt the toolkit when authoritative
+    deltas are already present and the result is a bounded exact transformation.
+
+No new candidate was promoted.
+
+## Validation
+
+- Trial-specific tests: all 13 corrected Rust tests and both archived integration
+  verifiers passed.
+- Strict lint and formatting: both new packages passed formatting and Clippy
+  with warnings denied; the complete nested workspace passed Clippy. The broad
+  repository formatting check also reports an existing formatting difference in
+  `examples/search/src/main.rs`, which is outside the automation archive boundary
+  and was left unchanged.
+- Runnable demonstrations: corrected FASTQ clean/mixed/malformed/observer/full
+  workloads and GIS named/analytical/malformed/permutation/full workloads passed
+  with the scoped results above.
+- Nested lab workspace tests: all 104 tests passed.
+- BogKit root workspace tests: all 45 unit and documentation tests passed after
+  the required ESE model artifact was fetched outside the restricted sandbox.
+- Archive and secret checks: `git diff --check`, coverage JSON parsing, marker
+  uniqueness, changed-path scope, generated-output, database, archive, model,
+  binary, credential-pattern, symlink, and file-size scans passed. Every intended
+  changed path is under `developer-simulation/`.
diff --git a/developer-simulation/reports/2026-08-06.md b/developer-simulation/reports/2026-08-06.md
new file mode 100644
index 0000000..a3c2def
--- /dev/null
+++ b/developer-simulation/reports/2026-08-06.md
@@ -0,0 +1,174 @@
+# Developer simulation — 2026-08-06
+
+<!-- bogkit-developer-simulation:2026-08-06 -->
+
+Two blind trials tested BogKit against calendar recurrence/time-zone
+correctness and HTTP cache revalidation/tag-purge safety. Fresh developers
+started from separate sanitized copies of current `main`. Both produced
+runnable, reviewed prototypes; neither established a full production fit.
+The skeptical review found prototype correctness and evidence blockers, which
+were fixed and rerun before archival. No BogKit core or existing-example defect
+was demonstrated.
+
+## Trial 1 — CalDAV recurrence and time-zone correctness
+
+- Persona: CalDAV calendar maintainer with beginner-to-intermediate Rust
+- Existing system: a SQLite-authoritative calendar service with a separate
+  HTTP/CalDAV layer
+- Problem: expand timed and all-day recurrence rules across DST gaps/folds,
+  exceptions, overrides, deterministic ordering, incremental rebuilds, and
+  atomic publication for 5,000 masters and 2,000,000 candidate occurrences
+- Outcome: no fit for the full production scenario; narrow Fold fit for the
+  event-master replacement boundary
+- BogKit components considered: Fold, ESE, and ANNy
+- BogKit components used: Fold only, for keyed event-master upsert/remove
+- Archive: [`caldav-recurrence`](../runs/2026-08-06--caldav-recurrence/README.md)
+
+### Evidence
+
+- The standalone prototype has 10 integration tests covering DST gap/fold
+  policy, all-day and floating values, partial-day intersection, recurrence
+  rules, exclusions, canonical and unseen override rejection, deterministic
+  ordering, host time-zone independence, tampered-shard rebuilds, preflight
+  store integrity, interruption recovery, and malformed-input publication.
+- Formatting and warnings-denied Clippy passed. The smoke CLI completed with
+  3 events and 4 occurrences.
+- A fresh release workload over 5,000 masters and 2,000,000 candidates took
+  3.85 seconds and reported 17,547,264 bytes peak RSS. A second run reused all
+  5,000 fingerprinted shards in 2.93 seconds with byte-identical output.
+  Separate `TZ=UTC` and `TZ=Pacific/Honolulu` runs also matched byte-for-byte.
+- The assigned 5,000-case oracle, production SQLite service, and named
+  reference machine were absent, so no production correctness or oracle
+  agreement is claimed.
+
+### Friction trail
+
+The developer followed the public README and examples. `timeseries` ran
+through its demo; `starter` and `search` attempted the ESE model download, and
+`chat` reached a sandbox listener-bind restriction. Fold's keyed streams,
+snapshots, and retractions were useful for event-master replacement, but the
+public APIs did not provide recurrence rules, civil-time conversion, SQLite
+authority, or publication artifacts.
+
+The first prototype workload took 30.09 seconds because it fsynced every
+per-UID shard and reread all shards to assemble output. The publication path
+was changed to one sorted atomic output pass while retaining per-UID recovery
+shards, then rerun at the reported 3.85-second result.
+
+### Findings and decision audit
+
+The reviewer initially found five correctness blockers: partial-day all-day
+queries omitted a touched date, equivalent timed override IDs could overwrite
+one another, unseen overrides created phantom occurrences, tampered shards
+were trusted, and invalid expansion could mutate the durable event store
+before publication. It also found incomplete trial documentation and a stray
+`+` in CLI help. The coordinator fixed all of them, added fingerprints and
+preflight expansion, and reran the 10-test suite and workload.
+
+The prototype deliberately keeps SQLite authoritative and uses Fold only for
+the event-master boundary. Recurrence semantics, transition tables, shard
+integrity, and filesystem publication remain adapter responsibilities. The
+oracle, standards completeness, production integration, and process-crash or
+power-loss durability remain unresolved.
+
+## Trial 2 — HTTP cache revalidation and tag-purge safety
+
+- Persona: edge reverse-proxy maintainer with intermediate Rust
+- Existing system: an HTTP cache with separate metadata, content-addressed
+  bodies, origin revalidation, leases, tag purges, and a byte quota
+- Problem: model Vary-aware identity, fresh/stale/stale-if-error decisions,
+  single-flight revalidation, ordered purges, crash phases, reachability, and
+  quota behavior for 2,000,000 objects, 1,000,000 requests, and 100,000 purges
+- Outcome: no fit for the acceptance-critical cache boundary
+- BogKit components considered: Fold, ESE, and ANNy
+- BogKit components used: none
+- Archive: [`http-cache-revalidation`](../runs/2026-08-06--http-cache-revalidation/README.md)
+
+### Evidence
+
+- The dependency-free model has 12 tests covering key normalization, logical
+  freshness, stale-if-error, single-flight calls, purge fencing and reorder,
+  modeled crash recovery, quota eviction, stable digests, and strict trace
+  parsing.
+- Formatting and warnings-denied Clippy passed. The demo reported
+  `purges_applied=1`, `purges_ignored=2`, `recovery_rollbacks=1`, and
+  `demo=PASS modeled_invariants=true`; the file-driven and quota traces also
+  passed. Dynamic output uses hashed identifiers and the privacy check passed.
+- The compact shape workload reported 2,000,000 objects, 1,000,000 requests,
+  100,000 purges, 8.64 GB logical usage under a 64 GiB quota, and 65,634,304
+  bytes RSS under the 256 MiB target. It is explicitly a shape check, not a
+  semantic-scale or production benchmark.
+
+### Friction trail
+
+The developer followed the public README and examples. Fold's keyed records,
+tag postings, ranking, and single-owner ingest pattern were useful isolated
+building blocks, but no public surface covered a durable metadata/body
+transaction, per-key lease expiry, distributed workers, or sequence-aware
+purge fencing. The trial therefore remained a standalone model rather than a
+new cache component hidden behind a BogKit node.
+
+### Findings and decision audit
+
+The reviewer found that an older lower-sequence purge could evict a newer
+repopulated response, and that the parser silently accepted surplus fields or
+more than 16 tags. The coordinator fixed both and reran the affected tests and
+traces. Claims were narrowed to a sequential single-process lease model, an
+in-memory digest/size/reference model, and a compact quota/memory shape run.
+
+The prototype does not parse real HTTP, read body bytes, delete files, run a
+SQLite transaction, fsync, restart a process, expire leases, recover a lost
+worker, or model distributed concurrency. Those are acceptance-critical
+boundaries and remain no-fit signals, not BogKit defects.
+
+## Skeptical review
+
+- Claims reproduced: both baseline reproductions, final test suites, demos,
+  purge reorder behavior, recovery traces, privacy output, calendar shard
+  reuse, tamper rebuilds, preflight store integrity, and stated-count shape
+  metrics.
+- Claims rejected or softened: calendar oracle/SQLite/standards/durability
+  claims; cache body-file, distributed lease, worker-loss, semantic-scale, and
+  production performance claims.
+- Quality fixes completed: six calendar correctness/documentation issues;
+  cache purge fencing and strict parser admission; and all affected evidence
+  reruns.
+- Remaining uncertainty: the absent calendar oracle and reference machine,
+  production adapters, filesystem and power-loss behavior, real HTTP semantics,
+  durable lease expiry, distributed coordination, and semantic cache behavior
+  at the stated object count.
+
+## Cross-run synthesis
+
+- New evidence: the capability and operational-boundary finding now has 20
+  independent trials; the component-selective project-scaffold finding now has
+  10; nameable pipeline and reader types remain at 3.
+- Recurring evidence: developers repeatedly separate authoritative external
+  stores, cross-store publication, distributed coordination, strict quotas,
+  and stateless transformations from BogKit's durable single-writer views.
+- Candidate improvements: publish a concise capability/operational-boundary
+  matrix and make the starter/project path component-selective, including a
+  true Fold-only introduction.
+- Observations not promoted: calendar, cache, parser, lease, body-store, and
+  recurrence utilities; each remains specific to the trial boundary.
+- No-fit signal: adding durable state or a custom cross-store protocol merely
+  to adopt BogKit would make either prototype less faithful to its contract.
+
+No new candidate was promoted, and no BogKit core or existing example was
+changed.
+
+## Validation
+
+- Trial-specific tests: calendar 10 passed; cache 12 passed.
+- Strict lint and formatting: both archived packages passed formatting and
+  warnings-denied Clippy. The complete nested simulation workspace passed
+  Clippy and tests. The broad formatting check reported the pre-existing
+  `examples/search/src/main.rs` difference and it was left untouched.
+- Runnable demonstrations: both smoke/trace demos and the cache quota trace
+  passed; the reviewed calendar and cache workloads passed in their fresh
+  developer checkouts.
+- BogKit root workspace tests: passed after the required ESE model artifact
+  was fetched in the network-enabled retry; all unit and documentation tests
+  completed successfully.
+- Archive and secret checks: run before publication; all committed paths are
+  restricted to `developer-simulation/`.
diff --git a/developer-simulation/reports/2026-08-07.md b/developer-simulation/reports/2026-08-07.md
new file mode 100644
index 0000000..f95d342
--- /dev/null
+++ b/developer-simulation/reports/2026-08-07.md
@@ -0,0 +1,215 @@
+# Developer simulation — 2026-08-07
+
+<!-- bogkit-developer-simulation:2026-08-07 -->
+
+Two blind developers tested substantially different existing-software
+problems from fresh sanitized current-main copies: offline localization catalog
+validation and multi-tenant webhook delivery scheduling. A separate skeptical
+reviewer reproduced the important claims and found one correctness defect in
+each prototype. The coordinator fixed both defects and reran the affected
+tests, demonstrations, formatting, and strict lint. No BogKit correctness
+defect or recurring BogKit improvement was demonstrated.
+
+## Trial 1 — Localization catalog compiler
+
+- Persona: desktop build-tooling developer, intermediate Rust
+- Existing system: a Rust CLI loads structured localization catalogs, checks
+  identifiers and fallback rules, applies an `en-US` baseline, and emits
+  locale-specific runtime tables.
+- Problem: detect missing plural branches, placeholder mismatches, invalid
+  fallback references, and duplicate IDs while preserving lookup behavior and
+  deterministic output for 100,000 messages across 18 locales.
+- Outcome: partial local proof only; no production adoption decision
+- BogKit components considered: Fold, ESE, and ANNy
+- BogKit components used: none
+- Archive:
+  [`runs/2026-08-07--localization-catalog-compiler`](../runs/2026-08-07--localization-catalog-compiler)
+
+### Evidence
+
+- Commands:
+  - `cargo test --offline -p catalog-compiler-prototype --quiet`
+  - `cargo fmt -p catalog-compiler-prototype -- --check`
+  - `cargo clippy --offline -p catalog-compiler-prototype --all-targets -- -D warnings`
+  - `cargo build --offline --release -p catalog-compiler-prototype`
+  - the archived `catalogc` valid/invalid lookup and compilation commands
+  - the generated 100,000-record / 18-locale release fixture compiled twice
+- Tests: 4 library tests passed after the fallback regression; binary and doc
+  test targets had no tests.
+- Demonstration:
+  - Valid source and emitted-table lookups returned identical output.
+  - The invalid fixture returned six diagnostics and continued past the first
+    error.
+  - Both corrected stress compiles took 0.05 seconds and reported
+    27,010,299 peak live allocated bytes. The output SHA-256 was identical:
+    `f4d5206bc4dd975da35221f78153ab4897ba9bdf0f3c65620e4bbdee36d5e31a`.
+- Baseline comparison: no production catalog corpus or baseline compiler was
+  available. The prototype grammar and live-allocation measurement are local
+  evidence, not production ICU/CLDR or RSS claims.
+
+### Friction trail
+
+The developer read the public README and starter, timeseries, chat, and search
+examples before inspecting source. None exposed localization parsing or table
+generation. The clean workspace-wide baseline also encountered ESE's model
+download under offline restrictions, while the Fold-local tests passed. The
+developer therefore kept the prototype standard-library-only and rejected all
+three BogKit components as unrelated to catalog semantics.
+
+The reviewer then found that a comma-separated fallback list stopped after its
+first locale. The coordinator changed lookup to try every fallback, made cycle
+validation traverse every fallback edge, added a missing-first/found-second
+regression, and reran the complete evidence set.
+
+### Findings
+
+1. **Fallback-list traversal, fixed — prototype correctness defect, high
+   severity, high confidence.** A valid `fallback xx,en-US` chain failed when
+   `xx` lacked the requested message even though `en-US` supplied it. The
+   smallest improvement was complete fallback iteration plus a regression.
+2. **Production catalog semantics — missing capability/evidence gap, high
+   severity, low-to-medium confidence.** ICU/CLDR plural rules, escaping, rich
+   placeholders, and the real catalog format were not present. The smallest
+   improvement is a differential harness over a sanitized production slice.
+3. **Resource evidence — performance/evidence limitation, moderate severity,
+   high confidence.** Live allocator bytes and local repeated hashes do not
+   establish RSS, cross-machine reproducibility, or a fair baseline speedup.
+
+### Decision audit
+
+The developer chose a dependency-free batch validator, ordered maps, normalized
+text output, and a generated-table lookup harness. Fold, ESE, and ANNy were
+rejected as mismatched. The narrow idea is a partial local proof, but the
+production corpus, runtime semantics, fair baseline, RSS, and second-machine
+reproducibility remain unresolved. No component or catalog feature is promoted.
+
+## Trial 2 — Multi-tenant webhook delivery scheduler
+
+- Persona: senior Rust backend developer, approximately six years of Rust
+  experience
+- Existing system: PostgreSQL-backed pending webhook deliveries with fixed
+  per-endpoint queues, exponential retries, dead-lettering, and at-least-once
+  event IDs for customer deduplication.
+- Problem: preserve endpoint ordering, isolate slow endpoints, apply tenant and
+  endpoint limits, recover after crashes, and avoid retry storms during outage
+  traces.
+- Outcome: no fit for BogKit; corrected standalone scheduler retained only as
+  an exploratory follow-up
+- BogKit components considered: Fold, ESE, and ANNy
+- BogKit components used: none
+- Archive:
+  [`runs/2026-08-07--webhook-scheduler`](../runs/2026-08-07--webhook-scheduler)
+
+### Evidence
+
+- Commands:
+  - `cargo fmt --package webhook-scheduler -- --check`
+  - `cargo clippy -p webhook-scheduler --all-targets -- -D warnings`
+  - `cargo test -p webhook-scheduler`
+  - `cargo test --release -p webhook-scheduler`
+  - `cargo run --release -p webhook-scheduler -- --repeat 1000`
+- Tests: 8 debug tests and 8 release tests passed after the retry-cap
+  regression.
+- Demonstration:
+  - Ordering, crash requeue, stale-outcome rejection, classification,
+    fairness, outage recovery, determinism, and hard retry caps passed.
+  - The repeated release demo completed 1,000 repetitions and reported the
+    modeled values. Its 15,193 microsecond elapsed time is harness overhead,
+    not throughput evidence.
+- Baseline comparison: the 60,000 ms versus 0 ms healthy-tenant result is a
+  small formula-versus-in-memory model comparison, not a deployed-worker
+  latency measurement. No claim is made for the stated production traffic.
+
+### Friction trail
+
+The developer inspected the public README and examples before source. They
+found durable views and transactional state but no public timer, external-side
+effect, lease, or acknowledgement boundary. The scheduler therefore remained
+standard-library-only and modeled persistence and HTTP outcomes explicitly.
+
+The reviewer reproduced a 1,056 ms retry deadline under a 1,000 ms cap because
+jitter was added after capping. The coordinator applied the cap after jitter
+and added a regression over 1,024 event IDs. The reviewer also narrowed the
+outage, durability, fairness, latency, and load claims to the in-memory model.
+
+### Findings
+
+1. **Retry cap, fixed — prototype correctness defect, high severity, high
+   confidence.** Jitter exceeded the configured hard cap. The smallest
+   improvement was post-jitter capping plus a regression.
+2. **External side-effect and durable acknowledgement boundary — poor product
+   fit, blocker severity, high confidence.** Fold does not supply the modeled
+   HTTP timer/lease/PostgreSQL acknowledgement boundary. No BogKit component
+   was used.
+3. **Production evidence scope — moderate-to-high limitation, high
+   confidence.** The prototype did not exercise real HTTP, PostgreSQL, process
+   or storage durability, payload memory, production-shaped load, or a fair
+   baseline implementation.
+
+### Decision audit
+
+The developer chose endpoint-head ordering, bounded queues, tenant round-robin,
+deterministic jitter, and explicit crash/restart transitions. Global FIFO,
+random jitter, concurrent endpoint sends, Fold as the dispatch loop, and real
+integrations were rejected. The corrected algorithm may justify a future
+integration experiment, but it is not production behavior or a dashboard
+candidate.
+
+## Skeptical review
+
+- Claims reproduced: both no-fit/partial boundaries, focused tests, strict
+  formatting and Clippy, valid/invalid catalog behavior, repeated catalog
+  hashes, webhook ordering, crash recovery, outage trace, fairness trace,
+  classification, determinism, and repeated release demos.
+- Claims rejected or softened: production catalog compatibility, cross-machine
+  determinism, RSS and baseline performance, one-event outage behavior as a
+  general no-storm claim, in-memory restart as database durability, and
+  production-scale fairness.
+- Quality fixes required and completed: catalog fallback traversal and all-edge
+  cycle validation; webhook post-jitter hard cap and regression coverage.
+- Unnecessary dependencies: none; both prototypes remained dependency-free and
+  used no BogKit component.
+- Remaining uncertainty: real catalog/compiler differential behavior, ICU/CLDR
+  semantics, RSS and cross-machine checks, HTTP/PostgreSQL durability, payload
+  memory, production traffic, and operational backpressure.
+
+No BogKit correctness defect was demonstrated. Neither trial established a
+recurring BogKit feature need.
+
+## Cross-run synthesis
+
+- New evidence: two additional, orthogonal no-component boundaries—batch
+  localization semantics and external-effect webhook scheduling.
+- Recurring evidence: the public capability/operational-boundary matrix remains
+  supported by 20 independent trials; component-selective scaffolding by 10;
+  nameable pipeline/reader patterns by 3.
+- Candidate improvements: none newly promoted. The existing capability matrix,
+  component-selective project path, and nameable pipeline/reader documentation
+  remain the only threshold-qualified candidates.
+- Observations not promoted: catalog compiler support, localization semantics,
+  webhook timers, durable leases, retry scheduling, and fairness controls.
+- No-fit signal: avoid adding durable state or a toolkit component when the
+  workload's authoritative boundary is external and the required semantics are
+  exact parsing or external side-effect coordination.
+
+## Validation
+
+- Trial-specific tests: catalog 4 library tests; webhook 8 debug and 8 release
+  tests; all passed after reviewer corrections.
+- Strict lint and formatting: both packages passed formatting and Clippy with
+  warnings denied.
+- Runnable demonstrations: valid/invalid catalog runs, two corrected stress
+  compiles, catalog hash comparison, and 1,000 webhook release repetitions
+  passed.
+- Nested lab workspace: locked offline `cargo test --workspace --offline` and
+  locked `cargo clippy --workspace --offline --all-targets -- -D warnings`
+  passed the existing corpus plus the new catalog and webhook packages.
+- The broad nested-workspace formatting check still reports pre-existing
+  differences in `examples/search/src/main.rs`; that unrelated example was
+  left unchanged. Both new packages pass package-scoped formatting checks.
+- BogKit root workspace: `cargo test --workspace` passed all unit and
+  documentation tests.
+- Archive and secret checks: `git diff --check`, `jq empty coverage.json`,
+  changed-path scope, no-target/database/binary/large-file/symlink checks, and
+  credential-pattern scans passed. Every changed path is under
+  `developer-simulation/`.
diff --git a/developer-simulation/reports/2026-08-08.md b/developer-simulation/reports/2026-08-08.md
new file mode 100644
index 0000000..d97c28c
--- /dev/null
+++ b/developer-simulation/reports/2026-08-08.md
@@ -0,0 +1,247 @@
+# Developer simulation — 2026-08-08
+
+<!-- bogkit-developer-simulation:2026-08-08 -->
+
+Two blind developers evaluated substantially different existing-software
+problems from separate sanitized copies of current `main`: exact medical
+remittance reconciliation and legal container-yard reshuffling. Both rejected
+BogKit for the core computation. A separate skeptical reviewer found four
+blocking prototype/archive defects, eight important evidence or capability
+limits, and three minor scope issues. The developers corrected the blocking
+prototype defects in two focused rounds; the coordinator completed the archive
+transform and reran the final gates. No BogKit correctness defect or new
+threshold-qualified BogKit improvement was demonstrated.
+
+## Trial 1 — Conservative remittance-to-claim reconciliation
+
+- Persona: revenue-cycle platform engineer, production Java and SQL expert,
+  Rust beginner
+- Existing system: a Java/PostgreSQL nightly process normalizes X12 835 data,
+  tries exact insurer references, then uses greedy SQL fallback matching.
+- Problem: match 50,000 remittance lines against 62,000 current claim revisions
+  without double posting, cent loss, input-order dependence, or silent guesses.
+- Outcome: no fit for BogKit; corrected standalone bounded matcher retained as
+  a local research prototype
+- BogKit components considered: Fold, ESE, and ANNy
+- BogKit components used: none
+- Archive:
+  [`runs/2026-08-08--remittance-reconciliation`](../runs/2026-08-08--remittance-reconciliation)
+
+### Evidence
+
+- Commands:
+  - `cargo fmt -p remittance-reconciliation -- --check`
+  - `cargo test --offline --locked -p remittance-reconciliation --all-targets`
+  - `cargo clippy --offline --locked -p remittance-reconciliation --all-targets --all-features -- -D warnings`
+  - the archived demo, overlapping-identity CLI/verifier reproduction, and
+    `scripts/run-acceptance.sh`
+- Tests: 6 library and 17 adversarial tests passed. These cover contradictory
+  identity sources, duplicate logical rows, staged comparator behavior,
+  conservative split/reversal scope, privacy checks, deterministic output, and
+  bounded-search exhaustion.
+- Demonstration: the final archived 62,000-claim / 50,000-remittance run linked
+  all 49,995 authored unambiguous truth links with no verifier or privacy
+  failures in 4.628 seconds. Ten fixed shuffles were byte-identical and ran in
+  4.779–5.093 seconds.
+- Baseline comparison: the corrected exact-reference-first greedy comparator
+  produced 99.903944% precision, 99.855986% recall, and 12 obsolete-revision
+  failures on the authored generator. The production Java/SQL executable,
+  external fixture, independent truth, supplied seeds, specified hardware, and
+  peak resident memory were unavailable, so these are not production claims.
+
+### Friction trail
+
+The developer started with the public README and all four examples. Fold's
+durable incremental views did not supply the required bounded global
+assignment over one immutable snapshot; ESE and ANNy's approximate similarity
+was unsafe for exact identifiers and integer money. The developer therefore
+built a small standalone Rust solver with review-on-uncertainty output.
+
+The first reviewer pass found that contradictory exact-reference and fallback
+identities could silently choose one source, duplicate logical IDs could create
+capacity, the comparator was not truly reference-first, and split/reversal and
+generator evidence were overstated. Round one fixed duplicates and staging and
+narrowed the claims, but a partial-overlap `{A,B}` versus `{B,C}` case still
+selected a reference-only candidate. Round two restricted all single and split
+allocations to the intersection when both sources exist. The reviewer reran the
+original counterexample, permanent fixture, controls, tests, lint, formatting,
+and demo, then approved archival with no new important regression.
+
+### Findings
+
+1. **Conflicting identity admission, fixed — prototype correctness defect,
+   blocker severity, high confidence.** Nonempty reference and fallback sets
+   now permit only shared candidates; infeasible disagreement is reviewed.
+2. **Duplicate logical rows, fixed — prototype correctness defect, blocker
+   severity, high confidence.** Every physical duplicate remittance ID or
+   claim `(id, revision)` row is quarantined before indexing and cannot create
+   capacity.
+3. **Settlement scope — missing prototype capability, important severity, high
+   confidence.** Only full-open-balance same-claim subsets and same-snapshot
+   offset reversals are supported; partial allocations and standalone
+   reversals require upstream authority and remain review-only.
+4. **External validity — evidence limitation, important severity, high
+   confidence.** Generator truth is authored by the same prototype, and the
+   production comparator, real fixture, memory measurement, and domain
+   validation are absent.
+
+These are prototype and evaluation findings, not BogKit defects. A generic
+matching or flow primitive is a one-trial observation and is not promoted.
+
+### Decision audit
+
+The developer chose exact integer cents, highest-revision current claims,
+complete exact fallback identity, joint bounded cluster search, intersection
+of conflicting identity sources, full-balance-only splits, conservative
+reversal handling, a one-million-node ceiling, and canonical review output.
+Approximate matching, stable tie guessing, arbitrary many-to-many flow, and
+BogKit persistence were rejected. The highest-revision, 31-day fallback range,
+duplicate, split, reversal, and X12 normalization policies still need explicit
+production authority.
+
+## Trial 2 — Advisory container-yard reshuffling
+
+- Persona: terminal-operating-system integration developer, production C# and
+  SQL experience, Rust novice
+- Existing system: a nearest-legal-slot greedy helper proposes relocations for
+  urgent pickups from a normalized yard snapshot.
+- Problem: produce deterministic legal move sequences while respecting stack
+  height, weight, reefer, customs, maintenance, hazardous-neighbor, pickup
+  order, and no-partial-publication constraints.
+- Outcome: no fit for BogKit; corrected standalone conservative proposal
+  generator retained with a known feasible false negative
+- BogKit components considered: Fold, ESE, and ANNy
+- BogKit components used: none
+- Archive:
+  [`runs/2026-08-08--container-yard-planner`](../runs/2026-08-08--container-yard-planner)
+
+### Evidence
+
+- Commands:
+  - `cargo fmt -p container-yard-planner -- --check`
+  - `cargo test --offline --locked --release -p container-yard-planner --all-targets`
+  - `cargo clippy --offline --locked -p container-yard-planner --all-targets --all-features -- -D warnings`
+  - the archived release demo and focused output-reuse, verifier, timeout, and
+    exact-feasible-witness tests
+- Tests: 1 library and 15 acceptance tests passed. They cover placement rules,
+  canonical output, replay, dishonest metadata, atomic exclusive publication,
+  reused-output transitions, injected failure, timeout, and the preserved
+  feasible false negative.
+- Demonstration: one micro-geometry used 3 baseline relocations versus 2
+  lookahead relocations (33% for that geometry), replayed successfully, and was
+  deterministic. A dense 48-by-6, 1,280-container fixture observed 42 versus 41
+  relocations and completed in roughly 8–16 ms in prior release runs.
+- Baseline comparison: 27 suffix-renamed cases repeat one geometry, not 27
+  diverse feasible snapshots. The stated 30 production files, C# results,
+  production 20% aggregate, specified laptop, and hard end-to-end 10-second
+  guarantee were unavailable or not established.
+
+### Friction trail
+
+After reading the public README and examples, the developer found no BogKit
+component related to deterministic constraint search over a frozen snapshot.
+Fold persistence, text embeddings, and nearest-neighbor search would not prove
+move legality, so the prototype remained standalone and advisory.
+
+The reviewer found a legal three-stack sequence that the bounded heuristic
+missed, incomplete verification of output metadata, and a reused-output bug
+that could leave an old executable `moves.json` beside a new review or failed
+run. The developer preserved the false-negative witness, narrowed feasibility
+and timing claims, strengthened full-artifact verification, and implemented
+atomic exclusive current-result publication with failure cleanup. The reviewer
+reproduced the fixes and approved archival.
+
+### Findings
+
+1. **Stale executable artifact, fixed — prototype correctness defect, blocker
+   severity, high confidence.** Success, review, malformed input, timeout,
+   replay rejection, and injected write failure now leave exactly one valid
+   current result or none.
+2. **Heuristic incompleteness — missing prototype capability, important
+   severity, high confidence.** A preserved three-stack witness has a legal
+   sequence that the eight-pickup bounded heuristic misses. Review therefore
+   means “no proposal found,” not “infeasible.”
+3. **Verifier independence and scope — evidence limitation, important
+   severity, high confidence.** The verifier now checks every published field
+   and separately replays transitions, but shares static snapshot and hazard
+   definitions with the planner.
+4. **Production comparison — evidence limitation, important severity, high
+   confidence.** The repeated micro-case and one dense synthetic block do not
+   establish the requested production completion, improvement, or hard
+   deadline.
+
+These are prototype and evaluation findings, not BogKit defects. A generic
+state-space planner is a one-trial observation and is not promoted.
+
+### Decision audit
+
+The developer chose an advisory file boundary, a private cloned state,
+deterministic eight-pickup lookahead, reciprocal hazardous-neighbor validation,
+separate transition replay, and generation-safe atomic publication. Exhaustive
+optimal search, random search, partial move prefixes, live terminal integration,
+and BogKit dependencies were rejected. The constraint model, deadline boundary,
+and production snapshot translation remain uncertain.
+
+## Skeptical review
+
+- Claims reproduced: both narrow no-fit decisions, focused test suites, strict
+  formatting and lint, runnable demos, authored remittance acceptance and
+  shuffles, remittance overlap and duplicate counterexamples, yard publication
+  lifecycle, verifier corruption rejection, and the feasible false negative.
+- Claims rejected or softened: broad remittance safety before the fixes,
+  general split/reversal support, production accuracy and speed, complete yard
+  feasibility, 27-case diversity, production relocation improvement, fully
+  independent verification, and a hard end-to-end 10-second bound.
+- Quality fixes required and completed: contradictory identity intersection,
+  duplicate-row quarantine, staged comparator semantics, atomic exclusive yard
+  result publication, complete metadata verification, and archive workspace
+  normalization. Narrow claims were corrected instead of adding subsystems.
+- Unnecessary code or dependencies: none. Each archive uses only `serde` and
+  `serde_json`; no BogKit, solver, async, database, network, or ML dependency
+  was added.
+- Remaining uncertainty: production data and baselines, independent truth,
+  memory, X12/domain policy, exact planning completeness, shared verifier
+  definitions, and end-to-end timing.
+
+The initial audit counted 4 blockers, 8 important findings, and 3 minor issues.
+After two focused fix rounds, the same reviewer approved both archives and
+found no new critical or important breakage. No BogKit correctness defect was
+demonstrated.
+
+## Cross-run synthesis
+
+- New evidence: two additional no-component boundaries—exact global assignment
+  over an immutable financial snapshot and deterministic constraint planning
+  over a frozen operational snapshot.
+- Recurring evidence: no existing recurring-finding count changes. The public
+  capability/operational-boundary matrix remains supported by 20 independent
+  trials; component-selective scaffolding by 10; nameable pipeline/reader
+  patterns by 3.
+- Candidate improvements: none newly promoted. The existing capability matrix,
+  component-selective project path, and nameable pipeline/reader documentation
+  remain the only threshold-qualified candidates.
+- Observations not yet promoted: exact reconciliation/flow machinery and a
+  general state-space planner. They are distinct one-trial capabilities and
+  should not be combined into a vague solver subsystem.
+- No-fit signal: BogKit should not be added merely to persist or approximate a
+  frozen exact computation. Keeping narrow domain logic outside the toolkit is
+  preferable to product bloat.
+
+## Validation
+
+- Trial-specific tests: remittance 23 total; yard 16 total; all passed after
+  reviewer-directed corrections.
+- Strict lint and formatting: both new packages passed package formatting and
+  strict Clippy with warnings denied.
+- Runnable demonstrations: remittance demo, permanent overlap CLI/verifier,
+  full authored acceptance and ten shuffles; yard demo and focused acceptance
+  suite all passed from the final archive paths.
+- Nested lab workspace: locked offline metadata resolved both new packages
+  under the single nested workspace and lockfile; locked release tests and
+  strict Clippy passed the complete archived corpus.
+- BogKit root workspace: `cargo test --workspace` passed all unit and
+  documentation tests.
+- Archive and secret checks: `git diff --check`, valid coverage JSON,
+  changed-path scope, no child workspace/lockfile, target/database/binary/large-
+  file/symlink checks, and credential-pattern scans passed. Every changed path
+  is under `developer-simulation/`.
diff --git a/developer-simulation/reports/2026-08-09.md b/developer-simulation/reports/2026-08-09.md
new file mode 100644
index 0000000..bcb857c
--- /dev/null
+++ b/developer-simulation/reports/2026-08-09.md
@@ -0,0 +1,266 @@
+# Developer simulation — 2026-08-09
+
+<!-- bogkit-developer-simulation:2026-08-09 -->
+
+Two blind developers evaluated substantially different existing-software
+problems from separate sanitized copies of current `main`: exact incremental
+syntax highlighting for a large-file desktop editor and exact ordered firewall
+policy impact analysis. Both concluded that BogKit was not a fit for the core
+computation and built standalone local prototypes. A separate skeptical
+reviewer found four blocking prototype/archive defects, nine important evidence
+or capability limits, and three minor issues. Three focused fix rounds closed
+the prototype defects and strengthened the permanent regressions; the
+coordinator normalized and reran the final archives. No BogKit correctness
+defect or new threshold-qualified BogKit improvement was demonstrated.
+
+## Trial 1 — Incremental syntax highlighting without stale tokens
+
+- Persona: desktop editor maintainer with three years of production Rust
+  experience and no prior incremental-lexer implementation
+- Existing system: a correct full-document UTF-8 lexer replaces all displayed
+  token spans after each edit, causing visible delays on large generated files
+- Problem: preserve exact full-lexer tokens, byte ranges, state, and diagnostics
+  while relexing only the affected suffix when convergence is proven
+- Outcome: no fit for BogKit; corrected standalone line-cache prototype retained
+  as a local proof, with peak-memory and production-editor claims unproved
+- BogKit components considered: Fold, ESE, and ANNy
+- BogKit components used: none
+- Archive:
+  [`runs/2026-08-09--incremental-syntax-highlighting`](../runs/2026-08-09--incremental-syntax-highlighting)
+
+### Evidence
+
+- Commands:
+  - `cargo fmt --check -p incremental-syntax-highlighting`
+  - `cargo test --offline --locked --release -p incremental-syntax-highlighting --all-targets`
+  - `cargo clippy --offline --locked --release -p incremental-syntax-highlighting --all-targets --all-features -- -D warnings`
+  - the archived `correctness`, `adversarial`, exact cross-line `apply`, full
+    oracle `benchmark`, and `reproducibility` commands
+- Tests: 5 library and 1 binary test passed. The permanent regressions cover
+  invalid-edit nonmutation, EOF cache partitioning, the exact cross-line String
+  token, and canonical result/counter serialization.
+- Differential evidence: 100 generated documents and 10,000 edits matched a
+  fresh full lex exactly; 9 handwritten cases with 19 accepted and 3 rejected
+  edits passed. The reviewer also ran an independently generated 250-document /
+  100,000-edit corpus plus four invalid-coordinate cases without disagreement.
+- Large demonstration: the normalized archived binary checked all 2,000 edits
+  on a 10,389,803-byte / 200,000-line document against a fresh full lex. All
+  1,900 localized edits met both locality thresholds; the incremental lexer
+  scanned 415,888,298 bytes versus 20,779,606,000 full-relex bytes, or
+  2.001425%. The oracle run took 72,696 ms on this machine.
+- Determinism: two large seeded reruns byte-compared equal 20,576,672-byte
+  canonical `(LexResult, WorkCounters)` values; stable measurement fields also
+  matched exactly.
+- Memory boundary: 61,589,867 bytes (58.7367 MiB) is an internal retained-index
+  capacity estimate only. It excludes transient allocations, fragmentation,
+  and process RSS, so the requested 64 MiB peak-memory criterion did not pass.
+
+### Friction trail
+
+The developer read the public README and all four examples before choosing a
+component. ESE and ANNy were immediate no-fits; Fold remained plausible until
+the baseline made the missing primitive explicit: exact positional edits,
+cross-line lexical state, byte-range rebasing, and proven suffix convergence,
+not durable record materialization. The developer kept the authoritative full
+lexer as the oracle and built the smallest line-oriented cache around it.
+
+The skeptical reviewer then found a valid EOF-reaching UTF-8 edit for which the
+cache retained an extra terminal line and emitted String token ranges `5..14`
+and `14..15`, while fresh full lex emitted one `5..15` token. The developer
+fixed terminal-line ownership, added the exact token and canonical line-count
+regression, and reran every differential and oracle workload. Review also
+corrected an overstated memory claim and replaced digest-only reproducibility
+with exact serialized-value comparison. The final reviewer fuzz, focused
+tests, formatting, lint, oracle benchmark, and reproducibility checks passed.
+
+### Findings
+
+1. **EOF splice token split, fixed — prototype correctness defect, blocker
+   severity, high confidence.** The permanent regression now asserts the exact
+   three-line cache and one String token at bytes `5..15`.
+2. **Peak memory — evidence limitation, important severity, high confidence.**
+   The deterministic 58.7367 MiB retained estimate does not bound actual peak
+   process memory; the full acceptance criterion remains unverified.
+3. **Counter scope — performance-evidence limitation, important severity, high
+   confidence.** The 2.001425% ratio measures lexer bytes, not the flat
+   line-start rebuild, suffix rebasing, total CPU, or editor latency.
+4. **External validity — evidence limitation, important severity, high
+   confidence.** Incremental equality is strong for the prototype-authored
+   lexer but does not establish compatibility with the production editor's
+   lexer or token grouping.
+
+These are prototype and evaluation findings, not BogKit defects. A generalized
+incremental parsing or ordered-sequence subsystem is a one-trial observation
+and is not promoted.
+
+### Decision audit
+
+The developer chose exact UTF-8 byte coordinates, a canonical line cache,
+transactional invalid-edit rejection, content/state/token convergence rather
+than hash trust, full-lexer fallback, internal work counters, and exact
+serialized reproducibility. Persistence, embeddings, approximate neighbors, a
+general parser framework, and production-editor integration were rejected. A
+production text buffer, allocator-backed peak measurement, and the real editor
+lexer remain necessary before any shipping claim.
+
+## Trial 2 — Ordered firewall policy impact analyzer
+
+- Persona: network release-tooling engineer, senior in network software, Rust
+  beginner with substantial production Go experience
+- Existing system: release preflight validates syntax and replays sampled recent
+  packet metadata against old and proposed first-match policies
+- Problem: compute exact newly allowed/denied regions and proposed-rule
+  reachability, with deterministic replayable witnesses, without private logs
+- Outcome: no fit for BogKit; corrected standalone exact analyzer retained with
+  deliberately narrow modeled semantics and output-sensitive performance claims
+- BogKit components considered: Fold, ESE, and ANNy
+- BogKit components used: none
+- Archive:
+  [`runs/2026-08-09--firewall-policy-impact`](../runs/2026-08-09--firewall-policy-impact)
+
+### Evidence
+
+- Commands:
+  - `cargo fmt --check -p firewall-policy-impact`
+  - `cargo test --offline --locked --release -p firewall-policy-impact --all-targets -- --nocapture`
+  - `cargo clippy --offline --locked --release -p firewall-policy-impact --all-targets --all-features -- -D warnings`
+  - archived baseline sampling, two byte-compared exact analyses, strict verify,
+    malformed-input no-output check, `validate-suite`, and 50,000-rule run
+- Tests: 14 acceptance tests passed. They cover the handwritten policy cases,
+  4,560,000 differential packet checks/probes, reserved implicit identity,
+  deterministic output, closed report schema, stale-output cleanup, five input
+  alias forms, hard-link/symlink temp attacks, collision retry, and atomic
+  publication.
+- Baseline comparison: the two synthetic sampled packets saw no change, while
+  exact analysis found `10.0.1.0/24`, TCP ports 443–444, newly allowed by
+  `new-admin-range`. Its change witness and both reachability witnesses replayed
+  with the separate linear evaluator. The sample is illustrative, not a claim
+  about the stated real incident.
+- Differential evidence: 10,000 reduced-universe pairs covered 2,560,000 packet
+  tuples exhaustively; 1,000 full-width IPv4/IPv6 pairs added 2,000,000
+  boundary probes. There were zero disagreements with the separate linear
+  evaluator.
+- Large demonstration: after archive profile normalization, exact analysis of
+  the recorded 50,000/50,000-rule fixture took 0.13 seconds and verification of
+  1 change plus 25,000 reachability witnesses took 0.81 seconds. The archive
+  sandbox withheld RSS. Earlier declared-host standalone runs observed
+  0.12–0.13 seconds and at most 41,664,512 bytes RSS; that memory result is not
+  attributed to the normalized archived binary.
+
+### Friction trail
+
+The README and examples showed that Fold persists incremental materialized
+views, ESE embeds text, and ANNy performs approximate neighbor search. None
+replaces a one-shot exact comparison of ordered CIDR/protocol/port predicates,
+so the developer rejected all three and implemented a self-contained exact
+sweep plus a separate simple reference evaluator.
+
+The reviewer found three publication-safety defects across three rounds. A real
+rule could impersonate the implicit `default-deny` marker; failed reruns could
+leave a stale valid report; output aliases could overwrite an input; and a
+predictable temporary path could follow a hostile hard link or symlink and
+truncate a policy. The developer reserved the marker, closed the report schema,
+made failure cleanup explicit, rejected direct/canonical/symlink/hard-link input
+aliases before unlinking, and changed publication to exclusively create and
+sync an owned temporary file before atomic rename. The reviewer's independent
+hard-link attack and all permanent regressions then passed.
+
+### Findings
+
+1. **Input and temporary-path overwrite risks, fixed — prototype correctness
+   defects, blocker severity, high confidence.** Input aliases are rejected and
+   temporary candidates are exclusively created with collision retry; both
+   inputs and foreign collision files remain byte-identical.
+2. **Stale verdict and implicit-marker ambiguity, fixed — prototype correctness
+   defects, important severity, high confidence.** Failed reruns remove the
+   requested report, and `default-deny` is reserved for the implicit decision.
+3. **Strict report verification, fixed — prototype strictness defect, minor
+   severity, high confidence.** Unknown fields at every report layer now fail
+   before `exact_report=true` can be printed.
+4. **Output sensitivity — performance-evidence limitation, important severity,
+   high confidence.** The recorded fixture has one normalized change region;
+   adversarial highly fragmented exact output may require substantially more
+   time and memory.
+5. **External validity — evidence limitation, important severity, high
+   confidence.** Exactness covers the toy source-CIDR/protocol/destination-port
+   model, not a vendor policy language or the production evaluator.
+
+These are prototype and evaluation findings, not BogKit defects. An exact
+static firewall analyzer is a domain-specific one-trial capability and is not a
+proposal for BogKit to add a firewall subsystem.
+
+### Decision audit
+
+The developer chose strict complete input admission, exact first-match geometry,
+implicit default deny, deterministic lower-corner witnesses, a separately
+written linear evaluator, closed report schemas, read-only policy handling,
+exclusive temporary creation, and atomic report publication. Sampling,
+approximation, persistence, policy rewriting, deployment decisions, and vendor
+feature expansion were rejected. Production syntax, fragmentation limits,
+report-size policy, and external evaluator parity remain uncertain.
+
+## Skeptical review
+
+- Claims reproduced: both no-fit decisions; exact lexer equality after the EOF
+  fix; an independent 100,000-edit lexer corpus; invalid-edit nonmutation;
+  exact serialized reproducibility; firewall exhaustive/probe agreement;
+  witness replay; deterministic reports; strict invalid-input behavior;
+  publication safety; and both recorded large fixtures.
+- Claims rejected or softened: Trial 1 peak memory, whole-editor performance,
+  and production-lexer compatibility; Trial 2 universal 50,000-rule resource
+  bounds, real-vendor semantics, and the illustrative sample as incident proof.
+- Quality fixes required and completed: canonical EOF splice ownership, exact
+  serialization comparison, reserved fallback identity, stale-output cleanup,
+  complete report schema, input-alias protection, and exclusive collision-safe
+  temporary publication.
+- Unnecessary code or dependencies: none. Each package uses only `serde` and
+  `serde_json`; no BogKit, database, network, async, parser, solver, or ML
+  dependency was added.
+- Remaining uncertainty: real editor and firewall oracles, true Trial 1 peak
+  memory, uncounted line-index work, production latency, adversarial firewall
+  output fragmentation, archive-path RSS, and domain-policy completeness.
+
+The final audit counted 4 blocker/critical, 9 important, and 3 minor findings,
+including fixed discoveries and coordinator-only archive conditions. After
+three focused correction rounds, the same reviewer approved both archives. No
+BogKit correctness defect or new candidate was demonstrated.
+
+## Cross-run synthesis
+
+- New evidence: two additional no-component boundaries—stateful positional
+  suffix convergence over an edited text buffer, and exact one-shot geometry
+  over an ordered policy snapshot.
+- Recurring evidence: no existing recurring-finding count changes. The public
+  capability/operational-boundary matrix remains supported by 20 independent
+  trials; component-selective scaffolding by 10; nameable pipeline/reader
+  patterns by 3.
+- Candidate improvements: none newly promoted. Trial 2's starter-dependency and
+  closure-type observations do not add an independently audited source to the
+  existing candidates.
+- Observations not yet promoted: an in-memory ordered-sequence convergence
+  primitive and exact static-policy analysis. They are separate domain-specific
+  needs and should not be combined into a vague new subsystem.
+- No-fit signal: exact local algorithms over one complete snapshot or buffer
+  should remain outside BogKit when persistence, embeddings, and approximate
+  neighbors do not simplify the load-bearing correctness work.
+
+## Validation
+
+- Trial-specific tests: syntax 6 total; firewall 14 total; all passed after
+  reviewer-directed fixes from the normalized final archive paths.
+- Strict lint and formatting: both new packages passed focused formatting and
+  strict release Clippy with warnings denied.
+- Runnable demonstrations: syntax correctness, adversarial, cross-line CLI,
+  full 2,000-edit oracle, and exact reproducibility passed; firewall sampling,
+  byte-deterministic baseline, strict verification, invalid no-output,
+  differential suite, and 50,000-rule analyze/verify passed.
+- Nested lab workspace: the two child workspaces, child lockfiles, and ignored
+  package release profiles were removed. The single nested lock resolved both
+  packages offline; locked release tests and strict Clippy passed the complete
+  archive workspace.
+- BogKit root workspace: `cargo test --workspace` passed all 45 unit and
+  documentation tests.
+- Archive and secret checks: `git diff --check`, valid coverage JSON,
+  changed-path scope, child workspace/lockfile, build/database/binary/large-file/
+  symlink scans, and credential-pattern scans passed. Every changed path is
+  under `developer-simulation/`.
diff --git a/developer-simulation/reports/2026-08-10.md b/developer-simulation/reports/2026-08-10.md
new file mode 100644
index 0000000..357cda5
--- /dev/null
+++ b/developer-simulation/reports/2026-08-10.md
@@ -0,0 +1,246 @@
+# Developer simulation — 2026-08-10
+
+<!-- bogkit-developer-simulation:2026-08-10 -->
+
+Two blind developers evaluated substantially different existing-software
+problems from separate sanitized copies of current `main`: a bilingual
+support-case duplicate finder beside authoritative PostgreSQL, and a fully
+offline repair-cafe lending ledger. Both built working BogKit integrations,
+but neither justified production adoption over its existing baseline. A
+separate skeptical reviewer confirmed one narrow Fold correctness defect and
+found one important prototype ordering bug plus three minor evidence/reporting
+issues. The original developer fixed the prototype bug and both archives passed
+fresh normalized-workspace checks. No BogKit core or existing example changed.
+
+## Trial 1 — Bilingual support-case duplicate finder
+
+- Persona: customer-support platform developer with production TypeScript
+  experience and six months of Rust
+- Existing system: PostgreSQL full-text search over a privacy-scrubbed
+  projection of resolved support cases
+- Problem: improve English/Spanish duplicate-case recall without moving
+  authority, permissions, or workflow ownership out of PostgreSQL
+- Outcome: local mechanics proof only; no production fit on current evidence
+- BogKit components considered and used: Fold, ESE, and ANNy
+- Archive:
+  [`runs/2026-08-10--support-case-finder`](../runs/2026-08-10--support-case-finder)
+
+### Evidence
+
+- Quality commands:
+  - `cargo fmt -p support-case-finder -- --check`
+  - `cargo test --offline --locked --release -p support-case-finder --all-targets`
+  - `cargo clippy --offline --locked --release -p support-case-finder --all-targets -- -D warnings`
+- Tests: 2 unit tests passed; the separate panic reproducer compiled and the
+  complete nested workspace test suite also passed.
+- Disclosed retrieval fixture: lexical, semantic, and hybrid each returned a
+  known case for 6/6 queries at rank 5. At the more discriminating rank 1,
+  lexical scored 5/6, semantic 4/6, and hybrid 5/6. The hybrid therefore did
+  not improve on lexical even in the toy comparison.
+- Mechanics: three reopened processes emitted byte-identical ordered IDs; an
+  aborted child left the prior index queryable; retry made an edit and insert
+  visible and removed a deletion; every displayed excerpt was an exact
+  substring of approved fixture text.
+- Normalized archive scale run: 75,000 synthetic cases built and checkpointed
+  in 80.43 seconds, occupied 321,337,660 bytes, applied 2,000 mixed changes in
+  1.78 seconds, and served the repeated warm query at 17.24 ms p95. Developer
+  and reviewer runs observed 254.2–321.3 MB, so storage is reported as a range,
+  not a stable size. The host was not constrained to two cores and peak memory
+  was unavailable.
+- Primary acceptance gate: not run. The private 200-query English/Spanish
+  judgments and the production 58% recall@5 baseline implementation were not
+  available, so the required 72% recall@5 gain remains unestablished.
+
+### Friction trail
+
+The public search example made Fold, ESE, and ANNy look unusually direct for a
+hybrid side index. The first offline Cargo build still attempted ESE's network
+download until an existing model/tokenizer cache was supplied. Source
+inspection then showed that the embedded model is English-specific, while the
+brief is explicitly bilingual. The developer used a small disclosed fixture
+and retained PostgreSQL as authority rather than turning synthetic success into
+a production claim.
+
+Crash testing uncovered the strongest result. A child-process abort during an
+uncommitted refresh preserved the old index and allowed retry. But if the
+service catches a panic resumed by Fold's `wtx`, the committed row remains
+readable and the next write panics with Fjall's `poisoned tx lock`. The
+reviewer independently reproduced the minimal expected-failure binary and
+traced the cause to resuming the user panic while the transaction's mutex guard
+is still alive.
+
+### Findings
+
+1. **Caught write panic poisons later writes — BogKit correctness defect,
+   important severity, high confidence.** Run
+   `cargo run --offline --locked --release -p support-case-finder --bin panic_poison`;
+   it exits 101 after proving rollback and then prints `poisoned tx lock`. The
+   smallest correction is to drop the underlying write transaction before
+   resuming the panic and add both `Stream` and `KeyedStream` regressions that
+   prove rollback plus a successful later write.
+2. **ESE model and offline-build boundaries — documentation gap, important
+   severity, high confidence.** The public onboarding does not name the model,
+   its English scope, cache path, first-build network behavior, or a hermetic
+   build recipe. Document those facts before considering a model-selection API.
+3. **Named pipeline reuse — API friction, important severity, high
+   confidence.** Closure-bearing pipeline types again forced macros around
+   ordinary open/search helpers. This independently strengthens the existing
+   documentation-first candidate; it does not justify type erasure.
+4. **Production retrieval and resource gates — evidence limitation, important
+   severity, high confidence.** Synthetic text, an unconstrained host, missing
+   peak memory, fixed top-K candidate behavior, and absent private judgments
+   prevent an adoption claim.
+
+### Decision audit
+
+The developer chose ESE `dim-64`/`quant-8`, default HNSW tuning with seed 42,
+default ASCII-oriented BM25, equal-weight reciprocal-rank fusion, application
+sorting by case ID, unweighted concatenated fields, fixed exact excerpts, and
+one large daily transaction. Language/product filtering, candidate-cutoff tie
+completeness, versioned index swapping, memory ceilings, concurrent refresh
+traffic, and a restart policy remain unresolved. The local index is replaceable
+and advisory; PostgreSQL remains the only authority.
+
+## Trial 2 — Repair-cafe tool lending kiosk
+
+- Persona: sole volunteer developer with strong Python/SQL and intermediate
+  Rust experience
+- Existing system: CSV event files plus a Python-generated current-inventory
+  snapshot
+- Problem: keep ordered history and current state atomic, replayable,
+  inspectable, searchable, and fully offline on one small laptop
+- Outcome: no fit for the authoritative store; Fold is a successful local
+  proof, but embedded SQL remains the better production choice
+- BogKit components considered: Fold, ESE, and ANNy
+- BogKit components used: Fold only at the application level
+- Archive:
+  [`runs/2026-08-10--repair-cafe-kiosk`](../runs/2026-08-10--repair-cafe-kiosk)
+
+### Evidence
+
+- Quality commands:
+  - `cargo fmt -p repair-cafe-fold-trial -- --check`
+  - `cargo test --offline --locked --release -p repair-cafe-fold-trial --all-targets`
+  - `cargo clippy --offline --locked --release -p repair-cafe-fold-trial --all-targets --all-features -- -D warnings`
+- Tests: 6 tests passed, including transition/rejection atomicity, reopen and
+  historical queries, canonical lookup, live order guards, and matching import
+  order guards.
+- Process interruption: a child flushed pending event and projection views
+  inside an uncommitted transaction, then aborted. Reopen exposed the complete
+  old state; a later committed event reopened with both new views.
+- Normalized archive benchmark: 8,000 items, 1,200 borrowers, and 100,000
+  accepted events imported in 1.18 seconds; five injected bad rows were all
+  reported; reopen took 0.198 seconds; 1,000 point reads measured 0.003 ms p95;
+  the synthetic search set scored 50/50 in 3.53 seconds; three fresh processes
+  reproduced byte-identical current views. Peak RSS was 172.0 MiB for the
+  coordinator and 171.3–172.8 MiB for replay children on this host.
+- Baseline comparison: not benchmarked. Embedded SQL still provides familiar
+  uniqueness/foreign-key constraints, indexed ordered history, inspection,
+  backup, and recovery; the report does not invent comparative speed or size.
+
+### Friction trail
+
+Fold genuinely kept accepted events and the current/history projection in one
+transaction, while ordinary deterministic matching made ESE and vector search
+unnecessary. However, a Fold-only application still resolved ANNy through
+Fold's unconditional dependency. Naming the reusable pipeline and reader also
+required about forty lines of nested aliases and function-pointer casts.
+
+The reviewer found that the first implementation validated a return against
+current state, then sorted all history by caller-supplied sequence during
+materialization. Checkout sequence 10 followed by return sequence 5 therefore
+passed preflight and panicked during replay. The developer chose an explicit
+global append-only policy, rejecting reused or non-increasing sequences before
+`wtx` in both live writes and imports. Permanent regressions prove both errors
+leave state/history unchanged and that a later valid write still succeeds. The
+small proof scans all events for this check; that O(total events) cost is
+disclosed rather than hidden behind a new subsystem.
+
+### Findings
+
+1. **Out-of-order event panic, fixed — prototype correctness defect,
+   important severity, high confidence.** Strict append-order validation and
+   two permanent regressions close the hole without changing BogKit core. The
+   no-fit recommendation remains.
+2. **Fold-only consumers still pull ANNy — API/packaging friction, important
+   severity, high confidence.** `cargo tree` independently confirmed
+   application → Fold → ANNy even though the kiosk rejects vector search. This
+   strengthens the existing component-selective candidate; the narrowest
+   improvement is an optional HNSW/ANNy integration with a simple default.
+3. **Durability and validation boundaries — documentation gap, important
+   severity, high confidence.** Public onboarding should distinguish process
+   atomicity, checkpoint/power-loss durability, transactional reads, and why
+   pre-transaction validation depends on the stated single-writer rule.
+4. **Relational ledger — poor product fit, high confidence.** Fold can perform
+   the workload, but it moves uniqueness, references, ordering, inspection,
+   and recovery into bespoke Rust without demonstrating an advantage over the
+   persona's embedded-SQL baseline. Do not add relational or SQL-like machinery
+   to BogKit based on this trial.
+
+### Decision audit
+
+The developer chose one global strictly increasing sequence, append-only
+correction events, application validation, a per-item history vector, day-level
+time, checkpoint after bulk work, and an O(8,000) normalized edit-distance
+search. Backdated insertion, master-data mutation, real CSV parsing, live-copy
+backup, corruption/version migration, power loss, production volunteer query
+logs, and the actual old laptop remain untested. The full-line/history rewrite
+and O(total-events) order check are proof-scale choices, not production advice.
+
+## Skeptical review
+
+- Claims reproduced: both narrow non-production outcomes; Fold multi-view
+  atomicity; keyed edit/delete and process reopen; deterministic output;
+  exact-source/privacy shape; the caught-panic writer poisoning; 75,000-case
+  scale mechanics; kiosk rejection nonmutation; transaction abort/reopen;
+  100,000-event import; exact replay; lookup; memory; and the transitive ANNy
+  dependency.
+- Claims rejected or softened: production retrieval gain, Spanish embedding
+  quality, stable storage size, declared-host performance, Trial 1 peak memory,
+  every crash boundary, real kiosk search language, power-loss durability, and
+  measured superiority over embedded SQL.
+- Review count: 0 blocker/critical, 2 important, and 3 minor findings. One
+  Important is the confirmed Fold defect; the other is the fixed kiosk order
+  bug. Minor corrections covered transitive-dependency wording, generated-data
+  location, and the exact boundary exercised by Trial 1's abort check.
+- Final verdict: both archives approved after the original kiosk developer's
+  correction and an independent scoped re-review.
+
+## Cross-run synthesis
+
+- New confirmed defect candidate: Fold's caught-`wtx` writer poisoning meets
+  the one-serious-reproducer threshold. The proposal is only the drop-before-
+  resume correction and two regression tests; the lab does not modify core.
+- Recurring storage/product-fit boundary: 22 independent trials now support a
+  concise public capability matrix. Today's two cases distinguish a replaceable
+  advisory side index from a relational source of truth.
+- Component-selective setup: 11 independent sources. The kiosk adds direct
+  evidence that choosing Fold alone still brings unused ANNy code.
+- Nameable pipelines/readers: 5 independent sources, now high confidence.
+  Keep the candidate documentation-first: show aliases, function pointers,
+  macros, and ordinary helper signatures before considering a new abstraction.
+- Observation not yet promoted: ESE model provenance, English-only suitability,
+  and first-build download behavior deserve documentation, but this is the
+  first archived developer trial that selected ESE. Multilingual model choice,
+  metadata filtering, index swapping, relational constraints, and SQL-like
+  range queries remain one-scenario needs or explicit no-fit boundaries.
+- Outcome totals: 28 trials — 25 `no_fit` and 3
+  `local_proof_only_no_production_fit`.
+
+## Validation
+
+- New packages: 8 focused tests passed; formatting and strict release Clippy
+  passed with warnings denied.
+- Runnable evidence: support retrieval/update/crash/determinism/privacy demo,
+  75,000/2,000 scale run, expected writer-poisoning reproducer, kiosk demo,
+  transaction-interruption run, and 100,000-event benchmark all ran from the
+  normalized archive paths.
+- Nested lab workspace: child workspaces, child lockfiles, and package release
+  profiles were removed. One lock resolved both unique packages; locked offline
+  release tests and strict Clippy passed the entire archive workspace.
+- BogKit root workspace: `cargo test --workspace` passed all 45 unit and
+  documentation tests against `80fd3c9a023e877fff2e5d127accca386d437af0`.
+- Archive boundaries: final checks cover diff whitespace, valid JSON,
+  changed-path scope, child workspace/locks, generated build/database/binary
+  output, large files, symlinks, and credential patterns. Every retained change
+  is under `developer-simulation/`.
diff --git a/developer-simulation/reports/2026-08-11.md b/developer-simulation/reports/2026-08-11.md
new file mode 100644
index 0000000..dc5659a
--- /dev/null
+++ b/developer-simulation/reports/2026-08-11.md
@@ -0,0 +1,273 @@
+# Developer simulation — 2026-08-11
+
+<!-- bogkit-developer-simulation:2026-08-11 -->
+
+Two blind developers evaluated substantially different existing-software
+problems from separate sanitized copies of current `main`: repairing derived
+cold-chain incident state from an authoritative NDJSON archive, and admitting
+receiving-dock bookings whose command result and audit must commit together in
+PostgreSQL. Both built runnable Fold integrations or boundary reproducers and
+reached grounded production no-fit conclusions. A separate skeptical reviewer
+confirmed one serious Fold persisted-value error-handling defect and found
+three Important scheduling-model defects. The original dock-slot developer
+fixed those defects, the same reviewer independently approved the corrections,
+and both normalized archives passed fresh workspace checks. No BogKit core or
+existing example changed.
+
+## Trial 1 — Cold-chain excursion state repair
+
+- Persona: regional food-distributor platform engineer with six years of
+  production Python and one year of Rust
+- Existing system: append-only NDJSON observation/configuration archive with a
+  disposable derived SQLite state database
+- Problem: obtain exact canonical incident state under duplicates, late
+  uploads, linked corrections, and backdated temperature limits
+- Outcome: no fit for the production reducer; the application-specific replay
+  remains simpler and materially lighter
+- BogKit components considered: Fold, ESE, and ANNy
+- BogKit components used: Fold
+- Archive:
+  [`runs/2026-08-11--cold-chain-repair`](../runs/2026-08-11--cold-chain-repair)
+
+### Evidence
+
+- Quality commands:
+  - `cargo fmt --manifest-path developer-simulation/Cargo.toml -p cold-chain-repair -- --check`
+  - `cargo test --manifest-path developer-simulation/Cargo.toml --locked --offline --release -p cold-chain-repair --all-targets`
+  - `cargo clippy --manifest-path developer-simulation/Cargo.toml --locked --offline --release -p cold-chain-repair --all-targets -- -D warnings -D clippy::all -D clippy::pedantic`
+- Tests: seven acceptance tests and two CLI/subprocess tests passed. The
+  100-seed differential test used fresh Fold databases for chronological
+  reference, shuffled candidate, and repeated candidate batches.
+- Canonical behavior: hand-checked five- and ten-minute boundaries, exact
+  observation/configuration provenance, correction and backdated-limit
+  isolation, duplicate idempotency, malformed-batch rejection, and byte-stable
+  NDJSON-to-JSON repair all passed.
+- Process exits: an exit inside an uncommitted Fold transaction, immediately
+  before snapshot rename, immediately after rename, and restart convergence
+  all exposed one complete prior-or-next snapshot for the tested boundaries.
+- Normalized archive demonstrations: the fixture demo exactly matched the
+  separate replay oracle, `verify 100` passed, and the process-exit demo passed.
+- One-million-observation/400-freezer measurements were independently
+  reproduced. The reference used 0.716–0.727 seconds inside the reducer and
+  511.46–511.51 MB peak RSS; the Fold-backed candidate used 3.230–3.320 seconds
+  and 1.155–1.156 GB peak RSS. Both met the 60-second target and failed 384 MiB;
+  the candidate also exceeded the stated 512 MiB server. Fixture generation,
+  validation, and replay remain in memory, so this is an architecture failure,
+  not an isolated Fold memory benchmark.
+
+### Friction trail
+
+The public Fold examples made a durable keyed record index plausible, while ESE
+and ANNy were clearly unrelated to deterministic temperature state. Source
+inspection confirmed useful local multi-view atomicity, but no operator for
+invalidating and replaying an event-time suffix after an old observation or
+configuration changes. The authoritative archive append and canonical snapshot
+also remain outside Fold's transaction, so the hardest domain and recovery
+logic stayed in the application.
+
+The first ordinary persisted enum compiled under Fold's public
+`Serialize + DeserializeOwned` bounds and committed, then table iteration
+panicked with Postcard `WontImplement`. Changing to external enum tagging and
+omitting a `None` field with `skip_serializing_if` produced a second read-time
+panic, `DeserializeUnexpectedEnd`. The developer retained both minimal
+reproducers and used external tagging with the option always serialized in the
+working proof.
+
+The reviewer reproduced both panics and then called Postcard directly without
+Fold. Postcard returned the same two expected errors: its non-self-describing
+format cannot decode an internally tagged enum or a schema field omitted at
+serialization. The consumer-facing Fold defect is therefore the undisclosed
+narrower storage contract plus an internal `unwrap` that converts a predictable
+type incompatibility into an unrecoverable read-time panic after data commits;
+the underlying format limitations are not Postcard correctness bugs.
+
+### Findings
+
+1. **Persisted-value incompatibility panics at read time — BogKit/Fold
+   correctness and error-handling defect, important severity, high
+   confidence.** Both compact reproducers deterministically exit 101 at
+   `TableReader::iter`. First document Postcard-compatible Serde shapes at every
+   persisted-value entry point; then replace serialization/deserialization
+   `unwrap`s with recoverable typed errors where an API-compatible path exists.
+   This serious reproducer satisfies the charter's single-defect candidate
+   exception without implying a new codec subsystem.
+2. **Straightforward Fold record index misses the memory ceiling — prototype
+   performance failure, high confidence.** The reference is already too large,
+   and the duplicate index makes the candidate substantially worse. Stream the
+   application-specific reducer rather than adding a BogKit subsystem.
+3. **External authority and ordered temporal repair — poor product fit, high
+   confidence.** Fold does not own the archive/snapshot publication boundary
+   and does not remove correction/configuration replay. Do not add a temporal
+   database or suffix-repair primitive from this one workload.
+4. **Named pipeline helpers — recurring API friction, high confidence.** The
+   closure-composed pipeline stayed inline because ordinary helper types were
+   awkward. This strengthens the existing documentation-first candidate, not
+   a type-erasure proposal.
+
+### Decision audit
+
+The developer chose integer-second timestamps, `(observed_at, observation_id)`
+tie ordering, continuous classification across unspecified sampling gaps,
+transition time at the first qualifying observation, conflicting-duplicate and
+ambiguous-correction rejection, backdated configuration lookup by effective
+time, fixed-shape canonical JSON, 4,096-record Fold transactions, and
+same-directory synced snapshot rename. A seven-day correction fixture exists,
+but no wall-clock cutoff policy was invented. The process-exit suite does not
+cover power loss or the boundary after some index chunks commit and before the
+full archive is indexed; restart convergence at that exact intermediate point
+is reasoned rather than executed. The oracle has a separate replay loop but
+shares record types, validation inputs, and fixture structure, so it is an
+algorithmically separate oracle rather than a fully independent production
+implementation.
+
+## Trial 2 — Receiving-dock slot admission
+
+- Persona: warehouse-management backend engineer with eight years of
+  TypeScript/PostgreSQL experience and three months of Rust
+- Existing system: six service replicas using serializable PostgreSQL and
+  advisory locks, with Redis-based hold expiry outside the commit boundary
+- Problem: make hold, confirm, cancel, reschedule, expiry, idempotency, booking,
+  and audit decisions atomic and deterministic
+- Outcome: no fit for the production authority; keep every accepted command
+  and audit decision in one PostgreSQL transaction
+- BogKit components considered: Fold, ESE, and ANNy
+- BogKit components used: Fold in the split-commit reproducer
+- Archive:
+  [`runs/2026-08-11--receiving-slot-admission`](../runs/2026-08-11--receiving-slot-admission)
+
+### Evidence
+
+- Quality commands:
+  - `cargo fmt --manifest-path developer-simulation/Cargo.toml -p receiving-slot-admission -- --check`
+  - `cargo test --manifest-path developer-simulation/Cargo.toml --locked --offline --release -p receiving-slot-admission --all-targets`
+  - `cargo clippy --manifest-path developer-simulation/Cargo.toml --locked --offline --release -p receiving-slot-admission --all-targets -- -D warnings -D clippy::all -D clippy::pedantic`
+- Tests: eight tests passed after review, including expiry without an explicit
+  sweep, reschedule after an unrelated expiry, zero/nine-duration nonmutation,
+  distinct stale-version and payload-mismatch results, exact retries,
+  deterministic fixtures, and local collision invariants.
+- Domain-model smoke: a deterministic 10,000-command fixture plus 100 generated
+  seeds passed; four threads over 30 runs preserved invariants behind one local
+  mutex. These are explicitly not PostgreSQL or six-process evidence.
+- Split-commit reproducer: real child exits immediately before and after a
+  mocked atomic authority commit. An exit after the authority commit and before
+  the real Fold mirror write leaves booking/audit present with no Fold row.
+  Retry can repair the mirror but cannot make the original commits atomic.
+- Normalized archive demo: all model and split-commit checks passed. The local
+  repeat-heavy 100,000-command run measured about 2.69–2.71 million commands/s
+  and 0.000459–0.000500 ms p95. These numbers are invalid for the PostgreSQL
+  acceptance gate and are retained only as a runnable smoke check.
+- PostgreSQL gate: not run. `psql`, `postgres`, and `pg_isready` were absent;
+  port 5432 was closed; no connection setting existed; and no service was
+  installed or started. Serializable locking, database timestamps, four real
+  clients, six replicas, schema size, and database latency remain unverified.
+
+### Friction trail
+
+The public examples showed that Fold atomically maintains views inside an
+embedded store, but did not state the external transaction or writer boundary.
+Minimal source inspection found a concrete Fjall `SingleWriterTxDatabase`:
+`Stream::wtx` creates and commits its own transaction and exposes no
+PostgreSQL/caller-owned transaction, prepare/commit, or storage-adapter hook.
+ESE and ANNy were irrelevant to exact scheduling. A downstream outbox-fed Fold
+projection remained possible, but no measured read need justified operating a
+second persisted system.
+
+The first model also demonstrated why skeptical review is required. Expired
+holds continued consuming capacity unless an explicit sweep ran, zero-duration
+reschedules were accepted, and the exact pedantic lint gate failed with 19
+diagnostics. The original developer moved logical-time expiry into every new
+non-replayed authority command, added range validation/nonmutation, replaced
+lossy conversions, and separated a genuine stale-version assertion from
+payload mismatch. Eight tests, strict lint, the release demo, and the real
+split-commit boundary then passed independently.
+
+### Findings
+
+1. **Expired-capacity and invalid-reschedule bugs, fixed — prototype
+   correctness defects, important severity, high confidence.** Logical
+   `expires_at <= command_now` processing and duration `1..=8` validation now
+   occur before mutation. Permanent regressions cover both fixes; no BogKit
+   core change was involved.
+2. **External transaction/writer boundary — documentation gap, important
+   severity, high confidence.** State concisely that Fold transactions are
+   scoped to the embedded Fjall store and do not join an external database
+   transaction, and name the intended writer topology. Do not add a PostgreSQL
+   adapter based on this no-fit workload.
+3. **Component-selective setup and nameable pipelines — recurring API
+   friction, high confidence.** Only Fold was relevant, yet the starter bundles
+   unrelated search components, and closure-bearing pipeline types remain hard
+   to name for ordinary helpers. Keep both improvements narrow and
+   documentation/scaffolding-first.
+4. **PostgreSQL command authority — poor product fit, high confidence.** The
+   existing database already provides the only commit boundary that can satisfy
+   the requirement. No BogKit dependency is the lean result.
+
+### Decision audit
+
+The model chose operation-scoped idempotency keys, stable payload hashes,
+confirmed-booking exclusivity despite pallet spare capacity, ascending door
+selection, time-conflict precedence, expiry at equality, explicit and implicit
+expiry, injected logical command time, one decision row per stored command,
+and eventual mirror repair only for demonstration. Payload-mismatch attempts
+remain visible but do not append a second durable decision; carrier priority,
+database schema/indexing, HTTP serialization, migrations, connection pooling,
+real lock ordering, and production retry behavior remain unresolved. The
+100-seed comparison repeats the same model, four workers serialize through one
+mutex, and the atomic file is only a benign authority model. None is presented
+as database evidence.
+
+## Skeptical review
+
+- Trial 1: `APPROVED_FOR_ARCHIVE`. Nine tests, formatting, strict pedantic
+  Clippy, demo, 100 seeds, process-exit boundaries, independent one-million
+  measurements, and both Fold/Postcard reproducers passed. Two Minor evidence
+  limits remain disclosed.
+- Trial 2 initial verdict: `REJECTED_UNTIL_FIXED`. Three Important items were
+  the expired-hold capacity bug, invalid reschedule duration, and failed strict
+  lint gate. One Minor evidence-name issue was also corrected.
+- Trial 2 final verdict: `APPROVED_FOR_ARCHIVE_AFTER_FIXES`. Eight tests,
+  formatting, strict pedantic Clippy, logical-time source inspection, release
+  demo, split-commit boundary, documentation, and cleanliness all passed the
+  same reviewer's scoped rerun. The PostgreSQL evidence limit remains.
+- Consolidated review count: 0 blocker/critical; 3 Important fixed and 0
+  remaining; 4 Minor notes, of which one was fixed and three remain as explicit
+  evidence limits.
+
+## Cross-run synthesis
+
+- New confirmed candidate: Fold's persisted-value codec panic meets the
+  one-serious-reproducer threshold. Keep it separate from the caught-`wtx`
+  writer-poisoning candidate because the roots and corrections differ.
+- Storage, transaction, and concurrency boundaries: 24 independent trials.
+  Today's runs add an authoritative external archive/snapshot boundary and an
+  external PostgreSQL/multi-process boundary.
+- Component-selective setup: 12 independent sources. The dock-slot developer
+  again rejected unrelated ESE/ANNy setup for a Fold-only evaluation.
+- Nameable pipeline/readers: 7 independent sources, now strengthened by both
+  developers. Preserve the documentation-first scope.
+- Do not promote event-time suffix replay, a PostgreSQL adapter, distributed
+  writer coordination, or a general constraint solver. Each is either a
+  one-scenario missing capability or an explicit product-fit boundary.
+- Outcome totals: 30 trials — 27 `no_fit` and 3
+  `local_proof_only_no_production_fit`.
+
+## Validation
+
+- New packages: all 17 focused tests passed; formatting and strict release
+  Clippy passed with warnings, `clippy::all`, and `clippy::pedantic` denied.
+- Runnable evidence: cold-chain fixture/reference, 100-seed differential,
+  process-exit recovery, both expected Fold panic reproducers, dock-slot domain
+  model, local collision smoke, and real Fold split-commit boundary ran from
+  normalized archive paths.
+- Nested lab workspace: child workspaces, child lockfiles, and package release
+  profiles were removed. One lock resolves both unique packages. Locked offline
+  release tests passed the complete nested workspace, and workspace-wide Clippy
+  passed with warnings denied. The unchanged ESE model/tokenizer were supplied
+  only through an external build cache; no model or generated data was archived.
+- BogKit root workspace: `cargo test --workspace --locked --offline` passed all
+  45 unit and documentation tests against
+  `80fd3c9a023e877fff2e5d127accca386d437af0`.
+- Archive boundaries: final checks cover diff whitespace, valid JSON,
+  changed-path scope, child workspace/locks/profiles, generated build/database/
+  binary output, large files, symlinks, and credential patterns. Every retained
+  change is under `developer-simulation/`.
diff --git a/developer-simulation/reports/2026-08-12.md b/developer-simulation/reports/2026-08-12.md
new file mode 100644
index 0000000..4a2d77c
--- /dev/null
+++ b/developer-simulation/reports/2026-08-12.md
@@ -0,0 +1,224 @@
+# Developer simulation — 2026-08-12
+
+<!-- bogkit-developer-simulation:2026-08-12 -->
+
+Two blind developers evaluated substantially different existing-software
+problems from separate sanitized copies of current `main`: an offline
+authoritative-DNS change-admission gate and a hard-real-time MIDI event
+scheduler. Both independently rejected Fold, ESE, and ANNy, built compact
+dependency-free Rust evidence artifacts, and retained the existing production
+baseline. A separate skeptical reviewer rejected both first handoffs, found one
+Critical and eight Important prototype defects, and approved both only after
+the original developers fixed every serious issue and the same reviewer
+reproduced the corrections. No BogKit core or existing example changed.
+
+## Trial 1 — Authoritative DNS change-admission gate
+
+- Persona: hosting-platform reliability engineer with seven years of Go/shell
+  and four months of Rust
+- Existing system: `named-checkzone` remains the syntax authority while humans
+  inspect diffs before deployment
+- Problem: produce a deterministic, fail-closed semantic change report over old
+  and proposed BIND master-file snapshots
+- Outcome: no fit; retain the existing authority and treat the standalone gate
+  only as an advisory prototype over immutable input snapshots
+- BogKit components considered: Fold, ESE, and ANNy
+- BogKit components used: none
+- Archive:
+  [`runs/2026-08-12--dns-change-gate`](../runs/2026-08-12--dns-change-gate)
+
+### Evidence
+
+- Quality commands:
+  - `cargo fmt --manifest-path developer-simulation/Cargo.toml -p dns-change-gate -- --check`
+  - `cargo test --manifest-path developer-simulation/Cargo.toml --locked --offline --release -p dns-change-gate --all-targets`
+  - `cargo clippy --manifest-path developer-simulation/Cargo.toml --locked --offline --release -p dns-change-gate --all-targets -- -D warnings -D clippy::all -D clippy::pedantic`
+- Tests: 22 black-box tests and one fixture-generator integration passed in the
+  repaired trial. They cover the declared parser subset, deterministic order,
+  semantic rules, supplied baseline results, bounded expansion, static
+  containment, input/output identity, and complete report publication.
+- Demonstration: the release CLI produced the checked-in 853-byte oracle
+  exactly. Maximum-`u32` and stepped `$GENERATE` ranges failed promptly without
+  replacing the prior report; decoded 63-octet escaped labels canonicalized
+  exactly while 64-octet labels failed closed.
+- Local scale observation: a synthetic 10,000-zone, 2,000,000-record-per-
+  snapshot corpus ran three times in 3.38–3.45 seconds at 18.63–18.79 MB peak
+  RSS after a 4.20-second warm-up. This was an Apple M4 Pro macOS host, not the
+  declared four-core Linux/256 MiB environment, and the regular corpus did not
+  contain the requested exhaustive semantic oracle set.
+
+### Friction trail
+
+The public material made the component mismatch clear: embeddings and
+approximate search cannot make exact DNS decisions, while a persistent Fold
+store adds state and failure boundaries without parsing master files or
+improving a bounded comparison. A standard-library sorted representation was
+smaller and easier to audit.
+
+Test-first work caught omitted `$TTL` inheritance and ambiguous per-snapshot
+record-cap accounting. Skeptical review then found the more valuable issues:
+unchecked expansion cardinality, wire length measured from rendered escapes,
+overstated concurrent-filesystem containment, non-exclusive temporary report
+creation, and missing input/output identity protection. The repaired prototype
+uses checked wide cardinality before iteration, decoded-octet length accounting,
+exclusive owned temporary files, alias rejection, and an explicitly narrowed
+immutable-snapshot contract.
+
+### Findings
+
+1. **No component improves the bounded exact gate — poor product fit, high
+   confidence.** Fold adds durable storage that the one-shot job does not need;
+   ESE and ANNy are categorically unrelated. Keep `named-checkzone` authoritative
+   and do not add a BogKit subsystem for this workload.
+2. **Operational-boundary guidance remains hard to discover — documentation
+   gap, high confidence.** The README should make no-component outcomes and
+   bounded stateless exact tools explicit in the existing capability matrix
+   candidate. This strengthens recurring evidence; it does not justify an
+   in-memory Fold mode.
+3. **First-handoff parser/publication defects, fixed — prototype correctness,
+   high confidence.** One Critical range-overflow issue and four Important
+   containment, publication, alias, and decoded-length issues now have permanent
+   regressions. They are not BogKit defects.
+4. **Production evidence remains incomplete — validation limit, high
+   confidence.** No real `named-checkzone` comparison, exhaustive 1,000/60/40
+   oracle tables, concurrent-mutation containment, or target Linux benchmark
+   exists. The archive preserves `Partial` and `Representative pass` labels.
+
+### Decision audit
+
+The developer chose a declared fail-closed parser subset, per-snapshot expansion
+caps, active `$TTL` inheritance into includes, scoped include-local state,
+decoded-octet name limits, RFC 1982 serial arithmetic, review rather than block
+for delegation changes, literal `PASS` baseline codes, deterministic JSON with
+no host fields, and complete semantic-block publication. The input trees and
+policy must remain immutable for the entire run because pathname-based reads do
+not prove safety under concurrent replacement. Application fault points do not
+prove kernel, filesystem, power-loss, or production durability.
+
+## Trial 2 — Hard-real-time MIDI event scheduler
+
+- Persona: ten-year production C++ audio developer with Rust Book and two hobby
+  crates but no shipped Rust callback
+- Existing system: production C++ scheduler plus a slower rational test oracle
+- Problem: make exact timing, transport cleanup, overload, duplicate handling,
+  and plan handoff executable without weakening the audio callback contract
+- Outcome: no fit for BogKit and no production Rust replacement; keep C++ until
+  lock, syscall, FFI, and genuinely concurrent reclamation gates are proved
+- BogKit components considered: Fold, ESE, and ANNy
+- BogKit components used: none
+- Archive:
+  [`runs/2026-08-12--midi-scheduler-rt-model`](../runs/2026-08-12--midi-scheduler-rt-model)
+
+### Evidence
+
+- Quality commands:
+  - `cargo fmt --manifest-path developer-simulation/Cargo.toml -p midi-scheduler-rt-model -- --check`
+  - `cargo test --manifest-path developer-simulation/Cargo.toml --locked --offline --release -p midi-scheduler-rt-model --all-targets`
+  - `cargo clippy --manifest-path developer-simulation/Cargo.toml --locked --offline --release -p midi-scheduler-rt-model --all-targets -- -D warnings -D clippy::all -D clippy::pedantic`
+- Tests: all 29 passed after repair — 14 callback, six validation, four modeled
+  publication, two oracle/determinism, two real-time instrumentation, and one
+  representative-shape test.
+- Correctness: 100 fixed seeds agreed with a separately written exact rational
+  oracle. Focused cases cover half-open frames, collapsed events, strict
+  successful-token monotonicity, transport resets, identity-checked notes,
+  retryable failed callbacks, 4,096-event saturation, and ordinary/mixed
+  termination overload with zero stuck active notes.
+- Scale observations: the release representative test prepared 180,000 events
+  and 20,000 tempo nodes for 45 minutes with 250 modeled replacements. An
+  uncontrolled, unpinned 10,000,000-call macOS run observed p99 125 ns and
+  maximum 49.791 microseconds. It is not a production comparison or portable
+  guarantee.
+
+### Friction trail
+
+The public component contracts were straightforward no-fits: Fold is persistent
+transactional state, ESE allocates text embeddings, and ANNy performs allocating
+approximate search. None belongs in an exact fixed-capacity callback. The useful
+work was instead making the existing callback contract executable in a small
+standard-library model.
+
+Skeptical review found four Important state defects missed by the initial 23
+tests: ordinary termination overload could leave notes active, termination
+metadata did not match the onset, a non-consecutive old token could re-emit, and
+a failed discontinuity consumed its retry token. The repaired model consolidates
+excess terminations into per-channel resets, validates full note identity,
+requires strictly increasing successful tokens, and commits a token only after
+successful scheduling. Six new regressions brought the suite to 29 tests.
+
+### Findings
+
+1. **BogKit is outside the callback boundary — poor product fit, high
+   confidence.** Do not change Fold, ESE, or ANNy for this use case. A future
+   editor-side history evaluation must remain separate from the callback.
+2. **First-handoff callback-state defects, fixed — prototype correctness, high
+   confidence.** Four Important issues now have permanent public-interface
+   regressions. They are evidence for the domain contract, not BogKit defects.
+3. **Hard-real-time proof is absent — missing production evidence, high
+   confidence.** The fake handoff is single-threaded; lock attempts, forbidden
+   system calls, FFI panic behavior, and real concurrent reclamation were not
+   instrumented. Keep the C++ baseline.
+4. **Local latency is encouraging but incomplete — performance evidence, medium
+   confidence.** The run had no pinned core, controlled host, repeated series,
+   CPU identity, or C++ comparison; the binary digest is rebuild-dependent.
+
+### Decision audit
+
+The model uses exact checked rational accumulation and containing-frame floor,
+frame/priority/stable ordering, full `(instance_id, channel, key)` identity,
+strictly increasing successful callback tokens, post-success token commit,
+per-channel `AllNotesOff` fallback, suppression of ordinary note lifecycle
+during fallback, fixed-capacity active state, and sticky overload reporting.
+The callback library contains no unsafe block; only the test allocator uses
+unsafe forwarding and counts allocation, zeroed allocation, and reallocation
+for 100,000 calls, not deallocation or the 10-million-call timing run. The
+two-slot handoff models named schedules with exclusive access and is not a
+lock-free primitive or memory-model proof.
+
+## Skeptical review
+
+- Initial verdicts: DNS `REJECTED_PENDING_FIX` with one Critical, four
+  Important, and two Minor; MIDI `REJECTED_PENDING_FIX` with four Important and
+  three Minor.
+- Final scoped verdicts: both `APPROVED_FOR_ARCHIVE_AFTER_FIXES`. One Critical
+  and eight Important findings are fixed; zero Critical or Important findings
+  remain. Five Minor evidence limits remain explicitly disclosed.
+- Fresh reviewer checks passed formatting, strict pedantic Clippy, 22 DNS
+  black-box plus one generator test in debug and release, the byte-exact DNS
+  oracle and focused boundary cases, all 29 MIDI tests, the release
+  representative shape, and five independent corrected callback checks.
+- No BogKit correctness defect or new candidate improvement is justified.
+
+## Cross-run synthesis
+
+- Storage and concurrency boundaries: 26 independent trials. Today's runs add
+  an immutable filesystem/report-lifecycle workload and a hard-real-time
+  callback/publication boundary.
+- Component-selective setup: 14 independent sources. Both developers correctly
+  avoided unrelated BogKit and third-party dependencies. Keep the candidate
+  documentation/scaffolding-first rather than adding a generic abstraction.
+- Nameable pipeline/readers: unchanged at seven; neither trial exercised it.
+- Confirmed defect candidates remain unchanged: caught Fold write-transaction
+  panic poisoning and persisted-value codec panic.
+- Outcome totals: 32 trials — 29 `no_fit` and three
+  `local_proof_only_no_production_fit`.
+- Do not promote a DNS parser, in-memory Fold mode, descriptor traversal layer,
+  MIDI scheduler, callback publication primitive, or general real-time API.
+
+## Validation
+
+- New packages: 52 focused tests pass after archive normalization; formatting
+  and strict release Clippy pass with warnings, `clippy::all`, and
+  `clippy::pedantic` denied.
+- Runnable evidence: the DNS demo matches its checked-in oracle byte-for-byte;
+  the MIDI release representative shape and bounded callback model pass from
+  normalized archive paths.
+- Nested lab workspace: one workspace and lockfile resolve both uniquely named
+  packages; no child workspace, lockfile, or package-local release profile
+  remains.
+- BogKit root workspace: `cargo test --workspace --locked --offline` passes all
+  45 unit and documentation tests against
+  `80fd3c9a023e877fff2e5d127accca386d437af0`.
+- Archive boundaries: final checks cover diff whitespace, valid JSON,
+  changed-path scope, generated build/database/binary output, large files,
+  symlinks, and credential patterns. Every retained change is under
+  `developer-simulation/`.
diff --git a/developer-simulation/reports/2026-08-13.md b/developer-simulation/reports/2026-08-13.md
new file mode 100644
index 0000000..b3dd999
--- /dev/null
+++ b/developer-simulation/reports/2026-08-13.md
@@ -0,0 +1,237 @@
+# Developer simulation — 2026-08-13
+
+<!-- bogkit-developer-simulation:2026-08-13 -->
+
+Two blind developers evaluated substantially different existing-software
+problems from separate sanitized copies of current `main`: advisory return and
+refund reconciliation across carrier, warehouse, and payment evidence, and
+municipal water-meter billing repair from cumulative-reading exports. Both
+built dependency-light exact batch tools, rejected Fold, ESE, and ANNy, and
+retained the existing external database and approval flows. A separate
+skeptical reviewer rejected both initial handoffs, found one Critical and five
+Important prototype or evidence defects, and approved the archives only after
+two fix rounds by the original developers. No BogKit core or existing example
+changed.
+
+## Trial 1 — Multi-carrier return refund reconciler
+
+- Persona: commerce-platform backend developer with seven years of
+  TypeScript/PostgreSQL and four months of Rust
+- Existing system: PostgreSQL remains authoritative; a nightly Python/CSV job
+  creates an operator review sheet and a separate approved service executes
+  refunds
+- Problem: derive an exact, deterministic advisory refund plan from split
+  parcels, warehouse corrections, substituted items, and ambiguous payment
+  results without issuing a second refund
+- Outcome: no fit; retain the direct read-only snapshot/reference approach and
+  keep payment execution outside the prototype
+- BogKit components considered: Fold, ESE, and ANNy
+- BogKit components used: none
+- Archive:
+  [`runs/2026-08-13--multi-carrier-return-refund-reconciler`](../runs/2026-08-13--multi-carrier-return-refund-reconciler)
+
+### Evidence
+
+- Quality commands:
+  - `cargo fmt --manifest-path developer-simulation/Cargo.toml -p return-reconciler-trial1 -- --check`
+  - `cargo test --manifest-path developer-simulation/Cargo.toml --locked --offline --release -p return-reconciler-trial1 --all-targets --all-features`
+  - `cargo clippy --manifest-path developer-simulation/Cargo.toml --locked --offline --release -p return-reconciler-trial1 --all-targets --all-features -- -D warnings -D clippy::all -D clippy::pedantic`
+- Tests: 20 release tests passed after repair. Permanent regressions cover
+  exact/conflicting retries, correction order, split parcels, substituted and
+  excess units, payment states, cent and quantity caps, checked report totals,
+  invalid payment ownership, verifier provenance, input/output aliases, normal
+  publication failures, and abrupt child exits.
+- Representative shape: the generator produced exactly 25,000 returns, 40,000
+  parcels, 70,000 authorized lines, 250,000 events, and 500 labeled adversarial
+  returns. Candidate and separately structured reference agreed, and ten input
+  shuffles produced byte-identical reports. The final trial run observed about
+  273 ms candidate work, 303 ms reference work, and 5.844 seconds for the ten
+  shuffles.
+- Memory evidence: three reviewer child-process high-water measurements were
+  506,707,968–523,190,272 bytes (483.2–499.0 MiB), leaving only 13–29 MiB below
+  the 512 MiB target. This is a narrow host-specific soft pass, not a portable
+  resource guarantee.
+- Baseline comparison: the production Python/SQL implementation and real
+  exports were unavailable, so no runtime or operational superiority was
+  measured. The prototype adds executable audit rules but does not displace
+  the authoritative baseline.
+
+### Friction trail
+
+The public examples made ESE and ANNy direct no-fits for exact IDs, units, and
+cents. Fold offered durable transactions and retractions, but the input is an
+immutable PostgreSQL export and the output an advisory file: persisting another
+copy would not remove reconciliation, quarantine, allocation, provenance,
+reference verification, or external publication logic.
+
+Test-first work found a relative-output false failure after a successful rename
+and an underpowered provenance verifier. Skeptical review then found the
+financially important gaps: return caps could report a full unit with only
+partial-unit cents; report-wide `u64` totals silently wrapped; and a pending
+payment result for a nonexistent or wrong-return line was ignored while a
+refund remained proposed. The repaired candidate, reference, and verifier now
+fund whole units only, use checked report totals, and validate every raw payment
+line/return identity before derivation and publication.
+
+### Findings
+
+1. **BogKit does not improve this authoritative-snapshot boundary — poor
+   product fit, high confidence.** Fold adds a second durable store without
+   sharing PostgreSQL's authority or removing exact domain rules; ESE/ANNy are
+   unsafe or irrelevant for exact accounting. Retain no component.
+2. **External authority and report lifecycle remain onboarding boundaries —
+   documentation gap, high confidence.** Add this source to the existing public
+   capability/operational-boundary matrix; do not infer a new report-publisher
+   or refund subsystem.
+3. **Initial financial-accounting defects, fixed — prototype correctness, high
+   confidence.** One Critical overflow and two Important unit/payment issues
+   now have permanent fail-before-publication regressions. They are not BogKit
+   defects.
+4. **Resource and production evidence are narrow — performance evidence limit,
+   high confidence.** The synthetic local run has little memory headroom and
+   no real Python/SQL comparison, Linux qualification, operator study, or
+   production-policy approval.
+
+### Decision audit
+
+The prototype uses checked integer cents, deterministic whole-unit funding,
+stable remainder-cent allocation, line-ID order for same-SKU authorizations,
+explicit conflict quarantine, source/ingestion/event ordering for named
+corrections, success-dominant prior payment results, a conservative pending
+block, and atomic verified sibling-file publication. Money-field semantics,
+remainder policy, multiple-correction policy, same-SKU allocation, return-cap
+allocation, carrier-status authority, and operator workflow remain product
+decisions rather than demonstrated production rules.
+
+## Trial 2 — Municipal water-meter billing repair
+
+- Persona: municipal-utility data engineer with nine years of SQL/Python and
+  one year of Rust
+- Existing system: an authoritative vendor billing database plus understood
+  SQL views, Python repair scripts, and a separate adjustment-approval import
+- Problem: deterministically reconstruct cumulative consumption across meter
+  rollover, replacement, estimates, corrections, and already billed intervals
+- Outcome: no fit; retain the auditor-understood external authority and use the
+  prototype only as an exact policy/evidence model
+- BogKit components considered: Fold, ESE, and ANNy
+- BogKit components used: none
+- Archive:
+  [`runs/2026-08-13--municipal-water-meter-billing-repair`](../runs/2026-08-13--municipal-water-meter-billing-repair)
+
+### Evidence
+
+- Quality commands:
+  - `cargo fmt --manifest-path developer-simulation/Cargo.toml -p water-repair -- --check`
+  - `cargo test --manifest-path developer-simulation/Cargo.toml --locked --offline --release -p water-repair --all-targets`
+  - `cargo clippy --manifest-path developer-simulation/Cargo.toml --locked --offline --release -p water-repair --all-targets --all-features -- -D warnings -D clippy::all -D clippy::pedantic`
+- Tests: all 19 passed after repair. They cover rollover/regression,
+  replacement boundaries, supersession, duplicates/conflicts, exact prior
+  adjustments, ambiguity isolation, ordering and batch determinism, path
+  identity, globally unique adjustment IDs, exact retries, and four real-child
+  `SIGABRT` publication cases.
+- Correctness: the disclosed demo produced five repairs and one review and
+  matched its hand-written canonical oracle byte-for-byte. A separately
+  structured chronological reference agreed on 100 deterministic seeds and ten
+  permutations at batch sizes 1, 7, and 64.
+- Process exits: real children terminated before staging and after a complete
+  synced temporary file immediately before rename. Existing finals remained
+  byte-identical, absent finals stayed absent, and restart removed the orphan
+  stage before publishing one complete report.
+- Requested-count observation: a synthetic pre-sorted workload contained
+  100,000 service points, 120,000 meters, 2,000,000 readings, and 200,000 billed
+  intervals and completed in 0.159 seconds at 139.8 MiB peak RSS. It has only two
+  intervals per point, no corrections or prior adjustments, and zero repairs or
+  reviews. This is explicitly a partial best-case traversal/publication check,
+  not representative repair performance.
+
+### Friction trail
+
+Fold was the only plausible component because keyed updates and retractions
+match corrected readings. Narrow source inspection confirmed those primitives,
+but every consequential rule—installation validity, register rollover,
+supersession, causal interval repair, provenance, per-service refusal,
+canonical output, and external publication—remained application code. Durable
+embedded state added lifecycle cost without measured benefit. ESE and ANNy were
+unrelated to exact integer/time reconstruction.
+
+The initial prototype passed ordinary tests but modeled publication failures as
+returned errors rather than process exits and overstated a trivial large-shape
+benchmark. Review also found candidate/reference disagreement when one
+adjustment ID was reused across billed intervals. The repair adds real abrupt
+child exits, labels the scale result partial/best-case, and establishes one
+global snapshot adjustment-ID contract: identical rows are idempotent retries;
+any differing reuse fails deterministically before derivation or publication.
+
+### Findings
+
+1. **Fold does not remove temporal or external-publication ownership — poor
+   product fit, high confidence.** Keep the direct chronological reducer and
+   external billing authority; do not add durable state for this batch job.
+2. **Operational-boundary guidance is recurring — documentation gap, high
+   confidence.** This independently strengthens the existing capability matrix
+   for immutable offline transformations and caller-owned publication.
+3. **Initial lifecycle and identity defects, fixed — prototype correctness and
+   evidence defects, high confidence.** Three Important findings now have
+   permanent subprocess, identity, retry, and order regressions. None is a
+   BogKit defect.
+4. **Scale and policy evidence remain partial — performance/validation limit,
+   high confidence.** The requested-count run is deliberately best-case; no
+   production export, regulatory review, approved rollover policy, baseline
+   timing, concurrent writer, or power-loss campaign exists.
+
+### Decision audit
+
+The model uses exact integer volumes, canonical source ordering, a conservative
+top-quarter-to-bottom-quarter rollover rule, fail-closed installation gaps and
+ambiguous equal timestamps, explicit old/new meter boundary readings, named
+correction targets, two adjacent causally affected intervals, global reading
+and adjustment IDs with exact-retry collapse, prior adjustments added to old
+usage, per-service ambiguity isolation, and one-writer atomic report
+publication. Rollover, replacement-boundary, ambiguity, and adjustment policies
+require utility approval. Stale-stage cleanup is not a multi-writer protocol.
+
+## Skeptical review
+
+- Trial 1 initial verdict: `REJECTED_UNTIL_FIXED` with one Critical, two
+  Important, and two Minor findings. Trial 2 initial verdict:
+  `REJECTED_UNTIL_FIXED` with three Important and two Minor findings.
+- Fix round 1 closed whole-unit funding, abrupt-exit evidence, and performance
+  wording, but the reviewer found overflow, invalid payment ownership, and
+  adjustment-ID divergence through independent harnesses.
+- Fix round 2 independently reproduced the repaired counterexamples. Final
+  verdicts: both `APPROVED_FOR_ARCHIVE_AFTER_FIXES`, with zero Critical or
+  Important and two disclosed Minor evidence limits per trial.
+- No BogKit correctness defect or new candidate improvement is justified.
+
+## Cross-run synthesis
+
+- Storage and concurrency boundaries: 28 independent trials. Both runs add an
+  immutable external-database export and caller-owned canonical-report
+  publication boundary.
+- Component-selective setup remains 14; neither trial substantially integrated
+  a Fold pipeline, so today's observations do not justify an increment.
+- Nameable pipeline/readers remains seven.
+- Confirmed BogKit defects remain unchanged: caught Fold write-transaction
+  panic poisoning and persisted-value codec panic.
+- Outcome totals: 34 trials — 31 `no_fit` and three
+  `local_proof_only_no_production_fit`.
+- Do not promote a refund reconciler, water-billing repair subsystem, generic
+  report publisher, in-memory Fold mode, or domain-specific temporal API.
+
+## Validation
+
+- New packages: 39 focused release tests pass after archive normalization;
+  formatting and strict pedantic Clippy pass.
+- Runnable evidence: the return demo/verifier, exact representative/reference
+  and ten-shuffle gate, water disclosed byte oracle, 100 seeds, ten-by-three
+  determinism, real-child publication suite, and focused overflow/payment/
+  adjustment-identity regressions pass from normalized archive paths.
+- Nested lab workspace: one workspace and lockfile resolve both unique new
+  packages; no child workspace, lockfile, or package-local profile remains.
+- BogKit root workspace: `cargo test --workspace --locked --offline` passes all
+  45 unit and documentation tests against
+  `80fd3c9a023e877fff2e5d127accca386d437af0`.
+- Archive boundaries: final checks cover valid JSON, diff whitespace,
+  changed-path scope, secrets, large/binary files, symlinks, child workspaces,
+  locks/profiles, and generated build/database/runtime residue. Every retained
+  change is under `developer-simulation/`.
diff --git a/developer-simulation/reports/2026-08-14.md b/developer-simulation/reports/2026-08-14.md
new file mode 100644
index 0000000..5ad623b
--- /dev/null
+++ b/developer-simulation/reports/2026-08-14.md
@@ -0,0 +1,253 @@
+# Developer simulation — 2026-08-14
+
+<!-- bogkit-developer-simulation:2026-08-14 -->
+
+Two blind developers worked from separate sanitized copies of current `main`.
+One evaluated crash-safe branching undo history for a vector editor; the other
+evaluated an epoch-safe local mailbox mirror beside an authoritative server.
+Both started from their supplied baselines before inspecting BogKit. A separate
+skeptical reviewer rejected both initial handoffs, independently reproduced one
+Critical and six Important correctness or evidence problems, and approved the
+archives only after one focused repair round by the original developers.
+
+The undo trial retained Fold as a narrow authoritative whole-state transaction
+and read-view proof, but its measured layout failed the latency, reopen, and
+storage comparison gates. The mailbox trial retained SQLite and used Fold only
+for a decisive transaction reproducer. It independently confirmed the already
+tracked caught-panic writer-poisoning defect on current `main`; it did not
+justify a new API or subsystem. BogKit core and existing examples remain
+unchanged.
+
+## Trial 1 — Crash-safe branching undo history
+
+- Persona: vector-editor document-core maintainer with eight years of Swift and
+  C++ and six months of Rust
+- Existing system: canonical JSON documents, an in-memory undo stack, and a
+  full-document autosave every 30 seconds
+- Problem: persist grouped undo/redo, branch invalidation, stable retry
+  outcomes, compaction, and acknowledged crash recovery
+- Outcome: `local_proof_only_no_production_fit`
+- BogKit components considered: Fold, ESE, and ANNy
+- BogKit components used: Fold
+- Archive:
+  [`runs/2026-08-14--crash-safe-undo-history`](../runs/2026-08-14--crash-safe-undo-history)
+
+### Evidence
+
+- Quality commands:
+  - `cargo fmt --manifest-path developer-simulation/Cargo.toml --package undo-history-lab -- --check`
+  - `cargo test --manifest-path developer-simulation/Cargo.toml --offline --locked --package undo-history-lab --all-targets`
+  - `cargo clippy --manifest-path developer-simulation/Cargo.toml --offline --locked --package undo-history-lab --all-targets -- -D warnings -D clippy::all -D clippy::pedantic`
+- Tests: all 24 passed after repair. Permanent regressions cover physical
+  final-tail repair followed by a later commit and second reopen, middle
+  corruption, object and point overflow without mutation, exact write-free
+  retries, unique-commit snapshot cadence, exact command identity across
+  restart and compaction, grouped undo/redo and branching, deterministic
+  fixtures, and real child exit after the durability point.
+- Bounded comparator: seed 9001 used 32 initial objects and 1,000 actions. Fold
+  candidate, JSONL-plus-snapshot baseline, and the in-memory model agreed on
+  document digest `b426134b815e9add`, head 843, undo 784, redo 0, and transcript
+  digest `f6251bb4865c3c56`.
+- Bounded performance: candidate p95 edit-submission latency was 17.050 ms
+  versus 5.395 ms for the baseline. Reopen was 19.528 ms versus 23.743 ms,
+  only 1.22x faster. Pre-compaction storage was 37,533,711 bytes versus
+  535,051; post-compaction storage was 2,111,098 versus 2,108,204 bytes.
+  This one-host run fails the requested material-improvement and non-regression
+  gates.
+- Scale boundary: the 60,000-object/250,000-action campaign, 30 seeds, 400
+  process exits, four concurrent inspectors, 20,000-group reversible window,
+  peak resident memory, and every crash point remain unproved.
+
+### Friction trail
+
+The public persistence examples showed Fold transactions and consistent reads,
+but deleted their stores at startup and did not demonstrate reopen,
+acknowledgement, checkpoint, or recovery diagnostics. Fold was therefore tested
+only after the JSONL baseline was defined. ESE and ANNy were direct no-fits for
+exact structured history.
+
+The smallest Fold candidate stored one authoritative complete history value.
+That made Fold central rather than decorative, while leaving command
+validation, inverse construction, branching, exact request identity,
+canonical JSON, retention, and directory-rebuild compaction in application
+code. Test-first work found ordinary prototype issues before skeptical review.
+The reviewer then found that a recognized bad final JSONL tail remained on
+disk, extreme translations could panic after mutation, retries still wrote and
+advanced snapshot cadence, and a 64-bit digest stood in for exact command
+equality. The repaired implementation truncates and syncs recognized final-tail
+damage, prevalidates all arithmetic, makes exact retries write-free, and stores
+canonical command bytes for authoritative equality.
+
+### Findings
+
+1. **Fold supplies bounded atomic whole-state persistence and snapshot reads —
+   partial local utility, high confidence.** The proof is real but narrow; it
+   does not make Fold an undo engine.
+2. **The tested whole-state layout is not production-competitive — performance
+   and storage problem, high confidence.** It missed the latency and comparison
+   gates before the requested scale. Do not infer a new API from this layout.
+3. **Reopen and durability guidance remains hard to discover — documentation
+   gap, high confidence.** A small public reopen/checkpoint example is the
+   smallest improvement; documentation before API work.
+4. **The review findings were prototype defects, now fixed — correctness,
+   high confidence.** They are not BogKit defects.
+5. **Production evidence is incomplete — evidence limit, high confidence.**
+   Memory, full scale, reader schedules, and the broad crash campaign are not
+   qualified.
+
+### Decision audit
+
+The candidate deliberately used a whole-state value as the smallest decisive
+Fold adapter, checkpoints before an accepted unique edit returns, keeps exact
+canonical command bytes for request identity, preserves complete grouped
+undo/redo semantics, and rebuilds a compacted directory. A normalized key-per-
+document/history/outcome layout remains untested. Power-loss behavior, migration
+from the prototype's earlier dedup encoding, an independent semantic oracle,
+and production editor integration remain uncertain.
+
+## Trial 2 — Epoch-safe mailbox mirror repair
+
+- Persona: desktop mail-sync maintainer with twelve years of Kotlin and SQLite
+  and three months of Rust
+- Existing system: an authoritative server plus a local SQLite mirror with
+  explicit accepted-batch transactions and staged epoch replacement
+- Problem: exact replay, UID-validity isolation, stable mailbox lifecycle,
+  atomic old-or-new reader visibility, and deterministic recovery
+- Outcome: `no_fit`
+- BogKit components considered: Fold, ESE, and ANNy
+- BogKit components used: Fold only in a decisive reproducer
+- Archive:
+  [`runs/2026-08-14--epoch-safe-mailbox-mirror`](../runs/2026-08-14--epoch-safe-mailbox-mirror)
+
+### Evidence
+
+- Quality commands:
+  - `cargo fmt --manifest-path developer-simulation/Cargo.toml --package mailbox-mirror-lab -- --check`
+  - `cargo test --manifest-path developer-simulation/Cargo.toml --offline --locked --package mailbox-mirror-lab --all-targets`
+  - `cargo clippy --manifest-path developer-simulation/Cargo.toml --offline --locked --package mailbox-mirror-lab --all-targets --no-deps -- -D warnings -D clippy::all -D clippy::pedantic`
+- Tests: all 22 ordinary tests passed after repair; the explicit local
+  measurement test passed separately in release mode. Coverage includes exact
+  replay, staged epoch replacement, deliberate UID reuse, flag replacement,
+  expunge, rename/delete/recreate, cursor refusal, truncation, chunking,
+  concurrent reader snapshots, integer bounds, staged-row cleanup, and Fold
+  transaction characterization.
+- Full-shape single seed: 80 mailboxes, 300,000 live messages, 600,000 decoded
+  responses, 30,000 duplicate responses, 12 epoch changes, 20 renames, 10
+  delete/recreate lifecycles, one mid-batch disconnect, and five checkpoints.
+  SQLite and the pure reference matched exactly in 49.101 seconds. Replaying the
+  complete transcript admitted zero new batches and preserved manifest hash
+  `ca7ad005908e1699ae14787552eb4880a2fa1c551845cffbcb528b6f30349909`.
+- Bounded measurement: the repaired trial snapshot applied 10,000 messages in
+  821.745 ms at 12,193.6 responses per second; count p95 was 3.593 ms, reopen
+  plus checkpoint was 2.347 ms, and SQLite plus sidecars occupied 2,867,200
+  bytes. A fresh normalized-archive rerun observed 913.095 ms, 10,973.7
+  responses per second, 3.337 ms count p95, 2.483 ms reopen, and the same disk
+  size, so these are host-local observations rather than stable performance
+  guarantees.
+- Evidence boundary: this is one of 30 requested full seeds. The 400 abrupt
+  exits, peak RSS, write amplification, 64 full-transcript cuts, and safe Fold
+  candidate comparison remain unproved.
+
+### Friction trail
+
+The SQLite baseline was implemented and measured before minimal Fold source
+inspection. Fold's public closure commits whenever it returns normally,
+including a returned `Result::Err`; that documented contract means fallible
+external batches need prevalidation or an overlay. The trial correctly treats
+this as onboarding friction, not an `Err` rollback defect.
+
+The decisive same-stream reproducer separates that contract from an existing
+correctness defect: a panicking transaction's row is absent after rollback,
+but after the panic is caught, the next write panics with `poisoned tx lock`.
+This independently confirms the defect first archived on August 10. A safe
+mailbox adapter would still require custom admission, staging inventories,
+cursor validation, replay state, publication state, and multi-key read
+projection, so the prototype retained SQLite.
+
+Review also found that the prototype admitted Rust `u64` values SQLite could
+coerce to floating point and left staged messages after mailbox deletion. Both
+models now reject values outside `0..=i64::MAX` before admission or mutation,
+and the admitted delete transaction removes staged rows. Reopen, repeated
+lifecycle, incomplete-stage, and rejected-rescan regressions pass.
+
+### Findings
+
+1. **SQLite remains the better fit — poor product fit, high confidence.** No
+   Fold adapter crossed the correctness threshold or demonstrated the required
+   maintenance or performance improvement.
+2. **Caught Fold write panic poisons later writes — correctness defect, high
+   confidence.** This is the second independent source for the already-tracked
+   defect. The narrow existing candidate remains: drop the underlying writer
+   before resuming the panic and add Stream and KeyedStream recovery tests.
+3. **Normal `Err` commits are documented but easy to misuse — API/documentation
+   friction, medium confidence.** Add a prevalidation/overlay example and clear
+   normal-return wording; do not infer a new transaction API.
+4. **Integer-domain and staged-delete gaps were prototype defects, now fixed —
+   correctness, high confidence.** They do not justify BogKit changes.
+5. **The full evidence campaign is incomplete — evidence limit, high
+   confidence.** Keep the synthetic one-host result local.
+
+### Decision audit
+
+The prototype buffers decoded batches, admits one exact canonical batch ID in
+the same SQLite transaction as its effects, validates the signed SQLite domain
+before admission, stages complete epochs, publishes them atomically, and
+composes each checkpoint in one SQLite snapshot. It deliberately uses the host
+`sqlite3` CLI because a Rust binding was not cached. Protocol parsing, real
+mail, two-way flags, arbitrary database corruption, process-exit injection,
+and account/UI integration remain outside the proof.
+
+## Skeptical review
+
+- Initial verdicts: Trial 1 `REJECTED_UNTIL_FIXED` with one Critical and three
+  Important findings; Trial 2 `REJECTED_UNTIL_FIXED` with three Important and
+  one Minor finding.
+- The reviewer independently reproduced the bad-tail acknowledgement loss,
+  arithmetic panic, retry-cadence drift, probabilistic identity, caught-panic
+  writer poisoning, SQLite integer loss, and abandoned staged rows.
+- One repair round by the original developers added permanent regressions and
+  corrected the reports. The same reviewer then passed all affected supplied
+  and independent checks.
+- Final verdicts: both `APPROVED_FOR_ARCHIVE_AFTER_FIXES`, with zero Critical,
+  Important, or Minor archive findings remaining.
+- One BogKit defect is confirmed but not new: caught Fold write-transaction
+  panic poisoning. No new API or subsystem candidate is justified.
+
+## Cross-run synthesis
+
+- Outcome totals: 36 trials — 32 `no_fit` and four
+  `local_proof_only_no_production_fit`; zero production adoptions.
+- Storage, durability, transaction, concurrency, and external-authority
+  boundaries: 30 independent trials, adding both of today's sources.
+- Component-selective setup: 15 independent trials, adding the Fold-only undo
+  proof. The mailbox diagnostic reproducer is not counted as another scaffold
+  source.
+- Nameable pipeline/readers remains seven.
+- Caught Fold write-panic poisoning now has two independent sources. Persisted-
+  value codec panic remains one source. These remain the two distinct confirmed
+  BogKit defects.
+- No new candidate is promoted for undo, mailbox projection, normal `Err`
+  returns, SQLite integer encoding, staging cleanup, or domain-specific APIs.
+- Positioning signal: Fold can centrally persist a small single-writer state,
+  but full-state rewrites may lose to a simple journal; exact epoch-safe
+  projections remain a strong embedded-SQL workload when custom admission and
+  staging rules dominate.
+
+## Validation
+
+- New packages: 46 ordinary integration tests pass after archive
+  normalization; Trial 2's explicit release measurement passes separately.
+- Formatting and strict pedantic Clippy pass for both new packages.
+- Runnable evidence: all five undo CLI modes, the bounded three-way comparator,
+  the mailbox five-command demo, the full-shape SQLite/reference seed, replay,
+  concurrent snapshots, final-tail recovery, exact retry, integer-bound,
+  staging-cleanup, and writer-poisoning characterization pass.
+- Nested lab workspace: one workspace and lockfile resolve the two unique new
+  packages; no child workspace, lockfile, or package-local release profile is
+  retained.
+- BogKit root workspace: all 45 unit and documentation tests pass against
+  `80fd3c9a023e877fff2e5d127accca386d437af0`.
+- Archive checks cover JSON validity, diff whitespace, changed-path scope,
+  credentials and secret-like tokens, large/binary files, symlinks, child
+  workspace metadata, and generated build/database/runtime residue. Every
+  retained change is under `developer-simulation/`.
diff --git a/developer-simulation/reports/2026-08-15.md b/developer-simulation/reports/2026-08-15.md
new file mode 100644
index 0000000..8ee934c
--- /dev/null
+++ b/developer-simulation/reports/2026-08-15.md
@@ -0,0 +1,292 @@
+# Developer simulation — 2026-08-15
+
+<!-- bogkit-developer-simulation:2026-08-15 -->
+
+Two blind developers worked from separate sanitized copies of current `main`.
+One evaluated a disposable incremental calculation cache for an established
+financial-planning workbook engine; the other evaluated revision- and
+applicability-safe offline search for an aircraft-maintenance tablet. Both
+defined the existing baseline before inspecting BogKit and both reached
+evidence-backed `no_fit` decisions.
+
+A separate skeptical reviewer rejected both initial handoffs. It independently
+reproduced two restart/initialization defects in the calculation prototype and
+one document-identity defect in the search reproducer. The original developers
+repaired those findings test-first, and the same reviewer approved both stable
+snapshots after a focused re-review. No BogKit core or existing example changed.
+
+## Trial 1 — Incremental calculation cache
+
+- Persona: financial-planning document-core maintainer with nine years of C#
+  and eight months of Rust
+- Existing system: checksummed append-only edit journal plus a mature in-memory
+  full recalculator using exact signed 128-bit scaled integers
+- Problem: preserve exact formula/error semantics while publishing one complete
+  calculated generation after small edits
+- Outcome: `no_fit`
+- BogKit components considered: Fold, ESE, and ANNy
+- BogKit components used: Fold
+- Archive:
+  [`runs/2026-08-15--incremental-calculation-cache`](../runs/2026-08-15--incremental-calculation-cache)
+
+### Evidence
+
+- Quality commands:
+  - `cargo fmt --manifest-path developer-simulation/Cargo.toml --package financial-snapshot-trial -- --check`
+  - `cargo test --manifest-path developer-simulation/Cargo.toml --offline --locked --package financial-snapshot-trial --all-targets`
+  - `cargo clippy --manifest-path developer-simulation/Cargo.toml --offline --locked --package financial-snapshot-trial --all-targets -- -D warnings -D clippy::all -D clippy::pedantic`
+- Tests: 15 acceptance tests and one demo test pass. Permanent coverage
+  includes exact hand-derived range and formula-replacement results,
+  deterministic cycle and missing-reference errors, malformed journal records,
+  overflow, one-way initialization, exact authoritative-journal recovery,
+  reopen-and-continue equality, and complete-generation application reads.
+- Runnable demonstration: five clean logical builds and all five requested
+  chunk groupings agreed; twelve reader tasks completed 24,000 reads with zero
+  mixed generations. The one-way initialization and recovery-continuation
+  gates both report `Pass` while production-scale gates remain `NotRun`.
+- Bounded storage observation: the closed three-batch store occupied 7,570
+  bytes; a live store after 100 tiny full-state publications occupied
+  67,115,339 bytes. These local figures are not a million-cell estimate.
+- Baseline: all 18 Fold unit tests and nine Fold documentation tests pass. The
+  mature workbook evaluator, million-cell fixture, 10,000-batch trace, and
+  existing full-recalculation implementation were not present, so the trial
+  does not claim a production comparison.
+
+### Friction trail
+
+The public starter was evaluated first. Its source uses Fold, but its manifest
+also declares ESE and ANNy, so a clean offline build reached ESE's model-download
+script and failed before the demo launched. A Fold-only package then built
+offline and demonstrated one transaction for a generation marker and calculated
+cells plus one pinned read snapshot.
+
+The first implementation enumerated affected cells, validated journal records,
+and used Fold for atomic full-state publication. It still fully evaluated the
+tiny workbook and republished every cell after every accepted batch. The
+application's twelve-reader surface used a cloned immutable snapshot behind an
+adapter lock because the inspected Fold API did not expose an independently
+clonable reader alongside the exclusive writer.
+
+Initial skeptical review found that repeated bootstrap could rewind the
+sequence gate and that reopening persisted calculated state without restoring a
+prior formula edit made the next batch diverge from uninterrupted execution.
+The repaired lifecycle makes initialization one-way and permits resumed writes
+only after caller-owned journal replay reconstructs a workbook whose calculated
+snapshot exactly matches the persisted Fold snapshot.
+
+### Findings
+
+1. **Fold's useful boundary stops at bounded snapshot publication.** Category:
+   poor product fit. Severity: Important before and after review. Confidence:
+   high. Reproduction: run the package acceptance test
+   `range_dependency_recalculates_and_publishes_one_generation` and its demo;
+   they prove atomic read-back but also show full-state publication. Smallest
+   plausible improvement: document Fold as a persistence primitive in the
+   component/storage/concurrency matrix; add no workbook-specific API.
+2. **The retained adapter is not an incremental performance proof.** Category:
+   performance problem. Severity: Important before and after review.
+   Confidence: high. Reproduction: inspect `Outcome::recalculated` and
+   `Trial::apply` in `src/lib.rs` plus the
+   `range_dependency_recalculates_and_publishes_one_generation` test;
+   affected cells are enumerated while every cell is recalculated and
+   republished. Smallest plausible improvement: retain the honest full-state
+   label and benchmark a real incremental evaluator before making a performance
+   claim.
+3. **Direct reader and external-journal recovery boundaries remain.** Category:
+   missing capability. Severity: Important before and after review. Confidence:
+   high. Reproduction: run
+   `twelve_readers_never_observe_a_mixed_generation` and
+   `close_recover_and_continue_matches_uninterrupted_formula_trace`; both rely
+   on application-owned snapshot cloning or journal replay. Smallest plausible
+   improvement: keep these boundaries explicit in the existing capability
+   matrix; the evidence does not justify a new reader or recovery subsystem.
+4. **The all-components starter is not a minimal offline Fold introduction.**
+   Category: API friction. Severity: Important before and after review.
+   Confidence: high. Reproduction: follow the first-build command and error in
+   the archived `DISCOVERY.md`, then compare it with the Fold-only package's
+   offline quality commands. Smallest plausible improvement: provide or
+   document component-selective starter manifests so Fold-only evaluation does
+   not initialize ESE or ANNy.
+5. **Repeated initialization and incomplete restart reconstruction broke the
+   first prototype.** Category: correctness defect. Severity: Important before
+   repair; none after repair. Confidence: high. Reproduction: run
+   `bootstrap_twice_rejects_without_rewinding_visible_state`,
+   `open_on_existing_store_rejects_without_changing_persisted_state`, and
+   `close_recover_and_continue_matches_uninterrupted_formula_trace`. Smallest
+   plausible improvement: none; the prototype now enforces one-way
+   initialization and exact authoritative-journal recovery, and this did not
+   establish a BogKit defect.
+6. **Production qualification is absent.** Category: poor product fit.
+   Severity: Important before and after review. Confidence: high. Reproduction:
+   run the demo and inspect `result-manifest.json`; the production-scale gates
+   remain `NotRun`. Smallest plausible improvement: evaluate the production
+   oracle, scale, process-exit, corruption, disk-full, memory, and concurrency
+   gates before reconsidering adoption.
+
+### Decision audit
+
+The candidate deliberately leaves the append-only journal authoritative, uses
+Fold only for disposable calculated state, compares canonical logical bytes
+rather than database bytes, and requires exact journal replay before resumed
+writes. It treats ESE and ANNy as exactness no-fits. A normalized per-cell
+incremental evaluator, direct Fold readers, structural reference rewriting,
+production formula parity, and a representative storage/compaction strategy
+remain untested. Under the brief's all-gates rule, the bounded publication proof
+cannot justify continued adoption.
+
+## Trial 2 — Revision-safe aircraft-manual search
+
+- Persona: aircraft-maintenance tablet search maintainer with eleven years of
+  Kotlin and four months of Rust
+- Existing system: signed licensed packages, a separately validated canonical
+  parser, and SQLite full-text search followed by aircraft-applicability filtering
+- Problem: improve symptom/paraphrase retrieval without ever returning an
+  ineligible or superseded revision
+- Outcome: `no_fit`
+- BogKit components considered: Fold, ESE, and ANNy
+- BogKit components used: Fold for the real BM25 cutoff reproducer
+- Archive:
+  [`runs/2026-08-15--revision-safe-aircraft-manual-search`](../runs/2026-08-15--revision-safe-aircraft-manual-search)
+
+### Evidence
+
+- Quality commands:
+  - `cargo fmt --manifest-path developer-simulation/Cargo.toml --package revision-safe-manual-search-trial -- --check`
+  - `cargo test --manifest-path developer-simulation/Cargo.toml --offline --locked --package revision-safe-manual-search-trial --all-targets`
+  - `cargo clippy --manifest-path developer-simulation/Cargo.toml --offline --locked --package revision-safe-manual-search-trial --all-targets -- -D warnings -D clippy::all -D clippy::pedantic`
+- Tests: ten acceptance tests and one demo test pass. Coverage includes the real
+  Fold BM25 candidate cutoff, complete-fixture eligibility/effective-time
+  selection, duplicate document and ranked identity rejection, duplicate
+  revision and overlapping-active-revision rejection, unknown attributes,
+  missing metadata, deterministic ties, and metadata-order independence.
+- Runnable demonstration: twenty ineligible documents outrank the only eligible
+  document. Global top-20 then filtering returns zero; requesting the complete
+  21-match toy ranking and filtering before the final top ten returns the one
+  eligible revision with exact evidence
+  `AMM-32|32-40-21|R-21|1700000000..1800000000`.
+- Baseline comparison: this reproduces the generic bounded-candidate-before-
+  filter failure mechanism. The existing SQLite implementation and private 600-
+  query judged set were unavailable, so no SQLite relevance or performance
+  comparison is claimed.
+
+### Friction trail
+
+The public search material suggested Fold for consistent lexical/semantic
+views, ESE for local embeddings, and ANNy for nearest-neighbor candidates. The
+developer's pre-internals hypothesis identified query-specific eligibility as
+the decisive unknown. Source inspection confirmed that BM25 accepts only a
+query and limit, HNSW has a fixed top-K, and the pipeline filter is fixed at
+ingestion rather than supplied per query.
+
+ESE was not retained because a clean build fetches model and tokenizer assets
+from mutable URLs without verified checksums. The bounded Fold reproducer
+therefore tests only exact lexical cutoff behavior. Its deliberately exhaustive
+21-row selector is a correctness proof for the toy fixture, not a scalable
+solution for 2.4 million revisions.
+
+Initial review found that duplicate canonical document IDs were silently
+overwritten in row order and repeated ranked IDs could return duplicate exact
+evidence. The repaired boundary rejects both before selection and is invariant
+to valid metadata row order.
+
+### Findings
+
+1. **Bounded global retrieval followed by eligibility filtering loses valid
+   results.** Category: missing capability. Severity: Important before and after
+   review. Confidence: high. Reproduction: run
+   `bounded_top_twenty_then_filter_loses_the_lower_eligible_revision` and the
+   demo; real Fold top-20 returns no eligible row while the complete 21-row toy
+   ranking returns the eligible revision. Smallest plausible improvement:
+   document the cutoff limitation, then evaluate a narrow allowed-key or
+   predicate surface rather than a general search subsystem.
+2. **Validated replaceable generations and the required reader/updater topology
+   are absent.** Category: missing capability. Severity: Important before and
+   after review. Confidence: high. Reproduction: inspect `machine-report.json`; the
+   generation, crash, and concurrent-reader gates are recorded as unsupported
+   or unrun. Smallest plausible improvement: add these facts to the existing
+   storage/concurrency capability matrix; do not add a generation manager from
+   this trial alone.
+3. **ESE's first-build model boundary is not hermetic or adequately documented.**
+   Category: documentation gap. Severity: Important before and after review.
+   Confidence: high. Reproduction: follow the ESE first-build trace in the
+   archived `DISCOVERY.md`, which reaches mutable model and tokenizer URLs
+   without checksum verification. Smallest plausible improvement: document
+   model identity, language scope, cache, and first-build behavior, then pin
+   immutable assets and verify their checksums.
+4. **Duplicate metadata and ranked identities made the first selector
+   order-dependent.** Category: correctness defect. Severity: Important before
+   repair; none after repair. Confidence: high. Reproduction: run
+   `duplicate_metadata_doc_id_is_rejected_regardless_of_row_order`,
+   `duplicate_ranked_doc_id_fails_closed`, and
+   `unique_metadata_row_order_does_not_change_eligibility_or_evidence`.
+   Smallest plausible improvement: none; the prototype now rejects both
+   duplicate boundaries, and this did not establish a BogKit defect.
+5. **Production relevance and operational gates remain unrun.** Category: poor
+   product fit. Severity: Important before and after review. Confidence: high.
+   Reproduction: inspect `machine-report.json`; recall, latency, memory, disk, full
+   applicability, generation hashes, atomic activation, corruption, disk-full,
+   process exits, and sixteen-reader updates remain unmeasured. Smallest
+   plausible improvement: rerun the evaluation only with the private judged set
+   and the full operational fixtures.
+
+### Decision audit
+
+The no-fit decision rests on a hard eligibility boundary rather than semantic
+quality. The prototype uses Fold centrally for the exact failure reproducer,
+does not add ANNy or ESE merely to satisfy component coverage, and refuses to
+infer generation safety from single-store transaction atomicity. Filtered ANN,
+bitmap allow-lists, generation layout, model quality/licensing, and the full
+private benchmark remain uncertain. Any future evaluation must begin from an
+actual filtered-retrieval surface and the full safety fixtures.
+
+## Skeptical review
+
+- Initial verdicts: both `REJECTED_UNTIL_FIXED`; zero Critical, three Important,
+  and one Minor finding across the two prototypes.
+- The reviewer independently reproduced calculation restart divergence,
+  sequence rewind through repeated initialization, full-evaluation wording,
+  order-dependent duplicate document metadata, and duplicate ranked evidence.
+- One focused repair round by the original developers added permanent
+  regressions and corrected code, manifests, and documentation.
+- Fresh scoped re-review passed all affected independent probes, all 27 new
+  retained tests, formatting, strict pedantic Clippy, and both demonstrations.
+- Final verdicts: both `APPROVED_FOR_ARCHIVE_AFTER_FIXES`, with zero Critical,
+  Important, or Minor archive findings remaining.
+- No BogKit correctness defect was found. The two promoted candidates are
+  repeated capability/documentation signals, not defects or new subsystems.
+
+## Cross-run synthesis
+
+- Outcome totals: 38 trials — 34 `no_fit` and four
+  `local_proof_only_no_production_fit`; zero production adoptions.
+- Storage, durability, transaction, concurrency, and external-authority
+  boundaries: 32 independent trials, adding both of today's sources.
+- Component-selective setup: 16 independent trials, adding the calculation
+  trial's all-components starter failure.
+- Nameable pipeline/readers remains seven.
+- Query-time filtered search is promoted at two independent sources:
+  `support-case-finder` and `revision-safe-aircraft-manual-search`.
+- Hermetic ESE model assets are promoted at two independent sources using the
+  same pair of trials.
+- Caught Fold write-panic poisoning remains at two independent sources;
+  persisted-value codec panic remains at one. Neither was encountered today.
+- Positioning signal: Fold can atomically persist a disposable embedded view,
+  but it does not replace domain evaluators, external authority replay,
+  query-specific eligibility, generation lifecycle, or application-level
+  concurrency design.
+
+## Validation
+
+- New packages: 27 tests pass after archive normalization.
+- Formatting and strict pedantic Clippy pass for both new packages.
+- Runnable evidence: the calculation lifecycle/demo and exact Fold BM25 cutoff
+  demonstration pass from the normalized archive.
+- Nested lab workspace: one workspace and lockfile resolve both unique new
+  packages; no child workspace, lockfile, or package-local release profile is
+  retained.
+- BogKit root workspace: all 45 unit and documentation tests pass against
+  `80fd3c9a023e877fff2e5d127accca386d437af0`.
+- Archive checks cover JSON validity, diff whitespace, changed-path scope,
+  credentials and secret-like tokens, large/binary files, symlinks, child
+  workspace metadata, and generated build/database/runtime residue. Every
+  retained change is under `developer-simulation/`.
diff --git a/developer-simulation/reports/2026-08-16.md b/developer-simulation/reports/2026-08-16.md
new file mode 100644
index 0000000..afb103a
--- /dev/null
+++ b/developer-simulation/reports/2026-08-16.md
@@ -0,0 +1,311 @@
+# Developer simulation — 2026-08-16
+
+<!-- bogkit-developer-simulation:2026-08-16 -->
+
+Two blind developers worked from separate sanitized copies of current `main`.
+One evaluated causal history compaction for a collaborative canvas; the other
+evaluated offline verification and durable advancement for cryptographic
+transparency checkpoints. Both established the existing baseline first and
+reached evidence-backed `no_fit` decisions.
+
+A separate skeptical reviewer rejected both initial handoffs with three
+Critical and five Important prototype or evidence findings. The original
+developers repaired all eight findings test-first, and the same reviewer
+approved both stable snapshots after a scoped re-review with zero Critical,
+Important, or Minor findings remaining. No BogKit core or existing example
+changed.
+
+## Trial 1 — Causal canvas-history compaction
+
+- Persona: collaborative-canvas synchronization maintainer with seven years of
+  TypeScript and Go and nine months of Rust
+- Existing system: PostgreSQL operation authority plus a TypeScript reducer,
+  periodic full snapshots, 30-day retained operations, and bespoke compaction
+- Problem: reduce history and tombstones without changing causal semantics,
+  reconnect behavior, operation identity, or canonical JSON
+- Outcome: `no_fit`
+- BogKit components considered: Fold, ESE, and ANNy
+- BogKit components used: Fold only for a development-time arrival-order
+  characterization
+- Archive:
+  [`runs/2026-08-16--causal-canvas-compaction`](../runs/2026-08-16--causal-canvas-compaction)
+
+### Evidence
+
+- Quality commands:
+  - `cargo fmt --manifest-path developer-simulation/Cargo.toml --package causal-canvas-compaction -- --check`
+  - `cargo test --offline --locked --manifest-path developer-simulation/Cargo.toml --package causal-canvas-compaction --all-targets`
+  - `cargo clippy --offline --locked --manifest-path developer-simulation/Cargo.toml --package causal-canvas-compaction --all-targets -- -D warnings -D clippy::all -D clippy::pedantic`
+- Tests: 22 all-target tests pass. Permanent coverage includes causal
+  buffering, all six literal operation kinds, duplicate and conflicting
+  identity handling, tombstones, bounded input, deterministic batching,
+  compaction/reopen, complete-manifest integrity, and the in-process
+  publication returned-error model.
+- Reduced oracle: 1,000/1,000 scalar comparisons pass across 50 histories and
+  20 schedules, with stable digest `5a36a712...e8141`. The production
+  TypeScript reducer and canonical fixtures were unavailable, so this is not
+  production parity.
+- Representative release observation: 500,000 operations completed in 776 ms
+  with 343 microseconds p95 for a 200-operation batch and 440,688 KiB sampled
+  peak RSS. The required 5,000,000-operation run was not attempted because the
+  architecture still retains accepted history in memory.
+- Largest reduced shape: 40,000 objects and 20,000 list elements reopened in
+  69 ms, with 195,440 KiB sampled peak RSS and 12,529,568 compacted bytes.
+- Decisive gate: permanent operation fingerprints made the corrected retained
+  artifact 3,719/8,670 bytes, or 42.90%. That fails the brief's at-most-40%
+  requirement and strengthens the no-fit decision.
+
+### Friction trail
+
+The developer began from the public README and examples, then inspected the
+smallest Fold surface needed to test the hypothesis. Fold could atomically
+store ordinary keyed views, but the application still had to decide causal
+winners, preserve permanent operation identity, prove tombstone safety, and
+publish complete generations beside PostgreSQL. ESE and ANNy were unrelated to
+the exact replay workload.
+
+The first stable prototype appeared to reject conflicting identity reuse and
+validate generation data. Skeptical review showed that compaction discarded the
+only fingerprint for an old operation ID, and that semantic manifest metadata
+could be changed without touching the selected payload digests. The repair now
+retains SHA-256 fingerprints for every accepted operation ID and binds every
+canonical manifest byte with a separate SHA-256 file. The reviewer also found
+that the initial crash and disk-full language described only ordinary returned
+errors; the code and evidence now use that exact, narrower label.
+
+### Findings
+
+1. **The production semantic oracle is absent.** Category: documentation gap.
+   Severity: Critical for adoption before and after review. Confidence: high.
+   Reproduction: compare the acceptance rules in archived `BRIEF.md` with the
+   explicit missing TypeScript reducer and fixtures in `DISCOVERY.md` and the
+   package README. Smallest plausible improvement: supply an executable
+   production oracle and literal fixtures for every operation and conflict
+   boundary before another adoption evaluation.
+2. **Fold does not remove causal winner selection or tombstone proofs.**
+   Category: poor product fit. Severity: Important before and after review.
+   Confidence: high. Reproduction: run
+   `fold_keyed_materialization_is_arrival_ordered_without_a_causal_wrapper` in
+   `tests/fold_comparison.rs`. Smallest plausible improvement: keep causality
+   application-owned; reconsider only a non-authoritative downstream view.
+3. **Failure-aware consumers cannot handle several Fold storage and decode
+   boundaries as typed errors.** Category: API friction. Severity: Important
+   before and after review. Confidence: high. Reproduction: inspect
+   `fold/src/stream/unkeyed.rs`, `fold/src/stream/mod.rs`,
+   `fold/src/stream/keyed.rs`, and
+   `fold/src/pipeline/terminal/table.rs` for the open, commit, checkpoint,
+   keyspace, read, and decode `unwrap` paths, then run the package's Fold
+   characterization test. Smallest plausible
+   improvement: add documented fallible variants for existing open, keyspace,
+   read, decode, commit, and checkpoint boundaries while retaining convenience
+   wrappers where useful.
+4. **Compaction initially permitted conflicting operation-ID reuse.** Category:
+   correctness defect. Severity: Critical before repair; none after repair.
+   Confidence: high. Reproduction: run
+   `conflicting_operation_id_reuse_remains_rejected_after_compact_reopen` in
+   `tests/compaction.rs`; it proves exact rejection and unchanged visible
+   bytes, digest, and counter through compact, publish, and reopen. Smallest
+   plausible improvement: none; permanent canonical fingerprints now close the
+   prototype defect and are counted in the failing byte gate.
+5. **Manifest semantic metadata was initially unauthenticated.** Category:
+   correctness defect. Severity: Important before repair; none after repair.
+   Confidence: high. Reproduction: run
+   `changed_manifest_metadata_falls_back_or_fails` in `tests/publication.rs`.
+   Smallest plausible improvement: none; a separately stored digest now binds
+   all canonical manifest bytes before any field is trusted.
+6. **The initial publication-fault labels exceeded the evidence.** Category:
+   documentation gap. Severity: Important before repair; none after repair.
+   Confidence: high. Reproduction: run `tests/publication.rs` and inspect the
+   package README's “returned-error test is not a crash test” section. Smallest
+   plausible improvement: none; the archive now says exactly that it models an
+   ordinary in-process returned error and only parses crash-schedule JSON.
+7. **The retained-history design breaks the scale envelope.** Category:
+   performance problem. Severity: Critical before and after review. Confidence:
+   high. Reproduction: run the release `workload 500000` command and
+   `compaction_counts_permanent_identity_metadata_in_retained_byte_gate`.
+   Smallest plausible improvement: stream operations and externalize retained
+   history/fingerprints, then measure the full five-million-operation recipe
+   against the real oracle before reconsidering adoption.
+
+### Decision audit
+
+The baseline remains authoritative because only it has the actual production
+merge semantics. Fold would add a second durable store without replacing
+causal winner selection, safe collection, bounded ingress, or generation
+publication. The prototype's repaired identity guarantee also causes the
+retained-byte gate to fail. ESE and ANNy are exact workload no-fits. The next
+responsible step is shadow replay against recorded histories and the real
+TypeScript oracle, not a production read-path change.
+
+## Trial 2 — Transparency-checkpoint verifier
+
+- Persona: certificate-transparency monitor maintainer with eight years of Go
+  and security operations and four months of Rust
+- Existing system: a trusted Go verifier and SQLite transaction that advance a
+  signed checkpoint, raw proof, archive cursor, and decision together
+- Problem: make restart, proof diagnostics, and adversarial recovery easier to
+  test without weakening fail-closed cryptographic behavior
+- Outcome: `no_fit`
+- BogKit components considered: Fold, ESE, and ANNy
+- BogKit components used: none
+- Archive:
+  [`runs/2026-08-16--transparency-checkpoint-verifier`](../runs/2026-08-16--transparency-checkpoint-verifier)
+
+### Evidence
+
+- Quality commands:
+  - `cargo fmt --manifest-path developer-simulation/Cargo.toml --package transparency-checkpoint-verifier -- --check`
+  - `cargo test --offline --locked --manifest-path developer-simulation/Cargo.toml --package transparency-checkpoint-verifier --all-targets`
+  - `cargo clippy --offline --locked --manifest-path developer-simulation/Cargo.toml --package transparency-checkpoint-verifier --all-targets -- -D warnings -D clippy::all -D clippy::pedantic`
+- Tests: 27 all-target tests pass. Coverage includes bounded parsing, RFC 8032
+  Ed25519, RFC 6962-style Merkle known answers and bit flips, cursor rollback,
+  deterministic pending resolution, duplicate/equivocation handling, corrupt
+  generation reuse, checked snapshot resume, and generic returned errors after
+  nine completed publication stages.
+- Independent review: the reviewer also checked all 2,080 non-empty old/new
+  size pairs through 64 leaves against an independent Merkle oracle.
+- Synthetic release observation: 8,000,000 generated leaf hashes completed in
+  895 ms with root `6a0bc348...be0c` and 1,818,624-byte peak RSS. This does no
+  decompression, production archive parsing, signature corpus, or SQLite
+  recovery and is not comparable with the baseline's 45-minute restart.
+- Reduced verifier path: 10,000 parse/signature/proof/advance iterations had
+  21-microsecond p95 after warm-up. Durable publication is excluded.
+- Checked reopen: eight empty logs reopened in a reported 0 ms. The production
+  4,000-checkpoint corpus and Go/SQLite state were unavailable.
+
+### Friction trail
+
+The developer identified exact auditability, recoverable storage errors, and
+cursor/proof atomicity as the decisive boundaries. Fold's transactions were
+plausible, but several public convenience paths panic on storage or decode
+failures and the component does not expose the fault surface required by this
+security evaluation. ESE and ANNy were unrelated to cryptographic proof.
+
+The first stable state machine passed its supplied crypto and publication
+tests, but the reviewer found five lifecycle gaps: cursor rollback was accepted;
+a corrupt pre-existing generation could be republished as success; stale
+same-base candidates could remain pending and make bytes delivery-order
+dependent; reopened state could not resume verification; and three named
+failure modes were one generic returned-error model. Test-first repairs close
+all five while preserving the no-fit decision and explicit production gaps.
+
+### Findings
+
+1. **Production Go, SQLite, wire-format, key, and corpus parity is absent.**
+   Category: poor product fit. Severity: Critical for adoption before and after
+   review. Confidence: high. Reproduction: compare archived `BRIEF.md` with the
+   missing-artifact inventory in `DISCOVERY.md` and the package README's
+   evidence boundaries. Smallest plausible improvement: supply read-only
+   production fixtures and a Go decision-ledger export, then run shadow parity.
+2. **Fold's fallible storage and decode boundary is missing for this consumer.**
+   Category: API friction. Severity: Important before and after review.
+   Confidence: high. Reproduction: inspect `fold/src/stream/unkeyed.rs`,
+   `fold/src/stream/mod.rs`, `fold/src/stream/keyed.rs`, and
+   `fold/src/pipeline/terminal/table.rs`; their open, keyspace, read/decode,
+   commit, and checkpoint convenience paths use `unwrap` rather than typed
+   errors. Smallest plausible
+   improvement: add documented fallible variants for those existing boundaries
+   without creating a new security storage subsystem.
+3. **Archive-cursor rollback initially advanced visible state.** Category:
+   correctness defect. Severity: Critical before repair; none after repair.
+   Confidence: high. Reproduction: run
+   `archive_cursor_rollback_is_rejected_without_mutation` in `tests/engine.rs`;
+   it proves the full snapshot unchanged and a later valid advance succeeds.
+   Smallest plausible improvement: none; the prototype now rejects rollback
+   before mutation, while cursor-to-leaf correspondence remains unimplemented.
+4. **Republishing initially trusted a corrupt existing generation by name.**
+   Category: correctness defect. Severity: Critical before repair; none after
+   repair. Confidence: high. Reproduction: run
+   `republish_rejects_corrupt_existing_generation_and_preserves_current` in
+   `tests/store.rs`. Smallest plausible improvement: none; reuse now validates
+   the exact expected files, digests, and payload bytes before pointer mutation.
+5. **Pending candidates were initially stale and order-dependent.** Category:
+   correctness defect. Severity: Important before repair; none after repair.
+   Confidence: high. Reproduction: run
+   `same_base_candidates_are_all_decided_after_advance` and
+   `equal_key_pending_delivery_orders_have_identical_bytes` in
+   `tests/engine.rs`. Smallest plausible improvement: none; canonical envelope
+   identity now completes the order and every stale candidate is decided.
+6. **Reopened state initially could not resume verification.** Category:
+   missing capability. Severity: Important before repair; none after repair.
+   Confidence: high. Reproduction: run
+   `reopened_engine_continues_and_drains_pending_without_divergence` in
+   `tests/store.rs`. Smallest plausible improvement: none; checked snapshot
+   reconstruction now validates retained state and matches uninterrupted
+   continuation, with historical-proof limits disclosed.
+7. **Named process-exit, disk-full, and permission claims were one model.**
+   Category: documentation gap. Severity: Important before repair; none after
+   repair. Confidence: high. Reproduction: inspect the package README's generic
+   completed-stage returned-error section and run the five store tests.
+   Smallest plausible improvement: none; the archive now excludes child kill,
+   partial write, real OS errors, and power loss instead of naming them as
+   tested.
+
+### Decision audit
+
+The Go/SQLite baseline wins by default because the actual implementation and
+corpus were absent. The Rust package is a useful characterization of bounded
+parsing, Ed25519, small-tree consistency, deterministic decisions, and checked
+publication, but it cannot establish production format, key, archive, recovery,
+or migration parity. Fold's panic-oriented convenience boundary is unsuitable
+for the required fail-closed error handling; ESE and ANNy do not address exact
+cryptographic verification. No component should own advancement from this
+evidence.
+
+## Skeptical review
+
+- Claims reproduced: all 49 retained trial tests, both strict lint/format
+  gates, both release builds, both reduced demos, the 1,000-schedule scalar
+  oracle, the 2,080-pair small-tree oracle, and all eight permanent fix-round
+  regressions.
+- Claims rejected or softened: production semantic/parity claims, the full
+  five-million-operation and production-corpus gates, process-crash and named
+  I/O-failure claims, and comparisons between reduced synthetic timings and
+  either production baseline.
+- Initial findings: three Critical and five Important prototype/evidence
+  defects. All were repaired by the original simulators and closed by the same
+  reviewer. Remaining findings: zero Critical, zero Important, zero Minor.
+- Unnecessary dependencies: neither trial retained ESE or ANNy; Trial 1 keeps
+  Fold only as a development-time characterization, and Trial 2 uses no BogKit
+  dependency.
+- Remaining uncertainty: actual production reducers, formats, keys, corpora,
+  operating systems, process exits, I/O failures, power loss, and migration
+  paths remain untested.
+
+## Cross-run synthesis
+
+- New evidence: both trials independently found that failure-aware consumers
+  cannot handle several Fold storage and decode failures as typed errors. This
+  promotes `fold-fallible-storage-and-decode-apis` at two sources.
+- Recurring evidence: both trials retain an external authority and require
+  application-owned causal, cryptographic, and publication semantics. The
+  storage/concurrency boundary theme rises from 32 to 34 sources.
+- Confirmed defects: unchanged. Caught Fold write-transaction panic poisoning
+  remains at two sources; the persisted-value codec panic remains at one.
+- Candidate improvement: add documented fallible variants for existing Fold
+  open, keyspace, read/decode, commit, and checkpoint boundaries. Keep this
+  separate from the one-source codec correctness defect.
+- Observations not promoted: the trials requested fault injection at different
+  layers, so no shared fault-injection feature is inferred. They do not justify
+  a generation manager, canvas API, cryptographic subsystem, archive codec, or
+  SQLite replacement.
+- Positioning signal: BogKit remains strongest where embedded materialization,
+  text embeddings, or approximate search remove meaningful application work.
+  It is a poor fit when the application must retain an external authority and
+  still own exact causal or cryptographic semantics plus publication recovery.
+
+## Validation
+
+- Trial-specific tests: 22 causal-canvas tests and 27 transparency-verifier
+  tests passed from the normalized nested workspace.
+- Strict lint and formatting: both new packages passed formatting and strict
+  pedantic Clippy; the full nested workspace passed warnings-denied Clippy.
+  A stronger full-workspace pedantic pass is not claimed because Rust 1.95
+  reports pre-existing pedantic lint drift in older archived packages.
+- Runnable demonstrations: both reduced release demos reproduced the retained
+  deterministic outputs and honestly scoped measurements.
+- BogKit root workspace: all 45 unit and documentation tests passed against
+  merged `main` commit `98875446c6b9f6ae242666978e8699751935d64c`.
+- Archive checks: one nested lockfile, unique package names, no child workspace
+  or lockfile, all changed paths under `developer-simulation/`, and no retained
+  secrets, databases, build output, runtime state, symlinks, or large binaries.
diff --git a/developer-simulation/reports/2026-08-17.md b/developer-simulation/reports/2026-08-17.md
new file mode 100644
index 0000000..f73669a
--- /dev/null
+++ b/developer-simulation/reports/2026-08-17.md
@@ -0,0 +1,266 @@
+# Developer simulation — 2026-08-17
+
+<!-- bogkit-developer-simulation:2026-08-17 -->
+
+Two blind developers worked from separate sanitized copies of current `main`.
+One evaluated corruption recovery for a binary instrument stream; the other
+evaluated mergeable approximate reach rollups. Both established their existing
+baseline first, considered Fold, ESE, and ANNy, used none, and reached
+evidence-backed `no_fit` decisions.
+
+A separate skeptical reviewer rejected both initial handoffs with five
+Important prototype or report findings. The original developers repaired or
+honestly narrowed all five test-first. The first repair to Trial 1 introduced
+one further Important correctness defect; the same reviewer reproduced it, the
+developer repaired it, and a second scoped review closed it. Both final
+handoffs were approved with zero Critical, Important, or Minor reviewer
+findings remaining. No BogKit core or existing example changed.
+
+## Trial 1 — Corruption-resynchronizing instrument stream decoder
+
+- Persona: laboratory gateway developer with nine years of C and C++, the Rust
+  Book, and two small Rust command-line tools
+- Existing system: one append buffer per connection, then a scan for framed
+  records or a connection-wide reset after corruption
+- Problem: decode exact marker/length/CRC frames from arbitrary chunks, keep
+  memory bounded, and recover valid followers without leaking payload bytes
+- Outcome: `no_fit`
+- BogKit components considered: Fold, ESE, and ANNy
+- BogKit components used: none
+- Archive:
+  [`runs/2026-08-17--corruption-resynchronizing-instrument-stream-decoder`](../runs/2026-08-17--corruption-resynchronizing-instrument-stream-decoder)
+
+### Evidence
+
+- Quality commands:
+  - `cargo fmt --manifest-path developer-simulation/Cargo.toml --package instrument-decoder-trial -- --check`
+  - `cargo test --locked --manifest-path developer-simulation/Cargo.toml --package instrument-decoder-trial --all-targets`
+  - `cargo clippy --locked --manifest-path developer-simulation/Cargo.toml --package instrument-decoder-trial --all-targets --all-features -- -D warnings -D clippy::all -D clippy::pedantic`
+- Tests: 19 retained tests pass. They cover the CRC known answer, exact wire
+  layout, all single-byte split points, bounded over-limit rejection, marker
+  and CRC corruption, the modeled baseline, deterministic schedules,
+  arbitrary-byte stress, and both sides of the ambiguous nested-frame prefix.
+- Full clean run: whole-frame, one-byte, and irregular schedules each emitted
+  1,000,000/1,000,000 frames over 387,200,000 bytes with tuple digest
+  `0x227BAFFB59534865`, trace digest `0xED1C4875E1055725`, and zero diagnostics.
+- Decisive damaged run: all schedules processed 25,000 corruptions, emitted no
+  damaged frame, and recorded only 48,942/50,000 followers by their own frame
+  end. This is an explicit failure of the brief's immediate-recovery gate, not
+  an independently counted total of followers that never appear later.
+- Boundedness and performance: the 100,000-case arbitrary-byte run retained at
+  most 8,175 bytes and buffered at most 8,192; fresh peak RSS was 6,144,000
+  bytes. In the fixed-chunk parser comparison, the slower baseline was 126.388
+  MiB/s and the candidate 135.002 MiB/s. These host observations do not offset
+  the failed correctness requirement.
+
+### Friction trail
+
+The developer began with the root README and public examples. Fold's durable
+stream and transaction model was unrelated to a synchronous no-disk framing
+path; ESE and ANNy were also exact workload no-fits. A standalone parser first
+passed clean and boundedness checks but waited behind a plausible, incomplete
+header. The first repair scanned inside that candidate and emitted a later
+CRC-valid sequence immediately. Skeptical review then supplied a clean outer
+frame whose opaque payload contained an entire valid-looking inner frame: the
+one-byte schedule emitted the inner sequence and lost the outer frame.
+
+The final conservative implementation never scans inside an incomplete
+accepted-length candidate. It preserves the clean outer frame, but the exact
+`02 00 13` false-header case cannot emit its first valid follower immediately.
+The two byte prefixes are indistinguishable until later bytes arrive, so the
+prototype and all three BogKit components are correctly classified `no_fit`
+against the complete brief.
+
+### Findings
+
+1. **The wire format cannot guarantee both opaque payloads and unconditional
+   immediate recovery.** Category: missing capability. Severity: Important
+   before and after review. Confidence: high. Reproduction: run
+   `candidate_never_emits_valid_nested_payload_before_outer_is_proved` and
+   `candidate_defers_nested_followers_until_plausible_header_fails`, then read
+   the incompatible prefixes in archived `TRIAL_REPORT.md`. Smallest plausible
+   improvement: add an unambiguous boundary such as escaping or trusted record
+   segmentation, or relax recovery until the containing candidate resolves.
+2. **Opportunistic nested emission initially corrupted a clean opaque frame.**
+   Category: correctness defect. Severity: Important before repair; none after
+   repair. Confidence: high. Reproduction: run
+   `candidate_never_emits_valid_nested_payload_before_outer_is_proved`; whole
+   and one-byte schedules now emit only outer sequence 42. Smallest plausible
+   improvement: none; the decoder now waits for the containing frame and keeps
+   the permanent regression.
+3. **The modeled connection reset loses already-buffered valid data.** Category:
+   correctness defect. Severity: Important before and after review. Confidence:
+   high. Reproduction: run the release `demo` described in `README.md`; the
+   modeled baseline clears a damaged frame and its valid follower. Smallest
+   plausible improvement: replace connection-wide reset with incremental
+   validation and an explicit conservative recovery boundary.
+4. **BogKit does not simplify synchronous exact framing.** Category: poor
+   product fit. Severity: Important before and after review. Confidence: high.
+   Reproduction: compare the brief's no-disk byte path with Fold's persistent
+   stream, ESE's text embeddings, and ANNy's approximate vector search in
+   `DISCOVERY.md`. Smallest plausible improvement: keep framing standalone and
+   consider Fold only for an optional downstream stream of validated,
+   privacy-safe diagnostics.
+5. **The root onboarding leaves the valid use-none path implicit.** Category:
+   documentation gap. Severity: Minor before and after review. Confidence:
+   high. Reproduction: start from the root README with the archived binary
+   framing brief and compare the component descriptions with `DISCOVERY.md`.
+   Smallest plausible improvement: extend the existing capability-matrix
+   candidate with explicit exact synchronous protocol and no-fit examples.
+
+### Decision audit
+
+The conservative parser was chosen over opportunistic resynchronization because
+clean opaque payload semantics are provable while early nested emission is not.
+The append/search reset remains only a modeled baseline; production gateway
+code and instrument captures were unavailable. The full synthetic and property
+runs establish the stated generated cases and memory bounds, not production
+readiness. The prototype is retained as an executable incompatibility and
+recovery reproducer, not as an adoption candidate.
+
+## Trial 2 — Mergeable unique-installation reach rollups
+
+- Persona: analytics-infrastructure engineer at a business-software company
+  with eight years of Kotlin and SQL and four months of Rust
+- Existing system: exact per-bucket hash sets merged centrally for an immutable
+  daily report
+- Problem: estimate unique installations across eight shards with bounded,
+  portable state and measurable accuracy, determinism, memory, and runtime
+- Outcome: `no_fit`
+- BogKit components considered: Fold, ESE, and ANNy
+- BogKit components used: none
+- Archive:
+  [`runs/2026-08-17--mergeable-unique-installation-reach-rollups`](../runs/2026-08-17--mergeable-unique-installation-reach-rollups)
+
+### Evidence
+
+- Quality commands:
+  - `cargo fmt --manifest-path developer-simulation/Cargo.toml --package reach-rollup-lab -- --check`
+  - `cargo test --locked --manifest-path developer-simulation/Cargo.toml --package reach-rollup-lab --release --all-targets --all-features`
+  - `cargo clippy --locked --manifest-path developer-simulation/Cargo.toml --package reach-rollup-lab --all-targets --all-features -- -D warnings -D clippy::all -D clippy::pedantic`
+- Tests: 21 tests pass and one benchmark wrapper remains intentionally ignored
+  in the ordinary suite. Coverage includes exact-oracle comparison, 50 merge
+  orders, duplicates and self-merge, complete state-file integrity, malformed
+  input, safe report publication, and deterministic output.
+- Accuracy: the disclosed tuning matrix recorded 0.858% median, 2.671% p95,
+  and 5.626% worst absolute error. A fixed held-out seed not used for further
+  tuning recorded 0.858%, 2.708%, and 6.124%.
+- Full load: 12,000,000 records produced 10,800,000 exact unique
+  bucket-occurrences and 5,760 canonical rows. Direct aggregation, eight-shard
+  aggregation, 50 merge orders, duplicate replay, and repeated state/report
+  bytes agree; corrected state digest is `ecda69b5ba1467d1`.
+- Normalized-workspace host comparison: after one earlier warm-up, three exact
+  runs took 1.03, 1.09, and 1.06 seconds, while three candidate runs took 0.54,
+  0.53, and 0.53 seconds. A separate current-profile measurement recorded
+  49,594,368-byte candidate peak RSS versus 645,136,384 bytes for exact, more
+  than 13 times lower. Both paths were single-threaded, but the host had 14
+  cores and the 128 MiB ceiling was measured rather than container-enforced.
+
+### Friction trail
+
+The exact hash-set baseline established correctness first. A 4,096-register,
+4,124-byte HyperLogLog-style state then passed merge, state-size, and
+determinism tests. The requested tuning matrix narrowly failed p95 before the
+estimator transition was changed; that matrix is therefore labeled tuning
+evidence, and a separate fixed seed is retained as held-out evidence.
+
+The first state-file format checksummed each nested sketch but did not bind the
+outer tenant/hour key. Skeptical review changed one valid tenant or hour into
+another and the decoder accepted the reassigned state. Version 2 now checksums
+the complete header, count, every key, and every nested state before
+constructing a rollup. The reviewer also corrected the component analysis:
+Fold's positive-only aggregate can express local HLL updates, but the public
+surface does not demonstrate the required portable external partial-state merge
+and adds persistence and transactions that this immutable batch does not need.
+
+### Findings
+
+1. **The first state format did not bind keys to states.** Category:
+   correctness defect. Severity: Important before repair; none after repair.
+   Confidence: high. Reproduction: run the valid-window tenant and hour
+   mutation regressions in `tests/state_file.rs`; version 2 rejects both before
+   returning a rollup. Smallest plausible improvement: none; the versioned
+   complete-file checksum and permanent regressions close the prototype defect.
+2. **BogKit does not demonstrate the required portable external shard merge.**
+   Category: poor product fit. Severity: Important before and after review.
+   Confidence: high. Reproduction: run the eight-shard and 50-order tests, then
+   compare their portable register-wise merge boundary with the public Fold
+   entry points described in `DISCOVERY.md`. Smallest plausible improvement:
+   keep this proof standalone; do not infer a new merge subsystem from one
+   trial.
+3. **Public onboarding does not state external partial-state merge support.**
+   Category: documentation gap. Severity: Important before and after review.
+   Confidence: high. Reproduction: start from the root README and public
+   starter/timeseries examples, then compare them with the exact external merge
+   exercised by `tests/load_contract.rs`. Smallest plausible improvement:
+   extend the existing capability matrix to state append-only aggregation,
+   retraction, portable serialization, external merge, and state-bound support.
+
+### Decision audit
+
+The standalone sketch is acceptable only for the brief's advisory immutable
+daily report; it is not exact and must not be used for billing, access, fraud,
+quotas, privacy, or contracts. Fold was rejected because portable shard-state
+exchange remains application-owned and the batch proof needs no durable store.
+The held-out run uses a different fixed seed from the same generator family,
+not a production distribution or independently preregistered study. OS-level
+power loss, real filesystem errors, skewed production identifiers, and the
+target four-core container remain untested.
+
+## Skeptical review
+
+- Claims reproduced: all 19 Trial 1 tests, 21 Trial 2 tests, two independent
+  parser probes, valid-range state-key mutation probes, both strict lint and
+  formatting gates, full clean/damaged decoder evidence, the 12-million-record
+  load, accuracy files, deterministic merge orders, host RSS, and both
+  comparisons.
+- Claims rejected or softened: universal immediate follower recovery,
+  opportunistic scanning inside opaque payload, the initial unbound state-file
+  checksum, the claim that Fold cannot express positive-only HLL updates, and
+  outcome/finding labels that exceeded the policy.
+- Initial findings: zero Critical, five Important, and zero Minor. The first
+  Trial 1 repair introduced one further Important correctness defect. All six
+  were repaired or explicitly converted into the honest no-fit boundary and
+  closed by the same reviewer. Remaining reviewer findings: zero Critical,
+  zero Important, zero Minor.
+- Unnecessary dependencies: neither trial retains Fold, ESE, ANNy, or any
+  third-party dependency.
+- Remaining uncertainty: real instrument traffic, production gateway behavior,
+  independent statistical distributions, target containers, enforced memory
+  caps, and power-loss durability remain untested.
+
+## Cross-run synthesis
+
+- New evidence: no new BogKit correctness defect or candidate crossed the
+  promotion threshold.
+- Recurring evidence: both trials are exact bounded transformations whose key
+  semantics remain outside durable materialization. The existing
+  storage/concurrency-boundary theme rises from 34 to 36 sources and now
+  includes exact binary framing and externally mergeable immutable rollups.
+- Candidate improvements: the existing capability-matrix candidate should
+  state protocol hot-path, portable accumulator, and explicit no-fit
+  boundaries. No new decoder, HLL, external-merge, Fold-batching, publisher,
+  CRC, or generic use-none subsystem is justified.
+- Observations not promoted: a positive-only Fold aggregate can represent the
+  local HLL update, but external state exchange and transaction sizing are
+  one-source observations. The decoder's wire ambiguity is protocol-specific.
+- Positioning signal: BogKit is useful when embedded materialization, text
+  embedding, or approximate search removes meaningful application work. It is
+  a poor fit for exact synchronous parsing or a small immutable batch whose
+  decisive portable merge stays application-owned.
+
+## Validation
+
+- Trial-specific tests: 19 decoder tests and 21 rollup tests passed from the
+  normalized nested workspace; the rollup benchmark wrapper remains explicitly
+  ignored in the ordinary suite and was run separately.
+- Strict lint and formatting: both new packages passed formatting and strict
+  pedantic Clippy. The full nested workspace passed warnings-denied Clippy.
+- Runnable demonstrations: the decoder demo/property/benchmark and the rollup
+  demo/load/comparison reproduced their retained deterministic evidence.
+- BogKit root workspace: all 45 unit and documentation tests passed against
+  merged current-main commit `20f2ca50d5d06f51edfe8b8570c0fb48caf9eb81`.
+- Archive checks: one nested lockfile, 42 unique package names, no child
+  workspace or lockfile, all changed paths under `developer-simulation/`, and
+  no retained secrets, databases, build output, runtime state, symlinks, or
+  large binaries.
diff --git a/developer-simulation/reports/2026-08-18.md b/developer-simulation/reports/2026-08-18.md
new file mode 100644
index 0000000..7b36993
--- /dev/null
+++ b/developer-simulation/reports/2026-08-18.md
@@ -0,0 +1,281 @@
+# Developer simulation — 2026-08-18
+
+<!-- bogkit-developer-simulation:2026-08-18 -->
+
+Two blind developers worked from separate sanitized copies of current
+`main`. One evaluated exact laboratory-unit conversion admission; the other
+evaluated deterministic freight-capacity batch clearing. Both established
+their existing baseline first, considered Fold, ESE, and ANNy, used none, and
+reached evidence-backed `no_fit` decisions.
+
+A separate skeptical reviewer rejected each initial handoff with four
+Important and one Minor prototype or report finding. The original developers
+repaired all ten findings test-first. Scoped re-review approved both repaired
+snapshots for archive with zero Critical, Important, or Minor reviewer
+discrepancies remaining. Trial 1 separately retains one honest Important
+performance finding because its million-row macOS run exceeded the 256 MiB
+gate. No BogKit core or existing example changed.
+
+## Trial 1 — Exact laboratory-unit conversion admission gate
+
+- Persona: healthcare-interface developer with eight years of Java and SQL and
+  four months of Rust
+- Existing system: authoritative PostgreSQL reference tables and a Java 17
+  conversion service, with a drifting Node.js advisory preflight
+- Problem: validate an immutable reference snapshot, apply exact rational
+  affine conversions with one round-half-to-even step, reject unsafe rows, and
+  atomically publish a canonical preview
+- Outcome: `no_fit`
+- BogKit components considered: Fold, ESE, and ANNy
+- BogKit components used: none
+- Archive:
+  [`runs/2026-08-18--laboratory-unit-conversion-gate`](../runs/2026-08-18--laboratory-unit-conversion-gate)
+
+### Evidence
+
+- Normalized quality commands:
+  - `cargo test --offline --locked --manifest-path developer-simulation/Cargo.toml --package lab-unit-gate --all-targets`
+  - `cargo fmt --manifest-path developer-simulation/Cargo.toml --package lab-unit-gate -- --check`
+  - `cargo clippy --offline --locked --manifest-path developer-simulation/Cargo.toml --package lab-unit-gate --all-targets --all-features -- -D warnings -D clippy::all -D clippy::pedantic`
+- Tests: 20 retained tests pass. They cover exact decimal parsing, positive and
+  negative half-even boundaries, 20,000 independent slow-reference arithmetic
+  comparisons, bounded lines, reference validation, canonical sorting,
+  duplicate IDs, alias identities, relative publication, explicit
+  pre/post-rename state, deterministic shuffles, and the real CLI.
+- Full synthetic shape: five one-million-row shuffles and three repeats each
+  produced 975,000 conversions, 25,000 rejections, a 93,065,000-byte report,
+  and SHA-256
+  `b9c8adf790c0717818cdaaeb83d5bbb612aa3780eb60e4eba3d97732c1446eb5`.
+- Independent reviewer observation: a fresh full run took 1.17 seconds and
+  290,521,088 bytes maximum resident memory on macOS. The memory result is
+  22,085,632 bytes above 256 MiB, so the resource gate fails on this host.
+- Normalized runnable demo: 10,000 rows produced 9,750 conversions and 250
+  rejections with digest
+  `256be30a4b0845bb13d4e999587042cdd60f9c6512f2ffc1e8da8a54379b71a0`.
+  Machine output says `run_status:"complete"` and
+  `acceptance:"unverified"`, never acceptance pass.
+
+### Friction trail
+
+The developer began with the root README and public examples. Fold's durable
+incremental state did not remove exact decimal grammar, checked rational
+arithmetic, full reference validation, duplicate detection, canonical sorting,
+or atomic file publication. ESE and ANNy were unrelated to exact numeric
+conversion. A standalone safe-Rust batch therefore became the baseline and
+candidate.
+
+Initial tests proved the numeric core, but review found that the report path
+could alias and replace an immutable input, a bare relative path returned an
+error after publication, and the benchmark printed `pass` despite a measured
+memory failure and missing authority. Review also rejected sixty duplicate
+parser fixtures and the classification of absent Java/Linux evidence as a
+product capability. The repaired boundary rejects direct, resolved, hard-link,
+and sibling-temporary aliases; opens the parent directory before rename;
+distinguishes post-rename durability uncertainty; separates completion from
+acceptance; and retains one meaningful negative fixture.
+
+### Findings
+
+1. **The million-row candidate exceeds the 256 MiB gate.** Category:
+   performance problem. Prior severity: Important. Current severity:
+   Important. Confidence: high. Reproduction: run the full-shape commands in
+   archived `README.md` under `/usr/bin/time -l`; the reviewer measured
+   290,521,088 bytes. Smallest plausible improvement: replace in-memory report
+   sorting and duplicate retention with a bounded external merge that detects
+   duplicates before final publication.
+2. **The original output path could overwrite an immutable input.** Category:
+   correctness defect. Prior severity: Important. Current severity: None.
+   Confidence: high. Reproduction: run
+   `output_cannot_alias_observations_or_a_resolved_reference_path` and
+   `existing_output_identity_and_temporary_aliases_are_rejected` in
+   `tests/gate.rs`. Smallest plausible improvement: none; resolved-path,
+   existing-file-identity, and sibling-temporary guards plus regressions are
+   retained.
+3. **The original relative path reported failure after publication.**
+   Category: correctness defect. Prior severity: Important. Current severity:
+   None. Confidence: high. Reproduction: run
+   `relative_output_path_publishes_successfully` and
+   `post_rename_uncertainty_is_distinct_from_prepublication_failure`.
+   Smallest plausible improvement: none; `.` normalization, an early retained
+   directory handle, and distinct lifecycle states are implemented.
+4. **The original benchmark false-passed failed or missing gates.** Category:
+   correctness defect. Prior severity: Important. Current severity: None.
+   Confidence: high. Reproduction: run
+   `measured_over_limit_memory_can_never_emit_acceptance_pass` and inspect the
+   demo JSON. Smallest plausible improvement: none; completion and acceptance
+   are separate and missing authorities force `unverified`.
+5. **BogKit does not simplify this exact immutable conversion batch.**
+   Category: poor product fit. Prior severity: Important. Current severity:
+   Important. Confidence: high. Reproduction: compare the brief's exact
+   file-to-file boundary with the component assessment in `DISCOVERY.md`.
+   Smallest plausible improvement: keep the converter standalone and extend
+   the existing capability matrix with exact numeric admission and no-component
+   examples.
+
+### Decision audit
+
+The prototype parses decimals without binary floating point and rounds only
+once. It preserves an external Java/PostgreSQL authority and is not a clinical
+decision system. In-memory canonical sorting was retained as the smallest
+inspectable proof even after the measured memory failure; this makes the
+`no_fit` result stronger rather than authorizing adoption. Output-alias races
+after preflight, process kills, disk-full behavior, power loss, real clinical
+data, signed fixtures, authoritative reason codes, the Java evaluator, and the
+declared Linux host remain outside the evidence.
+
+## Trial 2 — Deterministic freight-capacity batch clearing
+
+- Persona: freight-marketplace backend developer with six years of Ruby and
+  PostgreSQL and five months of Rust
+- Existing system: a Ruby worker clears immutable PostgreSQL snapshots into an
+  advisory operator proposal
+- Problem: apply exact price-time priority, conserve integer quantities and
+  checked gross value, ignore input order, and atomically publish one canonical
+  proposal
+- Outcome: `no_fit`
+- BogKit components considered: Fold, ESE, and ANNy
+- BogKit components used: none
+- Archive:
+  [`runs/2026-08-18--freight-capacity-batch-clearing`](../runs/2026-08-18--freight-capacity-batch-clearing)
+
+### Evidence
+
+- Normalized quality commands:
+  - `cargo test --offline --locked --manifest-path developer-simulation/Cargo.toml --package freight-clearing --all-targets`
+  - `cargo fmt --manifest-path developer-simulation/Cargo.toml --package freight-clearing -- --check`
+  - `cargo clippy --offline --locked --manifest-path developer-simulation/Cargo.toml --package freight-clearing --all-targets --all-features -- -D warnings -D clippy::all -D clippy::pedantic`
+- Tests: 33 retained integration tests pass. They include 40 literal golden
+  markets, 10,000 fixed-seed markets compared fill-for-fill with an independent
+  scanner, ordering/conservation/extrema checks, bounded input, required
+  manifest integrity, alias identities, explicit publication state, shuffles,
+  and the real CLI.
+- Full synthetic shape: all ten 650,000-order shuffles and three repeats
+  produced 498,521 fills, checked gross value
+  `312220517981477594`, an 80,960,196-byte proposal, and SHA-256
+  `e7ce11984ca3e04197df9dd43013361b123e5ecf4b877f3a36f0a08dd64ebcad`.
+- Independent reviewer observation: a fresh full run took 0.97 seconds and
+  481,558,528 bytes maximum resident memory on macOS, below 512 MiB on this
+  host. This is not the declared two-core Linux or Ruby comparison.
+- Normalized runnable demo: 6,500 orders in 50 markets produced 4,967 fills,
+  checked gross value `3075163243940483`, an 806,647-byte proposal, and
+  SHA-256
+  `d24a6f1898c9ea72b069ff4a3bf2e6a0d3d8de290449609d6e05377db1740cd3`.
+
+### Friction trail
+
+The exact Ruby specification established the ordering and conservation
+baseline. Fold would add persistent state to an immutable batch while leaving
+validation, sorting, matching, checked arithmetic, and file publication custom;
+ESE and ANNy were unrelated. The standalone matcher initially retained a
+duplicate global proposal while validating and exceeded 512 MiB. Market-at-a-
+time validation reduced host RSS below that threshold without changing bytes.
+
+Skeptical review then found that the proposal could overwrite either immutable
+input, relative publication returned failure after rename, the 4 KiB line limit
+was enforced only after buffering a one-MiB line, and required digest/gross
+integrity fields were optional. The repaired boundary rejects direct,
+resolved, and hard-link aliases; retains the parent directory handle; exposes
+pre-rename versus post-rename state; stops after 4,097 consumed bytes; and
+requires both manifest integrity fields before parsing or publication.
+
+### Findings
+
+1. **The original proposal path could overwrite an immutable input.**
+   Category: correctness defect. Prior severity: Important. Current severity:
+   None. Confidence: high. Reproduction: run the three alias tests in
+   `tests/reviewer_repairs.rs`; both source digests remain unchanged.
+   Smallest plausible improvement: none; resolved-path and existing-file-
+   identity rejection is retained at the run boundary.
+2. **The original relative proposal reported failure after publication.**
+   Category: correctness defect. Prior severity: Important. Current severity:
+   None. Confidence: high. Reproduction: run the relative, pre-rename, and
+   post-rename tests in `tests/reviewer_repairs.rs`. Smallest plausible
+   improvement: none; `.` normalization, an early retained directory handle,
+   and explicit `NotPublished` versus
+   `PublishedDurabilityUncertain` states are implemented.
+3. **The original line limit followed unbounded buffering.** Category:
+   performance problem. Prior severity: Important. Current severity: None.
+   Confidence: high. Reproduction: run
+   `one_mib_overlong_line_is_rejected_without_consuming_beyond_the_bound`;
+   rejection occurs after at most 4,097 bytes. Smallest plausible improvement:
+   none; the bounded `fill_buf` reader and regression are retained.
+4. **The original evidence boundary accepted missing integrity fields.**
+   Category: correctness defect. Prior severity: Important. Current severity:
+   None. Confidence: high. Reproduction: run the six missing, null, short, and
+   nonhex integrity tests in `tests/reviewer_repairs.rs`. Smallest plausible
+   improvement: none; the CLI requires a valid 64-hex order digest and expected
+   checked gross value.
+5. **BogKit does not simplify exact one-shot market clearing.** Category:
+   poor product fit. Prior severity: Important. Current severity: Important.
+   Confidence: high. Reproduction: compare the brief's immutable price-time
+   pass with `DISCOVERY.md` and the retained ordinary ordered-collection
+   implementation. Smallest plausible improvement: keep the matcher standalone
+   and state this batch/no-component boundary in the existing capability
+   matrix.
+
+### Decision audit
+
+The exact seller-ask matcher was chosen over an alternative auction design
+because the signed product specification fixes price-time behavior. The
+proposal remains advisory; it does not book, reserve, charge, notify, or write
+to PostgreSQL. Market-at-a-time validation fixes the candidate's duplicated
+proposal memory without changing canonical output. The production Ruby
+evaluator, authoritative output, three same-host Ruby timings, supplied
+negative corpus, declared Linux runner, process kills, disk-full, power loss,
+and concurrent hostile path replacement remain untested.
+
+## Skeptical review
+
+- Initial verdicts: both `REJECTED_UNTIL_FIXED`, each with zero Critical,
+  four Important, and one Minor finding.
+- Claims reproduced: exact arithmetic and half-even behavior; slow-reference
+  comparisons; ordering, seller-ask pricing, conservation, and checked gross
+  value; full deterministic shapes; host RSS; and all alias, publication,
+  bounded-line, and integrity failures.
+- Claims rejected or softened: Trial 1's acceptance pass and missing-authority
+  capability finding; Trial 2's unbounded line claim and optional integrity;
+  supplied-corpus implications; target-host, Java, Ruby, and production
+  conclusions.
+- Repair-round verdicts: both `APPROVED_FOR_ARCHIVE`; all eight Important and
+  two Minor review findings were fixed with zero reviewer discrepancies
+  remaining.
+- Unnecessary code or dependencies: Trial 1's sixty duplicate fixtures were
+  reduced to one named case. Neither archive retains Fold, ESE, ANNy, a
+  database, or an unjustified component.
+- Remaining uncertainty: authoritative Java/Ruby behavior, signed fixtures,
+  target Linux machines, cross-language performance, process termination,
+  actual I/O failures, and power-loss durability remain unverified.
+
+## Cross-run synthesis
+
+- New evidence: no new BogKit correctness defect or candidate crossed the
+  promotion threshold.
+- Recurring evidence: both trials are exact immutable file transforms whose
+  domain semantics and publication remain application-owned. The existing
+  storage/concurrency-boundary theme rises from 36 to 38 sources.
+- Candidate improvements: the existing capability matrix should state exact
+  numeric admission, deterministic batch clearing, and explicit no-component
+  boundaries. No decimal engine, unit system, market-clearing engine, generic
+  publisher, manifest service, or bounded-line subsystem is justified.
+- Observations not promoted: bounded external sorting and market-at-a-time
+  validation are workload-specific implementation choices. The repaired atomic
+  publishers are prototype code, not a new BogKit subsystem proposal.
+- Positioning signal: BogKit is useful when embedded materialization, text
+  embeddings, or approximate search remove meaningful application work. It is
+  a poor fit for one-shot exact transforms that retain external authority and
+  still own every decisive rule and publication boundary.
+
+## Validation
+
+- Trial-specific tests: 20 laboratory-gate tests and 33 freight-clearing
+  integration tests passed from the normalized nested workspace.
+- Strict lint and formatting: both new packages passed formatting and strict
+  pedantic Clippy; the full nested workspace passed warnings-denied Clippy.
+- Runnable demonstrations: both normalized packages produced the deterministic
+  small-run counts and digests above.
+- BogKit root workspace: all 45 unit and documentation tests passed against
+  current-main commit `20f2ca50d5d06f51edfe8b8570c0fb48caf9eb81`.
+- Archive checks: one nested lockfile, 44 unique package names, no child
+  workspace or lockfile, all changed paths under `developer-simulation/`, and
+  no retained secrets, databases, build output, runtime state, symlinks, or
+  large binaries.
diff --git a/developer-simulation/runs/2026-07-28--offline-reconciliation/Cargo.toml b/developer-simulation/runs/2026-07-28--offline-reconciliation/Cargo.toml
new file mode 100644
index 0000000..4a074fe
--- /dev/null
+++ b/developer-simulation/runs/2026-07-28--offline-reconciliation/Cargo.toml
@@ -0,0 +1,17 @@
+[package]
+name = "offline-reconciliation"
+version = "0.1.0"
+edition.workspace = true
+publish.workspace = true
+
+[dependencies]
+fold = { path = "../../../fold" }
+serde = { version = "1", features = ["derive"] }
+serde_json = "1"
+
+[lints.rust]
+unsafe_code = "forbid"
+
+[lints.clippy]
+all = "warn"
+pedantic = "allow"
diff --git a/developer-simulation/runs/2026-07-28--offline-reconciliation/README.md b/developer-simulation/runs/2026-07-28--offline-reconciliation/README.md
new file mode 100644
index 0000000..a4f9074
--- /dev/null
+++ b/developer-simulation/runs/2026-07-28--offline-reconciliation/README.md
@@ -0,0 +1,205 @@
+# Offline warehouse reconciliation evaluation
+
+## Outcome
+
+BogKit is usable as a local proof store, but this trial did not demonstrate a
+BogKit-specific advantage and it is not a fit for the required production
+architecture.
+
+Fold can persist immutable operation records atomically and support a
+deterministic local projection. The prototype scans all stored operations and
+recomputes its snapshot, so it does not demonstrate incremental
+materialization. It also lacks a direct Fjall, SQLite, or PostgreSQL control.
+Fold's embedded single-writer store does not replace the required PostgreSQL
+source of truth or horizontally deployed API. The production recommendation is
+to keep the algorithm and tests, but implement them in PostgreSQL.
+
+## Persona and existing system
+
+I approached BogKit as Mateo, a warehouse device developer seeing it for the
+first time. I have six months of Rust experience after working in Go and
+Kotlin.
+
+Forty Android scanners currently store pallet rows in SQLite and upload those
+rows to a central Rust/PostgreSQL API. Devices can remain offline for 12 hours.
+Duplicate, reordered, interrupted, or concurrent uploads can silently restore
+an old pallet location.
+
+The baseline stores immutable operations in PostgreSQL under a unique
+`(device_id, sequence)` key, derives current pallet state centrally, and puts
+incompatible moves into a review queue.
+
+## Discovery and friction trail
+
+1. I read the root README, then the starter, time-series, chat, and search
+   examples in their published order.
+2. Starter and time-series made Fold's durable transactional views clear.
+3. Chat exposed the intended single-owner write architecture.
+4. Search exposed `KeyedStream::upsert` replacement semantics.
+5. I read the documented stream, keyed stream, table, aggregation, and keyed
+   stream test APIs.
+6. The first ordinary Cargo build could not resolve `index.crates.io`. An
+   offline build worked from locally cached dependencies.
+7. The first interruption test proved disk rollback, but the deliberately
+   caught panic poisoned Fjall's writer lock. Reopening the store, as a
+   restarted process would, allowed the retry.
+8. Strict lint found an oversized diagnostic error. Boxing the stored and
+   incoming operations kept the diagnostic without retaining a large error
+   value.
+
+## Prototype
+
+The CLI accepts JSON Lines operation batches and persists them in a Fold
+`KeyedStream` keyed by `(device_id, sequence)`. Before each upsert it rejects a
+different operation that reuses an existing identity. A deterministic snapshot
+groups each pallet's latest operation from every device:
+
+- one latest location becomes the current location;
+- disagreeing latest locations become an explicit conflict containing every
+  candidate;
+- timestamps are retained as evidence but never decide ordering.
+
+The prototype supports `ingest`, `show`, `demo`, and `benchmark` commands.
+
+## Exact commands and observed results
+
+Run from `developer-simulation/`:
+
+```console
+$ rustfmt --edition 2024 --check \
+    runs/2026-07-28--offline-reconciliation/src/lib.rs \
+    runs/2026-07-28--offline-reconciliation/src/main.rs
+
+$ RUSTFLAGS='-D warnings' cargo test \
+    -p offline-reconciliation --all-targets --offline
+running 7 tests
+test result: ok. 7 passed; 0 failed
+
+$ RUSTFLAGS='-D warnings' cargo clippy \
+    -p offline-reconciliation --all-targets --offline -- -D warnings
+Finished `dev` profile
+
+$ cargo run -p offline-reconciliation --offline -- \
+    demo /tmp/bogkit-offline-reconciliation-demo.db
+first upload: 2 inserted
+exact replay: 2 duplicates
+thread 'main' panicked at ... Box<dyn Any>
+interrupted upload: rolled back
+whole-batch retry: 2 inserted
+
+$ cargo run -p offline-reconciliation --offline --release -- \
+    benchmark /tmp/bogkit-offline-reconciliation-benchmark.db 20000
+received=20000 inserted=20000 duplicates=0 stored=20000 pallets=1000 elapsed_ms=57
+```
+
+The simulator also ran 128 shuffled arrival orders. Every order produced the
+same snapshot. The exact sample replay inserted nothing, and the two disagreeing
+locations for `pallet-7` remained visible as conflict candidates.
+
+The panic diagnostic is printed by Rust's panic hook even though the
+interruption is caught and the program continues after reopening the store.
+
+The simulator observed 57 ms; the skeptical review observed 54 ms; final
+archive verification observed 76 ms. These synthetic, machine-specific results
+show only that the prototype clears five seconds. Without a direct control they
+do not show that BogKit improves on Fjall, SQLite, or PostgreSQL.
+
+## Findings
+
+### Missing causality metadata
+
+- Category: missing capability in the scenario data
+- Severity: Critical
+- Confidence: High
+- Finding: Device ID, local sequence, and device timestamp cannot distinguish a
+  genuinely concurrent cross-device move from a later edit that observed the
+  first move.
+- Reproduction: the same pair of cross-device operation records can describe
+  either history.
+- Minimal improvement: include a per-pallet base revision or observed-head
+  identifiers with every operation. Until then, conservatively review every
+  disagreeing cross-device frontier.
+
+### Production storage mismatch
+
+- Category: poor product fit
+- Severity: High
+- Confidence: High
+- Finding: Fold uses an embedded single-writer store, while the required
+  service keeps PostgreSQL and runs multiple API instances.
+- Reproduction: compare the chat example's single-owner write path with the
+  scenario constraints.
+- Minimal improvement: document the embedded source-of-truth boundary clearly.
+  A PostgreSQL-backed materialization path would be an architectural addition,
+  not a small adapter.
+
+### Keyed upsert is replacement, not immutable insertion
+
+- Category: usage constraint
+- Severity: Informational
+- Confidence: High
+- Finding: Reusing `(device_id, sequence)` with changed content replaces the
+  earlier value unless the caller checks it. This behavior is explicit in the
+  API and is not a defect.
+- Reproduction: `KeyedStream::upsert` retracts the previous value and inserts
+  the replacement; the prototype's divergent-identity test guards it.
+- Minimal improvement: none from one trial. The existing transactional
+  `get`-then-`upsert` path implements compare-and-reject safely.
+
+### Caught-panic test caveat
+
+- Category: test-harness caveat
+- Severity: Informational
+- Confidence: High
+- Finding: The injected panic rolled back disk state but poisoned the current
+  embedded writer for later writes, and Rust's panic hook printed a diagnostic
+  even though the harness caught the panic.
+- Reproduction: the interruption test must reopen the model before retrying.
+- Minimal improvement: no product change from this synthetic test. A real
+  process restart naturally reopens the store; repeat evidence would be needed
+  before proposing recovery behavior.
+
+### Onboarding does not expose component boundaries
+
+- Category: documentation gap
+- Severity: Medium
+- Confidence: High
+- Finding: The README and project generator do not quickly explain which
+  component fits which storage and concurrency shape.
+- Minimal improvement: add a concise capability matrix and an immutable-event
+  example.
+
+### Local atomic persistence worked
+
+- Category: positive evidence
+- Severity: Informational
+- Confidence: High
+- Finding: Fold supported atomic local batches, checkpointed reopen, exact
+  replay checks, and local ingestion under the scenario threshold. The
+  snapshot still performs a full scan and recomputation.
+
+## Decision audit
+
+1. **Immutable operations with caller-side identity checks — selected for the
+   proof.** Fold's upsert API alone would silently replace divergent content.
+2. **Conservative conflict detection — selected.** The available operation
+   schema lacks cross-device causality, so false-positive review is safer than
+   silent loss.
+3. **Fold as the local proof store — selected.** It exercises atomic batch,
+   checkpointed reopen, and deterministic read behavior with little
+   infrastructure. No control was built, so this is convenience evidence, not
+   a demonstrated advantage.
+4. **Fold as the production source of truth — rejected.** It conflicts with the
+   fixed PostgreSQL and horizontal-deployment requirements.
+5. **Timestamps for conflict resolution — rejected.** Device clocks cannot be
+   trusted or coordinated.
+
+## Limits
+
+- The conflict model deliberately over-reports until causality metadata exists.
+- Snapshot derivation scans and recomputes all stored operations; it does not
+  exercise Fold's incremental materialization advantage.
+- Interruption uses a caught panic and reopen, not an operating-system kill.
+- No direct Fjall, SQLite, or PostgreSQL control was built.
+- Warehouse-specific action compatibility is intentionally undefined.
+- No review-resolution workflow is implemented.
diff --git a/developer-simulation/runs/2026-07-28--offline-reconciliation/data/sample-batch.jsonl b/developer-simulation/runs/2026-07-28--offline-reconciliation/data/sample-batch.jsonl
new file mode 100644
index 0000000..7b12bf1
--- /dev/null
+++ b/developer-simulation/runs/2026-07-28--offline-reconciliation/data/sample-batch.jsonl
@@ -0,0 +1,5 @@
+{"device_id":"scanner-01","sequence":2,"pallet_id":"pallet-7","action":"move","location":"cold-1","operator":"maya","device_timestamp_ms":1700000000002}
+{"device_id":"scanner-02","sequence":1,"pallet_id":"pallet-7","action":"move","location":"freezer-9","operator":"liam","device_timestamp_ms":1699999999000}
+{"device_id":"scanner-01","sequence":1,"pallet_id":"pallet-7","action":"arrive","location":"dock","operator":"maya","device_timestamp_ms":1700000000001}
+{"device_id":"scanner-03","sequence":1,"pallet_id":"pallet-8","action":"arrive","location":"dock","operator":"noor","device_timestamp_ms":1700000001000}
+{"device_id":"scanner-01","sequence":2,"pallet_id":"pallet-7","action":"move","location":"cold-1","operator":"maya","device_timestamp_ms":1700000000002}
diff --git a/developer-simulation/runs/2026-07-28--offline-reconciliation/src/lib.rs b/developer-simulation/runs/2026-07-28--offline-reconciliation/src/lib.rs
new file mode 100644
index 0000000..72aa863
--- /dev/null
+++ b/developer-simulation/runs/2026-07-28--offline-reconciliation/src/lib.rs
@@ -0,0 +1,635 @@
+use std::collections::{BTreeMap, BTreeSet, btree_map::Entry};
+use std::fmt;
+use std::path::{Path, PathBuf};
+
+use fold::pipeline::terminal;
+use fold::stream::KeyedStream;
+use serde::{Deserialize, Serialize};
+
+pub type OperationKey = (String, u64);
+
+type OperationStore =
+    KeyedStream<OperationKey, Operation, terminal::Table<OperationKey, Operation>>;
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+pub struct Operation {
+    pub device_id: String,
+    pub sequence: u64,
+    pub pallet_id: String,
+    pub action: String,
+    pub location: String,
+    pub operator: String,
+    pub device_timestamp_ms: i64,
+}
+
+impl Operation {
+    #[must_use]
+    pub fn key(&self) -> OperationKey {
+        (self.device_id.clone(), self.sequence)
+    }
+
+    fn validate(&self) -> Result<(), IngestError> {
+        for (field, value) in [
+            ("device_id", &self.device_id),
+            ("pallet_id", &self.pallet_id),
+            ("action", &self.action),
+            ("location", &self.location),
+            ("operator", &self.operator),
+        ] {
+            if value.trim().is_empty() {
+                return Err(IngestError::InvalidOperation {
+                    key: self.key(),
+                    reason: format!("{field} must not be empty"),
+                });
+            }
+        }
+        Ok(())
+    }
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize)]
+pub struct IngestReport {
+    pub received: usize,
+    pub inserted: usize,
+    pub duplicate_replays: usize,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub enum IngestError {
+    InvalidOperation {
+        key: OperationKey,
+        reason: String,
+    },
+    DivergentDuplicate {
+        key: OperationKey,
+        stored: Box<Operation>,
+        incoming: Box<Operation>,
+    },
+    SimulatedInterruption {
+        after_inserts: usize,
+    },
+    NothingToInterrupt {
+        requested_after: usize,
+        new_operations: usize,
+    },
+}
+
+impl fmt::Display for IngestError {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        match self {
+            Self::InvalidOperation { key, reason } => {
+                write!(f, "invalid operation {}:{}: {reason}", key.0, key.1)
+            }
+            Self::DivergentDuplicate { key, .. } => write!(
+                f,
+                "operation identity {}:{} was reused with different content",
+                key.0, key.1
+            ),
+            Self::SimulatedInterruption { after_inserts } => {
+                write!(f, "simulated interruption after {after_inserts} inserts")
+            }
+            Self::NothingToInterrupt {
+                requested_after,
+                new_operations,
+            } => write!(
+                f,
+                "cannot interrupt after {requested_after} inserts: only {new_operations} are new"
+            ),
+        }
+    }
+}
+
+impl std::error::Error for IngestError {}
+
+#[derive(Debug, Clone, PartialEq, Eq, PartialOrd, Ord, Serialize)]
+pub struct Candidate {
+    pub device_id: String,
+    pub sequence: u64,
+    pub action: String,
+    pub location: String,
+    pub operator: String,
+    pub device_timestamp_ms: i64,
+}
+
+impl From<Operation> for Candidate {
+    fn from(operation: Operation) -> Self {
+        Self {
+            device_id: operation.device_id,
+            sequence: operation.sequence,
+            action: operation.action,
+            location: operation.location,
+            operator: operation.operator,
+            device_timestamp_ms: operation.device_timestamp_ms,
+        }
+    }
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize)]
+#[serde(tag = "status", rename_all = "snake_case")]
+pub enum PalletStatus {
+    Settled {
+        action: String,
+        location: String,
+        evidence: Vec<Candidate>,
+    },
+    Conflict {
+        candidates: Vec<Candidate>,
+    },
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize)]
+pub struct PalletView {
+    pub pallet_id: String,
+    #[serde(flatten)]
+    pub status: PalletStatus,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize)]
+pub struct Snapshot {
+    pub operation_count: usize,
+    pub pallets: Vec<PalletView>,
+}
+
+pub struct Model {
+    path: PathBuf,
+    store: Option<OperationStore>,
+}
+
+impl Model {
+    #[must_use]
+    pub fn open(path: impl AsRef<Path>) -> Self {
+        let path = path.as_ref().to_path_buf();
+        Self {
+            store: Some(open_store(&path)),
+            path,
+        }
+    }
+
+    pub fn ingest_batch(&mut self, batch: &[Operation]) -> Result<IngestReport, IngestError> {
+        let (normalized, mut duplicate_replays) = normalize_batch(batch)?;
+        let mut new_operations = Vec::with_capacity(normalized.len());
+        let mut conflict = None;
+
+        self.store.as_mut().expect("model store is open").wtx(|tx| {
+            for (key, incoming) in &normalized {
+                match tx.get(key) {
+                    Some(stored) if stored == *incoming => duplicate_replays += 1,
+                    Some(stored) => {
+                        conflict = Some(IngestError::DivergentDuplicate {
+                            key: key.clone(),
+                            stored: Box::new(stored),
+                            incoming: Box::new(incoming.clone()),
+                        });
+                        return;
+                    }
+                    None => new_operations.push((key.clone(), incoming.clone())),
+                }
+            }
+
+            for (key, operation) in &new_operations {
+                let replaced = tx.upsert(key, operation);
+                debug_assert!(replaced.is_none());
+            }
+        });
+
+        if let Some(error) = conflict {
+            return Err(error);
+        }
+
+        Ok(IngestReport {
+            received: batch.len(),
+            inserted: new_operations.len(),
+            duplicate_replays,
+        })
+    }
+
+    pub fn simulate_interrupted_batch(
+        &mut self,
+        batch: &[Operation],
+        after_inserts: usize,
+    ) -> Result<(), IngestError> {
+        let (normalized, _) = normalize_batch(batch)?;
+        let mut new_operations = Vec::with_capacity(normalized.len());
+        let mut conflict = None;
+        let mut nothing_to_interrupt = None;
+
+        let outcome = std::panic::catch_unwind(std::panic::AssertUnwindSafe(|| {
+            self.store.as_mut().expect("model store is open").wtx(|tx| {
+                for (key, incoming) in &normalized {
+                    match tx.get(key) {
+                        Some(stored) if stored == *incoming => {}
+                        Some(stored) => {
+                            conflict = Some(IngestError::DivergentDuplicate {
+                                key: key.clone(),
+                                stored: Box::new(stored),
+                                incoming: Box::new(incoming.clone()),
+                            });
+                            return;
+                        }
+                        None => new_operations.push((key.clone(), incoming.clone())),
+                    }
+                }
+
+                if after_inserts == 0 || after_inserts > new_operations.len() {
+                    nothing_to_interrupt = Some(IngestError::NothingToInterrupt {
+                        requested_after: after_inserts,
+                        new_operations: new_operations.len(),
+                    });
+                    return;
+                }
+
+                for (index, (key, operation)) in new_operations.iter().enumerate() {
+                    tx.upsert(key, operation);
+                    if index + 1 == after_inserts {
+                        std::panic::panic_any(InterruptionMarker);
+                    }
+                }
+            });
+        }));
+
+        if let Some(error) = conflict {
+            return Err(error);
+        }
+        if let Some(error) = nothing_to_interrupt {
+            return Err(error);
+        }
+
+        match outcome {
+            Err(payload) if payload.is::<InterruptionMarker>() => {
+                // fjall's single-writer mutex is poisoned by the deliberately
+                // injected panic. A real process interruption drops the
+                // handle, so reopen here before retrying in this process.
+                self.store.take();
+                self.store = Some(open_store(&self.path));
+                Err(IngestError::SimulatedInterruption { after_inserts })
+            }
+            Err(payload) => std::panic::resume_unwind(payload),
+            Ok(()) => unreachable!("a valid simulated interruption must panic"),
+        }
+    }
+
+    #[must_use]
+    pub fn snapshot(&self) -> Snapshot {
+        let operations = self
+            .store
+            .as_ref()
+            .expect("model store is open")
+            .rtx(|table| table.iter().map(|(_, operation)| operation).collect());
+        derive_snapshot(operations)
+    }
+
+    pub fn checkpoint(&mut self) {
+        self.store
+            .as_mut()
+            .expect("model store is open")
+            .checkpoint();
+    }
+}
+
+#[derive(Debug)]
+struct InterruptionMarker;
+
+fn open_store(path: &Path) -> OperationStore {
+    KeyedStream::new(path, terminal::Table::new("immutable_operations"))
+}
+
+fn normalize_batch(
+    batch: &[Operation],
+) -> Result<(BTreeMap<OperationKey, Operation>, usize), IngestError> {
+    let mut operations = BTreeMap::new();
+    let mut duplicate_replays = 0;
+
+    for operation in batch {
+        operation.validate()?;
+        let key = operation.key();
+        match operations.entry(key.clone()) {
+            Entry::Vacant(entry) => {
+                entry.insert(operation.clone());
+            }
+            Entry::Occupied(entry) if entry.get() == operation => {
+                duplicate_replays += 1;
+            }
+            Entry::Occupied(entry) => {
+                return Err(IngestError::DivergentDuplicate {
+                    key,
+                    stored: Box::new(entry.get().clone()),
+                    incoming: Box::new(operation.clone()),
+                });
+            }
+        }
+    }
+
+    Ok((operations, duplicate_replays))
+}
+
+fn derive_snapshot(operations: Vec<Operation>) -> Snapshot {
+    let operation_count = operations.len();
+    let mut latest_per_device: BTreeMap<(String, String), Operation> = BTreeMap::new();
+
+    for operation in operations {
+        let key = (operation.pallet_id.clone(), operation.device_id.clone());
+        match latest_per_device.entry(key) {
+            Entry::Vacant(entry) => {
+                entry.insert(operation);
+            }
+            Entry::Occupied(mut entry) if operation.sequence > entry.get().sequence => {
+                entry.insert(operation);
+            }
+            Entry::Occupied(_) => {}
+        }
+    }
+
+    let mut by_pallet: BTreeMap<String, Vec<Candidate>> = BTreeMap::new();
+    for ((pallet_id, _), operation) in latest_per_device {
+        by_pallet
+            .entry(pallet_id)
+            .or_default()
+            .push(operation.into());
+    }
+
+    let pallets = by_pallet
+        .into_iter()
+        .map(|(pallet_id, mut candidates)| {
+            candidates.sort();
+            let outcomes: BTreeSet<_> = candidates
+                .iter()
+                .map(|candidate| (candidate.action.clone(), candidate.location.clone()))
+                .collect();
+
+            let status = if outcomes.len() == 1 {
+                let (action, location) = outcomes
+                    .into_iter()
+                    .next()
+                    .expect("one outcome was observed");
+                PalletStatus::Settled {
+                    action,
+                    location,
+                    evidence: candidates,
+                }
+            } else {
+                PalletStatus::Conflict { candidates }
+            };
+
+            PalletView { pallet_id, status }
+        })
+        .collect();
+
+    Snapshot {
+        operation_count,
+        pallets,
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use std::fs;
+    use std::sync::atomic::{AtomicU64, Ordering};
+    use std::time::{Duration, Instant, SystemTime, UNIX_EPOCH};
+
+    use super::*;
+
+    static NEXT_TEMP: AtomicU64 = AtomicU64::new(0);
+
+    struct TempDb {
+        path: std::path::PathBuf,
+    }
+
+    impl TempDb {
+        fn new(label: &str) -> Self {
+            let nonce = SystemTime::now()
+                .duration_since(UNIX_EPOCH)
+                .expect("system clock should be after Unix epoch")
+                .as_nanos();
+            let counter = NEXT_TEMP.fetch_add(1, Ordering::Relaxed);
+            let path = std::env::temp_dir().join(format!(
+                "offline-reconciliation-{label}-{}-{nonce}-{counter}",
+                std::process::id()
+            ));
+            Self { path }
+        }
+    }
+
+    impl Drop for TempDb {
+        fn drop(&mut self) {
+            let _ = fs::remove_dir_all(&self.path);
+        }
+    }
+
+    fn op(
+        device_id: &str,
+        sequence: u64,
+        pallet_id: &str,
+        action: &str,
+        location: &str,
+    ) -> Operation {
+        Operation {
+            device_id: device_id.to_string(),
+            sequence,
+            pallet_id: pallet_id.to_string(),
+            action: action.to_string(),
+            location: location.to_string(),
+            operator: format!("operator-{device_id}"),
+            device_timestamp_ms: 1_700_000_000_000 + sequence as i64,
+        }
+    }
+
+    #[test]
+    fn duplicate_replay_changes_nothing() {
+        let db = TempDb::new("duplicates");
+        let mut model = Model::open(&db.path);
+        let batch = vec![
+            op("scanner-1", 1, "pallet-7", "arrive", "dock"),
+            op("scanner-1", 2, "pallet-7", "move", "cold-1"),
+        ];
+
+        let first = model.ingest_batch(&batch).expect("first upload succeeds");
+        let before = model.snapshot();
+        let replay = model.ingest_batch(&batch).expect("replay succeeds");
+
+        assert_eq!(first.inserted, 2);
+        assert_eq!(replay.inserted, 0);
+        assert_eq!(replay.duplicate_replays, 2);
+        assert_eq!(model.snapshot(), before);
+    }
+
+    #[test]
+    fn divergent_identity_is_rejected_without_partial_commit() {
+        let db = TempDb::new("identity-reuse");
+        let mut model = Model::open(&db.path);
+        let original = op("scanner-1", 1, "pallet-7", "move", "cold-1");
+        model
+            .ingest_batch(std::slice::from_ref(&original))
+            .expect("first upload succeeds");
+
+        let mut altered = original;
+        altered.location = "freezer-9".to_string();
+        let fresh = op("scanner-2", 1, "pallet-8", "arrive", "dock");
+        let before = model.snapshot();
+
+        let error = model
+            .ingest_batch(&[fresh, altered])
+            .expect_err("identity reuse must be rejected");
+
+        assert!(matches!(error, IngestError::DivergentDuplicate { .. }));
+        assert_eq!(model.snapshot(), before);
+    }
+
+    #[test]
+    fn at_least_one_hundred_random_orders_have_the_same_result() {
+        let operations = vec![
+            op("scanner-1", 1, "pallet-a", "arrive", "dock"),
+            op("scanner-1", 2, "pallet-a", "move", "cold-1"),
+            op("scanner-2", 1, "pallet-a", "move", "freezer-2"),
+            op("scanner-3", 1, "pallet-a", "move", "cold-1"),
+            op("scanner-1", 3, "pallet-b", "arrive", "dock-2"),
+            op("scanner-2", 2, "pallet-b", "arrive", "dock-2"),
+            op("scanner-4", 1, "pallet-c", "move", "aisle-9"),
+            op("scanner-4", 2, "pallet-c", "move", "aisle-10"),
+        ];
+
+        let expected_db = TempDb::new("expected");
+        let expected = {
+            let mut model = Model::open(&expected_db.path);
+            model
+                .ingest_batch(&operations)
+                .expect("canonical upload succeeds");
+            model.snapshot()
+        };
+
+        for seed in 0..128_u64 {
+            let db = TempDb::new("permutation");
+            let mut shuffled = operations.clone();
+            shuffle(&mut shuffled, seed + 1);
+            let mut model = Model::open(&db.path);
+            let mut cursor = 0;
+            let mut rng = seed + 17;
+
+            while cursor < shuffled.len() {
+                rng = next_random(rng);
+                let end = (cursor + (rng as usize % 4) + 1).min(shuffled.len());
+                model
+                    .ingest_batch(&shuffled[cursor..end])
+                    .expect("permuted batch succeeds");
+                cursor = end;
+            }
+
+            assert_eq!(model.snapshot(), expected, "seed {seed} differed");
+        }
+    }
+
+    #[test]
+    fn interrupted_batch_rolls_back_and_retry_loses_nothing() {
+        let db = TempDb::new("interruption");
+        let mut model = Model::open(&db.path);
+        let batch: Vec<_> = (1..=20)
+            .map(|sequence| {
+                op(
+                    "scanner-9",
+                    sequence,
+                    &format!("pallet-{sequence}"),
+                    "arrive",
+                    "dock",
+                )
+            })
+            .collect();
+
+        let interrupted = model
+            .simulate_interrupted_batch(&batch, 7)
+            .expect_err("upload is deliberately interrupted");
+        assert_eq!(
+            interrupted,
+            IngestError::SimulatedInterruption { after_inserts: 7 }
+        );
+        assert_eq!(model.snapshot().operation_count, 0);
+
+        let retry = model.ingest_batch(&batch).expect("whole retry succeeds");
+        assert_eq!(retry.inserted, 20);
+        assert_eq!(model.snapshot().operation_count, 20);
+    }
+
+    #[test]
+    fn incompatible_moves_expose_both_candidates() {
+        let db = TempDb::new("conflict");
+        let mut model = Model::open(&db.path);
+        model
+            .ingest_batch(&[
+                op("scanner-1", 4, "pallet-7", "move", "cold-1"),
+                op("scanner-2", 8, "pallet-7", "move", "freezer-9"),
+            ])
+            .expect("upload succeeds");
+
+        let snapshot = model.snapshot();
+        let PalletStatus::Conflict { candidates } = &snapshot.pallets[0].status else {
+            panic!("expected a conflict");
+        };
+        assert_eq!(candidates.len(), 2);
+        assert_eq!(candidates[0].location, "cold-1");
+        assert_eq!(candidates[1].location, "freezer-9");
+    }
+
+    #[test]
+    fn state_survives_reopen() {
+        let db = TempDb::new("reopen");
+        let expected = {
+            let mut model = Model::open(&db.path);
+            model
+                .ingest_batch(&[op("scanner-1", 1, "pallet-7", "arrive", "dock")])
+                .expect("upload succeeds");
+            model.checkpoint();
+            model.snapshot()
+        };
+
+        let reopened = Model::open(&db.path);
+        assert_eq!(reopened.snapshot(), expected);
+    }
+
+    #[test]
+    fn twenty_thousand_operations_complete_under_five_seconds() {
+        let db = TempDb::new("performance");
+        let mut model = Model::open(&db.path);
+        let operations = generated_operations(20_000);
+        let started = Instant::now();
+
+        let report = model
+            .ingest_batch(&operations)
+            .expect("large upload succeeds");
+        let snapshot = model.snapshot();
+        let elapsed = started.elapsed();
+
+        assert_eq!(report.inserted, 20_000);
+        assert_eq!(snapshot.operation_count, 20_000);
+        assert!(
+            elapsed < Duration::from_secs(5),
+            "20,000 operations took {elapsed:?}"
+        );
+    }
+
+    fn generated_operations(count: usize) -> Vec<Operation> {
+        (0..count)
+            .map(|index| {
+                let device = index % 40;
+                let sequence = (index / 40 + 1) as u64;
+                op(
+                    &format!("scanner-{device:02}"),
+                    sequence,
+                    &format!("pallet-{:04}", index % 1_000),
+                    "move",
+                    &format!("zone-{:02}", (index / 1_000) % 20),
+                )
+            })
+            .collect()
+    }
+
+    fn shuffle<T>(values: &mut [T], mut state: u64) {
+        for index in (1..values.len()).rev() {
+            state = next_random(state);
+            values.swap(index, state as usize % (index + 1));
+        }
+    }
+
+    fn next_random(state: u64) -> u64 {
+        state
+            .wrapping_mul(6_364_136_223_846_793_005)
+            .wrapping_add(1_442_695_040_888_963_407)
+    }
+}
diff --git a/developer-simulation/runs/2026-07-28--offline-reconciliation/src/main.rs b/developer-simulation/runs/2026-07-28--offline-reconciliation/src/main.rs
new file mode 100644
index 0000000..56f5b9f
--- /dev/null
+++ b/developer-simulation/runs/2026-07-28--offline-reconciliation/src/main.rs
@@ -0,0 +1,194 @@
+use std::env;
+use std::fs::File;
+use std::io::{BufRead, BufReader};
+use std::path::{Path, PathBuf};
+use std::process::ExitCode;
+use std::time::Instant;
+
+use offline_reconciliation::{IngestError, Model, Operation};
+
+fn main() -> ExitCode {
+    match run() {
+        Ok(()) => ExitCode::SUCCESS,
+        Err(error) => {
+            eprintln!("error: {error}");
+            ExitCode::FAILURE
+        }
+    }
+}
+
+fn run() -> Result<(), Box<dyn std::error::Error>> {
+    let mut args = env::args().skip(1);
+    match args.next().as_deref() {
+        Some("ingest") => {
+            let db = required_path(args.next(), "database path")?;
+            let input = required_path(args.next(), "JSON Lines batch path")?;
+            reject_extra(args)?;
+            ingest(&db, &input)
+        }
+        Some("show") => {
+            let db = required_path(args.next(), "database path")?;
+            reject_extra(args)?;
+            show(&db)
+        }
+        Some("demo") => {
+            let db = required_path(args.next(), "database path")?;
+            reject_extra(args)?;
+            demo(&db)
+        }
+        Some("benchmark") => {
+            let db = required_path(args.next(), "database path")?;
+            let count = args
+                .next()
+                .map(|value| value.parse())
+                .transpose()?
+                .unwrap_or(20_000);
+            reject_extra(args)?;
+            benchmark(&db, count)
+        }
+        _ => {
+            eprintln!(
+                "usage:\n  offline-reconciliation ingest <db-dir> <batch.jsonl>\n  \
+                 offline-reconciliation show <db-dir>\n  \
+                 offline-reconciliation demo <db-dir>\n  \
+                 offline-reconciliation benchmark <db-dir> [operation-count]"
+            );
+            Err("missing or unknown command".into())
+        }
+    }
+}
+
+fn required_path(value: Option<String>, description: &str) -> Result<PathBuf, String> {
+    value
+        .map(PathBuf::from)
+        .ok_or_else(|| format!("missing {description}"))
+}
+
+fn reject_extra(mut args: impl Iterator<Item = String>) -> Result<(), String> {
+    match args.next() {
+        Some(extra) => Err(format!("unexpected argument: {extra}")),
+        None => Ok(()),
+    }
+}
+
+fn ingest(db: &Path, input: &Path) -> Result<(), Box<dyn std::error::Error>> {
+    let operations = read_json_lines(input)?;
+    let mut model = Model::open(db);
+    let report = model.ingest_batch(&operations)?;
+    println!("{}", serde_json::to_string_pretty(&report)?);
+    print_snapshot(&model)
+}
+
+fn show(db: &Path) -> Result<(), Box<dyn std::error::Error>> {
+    print_snapshot(&Model::open(db))
+}
+
+fn demo(db: &Path) -> Result<(), Box<dyn std::error::Error>> {
+    let mut model = Model::open(db);
+    let first = vec![
+        operation("scanner-01", 1, "pallet-7", "arrive", "dock", "maya"),
+        operation("scanner-01", 2, "pallet-7", "move", "cold-1", "maya"),
+    ];
+    let concurrent = vec![
+        operation("scanner-02", 1, "pallet-7", "move", "freezer-9", "liam"),
+        operation("scanner-03", 1, "pallet-8", "arrive", "dock", "noor"),
+    ];
+
+    let first_report = model.ingest_batch(&first)?;
+    println!("first upload: {}", serde_json::to_string(&first_report)?);
+    let replay_report = model.ingest_batch(&first)?;
+    println!("exact replay: {}", serde_json::to_string(&replay_report)?);
+
+    match model.simulate_interrupted_batch(&concurrent, 1) {
+        Err(IngestError::SimulatedInterruption { .. }) => {
+            println!(
+                "interrupted upload: rolled back; operation_count={}",
+                model.snapshot().operation_count
+            );
+        }
+        Err(error) => return Err(error.into()),
+        Ok(()) => unreachable!("demo requested a valid interruption"),
+    }
+
+    let retry_report = model.ingest_batch(&concurrent)?;
+    println!(
+        "whole-batch retry: {}",
+        serde_json::to_string(&retry_report)?
+    );
+    print_snapshot(&model)
+}
+
+fn benchmark(db: &Path, count: usize) -> Result<(), Box<dyn std::error::Error>> {
+    let operations: Vec<_> = (0..count)
+        .map(|index| {
+            let device = index % 40;
+            let sequence = (index / 40 + 1) as u64;
+            operation(
+                &format!("scanner-{device:02}"),
+                sequence,
+                &format!("pallet-{:04}", index % 1_000),
+                "move",
+                &format!("zone-{:02}", (index / 1_000) % 20),
+                &format!("operator-{device:02}"),
+            )
+        })
+        .collect();
+    let mut model = Model::open(db);
+    let started = Instant::now();
+    let report = model.ingest_batch(&operations)?;
+    let snapshot = model.snapshot();
+    let elapsed = started.elapsed();
+
+    println!(
+        "received={} inserted={} duplicates={} stored={} pallets={} elapsed_ms={}",
+        report.received,
+        report.inserted,
+        report.duplicate_replays,
+        snapshot.operation_count,
+        snapshot.pallets.len(),
+        elapsed.as_millis()
+    );
+    if elapsed.as_secs_f64() >= 5.0 {
+        return Err(format!("performance target missed: {elapsed:?}").into());
+    }
+    Ok(())
+}
+
+fn read_json_lines(path: &Path) -> Result<Vec<Operation>, Box<dyn std::error::Error>> {
+    let reader = BufReader::new(File::open(path)?);
+    let mut operations = Vec::new();
+    for (index, line) in reader.lines().enumerate() {
+        let line = line?;
+        if line.trim().is_empty() {
+            continue;
+        }
+        let operation = serde_json::from_str(&line)
+            .map_err(|error| format!("{}:{}: {error}", path.display(), index + 1))?;
+        operations.push(operation);
+    }
+    Ok(operations)
+}
+
+fn print_snapshot(model: &Model) -> Result<(), Box<dyn std::error::Error>> {
+    println!("{}", serde_json::to_string_pretty(&model.snapshot())?);
+    Ok(())
+}
+
+fn operation(
+    device_id: &str,
+    sequence: u64,
+    pallet_id: &str,
+    action: &str,
+    location: &str,
+    operator: &str,
+) -> Operation {
+    Operation {
+        device_id: device_id.to_string(),
+        sequence,
+        pallet_id: pallet_id.to_string(),
+        action: action.to_string(),
+        location: location.to_string(),
+        operator: operator.to_string(),
+        device_timestamp_ms: 1_700_000_000_000 + sequence as i64,
+    }
+}
diff --git a/developer-simulation/runs/2026-07-28--purchase-audit/Cargo.toml b/developer-simulation/runs/2026-07-28--purchase-audit/Cargo.toml
new file mode 100644
index 0000000..dc6ccd1
--- /dev/null
+++ b/developer-simulation/runs/2026-07-28--purchase-audit/Cargo.toml
@@ -0,0 +1,12 @@
+[package]
+name = "purchase-audit-comparison"
+version = "0.1.0"
+edition.workspace = true
+publish.workspace = true
+
+[dependencies]
+fold = { path = "../../../fold" }
+serde = { version = "1", features = ["derive"] }
+
+[lints.rust]
+unsafe_code = "forbid"
diff --git a/developer-simulation/runs/2026-07-28--purchase-audit/README.md b/developer-simulation/runs/2026-07-28--purchase-audit/README.md
new file mode 100644
index 0000000..b6b4aa6
--- /dev/null
+++ b/developer-simulation/runs/2026-07-28--purchase-audit/README.md
@@ -0,0 +1,318 @@
+# Purchase-request audit evaluation
+
+## Outcome
+
+Use the conventional PostgreSQL audit table. BogKit is not a fit for the
+required audit write path.
+
+Fold gives atomic transactions inside its own embedded `fjall` store. It
+cannot put a PostgreSQL state mutation and a Fold audit event in the same
+transaction. The included reproduction commits an approval to the
+PostgreSQL-like state model, injects a failure before the Fold write, and
+ends with approved current state but only the older create event. That
+violates the central acceptance criterion.
+
+The baseline prototype passes its deterministic semantic tests. Those tests
+do not prove PostgreSQL durability, database grants, crash recovery, 150-user
+concurrency, seven-year storage behavior, or the production latency target.
+Those items need PostgreSQL integration and load tests.
+
+## Persona
+
+I approached BogKit as Priya, a developer seeing it for the first time. I
+maintain internal finance software at a 250-person manufacturer. I have three
+years of Rust experience and regularly use Axum, SQLx, and PostgreSQL.
+
+My service stores the current state of purchase requests in PostgreSQL.
+Thirty-day logs are not a sufficient audit record. Finance needs an immutable,
+ordered seven-year history that includes the policy version used for each
+change.
+
+Expected load:
+
+- 80,000 requests
+- About 400,000 changes per year, or roughly 2.8 million changes over seven
+  years
+- 150 concurrent users
+- Less than 20 ms added write p95
+- No hosted infrastructure
+
+## Baseline and acceptance criteria
+
+The baseline is an append-only `purchase_request_audit` table in the same
+PostgreSQL database as `purchase_request`. Each service mutation updates the
+current row and inserts exactly one audit row in one SQL transaction. The
+ordinary application role can select and insert audit rows but cannot update,
+delete, or truncate them. A conventional index on `(request_id, sequence)`
+serves ordered timelines.
+
+The required behavior is:
+
+1. Every successful mutation creates exactly one audit event.
+2. A forced failure leaves neither the mutation nor its event.
+3. Timelines are ordered and accurately capture before state, after state,
+   actor, amount, and policy version.
+4. The ordinary application role cannot update or delete audit events.
+5. A 10,000-event query completes in less than 250 ms locally.
+
+Cryptographic tamper evidence, migration, UI, cross-service collection,
+retention automation, and production authentication are out of scope.
+
+The reference table and privilege shape is in
+[`baseline.sql`](baseline.sql). It was not run because this prototype does not
+include PostgreSQL.
+
+## Discovery and friction trail
+
+This is the order in which I learned the project.
+
+1. I read the repository `README.md`. It describes Fold as an incremental
+   programming framework that materializes changing streams into fast views.
+   It describes ESE as an embedding tool and ANNy as nearest-neighbor search.
+   Only Fold appeared relevant to an audit timeline.
+2. I read `examples/starter/src/main.rs`. Its `Stream::wtx` closure looked
+   promising because the example says all of its materialized views commit
+   atomically.
+3. I ran the advertised starter command. It did not run. The starter manifest
+   directly depends on ESE and ANNy even though its source only uses Fold.
+   Building ESE tried to download `model.safetensors` and failed when DNS was
+   unavailable.
+4. I read Fold's crate documentation and stream implementation. This resolved
+   the main ambiguity: Fold stores state in an embedded `fjall` LSM store and
+   creates its own `SingleWriterTxDatabase` transaction. Its rollback guarantee
+   covers only that store.
+5. I read the keyed stream and terminal implementations. Keyed state and
+   materialized views are atomic with one another because they share the Fold
+   store. There is no caller-owned PostgreSQL or SQLx transaction hook.
+6. I read the timeseries and chat examples. They demonstrate useful
+   incremental views, but the chat example explicitly makes Fold the source of
+   truth and has one thread own all writes. That conflicts with the requirement
+   that PostgreSQL remain the source of truth.
+7. I read the `Bag` terminal. A holder of the Fold write handle can call
+   `remove`, and the terminal deletes an element when its multiplicity reaches
+   zero. Fold has no PostgreSQL-style role grants for separating ordinary
+   application access from audit administration.
+8. I implemented both the smallest baseline model and a failing-boundary
+   reproduction using the real Fold `Bag`. The result confirmed that Fold's
+   internal atomicity does not close the two-store failure window.
+
+I did not investigate ESE or ANNy further. Embeddings and nearest-neighbor
+search do not address any acceptance criterion.
+
+## Prototype contents
+
+- [`src/lib.rs`](src/lib.rs) contains the deterministic single-store baseline
+  model, create/approve/reject/cancel operations, ordered audit queries,
+  injected failure, role-denial model, and the two real-Fold boundary
+  reproductions.
+- [`src/main.rs`](src/main.rs) runs the comparison and prints the outcome.
+- [`baseline.sql`](baseline.sql) records the recommended PostgreSQL table,
+  timeline index, and role-grant shape.
+- `Cargo.lock` pins the runnable prototype dependencies.
+
+The model stages each current-state change and audit event before its commit
+point. A forced failure returns before either becomes visible. Events have a
+monotonic sequence and snapshot request amount, previous and new status,
+actor, and policy version.
+
+For the 10,000-event check, the prototype creates 5,000 requests and applies
+one approve, reject, or cancel transition to each. It then reads the first
+10,000 events in global sequence order. This is a deterministic local data
+structure check, not a PostgreSQL query benchmark.
+
+## Exact commands and results
+
+All commands below were run from the sanitized repository or the prototype
+directory on July 28, 2026.
+
+### Public starter attempt
+
+```console
+$ cargo run -p starter
+error: failed to run custom build command for `ese v0.1.0`
+...
+cargo:warning=Downloading .../target/ese-cache/model.safetensors...
+download failed: ... "failed to lookup address information: nodename nor servname provided, or not known"
+```
+
+Result: failed. This was a discovery issue, not evidence against Fold's audit
+semantics.
+
+### Formatting
+
+```console
+$ rustfmt --edition 2024 src/lib.rs src/main.rs
+$ rustfmt --edition 2024 --check src/lib.rs src/main.rs
+```
+
+Result: passed with no output.
+
+I first tried `cargo fmt --all -- --check`. Because the prototype has a local
+path dependency on the repository, that command also reported existing format
+differences in `examples/search/src/main.rs`. I did not change those existing
+files and used the two-file check above.
+
+### Tests with warnings denied
+
+```console
+$ RUSTFLAGS='-D warnings' cargo test --manifest-path Cargo.toml --all-targets --offline
+running 8 tests
+test result: ok. 8 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.19s
+running 0 tests
+test result: ok. 0 passed; 0 failed
+```
+
+The first online attempt tried to refresh the crates.io index and failed DNS.
+All required dependencies were already cached, so `--offline` was the
+deterministic command.
+
+### Strict lint check
+
+```console
+$ RUSTFLAGS='-D warnings' cargo clippy --manifest-path Cargo.toml --all-targets --offline -- -D warnings
+Finished `dev` profile [unoptimized + debuginfo] target(s) in 2.86s
+```
+
+Result: passed with no warnings or lint findings.
+
+### Runnable comparison
+
+```console
+$ cargo run --manifest-path Cargo.toml --offline --quiet
+Decision: use the PostgreSQL baseline; BogKit is not a fit.
+Baseline forced failure: request absent, audit count unchanged at 2.
+Baseline timeline: [Create, Approve].
+Split-store failure: current state Approved, Fold has 1 older event.
+Fold writer retraction: 0 events remain.
+Local-model query: 10000 events in 889.042µs.
+```
+
+Result: passed. The measured query was below 250 ms on this run. It is evidence
+only for the local model.
+
+## Acceptance results
+
+| Criterion | Local result | What remains unproven |
+| --- | --- | --- |
+| Exactly one event per successful mutation | Pass in the baseline model for create, approve, reject, and cancel | SQLx/PostgreSQL integration |
+| Failure leaves neither state nor event | Pass in the baseline model | Real rollback on database, driver, and process failures |
+| Ordered, accurate timeline | Pass; event sequence and policy snapshots are asserted | PostgreSQL query plan and concurrent ordering |
+| Ordinary app role cannot update/delete | Pass in the model; reference SQL revokes these privileges | Grants under a real non-owner role |
+| 10,000-event query under 250 ms | Pass at 889.042 microseconds on this local-model run | PostgreSQL data volume, cache state, hardware, and index plan |
+| Added write p95 under 20 ms | Not tested | PostgreSQL load test with 150-user concurrency |
+| Seven-year immutable storage | Structurally represented, not tested | Capacity, backup/restore, permissions, and operations over about 2.8 million rows |
+
+## Categorized findings
+
+### Architecture
+
+**A1 — Fixed storage and transaction boundary**
+
+- Severity: Critical
+- Confidence: High
+- Finding: Fold opens and commits its own embedded-store transaction. It cannot
+  atomically join a caller-owned PostgreSQL transaction, and replacing
+  PostgreSQL with Fold would violate a fixed scenario requirement.
+- Reproduction:
+  `cargo test fold_sidecar_cannot_share_the_state_commit --offline`
+- Observed result: the current state is `Approved`, while Fold contains only
+  the earlier `Create` event.
+- Minimal improvement: add a capability matrix to the public documentation
+  that distinguishes embedded source-of-truth use from external-database
+  integration. A PostgreSQL-backed sink would be a substantial architectural
+  addition and is not proposed from this trial.
+
+### Scenario fit
+
+**S1 — A Fold writer can retract audit events**
+
+- Severity: High
+- Confidence: High
+- Finding: The scenario requires a role-protected append-only audit log, while
+  `Bag` is intentionally a retractable multiset. This is a no-fit reason, not a
+  Fold security defect.
+- Reproduction:
+  `cargo test fold_sidecar_allows_retraction_by_its_writer --offline`
+- Observed result: zero events remain after insert followed by retraction.
+- Minimal improvement: none to Fold from this evidence. Use PostgreSQL grants
+  and the audit table designed for this requirement.
+
+**Q1 — The general-purpose Bag is not an audit timeline index**
+
+- Severity: Informational
+- Confidence: High
+- Finding: `Bag` documents serialized-element iteration rather than audit-log
+  ordering. Choosing it for this scenario requires an explicit sort and is
+  another fit mismatch, not an ordering defect.
+- Reproduction: inspect the `fold_events.sort_by_key` call in `src/lib.rs` and
+  the `BagReader::iter` documentation in Fold.
+- Minimal improvement: none from this trial. An append-log terminal would not
+  solve the transaction or role-separation requirements.
+
+### Developer experience
+
+**D1 — The advertised smallest example unexpectedly requires an embedding
+model download**
+
+- Severity: Medium
+- Confidence: High
+- Finding: `examples/starter` declares ESE and ANNy dependencies even though
+  its source uses only Fold. The first-run starter build therefore invokes the
+  ESE download.
+- Reproduction: `cargo run -p starter`
+- Observed result: build failure while downloading `model.safetensors` because
+  DNS was unavailable.
+- Minimal improvement: remove unused ESE and ANNy dependencies from the
+  starter manifest or put them behind opt-in features.
+
+**D2 — External transaction and concurrency limits are not surfaced early**
+
+- Severity: Medium
+- Confidence: High
+- Finding: The top-level README says writes are transactional but does not say
+  that the boundary is one embedded store. The chat example's single-writer
+  shape appears only after reading its source.
+- Reproduction: follow the discovery sequence above from `README.md` to
+  `fold/src/stream`.
+- Minimal improvement: state the storage engine, external-transaction
+  limitation, and single-writer architecture in the top-level Fold
+  description.
+
+### Positive evidence
+
+**P1 — Fold's internal transaction behavior is clear and useful within its
+intended boundary**
+
+- Severity: Informational
+- Confidence: High
+- Finding: Current keyed state and Fold materialized views share one embedded
+  transaction, and panic handling aborts pending pipeline state.
+- Reproduction: the Fold stream and keyed-stream implementations, plus the
+  public starter example.
+- Minimal improvement: none for embedded use; the issue is fit, not a failure
+  of the documented internal transaction.
+
+## Decision audit
+
+1. **PostgreSQL current state plus PostgreSQL audit table — selected.** It is
+   the only option evaluated that can use one native transaction for the
+   mandatory state and event writes. It also has direct role grants and a
+   conventional ordered index.
+2. **PostgreSQL current state plus Fold audit sidecar — rejected.** Either
+   commit order has a partial-success window. State-first can lose the audit
+   event; Fold-first can retain an event for a mutation that never committed.
+   Retry logic cannot remove the crash window without a shared transaction.
+3. **Fold as the source of truth — rejected.** It could keep its own state and
+   views atomic, but it directly violates the PostgreSQL source-of-truth
+   requirement and would create an unnecessary migration.
+4. **PostgreSQL outbox feeding Fold — rejected for this scope.** A PostgreSQL
+   outbox row could be atomic with the mutation, but the immutable audit table
+   already is that durable record. Copying it into Fold adds lag, duplicate
+   storage, replay, and operational work without improving the required
+   timeline.
+5. **ESE or ANNy — not applicable.** Neither embeddings nor nearest-neighbor
+   search help transaction atomicity, immutability, or ordered audit queries.
+
+The no-fit decision does not claim Fold is generally unsuitable. It says that
+its strongest feature here—atomic incremental views in one embedded
+store—ends at exactly the boundary this finance system must cross.
diff --git a/developer-simulation/runs/2026-07-28--purchase-audit/baseline.sql b/developer-simulation/runs/2026-07-28--purchase-audit/baseline.sql
new file mode 100644
index 0000000..083894e
--- /dev/null
+++ b/developer-simulation/runs/2026-07-28--purchase-audit/baseline.sql
@@ -0,0 +1,34 @@
+-- Reference shape for the recommended PostgreSQL baseline.
+-- This file was reviewed but not executed because the prototype has no
+-- PostgreSQL service.
+
+CREATE TABLE purchase_request (
+    request_id bigint PRIMARY KEY,
+    amount_cents bigint NOT NULL CHECK (amount_cents >= 0),
+    status text NOT NULL CHECK (status IN ('draft', 'approved', 'rejected', 'cancelled')),
+    policy_version text NOT NULL
+);
+
+CREATE TABLE purchase_request_audit (
+    sequence bigint GENERATED ALWAYS AS IDENTITY PRIMARY KEY,
+    request_id bigint NOT NULL REFERENCES purchase_request(request_id),
+    action text NOT NULL CHECK (action IN ('create', 'approve', 'reject', 'cancel')),
+    previous_status text,
+    new_status text NOT NULL,
+    amount_cents bigint NOT NULL,
+    actor text NOT NULL,
+    policy_version text NOT NULL,
+    occurred_at timestamptz NOT NULL DEFAULT transaction_timestamp()
+);
+
+CREATE INDEX purchase_request_audit_timeline
+    ON purchase_request_audit (request_id, sequence);
+
+-- Replace purchase_app with the actual non-owner application role.
+REVOKE UPDATE, DELETE, TRUNCATE ON purchase_request_audit FROM purchase_app;
+GRANT SELECT, INSERT ON purchase_request_audit TO purchase_app;
+
+-- Each service mutation must update purchase_request and insert exactly one
+-- purchase_request_audit row inside the same SQL transaction. Production
+-- enforcement should use one reviewed mutation function or an equivalent
+-- single repository path, plus integration tests against PostgreSQL.
diff --git a/developer-simulation/runs/2026-07-28--purchase-audit/src/lib.rs b/developer-simulation/runs/2026-07-28--purchase-audit/src/lib.rs
new file mode 100644
index 0000000..0802086
--- /dev/null
+++ b/developer-simulation/runs/2026-07-28--purchase-audit/src/lib.rs
@@ -0,0 +1,533 @@
+//! A deterministic comparison of a single-store audit transaction with a
+//! PostgreSQL-plus-Fold split write.
+//!
+//! `BaselineModel` is deliberately small. It models transaction outcomes and
+//! audit semantics, not PostgreSQL durability, locking, grants, or latency.
+
+use std::collections::BTreeMap;
+use std::fmt::{Display, Formatter};
+use std::path::Path;
+
+use fold::pipeline::terminal;
+use fold::stream::Stream;
+use serde::{Deserialize, Serialize};
+
+pub type RequestId = u64;
+
+#[derive(Clone, Copy, Debug, Deserialize, Eq, PartialEq, Serialize)]
+pub enum RequestStatus {
+    Draft,
+    Approved,
+    Rejected,
+    Cancelled,
+}
+
+#[derive(Clone, Copy, Debug, Deserialize, Eq, PartialEq, Serialize)]
+pub enum Action {
+    Create,
+    Approve,
+    Reject,
+    Cancel,
+}
+
+#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
+pub struct PurchaseRequest {
+    pub id: RequestId,
+    pub amount_cents: u64,
+    pub status: RequestStatus,
+    pub policy_version: String,
+}
+
+#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
+pub struct AuditEvent {
+    pub sequence: u64,
+    pub request_id: RequestId,
+    pub action: Action,
+    pub previous_status: Option<RequestStatus>,
+    pub new_status: RequestStatus,
+    pub amount_cents: u64,
+    pub actor: String,
+    pub policy_version: String,
+}
+
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+pub enum FailPoint {
+    Never,
+    BeforeCommit,
+}
+
+#[derive(Clone, Debug, Eq, PartialEq)]
+pub enum AuditError {
+    RequestAlreadyExists(RequestId),
+    RequestNotFound(RequestId),
+    InvalidTransition {
+        request_id: RequestId,
+        from: RequestStatus,
+        action: Action,
+    },
+    InjectedFailure,
+    AppRoleCannotModifyAudit,
+}
+
+impl Display for AuditError {
+    fn fmt(&self, f: &mut Formatter<'_>) -> std::fmt::Result {
+        match self {
+            Self::RequestAlreadyExists(id) => write!(f, "request {id} already exists"),
+            Self::RequestNotFound(id) => write!(f, "request {id} does not exist"),
+            Self::InvalidTransition {
+                request_id,
+                from,
+                action,
+            } => write!(
+                f,
+                "request {request_id} cannot apply {action:?} from {from:?}"
+            ),
+            Self::InjectedFailure => write!(f, "failure injected before commit"),
+            Self::AppRoleCannotModifyAudit => {
+                write!(f, "the ordinary application role cannot modify audit rows")
+            }
+        }
+    }
+}
+
+impl std::error::Error for AuditError {}
+
+/// Models current rows and append-only audit rows committed in one database
+/// transaction. Changes are staged and become visible only at the commit
+/// boundary.
+#[derive(Default)]
+pub struct BaselineModel {
+    requests: BTreeMap<RequestId, PurchaseRequest>,
+    audit_by_sequence: BTreeMap<u64, AuditEvent>,
+    sequences_by_request: BTreeMap<RequestId, Vec<u64>>,
+    next_sequence: u64,
+}
+
+impl BaselineModel {
+    #[must_use]
+    pub fn new() -> Self {
+        Self::default()
+    }
+
+    pub fn create(
+        &mut self,
+        id: RequestId,
+        amount_cents: u64,
+        actor: &str,
+        policy_version: &str,
+        fail: FailPoint,
+    ) -> Result<(), AuditError> {
+        if self.requests.contains_key(&id) {
+            return Err(AuditError::RequestAlreadyExists(id));
+        }
+
+        let request = PurchaseRequest {
+            id,
+            amount_cents,
+            status: RequestStatus::Draft,
+            policy_version: policy_version.to_owned(),
+        };
+        let event = self.event_for(&request, Action::Create, None, actor, policy_version);
+
+        if fail == FailPoint::BeforeCommit {
+            return Err(AuditError::InjectedFailure);
+        }
+
+        self.commit(request, event);
+        Ok(())
+    }
+
+    pub fn approve(
+        &mut self,
+        id: RequestId,
+        actor: &str,
+        policy_version: &str,
+        fail: FailPoint,
+    ) -> Result<(), AuditError> {
+        self.transition(
+            id,
+            Action::Approve,
+            RequestStatus::Approved,
+            actor,
+            policy_version,
+            fail,
+        )
+    }
+
+    pub fn reject(
+        &mut self,
+        id: RequestId,
+        actor: &str,
+        policy_version: &str,
+        fail: FailPoint,
+    ) -> Result<(), AuditError> {
+        self.transition(
+            id,
+            Action::Reject,
+            RequestStatus::Rejected,
+            actor,
+            policy_version,
+            fail,
+        )
+    }
+
+    pub fn cancel(
+        &mut self,
+        id: RequestId,
+        actor: &str,
+        policy_version: &str,
+        fail: FailPoint,
+    ) -> Result<(), AuditError> {
+        self.transition(
+            id,
+            Action::Cancel,
+            RequestStatus::Cancelled,
+            actor,
+            policy_version,
+            fail,
+        )
+    }
+
+    fn transition(
+        &mut self,
+        id: RequestId,
+        action: Action,
+        new_status: RequestStatus,
+        actor: &str,
+        policy_version: &str,
+        fail: FailPoint,
+    ) -> Result<(), AuditError> {
+        let current = self
+            .requests
+            .get(&id)
+            .ok_or(AuditError::RequestNotFound(id))?;
+
+        if current.status != RequestStatus::Draft {
+            return Err(AuditError::InvalidTransition {
+                request_id: id,
+                from: current.status,
+                action,
+            });
+        }
+
+        let previous_status = current.status;
+        let mut changed = current.clone();
+        changed.status = new_status;
+        changed.policy_version = policy_version.to_owned();
+        let event = self.event_for(
+            &changed,
+            action,
+            Some(previous_status),
+            actor,
+            policy_version,
+        );
+
+        if fail == FailPoint::BeforeCommit {
+            return Err(AuditError::InjectedFailure);
+        }
+
+        self.commit(changed, event);
+        Ok(())
+    }
+
+    fn event_for(
+        &self,
+        request: &PurchaseRequest,
+        action: Action,
+        previous_status: Option<RequestStatus>,
+        actor: &str,
+        policy_version: &str,
+    ) -> AuditEvent {
+        AuditEvent {
+            sequence: self.next_sequence + 1,
+            request_id: request.id,
+            action,
+            previous_status,
+            new_status: request.status,
+            amount_cents: request.amount_cents,
+            actor: actor.to_owned(),
+            policy_version: policy_version.to_owned(),
+        }
+    }
+
+    fn commit(&mut self, request: PurchaseRequest, event: AuditEvent) {
+        self.next_sequence = event.sequence;
+        self.sequences_by_request
+            .entry(request.id)
+            .or_default()
+            .push(event.sequence);
+        self.audit_by_sequence.insert(event.sequence, event);
+        self.requests.insert(request.id, request);
+    }
+
+    #[must_use]
+    pub fn request(&self, id: RequestId) -> Option<&PurchaseRequest> {
+        self.requests.get(&id)
+    }
+
+    #[must_use]
+    pub fn audit_len(&self) -> usize {
+        self.audit_by_sequence.len()
+    }
+
+    #[must_use]
+    pub fn timeline(&self, id: RequestId) -> Vec<&AuditEvent> {
+        self.sequences_by_request
+            .get(&id)
+            .into_iter()
+            .flatten()
+            .filter_map(|sequence| self.audit_by_sequence.get(sequence))
+            .collect()
+    }
+
+    #[must_use]
+    pub fn all_timeline(&self, limit: usize) -> Vec<&AuditEvent> {
+        self.audit_by_sequence.values().take(limit).collect()
+    }
+
+    pub fn app_role_update_audit(&mut self, _sequence: u64) -> Result<(), AuditError> {
+        Err(AuditError::AppRoleCannotModifyAudit)
+    }
+
+    pub fn app_role_delete_audit(&mut self, _sequence: u64) -> Result<(), AuditError> {
+        Err(AuditError::AppRoleCannotModifyAudit)
+    }
+}
+
+#[derive(Clone, Debug, Eq, PartialEq)]
+pub struct SplitBoundaryResult {
+    pub current_state: RequestStatus,
+    pub fold_events: Vec<AuditEvent>,
+}
+
+/// Uses the real Fold `Bag` as a durable sidecar and a deterministic stand-in
+/// for a PostgreSQL current-state row. The second state mutation commits, then
+/// the injected integration failure prevents the corresponding Fold write.
+///
+/// This proves only the transaction-boundary mismatch. It does not model a
+/// PostgreSQL driver or a process crash.
+#[must_use]
+pub fn reproduce_split_commit(path: &Path) -> SplitBoundaryResult {
+    let created = AuditEvent {
+        sequence: 1,
+        request_id: 7,
+        action: Action::Create,
+        previous_status: None,
+        new_status: RequestStatus::Draft,
+        amount_cents: 125_000,
+        actor: "priya".to_owned(),
+        policy_version: "policy-2026.1".to_owned(),
+    };
+
+    let mut fold_audit = Stream::new(path, terminal::Bag::<AuditEvent>::new("audit_events"));
+    fold_audit.wtx(|tx| tx.insert(&created));
+
+    // The PostgreSQL-like state commits first.
+    let current_state = RequestStatus::Approved;
+    // Injected failure: the matching Fold write is never called.
+
+    let mut fold_events = fold_audit.rtx(|events| {
+        events
+            .iter()
+            .flat_map(|(event, multiplicity)| {
+                std::iter::repeat_n(event, usize::try_from(multiplicity).unwrap_or_default())
+            })
+            .collect::<Vec<_>>()
+    });
+    fold_events.sort_by_key(|event| event.sequence);
+
+    SplitBoundaryResult {
+        current_state,
+        fold_events,
+    }
+}
+
+/// Shows that a caller with a Fold write handle can retract an event. Fold
+/// does not expose PostgreSQL-style table privileges or application roles.
+#[must_use]
+pub fn fold_retraction_count(path: &Path) -> usize {
+    let event = AuditEvent {
+        sequence: 1,
+        request_id: 7,
+        action: Action::Create,
+        previous_status: None,
+        new_status: RequestStatus::Draft,
+        amount_cents: 125_000,
+        actor: "priya".to_owned(),
+        policy_version: "policy-2026.1".to_owned(),
+    };
+
+    let mut fold_audit = Stream::new(path, terminal::Bag::<AuditEvent>::new("audit_events"));
+    fold_audit.wtx(|tx| tx.insert(&event));
+    fold_audit.wtx(|tx| tx.remove(&event));
+    fold_audit.rtx(|events| events.iter().count())
+}
+
+#[cfg(test)]
+mod tests {
+    use std::fs;
+    use std::time::{Duration, Instant};
+
+    use super::*;
+
+    fn clean_test_path(name: &str) -> std::path::PathBuf {
+        let path = std::env::current_dir()
+            .unwrap()
+            .join("target")
+            .join("test-data")
+            .join(name);
+        if path.exists() {
+            fs::remove_dir_all(&path).unwrap();
+        }
+        path
+    }
+
+    #[test]
+    fn every_successful_mutation_has_one_ordered_accurate_event() {
+        let mut db = BaselineModel::new();
+        db.create(10, 50_000, "priya", "policy-2026.1", FailPoint::Never)
+            .unwrap();
+        db.approve(10, "sam", "policy-2026.2", FailPoint::Never)
+            .unwrap();
+
+        let timeline = db.timeline(10);
+        assert_eq!(timeline.len(), 2);
+        assert_eq!(timeline[0].sequence, 1);
+        assert_eq!(timeline[0].action, Action::Create);
+        assert_eq!(timeline[0].previous_status, None);
+        assert_eq!(timeline[0].new_status, RequestStatus::Draft);
+        assert_eq!(timeline[0].policy_version, "policy-2026.1");
+        assert_eq!(timeline[1].sequence, 2);
+        assert_eq!(timeline[1].action, Action::Approve);
+        assert_eq!(timeline[1].previous_status, Some(RequestStatus::Draft));
+        assert_eq!(timeline[1].new_status, RequestStatus::Approved);
+        assert_eq!(timeline[1].policy_version, "policy-2026.2");
+    }
+
+    #[test]
+    fn forced_failure_commits_neither_state_nor_event() {
+        let mut db = BaselineModel::new();
+        let result = db.create(
+            11,
+            75_000,
+            "priya",
+            "policy-2026.1",
+            FailPoint::BeforeCommit,
+        );
+
+        assert_eq!(result, Err(AuditError::InjectedFailure));
+        assert!(db.request(11).is_none());
+        assert_eq!(db.audit_len(), 0);
+    }
+
+    #[test]
+    fn failed_transition_preserves_prior_state_and_timeline() {
+        let mut db = BaselineModel::new();
+        db.create(12, 99_000, "priya", "policy-2026.1", FailPoint::Never)
+            .unwrap();
+        let result = db.reject(12, "sam", "policy-2026.2", FailPoint::BeforeCommit);
+
+        assert_eq!(result, Err(AuditError::InjectedFailure));
+        assert_eq!(
+            db.request(12).map(|request| request.status),
+            Some(RequestStatus::Draft)
+        );
+        assert_eq!(db.timeline(12).len(), 1);
+    }
+
+    #[test]
+    fn approve_reject_and_cancel_are_terminal_transitions() {
+        let mut db = BaselineModel::new();
+        for id in 20..=22 {
+            db.create(id, 10_000, "priya", "p1", FailPoint::Never)
+                .unwrap();
+        }
+        db.approve(20, "sam", "p2", FailPoint::Never).unwrap();
+        db.reject(21, "sam", "p2", FailPoint::Never).unwrap();
+        db.cancel(22, "priya", "p1", FailPoint::Never).unwrap();
+
+        assert_eq!(
+            db.request(20).map(|request| request.status),
+            Some(RequestStatus::Approved)
+        );
+        assert_eq!(
+            db.request(21).map(|request| request.status),
+            Some(RequestStatus::Rejected)
+        );
+        assert_eq!(
+            db.request(22).map(|request| request.status),
+            Some(RequestStatus::Cancelled)
+        );
+        assert!(matches!(
+            db.cancel(20, "priya", "p2", FailPoint::Never),
+            Err(AuditError::InvalidTransition { .. })
+        ));
+        assert_eq!(db.timeline(20).len(), 2);
+    }
+
+    #[test]
+    fn app_role_cannot_update_or_delete_audit_events() {
+        let mut db = BaselineModel::new();
+        db.create(30, 15_000, "priya", "p1", FailPoint::Never)
+            .unwrap();
+
+        assert_eq!(
+            db.app_role_update_audit(1),
+            Err(AuditError::AppRoleCannotModifyAudit)
+        );
+        assert_eq!(
+            db.app_role_delete_audit(1),
+            Err(AuditError::AppRoleCannotModifyAudit)
+        );
+        assert_eq!(db.audit_len(), 1);
+    }
+
+    #[test]
+    fn ten_thousand_event_query_is_under_250ms_in_the_local_model() {
+        let mut db = BaselineModel::new();
+        for id in 1..=5_000 {
+            db.create(id, id * 100, "seed", "p1", FailPoint::Never)
+                .unwrap();
+            match id % 3 {
+                0 => db.approve(id, "seed", "p2", FailPoint::Never).unwrap(),
+                1 => db.reject(id, "seed", "p2", FailPoint::Never).unwrap(),
+                _ => db.cancel(id, "seed", "p2", FailPoint::Never).unwrap(),
+            }
+        }
+
+        let started = Instant::now();
+        let timeline = db.all_timeline(10_000);
+        let elapsed = started.elapsed();
+
+        assert_eq!(timeline.len(), 10_000);
+        assert!(
+            timeline
+                .windows(2)
+                .all(|pair| pair[0].sequence < pair[1].sequence)
+        );
+        assert!(
+            elapsed < Duration::from_millis(250),
+            "local model query took {elapsed:?}"
+        );
+    }
+
+    #[test]
+    fn fold_sidecar_cannot_share_the_state_commit() {
+        let path = clean_test_path("split-commit");
+        let result = reproduce_split_commit(&path);
+
+        assert_eq!(result.current_state, RequestStatus::Approved);
+        assert_eq!(result.fold_events.len(), 1);
+        assert_eq!(result.fold_events[0].action, Action::Create);
+        assert_ne!(
+            result.fold_events.last().map(|event| event.new_status),
+            Some(result.current_state)
+        );
+    }
+
+    #[test]
+    fn fold_sidecar_allows_retraction_by_its_writer() {
+        let path = clean_test_path("retraction");
+        assert_eq!(fold_retraction_count(&path), 0);
+    }
+}
diff --git a/developer-simulation/runs/2026-07-28--purchase-audit/src/main.rs b/developer-simulation/runs/2026-07-28--purchase-audit/src/main.rs
new file mode 100644
index 0000000..c62b5d0
--- /dev/null
+++ b/developer-simulation/runs/2026-07-28--purchase-audit/src/main.rs
@@ -0,0 +1,87 @@
+use std::fs;
+use std::time::Instant;
+
+use purchase_audit_comparison::{
+    AuditError, BaselineModel, FailPoint, RequestStatus, fold_retraction_count,
+    reproduce_split_commit,
+};
+
+fn main() {
+    let mut baseline = BaselineModel::new();
+    baseline
+        .create(1, 125_000, "priya", "policy-2026.1", FailPoint::Never)
+        .expect("create should commit");
+    baseline
+        .approve(1, "sam", "policy-2026.2", FailPoint::Never)
+        .expect("approve should commit");
+
+    let before_failed_write = baseline.audit_len();
+    let forced_failure =
+        baseline.create(2, 80_000, "priya", "policy-2026.1", FailPoint::BeforeCommit);
+    assert_eq!(forced_failure, Err(AuditError::InjectedFailure));
+    assert!(baseline.request(2).is_none());
+    assert_eq!(baseline.audit_len(), before_failed_write);
+
+    let split_path = data_path("run-split");
+    let split = reproduce_split_commit(&split_path);
+    assert_eq!(split.current_state, RequestStatus::Approved);
+    assert_eq!(split.fold_events.len(), 1);
+
+    let retraction_path = data_path("run-retraction");
+    let after_retraction = fold_retraction_count(&retraction_path);
+    assert_eq!(after_retraction, 0);
+
+    let mut query_model = BaselineModel::new();
+    for id in 1..=5_000 {
+        query_model
+            .create(id, id * 100, "seed", "p1", FailPoint::Never)
+            .expect("seed create should commit");
+        match id % 3 {
+            0 => query_model
+                .approve(id, "seed", "p2", FailPoint::Never)
+                .expect("seed approval should commit"),
+            1 => query_model
+                .reject(id, "seed", "p2", FailPoint::Never)
+                .expect("seed rejection should commit"),
+            _ => query_model
+                .cancel(id, "seed", "p2", FailPoint::Never)
+                .expect("seed cancellation should commit"),
+        }
+    }
+    let started = Instant::now();
+    let result_count = query_model.all_timeline(10_000).len();
+    let elapsed = started.elapsed();
+
+    println!("Decision: use the PostgreSQL baseline; BogKit is not a fit.");
+    println!(
+        "Baseline forced failure: request absent, audit count unchanged at {}.",
+        baseline.audit_len()
+    );
+    println!(
+        "Baseline timeline: {:?}.",
+        baseline
+            .timeline(1)
+            .iter()
+            .map(|event| event.action)
+            .collect::<Vec<_>>()
+    );
+    println!(
+        "Split-store failure: current state {:?}, Fold has {} older event.",
+        split.current_state,
+        split.fold_events.len()
+    );
+    println!("Fold writer retraction: {after_retraction} events remain.");
+    println!("Local-model query: {result_count} events in {elapsed:?}.");
+}
+
+fn data_path(name: &str) -> std::path::PathBuf {
+    let path = std::env::current_dir()
+        .expect("current directory should be available")
+        .join("target")
+        .join("run-data")
+        .join(name);
+    if path.exists() {
+        fs::remove_dir_all(&path).expect("old run data should be removable");
+    }
+    path
+}
diff --git a/developer-simulation/runs/2026-07-29--edge-spool-pressure/Cargo.toml b/developer-simulation/runs/2026-07-29--edge-spool-pressure/Cargo.toml
new file mode 100644
index 0000000..382b0d5
--- /dev/null
+++ b/developer-simulation/runs/2026-07-29--edge-spool-pressure/Cargo.toml
@@ -0,0 +1,16 @@
+[package]
+name = "edge-spool-pressure"
+version = "0.1.0"
+edition.workspace = true
+publish.workspace = true
+
+[dependencies]
+fold = { path = "../../../fold" }
+serde = { version = "1", features = ["derive"] }
+
+[lints.rust]
+unsafe_code = "forbid"
+
+[lints.clippy]
+all = "warn"
+pedantic = "allow"
diff --git a/developer-simulation/runs/2026-07-29--edge-spool-pressure/EVIDENCE.md b/developer-simulation/runs/2026-07-29--edge-spool-pressure/EVIDENCE.md
new file mode 100644
index 0000000..157eefa
--- /dev/null
+++ b/developer-simulation/runs/2026-07-29--edge-spool-pressure/EVIDENCE.md
@@ -0,0 +1,426 @@
+# Blind trial report: edge spool pressure
+
+## Decision
+
+**No fit for the strict 256 MiB edge spool.**
+
+Fold is useful for atomic queue state, durable upload intent, and durable
+drop counters. The prototype recovered every retained event in the two
+representative crash cases and explained the duplicate window.
+
+The blocker is the disk-bound guarantee. Fold exposes a logical view of
+records, but its public interface does not expose a hard allocated-byte limit
+or a documented way to make eviction and compaction satisfy one. In the
+minimal probe, the queue held 1,048,512 logical bytes under a 1,048,576-byte
+logical limit, while the database had 3,305,472 allocated bytes. This proves
+that logical accounting is not a physical cap. It does not predict exact
+allocation at 256 MiB or test an external filesystem quota.
+
+This is a deliberately bounded no-fit result. I did not run one million
+events through the Fold candidate after the quota prerequisite failed.
+
+## Deliverables
+
+- Prototype: `runs/2026-07-29--edge-spool-pressure/`
+- Main executable: `runs/2026-07-29--edge-spool-pressure/src/main.rs`
+- Prototype instructions: `runs/2026-07-29--edge-spool-pressure/README.md`
+- This report: `runs/2026-07-29--edge-spool-pressure/EVIDENCE.md`
+
+The prototype uses only `fold` by a local path and `serde`. It has no
+network client and makes no external writes beyond its own temporary test
+directories.
+
+## What the prototype compares
+
+### Existing newline-file baseline
+
+The baseline is a deterministic streaming model, not a disk implementation.
+It generates one million events with the required exact priority mix:
+
+- 850,000 debug
+- 120,000 operational
+- 30,000 critical
+
+Payloads range from 100 bytes to 8 KiB. The model rolls 4 MiB newline files,
+caps retained file bytes at 256 MiB, deletes the oldest whole file, and
+models the duplicate window from retrying a whole file after a mid-file
+disconnect.
+
+Observed result:
+
+- Generated: 1,000,000
+- Retained: 770,212
+- Retained modeled bytes: 267,030,039, below 256 MiB
+- Deleted as oldest: 229,788
+- Critical events deleted: 6,894
+- Security events deleted: 4,596
+- Hardware-failure events deleted: 2,298
+- One modeled whole-file retry exposes up to 12,064 events to duplication
+- Model runtime: 79-89 ms in the final runs
+
+The age-only policy therefore allows bulk debug traffic to delete critical
+events, and whole-file retry creates a large unexplained duplicate window
+unless the daemon records the active file and offset.
+
+### Fold candidate
+
+The candidate uses one Fold stream with four durable views:
+
+1. A priority-ordered event bag.
+2. Per-priority and per-category retained counts and logical bytes.
+3. Drop counts keyed by priority, category, and reason.
+4. A durable upload intent that contains the attempted batch.
+
+The first serialized event field is a priority rank. Fold documents that a
+Bag iterates in postcard-encoded order, so reads return critical,
+operational, then debug events. When a higher-priority event needs room, the
+prototype removes the oldest eligible lower-priority records and increments
+their drop counters in the same transaction.
+
+Before upload, the candidate stores and checkpoints an intent. After the
+collector accepts the batch, it removes the retained events and the intent
+in one transaction. If the process dies after sending but before that
+transaction, every intended event remains retained. The intent gives a
+conservative possible-duplicate count.
+
+## Verified results
+
+### Representative priority and quota workload
+
+The real Fold-backed run used 20,000 generated events and a 4 MiB logical
+limit.
+
+- Retained: 13,319
+- Retained logical bytes: 4,194,221
+- Allocated database bytes: 6,676,480
+- Apparent database file bytes: 67,138,588
+- Critical retained: all 600 generated
+- Operational retained: all 2,400 generated
+- Debug retained: 10,319
+- Debug evicted for higher priority: 1,024
+- Incoming debug dropped for lack of eligible space: 5,657
+- Runtime: 8.0–9.2 seconds across reviewed and final archive runs
+
+The run preserves critical and operational events ahead of debug events and
+accounts for every drop in this representative scope. It also shows that
+logical byte accounting is not a disk cap. The demonstrated candidate stage
+processed roughly 2,200–2,500 events per second when its checkpoints and
+verification were included. This is below the scenario's
+5,000-events-per-second burst and is a prototype limitation, not a general Fold
+throughput result.
+
+### Crash while a write transaction is open
+
+The parent created and checkpointed one event. A child process began a
+100-event transaction and exited with code 72 after its fiftieth insert,
+before the transaction returned.
+
+After reopen:
+
+- Retained count: 1
+- Retained event IDs matched the pre-crash set: true
+- None of the partial transaction appeared
+
+### Crash during upload
+
+The queue held 120 events. A child durably recorded a 25-event upload
+intent, wrote 7 event IDs to the mock collector, and exited with code 73
+before acknowledging the queue.
+
+After reopen:
+
+- Retained count: 120
+- All 120 retained IDs matched: true
+- Reported possible duplicates: 25
+- Recovery and inspection: 4 ms in the final timed runs
+
+The retry sent all 25 intended events:
+
+- Collector deliveries: 32
+- Unique events: 25
+- Actual duplicates: 7
+- Retained after durable acknowledgement: 95
+
+At-least-once delivery is therefore explained: the intent bounds possible
+duplicates at 25, and the mock collector observed the exact 7 already sent
+before the crash.
+
+### Minimal disk-limit failure
+
+The probe used a 1 MiB logical limit. It first added 8 KiB debug events,
+then 8 KiB critical events that evicted debug records.
+
+- Logical limit: 1,048,576 bytes
+- Retained logical bytes: 1,048,512
+- Allocated database bytes from Unix block accounting: 3,305,472
+- Apparent database file bytes: 67,123,220
+- Strict allocated-byte limit satisfied: false
+
+This is the minimal acceptance failure. It does not prove what the exact
+overage would be at 256 MiB. It proves that the prototype's logical control
+loop cannot enforce a hard allocated-byte cap through Fold's public interface.
+External filesystem enforcement was not evaluated.
+
+### Memory
+
+I sampled the final demonstration process every 50 ms with `ps`.
+
+- Simulator maximum sampled resident memory: 19,392 KiB
+- Reviewer maximum sampled resident memory: 19,456 KiB
+- Limit in the brief: 65,536 KiB
+
+This is evidence only for the one-million-event streaming baseline model
+plus the 20,000-event real candidate run. It is not a million-event Fold
+memory claim, and 50 ms sampling can miss a short peak.
+
+## Acceptance audit
+
+| Acceptance item | Result | Evidence boundary |
+| --- | --- | --- |
+| Deterministic one-million-event workload | Partial | The baseline model processes exactly one million events. The Fold candidate was not scaled to one million after the disk-cap prerequisite failed. |
+| Stay within 256 MiB disk and 64 MiB memory | No fit / partial | The 1 MiB probe shows that the public interface's logical accounting is not a hard allocated-byte guarantee. Exact 256 MiB behavior and external quotas were not tested. Sampled host RSS was 19,392–19,456 KiB and may miss short peaks. |
+| Preserve critical ahead of lower priority | Pass, representative | All 600 critical events were retained in the 20,000-event run; only debug events dropped. |
+| Recover every retained event after crashes | Pass, representative | Exact ID sets matched after the interrupted write and interrupted upload cases. |
+| Report possible duplicates | Pass, representative | Intent reported 25 possible; collector observed 7 actual duplicates. |
+| Dropped counts by priority/category/reason | Pass, representative | Durable counters reported 1,024 debug/diagnostics evictions and 5,657 incoming debug/diagnostics drops. |
+| Recovery within two seconds | Pass, representative | Reopen plus exact-ID and intent inspection took 4 ms. |
+| One CPU core | Unresolved | The executable is single-writer, but I did not measure or constrain internal database background threads. |
+| Burst to 5,000 events per second | Unresolved | The candidate stage demonstrated roughly 2,200–2,500 events per second with prototype checkpoint and verification work. No sustained production ingest test was run. |
+
+## Ordered discovery and friction trail
+
+1. I confirmed the assigned checkout and listed only its root README,
+   examples, and Cargo manifests.
+2. I read the public root `README.md` first. It described Fold as a
+   persistent incremental framework and recommended the project generator.
+3. I read the root workspace manifest and the `starter`, `timeseries`,
+   `chat`, and `search` examples in that order. The starter example made the
+   atomic write and persistent Bag pattern clear. The other examples were
+   useful context but not required for this problem.
+4. I did not run `scripts/new-project.sh`. Its README description says it
+   adds `fold`, `anny`, and `ese`; this prototype needs only Fold. I created
+   a standalone crate with a local Fold path instead.
+5. Before selecting Fold, I specified and implemented the age-only
+   newline-file baseline. The one-million-event result demonstrated
+   priority-blind critical loss and whole-file duplicate exposure.
+6. I then inspected Fold's public module documentation and the Stream, Bag,
+   Table, Aggregate, and Retain implementations. Stream transactions, Bag
+   ordering, and Aggregate views fit the atomic accounting problem.
+   Retain did not fit because it is time-based rather than byte- and
+   priority-based.
+7. The first `cargo check` could not resolve `index.crates.io`. I retried
+   with network access and Cargo downloaded the checkout's declared
+   dependencies. No credential or source-code problem was involved.
+8. The first test compile found one method-reference type mismatch in a
+   test. I replaced it with an explicit closure.
+9. The first warnings-denied Clippy run found two manual modulus checks. I
+   used Rust's `is_multiple_of` method and reran the lint successfully.
+10. `/usr/bin/time -l` could not read `kern.clockrate` in the restricted
+    environment. I used `/usr/bin/time -p` for elapsed time and sampled
+    resident memory with `ps` every 50 ms.
+11. My first directory-size helper summed apparent file lengths. A `du`
+    cross-check showed that sparse/preallocated files made that an
+    unsuitable physical-disk measure. I changed the probe to use Unix
+    allocated block counts. Both values remain reported, with the quota
+    decision based on allocated bytes.
+
+## Exact validation commands and results
+
+From `developer-simulation/`:
+
+```console
+cargo test -p edge-spool-pressure --all-targets
+```
+
+Result: 10 passed, 0 failed, 0 ignored.
+
+```console
+cargo fmt --check -p edge-spool-pressure
+```
+
+Result: exit 0 with no formatting differences.
+
+```console
+cargo clippy -p edge-spool-pressure --all-targets -- -D warnings
+```
+
+Result: exit 0 with no warnings.
+
+```console
+cargo build -p edge-spool-pressure --release
+```
+
+Result: optimized build completed successfully.
+
+```console
+/usr/bin/time -p target/release/edge-spool-pressure demo
+```
+
+Result: exit 0. The simulator observed 10.31 seconds and final archive
+verification observed 11.95 seconds. The detailed baseline, candidate, crash,
+retry, and quota results are recorded above.
+
+Final memory sampling command:
+
+```console
+target/release/edge-spool-pressure demo &
+devsim_pid=$!
+devsim_max_rss=0
+while kill -0 $devsim_pid 2>/dev/null; do
+  devsim_rss=$(ps -o rss= -p $devsim_pid | tr -d ' ')
+  if [[ -n $devsim_rss && $devsim_rss -gt $devsim_max_rss ]]; then
+    devsim_max_rss=$devsim_rss
+  fi
+  sleep 0.05
+done
+wait $devsim_pid
+```
+
+Result: exit 0; the simulator sampled 19,392 KiB maximum RSS and the reviewer
+sampled 19,456 KiB. The 50 ms interval can miss short peaks.
+
+## Categorized findings
+
+### Baseline correctness defect: age-only deletion loses critical events
+
+- Severity: high
+- Confidence: high
+- Scope: defect in the supplied newline-file baseline, not in BogKit
+- Evidence: The deterministic baseline deleted 6,894 critical events,
+  including 4,596 security and 2,298 hardware-failure events.
+- Reproduction: Run the `baseline` command or the full demo.
+- Smallest plausible improvement: Separate files or byte budgets by
+  priority, and record every eviction with priority, category, and reason.
+
+### Baseline correctness defect: whole-file retry has a large explanation gap
+
+- Severity: high
+- Confidence: high
+- Scope: defect in the supplied newline-file baseline, not in BogKit
+- Evidence: The modeled first retained file contains 12,064 events. A
+  disconnect after any prefix followed by whole-file retry exposes that prefix
+  to duplication, while the baseline has no durable request intent or offset.
+- Reproduction: Run the `baseline` command.
+- Smallest plausible improvement: Durably record the exact attempted batch
+  before sending, then clear it atomically with retained-event
+  acknowledgement.
+
+### Prototype limitation: existing ranked range scans were not evaluated
+
+- Severity: informational
+- Confidence: high that the trial left an alternative untested; low that Fold
+  itself causes the observed throughput
+- Evidence: The prototype uses a full Bag iterator for priority eviction and
+  its candidate stage processed roughly 2,200–2,500 events per second. Fold
+  already exposes `Ranked` range scans over tuple scores, but the trial did not
+  try that API.
+- Reproduction: Run the 20,000-event demo and inspect the eviction path.
+- Smallest plausible improvement: Evaluate the existing `Ranked` API before
+  proposing any range-scan or eviction API.
+
+### API friction: removal requires reproducing the full event
+
+- Severity: informational
+- Confidence: medium
+- Evidence: `Stream::remove` needs the exact original value. The upload
+  intent stores full event copies so acknowledgement can retract them.
+  `KeyedStream` removes by key, but its primary table does not have a public
+  iterator; adding a terminal Table would duplicate payload storage.
+- Reproduction: Inspect `acknowledge_upload` and compare it with Fold's
+  `Stream` and `KeyedStream` APIs.
+- Smallest plausible improvement: None from this one trial. Evaluate
+  `KeyedStream` and bounded intent representations before proposing an API.
+
+### Documentation gap: no edge-storage suitability boundary
+
+- Severity: medium
+- Confidence: high
+- Evidence: The root README explains persistence and atomic writes, but it
+  does not discuss allocated disk growth, compaction, database minimums,
+  hard quotas, write amplification, or memory/thread bounds. I had to read
+  implementation files and build the quota probe.
+- Reproduction: Start from the root README and examples as instructed.
+- Smallest plausible improvement: Add a “storage limits and durability”
+  section with hard-limit non-goals, allocated-vs-logical sizing, process
+  crash vs power-loss guarantees, and operational sizing guidance.
+
+### Missing scenario capability: hard allocated-byte quota
+
+- Severity: critical
+- Confidence: high that the public interface has no documented hard-cap
+  guarantee; medium for behavior at exactly 256 MiB because that scale was not
+  run
+- Evidence: A 1 MiB logical limit produced 3,305,472 allocated bytes. Fold
+  exposes checkpointing but no public allocated-byte quota or compaction
+  control.
+- Reproduction: Run `quota-probe` in a new directory.
+- Smallest plausible improvement: Document hard allocated-byte limits as an
+  unsupported boundary. Consider admission control, compaction reserve, and
+  allocated-byte telemetry only if strict quotas are an intended use case.
+
+### Poor product fit: strict bounded edge spool
+
+- Severity: critical
+- Confidence: high
+- Evidence: The candidate passes representative transaction, recovery,
+  priority, duplicate, and accounting checks but fails the disk-bound
+  prerequisite.
+- Reproduction: Run the full demo.
+- Smallest plausible improvement: Use a storage engine designed for a hard
+  ring/segment budget, while retaining Fold only for small derived counters
+  if its own database allocation is separately bounded.
+
+## Decision audit
+
+### Consequential choices
+
+- I evaluated the newline-file baseline before selecting a candidate.
+- I used `Stream` plus Bag rather than KeyedStream. This avoids storing every
+  payload in both the KeyedStream root and a separately iterable Table.
+- I put the priority rank first in the serialized Event so the documented
+  Bag order provides critical-first upload without an in-memory sort.
+- I made eviction and drop accounting one Fold transaction.
+- I made upload intent durable before collector delivery and cleared it in
+  the same transaction as retained-event removal.
+- I kept upload batches small, so storing full events in the intent stays
+  bounded in this prototype.
+- I based the no-fit decision on allocated Unix blocks, not apparent file
+  lengths.
+
+### Rejected alternatives
+
+- `Retain`: It expires by elapsed time and cannot express byte pressure or
+  priority preservation.
+- `TopK`: It is count-based, not byte-based, and does not provide the
+  required durable drop reason accounting.
+- `KeyedStream` plus terminal Table: It enables removal by ID but duplicates
+  payloads and still does not provide a hard disk cap.
+- Direct use of Fold's internal Fjall store: It would bypass the public
+  BogKit interface and still require designing compaction headroom and
+  quota guarantees.
+- Exactly-once delivery: Explicitly outside scope and unnecessary; durable
+  intent makes at-least-once behavior explainable.
+- Scaling the Fold candidate to one million events: Rejected after the
+  minimal disk-limit prerequisite failed. Doing so would add runtime and
+  disk cost without changing the fit decision.
+- `Ranked` range scans: Not evaluated. This is why the review rejected the
+  trial's proposed range-scan API and performance attribution.
+
+### Unresolved uncertainty
+
+- Exact allocated-byte behavior at a 256 MiB logical limit.
+- Sustained ingest at 5,000 events per second.
+- One-million-event Fold recovery time and memory.
+- Behavior under power loss rather than process termination.
+- Behavior when the operating system terminates the process during the
+  storage engine's own commit sequence.
+- Internal database background-thread CPU use under compaction.
+- Long-running allocated space after multiple compaction cycles.
+- Enforcement through an external filesystem quota.
+- A real HTTP client's buffering and disconnect behavior; the mock
+  collector persists event IDs locally.
+- Cross-version stability of a schema that deliberately relies on postcard
+  field ordering.
+
+These uncertainties do not overturn the no-fit decision because the required
+hard-cap guarantee is absent from the public interface the trial evaluated.
diff --git a/developer-simulation/runs/2026-07-29--edge-spool-pressure/README.md b/developer-simulation/runs/2026-07-29--edge-spool-pressure/README.md
new file mode 100644
index 0000000..18054ea
--- /dev/null
+++ b/developer-simulation/runs/2026-07-29--edge-spool-pressure/README.md
@@ -0,0 +1,46 @@
+# Edge spool pressure prototype
+
+This local executable compares:
+
+1. A streaming model of the current age-based newline-file queue.
+2. A small Fold-backed priority spool.
+
+The candidate intentionally stops short of claiming production fit. Fold
+provides useful atomic, crash-safe state, but its public interface does not
+provide a hard allocated-disk quota guarantee. The `quota-probe` command
+demonstrates why logical accounting alone cannot enforce that requirement.
+
+Run from `developer-simulation/`.
+
+Run the tests and strict lint:
+
+```console
+cargo test -p edge-spool-pressure --all-targets
+cargo clippy -p edge-spool-pressure --all-targets -- -D warnings
+```
+
+Run all representative checks:
+
+```console
+cargo run -p edge-spool-pressure --release -- demo
+```
+
+Run only the deterministic one-million-event baseline model:
+
+```console
+cargo run -p edge-spool-pressure --release -- baseline
+```
+
+Run a quota probe in a new directory:
+
+```console
+cargo run -p edge-spool-pressure --release -- quota-probe /tmp/bogkit-quota-probe
+```
+
+The demo creates a unique directory under the operating system temporary
+directory and prints the path. It does not delete prior runs.
+
+The 1 MiB probe shows that retained logical bytes can stay under their limit
+while allocated database bytes exceed it. It does not predict exact allocation
+at 256 MiB or evaluate an external filesystem quota. See
+[`EVIDENCE.md`](EVIDENCE.md) for the bounded decision audit.
diff --git a/developer-simulation/runs/2026-07-29--edge-spool-pressure/src/main.rs b/developer-simulation/runs/2026-07-29--edge-spool-pressure/src/main.rs
new file mode 100644
index 0000000..18d171e
--- /dev/null
+++ b/developer-simulation/runs/2026-07-29--edge-spool-pressure/src/main.rs
@@ -0,0 +1,1154 @@
+use std::collections::{BTreeMap, HashSet, VecDeque};
+use std::env;
+use std::fs::{self, File, OpenOptions};
+use std::io::{BufRead, BufReader, Write};
+use std::os::unix::fs::MetadataExt;
+use std::path::{Path, PathBuf};
+use std::process::{Command, ExitCode};
+use std::time::{Instant, SystemTime, UNIX_EPOCH};
+
+use fold::pipeline::terminal::{self, Bag, Table};
+use fold::pipeline::{Aggregate, FilterMap, KeyBy};
+use fold::stream::Stream;
+use serde::{Deserialize, Serialize};
+
+const MIB: u64 = 1024 * 1024;
+const BASELINE_CAPACITY: u64 = 256 * MIB;
+const BASELINE_FILE_SIZE: u64 = 4 * MIB;
+const MILLION: u64 = 1_000_000;
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, PartialOrd, Ord, Serialize, Deserialize)]
+#[repr(u8)]
+enum Priority {
+    Critical = 0,
+    Operational = 1,
+    Debug = 2,
+}
+
+impl Priority {
+    fn name(self) -> &'static str {
+        match self {
+            Self::Critical => "critical",
+            Self::Operational => "operational",
+            Self::Debug => "debug",
+        }
+    }
+
+    fn from_rank(rank: u8) -> Self {
+        match rank {
+            0 => Self::Critical,
+            1 => Self::Operational,
+            _ => Self::Debug,
+        }
+    }
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, PartialOrd, Ord, Serialize, Deserialize)]
+#[repr(u8)]
+enum Category {
+    Security = 0,
+    HardwareFailure = 1,
+    Operations = 2,
+    Diagnostics = 3,
+}
+
+impl Category {
+    fn name(self) -> &'static str {
+        match self {
+            Self::Security => "security",
+            Self::HardwareFailure => "hardware_failure",
+            Self::Operations => "operations",
+            Self::Diagnostics => "diagnostics",
+        }
+    }
+
+    fn from_rank(rank: u8) -> Self {
+        match rank {
+            0 => Self::Security,
+            1 => Self::HardwareFailure,
+            2 => Self::Operations,
+            _ => Self::Diagnostics,
+        }
+    }
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, PartialOrd, Ord, Serialize, Deserialize)]
+#[repr(u8)]
+enum DropReason {
+    IncomingLowerPriority = 0,
+    EvictedForHigherPriority = 1,
+    EventExceedsLogicalQuota = 2,
+}
+
+impl DropReason {
+    fn name(self) -> &'static str {
+        match self {
+            Self::IncomingLowerPriority => "incoming_lower_priority",
+            Self::EvictedForHigherPriority => "evicted_for_higher_priority",
+            Self::EventExceedsLogicalQuota => "event_exceeds_logical_quota",
+        }
+    }
+
+    fn from_rank(rank: u8) -> Self {
+        match rank {
+            0 => Self::IncomingLowerPriority,
+            1 => Self::EvictedForHigherPriority,
+            _ => Self::EventExceedsLogicalQuota,
+        }
+    }
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+struct Event {
+    // This field is first so Bag's documented postcard ordering yields
+    // critical, then operational, then debug records.
+    priority_rank: u8,
+    id_be: [u8; 8],
+    gateway_id: [u8; 8],
+    timestamp_ms_be: [u8; 8],
+    category_rank: u8,
+    accounted_bytes: u32,
+    payload: Vec<u8>,
+}
+
+impl Event {
+    fn id(&self) -> u64 {
+        u64::from_be_bytes(self.id_be)
+    }
+
+    fn priority(&self) -> Priority {
+        Priority::from_rank(self.priority_rank)
+    }
+
+    fn category(&self) -> Category {
+        Category::from_rank(self.category_rank)
+    }
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+struct UploadIntent {
+    attempt: u64,
+    events: Vec<Event>,
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, PartialOrd, Ord, Serialize, Deserialize)]
+struct QueueKey {
+    priority_rank: u8,
+    category_rank: u8,
+}
+
+#[derive(Debug, Clone, Copy, Default, PartialEq, Eq, Serialize, Deserialize)]
+struct QueueStats {
+    count: i64,
+    bytes: i64,
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
+struct DropFact {
+    priority_rank: u8,
+    category_rank: u8,
+    reason_rank: u8,
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, PartialOrd, Ord, Serialize, Deserialize)]
+struct DropKey {
+    priority_rank: u8,
+    category_rank: u8,
+    reason_rank: u8,
+}
+
+#[derive(Debug, Clone)]
+enum Mutation {
+    Queue(Event),
+    Drop(DropFact),
+    Upload(UploadIntent),
+}
+
+fn mutation_event(value: &Mutation) -> Option<Event> {
+    match value {
+        Mutation::Queue(event) => Some(event.clone()),
+        _ => None,
+    }
+}
+
+fn mutation_drop(value: &Mutation) -> Option<DropFact> {
+    match value {
+        Mutation::Drop(drop) => Some(*drop),
+        _ => None,
+    }
+}
+
+fn mutation_upload(value: &Mutation) -> Option<UploadIntent> {
+    match value {
+        Mutation::Upload(intent) => Some(intent.clone()),
+        _ => None,
+    }
+}
+
+fn queue_key(event: &Event) -> QueueKey {
+    QueueKey {
+        priority_rank: event.priority_rank,
+        category_rank: event.category_rank,
+    }
+}
+
+fn queue_step(stats: &mut QueueStats, event: &Event, delta: isize) {
+    stats.count += delta as i64;
+    stats.bytes += i64::from(event.accounted_bytes) * delta as i64;
+}
+
+fn drop_key(drop: &DropFact) -> DropKey {
+    DropKey {
+        priority_rank: drop.priority_rank,
+        category_rank: drop.category_rank,
+        reason_rank: drop.reason_rank,
+    }
+}
+
+fn drop_step(count: &mut i64, _drop: &DropFact, delta: isize) {
+    *count += delta as i64;
+}
+
+type EventBranch = FilterMap<fn(&Mutation) -> Option<Event>, Bag<Event>, Mutation, Event>;
+type QueueAggregate = Aggregate<
+    QueueKey,
+    Event,
+    QueueStats,
+    fn(&mut QueueStats, &Event, isize),
+    Table<QueueKey, QueueStats>,
+>;
+type QueueBranch = FilterMap<
+    fn(&Mutation) -> Option<Event>,
+    KeyBy<fn(&Event) -> QueueKey, QueueAggregate, QueueKey, Event>,
+    Mutation,
+    Event,
+>;
+type DropAggregate =
+    Aggregate<DropKey, DropFact, i64, fn(&mut i64, &DropFact, isize), Table<DropKey, i64>>;
+type DropBranch = FilterMap<
+    fn(&Mutation) -> Option<DropFact>,
+    KeyBy<fn(&DropFact) -> DropKey, DropAggregate, DropKey, DropFact>,
+    Mutation,
+    DropFact,
+>;
+type IntentBranch =
+    FilterMap<fn(&Mutation) -> Option<UploadIntent>, Bag<UploadIntent>, Mutation, UploadIntent>;
+type SpoolPipeline = (EventBranch, QueueBranch, DropBranch, IntentBranch);
+
+fn pipeline() -> SpoolPipeline {
+    (
+        FilterMap::new(
+            mutation_event as fn(&Mutation) -> Option<Event>,
+            terminal::Bag::new("queued_events"),
+        ),
+        FilterMap::new(
+            mutation_event as fn(&Mutation) -> Option<Event>,
+            KeyBy::new(
+                queue_key as fn(&Event) -> QueueKey,
+                Aggregate::new(
+                    "queue_stats_aggregate",
+                    queue_step as fn(&mut QueueStats, &Event, isize),
+                    terminal::Table::new("queue_stats"),
+                ),
+            ),
+        ),
+        FilterMap::new(
+            mutation_drop as fn(&Mutation) -> Option<DropFact>,
+            KeyBy::new(
+                drop_key as fn(&DropFact) -> DropKey,
+                Aggregate::new(
+                    "drop_counts_aggregate",
+                    drop_step as fn(&mut i64, &DropFact, isize),
+                    terminal::Table::new("drop_counts"),
+                ),
+            ),
+        ),
+        FilterMap::new(
+            mutation_upload as fn(&Mutation) -> Option<UploadIntent>,
+            terminal::Bag::new("upload_intents"),
+        ),
+    )
+}
+
+struct Spool {
+    stream: Stream<Mutation, SpoolPipeline>,
+    logical_quota: u64,
+}
+
+#[derive(Debug, Default)]
+struct SpoolSnapshot {
+    retained_count: u64,
+    logical_bytes: u64,
+    retained_by_priority: BTreeMap<&'static str, u64>,
+    drops: BTreeMap<String, u64>,
+    intent: Option<UploadIntent>,
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+enum EnqueueOutcome {
+    Retained,
+    Dropped,
+}
+
+impl Spool {
+    fn open(path: &Path, logical_quota: u64) -> Self {
+        Self {
+            stream: Stream::new(path, pipeline()),
+            logical_quota,
+        }
+    }
+
+    fn checkpoint(&mut self) {
+        self.stream.checkpoint();
+    }
+
+    fn snapshot(&self) -> SpoolSnapshot {
+        self.stream.rtx(|(_events, queue_stats, drops, intents)| {
+            let mut snapshot = SpoolSnapshot::default();
+            for (key, stats) in queue_stats.iter() {
+                let count = u64::try_from(stats.count).expect("negative queue count");
+                let bytes = u64::try_from(stats.bytes).expect("negative queue bytes");
+                snapshot.retained_count += count;
+                snapshot.logical_bytes += bytes;
+                *snapshot
+                    .retained_by_priority
+                    .entry(Priority::from_rank(key.priority_rank).name())
+                    .or_default() += count;
+            }
+            for (key, count) in drops.iter() {
+                let label = format!(
+                    "{}/{}/{}",
+                    Priority::from_rank(key.priority_rank).name(),
+                    Category::from_rank(key.category_rank).name(),
+                    DropReason::from_rank(key.reason_rank).name()
+                );
+                snapshot
+                    .drops
+                    .insert(label, u64::try_from(count).expect("negative drop count"));
+            }
+            snapshot.intent = intents.iter().next().map(|(intent, _)| intent);
+
+            snapshot
+        })
+    }
+
+    fn verify_consistency(&self) {
+        let expected = self.snapshot().retained_count;
+        let bag_count = self.stream.rtx(|(events, _, _, _)| {
+            events
+                .iter()
+                .map(|(_, multiplicity)| {
+                    u64::try_from(multiplicity).expect("negative multiplicity")
+                })
+                .sum::<u64>()
+        });
+        assert_eq!(
+            bag_count, expected,
+            "event Bag and aggregate count diverged"
+        );
+    }
+
+    fn enqueue(&mut self, event: Event) -> EnqueueOutcome {
+        let snapshot = self.snapshot();
+        let event_bytes = u64::from(event.accounted_bytes);
+
+        if event_bytes > self.logical_quota {
+            self.record_drop(&event, DropReason::EventExceedsLogicalQuota);
+            return EnqueueOutcome::Dropped;
+        }
+
+        if snapshot.logical_bytes + event_bytes <= self.logical_quota {
+            self.stream
+                .wtx(|tx| tx.insert(&Mutation::Queue(event.clone())));
+            return EnqueueOutcome::Retained;
+        }
+
+        let needed = snapshot.logical_bytes + event_bytes - self.logical_quota;
+        let eviction_ranks: &[u8] = match event.priority() {
+            Priority::Critical => &[Priority::Debug as u8, Priority::Operational as u8],
+            Priority::Operational => &[Priority::Debug as u8],
+            Priority::Debug => &[],
+        };
+
+        let evictions = self.stream.rtx(|(events, _, _, _)| {
+            let mut chosen = Vec::new();
+            let mut reclaimed = 0_u64;
+            for wanted_rank in eviction_ranks {
+                for (candidate, multiplicity) in events.iter() {
+                    if candidate.priority_rank != *wanted_rank {
+                        continue;
+                    }
+                    for _ in 0..multiplicity {
+                        reclaimed += u64::from(candidate.accounted_bytes);
+                        chosen.push(candidate.clone());
+                        if reclaimed >= needed {
+                            return chosen;
+                        }
+                    }
+                }
+            }
+            chosen
+        });
+
+        let reclaimed: u64 = evictions
+            .iter()
+            .map(|candidate| u64::from(candidate.accounted_bytes))
+            .sum();
+        if reclaimed < needed {
+            self.record_drop(&event, DropReason::IncomingLowerPriority);
+            return EnqueueOutcome::Dropped;
+        }
+
+        self.stream.wtx(|tx| {
+            for candidate in &evictions {
+                tx.remove(&Mutation::Queue(candidate.clone()));
+                tx.insert(&Mutation::Drop(DropFact {
+                    priority_rank: candidate.priority_rank,
+                    category_rank: candidate.category_rank,
+                    reason_rank: DropReason::EvictedForHigherPriority as u8,
+                }));
+            }
+            tx.insert(&Mutation::Queue(event));
+        });
+        EnqueueOutcome::Retained
+    }
+
+    fn record_drop(&mut self, event: &Event, reason: DropReason) {
+        self.stream.wtx(|tx| {
+            tx.insert(&Mutation::Drop(DropFact {
+                priority_rank: event.priority_rank,
+                category_rank: event.category_rank,
+                reason_rank: reason as u8,
+            }))
+        });
+    }
+
+    fn ordered_events(&self, limit: usize) -> Vec<Event> {
+        self.stream.rtx(|(events, _, _, _)| {
+            let mut selected = Vec::with_capacity(limit);
+            for (event, multiplicity) in events.iter() {
+                for _ in 0..multiplicity {
+                    selected.push(event.clone());
+                    if selected.len() == limit {
+                        return selected;
+                    }
+                }
+            }
+            selected
+        })
+    }
+
+    fn prepare_upload(&mut self, limit: usize, attempt: u64) -> Option<UploadIntent> {
+        if let Some(intent) = self.snapshot().intent {
+            return Some(intent);
+        }
+        let events = self.ordered_events(limit);
+        if events.is_empty() {
+            return None;
+        }
+        let intent = UploadIntent { attempt, events };
+        self.stream
+            .wtx(|tx| tx.insert(&Mutation::Upload(intent.clone())));
+        Some(intent)
+    }
+
+    fn acknowledge_upload(&mut self, intent: &UploadIntent) {
+        self.stream.wtx(|tx| {
+            for event in &intent.events {
+                tx.remove(&Mutation::Queue(event.clone()));
+            }
+            tx.remove(&Mutation::Upload(intent.clone()));
+        });
+    }
+}
+
+#[derive(Debug, Clone, Copy, Default)]
+struct BaselineBucket {
+    debug: u64,
+    operational: u64,
+    critical: u64,
+    security: u64,
+    hardware_failure: u64,
+}
+
+impl BaselineBucket {
+    fn add(&mut self, event: &Event) {
+        match event.priority() {
+            Priority::Debug => self.debug += 1,
+            Priority::Operational => self.operational += 1,
+            Priority::Critical => self.critical += 1,
+        }
+        match event.category() {
+            Category::Security => self.security += 1,
+            Category::HardwareFailure => self.hardware_failure += 1,
+            _ => {}
+        }
+    }
+
+    fn merge(&mut self, other: Self) {
+        self.debug += other.debug;
+        self.operational += other.operational;
+        self.critical += other.critical;
+        self.security += other.security;
+        self.hardware_failure += other.hardware_failure;
+    }
+
+    fn total(self) -> u64 {
+        self.debug + self.operational + self.critical
+    }
+}
+
+#[derive(Debug, Default)]
+struct FileSummary {
+    bytes: u64,
+    events: BaselineBucket,
+}
+
+#[derive(Debug)]
+struct BaselineResult {
+    generated: BaselineBucket,
+    retained: BaselineBucket,
+    dropped_oldest: BaselineBucket,
+    retained_bytes: u64,
+    files: usize,
+    possible_duplicates_after_mid_file_disconnect: u64,
+}
+
+fn simulate_baseline(count: u64) -> BaselineResult {
+    let mut files = VecDeque::new();
+    let mut current = FileSummary::default();
+    let mut generated = BaselineBucket::default();
+    let mut dropped_oldest = BaselineBucket::default();
+    let mut retained_bytes = 0_u64;
+
+    for sequence in 0..count {
+        let event = synthetic_event(sequence);
+        let line_bytes = u64::from(event.accounted_bytes) + 32;
+        if current.bytes > 0 && current.bytes + line_bytes > BASELINE_FILE_SIZE {
+            retained_bytes += current.bytes;
+            files.push_back(current);
+            current = FileSummary::default();
+        }
+        current.bytes += line_bytes;
+        current.events.add(&event);
+        generated.add(&event);
+
+        while retained_bytes + current.bytes > BASELINE_CAPACITY {
+            let Some(deleted) = files.pop_front() else {
+                break;
+            };
+            retained_bytes -= deleted.bytes;
+            dropped_oldest.merge(deleted.events);
+        }
+    }
+
+    if current.bytes > 0 {
+        retained_bytes += current.bytes;
+        files.push_back(current);
+    }
+    while retained_bytes > BASELINE_CAPACITY {
+        let deleted = files
+            .pop_front()
+            .expect("baseline queue unexpectedly empty");
+        retained_bytes -= deleted.bytes;
+        dropped_oldest.merge(deleted.events);
+    }
+
+    let mut retained = BaselineBucket::default();
+    for file in &files {
+        retained.merge(file.events);
+    }
+    let possible_duplicates_after_mid_file_disconnect =
+        files.front().map_or(0, |file| file.events.total());
+
+    BaselineResult {
+        generated,
+        retained,
+        dropped_oldest,
+        retained_bytes,
+        files: files.len(),
+        possible_duplicates_after_mid_file_disconnect,
+    }
+}
+
+fn splitmix64(mut value: u64) -> u64 {
+    value = value.wrapping_add(0x9e37_79b9_7f4a_7c15);
+    value = (value ^ (value >> 30)).wrapping_mul(0xbf58_476d_1ce4_e5b9);
+    value = (value ^ (value >> 27)).wrapping_mul(0x94d0_49bb_1331_11eb);
+    value ^ (value >> 31)
+}
+
+fn synthetic_event(sequence: u64) -> Event {
+    let percentile = sequence % 100;
+    let (priority, category) = if percentile < 3 {
+        let category = if sequence.is_multiple_of(2) {
+            Category::Security
+        } else {
+            Category::HardwareFailure
+        };
+        (Priority::Critical, category)
+    } else if percentile < 15 {
+        (Priority::Operational, Category::Operations)
+    } else {
+        (Priority::Debug, Category::Diagnostics)
+    };
+    let payload_len = if sequence.is_multiple_of(10_000) {
+        8 * 1024
+    } else {
+        100 + usize::try_from(splitmix64(sequence) % 301).expect("payload size")
+    };
+    let prefix = format!("{{\"event_id\":{sequence},\"data\":\"");
+    let suffix = "\"}";
+    let filler_len = payload_len.saturating_sub(prefix.len() + suffix.len());
+    let mut payload = Vec::with_capacity(prefix.len() + filler_len + suffix.len());
+    payload.extend_from_slice(prefix.as_bytes());
+    payload.extend(std::iter::repeat_n(b'x', filler_len));
+    payload.extend_from_slice(suffix.as_bytes());
+
+    Event {
+        priority_rank: priority as u8,
+        id_be: sequence.to_be_bytes(),
+        gateway_id: 7_u64.to_be_bytes(),
+        timestamp_ms_be: (1_700_000_000_000_u64 + sequence).to_be_bytes(),
+        category_rank: category as u8,
+        accounted_bytes: u32::try_from(payload.len() + 64).expect("event too large"),
+        payload,
+    }
+}
+
+fn append_collector(path: &Path, events: &[Event]) -> std::io::Result<()> {
+    let mut file = OpenOptions::new().create(true).append(true).open(path)?;
+    for event in events {
+        writeln!(file, "{}", event.id())?;
+    }
+    file.sync_all()
+}
+
+#[derive(Debug, Default)]
+struct CollectorSummary {
+    deliveries: u64,
+    unique: u64,
+    duplicates: u64,
+}
+
+fn collector_summary(path: &Path) -> std::io::Result<CollectorSummary> {
+    let file = File::open(path)?;
+    let mut seen = HashSet::new();
+    let mut deliveries = 0_u64;
+    let mut duplicates = 0_u64;
+    for line in BufReader::new(file).lines() {
+        let id: u64 = line?.parse().expect("collector id is numeric");
+        deliveries += 1;
+        if !seen.insert(id) {
+            duplicates += 1;
+        }
+    }
+    Ok(CollectorSummary {
+        deliveries,
+        unique: u64::try_from(seen.len()).expect("collector length"),
+        duplicates,
+    })
+}
+
+#[derive(Debug, Default)]
+struct DirectoryUsage {
+    apparent_bytes: u64,
+    allocated_bytes: u64,
+}
+
+fn directory_usage(path: &Path) -> std::io::Result<DirectoryUsage> {
+    fn visit(path: &Path, usage: &mut DirectoryUsage) -> std::io::Result<()> {
+        for entry in fs::read_dir(path)? {
+            let entry = entry?;
+            let metadata = entry.metadata()?;
+            if metadata.is_dir() {
+                visit(&entry.path(), usage)?;
+            } else {
+                usage.apparent_bytes += metadata.len();
+                usage.allocated_bytes += metadata.blocks() * 512;
+            }
+        }
+        Ok(())
+    }
+
+    let mut usage = DirectoryUsage::default();
+    visit(path, &mut usage)?;
+    Ok(usage)
+}
+
+fn unique_demo_root() -> PathBuf {
+    let now = SystemTime::now()
+        .duration_since(UNIX_EPOCH)
+        .expect("clock before epoch")
+        .as_millis();
+    env::temp_dir().join(format!("edge-spool-pressure-{}-{now}", std::process::id()))
+}
+
+fn print_baseline(result: &BaselineResult) {
+    println!(
+        "baseline: generated={} retained={} bytes={} files={} dropped_oldest={}",
+        result.generated.total(),
+        result.retained.total(),
+        result.retained_bytes,
+        result.files,
+        result.dropped_oldest.total()
+    );
+    println!(
+        "baseline: dropped critical={} security={} hardware_failure={}",
+        result.dropped_oldest.critical,
+        result.dropped_oldest.security,
+        result.dropped_oldest.hardware_failure
+    );
+    println!(
+        "baseline: modeled whole-file retry exposes up to {} retained events to duplication",
+        result.possible_duplicates_after_mid_file_disconnect
+    );
+}
+
+fn run_demo() -> Result<(), Box<dyn std::error::Error>> {
+    let root = unique_demo_root();
+    fs::create_dir_all(&root)?;
+    println!("demo_root={}", root.display());
+
+    let baseline_started = Instant::now();
+    let baseline = simulate_baseline(MILLION);
+    print_baseline(&baseline);
+    println!(
+        "baseline_model_elapsed_ms={}",
+        baseline_started.elapsed().as_millis()
+    );
+    assert_eq!(baseline.generated.total(), MILLION);
+    assert!(baseline.dropped_oldest.critical > 0);
+    assert!(baseline.retained_bytes <= BASELINE_CAPACITY);
+
+    let candidate_path = root.join("candidate");
+    let logical_quota = 4 * MIB;
+    let mut spool = Spool::open(&candidate_path, logical_quota);
+    let ingest_started = Instant::now();
+    for sequence in 0..20_000 {
+        spool.enqueue(synthetic_event(sequence));
+    }
+    spool.checkpoint();
+    spool.verify_consistency();
+    let candidate = spool.snapshot();
+    let candidate_usage = directory_usage(&candidate_path)?;
+    println!(
+        "candidate_representative: generated=20000 retained={} logical_bytes={} allocated_bytes={} apparent_bytes={} elapsed_ms={}",
+        candidate.retained_count,
+        candidate.logical_bytes,
+        candidate_usage.allocated_bytes,
+        candidate_usage.apparent_bytes,
+        ingest_started.elapsed().as_millis()
+    );
+    println!(
+        "candidate_representative: retained_by_priority={:?}",
+        candidate.retained_by_priority
+    );
+    println!("candidate_representative: drops={:?}", candidate.drops);
+    assert!(candidate.logical_bytes <= logical_quota);
+    assert_eq!(
+        candidate.retained_by_priority.get("critical").copied(),
+        Some(600)
+    );
+
+    let crash_write_path = root.join("crash-write");
+    let mut crash_spool = Spool::open(&crash_write_path, MIB);
+    crash_spool.enqueue(synthetic_event(9_000_000));
+    crash_spool.checkpoint();
+    drop(crash_spool);
+    let crash_status = Command::new(env::current_exe()?)
+        .arg("child-crash-write")
+        .arg(&crash_write_path)
+        .status()?;
+    assert_eq!(crash_status.code(), Some(72));
+    let recovered_write_spool = Spool::open(&crash_write_path, MIB);
+    let recovered_after_write_crash = recovered_write_spool.snapshot();
+    let write_ids: Vec<_> = recovered_write_spool
+        .ordered_events(10)
+        .iter()
+        .map(Event::id)
+        .collect();
+    println!(
+        "write_crash_recovery: child_exit={:?} retained={} ids_match={}",
+        crash_status.code(),
+        recovered_after_write_crash.retained_count,
+        write_ids == [9_000_000]
+    );
+    assert_eq!(recovered_after_write_crash.retained_count, 1);
+    assert_eq!(write_ids, [9_000_000]);
+
+    let upload_path = root.join("upload-crash");
+    let collector_path = root.join("collector.log");
+    let mut upload_spool = Spool::open(&upload_path, 8 * MIB);
+    let mut expected_upload_ids = Vec::new();
+    for sequence in 0..120 {
+        let event = synthetic_event(10_000_000 + sequence);
+        expected_upload_ids.push(event.id());
+        upload_spool.enqueue(event);
+    }
+    upload_spool.checkpoint();
+    drop(upload_spool);
+    let upload_crash_status = Command::new(env::current_exe()?)
+        .arg("child-crash-upload")
+        .arg(&upload_path)
+        .arg(&collector_path)
+        .status()?;
+    assert_eq!(upload_crash_status.code(), Some(73));
+
+    let recovery_started = Instant::now();
+    let mut recovered_spool = Spool::open(&upload_path, 8 * MIB);
+    let recovered = recovered_spool.snapshot();
+    recovered_spool.verify_consistency();
+    let mut recovered_upload_ids: Vec<_> = recovered_spool
+        .ordered_events(120)
+        .iter()
+        .map(Event::id)
+        .collect();
+    expected_upload_ids.sort_unstable();
+    recovered_upload_ids.sort_unstable();
+    let recovery_elapsed = recovery_started.elapsed();
+    let intent = recovered.intent.expect("durable upload intent");
+    println!(
+        "upload_crash_recovery: retained={} ids_match={} possible_duplicates={} recovery_ms={}",
+        recovered.retained_count,
+        recovered_upload_ids == expected_upload_ids,
+        intent.events.len(),
+        recovery_elapsed.as_millis()
+    );
+    assert_eq!(recovered.retained_count, 120);
+    assert_eq!(recovered_upload_ids, expected_upload_ids);
+    assert_eq!(intent.events.len(), 25);
+    assert!(recovery_elapsed.as_secs_f64() < 2.0);
+
+    append_collector(&collector_path, &intent.events)?;
+    recovered_spool.acknowledge_upload(&intent);
+    recovered_spool.checkpoint();
+    recovered_spool.verify_consistency();
+    let collector = collector_summary(&collector_path)?;
+    let after_retry = recovered_spool.snapshot();
+    println!(
+        "upload_retry: deliveries={} unique={} actual_duplicates={} retained_after_ack={}",
+        collector.deliveries, collector.unique, collector.duplicates, after_retry.retained_count
+    );
+    assert_eq!(collector.deliveries, 32);
+    assert_eq!(collector.unique, 25);
+    assert_eq!(collector.duplicates, 7);
+    assert_eq!(after_retry.retained_count, 95);
+
+    let quota_path = root.join("quota-probe");
+    let probe = run_quota_probe(&quota_path)?;
+    println!(
+        "quota_probe: logical_quota={} logical_bytes={} allocated_bytes={} apparent_bytes={} strict_quota_satisfied={}",
+        probe.logical_quota,
+        probe.logical_bytes,
+        probe.allocated_bytes,
+        probe.apparent_bytes,
+        probe.allocated_bytes <= probe.logical_quota
+    );
+    assert!(probe.logical_bytes <= probe.logical_quota);
+    assert!(
+        probe.allocated_bytes > probe.logical_quota,
+        "probe did not reproduce physical quota gap"
+    );
+
+    println!("decision=NO_FIT_FOR_STRICT_256_MIB_BOUND");
+    println!(
+        "reason=Fold's public interface has no documented hard allocated-byte quota guarantee"
+    );
+    Ok(())
+}
+
+#[derive(Debug)]
+struct QuotaProbe {
+    logical_quota: u64,
+    logical_bytes: u64,
+    allocated_bytes: u64,
+    apparent_bytes: u64,
+}
+
+fn run_quota_probe(path: &Path) -> Result<QuotaProbe, Box<dyn std::error::Error>> {
+    let logical_quota = MIB;
+    let mut spool = Spool::open(path, logical_quota);
+
+    for sequence in 0..180 {
+        let mut event = synthetic_event(20_000_000 + sequence);
+        event.priority_rank = Priority::Debug as u8;
+        event.category_rank = Category::Diagnostics as u8;
+        event.payload.resize(8 * 1024, b'd');
+        event.accounted_bytes = u32::try_from(event.payload.len() + 64)?;
+        spool.enqueue(event);
+    }
+    for sequence in 0..180 {
+        let mut event = synthetic_event(30_000_000 + sequence);
+        event.priority_rank = Priority::Critical as u8;
+        event.category_rank = Category::Security as u8;
+        event.payload.resize(8 * 1024, b'c');
+        event.accounted_bytes = u32::try_from(event.payload.len() + 64)?;
+        spool.enqueue(event);
+    }
+    spool.checkpoint();
+    spool.verify_consistency();
+    let logical_bytes = spool.snapshot().logical_bytes;
+    drop(spool);
+    let usage = directory_usage(path)?;
+    Ok(QuotaProbe {
+        logical_quota,
+        logical_bytes,
+        allocated_bytes: usage.allocated_bytes,
+        apparent_bytes: usage.apparent_bytes,
+    })
+}
+
+fn child_crash_write(path: &Path) -> ! {
+    let mut spool = Spool::open(path, MIB);
+    spool.stream.wtx(|tx| {
+        for sequence in 0..100 {
+            tx.insert(&Mutation::Queue(synthetic_event(40_000_000 + sequence)));
+            if sequence == 49 {
+                std::process::exit(72);
+            }
+        }
+    });
+    std::process::exit(74);
+}
+
+fn child_crash_upload(path: &Path, collector_path: &Path) -> ! {
+    let mut spool = Spool::open(path, 8 * MIB);
+    let intent = spool
+        .prepare_upload(25, 1)
+        .expect("events available for upload");
+    spool.checkpoint();
+    append_collector(collector_path, &intent.events[..7]).expect("collector append");
+    std::process::exit(73);
+}
+
+fn usage() {
+    eprintln!("usage: edge-spool-pressure [demo|baseline|quota-probe <new-dir>]");
+}
+
+fn main() -> ExitCode {
+    let args: Vec<String> = env::args().collect();
+    let result = match args.get(1).map(String::as_str).unwrap_or("demo") {
+        "demo" => run_demo(),
+        "baseline" => {
+            let started = Instant::now();
+            let result = simulate_baseline(MILLION);
+            print_baseline(&result);
+            println!(
+                "baseline_model_elapsed_ms={}",
+                started.elapsed().as_millis()
+            );
+            Ok(())
+        }
+        "quota-probe" => match args.get(2) {
+            Some(path) => run_quota_probe(Path::new(path)).map(|probe| {
+                println!(
+                    "logical_quota={} logical_bytes={} allocated_bytes={} apparent_bytes={} strict_quota_satisfied={}",
+                    probe.logical_quota,
+                    probe.logical_bytes,
+                    probe.allocated_bytes,
+                    probe.apparent_bytes,
+                    probe.allocated_bytes <= probe.logical_quota
+                );
+            }),
+            None => {
+                usage();
+                return ExitCode::from(2);
+            }
+        },
+        "child-crash-write" => match args.get(2) {
+            Some(path) => child_crash_write(Path::new(path)),
+            None => {
+                usage();
+                return ExitCode::from(2);
+            }
+        },
+        "child-crash-upload" => match (args.get(2), args.get(3)) {
+            (Some(path), Some(collector)) => {
+                child_crash_upload(Path::new(path), Path::new(collector))
+            }
+            _ => {
+                usage();
+                return ExitCode::from(2);
+            }
+        },
+        _ => {
+            usage();
+            return ExitCode::from(2);
+        }
+    };
+
+    match result {
+        Ok(()) => ExitCode::SUCCESS,
+        Err(error) => {
+            eprintln!("error: {error}");
+            ExitCode::FAILURE
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::collections::HashMap;
+
+    fn test_path(name: &str) -> PathBuf {
+        unique_demo_root().join(name)
+    }
+
+    #[test]
+    fn million_event_baseline_is_deterministic_and_loses_critical_events() {
+        let first = simulate_baseline(MILLION);
+        let second = simulate_baseline(MILLION);
+        assert_eq!(first.generated.total(), MILLION);
+        assert_eq!(first.retained.total(), second.retained.total());
+        assert_eq!(
+            first.dropped_oldest.critical,
+            second.dropped_oldest.critical
+        );
+        assert!(first.retained_bytes <= BASELINE_CAPACITY);
+        assert!(first.dropped_oldest.critical > 0);
+        assert!(first.dropped_oldest.security > 0);
+        assert!(first.dropped_oldest.hardware_failure > 0);
+    }
+
+    #[test]
+    fn bag_order_prioritizes_critical_then_operational_then_debug() {
+        let path = test_path("ordering");
+        let mut spool = Spool::open(&path, MIB);
+        spool.enqueue(synthetic_event(99));
+        spool.enqueue(synthetic_event(4));
+        spool.enqueue(synthetic_event(0));
+        let priorities: Vec<_> = spool
+            .ordered_events(3)
+            .into_iter()
+            .map(|event| event.priority())
+            .collect();
+        assert_eq!(
+            priorities,
+            vec![Priority::Critical, Priority::Operational, Priority::Debug]
+        );
+    }
+
+    #[test]
+    fn critical_event_evicts_debug_and_drop_is_accounted() {
+        let path = test_path("eviction");
+        let mut debug = synthetic_event(99);
+        debug.accounted_bytes = 600;
+        let mut critical = synthetic_event(0);
+        critical.accounted_bytes = 600;
+        let mut spool = Spool::open(&path, 600);
+        assert_eq!(spool.enqueue(debug), EnqueueOutcome::Retained);
+        assert_eq!(spool.enqueue(critical), EnqueueOutcome::Retained);
+        let snapshot = spool.snapshot();
+        assert_eq!(snapshot.retained_count, 1);
+        assert_eq!(
+            snapshot.retained_by_priority.get("critical").copied(),
+            Some(1)
+        );
+        assert_eq!(
+            snapshot
+                .drops
+                .get("debug/diagnostics/evicted_for_higher_priority")
+                .copied(),
+            Some(1)
+        );
+    }
+
+    #[test]
+    fn panic_rolls_back_all_fold_views() {
+        let path = test_path("panic");
+        let mut spool = Spool::open(&path, MIB);
+        spool.enqueue(synthetic_event(1));
+        let before = spool.snapshot();
+        let panic_result = std::panic::catch_unwind(std::panic::AssertUnwindSafe(|| {
+            spool.stream.wtx(|tx| {
+                tx.insert(&Mutation::Queue(synthetic_event(2)));
+                tx.insert(&Mutation::Drop(DropFact {
+                    priority_rank: Priority::Debug as u8,
+                    category_rank: Category::Diagnostics as u8,
+                    reason_rank: DropReason::IncomingLowerPriority as u8,
+                }));
+                panic!("injected");
+            });
+        }));
+        assert!(panic_result.is_err());
+        let after = spool.snapshot();
+        assert_eq!(after.retained_count, before.retained_count);
+        assert_eq!(after.logical_bytes, before.logical_bytes);
+        assert_eq!(after.drops, before.drops);
+    }
+
+    #[test]
+    fn upload_intent_and_retained_events_survive_reopen() {
+        let path = test_path("reopen");
+        {
+            let mut spool = Spool::open(&path, MIB);
+            for sequence in 0..20 {
+                spool.enqueue(synthetic_event(sequence));
+            }
+            let intent = spool.prepare_upload(7, 44).expect("upload intent");
+            assert_eq!(intent.events.len(), 7);
+            spool.checkpoint();
+        }
+        let reopened = Spool::open(&path, MIB);
+        let snapshot = reopened.snapshot();
+        assert_eq!(snapshot.retained_count, 20);
+        let mut ids: Vec<_> = reopened.ordered_events(20).iter().map(Event::id).collect();
+        ids.sort_unstable();
+        assert_eq!(ids, (0..20).collect::<Vec<_>>());
+        let intent = snapshot.intent.expect("intent recovered");
+        assert_eq!(intent.attempt, 44);
+        assert_eq!(intent.events.len(), 7);
+    }
+
+    #[test]
+    fn generator_mix_is_exact_for_one_million() {
+        let result = simulate_baseline(MILLION);
+        assert_eq!(result.generated.critical, 30_000);
+        assert_eq!(result.generated.operational, 120_000);
+        assert_eq!(result.generated.debug, 850_000);
+    }
+
+    #[test]
+    fn payload_is_valid_json_shape_and_in_range() {
+        for sequence in [0, 1, 9_999, 10_000, 88_888] {
+            let event = synthetic_event(sequence);
+            assert!(event.payload.starts_with(b"{\"event_id\":"));
+            assert!(event.payload.ends_with(b"\"}"));
+            assert!((100..=8 * 1024).contains(&event.payload.len()));
+        }
+    }
+
+    #[test]
+    fn collector_reports_actual_duplicates() {
+        let path = test_path("collector.log");
+        fs::create_dir_all(path.parent().expect("parent")).expect("create parent");
+        let events: Vec<_> = (0..5).map(synthetic_event).collect();
+        append_collector(&path, &events[..3]).expect("first request");
+        append_collector(&path, &events).expect("retry");
+        let summary = collector_summary(&path).expect("collector summary");
+        assert_eq!(summary.deliveries, 8);
+        assert_eq!(summary.unique, 5);
+        assert_eq!(summary.duplicates, 3);
+    }
+
+    #[test]
+    fn logical_quota_probe_exposes_physical_gap() {
+        let path = test_path("quota");
+        let probe = run_quota_probe(&path).expect("quota probe");
+        assert!(probe.logical_bytes <= probe.logical_quota);
+        assert!(probe.allocated_bytes > probe.logical_quota);
+    }
+
+    #[test]
+    fn drop_key_labels_round_trip() {
+        let mut expected = HashMap::new();
+        expected.insert(Priority::Critical as u8, "critical");
+        expected.insert(Priority::Operational as u8, "operational");
+        expected.insert(Priority::Debug as u8, "debug");
+        for (rank, label) in expected {
+            assert_eq!(Priority::from_rank(rank).name(), label);
+        }
+    }
+}
diff --git a/developer-simulation/runs/2026-07-29--flash-config-journal/Cargo.toml b/developer-simulation/runs/2026-07-29--flash-config-journal/Cargo.toml
new file mode 100644
index 0000000..8aac266
--- /dev/null
+++ b/developer-simulation/runs/2026-07-29--flash-config-journal/Cargo.toml
@@ -0,0 +1,14 @@
+[package]
+name = "flash-config-journal"
+version = "0.0.0"
+edition.workspace = true
+publish.workspace = true
+
+[dependencies]
+
+[lints.rust]
+unsafe_code = "forbid"
+
+[lints.clippy]
+all = "warn"
+pedantic = "allow"
diff --git a/developer-simulation/runs/2026-07-29--flash-config-journal/EVIDENCE.md b/developer-simulation/runs/2026-07-29--flash-config-journal/EVIDENCE.md
new file mode 100644
index 0000000..5ed7561
--- /dev/null
+++ b/developer-simulation/runs/2026-07-29--flash-config-journal/EVIDENCE.md
@@ -0,0 +1,242 @@
+# Blind BogKit trial: flash-config-journal
+
+Completed: 2026-07-29 06:18 EDT
+
+## Outcome
+
+**BogKit is not a fit for this firmware storage problem.** `fold` provides
+transactional application dataflow on a filesystem-backed `fjall` database. It
+does not provide a raw NOR interface, fixed recovery bounds, a `no_std` path, or
+a fixed memory envelope. Using it would import the exact filesystem and
+allocation assumptions that this trial must avoid.
+
+I kept no BogKit dependency. I built a dependency-free reference journal and
+host-side NOR harness in
+`runs/2026-07-29--flash-config-journal`. The journal candidate passes the tested
+emulator checks at the minimum and maximum record sizes. This is not a
+production firmware recommendation: host timing, whole-stack memory, and the
+modeled failure behavior still need measurement on the actual controller and
+NOR part.
+
+## Prototype
+
+The emulated flash is exactly 131,072 bytes: 32 erase blocks of 4,096 bytes.
+Every program checks the NOR 1→0 rule.
+
+Each journal update:
+
+1. Scans the 32 block starts for valid committed records.
+2. Rejects a revision that is not newer than the highest valid revision.
+3. Selects the circular run immediately after the active record. A maximum
+   record uses seven blocks, so it cannot overlap the seven-block active record.
+4. Erases only the selected run.
+5. Streams the payload in 256-byte chunks while computing CRC-32.
+6. Writes a checked 32-byte header.
+7. Writes the one-byte commit marker last.
+
+A boot scan ignores an absent/torn commit, a malformed header, and a payload
+with the wrong checksum. It selects the highest valid revision. Because the
+replacement run never overlaps the active run, each tested interruption sees
+the complete old value until the final commit byte, then the complete new value.
+
+The CLI uses a file-backed emulator. The exhaustive crash and wear tests use an
+in-memory emulator so that each byte boundary can be inspected deterministically.
+Neither emulator claims to reproduce page-program, partial-erase, cache,
+controller, or timing behavior of real NOR.
+
+## Acceptance results
+
+| Requirement | Result | Evidence |
+| --- | --- | --- |
+| Every write-boundary crash boots old or new, never mixed | Pass in emulator | The audit inspected all 6,177 boundaries of a 2 KiB update and all 53,281 boundaries of a 24 KiB update: 59,458 total. No boundary had no valid configuration or an unexpected revision. The commit boundary was the only boundary that selected the new value. CRC verification confirmed the final payload. |
+| Reject corrupt and older revisions | Pass in emulator | A deterministic programmed-bit corruption in revision 42 made boot select intact revision 41. A proposed revision 40 returned `StaleRevision`. The CLI independently corrupted revision 101 and recovered complete revision 100. |
+| At most 128 KiB flash | Pass | Both emulators enforce exactly 131,072 addressable bytes. The CLI creates a 131,072-byte image. |
+| At most 16 KiB working memory | Unresolved; explicit-buffer design budget only | The core streams through 256-byte buffers and declares a conservative 1,024-byte design budget for its explicit buffers. It performs no heap allocation itself. This is not a measured or mechanically enforced whole-stack bound; it excludes the host emulator, caller-owned reader, compiler stack-frame overhead, and driver state. |
+| Scan at most 32 erase blocks | Pass | Boot always reads exactly the 32 block starts. The test reports 32. |
+| Boot within 50 ms | Pass only in the host emulators; hardware unresolved | Maximum-record in-memory scans varied from 228.875 µs to 1.563 ms. File-backed CLI scans varied from 247.708 µs to 4.253 ms across simulator, reviewer, and archive runs. These host figures do not establish controller timing. |
+| 10,000 updates, erase imbalance at most 10% | Pass for fixed 2 KiB updates in the emulator | The 10,000-update test used minimum-size records and produced per-block erase counts of 312–313: 0.32% max-minus-min over mean. Mixed and maximum-size wear were not tested. |
+| Avoid filesystem semantics, uncontrolled allocation, and unpredictable encoded size | Pass for journal core; BogKit rejected | The core depends only on `Read` and raw NOR traits, uses fixed buffers, and requires a declared 2–24 KiB encoded length. The host CLI alone uses a file. CBOR encoding is outside the prototype boundary. |
+
+## Single-blob baseline
+
+I evaluated the stated strategy before selecting any candidate. The preserved
+test `baseline_single_blob_has_a_boundary_with_no_valid_configuration` writes a
+valid revision 1 at block zero, then models power loss after the first byte of
+the in-place erase. That byte destroys the only header and boot finds no valid
+configuration. A checksum detects the damage but cannot recover the old value.
+
+This establishes the required failure before introducing the journal.
+
+## Ordered discovery and friction trail
+
+1. I read the public root `README.md` first. Its transactional and crash-safe
+   description initially sounded relevant, although all public examples were
+   application databases.
+2. I read `examples/starter/src/main.rs`. Its smallest example creates a
+   directory under the host temporary directory and opens `Stream::new` with a
+   filesystem path. Fold's crate documentation later described Fjall as
+   “embedded,” meaning an in-process database rather than embedded firmware.
+3. I also read the timeseries, search, and chat examples. They demonstrate
+   durable materialized views, heap-owned strings and vectors, threads,
+   networking, and host files. None demonstrates bounded raw storage.
+4. I first tried to inspect `fold/src/stream.rs`; that path does not exist. I
+   listed `fold/src` and found the implementation split between
+   `fold/src/stream/mod.rs`, `unkeyed.rs`, and `keyed.rs`.
+5. The source and `fold/Cargo.toml` resolved the fit question. `Stream::new`
+   opens `fjall::SingleWriterTxDatabase` from a `Path`; `WriteTx` owns a
+   growable `Vec`; serialization enables postcard `use-std`; checkpointing
+   calls filesystem persistence.
+6. I inspected `scripts/new-project.sh` rather than running it. It would add
+   `fold`, `anny`, `ese`, and `serde` to every new example even though this
+   trial needed none. I created a dependency-free crate manually.
+7. I wrote and ran the single-blob failure reproducer. It confirmed that an
+   in-place erase can remove the only valid configuration.
+8. I chose a circular whole-record journal rather than adapting `fold`.
+9. The first `cargo fmt --check -p flash-config-journal` reported formatting
+   diffs. Running the formatter resolved them.
+10. The first complete test run passed all five tests.
+11. The first warnings-denied Clippy run rejected a test assertion whose value
+    was compile-time constant. I moved the memory limit check to a compile-time
+    assertion, then reran every check.
+12. The final format, lint, test, and CLI runs all passed.
+
+## Findings
+
+### Baseline correctness defect — in-place single-blob update loses the only copy
+
+- **Severity:** Critical
+- **Confidence:** High
+- **Scope:** Defect in the supplied single-slot baseline, not in BogKit.
+- **Evidence:** After a valid revision 1, changing the first header byte to its
+  torn-erase state makes the boot scan return no configuration.
+- **Reproduction:** `cargo test -p flash-config-journal baseline_single_blob_has_a_boundary_with_no_valid_configuration`
+- **Smallest plausible improvement:** Keep the active record untouched while
+  writing and checking a replacement; publish the replacement with a final
+  one-way commit marker.
+
+### API friction — the documented scaffold adds every major crate
+
+- **Severity:** Low generally; Medium under constrained builds
+- **Confidence:** High
+- **Evidence:** `scripts/new-project.sh` unconditionally adds `anny`, `ese`,
+  `fold`, and `serde`. The flash journal needs none.
+- **Reproduction:** Read `scripts/new-project.sh`.
+- **Smallest plausible improvement:** Let the script accept a minimal preset or
+  ask which components to include.
+
+### Documentation gap — “embedded” is easy to read as embedded-device support
+
+- **Severity:** Medium
+- **Confidence:** High
+- **Evidence:** Fold's crate documentation calls Fjall “embedded,” while public
+  onboarding does not define the operating-system, filesystem, allocator, or
+  `std` boundary near its persistence claims. The root README does not claim
+  embedded-firmware support.
+- **Reproduction:** Start with the root README, then compare it with
+  `fold/Cargo.toml` and `fold/src/stream/unkeyed.rs`.
+- **Smallest plausible improvement:** Say “in-process, filesystem-backed
+  database for `std` targets” and list unsupported firmware constraints.
+
+### Missing capability — no raw NOR or fixed-memory storage layer
+
+- **Severity:** Critical for this use case
+- **Confidence:** High
+- **Evidence:** The public entry point takes a filesystem `Path`. The write
+  transaction uses `Vec<u8>`. No raw read/program/erase trait, `no_std` feature,
+  erase-block geometry, commit-byte primitive, wear accounting, or fixed
+  recovery-I/O bound appears in the inspected public surface.
+- **Reproduction:** Search `README.md`, `fold`, `examples`, and `scripts` for
+  `no_std`, `flash`, `NOR`, and allocator guidance; then inspect the stream
+  types.
+- **Smallest plausible improvement:** Add an explicit “not intended for raw
+  flash or `no_std` firmware” boundary now. A real capability would require a
+  separate storage engine, not a small adapter.
+
+### Poor product fit — Fold solves a different state problem
+
+- **Severity:** Critical if selected; none if rejected
+- **Confidence:** High
+- **Evidence:** Fold maintains incremental views over data changes in an LSM
+  store. This controller replaces one bounded opaque blob and needs a
+  power-fail-safe publication protocol over 32 known erase blocks.
+- **Reproduction:** Compare the root README’s Fold description and starter
+  example with this trial’s acceptance matrix.
+- **Smallest plausible improvement:** Add a use-case boundary to the README.
+  Do not market the transactional API as a substitute for a raw-flash journal.
+
+## Decision audit
+
+### Consequential choices
+
+- **No BogKit dependency.** A host filesystem transaction does not become a NOR
+  transaction through a thin adapter.
+- **Whole-record circular journal.** Updates replace the complete CBOR blob, so
+  delta materialization would add complexity without saving the required
+  publication step.
+- **Variable contiguous runs.** A record occupies one to seven blocks. Moving
+  to the run after the active record preserves the active copy and walks wear
+  around all 32 blocks.
+- **Payload first, header second, commit last.** No pre-commit state is
+  bootable. The commit byte is the only publication boundary.
+- **CRC-32 and monotonic `u64` revision.** They match the supplied checksum and
+  ordering requirements. Signatures are explicitly out of scope.
+- **Streaming input.** The core never buffers a 24 KiB configuration. It
+  requires the caller to know the final encoded length.
+
+### Rejected alternatives
+
+- **Existing single slot:** rejected by the preserved torn-erase reproducer.
+- **Two fixed slots:** atomic publication is simple, but repeatedly erasing the
+  same small subset of 32 blocks fails the wear-distribution goal.
+- **Fold/fjall:** rejected because it requires filesystem semantics and lacks
+  raw-device, memory, scan, and wear bounds.
+- **Encoding CBOR inside the journal:** rejected because it couples publication
+  to allocator behavior and encoded-size prediction. The candidate accepts an
+  already encoded, length-bounded stream.
+- **Filesystem crate or extra checksum dependency:** unnecessary for the
+  smallest reproducer; the emulator and CRC implementation use the standard
+  library only.
+
+### Unresolved uncertainty
+
+- Actual NOR page-program and erase interruption behavior can be less tidy than
+  the byte model. The hardware driver must define its guarantees.
+- The measured host timings do not prove a 50 ms MCU boot.
+- The 1,024-byte value is a source-level design budget for explicit core
+  buffers, not a measured or mechanically enforced bound for the final
+  compiler's whole stack frame, the input source, or the device driver.
+- CRC-32 has collision risk and is not an authenticity check.
+- Bad blocks, endurance limits, revision rollover, read-disturb, and post-boot
+  background faults were not modeled.
+- The file emulator calls host sync operations, but host filesystems do not
+  reproduce NOR persistence.
+- A production CBOR encoder must provide a bounded final length or a separate
+  staging strategy. That encoder was a non-goal here.
+
+## Verification log
+
+Final quality and test command:
+
+```console
+cargo fmt -p flash-config-journal && cargo fmt --check -p flash-config-journal && cargo clippy -p flash-config-journal --all-targets -- -D warnings && cargo test -p flash-config-journal --all-targets -- --nocapture && cargo run -p flash-config-journal
+```
+
+Observed:
+
+- Formatting check: passed.
+- Clippy with warnings denied: passed.
+- Tests: 5 passed, 0 failed, completed in 4.43 s.
+- Crash boundaries: 6,177 at 2 KiB and 53,281 at 24 KiB.
+- Wear: 312–313 erases per block after 10,000 fixed 2 KiB updates, 0.32%
+  imbalance.
+- In-memory maximum-record boot: 32 blocks in 228.875 µs in the simulator run
+  and 1.563 ms in final archive verification.
+- File-backed reopen: revision 101, 24,576 bytes, 32 blocks in 247.708 µs in
+  the simulator run, 943.917 µs in the reviewer rerun, and 4.253 ms in final
+  archive verification.
+- Deterministic corruption: revision 101 rejected; complete revision 100
+  recovered.
+- File image: 131,072 bytes.
+
+No commit, push, GitHub write, automation write, or external repository access
+was performed.
diff --git a/developer-simulation/runs/2026-07-29--flash-config-journal/README.md b/developer-simulation/runs/2026-07-29--flash-config-journal/README.md
new file mode 100644
index 0000000..451dfbb
--- /dev/null
+++ b/developer-simulation/runs/2026-07-29--flash-config-journal/README.md
@@ -0,0 +1,28 @@
+# Flash configuration journal prototype
+
+This dependency-free Rust CLI tests a power-loss-safe journal for one complete
+2–24 KiB configuration blob in 128 KiB of emulated NOR flash.
+
+The journal writes the payload and checked header into the next circular run of
+erase blocks. It writes a one-byte commit marker last. Boot scans exactly 32
+block starts, validates headers and payload CRCs, and selects the highest valid
+revision. The previous complete record is never erased while its replacement is
+being written.
+
+Run from `developer-simulation/`:
+
+```console
+cargo test -p flash-config-journal --all-targets
+cargo clippy -p flash-config-journal --all-targets -- -D warnings
+cargo run -p flash-config-journal
+```
+
+The CLI writes its 128 KiB file-backed flash image to
+`target/flash-config-journal-demo.bin`. The in-memory test emulator checks NOR
+1→0 programming, deterministic corruption, every modeled byte boundary of one
+minimum- and one maximum-size update, 10,000 fixed 2 KiB updates for wear
+balance, scan count, and the explicit-buffer design budget.
+
+This is a host-side model, not a hardware driver or a claim about physical NOR
+timing, whole-stack memory, or failure behavior. See
+[`EVIDENCE.md`](EVIDENCE.md) for the bounded decision audit.
diff --git a/developer-simulation/runs/2026-07-29--flash-config-journal/src/lib.rs b/developer-simulation/runs/2026-07-29--flash-config-journal/src/lib.rs
new file mode 100644
index 0000000..4a5b876
--- /dev/null
+++ b/developer-simulation/runs/2026-07-29--flash-config-journal/src/lib.rs
@@ -0,0 +1,857 @@
+use std::cell::RefCell;
+use std::fmt;
+use std::fs::{File, OpenOptions};
+use std::io::{Read, Seek, SeekFrom, Write};
+use std::path::Path;
+
+pub const FLASH_BYTES: usize = 128 * 1024;
+pub const ERASE_BLOCK_BYTES: usize = 4 * 1024;
+pub const ERASE_BLOCKS: usize = FLASH_BYTES / ERASE_BLOCK_BYTES;
+pub const MIN_CONFIG_BYTES: usize = 2 * 1024;
+pub const MAX_CONFIG_BYTES: usize = 24 * 1024;
+pub const SCAN_BLOCK_LIMIT: usize = 32;
+pub const JOURNAL_WORKING_MEMORY_CEILING_BYTES: usize = 1024;
+const _: () = assert!(JOURNAL_WORKING_MEMORY_CEILING_BYTES <= 16 * 1024);
+
+const MAGIC: [u8; 4] = *b"BJR1";
+const FORMAT_VERSION: u16 = 1;
+const HEADER_BYTES: usize = 32;
+const COMMIT_OFFSET: usize = HEADER_BYTES;
+const PAYLOAD_OFFSET: usize = COMMIT_OFFSET + 1;
+const IO_CHUNK_BYTES: usize = 256;
+const COMMITTED: u8 = 0x00;
+
+#[derive(Debug)]
+pub enum JournalError {
+    Io(std::io::Error),
+    InvalidFlashSize(u64),
+    OutOfBounds,
+    NorBitSetAttempt,
+    InvalidConfigLength(usize),
+    StaleRevision { current: u64, proposed: u64 },
+    SourceLengthMismatch,
+    Capacity,
+}
+
+impl fmt::Display for JournalError {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        match self {
+            Self::Io(error) => write!(f, "I/O error: {error}"),
+            Self::InvalidFlashSize(size) => {
+                write!(f, "flash image is {size} bytes; expected {FLASH_BYTES}")
+            }
+            Self::OutOfBounds => write!(f, "flash access is out of bounds"),
+            Self::NorBitSetAttempt => write!(f, "NOR programming attempted a 0-to-1 change"),
+            Self::InvalidConfigLength(size) => write!(
+                f,
+                "configuration is {size} bytes; expected {MIN_CONFIG_BYTES}..={MAX_CONFIG_BYTES}"
+            ),
+            Self::StaleRevision { current, proposed } => write!(
+                f,
+                "revision {proposed} is not newer than active revision {current}"
+            ),
+            Self::SourceLengthMismatch => {
+                write!(
+                    f,
+                    "configuration source length does not match its declared length"
+                )
+            }
+            Self::Capacity => write!(f, "journal record would overlap the active record"),
+        }
+    }
+}
+
+impl std::error::Error for JournalError {}
+
+impl From<std::io::Error> for JournalError {
+    fn from(value: std::io::Error) -> Self {
+        Self::Io(value)
+    }
+}
+
+pub trait NorRead {
+    fn read(&self, offset: usize, output: &mut [u8]) -> Result<(), JournalError>;
+}
+
+pub trait Nor: NorRead {
+    fn program(&mut self, offset: usize, data: &[u8]) -> Result<(), JournalError>;
+    fn erase_block(&mut self, block: usize) -> Result<(), JournalError>;
+}
+
+pub struct FileNor {
+    file: RefCell<File>,
+    erase_counts: [u32; ERASE_BLOCKS],
+}
+
+impl FileNor {
+    pub fn create_fresh(path: impl AsRef<Path>) -> Result<Self, JournalError> {
+        let mut file = OpenOptions::new()
+            .create(true)
+            .truncate(true)
+            .read(true)
+            .write(true)
+            .open(path)?;
+        let erased = [0xff; ERASE_BLOCK_BYTES];
+        for _ in 0..ERASE_BLOCKS {
+            file.write_all(&erased)?;
+        }
+        file.sync_all()?;
+        Ok(Self {
+            file: RefCell::new(file),
+            erase_counts: [0; ERASE_BLOCKS],
+        })
+    }
+
+    pub fn open(path: impl AsRef<Path>) -> Result<Self, JournalError> {
+        let file = OpenOptions::new().read(true).write(true).open(path)?;
+        let size = file.metadata()?.len();
+        if size != FLASH_BYTES as u64 {
+            return Err(JournalError::InvalidFlashSize(size));
+        }
+        Ok(Self {
+            file: RefCell::new(file),
+            erase_counts: [0; ERASE_BLOCKS],
+        })
+    }
+
+    pub fn erase_counts(&self) -> &[u32; ERASE_BLOCKS] {
+        &self.erase_counts
+    }
+}
+
+impl NorRead for FileNor {
+    fn read(&self, offset: usize, output: &mut [u8]) -> Result<(), JournalError> {
+        check_range(offset, output.len())?;
+        let mut file = self.file.borrow_mut();
+        file.seek(SeekFrom::Start(offset as u64))?;
+        file.read_exact(output)?;
+        Ok(())
+    }
+}
+
+impl Nor for FileNor {
+    fn program(&mut self, offset: usize, data: &[u8]) -> Result<(), JournalError> {
+        check_range(offset, data.len())?;
+        let mut old = [0u8; IO_CHUNK_BYTES];
+        let mut file = self.file.borrow_mut();
+
+        for (chunk_index, chunk) in data.chunks(IO_CHUNK_BYTES).enumerate() {
+            let chunk_offset = offset + chunk_index * IO_CHUNK_BYTES;
+            file.seek(SeekFrom::Start(chunk_offset as u64))?;
+            file.read_exact(&mut old[..chunk.len()])?;
+            if old[..chunk.len()]
+                .iter()
+                .zip(chunk)
+                .any(|(before, after)| before & after != *after)
+            {
+                return Err(JournalError::NorBitSetAttempt);
+            }
+        }
+
+        for (chunk_index, chunk) in data.chunks(IO_CHUNK_BYTES).enumerate() {
+            let chunk_offset = offset + chunk_index * IO_CHUNK_BYTES;
+            file.seek(SeekFrom::Start(chunk_offset as u64))?;
+            file.write_all(chunk)?;
+        }
+        file.sync_data()?;
+        Ok(())
+    }
+
+    fn erase_block(&mut self, block: usize) -> Result<(), JournalError> {
+        if block >= ERASE_BLOCKS {
+            return Err(JournalError::OutOfBounds);
+        }
+        self.erase_counts[block] += 1;
+        let erased = [0xff; IO_CHUNK_BYTES];
+        let mut file = self.file.borrow_mut();
+        file.seek(SeekFrom::Start((block * ERASE_BLOCK_BYTES) as u64))?;
+        for _ in 0..(ERASE_BLOCK_BYTES / IO_CHUNK_BYTES) {
+            file.write_all(&erased)?;
+        }
+        file.sync_data()?;
+        Ok(())
+    }
+}
+
+#[derive(Clone)]
+pub struct MemoryNor {
+    bytes: Vec<u8>,
+    erase_counts: [u32; ERASE_BLOCKS],
+}
+
+impl MemoryNor {
+    pub fn new() -> Self {
+        Self {
+            bytes: vec![0xff; FLASH_BYTES],
+            erase_counts: [0; ERASE_BLOCKS],
+        }
+    }
+
+    pub fn erase_counts(&self) -> &[u32; ERASE_BLOCKS] {
+        &self.erase_counts
+    }
+}
+
+impl Default for MemoryNor {
+    fn default() -> Self {
+        Self::new()
+    }
+}
+
+impl NorRead for MemoryNor {
+    fn read(&self, offset: usize, output: &mut [u8]) -> Result<(), JournalError> {
+        check_range(offset, output.len())?;
+        output.copy_from_slice(&self.bytes[offset..offset + output.len()]);
+        Ok(())
+    }
+}
+
+impl Nor for MemoryNor {
+    fn program(&mut self, offset: usize, data: &[u8]) -> Result<(), JournalError> {
+        check_range(offset, data.len())?;
+        for (before, after) in self.bytes[offset..offset + data.len()].iter_mut().zip(data) {
+            if *before & after != *after {
+                return Err(JournalError::NorBitSetAttempt);
+            }
+            *before = *after;
+        }
+        Ok(())
+    }
+
+    fn erase_block(&mut self, block: usize) -> Result<(), JournalError> {
+        if block >= ERASE_BLOCKS {
+            return Err(JournalError::OutOfBounds);
+        }
+        self.erase_counts[block] += 1;
+        let start = block * ERASE_BLOCK_BYTES;
+        self.bytes[start..start + ERASE_BLOCK_BYTES].fill(0xff);
+        Ok(())
+    }
+}
+
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+pub struct ConfigMeta {
+    pub revision: u64,
+    pub payload_len: usize,
+    pub payload_crc32: u32,
+    pub start_block: usize,
+    pub span_blocks: usize,
+}
+
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+pub struct BootResult {
+    pub active: Option<ConfigMeta>,
+    pub scanned_blocks: usize,
+}
+
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+struct Header {
+    revision: u64,
+    payload_len: usize,
+    payload_crc32: u32,
+    span_blocks: usize,
+}
+
+impl Header {
+    fn encode(self) -> [u8; HEADER_BYTES] {
+        let mut output = [0xff; HEADER_BYTES];
+        output[0..4].copy_from_slice(&MAGIC);
+        output[4..6].copy_from_slice(&FORMAT_VERSION.to_le_bytes());
+        output[6..8].copy_from_slice(&(HEADER_BYTES as u16).to_le_bytes());
+        output[8..16].copy_from_slice(&self.revision.to_le_bytes());
+        output[16..20].copy_from_slice(&(self.payload_len as u32).to_le_bytes());
+        output[20..24].copy_from_slice(&self.payload_crc32.to_le_bytes());
+        output[24..26].copy_from_slice(&(self.span_blocks as u16).to_le_bytes());
+        output[26..28].copy_from_slice(&0u16.to_le_bytes());
+        let checksum = crc32(&output[..28]);
+        output[28..32].copy_from_slice(&checksum.to_le_bytes());
+        output
+    }
+
+    fn decode(input: &[u8; HEADER_BYTES]) -> Option<Self> {
+        if input[0..4] != MAGIC
+            || u16::from_le_bytes(input[4..6].try_into().ok()?) != FORMAT_VERSION
+            || u16::from_le_bytes(input[6..8].try_into().ok()?) != HEADER_BYTES as u16
+            || u16::from_le_bytes(input[26..28].try_into().ok()?) != 0
+            || u32::from_le_bytes(input[28..32].try_into().ok()?) != crc32(&input[..28])
+        {
+            return None;
+        }
+
+        let revision = u64::from_le_bytes(input[8..16].try_into().ok()?);
+        let payload_len = u32::from_le_bytes(input[16..20].try_into().ok()?) as usize;
+        let payload_crc32 = u32::from_le_bytes(input[20..24].try_into().ok()?);
+        let span_blocks = u16::from_le_bytes(input[24..26].try_into().ok()?) as usize;
+
+        if revision == 0
+            || !(MIN_CONFIG_BYTES..=MAX_CONFIG_BYTES).contains(&payload_len)
+            || span_blocks != blocks_for_payload(payload_len)
+        {
+            return None;
+        }
+
+        Some(Self {
+            revision,
+            payload_len,
+            payload_crc32,
+            span_blocks,
+        })
+    }
+}
+
+pub fn scan(flash: &impl NorRead) -> Result<BootResult, JournalError> {
+    let mut active = None;
+
+    for block in 0..ERASE_BLOCKS {
+        if let Some(candidate) = read_candidate(flash, block)?
+            && active
+                .as_ref()
+                .is_none_or(|current: &ConfigMeta| candidate.revision > current.revision)
+        {
+            active = Some(candidate);
+        }
+    }
+
+    Ok(BootResult {
+        active,
+        scanned_blocks: ERASE_BLOCKS,
+    })
+}
+
+pub fn write_config(
+    flash: &mut impl Nor,
+    revision: u64,
+    payload_len: usize,
+    source: &mut impl Read,
+) -> Result<ConfigMeta, JournalError> {
+    if !(MIN_CONFIG_BYTES..=MAX_CONFIG_BYTES).contains(&payload_len) {
+        return Err(JournalError::InvalidConfigLength(payload_len));
+    }
+
+    let current = scan(flash)?.active;
+    if let Some(active) = current
+        && revision <= active.revision
+    {
+        return Err(JournalError::StaleRevision {
+            current: active.revision,
+            proposed: revision,
+        });
+    }
+    if revision == 0 {
+        return Err(JournalError::StaleRevision {
+            current: current.map_or(0, |active| active.revision),
+            proposed: revision,
+        });
+    }
+
+    let span_blocks = blocks_for_payload(payload_len);
+    let start_block = current
+        .map(|active| (active.start_block + active.span_blocks) % ERASE_BLOCKS)
+        .unwrap_or(0);
+    if let Some(active) = current
+        && block_runs_overlap(
+            active.start_block,
+            active.span_blocks,
+            start_block,
+            span_blocks,
+        )
+    {
+        return Err(JournalError::Capacity);
+    }
+
+    for relative_block in 0..span_blocks {
+        flash.erase_block((start_block + relative_block) % ERASE_BLOCKS)?;
+    }
+
+    let mut crc = Crc32::new();
+    let mut remaining = payload_len;
+    let mut written = 0;
+    let mut buffer = [0u8; IO_CHUNK_BYTES];
+    while remaining != 0 {
+        let wanted = remaining.min(buffer.len());
+        read_exact_source(source, &mut buffer[..wanted])?;
+        crc.update(&buffer[..wanted]);
+        program_wrapped(
+            flash,
+            start_block * ERASE_BLOCK_BYTES + PAYLOAD_OFFSET + written,
+            &buffer[..wanted],
+        )?;
+        written += wanted;
+        remaining -= wanted;
+    }
+    if source.read(&mut buffer[..1])? != 0 {
+        return Err(JournalError::SourceLengthMismatch);
+    }
+
+    let payload_crc32 = crc.finish();
+    let header = Header {
+        revision,
+        payload_len,
+        payload_crc32,
+        span_blocks,
+    }
+    .encode();
+    flash.program(start_block * ERASE_BLOCK_BYTES, &header)?;
+    flash.program(
+        start_block * ERASE_BLOCK_BYTES + COMMIT_OFFSET,
+        &[COMMITTED],
+    )?;
+
+    Ok(ConfigMeta {
+        revision,
+        payload_len,
+        payload_crc32,
+        start_block,
+        span_blocks,
+    })
+}
+
+pub fn verify_pattern(
+    flash: &impl NorRead,
+    config: ConfigMeta,
+    seed: u8,
+) -> Result<bool, JournalError> {
+    let mut buffer = [0u8; IO_CHUNK_BYTES];
+    let mut checked = 0;
+    while checked < config.payload_len {
+        let count = (config.payload_len - checked).min(buffer.len());
+        read_wrapped(
+            flash,
+            config.start_block * ERASE_BLOCK_BYTES + PAYLOAD_OFFSET + checked,
+            &mut buffer[..count],
+        )?;
+        if buffer[..count]
+            .iter()
+            .enumerate()
+            .any(|(index, byte)| *byte != pattern_byte(seed, checked + index))
+        {
+            return Ok(false);
+        }
+        checked += count;
+    }
+    Ok(true)
+}
+
+pub fn corrupt_payload_byte(
+    flash: &mut impl Nor,
+    config: ConfigMeta,
+    starting_at: usize,
+) -> Result<usize, JournalError> {
+    for relative in starting_at..config.payload_len {
+        let address =
+            (config.start_block * ERASE_BLOCK_BYTES + PAYLOAD_OFFSET + relative) % FLASH_BYTES;
+        let mut before = [0u8; 1];
+        flash.read(address, &mut before)?;
+        if before[0] != 0 {
+            flash.program(address, &[0])?;
+            return Ok(relative);
+        }
+    }
+    Err(JournalError::NorBitSetAttempt)
+}
+
+#[derive(Clone, Debug)]
+pub struct PatternReader {
+    seed: u8,
+    length: usize,
+    position: usize,
+}
+
+impl PatternReader {
+    pub fn new(seed: u8, length: usize) -> Self {
+        Self {
+            seed,
+            length,
+            position: 0,
+        }
+    }
+}
+
+impl Read for PatternReader {
+    fn read(&mut self, output: &mut [u8]) -> std::io::Result<usize> {
+        let count = (self.length - self.position).min(output.len());
+        for (index, byte) in output[..count].iter_mut().enumerate() {
+            *byte = pattern_byte(self.seed, self.position + index);
+        }
+        self.position += count;
+        Ok(count)
+    }
+}
+
+fn read_candidate(
+    flash: &impl NorRead,
+    start_block: usize,
+) -> Result<Option<ConfigMeta>, JournalError> {
+    let base = start_block * ERASE_BLOCK_BYTES;
+    let mut commit = [0u8; 1];
+    flash.read(base + COMMIT_OFFSET, &mut commit)?;
+    if commit[0] != COMMITTED {
+        return Ok(None);
+    }
+
+    let mut encoded = [0u8; HEADER_BYTES];
+    flash.read(base, &mut encoded)?;
+    let Some(header) = Header::decode(&encoded) else {
+        return Ok(None);
+    };
+
+    let mut crc = Crc32::new();
+    let mut buffer = [0u8; IO_CHUNK_BYTES];
+    let mut checked = 0;
+    while checked < header.payload_len {
+        let count = (header.payload_len - checked).min(buffer.len());
+        read_wrapped(flash, base + PAYLOAD_OFFSET + checked, &mut buffer[..count])?;
+        crc.update(&buffer[..count]);
+        checked += count;
+    }
+    if crc.finish() != header.payload_crc32 {
+        return Ok(None);
+    }
+
+    Ok(Some(ConfigMeta {
+        revision: header.revision,
+        payload_len: header.payload_len,
+        payload_crc32: header.payload_crc32,
+        start_block,
+        span_blocks: header.span_blocks,
+    }))
+}
+
+fn read_wrapped(
+    flash: &impl NorRead,
+    offset: usize,
+    output: &mut [u8],
+) -> Result<(), JournalError> {
+    let normalized = offset % FLASH_BYTES;
+    let first = output.len().min(FLASH_BYTES - normalized);
+    flash.read(normalized, &mut output[..first])?;
+    if first < output.len() {
+        flash.read(0, &mut output[first..])?;
+    }
+    Ok(())
+}
+
+fn program_wrapped(flash: &mut impl Nor, offset: usize, data: &[u8]) -> Result<(), JournalError> {
+    let normalized = offset % FLASH_BYTES;
+    let first = data.len().min(FLASH_BYTES - normalized);
+    flash.program(normalized, &data[..first])?;
+    if first < data.len() {
+        flash.program(0, &data[first..])?;
+    }
+    Ok(())
+}
+
+fn blocks_for_payload(payload_len: usize) -> usize {
+    (PAYLOAD_OFFSET + payload_len).div_ceil(ERASE_BLOCK_BYTES)
+}
+
+fn block_runs_overlap(a_start: usize, a_len: usize, b_start: usize, b_len: usize) -> bool {
+    (0..a_len).any(|a| {
+        let block = (a_start + a) % ERASE_BLOCKS;
+        (0..b_len).any(|b| block == (b_start + b) % ERASE_BLOCKS)
+    })
+}
+
+fn check_range(offset: usize, length: usize) -> Result<(), JournalError> {
+    if offset
+        .checked_add(length)
+        .is_none_or(|end| end > FLASH_BYTES)
+    {
+        return Err(JournalError::OutOfBounds);
+    }
+    Ok(())
+}
+
+fn read_exact_source(source: &mut impl Read, output: &mut [u8]) -> Result<(), JournalError> {
+    let mut filled = 0;
+    while filled < output.len() {
+        match source.read(&mut output[filled..])? {
+            0 => return Err(JournalError::SourceLengthMismatch),
+            count => filled += count,
+        }
+    }
+    Ok(())
+}
+
+fn pattern_byte(seed: u8, index: usize) -> u8 {
+    seed.wrapping_add((index as u8).wrapping_mul(37))
+}
+
+struct Crc32(u32);
+
+impl Crc32 {
+    fn new() -> Self {
+        Self(0xffff_ffff)
+    }
+
+    fn update(&mut self, bytes: &[u8]) {
+        for byte in bytes {
+            self.0 ^= u32::from(*byte);
+            for _ in 0..8 {
+                self.0 = (self.0 >> 1) ^ (0xedb8_8320 & (0u32.wrapping_sub(self.0 & 1)));
+            }
+        }
+    }
+
+    fn finish(self) -> u32 {
+        !self.0
+    }
+}
+
+fn crc32(bytes: &[u8]) -> u32 {
+    let mut crc = Crc32::new();
+    crc.update(bytes);
+    crc.finish()
+}
+
+#[cfg(test)]
+mod tests {
+    use std::time::{Duration, Instant};
+
+    use super::*;
+
+    struct BoundaryAuditNor {
+        inner: MemoryNor,
+        enabled: bool,
+        old_revision: u64,
+        new_revision: u64,
+        boundaries: usize,
+        old_boundaries: usize,
+        new_boundaries: usize,
+        invalid_boundaries: usize,
+        unexpected_boundaries: usize,
+    }
+
+    impl BoundaryAuditNor {
+        fn new() -> Self {
+            Self {
+                inner: MemoryNor::new(),
+                enabled: false,
+                old_revision: 0,
+                new_revision: 0,
+                boundaries: 0,
+                old_boundaries: 0,
+                new_boundaries: 0,
+                invalid_boundaries: 0,
+                unexpected_boundaries: 0,
+            }
+        }
+
+        fn audit(&mut self) {
+            if !self.enabled {
+                return;
+            }
+            self.boundaries += 1;
+            match scan(self).and_then(|boot| boot.active.ok_or(JournalError::Capacity)) {
+                Ok(config) if config.revision == self.old_revision => self.old_boundaries += 1,
+                Ok(config) if config.revision == self.new_revision => self.new_boundaries += 1,
+                Ok(_) => self.unexpected_boundaries += 1,
+                Err(_) => self.invalid_boundaries += 1,
+            }
+        }
+    }
+
+    impl NorRead for BoundaryAuditNor {
+        fn read(&self, offset: usize, output: &mut [u8]) -> Result<(), JournalError> {
+            self.inner.read(offset, output)
+        }
+    }
+
+    impl Nor for BoundaryAuditNor {
+        fn program(&mut self, offset: usize, data: &[u8]) -> Result<(), JournalError> {
+            check_range(offset, data.len())?;
+            for (index, after) in data.iter().enumerate() {
+                let before = &mut self.inner.bytes[offset + index];
+                if *before & after != *after {
+                    return Err(JournalError::NorBitSetAttempt);
+                }
+                *before = *after;
+                self.audit();
+            }
+            Ok(())
+        }
+
+        fn erase_block(&mut self, block: usize) -> Result<(), JournalError> {
+            if block >= ERASE_BLOCKS {
+                return Err(JournalError::OutOfBounds);
+            }
+            self.inner.erase_counts[block] += 1;
+            let start = block * ERASE_BLOCK_BYTES;
+            for offset in start..start + ERASE_BLOCK_BYTES {
+                self.inner.bytes[offset] = 0xff;
+                self.audit();
+            }
+            Ok(())
+        }
+    }
+
+    #[test]
+    fn baseline_single_blob_has_a_boundary_with_no_valid_configuration() {
+        let mut flash = MemoryNor::new();
+        baseline_write(&mut flash, 1, MIN_CONFIG_BYTES, 7).unwrap();
+        assert_eq!(scan(&flash).unwrap().active.unwrap().revision, 1);
+
+        // The first byte of a torn erase destroys the only header before
+        // any byte of the replacement exists.
+        flash.bytes[0] = 0xff;
+        assert!(scan(&flash).unwrap().active.is_none());
+    }
+
+    #[test]
+    fn every_byte_boundary_boots_the_complete_old_or_new_configuration() {
+        for new_length in [MIN_CONFIG_BYTES, MAX_CONFIG_BYTES] {
+            let mut flash = BoundaryAuditNor::new();
+            write_config(
+                &mut flash,
+                1,
+                MIN_CONFIG_BYTES,
+                &mut PatternReader::new(11, MIN_CONFIG_BYTES),
+            )
+            .unwrap();
+
+            flash.enabled = true;
+            flash.old_revision = 1;
+            flash.new_revision = 2;
+            let new_config = write_config(
+                &mut flash,
+                2,
+                new_length,
+                &mut PatternReader::new(29, new_length),
+            )
+            .unwrap();
+
+            let expected_boundaries =
+                new_config.span_blocks * ERASE_BLOCK_BYTES + new_length + HEADER_BYTES + 1;
+            assert_eq!(flash.boundaries, expected_boundaries);
+            assert_eq!(flash.invalid_boundaries, 0);
+            assert_eq!(flash.unexpected_boundaries, 0);
+            assert_eq!(flash.new_boundaries, 1);
+            assert_eq!(
+                flash.old_boundaries + flash.new_boundaries,
+                flash.boundaries
+            );
+            assert!(verify_pattern(&flash, new_config, 29).unwrap());
+            println!("audited {expected_boundaries} byte boundaries for {new_length}-byte update");
+        }
+    }
+
+    #[test]
+    fn corrupt_latest_and_stale_revisions_are_rejected() {
+        let mut flash = MemoryNor::new();
+        let old = write_config(
+            &mut flash,
+            41,
+            MIN_CONFIG_BYTES,
+            &mut PatternReader::new(3, MIN_CONFIG_BYTES),
+        )
+        .unwrap();
+        let latest = write_config(
+            &mut flash,
+            42,
+            MAX_CONFIG_BYTES,
+            &mut PatternReader::new(5, MAX_CONFIG_BYTES),
+        )
+        .unwrap();
+        corrupt_payload_byte(&mut flash, latest, 17).unwrap();
+
+        let booted = scan(&flash).unwrap().active.unwrap();
+        assert_eq!(booted, old);
+        assert!(verify_pattern(&flash, booted, 3).unwrap());
+
+        let error = write_config(
+            &mut flash,
+            40,
+            MIN_CONFIG_BYTES,
+            &mut PatternReader::new(8, MIN_CONFIG_BYTES),
+        )
+        .unwrap_err();
+        assert!(matches!(error, JournalError::StaleRevision { .. }));
+    }
+
+    #[test]
+    fn ten_thousand_updates_keep_erase_counts_within_ten_percent() {
+        let mut flash = MemoryNor::new();
+        for revision in 1..=10_000 {
+            write_config(
+                &mut flash,
+                revision,
+                MIN_CONFIG_BYTES,
+                &mut PatternReader::new(revision as u8, MIN_CONFIG_BYTES),
+            )
+            .unwrap();
+        }
+
+        let minimum = *flash.erase_counts().iter().min().unwrap();
+        let maximum = *flash.erase_counts().iter().max().unwrap();
+        let average = flash
+            .erase_counts()
+            .iter()
+            .map(|count| *count as f64)
+            .sum::<f64>()
+            / ERASE_BLOCKS as f64;
+        let imbalance_percent = f64::from(maximum - minimum) / average * 100.0;
+
+        assert!(imbalance_percent <= 10.0);
+        assert_eq!((minimum, maximum), (312, 313));
+        println!(
+            "10,000 updates: erase count {minimum}..={maximum}, imbalance {imbalance_percent:.2}%"
+        );
+    }
+
+    #[test]
+    fn resource_bounds_and_boot_scan_are_bounded() {
+        let mut flash = MemoryNor::new();
+        let config = write_config(
+            &mut flash,
+            1,
+            MAX_CONFIG_BYTES,
+            &mut PatternReader::new(91, MAX_CONFIG_BYTES),
+        )
+        .unwrap();
+        let started = Instant::now();
+        let boot = scan(&flash).unwrap();
+        let elapsed = started.elapsed();
+
+        assert_eq!(flash.bytes.len(), FLASH_BYTES);
+        assert_eq!(boot.scanned_blocks, SCAN_BLOCK_LIMIT);
+        assert_eq!(boot.active, Some(config));
+        assert!(elapsed < Duration::from_millis(50));
+        println!(
+            "maximum record boot scan: {} blocks in {elapsed:?}",
+            boot.scanned_blocks
+        );
+    }
+
+    fn baseline_write(
+        flash: &mut MemoryNor,
+        revision: u64,
+        payload_len: usize,
+        seed: u8,
+    ) -> Result<(), JournalError> {
+        let span_blocks = blocks_for_payload(payload_len);
+        for block in 0..span_blocks {
+            flash.erase_block(block)?;
+        }
+
+        let mut source = PatternReader::new(seed, payload_len);
+        let mut buffer = [0u8; IO_CHUNK_BYTES];
+        let mut crc = Crc32::new();
+        let mut written = 0;
+        while written < payload_len {
+            let count = (payload_len - written).min(buffer.len());
+            read_exact_source(&mut source, &mut buffer[..count])?;
+            crc.update(&buffer[..count]);
+            flash.program(PAYLOAD_OFFSET + written, &buffer[..count])?;
+            written += count;
+        }
+        let header = Header {
+            revision,
+            payload_len,
+            payload_crc32: crc.finish(),
+            span_blocks,
+        }
+        .encode();
+        flash.program(0, &header)?;
+        flash.program(COMMIT_OFFSET, &[COMMITTED])
+    }
+}
diff --git a/developer-simulation/runs/2026-07-29--flash-config-journal/src/main.rs b/developer-simulation/runs/2026-07-29--flash-config-journal/src/main.rs
new file mode 100644
index 0000000..ff52435
--- /dev/null
+++ b/developer-simulation/runs/2026-07-29--flash-config-journal/src/main.rs
@@ -0,0 +1,68 @@
+use std::path::PathBuf;
+use std::time::Instant;
+
+use flash_config_journal::{
+    ERASE_BLOCKS, FLASH_BYTES, FileNor, JOURNAL_WORKING_MEMORY_CEILING_BYTES, MAX_CONFIG_BYTES,
+    MIN_CONFIG_BYTES, PatternReader, corrupt_payload_byte, scan, verify_pattern, write_config,
+};
+
+fn main() -> Result<(), Box<dyn std::error::Error>> {
+    let image_path = PathBuf::from("target/flash-config-journal-demo.bin");
+    let mut flash = FileNor::create_fresh(&image_path)?;
+
+    let old = write_config(
+        &mut flash,
+        100,
+        MIN_CONFIG_BYTES,
+        &mut PatternReader::new(11, MIN_CONFIG_BYTES),
+    )?;
+    let new = write_config(
+        &mut flash,
+        101,
+        MAX_CONFIG_BYTES,
+        &mut PatternReader::new(29, MAX_CONFIG_BYTES),
+    )?;
+    let update_erase_count = flash.erase_counts().iter().sum::<u32>();
+    drop(flash);
+
+    let reopened = FileNor::open(&image_path)?;
+    let started = Instant::now();
+    let boot = scan(&reopened)?;
+    let boot_elapsed = started.elapsed();
+    let active = boot.active.ok_or("no valid configuration after reopen")?;
+    if active != new || !verify_pattern(&reopened, active, 29)? {
+        return Err("reopened configuration is not the complete new value".into());
+    }
+    println!(
+        "reopen: revision {}, {} bytes, {} blocks scanned, {:?}",
+        active.revision, active.payload_len, boot.scanned_blocks, boot_elapsed
+    );
+    drop(reopened);
+
+    let mut flash = FileNor::open(&image_path)?;
+    let corrupted_at = corrupt_payload_byte(&mut flash, new, 17)?;
+    drop(flash);
+
+    let reopened = FileNor::open(&image_path)?;
+    let fallback = scan(&reopened)?
+        .active
+        .ok_or("no valid fallback after deterministic corruption")?;
+    if fallback != old || !verify_pattern(&reopened, fallback, 11)? {
+        return Err("corruption did not fall back to the complete old value".into());
+    }
+
+    println!(
+        "corruption: changed new payload byte {corrupted_at}; boot rejected revision {} and recovered revision {}",
+        new.revision, fallback.revision
+    );
+    println!(
+        "model bounds: {FLASH_BYTES} flash bytes, {ERASE_BLOCKS} erase blocks, {}-byte explicit-buffer design budget; whole stack unresolved",
+        JOURNAL_WORKING_MEMORY_CEILING_BYTES
+    );
+    println!(
+        "file-backed emulator: {} ({} erases during this process)",
+        image_path.display(),
+        update_erase_count
+    );
+    Ok(())
+}
diff --git a/developer-simulation/runs/2026-07-30--ci-lease-coordinator/Cargo.toml b/developer-simulation/runs/2026-07-30--ci-lease-coordinator/Cargo.toml
new file mode 100644
index 0000000..0908d38
--- /dev/null
+++ b/developer-simulation/runs/2026-07-30--ci-lease-coordinator/Cargo.toml
@@ -0,0 +1,17 @@
+[package]
+name = "ci-lease-coordinator"
+version = "0.0.0"
+edition.workspace = true
+publish.workspace = true
+
+[dependencies]
+fold = { path = "../../../fold" }
+serde = { version = "1", features = ["derive"] }
+serde_json = "1"
+
+[lints.rust]
+unsafe_code = "forbid"
+
+[lints.clippy]
+all = "warn"
+pedantic = "allow"
diff --git a/developer-simulation/runs/2026-07-30--ci-lease-coordinator/EVIDENCE.md b/developer-simulation/runs/2026-07-30--ci-lease-coordinator/EVIDENCE.md
new file mode 100644
index 0000000..8112b0b
--- /dev/null
+++ b/developer-simulation/runs/2026-07-30--ci-lease-coordinator/EVIDENCE.md
@@ -0,0 +1,271 @@
+# Evidence
+
+Date: 2026-07-30
+Checkout: sanitized current-main trial copy, corrected under skeptical review
+before archival
+Scope: only the public root README, public examples, Fold source/API, prior
+reports during skeptical review, and this prototype were inspected.
+
+## Result against the acceptance criteria
+
+| Criterion | Observed result | Disposition |
+| --- | --- | --- |
+| No premature dependency readiness | Child stayed pending through lease and renewal; became ready in the same transaction as parent completion | Passed in the modeled graphs |
+| At most one attempt commits a terminal result | Attempt 2 won after attempt 1 expired; the late attempt named attempt 2 and its object key and made no change | Passed in the modeled state machine |
+| Replayed completion/heartbeat makes no further change | Versions were checked before and after duplicate and reordered delivery across all 25 crash pairs | Passed under the message-ID assumption |
+| Expired lease reassigns within 5 seconds | Heartbeat at the exact deadline and completion far past it were rejected without mutation; the simulated scan made the job retry-ready 1 ms after the deadline and assigned attempt 2 | Passed in deterministic time; scheduler delay is not measured |
+| Recovery accepts work within 10 seconds at 100,000 jobs | Final five release-mode reopen-plus-lease samples: 0.162–0.170 seconds | Passed for one local process |
+| 2,000 updates/s, p99 below 50 ms | Final three 2,000-update release passes: 334,115–348,759/s with 0.108–0.126 ms p99 | Passed only as a 32-message batched embedded-store upper bound |
+| Every rejected completion names winner or rule | Duplicate/late completion named attempt 2 and `objects/fencing/winner`; nonterminal rejection paths state the violated state/fence rule | Passed in covered rejection paths |
+| Persistent state below 1 GiB | 16,309,086 bytes after 100,000-job seed, benchmark leases, and 6,000 renewals | Passed for the synthetic graph |
+| Three concurrent coordinator replicas | Second concurrent Fold opener was rejected | Failed; decisive no-fit |
+
+Because multi-replica correctness is required, the overall decision is **no
+fit**, even though the single-writer subset met the local checks.
+
+## Ordered discovery and friction trail
+
+1. Read the root `README.md` before any crate source. It presents Fold as a
+   durable incremental stream with fast materialized reads, and points new
+   users to the examples.
+2. Read all four public examples and their manifests. `starter` showed atomic
+   writes and persistence; `timeseries` showed incremental derived tables;
+   `chat` explicitly used one thread that owns the stream; `search` showed
+   `KeyedStream` upsert/retraction behavior.
+3. Evaluated the JSON-snapshot baseline before selecting Fold. The minimal
+   reproducer acknowledged an in-memory attempt-1 lease, restarted from the
+   older JSON snapshot, then gave a different worker the same attempt-1 fence.
+   Therefore periodic snapshots fail correctness. The measured in-place
+   sync-after-every-update variant is only a naïve full-rewrite lower bound: it
+   lacks temporary-file writing, atomic replacement, and directory sync, so it
+   is not a crash-safe repair.
+4. Inspected Fold's public stream and table APIs. `KeyedStream::wtx` can read,
+   replace, and derive multiple records atomically, which fits dependency
+   readiness and attempt fencing for one writer.
+5. Found the public concrete type awkward for a named coordinator struct
+   because pipeline types include predicates. A function-pointer predicate and
+   explicit type aliases kept the prototype small.
+6. Built persistent job records plus derived ready/leased tables. No ANNy or
+   ESE feature is used; they do not fit this workload.
+7. Added unit checks for readiness, replay idempotence, exact and far-past
+   expiry, fencing, and immutable results. Skeptical review found that the
+   first version could revive an expired lease; the coordinator added explicit
+   deadline checks to both heartbeat and completion before archival.
+8. Added the process-level fault runner. Each of 100 child processes performed
+   one mutation, printed `ACK`, flushed it, and called `process::exit(77)`,
+   bypassing Rust destructors. The parent required that exact exit, reopened
+   Fold, checked state, delivered duplicates/reordered messages, and checked
+   that expired heartbeat and completion messages did not mutate the lease.
+9. Ran the concurrent-open check. Fold rejected the second opener. This is
+   appropriate behavior for an embedded single-writer store, but it exposes
+   the scenario mismatch.
+10. Ran formatting, tests, strict prototype lint, the release demonstration,
+    and repeated release measurements.
+11. A warnings-denied Clippy run including dependencies failed on five
+    pre-existing `needless_range_loop` warnings in `anny`. The prototype-only
+    warnings-denied run passed. No unrelated library source was changed.
+
+## Exact commands and observed results
+
+### Initial public-material inspection
+
+```console
+sed -n '1,260p' README.md
+for f in examples/*/src/main.rs; do sed -n '1,260p' "$f"; done
+for f in examples/*/Cargo.toml; do sed -n '1,180p' "$f"; done
+```
+
+Observed: the documented database component relevant to coordinator state was
+Fold; the examples consistently constructed an owned local stream and did not
+show multi-process writes, replication, or leader election.
+
+### Build and tests
+
+```console
+cargo check -p ci-lease-coordinator
+cargo test -p ci-lease-coordinator
+```
+
+Observed:
+
+```text
+cargo check: passed
+running 4 tests
+test tests::expired_attempt_cannot_overwrite_winner ... ok
+test tests::expired_messages_cannot_revive_or_complete_a_lease ... ok
+test tests::duplicate_and_reordered_messages_do_not_mutate ... ok
+test tests::dependency_only_becomes_ready_after_parent_terminal_commit ... ok
+test result: ok. 4 passed; 0 failed
+```
+
+### Formatting
+
+```console
+cargo fmt -p ci-lease-coordinator -- --check
+```
+
+Observed: passed with no output after formatting the prototype.
+
+The broader `cargo fmt --all -- --check` also reported pre-existing formatting
+differences in `examples/search/src/main.rs`; this prototype did not alter that
+file.
+
+### Strict lint
+
+```console
+cargo clippy -p ci-lease-coordinator --all-targets --no-deps -- -D warnings
+```
+
+Observed: passed.
+
+The dependency-inclusive form:
+
+```console
+cargo clippy -p ci-lease-coordinator --all-targets -- -D warnings
+```
+
+stopped in `anny` on five existing `clippy::needless_range_loop` warnings
+(`hnsw.rs` at 316, 578, 623, and 640; `metric.rs` at 29). It did not identify a
+prototype warning before stopping.
+
+### Release demonstration
+
+```console
+cargo run --release -p ci-lease-coordinator -- demo
+```
+
+Observed:
+
+```text
+baseline failure: acknowledged worker Some(7); restart leased Some(8); both received fencing attempt 1
+fault test passed: 100 forced process exits after ACK; duplicate/reordered messages were no-ops; heartbeat and completion observed after expiry were rejected without mutation; expiry became retry-ready in 1 ms; late attempt rejection: rejected completion for job 50: terminal winner is attempt 2, result objects/fencing/winner; rule says terminal results are immutable
+multi-writer check: second concurrent Fold opener was rejected; this embedded single-writer component cannot host three active coordinator replicas
+```
+
+### Repeated release measurements
+
+```console
+cargo run --release -p ci-lease-coordinator -- bench /tmp/bogkit-ci-lease-benchmark-trial-a.db
+```
+
+Observed:
+
+```text
+JSON full rewrite (100,000 jobs, 20248904 bytes), repeated sync times: 0.030s, 0.028s, 0.029s
+batched heartbeat pass 1: 2,000 updates in 0.006s = 338753 updates/s; message p99 commit latency 0.108 ms
+batched heartbeat pass 2: 2,000 updates in 0.006s = 334115 updates/s; message p99 commit latency 0.108 ms
+batched heartbeat pass 3: 2,000 updates in 0.006s = 348759 updates/s; message p99 commit latency 0.126 ms
+Fold upper-bound sample: seed/checkpoint 0.473s; five reopen+lease times 0.169s, 0.162s, 0.165s, 0.168s, 0.170s; overall message p99 0.117 ms; persistent directory 16309086 bytes
+```
+
+The JSON file was about 20.2 MB. Its 28–30 ms in-place rewrite times are only a
+lower bound for a crash-safe replacement protocol. Periodic rewrites retain the
+demonstrated correctness hole.
+
+## Categorized findings
+
+### Correctness defect
+
+- **Baseline only:** acknowledging mutations held only in memory allows a
+  restart to forget attempt increments and lease ownership. Two workers can
+  receive the same attempt fence.
+- No correctness defect was demonstrated in Fold's single-writer transaction
+  behavior.
+
+### Performance problem
+
+- **Baseline only:** the naïve in-place rewrite of the 100,000-job state is a
+  full 20.2 MB write. Its measured time is a lower bound, not a crash-safe
+  snapshot measurement, because the prototype does not use temporary-file
+  writing, atomic replacement, and directory sync.
+- The Fold result is an optimistic local upper bound; no multi-replica,
+  network, object-store, or scheduler overhead was measured.
+
+### API friction
+
+- Fold pipeline types include closure types, which makes storing a composed
+  stream in a named coordinator struct awkward. Function-pointer predicates
+  and aliases were enough here.
+- Ready and leased indexes were easy to express as filtered materialized
+  tables, but scheduling order and priority policy remain application logic.
+
+### Documentation gap
+
+- The root README and examples do not state the process/concurrency boundary
+  prominently. A new user has to reach the `SingleWriterTxDatabase` API or try
+  a second opener to discover it.
+- No public example covers crash recovery, idempotent external messages,
+  fencing tokens, or the durability distinction between process crash and
+  power loss.
+
+### Missing capability
+
+- No consensus, leader lease, replica fencing, replicated log, or documented
+  multi-process compare-and-swap is present in the evaluated Fold surface.
+  Three active coordinator replicas therefore cannot safely share this state.
+
+### Poor product fit
+
+- The scenario makes three concurrent coordinators and correctness mandatory.
+  The missing distributed coordination is not a bounded throughput
+  optimization; it changes the system's authority model. BogKit is therefore
+  not a fit for the full coordinator.
+
+### Actual BogKit defect
+
+- None demonstrated. Rejecting a second embedded single-writer opener is not a
+  defect. The dependency-inclusive strict-lint failure is a repository quality
+  issue in ANNy, not evidence of a runtime correctness defect in Fold.
+
+## Decision audit
+
+1. **Rejected periodic JSON snapshots.** They acknowledge state that is not yet
+   durable, so the crash requirement fails.
+2. **Rejected the naïve sync-after-every-update JSON comparison.** It requires
+   a full in-place rewrite per mutation and still lacks a crash-safe
+   replacement protocol. Its timing is only a lower bound for a correct
+   snapshot design.
+3. **Selected only Fold.** ESE and ANNy solve embedding/search problems, not
+   durable coordination.
+4. **Used keyed full job records as the source of truth.** This allows one
+   transaction to compare a fence, commit a result, and unlock dependents.
+5. **Materialized ready and leased subsets.** This avoids scanning all 100,000
+   jobs during recovery dispatch or expiry checks.
+6. **Used coordinator-provided time only.** Worker clocks never determine a
+   deadline.
+7. **Batched at most 32 heartbeats.** This is a bounded single-writer throughput
+   optimization; acknowledgment waits for the batch commit.
+8. **Did not invent distributed wrapping.** Adding a consensus service,
+   leader-election system, or remote transactional database would be the real
+   coordinator authority and is outside BogKit and this prototype.
+9. **Concluded no fit.** The multi-writer failure is correctness-critical and
+   cannot be excused by the strong single-process measurements.
+
+## Prototype limits and uncertainty
+
+- The synthetic upper-bound graph uses 10,000 builds with 10 jobs each,
+  arranged as independent chains. It reaches 100,000 jobs but does not cover
+  the full 1-500 job/build distribution or wide fan-in/fan-out.
+- The fault run uses 25 two-job dependency graphs plus one fencing job. It
+  forces 100 post-ack process exits, but does not kill during the storage
+  commit itself because no acknowledgment exists before commit returns.
+- `process::exit` bypasses Rust destructors, but it is not a power-loss test.
+  Fold documents `checkpoint` separately for OS/power durability.
+- The 1 ms expiry result is simulated coordinator time and immediate scheduler
+  invocation. It proves state-machine eligibility, not a five-second
+  production scheduling service-level objective.
+- Heartbeat replay idempotence assumes stable, increasing per-attempt message
+  IDs already exist. The worker protocol was unspecified and cannot be
+  changed; absence of that field is an unresolved scenario/protocol mismatch.
+- Results are local-machine measurements from one run containing three update
+  passes, five recovery samples, and three JSON rewrites. They are not
+  cross-machine capacity guarantees.
+- Batch latency excludes queueing time to collect up to 32 messages. A
+  production implementation would need a bounded flush timer below the 50 ms
+  objective.
+- No network server, dependency discovery, artifact transfer, object-store
+  mutation, autoscaling, UI, authentication, or multi-region behavior is
+  included, matching the stated non-goals.
+- The prototype has no three-replica implementation, because the evaluated
+  component provides no safe basis for one. This is the decisive scenario
+  mismatch, not a hidden prototype TODO.
diff --git a/developer-simulation/runs/2026-07-30--ci-lease-coordinator/README.md b/developer-simulation/runs/2026-07-30--ci-lease-coordinator/README.md
new file mode 100644
index 0000000..6ef5076
--- /dev/null
+++ b/developer-simulation/runs/2026-07-30--ci-lease-coordinator/README.md
@@ -0,0 +1,88 @@
+# CI lease coordinator trial
+
+This is a clean-room evaluation of BogKit's `fold` crate for durable CI
+coordinator state. It is deliberately a prototype, not a production
+coordinator.
+
+## Decision
+
+**BogKit is not a fit for the complete scenario.** After explicit
+coordinator-time deadline checks, Fold handled the modeled single-active-
+coordinator subset: one transaction can fence an attempt, commit an immutable
+result, and make dependent jobs ready without exposing partial state. However,
+Fold opens an embedded single-writer database and rejected a second concurrent
+opener in this trial. It does not provide the consensus, leader fencing, or
+replicated compare-and-swap needed by three concurrently running coordinator
+replicas.
+
+The prototype therefore demonstrates only the useful single-writer subset. It
+does not suggest placing an unsupported replication layer around Fold.
+
+## What it covers
+
+- Durable job, dependency, lease, attempt, terminal-result, and explanation
+  fields.
+- Incrementally maintained ready and leased indexes.
+- Coordinator-time lease acquisition, renewal, expiry, and reassignment.
+- Exact-deadline and far-past-deadline rejection for heartbeats and
+  completions, without reviving the expired attempt.
+- Attempt fencing and immutable terminal results.
+- Atomic dependency readiness after a parent commits.
+- Explicit reasons for blocked, retried, and rejected operations.
+- A deterministic test that exits 100 child coordinator processes immediately
+  after a committed acknowledgment, then reopens state and injects duplicate
+  and reordered messages.
+- A 100,000-job recovery, storage, JSON-baseline, and batched-update benchmark.
+
+## Run
+
+Run from `developer-simulation/`:
+
+```console
+cargo run --release -p ci-lease-coordinator -- demo
+cargo run --release -p ci-lease-coordinator -- bench /tmp/bogkit-ci-lease-benchmark.db
+cargo test -p ci-lease-coordinator
+cargo fmt -p ci-lease-coordinator -- --check
+cargo clippy -p ci-lease-coordinator --all-targets --no-deps -- -D warnings
+```
+
+The subcommands can also be run separately:
+
+```console
+cargo run --release -p ci-lease-coordinator -- baseline
+cargo run --release -p ci-lease-coordinator -- fault /tmp/bogkit-ci-fault.db
+cargo run --release -p ci-lease-coordinator -- multi-writer /tmp/bogkit-ci-writer.db
+```
+
+`demo` uses and resets fixed directories under the system temporary directory.
+`bench` resets the database path passed on its command line and overwrites the
+same path with a `.json` extension for the baseline measurement. Do not point
+either command at valued data.
+
+## State-machine notes
+
+Every lease assigns a new attempt number. Heartbeats and completions must match
+both the worker and attempt, and the coordinator must observe them strictly
+before the stored deadline. Once a completion wins, its attempt and immutable
+object-store key are stored in the terminal record; later messages return a
+reason naming that winner and make no state change.
+
+A completion and all readiness changes it unlocks occur in one Fold
+transaction. A child remains pending until every dependency has a terminal
+record in that same transaction's view.
+
+The heartbeat replay test assumes the existing worker request already has a
+stable, increasing message identifier within an attempt. The problem brief did
+not specify the existing protocol's fields, and changing that protocol is a
+non-goal. If the real protocol lacks such an identifier, exact heartbeat replay
+idempotence is an unresolved protocol mismatch and this prototype is not
+deployable.
+
+The benchmark groups at most 32 heartbeats into one durable transaction and
+acknowledges them after that transaction commits. Its reported latency is the
+batch commit time assigned to each message; it excludes time waiting to form a
+batch, networking, request parsing, and replica coordination. Treat it as an
+embedded-store upper bound.
+
+See [EVIDENCE.md](EVIDENCE.md) for the complete trail, observed output, limits,
+and decision audit.
diff --git a/developer-simulation/runs/2026-07-30--ci-lease-coordinator/src/main.rs b/developer-simulation/runs/2026-07-30--ci-lease-coordinator/src/main.rs
new file mode 100644
index 0000000..0dfc0d7
--- /dev/null
+++ b/developer-simulation/runs/2026-07-30--ci-lease-coordinator/src/main.rs
@@ -0,0 +1,1092 @@
+use std::fs::{self, File};
+use std::io::{BufWriter, Write};
+use std::path::{Path, PathBuf};
+use std::process::{Command, ExitCode};
+use std::time::{Duration, Instant};
+
+use fold::pipeline::{Filter, Keyed, terminal};
+use fold::stream::KeyedStream;
+use serde::{Deserialize, Serialize};
+
+const LEASE_MS: u64 = 30_000;
+const FORCED_EXIT_CODE: i32 = 77;
+
+type JobTable = terminal::Table<u32, Job>;
+type JobFilter = Filter<Keyed<u32, Job>, fn(&Keyed<u32, Job>) -> bool, JobTable>;
+type JobPipeline = (JobTable, JobFilter, JobFilter);
+type JobStore = KeyedStream<u32, Job, JobPipeline>;
+
+#[derive(Clone, Debug, Deserialize, Serialize)]
+enum Status {
+    Pending,
+    Ready,
+    Leased { owner: u32, deadline_ms: u64 },
+    Completed { attempt: u32, result_key: String },
+}
+
+#[derive(Clone, Debug, Deserialize, Serialize)]
+struct Job {
+    build_id: u32,
+    dependencies: Vec<u32>,
+    dependents: Vec<u32>,
+    attempt: u32,
+    status: Status,
+    last_heartbeat_message_id: u64,
+    terminal_message_id: Option<u64>,
+    version: u64,
+    reason: String,
+}
+
+#[derive(Debug)]
+struct Outcome {
+    changed: bool,
+    detail: String,
+}
+
+#[derive(Clone, Copy)]
+struct Heartbeat {
+    job_id: u32,
+    worker: u32,
+    attempt: u32,
+    message_id: u64,
+    coordinator_now_ms: u64,
+}
+
+struct Coordinator {
+    store: JobStore,
+}
+
+impl Coordinator {
+    fn open(path: &Path) -> Self {
+        let pipeline = (
+            terminal::Table::new("jobs"),
+            Filter::new(
+                is_ready as fn(&Keyed<u32, Job>) -> bool,
+                terminal::Table::new("ready"),
+            ),
+            Filter::new(
+                is_leased as fn(&Keyed<u32, Job>) -> bool,
+                terminal::Table::new("leased"),
+            ),
+        );
+        Self {
+            store: KeyedStream::new(path, pipeline),
+        }
+    }
+
+    fn seed_pairs(&mut self, pairs: u32) {
+        self.store.wtx(|tx| {
+            for pair in 0..pairs {
+                let root = pair * 2;
+                let child = root + 1;
+                tx.upsert(
+                    &root,
+                    &Job {
+                        build_id: pair,
+                        dependencies: vec![],
+                        dependents: vec![child],
+                        attempt: 0,
+                        status: Status::Ready,
+                        last_heartbeat_message_id: 0,
+                        terminal_message_id: None,
+                        version: 1,
+                        reason: "ready: no dependencies".to_string(),
+                    },
+                );
+                tx.upsert(
+                    &child,
+                    &Job {
+                        build_id: pair,
+                        dependencies: vec![root],
+                        dependents: vec![],
+                        attempt: 0,
+                        status: Status::Pending,
+                        last_heartbeat_message_id: 0,
+                        terminal_message_id: None,
+                        version: 1,
+                        reason: format!("blocked by unfinished job {root}"),
+                    },
+                );
+            }
+            let fencing_job = pairs * 2;
+            tx.upsert(
+                &fencing_job,
+                &Job {
+                    build_id: pairs,
+                    dependencies: vec![],
+                    dependents: vec![],
+                    attempt: 0,
+                    status: Status::Ready,
+                    last_heartbeat_message_id: 0,
+                    terminal_message_id: None,
+                    version: 1,
+                    reason: "ready: no dependencies".to_string(),
+                },
+            );
+        });
+    }
+
+    fn seed_benchmark_graph(&mut self, builds: u32, jobs_per_build: u32) {
+        self.store.wtx(|tx| {
+            for build in 0..builds {
+                for offset in 0..jobs_per_build {
+                    let id = build * jobs_per_build + offset;
+                    let dependencies = if offset > 0 { vec![id - 1] } else { Vec::new() };
+                    let dependents = if offset + 1 < jobs_per_build {
+                        vec![id + 1]
+                    } else {
+                        Vec::new()
+                    };
+                    let (status, reason) = if dependencies.is_empty() {
+                        (Status::Ready, "ready: no dependencies".to_string())
+                    } else {
+                        (
+                            Status::Pending,
+                            format!("blocked by unfinished job {}", id - 1),
+                        )
+                    };
+                    tx.upsert(
+                        &id,
+                        &Job {
+                            build_id: build,
+                            dependencies,
+                            dependents,
+                            attempt: 0,
+                            status,
+                            last_heartbeat_message_id: 0,
+                            terminal_message_id: None,
+                            version: 1,
+                            reason,
+                        },
+                    );
+                }
+            }
+        });
+    }
+
+    fn job(&self, id: u32) -> Job {
+        self.store
+            .get(&id)
+            .unwrap_or_else(|| panic!("missing job {id}"))
+    }
+
+    fn next_ready(&self) -> Option<u32> {
+        self.store
+            .rtx(|(_, ready, _)| ready.iter().next().map(|(id, _)| id))
+    }
+
+    fn lease_next(&mut self, worker: u32, now_ms: u64) -> Option<(u32, Outcome)> {
+        let id = self.next_ready()?;
+        Some((id, self.lease_job(id, worker, now_ms)))
+    }
+
+    fn lease_job(&mut self, id: u32, worker: u32, now_ms: u64) -> Outcome {
+        self.store.wtx(|tx| {
+            let Some(mut job) = tx.get(&id) else {
+                return Outcome {
+                    changed: false,
+                    detail: format!("rejected: job {id} does not exist"),
+                };
+            };
+            if !matches!(job.status, Status::Ready) {
+                return Outcome {
+                    changed: false,
+                    detail: rejection_for_non_ready(id, &job),
+                };
+            }
+            job.attempt += 1;
+            job.last_heartbeat_message_id = 0;
+            job.status = Status::Leased {
+                owner: worker,
+                deadline_ms: now_ms + LEASE_MS,
+            };
+            job.version += 1;
+            job.reason = format!(
+                "leased to worker {worker} as attempt {} until {} by coordinator time",
+                job.attempt,
+                now_ms + LEASE_MS
+            );
+            let attempt = job.attempt;
+            tx.upsert(&id, &job);
+            Outcome {
+                changed: true,
+                detail: format!("leased job {id}: worker {worker}, attempt {attempt}"),
+            }
+        })
+    }
+
+    fn heartbeat(&mut self, heartbeat: Heartbeat) -> Outcome {
+        self.heartbeat_batch(&[heartbeat])
+            .into_iter()
+            .next()
+            .expect("one heartbeat outcome")
+    }
+
+    fn heartbeat_batch(&mut self, heartbeats: &[Heartbeat]) -> Vec<Outcome> {
+        self.store.wtx(|tx| {
+            heartbeats
+                .iter()
+                .map(|heartbeat| {
+                    let Some(mut job) = tx.get(&heartbeat.job_id) else {
+                        return Outcome {
+                            changed: false,
+                            detail: format!(
+                                "rejected heartbeat: job {} does not exist",
+                                heartbeat.job_id
+                            ),
+                        };
+                    };
+                    let Status::Leased { owner, deadline_ms } = job.status else {
+                        return Outcome {
+                            changed: false,
+                            detail: rejection_for_message("heartbeat", heartbeat.job_id, &job),
+                        };
+                    };
+                    if owner != heartbeat.worker || job.attempt != heartbeat.attempt {
+                        return Outcome {
+                            changed: false,
+                            detail: format!(
+                                "rejected heartbeat for job {}: active fence is worker {owner}, attempt {}; rule requires both to match",
+                                heartbeat.job_id, job.attempt
+                            ),
+                        };
+                    }
+                    if deadline_ms <= heartbeat.coordinator_now_ms {
+                        return Outcome {
+                            changed: false,
+                            detail: format!(
+                                "rejected heartbeat for job {}: attempt {} expired at {deadline_ms}; coordinator observed {}; rule forbids reviving an expired lease",
+                                heartbeat.job_id,
+                                job.attempt,
+                                heartbeat.coordinator_now_ms
+                            ),
+                        };
+                    }
+                    if heartbeat.message_id <= job.last_heartbeat_message_id {
+                        return Outcome {
+                            changed: false,
+                            detail: format!(
+                                "rejected heartbeat for job {}: message {} did not advance winner {} for attempt {}; rule requires a stable increasing per-attempt message id",
+                                heartbeat.job_id,
+                                heartbeat.message_id,
+                                job.last_heartbeat_message_id,
+                                job.attempt
+                            ),
+                        };
+                    }
+                    let new_deadline =
+                        deadline_ms.max(heartbeat.coordinator_now_ms.saturating_add(LEASE_MS));
+                    job.last_heartbeat_message_id = heartbeat.message_id;
+                    job.status = Status::Leased {
+                        owner,
+                        deadline_ms: new_deadline,
+                    };
+                    job.version += 1;
+                    job.reason = format!(
+                        "lease renewed by coordinator message {} until {new_deadline}",
+                        heartbeat.message_id
+                    );
+                    tx.upsert(&heartbeat.job_id, &job);
+                    Outcome {
+                        changed: true,
+                        detail: format!(
+                            "renewed job {} attempt {} until {new_deadline}",
+                            heartbeat.job_id, heartbeat.attempt
+                        ),
+                    }
+                })
+                .collect()
+        })
+    }
+
+    fn complete(
+        &mut self,
+        id: u32,
+        worker: u32,
+        attempt: u32,
+        message_id: u64,
+        coordinator_now_ms: u64,
+        result_key: &str,
+    ) -> Outcome {
+        self.store.wtx(|tx| {
+            let Some(mut job) = tx.get(&id) else {
+                return Outcome {
+                    changed: false,
+                    detail: format!("rejected completion: job {id} does not exist"),
+                };
+            };
+            let Status::Leased { owner, deadline_ms } = &job.status else {
+                return Outcome {
+                    changed: false,
+                    detail: rejection_for_message("completion", id, &job),
+                };
+            };
+            if *owner != worker || job.attempt != attempt {
+                return Outcome {
+                    changed: false,
+                    detail: format!(
+                        "rejected completion for job {id}: active fence is worker {owner}, attempt {}; rule requires both to match",
+                        job.attempt
+                    ),
+                };
+            }
+            if *deadline_ms <= coordinator_now_ms {
+                return Outcome {
+                    changed: false,
+                    detail: format!(
+                        "rejected completion for job {id}: attempt {} expired at {deadline_ms}; coordinator observed {coordinator_now_ms}; rule forbids an expired attempt from winning",
+                        job.attempt
+                    ),
+                };
+            }
+
+            let dependents = job.dependents.clone();
+            job.status = Status::Completed {
+                attempt,
+                result_key: result_key.to_string(),
+            };
+            job.terminal_message_id = Some(message_id);
+            job.version += 1;
+            job.reason = format!(
+                "terminal result committed by worker {worker}, attempt {attempt}, message {message_id}"
+            );
+            tx.upsert(&id, &job);
+
+            for dependent_id in dependents {
+                let Some(mut dependent) = tx.get(&dependent_id) else {
+                    continue;
+                };
+                if !matches!(dependent.status, Status::Pending) {
+                    continue;
+                }
+                let mut blocked = Vec::new();
+                for dependency_id in &dependent.dependencies {
+                    let complete = tx
+                        .get(dependency_id)
+                        .is_some_and(|parent| matches!(parent.status, Status::Completed { .. }));
+                    if !complete {
+                        blocked.push(*dependency_id);
+                    }
+                }
+                dependent.version += 1;
+                if blocked.is_empty() {
+                    dependent.status = Status::Ready;
+                    dependent.reason =
+                        format!("ready: all dependencies completed after job {id}");
+                } else {
+                    dependent.reason = format!("blocked by unfinished jobs {blocked:?}");
+                }
+                tx.upsert(&dependent_id, &dependent);
+            }
+
+            Outcome {
+                changed: true,
+                detail: format!(
+                    "committed terminal winner for job {id}: attempt {attempt}, result {result_key}"
+                ),
+            }
+        })
+    }
+
+    fn reap_expired(&mut self, now_ms: u64) -> usize {
+        let expired: Vec<u32> = self.store.rtx(|(_, _, leased)| {
+            leased
+                .iter()
+                .filter_map(|(id, job)| match job.status {
+                    Status::Leased { deadline_ms, .. } if deadline_ms <= now_ms => Some(id),
+                    _ => None,
+                })
+                .collect()
+        });
+        self.store.wtx(|tx| {
+            for id in &expired {
+                let Some(mut job) = tx.get(id) else {
+                    continue;
+                };
+                let Status::Leased { deadline_ms, .. } = job.status else {
+                    continue;
+                };
+                if deadline_ms > now_ms {
+                    continue;
+                }
+                job.status = Status::Ready;
+                job.version += 1;
+                job.reason = format!(
+                    "retry ready: attempt {} expired at {deadline_ms}; coordinator observed {now_ms}",
+                    job.attempt
+                );
+                tx.upsert(id, &job);
+            }
+        });
+        expired.len()
+    }
+
+    fn checkpoint(&mut self) {
+        self.store.checkpoint();
+    }
+}
+
+fn is_ready(job: &Keyed<u32, Job>) -> bool {
+    matches!(job.val.status, Status::Ready)
+}
+
+fn is_leased(job: &Keyed<u32, Job>) -> bool {
+    matches!(job.val.status, Status::Leased { .. })
+}
+
+fn rejection_for_non_ready(id: u32, job: &Job) -> String {
+    match &job.status {
+        Status::Pending => format!("rejected lease for job {id}: {}", job.reason),
+        Status::Leased { owner, .. } => format!(
+            "rejected lease for job {id}: winner is active worker {owner}, attempt {}; rule forbids a second live lease",
+            job.attempt
+        ),
+        Status::Completed {
+            attempt,
+            result_key,
+        } => format!(
+            "rejected lease for job {id}: terminal winner is attempt {attempt}, result {result_key}; rule forbids retry after completion"
+        ),
+        Status::Ready => unreachable!("caller checks ready"),
+    }
+}
+
+fn rejection_for_message(kind: &str, id: u32, job: &Job) -> String {
+    match &job.status {
+        Status::Completed {
+            attempt,
+            result_key,
+        } => format!(
+            "rejected {kind} for job {id}: terminal winner is attempt {attempt}, result {result_key}; rule says terminal results are immutable"
+        ),
+        Status::Pending => format!("rejected {kind} for job {id}: {}", job.reason),
+        Status::Ready => format!(
+            "rejected {kind} for job {id}: no active lease; rule requires a matching active attempt"
+        ),
+        Status::Leased { .. } => unreachable!("caller handles leased"),
+    }
+}
+
+#[derive(Clone, Debug, Deserialize, Serialize)]
+struct SnapshotJob {
+    attempt: u32,
+    lease_owner: Option<u32>,
+}
+
+fn baseline_demo() {
+    let durable_snapshot = serde_json::to_vec(&vec![SnapshotJob {
+        attempt: 0,
+        lease_owner: None,
+    }])
+    .expect("encode baseline snapshot");
+    let mut in_memory: Vec<SnapshotJob> =
+        serde_json::from_slice(&durable_snapshot).expect("load baseline snapshot");
+    in_memory[0].attempt += 1;
+    in_memory[0].lease_owner = Some(7);
+    let first_ack = in_memory[0].clone();
+
+    let mut after_crash: Vec<SnapshotJob> =
+        serde_json::from_slice(&durable_snapshot).expect("reload baseline snapshot");
+    after_crash[0].attempt += 1;
+    after_crash[0].lease_owner = Some(8);
+    let second_ack = after_crash[0].clone();
+
+    println!(
+        "baseline failure: acknowledged worker {:?}; restart leased {:?}; both received fencing attempt {}",
+        first_ack.lease_owner, second_ack.lease_owner, second_ack.attempt
+    );
+}
+
+fn crash_child(args: &[String]) -> ExitCode {
+    let path = Path::new(&args[2]);
+    let operation = &args[3];
+    let id: u32 = args[4].parse().expect("job id");
+    let worker: u32 = args[5].parse().expect("worker");
+    let mut coordinator = Coordinator::open(path);
+    let outcome = match operation.as_str() {
+        "lease" => {
+            let now_ms: u64 = args[6].parse().expect("coordinator time");
+            coordinator.lease_job(id, worker, now_ms)
+        }
+        "heartbeat" => {
+            let attempt: u32 = args[6].parse().expect("attempt");
+            let message_id: u64 = args[7].parse().expect("message id");
+            let now_ms: u64 = args[8].parse().expect("coordinator time");
+            coordinator.heartbeat(Heartbeat {
+                job_id: id,
+                worker,
+                attempt,
+                message_id,
+                coordinator_now_ms: now_ms,
+            })
+        }
+        "complete" => {
+            let attempt: u32 = args[6].parse().expect("attempt");
+            let message_id: u64 = args[7].parse().expect("message id");
+            let now_ms: u64 = args[8].parse().expect("coordinator time");
+            coordinator.complete(id, worker, attempt, message_id, now_ms, &args[9])
+        }
+        other => panic!("unknown crash operation {other}"),
+    };
+    assert!(
+        outcome.changed,
+        "crash step must mutate: {}",
+        outcome.detail
+    );
+    println!("ACK {}", outcome.detail);
+    std::io::stdout().flush().expect("flush ack");
+    std::process::exit(FORCED_EXIT_CODE);
+}
+
+fn run_crash_step(path: &Path, operation: &[String]) {
+    let output = Command::new(std::env::current_exe().expect("current executable"))
+        .arg("crash-step")
+        .arg(path)
+        .args(operation)
+        .output()
+        .expect("spawn forced-termination child");
+    assert_eq!(output.status.code(), Some(FORCED_EXIT_CODE));
+    let stdout = String::from_utf8(output.stdout).expect("child stdout");
+    assert!(stdout.starts_with("ACK "), "missing child ack: {stdout}");
+}
+
+fn fault_demo(path: &Path) {
+    reset_dir(path);
+    {
+        let mut coordinator = Coordinator::open(path);
+        coordinator.seed_pairs(25);
+    }
+
+    let mut terminations = 0;
+    for pair in 0..25u32 {
+        let root = pair * 2;
+        let child = root + 1;
+        let root_worker = 1_000 + root;
+        let child_worker = 2_000 + child;
+        let heartbeat_id = 10_000 + u64::from(root);
+
+        run_crash_step(
+            path,
+            &[
+                "lease".to_string(),
+                root.to_string(),
+                root_worker.to_string(),
+                "100".to_string(),
+            ],
+        );
+        terminations += 1;
+        {
+            let mut coordinator = Coordinator::open(path);
+            assert!(matches!(coordinator.job(child).status, Status::Pending));
+            let before = coordinator.job(root).version;
+            let duplicate = coordinator.lease_job(root, root_worker, 100);
+            assert!(!duplicate.changed);
+            assert_eq!(coordinator.job(root).version, before);
+        }
+
+        run_crash_step(
+            path,
+            &[
+                "heartbeat".to_string(),
+                root.to_string(),
+                root_worker.to_string(),
+                "1".to_string(),
+                heartbeat_id.to_string(),
+                "1_000".replace('_', ""),
+            ],
+        );
+        terminations += 1;
+        {
+            let mut coordinator = Coordinator::open(path);
+            let before = coordinator.job(root).version;
+            let duplicate = coordinator.heartbeat(Heartbeat {
+                job_id: root,
+                worker: root_worker,
+                attempt: 1,
+                message_id: heartbeat_id,
+                coordinator_now_ms: 2_000,
+            });
+            assert!(!duplicate.changed);
+            assert_eq!(coordinator.job(root).version, before);
+        }
+
+        run_crash_step(
+            path,
+            &[
+                "complete".to_string(),
+                root.to_string(),
+                root_worker.to_string(),
+                "1".to_string(),
+                (20_000 + u64::from(root)).to_string(),
+                "2_500".replace('_', ""),
+                format!("objects/build-{pair}/root"),
+            ],
+        );
+        terminations += 1;
+        {
+            let mut coordinator = Coordinator::open(path);
+            assert!(matches!(coordinator.job(child).status, Status::Ready));
+            let before = coordinator.job(root).version;
+            let replay = coordinator.complete(
+                root,
+                root_worker,
+                1,
+                20_000 + u64::from(root),
+                2_500,
+                &format!("objects/build-{pair}/root"),
+            );
+            assert!(!replay.changed);
+            assert!(replay.detail.contains("terminal winner"));
+            let reordered_heartbeat = coordinator.heartbeat(Heartbeat {
+                job_id: root,
+                worker: root_worker,
+                attempt: 1,
+                message_id: heartbeat_id + 1,
+                coordinator_now_ms: 3_000,
+            });
+            assert!(!reordered_heartbeat.changed);
+            assert_eq!(coordinator.job(root).version, before);
+        }
+
+        run_crash_step(
+            path,
+            &[
+                "lease".to_string(),
+                child.to_string(),
+                child_worker.to_string(),
+                "4_000".replace('_', ""),
+            ],
+        );
+        terminations += 1;
+        {
+            let mut coordinator = Coordinator::open(path);
+            let before = coordinator.job(child).version;
+            let duplicate = coordinator.lease_job(child, child_worker, 4_000);
+            assert!(!duplicate.changed);
+            assert_eq!(coordinator.job(child).version, before);
+        }
+    }
+    assert_eq!(terminations, 100);
+
+    let fencing_job = 50;
+    let mut coordinator = Coordinator::open(path);
+    assert!(coordinator.lease_job(fencing_job, 41, 0).changed);
+    let before_expired_messages = coordinator.job(fencing_job).version;
+    let expired_heartbeat = coordinator.heartbeat(Heartbeat {
+        job_id: fencing_job,
+        worker: 41,
+        attempt: 1,
+        message_id: 90_000,
+        coordinator_now_ms: 30_001,
+    });
+    assert!(!expired_heartbeat.changed);
+    assert!(expired_heartbeat.detail.contains("expired at 30000"));
+    let expired_completion = coordinator.complete(
+        fencing_job,
+        41,
+        1,
+        90_001,
+        30_001,
+        "objects/fencing/expired",
+    );
+    assert!(!expired_completion.changed);
+    assert!(expired_completion.detail.contains("expired at 30000"));
+    assert_eq!(
+        coordinator.job(fencing_job).version,
+        before_expired_messages
+    );
+    assert_eq!(coordinator.reap_expired(30_001), 1);
+    let retry_ready_after_ms = 1;
+    assert!(coordinator.lease_job(fencing_job, 42, 30_001).changed);
+    assert_eq!(coordinator.job(fencing_job).attempt, 2);
+    let winner = coordinator.complete(fencing_job, 42, 2, 90_002, 30_002, "objects/fencing/winner");
+    assert!(winner.changed);
+    let before = coordinator.job(fencing_job).version;
+    let late = coordinator.complete(fencing_job, 41, 1, 90_003, 30_003, "objects/fencing/late");
+    assert!(!late.changed);
+    assert!(late.detail.contains("attempt 2"));
+    assert!(late.detail.contains("objects/fencing/winner"));
+    assert_eq!(coordinator.job(fencing_job).version, before);
+
+    println!(
+        "fault test passed: {terminations} forced process exits after ACK; duplicate/reordered messages were no-ops; heartbeat and completion observed after expiry were rejected without mutation; expiry became retry-ready in {retry_ready_after_ms} ms; late attempt rejection: {}",
+        late.detail
+    );
+}
+
+fn multi_writer_demo(path: &Path) {
+    reset_dir(path);
+    let _first = Coordinator::open(path);
+    let old_hook = std::panic::take_hook();
+    std::panic::set_hook(Box::new(|_| {}));
+    let second = std::panic::catch_unwind(std::panic::AssertUnwindSafe(|| Coordinator::open(path)));
+    std::panic::set_hook(old_hook);
+    match second {
+        Ok(_) => println!(
+            "multi-writer check: a second handle opened, but Fold exposes no replica consensus, leader fencing, or cross-process compare-and-swap contract; requirement remains unproven"
+        ),
+        Err(_) => println!(
+            "multi-writer check: second concurrent Fold opener was rejected; this embedded single-writer component cannot host three active coordinator replicas"
+        ),
+    }
+}
+
+fn benchmark(path: &Path) {
+    reset_dir(path);
+    let json_path = path.with_extension("json");
+    let seed_jobs = benchmark_jobs(10_000, 10);
+    let mut json_durations = Vec::new();
+    let mut json_bytes = 0;
+    for _ in 0..3 {
+        let started = Instant::now();
+        let file = File::create(&json_path).expect("create JSON snapshot");
+        let mut writer = BufWriter::new(file);
+        serde_json::to_writer(&mut writer, &seed_jobs).expect("write JSON snapshot");
+        writer.flush().expect("flush JSON");
+        writer.get_ref().sync_all().expect("sync JSON snapshot");
+        json_durations.push(started.elapsed());
+        json_bytes = writer.get_ref().metadata().expect("JSON metadata").len();
+    }
+    println!(
+        "JSON full rewrite (100,000 jobs, {} bytes), repeated sync times: {}",
+        json_bytes,
+        display_durations(&json_durations)
+    );
+
+    let seed_started = Instant::now();
+    let mut coordinator = Coordinator::open(path);
+    coordinator.seed_benchmark_graph(10_000, 10);
+    coordinator.checkpoint();
+    let seed_elapsed = seed_started.elapsed();
+    drop(coordinator);
+
+    let mut recovery_times = Vec::new();
+    for worker in 0..5 {
+        let started = Instant::now();
+        let mut recovered = Coordinator::open(path);
+        let lease = recovered
+            .lease_next(50_000 + worker, 100)
+            .expect("ready work after recovery");
+        assert!(lease.1.changed);
+        recovery_times.push(started.elapsed());
+    }
+
+    let mut coordinator = Coordinator::open(path);
+    let mut leased = Vec::new();
+    for worker in 0..500 {
+        let (id, outcome) = coordinator
+            .lease_next(60_000 + worker, 1_000)
+            .expect("500 ready benchmark jobs");
+        assert!(outcome.changed);
+        leased.push((id, 60_000 + worker, coordinator.job(id).attempt));
+    }
+
+    let mut all_message_latencies = Vec::new();
+    for pass in 0..3u64 {
+        let pass_started = Instant::now();
+        let mut pass_latencies = Vec::with_capacity(2_000);
+        for batch_start in (0..2_000usize).step_by(32) {
+            let batch_end = (batch_start + 32).min(2_000);
+            let mut batch = Vec::with_capacity(batch_end - batch_start);
+            for update in batch_start..batch_end {
+                let (job_id, worker, attempt) = leased[update % leased.len()];
+                batch.push(Heartbeat {
+                    job_id,
+                    worker,
+                    attempt,
+                    message_id: pass * 2_000 + update as u64 + 1,
+                    coordinator_now_ms: 2_000 + pass,
+                });
+            }
+            let started = Instant::now();
+            let outcomes = coordinator.heartbeat_batch(&batch);
+            let elapsed = started.elapsed();
+            assert!(outcomes.iter().all(|outcome| outcome.changed));
+            pass_latencies.extend(std::iter::repeat_n(elapsed, batch.len()));
+        }
+        let wall = pass_started.elapsed();
+        let rate = 2_000.0 / wall.as_secs_f64();
+        let p99 = percentile_99(&mut pass_latencies);
+        println!(
+            "batched heartbeat pass {}: 2,000 updates in {:.3}s = {:.0} updates/s; message p99 commit latency {:.3} ms",
+            pass + 1,
+            wall.as_secs_f64(),
+            rate,
+            p99.as_secs_f64() * 1_000.0
+        );
+        all_message_latencies.extend(pass_latencies);
+    }
+    coordinator.checkpoint();
+    drop(coordinator);
+
+    let state_bytes = directory_size(path);
+    let overall_p99 = percentile_99(&mut all_message_latencies);
+    println!(
+        "Fold upper-bound sample: seed/checkpoint {:.3}s; five reopen+lease times {}; overall message p99 {:.3} ms; persistent directory {} bytes",
+        seed_elapsed.as_secs_f64(),
+        display_durations(&recovery_times),
+        overall_p99.as_secs_f64() * 1_000.0,
+        state_bytes
+    );
+}
+
+fn benchmark_jobs(builds: u32, jobs_per_build: u32) -> Vec<Job> {
+    let mut jobs = Vec::with_capacity((builds * jobs_per_build) as usize);
+    for build in 0..builds {
+        for offset in 0..jobs_per_build {
+            let id = build * jobs_per_build + offset;
+            jobs.push(Job {
+                build_id: build,
+                dependencies: if offset > 0 { vec![id - 1] } else { Vec::new() },
+                dependents: if offset + 1 < jobs_per_build {
+                    vec![id + 1]
+                } else {
+                    Vec::new()
+                },
+                attempt: 0,
+                status: if offset == 0 {
+                    Status::Ready
+                } else {
+                    Status::Pending
+                },
+                last_heartbeat_message_id: 0,
+                terminal_message_id: None,
+                version: 1,
+                reason: if offset == 0 {
+                    "ready: no dependencies".to_string()
+                } else {
+                    format!("blocked by unfinished job {}", id - 1)
+                },
+            });
+        }
+    }
+    jobs
+}
+
+fn percentile_99(durations: &mut [Duration]) -> Duration {
+    durations.sort_unstable();
+    durations[(durations.len() * 99 / 100).min(durations.len() - 1)]
+}
+
+fn display_durations(durations: &[Duration]) -> String {
+    durations
+        .iter()
+        .map(|duration| format!("{:.3}s", duration.as_secs_f64()))
+        .collect::<Vec<_>>()
+        .join(", ")
+}
+
+fn directory_size(path: &Path) -> u64 {
+    fs::read_dir(path)
+        .expect("read state directory")
+        .map(|entry| {
+            let entry = entry.expect("state entry");
+            let metadata = entry.metadata().expect("state metadata");
+            if metadata.is_dir() {
+                directory_size(&entry.path())
+            } else {
+                metadata.len()
+            }
+        })
+        .sum()
+}
+
+fn reset_dir(path: &Path) {
+    if path.exists() {
+        fs::remove_dir_all(path).expect("remove prior demonstration state");
+    }
+}
+
+fn demo_paths() -> (PathBuf, PathBuf) {
+    let base = std::env::temp_dir();
+    (
+        base.join("bogkit-ci-lease-fault-demo.db"),
+        base.join("bogkit-ci-lease-multi-writer.db"),
+    )
+}
+
+fn usage() {
+    eprintln!(
+        "usage: ci-lease-coordinator <demo|fault [path]|baseline|multi-writer [path]|bench [path]>"
+    );
+}
+
+fn main() -> ExitCode {
+    let args: Vec<String> = std::env::args().collect();
+    match args.get(1).map(String::as_str) {
+        Some("crash-step") => crash_child(&args),
+        Some("baseline") => {
+            baseline_demo();
+            ExitCode::SUCCESS
+        }
+        Some("fault") => {
+            let path = args
+                .get(2)
+                .map(PathBuf::from)
+                .unwrap_or_else(|| demo_paths().0);
+            fault_demo(&path);
+            ExitCode::SUCCESS
+        }
+        Some("multi-writer") => {
+            let path = args
+                .get(2)
+                .map(PathBuf::from)
+                .unwrap_or_else(|| demo_paths().1);
+            multi_writer_demo(&path);
+            ExitCode::SUCCESS
+        }
+        Some("bench") => {
+            let path = args
+                .get(2)
+                .map(PathBuf::from)
+                .unwrap_or_else(|| std::env::temp_dir().join("bogkit-ci-lease-benchmark.db"));
+            benchmark(&path);
+            ExitCode::SUCCESS
+        }
+        Some("demo") => {
+            let (fault_path, multi_writer_path) = demo_paths();
+            baseline_demo();
+            fault_demo(&fault_path);
+            multi_writer_demo(&multi_writer_path);
+            ExitCode::SUCCESS
+        }
+        _ => {
+            usage();
+            ExitCode::from(2)
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::sync::atomic::{AtomicU64, Ordering};
+
+    static NEXT_DB: AtomicU64 = AtomicU64::new(0);
+
+    fn test_path(name: &str) -> PathBuf {
+        std::env::temp_dir().join(format!(
+            "bogkit-ci-{name}-{}-{}",
+            std::process::id(),
+            NEXT_DB.fetch_add(1, Ordering::Relaxed)
+        ))
+    }
+
+    #[test]
+    fn dependency_only_becomes_ready_after_parent_terminal_commit() {
+        let path = test_path("dependency");
+        let mut coordinator = Coordinator::open(&path);
+        coordinator.seed_pairs(1);
+        assert!(matches!(coordinator.job(1).status, Status::Pending));
+        assert!(coordinator.lease_job(0, 7, 0).changed);
+        assert!(matches!(coordinator.job(1).status, Status::Pending));
+        assert!(
+            coordinator
+                .complete(0, 7, 1, 1, 1_000, "objects/parent")
+                .changed
+        );
+        assert!(matches!(coordinator.job(1).status, Status::Ready));
+    }
+
+    #[test]
+    fn duplicate_and_reordered_messages_do_not_mutate() {
+        let path = test_path("replay");
+        let mut coordinator = Coordinator::open(&path);
+        coordinator.seed_pairs(1);
+        assert!(coordinator.lease_job(0, 7, 0).changed);
+        let heartbeat = Heartbeat {
+            job_id: 0,
+            worker: 7,
+            attempt: 1,
+            message_id: 10,
+            coordinator_now_ms: 1_000,
+        };
+        assert!(coordinator.heartbeat(heartbeat).changed);
+        let after_first = coordinator.job(0).version;
+        assert!(!coordinator.heartbeat(heartbeat).changed);
+        assert_eq!(coordinator.job(0).version, after_first);
+        assert!(
+            coordinator
+                .complete(0, 7, 1, 11, 2_000, "objects/winner")
+                .changed
+        );
+        let after_complete = coordinator.job(0).version;
+        assert!(
+            !coordinator
+                .heartbeat(Heartbeat {
+                    message_id: 12,
+                    ..heartbeat
+                })
+                .changed
+        );
+        assert!(
+            !coordinator
+                .complete(0, 7, 1, 11, 2_000, "objects/winner")
+                .changed
+        );
+        assert_eq!(coordinator.job(0).version, after_complete);
+    }
+
+    #[test]
+    fn expired_attempt_cannot_overwrite_winner() {
+        let path = test_path("fence");
+        let mut coordinator = Coordinator::open(&path);
+        coordinator.seed_pairs(0);
+        assert!(coordinator.lease_job(0, 7, 0).changed);
+        assert_eq!(coordinator.reap_expired(30_001), 1);
+        assert!(coordinator.lease_job(0, 8, 30_001).changed);
+        assert!(
+            coordinator
+                .complete(0, 8, 2, 2, 30_002, "objects/winner")
+                .changed
+        );
+        let before = coordinator.job(0).version;
+        let late = coordinator.complete(0, 7, 1, 1, 30_003, "objects/late");
+        assert!(!late.changed);
+        assert!(late.detail.contains("attempt 2"));
+        assert!(late.detail.contains("objects/winner"));
+        assert_eq!(coordinator.job(0).version, before);
+    }
+
+    #[test]
+    fn expired_messages_cannot_revive_or_complete_a_lease() {
+        let path = test_path("expired-messages");
+        let mut coordinator = Coordinator::open(&path);
+        coordinator.seed_pairs(0);
+        assert!(coordinator.lease_job(0, 7, 0).changed);
+        let leased_version = coordinator.job(0).version;
+
+        let at_deadline = coordinator.heartbeat(Heartbeat {
+            job_id: 0,
+            worker: 7,
+            attempt: 1,
+            message_id: 1,
+            coordinator_now_ms: LEASE_MS,
+        });
+        assert!(!at_deadline.changed);
+        assert!(at_deadline.detail.contains("expired at 30000"));
+        assert_eq!(coordinator.job(0).version, leased_version);
+
+        let far_past = coordinator.complete(0, 7, 1, 2, 999_999, "objects/expired-attempt");
+        assert!(!far_past.changed);
+        assert!(far_past.detail.contains("expired at 30000"));
+        assert_eq!(coordinator.job(0).version, leased_version);
+
+        assert_eq!(coordinator.reap_expired(999_999), 1);
+        assert!(coordinator.lease_job(0, 8, 999_999).changed);
+        assert_eq!(coordinator.job(0).attempt, 2);
+        let reassigned_version = coordinator.job(0).version;
+
+        let stale_heartbeat = coordinator.heartbeat(Heartbeat {
+            job_id: 0,
+            worker: 7,
+            attempt: 1,
+            message_id: 3,
+            coordinator_now_ms: 1_000_000,
+        });
+        assert!(!stale_heartbeat.changed);
+        let stale_completion = coordinator.complete(0, 7, 1, 4, 1_000_000, "objects/stale-attempt");
+        assert!(!stale_completion.changed);
+        assert_eq!(coordinator.job(0).version, reassigned_version);
+    }
+}
diff --git a/developer-simulation/runs/2026-07-30--fraud-velocity-evaluation/Cargo.toml b/developer-simulation/runs/2026-07-30--fraud-velocity-evaluation/Cargo.toml
new file mode 100644
index 0000000..0cb6b40
--- /dev/null
+++ b/developer-simulation/runs/2026-07-30--fraud-velocity-evaluation/Cargo.toml
@@ -0,0 +1,12 @@
+[package]
+name = "fraud-velocity-evaluation"
+version = "0.1.0"
+edition.workspace = true
+publish.workspace = true
+
+[lints.rust]
+unsafe_code = "forbid"
+
+[lints.clippy]
+all = "warn"
+pedantic = "allow"
diff --git a/developer-simulation/runs/2026-07-30--fraud-velocity-evaluation/EVIDENCE.md b/developer-simulation/runs/2026-07-30--fraud-velocity-evaluation/EVIDENCE.md
new file mode 100644
index 0000000..71ce5b3
--- /dev/null
+++ b/developer-simulation/runs/2026-07-30--fraud-velocity-evaluation/EVIDENCE.md
@@ -0,0 +1,216 @@
+# Evidence: fraud velocity blind evaluation
+
+Run date: 2026-07-30
+Environment: arm64 macOS 26.5.2, Rust 1.95.0, release profile inherited from the
+workspace (`opt-level=3`, one codegen unit, fat LTO).
+
+## Outcome
+
+**Decision: BogKit is not a fit for this scenario on the evidence available.**
+
+The Redis baseline is incorrect under duplicate and late delivery. Fold offers
+useful embedded transactional materialization and ranked event-time range
+indexing, but the public contracts inspected do not cover the full correctness
+boundary: maintained multi-rule aggregates with linked retroactive corrections,
+two-ID deduplication, deletion policy, four-replica partition ownership and
+transfer, or atomic coordination with durable-stream offsets. Using Fold only
+as a local time index would leave the consequential system semantics custom and
+unverified. ESE and ANNy are unrelated to this problem.
+
+The prototype independently demonstrates the intended deterministic semantics,
+but it does not satisfy the full acceptance run. No BogKit correctness defect was
+found because no BogKit component was forced into a job outside its documented
+contract.
+
+## Ordered discovery and friction trail
+
+1. Read the root `README.md` and then all four public example manifests and
+   sources (`starter`, `timeseries`, `chat`, and `search`). The public path showed
+   durable inserts/retractions, keyed upsert/remove, aggregates, and consistent
+   snapshots.
+2. While enumerating examples, a local zsh command used the special lowercase
+   variable `path`, which temporarily replaced zsh's command search path. The
+   command stopped after read-only output; no file changed. Rerunning with
+   `file_name` completed the read.
+3. Built and ran the Redis-style independent-TTL reproducer before inspecting
+   Fold internals or selecting a component. One duplicate changed both counters
+   from `(1, 1)` to `(2, 2)`. A later arrival whose event time was still inside
+   the same minute returned `(1, 1)` because arrival-time TTLs had expired. The
+   design retained no contributing event list.
+4. Inspected Fold's public crate, stream, keyed stream, scoring, retention,
+   ranked-index, tests, and manifest contracts. Positive findings: single-writer
+   crash-safe transactions, atomic keyed upsert/remove, deterministic
+   retractions, time-ordered range scans, and persistent materializations.
+5. Rejected `Retain`: its documentation explicitly defines a processing-time
+   window stamped by transaction wall clock and calls persistence across clock
+   jumps best-effort. That is incompatible with event-time replay and 15-minute
+   late correction.
+6. Rejected `TopK`: timestamp scoring produces the most recent *N records*, not
+   1-minute, 10-minute, and 24-hour duration windows.
+7. Considered `Ranked`/keyed ranked state as a narrow event-time index. Rejected
+   adoption because it would not supply deduplication across both IDs, linked
+   decision revisions, explanation retention, deletion policy, broker-offset
+   atomicity, or replica partition transfer. The critical behavior would still
+   be application-owned.
+8. Built the dependency-free reference prototype. The first test pass caught a
+   real prototype deletion defect: empty account-index containers survived after
+   their final rows were removed. The deletion scan rejected the result. Removing
+   empty containers fixed it; all five behavioral tests then passed.
+9. Ran formatting, strict lint, the release demonstration, and three release
+   benchmark rounds. The release digest was identical in every round.
+
+## Categorized findings
+
+### Baseline defects (not BogKit defects)
+
+- **Correctness defect:** retries double-count because neither event ID nor
+  merchant event ID is checked before increment.
+- **Correctness defect:** independent arrival-time TTLs disagree with event-time
+  windows and cannot deterministically correct prior decisions.
+- **Missing baseline capability:** counters alone cannot reconstruct an alert's
+  exact contributors.
+- **Performance problem:** the baseline requires separate remote operations for
+  account, card, device, and IP state on the checkout path. This trial did not
+  connect to Redis, so no network-latency number is claimed.
+
+### BogKit evaluation
+
+- **Poor product fit:** Fold is an embedded single-writer dataflow store; the
+  scenario's hard boundary includes four stream consumers with partition
+  reassignment.
+- **Missing capability:** no inspected public contract coordinates a Fold
+  transaction with a durable-stream offset or transfers state when a partition
+  moves.
+- **Missing capability:** `Ranked` and `KeyedRanked` supply event-time range
+  scans, but no inspected operator maintains the complete multi-rule
+  aggregation, linked correction, deduplication, and deletion semantics.
+- **API friction:** pipeline types include closure types, and the examples use
+  local macros where ordinary helper signatures cannot name the reader type.
+  That is manageable for an experienced Rust developer, but material friction
+  for the stated Rust-beginner persona.
+- **Documentation gap:** the root guide points to generated Fold documentation
+  but does not surface the crucial processing-time versus event-time distinction.
+  The detailed `Retain` documentation itself is clear once found.
+- **Actual BogKit defect:** none demonstrated.
+
+### Prototype evidence
+
+- **Correctness:** the indexed engine matched a separately implemented naive
+  scan for every latest decision in the demonstration fixture.
+- **Deduplication:** 10 deliveries became 9 events; the duplicate changed no
+  state or decision record.
+- **Late data:** late event 8 generated 6 linked corrections.
+- **Replay:** uninterrupted and normal close/reopen paths produced 3,311
+  byte-identical decision bytes. No crash or torn-write behavior was tested.
+- **Explanations:** all 15 emitted alert outcomes were internally
+  reconstructable from retained event records. The independent naïve reference
+  validates latest decisions, not every historical correction revision.
+- **Deletion:** 4 events owned by account 100 had their account and card keys
+  scrubbed in memory; the audit captured both identifiers and checked the
+  retained event rows plus account/card indexes. A retained event's shared
+  device/IP counts were unchanged, and retained alerts reconstructed.
+- **Determinism:** the demonstration digest was `2a763be27500e742`.
+
+### Prototype limits
+
+- Persistence is an append-only fixture ledger with one sync per accepted event,
+  not an optimized production log.
+- Customer deletion is verified for in-memory retained/indexed state; durable
+  ledger compaction and a post-compaction disk scan are not implemented.
+- Normal close/reopen replay uses one canonical delivery order. It does not
+  simulate a crash, torn write, four replicas, cross-partition scheduling,
+  reassignment, or stream-offset commits.
+- `PersistentEngine` mutates memory before appending and syncing its ledger. A
+  write or sync error can leave memory ahead of disk, and a torn final TSV row
+  prevents reopening.
+- The rule set is fixed and partitions amount totals by currency. It counts all
+  authorization attempts; production policy would need to confirm that choice.
+- The benchmark uses mostly sparse keys, stores full canonical decision output
+  in memory, and reports a payload lower bound, not allocator overhead or
+  resident-set size. It is an in-memory upper bound, not a production load
+  result.
+- The trial did not run the required 20-million-event state test or sustain load
+  for 30 minutes. It therefore makes no full-acceptance performance or storage
+  claim.
+
+## Decision audit
+
+1. **Chose canonical ordering:** arrivals by `(arrival_time, event_id)` and
+   event-time contributions by `(event_time, event_id)`. Rejected wall clock and
+   hash-map iteration because replay bytes must not depend on timing or map order.
+2. **Chose two-ID deduplication:** either event ID or merchant event ID blocks a
+   retry; a conflicting reuse is rejected. Rejected “last write wins” because it
+   would silently revise the payment fact.
+3. **Chose explicit revisions:** late events recompute only later canonical
+   events sharing an affected identifier and append a correction linked to the
+   previous revision. Rejected silent aggregate mutation because analysts need
+   an audit trail.
+4. **Chose contributor IDs only on alerts:** all decisions retain counts and
+   totals, while alerts additionally retain exact event IDs. Rejected contributor
+   arrays on every non-alert because they grow storage without serving the stated
+   explanation requirement.
+5. **Chose account/card scrubbing with shared device/IP retention:** this directly
+   tests the deletion boundary. Rejected wholesale event removal because that
+   corrupts shared aggregates.
+6. **Rejected partial Fold adoption:** `Ranked` could replace the prototype's
+   ordered maps, but that substitution would not reduce the highest-risk custom
+   logic and would create an unsupported impression of end-to-end fit.
+7. **Uncertainty:** a production architecture could wrap Fold with partition-local
+   ownership, an outbox/offset protocol, Fold's range indexes, custom
+   correction semantics, and deletion compaction. This trial did not build or benchmark
+   that larger system, so it cannot rule out such an architecture; it does show
+   that BogKit does not currently supply the required boundary as a small,
+   justified adoption.
+
+## Exact validation commands and observed results
+
+```console
+$ cargo run -p fraud-velocity-evaluation -- baseline
+redis baseline
+  duplicate event 10 changed both counts: (1, 1) -> (2, 2)
+  late event 11 belongs with event 10 in event time, but arrival-time TTL returned (1, 1)
+  no retained contribution list can explain either result
+```
+
+```console
+$ cargo test -p fraud-velocity-evaluation
+running 5 tests
+test result: ok. 5 passed; 0 failed
+```
+
+```console
+$ cargo fmt -p fraud-velocity-evaluation -- --check
+# exit 0, no output
+```
+
+```console
+$ cargo clippy -p fraud-velocity-evaluation --all-targets -- -D warnings
+Finished `dev` profile [optimized + debuginfo]
+# exit 0
+```
+
+```console
+$ cargo run --release -p fraud-velocity-evaluation -- demo
+10 deliveries -> 9 unique events; 1 duplicate ignored
+6 linked corrections from late event 8; 6 total corrections
+15 canonical records; 15 alert explanations; digest 2a763be27500e742
+normal close/reopen replay
+uninterrupted and reopened ledgers produced 3311 identical decision bytes
+scrubbed 4 account-owned events and audited account/card removal; shared device/IP counts unchanged
+demo: PASS
+```
+
+```console
+$ cargo run --release -p fraud-velocity-evaluation -- benchmark 100000 3
+sparse-key latest-state naive-reference comparison: PASS (2000 unique events)
+round 1: 971105 deliveries/s, p99 0.002 ms, 134 corrections, 50056 alert outcomes, digest 0fb37b9c0b65c76c
+round 2: 1080871 deliveries/s, p99 0.002 ms, 134 corrections, 50056 alert outcomes, digest 0fb37b9c0b65c76c
+round 3: 951640 deliveries/s, p99 0.002 ms, 134 corrections, 50056 alert outcomes, digest 0fb37b9c0b65c76c
+median: 971105 deliveries/s; median p99 0.002 ms
+measured payload lower bound: 39.41 MiB
+```
+
+The mostly sparse-key benchmark fixture includes 5% late events (up to 15
+minutes) and 1% duplicate deliveries. These short-run in-memory upper-bound
+results are useful prototype evidence, not substitutes for the specified
+30-minute and 20-million-event gates.
diff --git a/developer-simulation/runs/2026-07-30--fraud-velocity-evaluation/README.md b/developer-simulation/runs/2026-07-30--fraud-velocity-evaluation/README.md
new file mode 100644
index 0000000..f97b291
--- /dev/null
+++ b/developer-simulation/runs/2026-07-30--fraud-velocity-evaluation/README.md
@@ -0,0 +1,65 @@
+# Fraud velocity evaluation
+
+This is a dependency-free reference prototype for deterministic payment-velocity
+decisions. It evaluates the existing Redis-counter design first, then exercises:
+
+- deduplication by event ID and merchant event ID;
+- event-time windows over account, salted card fingerprint, device, and IP prefix;
+- linked corrections when an event arrives late;
+- canonical decision bytes across a normal close/reopen replay;
+- latest decisions checked against a naïve reference and retained alert
+  records checked for internal reconstructability;
+- customer-key scrubbing while shared device/IP contributions remain;
+- a repeated release-mode benchmark with 1% duplicates and 5% late events.
+
+It deliberately does not use a BogKit component. Fold's durable,
+transactional materializations and ranked event-time range scans are useful,
+but the inspected public contracts do not provide the complete maintained
+semantics for linked corrections, two-ID deduplication, deletion, partition
+reassignment, and atomic broker-offset ownership that this scenario requires.
+
+## Data and deterministic rules
+
+The fixture is tab-separated and contains only the supplied fields. Card values
+are already salted fingerprints; no raw card or address data is accepted.
+Arrivals are ordered by `(arrival_time_ms, event_id)`. Event-time ties are ordered
+by `event_id`. Windows are `(target_time - window, target_time]`, partitioned by
+currency, and count every authorization attempt. The demonstration rules are:
+
+| Rule | Window | Alert threshold |
+| --- | ---: | --- |
+| account | 1 minute | count at least 3 |
+| salted card fingerprint | 10 minutes | count at least 2 and amount at least 100,000 minor units |
+| device | 10 minutes | count at least 4 |
+| IP prefix | 24 hours | count at least 6 |
+
+Every alert records the rule, window, count, amount, currency, and canonical
+contributing event IDs. A correction links to the immediately preceding revision.
+
+## Reproduce
+
+Run from `developer-simulation/`:
+
+```console
+cargo run -p fraud-velocity-evaluation -- baseline
+cargo test -p fraud-velocity-evaluation
+cargo fmt -p fraud-velocity-evaluation -- --check
+cargo clippy -p fraud-velocity-evaluation --all-targets -- -D warnings
+cargo run --release -p fraud-velocity-evaluation -- demo
+cargo run --release -p fraud-velocity-evaluation -- benchmark 100000 3
+```
+
+The benchmark's first argument is the number of unique generated events and
+its second is the number of repeated rounds. Use at least two rounds. It is a
+sparse-key in-memory upper bound, checks latest state against a bounded naïve
+reference before timing, reports correction and alert counts, and rejects any
+digest drift between rounds.
+
+## Important boundary
+
+This is a reference boundary, not a production service. It does not implement
+four-replica partition transfer, atomic stream-offset commits, live Redis network
+measurements, a durable customer-deletion compaction, a 30-minute load run, or a
+20-million-event state measurement. `EVIDENCE.md` records the resulting no-fit
+decision without attributing those missing capabilities to a demonstrated
+BogKit defect.
diff --git a/developer-simulation/runs/2026-07-30--fraud-velocity-evaluation/fixtures/demo.tsv b/developer-simulation/runs/2026-07-30--fraud-velocity-evaluation/fixtures/demo.tsv
new file mode 100644
index 0000000..c50397b
--- /dev/null
+++ b/developer-simulation/runs/2026-07-30--fraud-velocity-evaluation/fixtures/demo.tsv
@@ -0,0 +1,11 @@
+# event_id	event_time_ms	arrival_time_ms	account_id	salted_card_fingerprint	device_id	ip_prefix	merchant_event_id	amount_minor	currency	authorization_outcome
+1	100000	100000	100	500	700	900	1001	40000	USD	approved
+2	120000	120000	100	501	700	900	1002	30000	USD	approved
+3	140000	140000	100	500	701	900	1003	60000	USD	approved
+4	150000	150000	200	600	700	900	1004	25000	USD	approved
+5	160000	160000	300	601	700	900	1005	20000	USD	approved
+6	170000	170000	400	602	702	900	1006	15000	USD	approved
+7	180000	180000	200	603	700	900	1007	10000	USD	approved
+7	180000	181000	200	603	700	900	1007	10000	USD	approved
+8	110000	200000	100	500	700	900	1008	30000	USD	approved
+9	190000	210000	500	700	800	901	1009	5000	USD	declined
diff --git a/developer-simulation/runs/2026-07-30--fraud-velocity-evaluation/src/lib.rs b/developer-simulation/runs/2026-07-30--fraud-velocity-evaluation/src/lib.rs
new file mode 100644
index 0000000..acfaa98
--- /dev/null
+++ b/developer-simulation/runs/2026-07-30--fraud-velocity-evaluation/src/lib.rs
@@ -0,0 +1,1120 @@
+use std::collections::{BTreeMap, BTreeSet, HashMap};
+use std::fmt::Write as _;
+use std::fs::{File, OpenOptions};
+use std::hash::{Hash, Hasher};
+use std::io::Write as _;
+use std::ops::Bound;
+use std::path::Path;
+
+pub const MINUTE_MS: u64 = 60_000;
+pub const MAX_LATENESS_MS: u64 = 15 * MINUTE_MS;
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
+pub struct Currency([u8; 3]);
+
+impl Currency {
+    fn parse(value: &str) -> Result<Self, String> {
+        let bytes: [u8; 3] = value
+            .as_bytes()
+            .try_into()
+            .map_err(|_| format!("currency must contain three ASCII bytes: {value}"))?;
+        if !bytes.iter().all(u8::is_ascii_uppercase) {
+            return Err(format!("currency must be uppercase ASCII: {value}"));
+        }
+        Ok(Self(bytes))
+    }
+
+    fn as_str(self) -> &'static str {
+        match &self.0 {
+            b"USD" => "USD",
+            b"EUR" => "EUR",
+            b"GBP" => "GBP",
+            _ => "UNK",
+        }
+    }
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum AuthorizationOutcome {
+    Approved,
+    Declined,
+}
+
+impl AuthorizationOutcome {
+    fn parse(value: &str) -> Result<Self, String> {
+        match value {
+            "approved" => Ok(Self::Approved),
+            "declined" => Ok(Self::Declined),
+            _ => Err(format!("unknown authorization outcome: {value}")),
+        }
+    }
+
+    fn as_str(self) -> &'static str {
+        match self {
+            Self::Approved => "approved",
+            Self::Declined => "declined",
+        }
+    }
+}
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct Event {
+    pub event_id: u64,
+    pub event_time_ms: u64,
+    pub arrival_time_ms: u64,
+    pub account_id: u64,
+    pub salted_card_fingerprint: u64,
+    pub device_id: u64,
+    pub ip_prefix: u64,
+    pub merchant_event_id: u64,
+    pub amount_minor: i64,
+    pub currency: Currency,
+    pub authorization_outcome: AuthorizationOutcome,
+}
+
+impl Event {
+    fn parse_tsv(line: &str, line_number: usize) -> Result<Self, String> {
+        let fields: Vec<_> = line.split('\t').collect();
+        if fields.len() != 11 {
+            return Err(format!(
+                "line {line_number}: expected 11 tab-separated fields, got {}",
+                fields.len()
+            ));
+        }
+        let number = |index: usize, name: &str| {
+            fields[index]
+                .parse::<u64>()
+                .map_err(|error| format!("line {line_number}: invalid {name}: {error}"))
+        };
+        let amount_minor = fields[8]
+            .parse::<i64>()
+            .map_err(|error| format!("line {line_number}: invalid amount_minor: {error}"))?;
+        if amount_minor < 0 {
+            return Err(format!(
+                "line {line_number}: amount_minor must be non-negative"
+            ));
+        }
+        Ok(Self {
+            event_id: number(0, "event_id")?,
+            event_time_ms: number(1, "event_time_ms")?,
+            arrival_time_ms: number(2, "arrival_time_ms")?,
+            account_id: number(3, "account_id")?,
+            salted_card_fingerprint: number(4, "salted_card_fingerprint")?,
+            device_id: number(5, "device_id")?,
+            ip_prefix: number(6, "ip_prefix")?,
+            merchant_event_id: number(7, "merchant_event_id")?,
+            amount_minor,
+            currency: Currency::parse(fields[9])?,
+            authorization_outcome: AuthorizationOutcome::parse(fields[10])?,
+        })
+    }
+
+    fn to_tsv(&self) -> String {
+        format!(
+            "{}\t{}\t{}\t{}\t{}\t{}\t{}\t{}\t{}\t{}\t{}\n",
+            self.event_id,
+            self.event_time_ms,
+            self.arrival_time_ms,
+            self.account_id,
+            self.salted_card_fingerprint,
+            self.device_id,
+            self.ip_prefix,
+            self.merchant_event_id,
+            self.amount_minor,
+            self.currency.as_str(),
+            self.authorization_outcome.as_str()
+        )
+    }
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, PartialOrd, Ord)]
+struct EventOrder {
+    event_time_ms: u64,
+    event_id: u64,
+}
+
+impl From<&Event> for EventOrder {
+    fn from(event: &Event) -> Self {
+        Self {
+            event_time_ms: event.event_time_ms,
+            event_id: event.event_id,
+        }
+    }
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
+enum KeyKind {
+    Account,
+    Card,
+    Device,
+    IpPrefix,
+}
+
+impl KeyKind {
+    fn name(self) -> &'static str {
+        match self {
+            Self::Account => "account",
+            Self::Card => "card",
+            Self::Device => "device",
+            Self::IpPrefix => "ip-prefix",
+        }
+    }
+
+    fn value(self, event: &Event) -> u64 {
+        match self {
+            Self::Account => event.account_id,
+            Self::Card => event.salted_card_fingerprint,
+            Self::Device => event.device_id,
+            Self::IpPrefix => event.ip_prefix,
+        }
+    }
+}
+
+#[derive(Debug, Clone, Copy)]
+struct Rule {
+    id: &'static str,
+    key_kind: KeyKind,
+    window_ms: u64,
+    minimum_count: u32,
+    minimum_amount_minor: i64,
+}
+
+const RULES: [Rule; 4] = [
+    Rule {
+        id: "account-1m-count-3",
+        key_kind: KeyKind::Account,
+        window_ms: MINUTE_MS,
+        minimum_count: 3,
+        minimum_amount_minor: 0,
+    },
+    Rule {
+        id: "card-10m-amount-100000",
+        key_kind: KeyKind::Card,
+        window_ms: 10 * MINUTE_MS,
+        minimum_count: 2,
+        minimum_amount_minor: 100_000,
+    },
+    Rule {
+        id: "device-10m-count-4",
+        key_kind: KeyKind::Device,
+        window_ms: 10 * MINUTE_MS,
+        minimum_count: 4,
+        minimum_amount_minor: 0,
+    },
+    Rule {
+        id: "ip-prefix-24h-count-6",
+        key_kind: KeyKind::IpPrefix,
+        window_ms: 24 * 60 * MINUTE_MS,
+        minimum_count: 6,
+        minimum_amount_minor: 0,
+    },
+];
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
+struct IndexKey {
+    kind: KeyKind,
+    value: u64,
+    currency: Currency,
+}
+
+impl IndexKey {
+    fn new(rule: Rule, event: &Event) -> Self {
+        Self {
+            kind: rule.key_kind,
+            value: rule.key_kind.value(event),
+            currency: event.currency,
+        }
+    }
+}
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct RuleOutcome {
+    rule_id: &'static str,
+    key_kind: KeyKind,
+    window_ms: u64,
+    count: u32,
+    amount_minor: i64,
+    currency: Currency,
+    alert: bool,
+    contributing_event_ids: Vec<u64>,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+struct LatestDecision {
+    revision: u32,
+    outcomes: Vec<RuleOutcome>,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct DecisionRecord {
+    event_id: u64,
+    revision: u32,
+    correction_of_revision: Option<u32>,
+    outcomes: Vec<RuleOutcome>,
+}
+
+impl DecisionRecord {
+    fn append_canonical(&self, output: &mut String) {
+        let record_kind = if self.correction_of_revision.is_some() {
+            'C'
+        } else {
+            'I'
+        };
+        write!(output, "{record_kind}|{}|{}|", self.event_id, self.revision)
+            .expect("writing to String cannot fail");
+        match self.correction_of_revision {
+            Some(revision) => {
+                write!(output, "{}:{revision}", self.event_id)
+                    .expect("writing to String cannot fail");
+            }
+            None => output.push('-'),
+        }
+        for outcome in &self.outcomes {
+            write!(
+                output,
+                "|{}:{}:{}:{}:{}:{}:{}:",
+                outcome.rule_id,
+                outcome.key_kind.name(),
+                outcome.window_ms,
+                outcome.count,
+                outcome.amount_minor,
+                outcome.currency.as_str(),
+                u8::from(outcome.alert)
+            )
+            .expect("writing to String cannot fail");
+            for (index, event_id) in outcome.contributing_event_ids.iter().enumerate() {
+                if index > 0 {
+                    output.push(',');
+                }
+                write!(output, "{event_id}").expect("writing to String cannot fail");
+            }
+        }
+        output.push('\n');
+    }
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum IngestResult {
+    Accepted { correction_count: usize },
+    ExactDuplicate,
+    ConflictingDuplicate,
+}
+
+#[derive(Debug)]
+pub struct DeletionReceipt {
+    account_id: u64,
+    event_ids: BTreeSet<u64>,
+    card_fingerprints: BTreeSet<u64>,
+}
+
+impl DeletionReceipt {
+    pub fn event_count(&self) -> usize {
+        self.event_ids.len()
+    }
+}
+
+#[derive(Default)]
+pub struct Engine {
+    events: BTreeMap<EventOrder, Event>,
+    event_order_by_id: HashMap<u64, EventOrder>,
+    event_id_by_merchant_id: HashMap<u64, u64>,
+    indexes: HashMap<IndexKey, BTreeMap<EventOrder, i64>>,
+    latest: HashMap<u64, LatestDecision>,
+    records: Vec<DecisionRecord>,
+}
+
+impl Engine {
+    pub fn ingest(&mut self, event: Event) -> IngestResult {
+        if let Some(order) = self.event_order_by_id.get(&event.event_id) {
+            let existing = self
+                .events
+                .get(order)
+                .expect("event ID index must point to an event");
+            return if existing == &event
+                || (existing.merchant_event_id == event.merchant_event_id
+                    && existing.event_time_ms == event.event_time_ms
+                    && existing.account_id == event.account_id
+                    && existing.salted_card_fingerprint == event.salted_card_fingerprint
+                    && existing.device_id == event.device_id
+                    && existing.ip_prefix == event.ip_prefix
+                    && existing.amount_minor == event.amount_minor
+                    && existing.currency == event.currency
+                    && existing.authorization_outcome == event.authorization_outcome)
+            {
+                IngestResult::ExactDuplicate
+            } else {
+                IngestResult::ConflictingDuplicate
+            };
+        }
+        if let Some(existing_event_id) = self.event_id_by_merchant_id.get(&event.merchant_event_id)
+        {
+            return if self
+                .events
+                .get(
+                    self.event_order_by_id
+                        .get(existing_event_id)
+                        .expect("merchant ID index must point to an event ID"),
+                )
+                .is_some_and(|existing| {
+                    existing.event_time_ms == event.event_time_ms
+                        && existing.account_id == event.account_id
+                        && existing.salted_card_fingerprint == event.salted_card_fingerprint
+                        && existing.device_id == event.device_id
+                        && existing.ip_prefix == event.ip_prefix
+                        && existing.amount_minor == event.amount_minor
+                        && existing.currency == event.currency
+                        && existing.authorization_outcome == event.authorization_outcome
+                }) {
+                IngestResult::ExactDuplicate
+            } else {
+                IngestResult::ConflictingDuplicate
+            };
+        }
+
+        let order = EventOrder::from(&event);
+        let mut affected = BTreeSet::new();
+        for rule in RULES {
+            let key = IndexKey::new(rule, &event);
+            if key.value == 0 {
+                continue;
+            }
+            if let Some(index) = self.indexes.get(&key) {
+                let end_time = event.event_time_ms.saturating_add(rule.window_ms);
+                let end = EventOrder {
+                    event_time_ms: end_time,
+                    event_id: 0,
+                };
+                for (later_order, _) in index.range((Bound::Excluded(order), Bound::Excluded(end)))
+                {
+                    affected.insert(*later_order);
+                }
+            }
+        }
+
+        self.event_order_by_id.insert(event.event_id, order);
+        self.event_id_by_merchant_id
+            .insert(event.merchant_event_id, event.event_id);
+        for rule in RULES {
+            let key = IndexKey::new(rule, &event);
+            if key.value != 0 {
+                self.indexes
+                    .entry(key)
+                    .or_default()
+                    .insert(order, event.amount_minor);
+            }
+        }
+        let event_id = event.event_id;
+        self.events.insert(order, event);
+
+        let outcomes = self.outcomes_from_indexes(order);
+        self.latest.insert(
+            event_id,
+            LatestDecision {
+                revision: 0,
+                outcomes: outcomes.clone(),
+            },
+        );
+        self.records.push(DecisionRecord {
+            event_id,
+            revision: 0,
+            correction_of_revision: None,
+            outcomes,
+        });
+
+        let mut correction_count = 0;
+        for target_order in affected {
+            let target_id = target_order.event_id;
+            let corrected = self.outcomes_from_indexes(target_order);
+            let latest = self
+                .latest
+                .get_mut(&target_id)
+                .expect("affected event must already have a decision");
+            if latest.outcomes != corrected {
+                let previous_revision = latest.revision;
+                latest.revision += 1;
+                latest.outcomes = corrected.clone();
+                self.records.push(DecisionRecord {
+                    event_id: target_id,
+                    revision: latest.revision,
+                    correction_of_revision: Some(previous_revision),
+                    outcomes: corrected,
+                });
+                correction_count += 1;
+            }
+        }
+
+        IngestResult::Accepted { correction_count }
+    }
+
+    fn outcomes_from_indexes(&self, target_order: EventOrder) -> Vec<RuleOutcome> {
+        let target = self
+            .events
+            .get(&target_order)
+            .expect("target order must point to an event");
+        RULES
+            .into_iter()
+            .map(|rule| {
+                let key = IndexKey::new(rule, target);
+                let mut count = 0_u32;
+                let mut amount_minor = 0_i64;
+                let mut contributing_event_ids = Vec::new();
+                if key.value != 0
+                    && let Some(index) = self.indexes.get(&key)
+                {
+                    let lower = lower_bound(target_order.event_time_ms, rule.window_ms);
+                    for (order, amount) in index.range((lower, Bound::Included(target_order))) {
+                        count = count.saturating_add(1);
+                        amount_minor = amount_minor.saturating_add(*amount);
+                        contributing_event_ids.push(order.event_id);
+                    }
+                }
+                let alert =
+                    count >= rule.minimum_count && amount_minor >= rule.minimum_amount_minor;
+                if !alert {
+                    contributing_event_ids.clear();
+                }
+                RuleOutcome {
+                    rule_id: rule.id,
+                    key_kind: rule.key_kind,
+                    window_ms: rule.window_ms,
+                    count,
+                    amount_minor,
+                    currency: target.currency,
+                    alert,
+                    contributing_event_ids,
+                }
+            })
+            .collect()
+    }
+
+    fn outcomes_from_naive_scan(&self, target_order: EventOrder) -> Vec<RuleOutcome> {
+        let target = self
+            .events
+            .get(&target_order)
+            .expect("target order must point to an event");
+        RULES
+            .into_iter()
+            .map(|rule| {
+                let target_key = rule.key_kind.value(target);
+                let mut contributing_event_ids = Vec::new();
+                let mut amount_minor = 0_i64;
+                for (order, candidate) in self.events.range(..=target_order) {
+                    if candidate.currency == target.currency
+                        && rule.key_kind.value(candidate) == target_key
+                        && target_key != 0
+                        && in_window(
+                            order.event_time_ms,
+                            target_order.event_time_ms,
+                            rule.window_ms,
+                        )
+                    {
+                        contributing_event_ids.push(candidate.event_id);
+                        amount_minor = amount_minor.saturating_add(candidate.amount_minor);
+                    }
+                }
+                let count = u32::try_from(contributing_event_ids.len()).unwrap_or(u32::MAX);
+                let alert =
+                    count >= rule.minimum_count && amount_minor >= rule.minimum_amount_minor;
+                if !alert {
+                    contributing_event_ids.clear();
+                }
+                RuleOutcome {
+                    rule_id: rule.id,
+                    key_kind: rule.key_kind,
+                    window_ms: rule.window_ms,
+                    count,
+                    amount_minor,
+                    currency: target.currency,
+                    alert,
+                    contributing_event_ids,
+                }
+            })
+            .collect()
+    }
+
+    pub fn assert_matches_reference(&self) -> Result<(), String> {
+        for order in self.events.keys().copied() {
+            let target_id = order.event_id;
+            let optimized = &self
+                .latest
+                .get(&target_id)
+                .ok_or_else(|| format!("event {target_id} has no latest decision"))?
+                .outcomes;
+            let reference = self.outcomes_from_naive_scan(order);
+            if optimized != &reference {
+                return Err(format!(
+                    "event {target_id} differs from the independent naive reference"
+                ));
+            }
+        }
+        Ok(())
+    }
+
+    pub fn decision_bytes(&self) -> Vec<u8> {
+        let mut output = String::new();
+        for record in &self.records {
+            record.append_canonical(&mut output);
+        }
+        output.into_bytes()
+    }
+
+    pub fn record_count(&self) -> usize {
+        self.records.len()
+    }
+
+    pub fn event_count(&self) -> usize {
+        self.events.len()
+    }
+
+    pub fn alert_count(&self) -> usize {
+        self.records
+            .iter()
+            .flat_map(|record| &record.outcomes)
+            .filter(|outcome| outcome.alert)
+            .count()
+    }
+
+    pub fn correction_count(&self) -> usize {
+        self.records
+            .iter()
+            .filter(|record| record.correction_of_revision.is_some())
+            .count()
+    }
+
+    pub fn digest(&self) -> u64 {
+        let mut hasher = std::collections::hash_map::DefaultHasher::new();
+        self.decision_bytes().hash(&mut hasher);
+        hasher.finish()
+    }
+
+    pub fn latest_rule_count(&self, event_id: u64, rule_id: &str) -> Option<u32> {
+        self.latest.get(&event_id).and_then(|decision| {
+            decision
+                .outcomes
+                .iter()
+                .find(|outcome| outcome.rule_id == rule_id)
+                .map(|outcome| outcome.count)
+        })
+    }
+
+    pub fn delete_customer(&mut self, account_id: u64) -> Result<DeletionReceipt, String> {
+        let deleted_orders: Vec<_> = self
+            .events
+            .iter()
+            .filter_map(|(order, event)| (event.account_id == account_id).then_some(*order))
+            .collect();
+        let deleted_ids: BTreeSet<_> = deleted_orders.iter().map(|order| order.event_id).collect();
+        let deleted_cards: BTreeSet<_> = deleted_orders
+            .iter()
+            .filter_map(|order| self.events.get(order))
+            .map(|event| event.salted_card_fingerprint)
+            .collect();
+        let receipt = DeletionReceipt {
+            account_id,
+            event_ids: deleted_ids.clone(),
+            card_fingerprints: deleted_cards,
+        };
+        if deleted_ids.is_empty() {
+            return Ok(receipt);
+        }
+
+        for order in &deleted_orders {
+            let event = self
+                .events
+                .get(order)
+                .expect("deletion order must point to event")
+                .clone();
+            for rule in RULES {
+                if matches!(rule.key_kind, KeyKind::Account | KeyKind::Card) {
+                    let key = IndexKey::new(rule, &event);
+                    if let Some(index) = self.indexes.get_mut(&key) {
+                        index.remove(order);
+                    }
+                }
+            }
+            let event = self
+                .events
+                .get_mut(order)
+                .expect("deletion order must still point to event");
+            event.account_id = 0;
+            event.salted_card_fingerprint = 0;
+        }
+        self.indexes.retain(|_, index| !index.is_empty());
+
+        self.latest
+            .retain(|event_id, _| !deleted_ids.contains(event_id));
+        self.records
+            .retain(|record| !deleted_ids.contains(&record.event_id));
+        for record in &mut self.records {
+            record.outcomes.retain(|outcome| {
+                !matches!(outcome.key_kind, KeyKind::Account | KeyKind::Card)
+                    || !outcome
+                        .contributing_event_ids
+                        .iter()
+                        .any(|event_id| deleted_ids.contains(event_id))
+            });
+        }
+
+        let retained_orders: Vec<_> = self
+            .events
+            .keys()
+            .copied()
+            .filter(|order| !deleted_ids.contains(&order.event_id))
+            .collect();
+        for order in retained_orders {
+            let corrected = self.outcomes_from_indexes(order);
+            let latest = self
+                .latest
+                .get_mut(&order.event_id)
+                .expect("retained event must have a latest decision");
+            if latest.outcomes != corrected {
+                let previous_revision = latest.revision;
+                latest.revision += 1;
+                latest.outcomes = corrected.clone();
+                self.records.push(DecisionRecord {
+                    event_id: order.event_id,
+                    revision: latest.revision,
+                    correction_of_revision: Some(previous_revision),
+                    outcomes: corrected,
+                });
+            }
+        }
+
+        self.scan_customer(&receipt)?;
+        self.reconstruct_all_alerts()?;
+        Ok(receipt)
+    }
+
+    pub fn scan_customer(&self, receipt: &DeletionReceipt) -> Result<(), String> {
+        if self
+            .events
+            .values()
+            .any(|event| event.account_id == receipt.account_id)
+        {
+            return Err(format!(
+                "account {} remains in retained events",
+                receipt.account_id
+            ));
+        }
+        if self
+            .indexes
+            .keys()
+            .any(|key| key.kind == KeyKind::Account && key.value == receipt.account_id)
+        {
+            return Err(format!(
+                "account {} remains in an account index",
+                receipt.account_id
+            ));
+        }
+        for event_id in &receipt.event_ids {
+            let order = self
+                .event_order_by_id
+                .get(event_id)
+                .ok_or_else(|| format!("deleted event {event_id} lost its audit row"))?;
+            let event = self
+                .events
+                .get(order)
+                .ok_or_else(|| format!("deleted event {event_id} lost its retained record"))?;
+            if event.account_id != 0 || event.salted_card_fingerprint != 0 {
+                return Err(format!(
+                    "deleted event {event_id} retains an account or card identifier"
+                ));
+            }
+            for (key, index) in &self.indexes {
+                if matches!(key.kind, KeyKind::Account | KeyKind::Card)
+                    && (key.kind == KeyKind::Account
+                        || receipt.card_fingerprints.contains(&key.value))
+                    && index.contains_key(order)
+                {
+                    return Err(format!(
+                        "deleted event {event_id} remains in a {} index",
+                        key.kind.name()
+                    ));
+                }
+            }
+        }
+        Ok(())
+    }
+
+    pub fn reconstruct_all_alerts(&self) -> Result<(), String> {
+        for record in &self.records {
+            let target_order = self
+                .event_order_by_id
+                .get(&record.event_id)
+                .ok_or_else(|| format!("missing target event {}", record.event_id))?;
+            let target = self
+                .events
+                .get(target_order)
+                .ok_or_else(|| format!("missing target record {}", record.event_id))?;
+            for outcome in &record.outcomes {
+                if !outcome.alert {
+                    continue;
+                }
+                let rule = RULES
+                    .into_iter()
+                    .find(|rule| rule.id == outcome.rule_id)
+                    .ok_or_else(|| format!("unknown retained rule {}", outcome.rule_id))?;
+                let target_key = rule.key_kind.value(target);
+                let mut amount_minor = 0_i64;
+                for event_id in &outcome.contributing_event_ids {
+                    let contribution_order = self
+                        .event_order_by_id
+                        .get(event_id)
+                        .ok_or_else(|| format!("missing contribution event {event_id}"))?;
+                    let contribution = self.events.get(contribution_order).ok_or_else(|| {
+                        format!("missing retained contribution record {event_id}")
+                    })?;
+                    if *contribution_order > *target_order
+                        || contribution.currency != outcome.currency
+                        || rule.key_kind.value(contribution) != target_key
+                        || !in_window(
+                            contribution.event_time_ms,
+                            target.event_time_ms,
+                            rule.window_ms,
+                        )
+                    {
+                        return Err(format!(
+                            "event {event_id} cannot reconstruct {} for target {}",
+                            rule.id, record.event_id
+                        ));
+                    }
+                    amount_minor = amount_minor.saturating_add(contribution.amount_minor);
+                }
+                let count = u32::try_from(outcome.contributing_event_ids.len()).unwrap_or(u32::MAX);
+                if count != outcome.count || amount_minor != outcome.amount_minor {
+                    return Err(format!(
+                        "retained explanation mismatch for event {} rule {}",
+                        record.event_id, rule.id
+                    ));
+                }
+            }
+        }
+        Ok(())
+    }
+
+    pub fn approximate_payload_bytes(&self) -> usize {
+        let event_payload = self.events.len() * std::mem::size_of::<Event>();
+        let index_rows: usize = self.indexes.values().map(BTreeMap::len).sum();
+        let index_payload =
+            index_rows * (std::mem::size_of::<EventOrder>() + std::mem::size_of::<i64>());
+        event_payload + index_payload + self.decision_bytes().len()
+    }
+}
+
+fn lower_bound(target_time_ms: u64, window_ms: u64) -> Bound<EventOrder> {
+    if target_time_ms < window_ms {
+        Bound::Unbounded
+    } else {
+        Bound::Excluded(EventOrder {
+            event_time_ms: target_time_ms - window_ms,
+            event_id: u64::MAX,
+        })
+    }
+}
+
+fn in_window(candidate_time_ms: u64, target_time_ms: u64, window_ms: u64) -> bool {
+    candidate_time_ms <= target_time_ms
+        && target_time_ms.saturating_sub(candidate_time_ms) < window_ms
+}
+
+pub fn load_fixture(path: &Path) -> Result<Vec<Event>, String> {
+    let contents = std::fs::read_to_string(path)
+        .map_err(|error| format!("failed to read {}: {error}", path.display()))?;
+    let mut events = Vec::new();
+    for (line_index, line) in contents.lines().enumerate() {
+        if line.is_empty() || line.starts_with('#') {
+            continue;
+        }
+        events.push(Event::parse_tsv(line, line_index + 1)?);
+    }
+    events.sort_by(|left, right| {
+        left.arrival_time_ms
+            .cmp(&right.arrival_time_ms)
+            .then_with(|| left.event_id.cmp(&right.event_id))
+    });
+    Ok(events)
+}
+
+pub struct PersistentEngine {
+    engine: Engine,
+    ledger: File,
+}
+
+impl PersistentEngine {
+    pub fn open(directory: &Path) -> Result<Self, String> {
+        std::fs::create_dir_all(directory)
+            .map_err(|error| format!("failed to create {}: {error}", directory.display()))?;
+        let ledger_path = directory.join("accepted-events.tsv");
+        let mut engine = Engine::default();
+        if ledger_path.exists() {
+            for event in load_fixture(&ledger_path)? {
+                if !matches!(engine.ingest(event), IngestResult::Accepted { .. }) {
+                    return Err("persisted ledger contains a duplicate".to_string());
+                }
+            }
+        }
+        let ledger = OpenOptions::new()
+            .create(true)
+            .append(true)
+            .open(&ledger_path)
+            .map_err(|error| format!("failed to open {}: {error}", ledger_path.display()))?;
+        Ok(Self { engine, ledger })
+    }
+
+    pub fn ingest(&mut self, event: Event) -> Result<IngestResult, String> {
+        let result = self.engine.ingest(event.clone());
+        if matches!(result, IngestResult::Accepted { .. }) {
+            self.ledger
+                .write_all(event.to_tsv().as_bytes())
+                .map_err(|error| format!("failed to append event ledger: {error}"))?;
+            self.ledger
+                .sync_data()
+                .map_err(|error| format!("failed to sync event ledger: {error}"))?;
+        }
+        Ok(result)
+    }
+
+    pub fn decision_bytes(&self) -> Vec<u8> {
+        self.engine.decision_bytes()
+    }
+}
+
+#[derive(Default)]
+pub struct RedisStyleBaseline {
+    account: HashMap<u64, (u64, u64)>,
+    card: HashMap<u64, (u64, u64)>,
+}
+
+impl RedisStyleBaseline {
+    fn apply(&mut self, event: &Event) -> (u64, u64) {
+        let account = increment_with_independent_ttl(
+            &mut self.account,
+            event.account_id,
+            event.arrival_time_ms,
+        );
+        let card = increment_with_independent_ttl(
+            &mut self.card,
+            event.salted_card_fingerprint,
+            event.arrival_time_ms,
+        );
+        (account, card)
+    }
+}
+
+fn increment_with_independent_ttl(
+    counters: &mut HashMap<u64, (u64, u64)>,
+    key: u64,
+    arrival_time_ms: u64,
+) -> u64 {
+    let entry = counters
+        .entry(key)
+        .or_insert((0, arrival_time_ms + MINUTE_MS));
+    if arrival_time_ms >= entry.1 {
+        *entry = (0, arrival_time_ms + MINUTE_MS);
+    }
+    entry.0 += 1;
+    entry.0
+}
+
+pub fn baseline_observations() -> Vec<String> {
+    let original = Event {
+        event_id: 10,
+        event_time_ms: 10_000,
+        arrival_time_ms: 10_000,
+        account_id: 7,
+        salted_card_fingerprint: 9,
+        device_id: 11,
+        ip_prefix: 12,
+        merchant_event_id: 1010,
+        amount_minor: 10_000,
+        currency: Currency(*b"USD"),
+        authorization_outcome: AuthorizationOutcome::Approved,
+    };
+    let duplicate = Event {
+        arrival_time_ms: 11_000,
+        ..original.clone()
+    };
+    let late = Event {
+        event_id: 11,
+        event_time_ms: 20_000,
+        arrival_time_ms: 80_000,
+        merchant_event_id: 1011,
+        ..original.clone()
+    };
+    let mut baseline = RedisStyleBaseline::default();
+    let first = baseline.apply(&original);
+    let after_duplicate = baseline.apply(&duplicate);
+    let after_late = baseline.apply(&late);
+
+    assert_eq!(first, (1, 1));
+    assert_eq!(after_duplicate, (2, 2));
+    assert_eq!(after_late, (1, 1));
+    assert!(late.event_time_ms - original.event_time_ms < MINUTE_MS);
+
+    vec![
+        format!("duplicate event 10 changed both counts: {first:?} -> {after_duplicate:?}"),
+        format!(
+            "late event 11 belongs with event 10 in event time, but arrival-time TTL returned {after_late:?}"
+        ),
+        "no retained contribution list can explain either result".to_string(),
+    ]
+}
+
+pub fn generated_event(unique_index: u64) -> Event {
+    let nominal_time = unique_index.saturating_mul(40);
+    let is_late = unique_index % 20 == 19;
+    let delay = if is_late {
+        ((unique_index.wrapping_mul(7_919) % MAX_LATENESS_MS) + 1).min(nominal_time)
+    } else {
+        0
+    };
+    Event {
+        event_id: unique_index + 1,
+        event_time_ms: nominal_time - delay,
+        arrival_time_ms: nominal_time,
+        account_id: 1 + unique_index % 100_000,
+        salted_card_fingerprint: 1 + unique_index.wrapping_mul(17) % 200_000,
+        device_id: 1 + unique_index.wrapping_mul(31) % 50_000,
+        ip_prefix: 1 + unique_index.wrapping_mul(43) % 10_000,
+        merchant_event_id: 1_000_000_000 + unique_index,
+        amount_minor: 1_000 + i64::try_from(unique_index % 90_000).unwrap_or(0),
+        currency: Currency(*b"USD"),
+        authorization_outcome: if unique_index.is_multiple_of(10) {
+            AuthorizationOutcome::Declined
+        } else {
+            AuthorizationOutcome::Approved
+        },
+    }
+}
+
+pub fn percentile_nanos(samples: &mut [u64], percentile: usize) -> u64 {
+    samples.sort_unstable();
+    let rank = samples
+        .len()
+        .saturating_mul(percentile)
+        .div_ceil(100)
+        .saturating_sub(1);
+    samples[rank.min(samples.len().saturating_sub(1))]
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn fixture() -> Vec<Event> {
+        load_fixture(
+            &Path::new(env!("CARGO_MANIFEST_DIR"))
+                .join("fixtures")
+                .join("demo.tsv"),
+        )
+        .expect("fixture should parse")
+    }
+
+    #[test]
+    fn baseline_reproducer_exposes_three_defects() {
+        let observations = baseline_observations();
+        assert_eq!(observations.len(), 3);
+    }
+
+    #[test]
+    fn fixture_matches_naive_reference_and_duplicates_are_inert() {
+        let mut engine = Engine::default();
+        let mut duplicate_count = 0;
+        for event in fixture() {
+            match engine.ingest(event) {
+                IngestResult::Accepted { .. } => {}
+                IngestResult::ExactDuplicate => duplicate_count += 1,
+                IngestResult::ConflictingDuplicate => panic!("unexpected conflict"),
+            }
+        }
+        assert_eq!(duplicate_count, 1);
+        assert_eq!(engine.event_count(), 9);
+        engine
+            .assert_matches_reference()
+            .expect("indexed results should equal independent scan");
+        engine
+            .reconstruct_all_alerts()
+            .expect("every alert should reconstruct");
+    }
+
+    #[test]
+    fn late_event_emits_linked_corrections() {
+        let mut engine = Engine::default();
+        let mut late_corrections = 0;
+        for event in fixture() {
+            let is_late = event.event_id == 8;
+            if let IngestResult::Accepted { correction_count } = engine.ingest(event)
+                && is_late
+            {
+                late_corrections = correction_count;
+            }
+        }
+        assert!(late_corrections > 0);
+        assert!(engine.correction_count() >= late_corrections);
+        let output = String::from_utf8(engine.decision_bytes()).expect("ASCII decision records");
+        assert!(output.lines().any(|line| line.starts_with("C|")));
+    }
+
+    #[test]
+    fn normal_close_reopen_replay_is_byte_identical() {
+        let root = std::env::temp_dir().join(format!(
+            "fraud-velocity-restart-test-{}",
+            std::process::id()
+        ));
+        let direct_path = root.join("direct");
+        let restarted_path = root.join("restarted");
+        let _ = std::fs::remove_dir_all(&root);
+        let events = fixture();
+
+        let direct = {
+            let mut persistent = PersistentEngine::open(&direct_path).expect("open direct ledger");
+            for event in &events {
+                persistent.ingest(event.clone()).expect("direct ingest");
+            }
+            persistent.decision_bytes()
+        };
+        let restarted = {
+            let split = events.len() / 2;
+            {
+                let mut persistent =
+                    PersistentEngine::open(&restarted_path).expect("open first ledger");
+                for event in &events[..split] {
+                    persistent.ingest(event.clone()).expect("first ingest");
+                }
+            }
+            let mut persistent = PersistentEngine::open(&restarted_path).expect("reopen ledger");
+            for event in &events[split..] {
+                persistent.ingest(event.clone()).expect("second ingest");
+            }
+            persistent.decision_bytes()
+        };
+        assert_eq!(direct, restarted);
+        let _ = std::fs::remove_dir_all(root);
+    }
+
+    #[test]
+    fn customer_deletion_scrubs_owned_keys_and_preserves_shared_windows() {
+        let mut engine = Engine::default();
+        for event in fixture() {
+            engine.ingest(event);
+        }
+        let before_device = engine.latest_rule_count(7, "device-10m-count-4");
+        let before_ip = engine.latest_rule_count(7, "ip-prefix-24h-count-6");
+        let receipt = engine.delete_customer(100).expect("customer deletion");
+        assert_eq!(receipt.event_count(), 4);
+        assert_eq!(
+            before_device,
+            engine.latest_rule_count(7, "device-10m-count-4")
+        );
+        assert_eq!(
+            before_ip,
+            engine.latest_rule_count(7, "ip-prefix-24h-count-6")
+        );
+        engine
+            .scan_customer(&receipt)
+            .expect("account and card scan");
+        engine
+            .reconstruct_all_alerts()
+            .expect("retained alerts reconstruct");
+    }
+}
diff --git a/developer-simulation/runs/2026-07-30--fraud-velocity-evaluation/src/main.rs b/developer-simulation/runs/2026-07-30--fraud-velocity-evaluation/src/main.rs
new file mode 100644
index 0000000..c6f64a8
--- /dev/null
+++ b/developer-simulation/runs/2026-07-30--fraud-velocity-evaluation/src/main.rs
@@ -0,0 +1,229 @@
+use std::path::{Path, PathBuf};
+use std::time::Instant;
+
+use fraud_velocity_evaluation::{
+    Engine, IngestResult, PersistentEngine, baseline_observations, generated_event, load_fixture,
+    percentile_nanos,
+};
+
+fn fixture_path() -> PathBuf {
+    Path::new(env!("CARGO_MANIFEST_DIR"))
+        .join("fixtures")
+        .join("demo.tsv")
+}
+
+fn run_baseline() {
+    println!("redis baseline");
+    for observation in baseline_observations() {
+        println!("  {observation}");
+    }
+}
+
+fn run_demo() -> Result<(), String> {
+    run_baseline();
+    let events = load_fixture(&fixture_path())?;
+    let mut engine = Engine::default();
+    let mut duplicates = 0;
+    let mut corrections_from_late_event = 0;
+    for event in &events {
+        match engine.ingest(event.clone()) {
+            IngestResult::Accepted { correction_count } => {
+                if event.event_id == 8 {
+                    corrections_from_late_event = correction_count;
+                }
+            }
+            IngestResult::ExactDuplicate => duplicates += 1,
+            IngestResult::ConflictingDuplicate => {
+                return Err(format!("fixture event {} conflicts", event.event_id));
+            }
+        }
+    }
+    engine.assert_matches_reference()?;
+    engine.reconstruct_all_alerts()?;
+    println!("deterministic fixture");
+    println!(
+        "  {} deliveries -> {} unique events; {} duplicate ignored",
+        events.len(),
+        engine.event_count(),
+        duplicates
+    );
+    println!(
+        "  {} linked corrections from late event 8; {} total corrections",
+        corrections_from_late_event,
+        engine.correction_count()
+    );
+    println!(
+        "  {} canonical records; {} alert explanations; digest {:016x}",
+        engine.record_count(),
+        engine.alert_count(),
+        engine.digest()
+    );
+
+    let recovery_root =
+        std::env::temp_dir().join(format!("fraud-velocity-demo-{}", std::process::id()));
+    let direct_path = recovery_root.join("direct");
+    let restarted_path = recovery_root.join("restarted");
+    let _ = std::fs::remove_dir_all(&recovery_root);
+    let direct = {
+        let mut persistent = PersistentEngine::open(&direct_path)?;
+        for event in &events {
+            persistent.ingest(event.clone())?;
+        }
+        persistent.decision_bytes()
+    };
+    let restarted = {
+        let split = events.len() / 2;
+        {
+            let mut persistent = PersistentEngine::open(&restarted_path)?;
+            for event in &events[..split] {
+                persistent.ingest(event.clone())?;
+            }
+        }
+        let mut persistent = PersistentEngine::open(&restarted_path)?;
+        for event in &events[split..] {
+            persistent.ingest(event.clone())?;
+        }
+        persistent.decision_bytes()
+    };
+    if direct != restarted {
+        return Err("restart changed canonical decision bytes".to_string());
+    }
+    println!(
+        "normal close/reopen replay\n  uninterrupted and reopened ledgers produced {} identical decision bytes",
+        direct.len()
+    );
+    let _ = std::fs::remove_dir_all(&recovery_root);
+
+    let before_device = engine.latest_rule_count(7, "device-10m-count-4");
+    let before_ip = engine.latest_rule_count(7, "ip-prefix-24h-count-6");
+    let receipt = engine.delete_customer(100)?;
+    if before_device != engine.latest_rule_count(7, "device-10m-count-4")
+        || before_ip != engine.latest_rule_count(7, "ip-prefix-24h-count-6")
+    {
+        return Err("customer deletion corrupted shared device/IP counts".to_string());
+    }
+    engine.scan_customer(&receipt)?;
+    engine.reconstruct_all_alerts()?;
+    println!(
+        "customer deletion\n  scrubbed {} account-owned events and audited account/card removal; shared device/IP counts unchanged; retained alerts reconstruct",
+        receipt.event_count()
+    );
+    println!("demo: PASS");
+    Ok(())
+}
+
+fn run_benchmark(unique_events: usize, rounds: usize) -> Result<(), String> {
+    if unique_events == 0 || rounds < 2 {
+        return Err("benchmark needs at least one event and two rounds".to_string());
+    }
+    println!(
+        "sparse-key in-memory upper-bound benchmark: {unique_events} unique events + 1% duplicate deliveries, {rounds} rounds"
+    );
+    let reference_probe_events = unique_events.min(2_000);
+    let mut reference_probe = Engine::default();
+    for index in 0..reference_probe_events {
+        let event = generated_event(index as u64);
+        reference_probe.ingest(event.clone());
+        if index % 100 == 99 {
+            reference_probe.ingest(event);
+        }
+    }
+    reference_probe.assert_matches_reference()?;
+    println!(
+        "  sparse-key latest-state naive-reference comparison: PASS ({reference_probe_events} unique events)"
+    );
+    let mut throughputs = Vec::with_capacity(rounds);
+    let mut p99_values = Vec::with_capacity(rounds);
+    let mut final_digest = None;
+    let mut payload_bytes = 0;
+    for round in 0..rounds {
+        let mut engine = Engine::default();
+        let mut latencies = Vec::with_capacity(unique_events + unique_events / 100 + 1);
+        let wall_start = Instant::now();
+        for index in 0..unique_events {
+            let event = generated_event(index as u64);
+            let event_start = Instant::now();
+            engine.ingest(event.clone());
+            latencies.push(u64::try_from(event_start.elapsed().as_nanos()).unwrap_or(u64::MAX));
+            if index % 100 == 99 {
+                let duplicate_start = Instant::now();
+                let result = engine.ingest(event);
+                latencies
+                    .push(u64::try_from(duplicate_start.elapsed().as_nanos()).unwrap_or(u64::MAX));
+                if result != IngestResult::ExactDuplicate {
+                    return Err("benchmark duplicate altered state".to_string());
+                }
+            }
+        }
+        let elapsed = wall_start.elapsed();
+        engine.reconstruct_all_alerts()?;
+        let deliveries = latencies.len();
+        let throughput = deliveries as f64 / elapsed.as_secs_f64();
+        let p99 = percentile_nanos(&mut latencies, 99);
+        let digest = engine.digest();
+        if let Some(expected) = final_digest
+            && expected != digest
+        {
+            return Err("benchmark rounds produced different decision digests".to_string());
+        }
+        final_digest = Some(digest);
+        payload_bytes = engine.approximate_payload_bytes();
+        throughputs.push(throughput);
+        p99_values.push(p99);
+        println!(
+            "  round {}: {:.0} deliveries/s, p99 {:.3} ms, {} corrections, {} alert outcomes, digest {digest:016x}",
+            round + 1,
+            throughput,
+            p99 as f64 / 1_000_000.0,
+            engine.correction_count(),
+            engine.alert_count()
+        );
+    }
+    throughputs.sort_by(f64::total_cmp);
+    p99_values.sort_unstable();
+    println!(
+        "  median: {:.0} deliveries/s; median p99 {:.3} ms; measured payload lower bound {:.2} MiB",
+        throughputs[rounds / 2],
+        p99_values[rounds / 2] as f64 / 1_000_000.0,
+        payload_bytes as f64 / (1024.0 * 1024.0)
+    );
+    println!(
+        "  scope: mixed stream includes 5% late events up to 15 minutes and 1% duplicates; this is not a 30-minute/20-million-event acceptance run"
+    );
+    Ok(())
+}
+
+fn parse_usize(value: Option<String>, default: usize, name: &str) -> Result<usize, String> {
+    value.map_or(Ok(default), |value| {
+        value
+            .parse()
+            .map_err(|error| format!("invalid {name}: {error}"))
+    })
+}
+
+fn run() -> Result<(), String> {
+    let mut args = std::env::args().skip(1);
+    match args.next().as_deref() {
+        Some("baseline") => {
+            run_baseline();
+            Ok(())
+        }
+        Some("demo") => run_demo(),
+        Some("benchmark") => {
+            let events = parse_usize(args.next(), 100_000, "event count")?;
+            let rounds = parse_usize(args.next(), 3, "round count")?;
+            run_benchmark(events, rounds)
+        }
+        _ => Err(
+            "usage: fraud-velocity-evaluation <baseline|demo|benchmark [events] [rounds]>"
+                .to_string(),
+        ),
+    }
+}
+
+fn main() {
+    if let Err(error) = run() {
+        eprintln!("error: {error}");
+        std::process::exit(1);
+    }
+}
diff --git a/developer-simulation/runs/2026-07-31--homecare-gap-fill/Cargo.toml b/developer-simulation/runs/2026-07-31--homecare-gap-fill/Cargo.toml
new file mode 100644
index 0000000..f599574
--- /dev/null
+++ b/developer-simulation/runs/2026-07-31--homecare-gap-fill/Cargo.toml
@@ -0,0 +1,10 @@
+[package]
+name = "homecare-gap-fill"
+version = "0.1.0"
+edition.workspace = true
+publish.workspace = true
+
+[dependencies]
+chrono = { version = "0.4", default-features = false, features = ["std"] }
+fold = { path = "../../../fold" }
+serde = { version = "1", features = ["derive"] }
diff --git a/developer-simulation/runs/2026-07-31--homecare-gap-fill/EVIDENCE.md b/developer-simulation/runs/2026-07-31--homecare-gap-fill/EVIDENCE.md
new file mode 100644
index 0000000..8dba19b
--- /dev/null
+++ b/developer-simulation/runs/2026-07-31--homecare-gap-fill/EVIDENCE.md
@@ -0,0 +1,174 @@
+# Evidence
+
+## Ordered discovery and friction
+
+1. Read the repository `README.md` first. It described Fold as an incremental,
+   durable stream framework and named starter, time-series, chat, and search
+   examples.
+2. Read the four public examples in that order: starter, time-series, chat,
+   search. Starter established durable transactions and retractions;
+   time-series showed keyed aggregates; chat showed one writer and consistent
+   snapshots; search showed keyed upsert/remove semantics.
+3. Inspected only the public Fold keyed-stream, table, and pipeline APIs needed
+   to determine whether the component could represent mutable input and durable
+   count views.
+4. Evaluated the baseline before selecting a component. A deterministic
+   full-rescan greedy scheduler met fill and urgent coverage, but the sampled
+   cancellation changes preserved only 98.2940% of unaffected assignments on
+   average. That misses the 99.5% requirement and motivates a local change path.
+5. Selected Fold narrowly for durable keyed state and transactional materialized
+   counts. Scheduling itself stayed in ordinary Rust. ESE and ANNy were rejected
+   as no-fit.
+6. First dependency resolution attempt failed because the sandbox could not
+   resolve `index.crates.io`. After network access was approved, dependencies
+   resolved. Subsequent checks ran offline.
+7. The first compile exposed a generic associated-reader type that could not be
+   destructured. Replacing anonymous closures with named functions gave the
+   Fold pipeline a concrete type; no BogKit source was changed.
+8. The first successful workload over-correlated region and certification and
+   made most unfilled visits structurally impossible. Randomizing certification
+   independently and lowering the total hour cap created meaningful capacity
+   pressure: cancellations now free capacity for the incremental path.
+9. Skeptical review found that the validator returned `TRAVEL_CONFLICT` whenever
+   all earlier filters left a candidate, without proving travel was the blocker.
+   A one-caregiver reproducer was incorrectly accepted. The validator now checks
+   travel independently, errors when any caregiver is eligible, and has a
+   regression test.
+10. Review also rejected the initial “partial fit” label. The prototype has no
+    SQLite adapter, change feed, rebuild policy, idempotent handoff, or
+    cross-store transaction, so the scenario remains no-fit for the required
+    SQLite-authoritative boundary.
+
+## Exact commands and observed results
+
+All commands were run from this crate directory.
+
+### Dependency-resolution failure
+
+```console
+cargo test --all-targets
+```
+
+Observed: failed before compilation because `index.crates.io` could not be
+resolved. Retried with approved network access; Cargo downloaded dependencies
+and then reported the concrete Fold reader type error described above.
+
+### Tests
+
+```console
+cargo test --all-targets --offline
+```
+
+Observed after review fixes: exit 0; 5 passed, 0 failed. Coverage includes
+explicit-offset instant arithmetic around two DST transitions, rejection of
+offset-free local times, the spurious-travel-reason regression, deterministic
+scheduling, cancellation stability, independent validation, and Fold
+round-trip recovery with materialized count checks.
+
+### Formatting
+
+```console
+cargo fmt --check
+```
+
+Observed: exit 0; no output.
+
+### Linting
+
+```console
+cargo clippy --all-targets --offline -- -D warnings
+```
+
+Observed: exit 0; no warnings in the prototype or its targets.
+
+### Release demo
+
+```console
+cargo run --release --offline
+```
+
+Observed: exit 0. One measured run:
+
+```text
+DATASET label=10%-representative caregivers=2000 visits=12000 horizon_days=14 generated_ms=1.959
+BASELINE initial_ms=133.788 sampled_changes=12 sampled_p95_ms=116.540 sampled_mean_preservation_pct=98.2940 final_rescan_ms=103.811 filled=10000 urgent_filled=2761/2913
+INCREMENTAL initial_ms=485.727 burst_changes=200 burst_ms=900.334 p95_ms=5.363 throughput_changes_per_s=222.1 preservation_pct=100.0000 filled=10000 urgent_filled=2761/2913
+VALIDATOR status=ok constraint_violations=0 active_visits=11800 outcomes=11800 unfilled_reason_codes={"HOUR_LIMIT": 1235, "NO_CERTIFICATION": 57, "NO_REGION_COVERAGE": 0, "OUTSIDE_AVAILABILITY": 0, "REQUIRED_REST": 508, "TRAVEL_CONFLICT": 0}
+REPLAY status=deterministic digest=3a9719e0c8654377 replay_ms=505.919
+RESTART status=ok recovery_ms=47.200 caregivers=2000 active_visits=11800 assignments=10000 unfilled=1800
+CRASH_RESTART status=ok child_status=signal: 6 (SIGABRT) recovery_ms=50.553 committed_visit=28 canceled_visits=201
+```
+
+The latency above includes a Fold transaction and explicit checkpoint for every
+change. Two reviewer reruns measured baseline sampled p95 at 102.118 and
+113.509 ms and incremental p95 at 5.517 and 5.244 ms. All three runs reproduced
+digest `3a9719e0c8654377`, zero validator violations, the same fill/urgent counts,
+and 100% preservation.
+`/usr/bin/time -l` could not report resident memory because its
+`sysctl kern.clockrate` call was denied in this environment; the demo itself
+still completed successfully.
+
+## Categorized findings
+
+| Category | Severity | Confidence | Finding | Reproduction | Smallest improvement |
+|---|---:|---:|---|---|---|
+| Poor product fit | High | High | The isolated Fold projection demonstrates atomic durable input/outcome state and counts, but the required SQLite-to-Fold synchronization and atomic publication boundary are absent. | Inspect `src/store.rs`; no SQLite adapter or handoff exists. | Document source-of-truth and cross-store transaction boundaries; keep this scenario no-fit until a real handoff is proven. |
+| Prototype correctness defect, fixed | High | High | The original validator accepted a spurious travel-conflict reason without testing travel feasibility. | Run `validator_rejects_spurious_travel_conflict`; the pre-fix reviewer reproducer returned success. | Independently check travel and error when any caregiver is fully eligible. |
+| Stability | High | High | Full rescans preserved 98.2940% in the sample; the incremental path preserved 100%. | `cargo run --release --offline` | Keep published outcomes first-class and expose affected-key transactions. |
+| Performance evidence | Medium | High at representative scale | Across three local runs, incremental p95 was 5.244–5.517 ms and baseline sampled p95 was 102.118–116.540 ms. | Run the release demo repeatedly. | Add full-scale, memory-bounded, multi-seed benchmarks before production claims. |
+| Correctness | High | High at representative scale after the fix | Independent validation found no certification, region, availability, rest, hour, or travel violations; the regression rejects a falsely unfilled eligible visit. | Run the demo and all tests. | Add mutation/property tests across many seeds. |
+| Recovery | High | High for committed state | Normal reopen was 47.200 ms and post-abort reopen was 50.553 ms with the committed change present. | Same demo; child SIGABRT is intentional. | Add a second crash point inside an uncommitted transaction. |
+| Time handling | Medium | High for the narrow parser contract | Explicit-offset RFC3339 strings are parsed as instants and offset-free strings are rejected; IANA-zone ambiguity and nonexistent-wall-time policy are not tested. | Run the time unit test. | Add timezone-aware conversion at the unimplemented SQLite import boundary. |
+| Developer experience | Low | High | Anonymous Fold pipeline closure types made a reusable load helper awkward. | Replace named functions in `src/store.rs` with closures and compile. | Provide a documented named-pipeline/type-alias example for reusable stores. |
+| Environment | Low | High | First build requires registry access if dependencies are not cached. | Clear cache and run `cargo test --all-targets` without network. | Offer a vendored/offline lab setup. |
+
+## Decision audit
+
+- **Baseline first:** retained as a deterministic full-rescan comparator. It
+  met final fill and urgent coverage but failed the assignment-preservation
+  target and did unnecessary work on each cancellation.
+- **Fold: evaluated in an isolated projection.** `KeyedStream` gives upsert/remove semantics,
+  atomic caregiver/visit/outcome changes, durable restart state, and
+  incrementally maintained counts. This is directly relevant to cancellation
+  events and recovery.
+- **Custom scheduler: selected.** The smallest safe change is to retain valid
+  published assignments, remove only the canceled visit, and test the freed
+  caregiver against the urgency-ordered open set. It guarantees no reassignment
+  of unaffected visits, including those inside six hours.
+- **Independent validator: selected.** It deliberately duplicates constraint
+  checks and reason classification instead of calling scheduler eligibility.
+- **Overall decision: no fit for the stated SQLite-authoritative system.** The
+  isolated Fold projection is useful evidence, but it is not a safe integration
+  until synchronization, rebuilding, and atomic publication are demonstrated.
+  Do not move constraint logic into BogKit core based on this trial.
+
+## Alternatives rejected
+
+- **Fold `TopK` or aggregate as the scheduler:** no-fit because eligibility
+  depends on interacting travel, rest, hour, and assignment constraints; a
+  simple rank is not enough.
+- **ESE:** no-fit; there is no semantic-text matching problem.
+- **ANNy:** no-fit; exact deterministic eligibility is required, not approximate
+  vector similarity.
+- **Global optimization:** explicitly out of scope and would make the prototype
+  materially larger.
+- **SQLite replacement:** rejected. The existing service owns that boundary;
+  this trial tests a durable scheduling projection, not a database migration.
+- **Full 20,000/120,000 benchmark in this pass:** rejected to keep the trial
+  compact. The 10% run is labeled and no linear extrapolation is claimed.
+
+## Unresolved uncertainty
+
+- Full requested scale has not been run, so p95, startup time, and the 1 GiB
+  limit are unproven at 20,000 caregivers and 120,000 visits.
+- Peak resident memory was not measured because `/usr/bin/time -l` could not
+  access the required system control in this sandbox.
+- The SQLite import/change-feed adapter is not implemented.
+- The crash harness proves recovery after an acknowledged commit and process
+  abort; it does not yet inject a crash inside an uncommitted transaction.
+- Explicit-offset parsing is correct only as instant arithmetic. IANA-zone
+  conversion and policy for ambiguous/nonexistent local wall times must be
+  owned by the importer.
+- Only one seed and a synthetic distribution were used for the recorded
+  performance run. More seeds and real distribution shapes could expose
+  different contention and reason mixes.
diff --git a/developer-simulation/runs/2026-07-31--homecare-gap-fill/README.md b/developer-simulation/runs/2026-07-31--homecare-gap-fill/README.md
new file mode 100644
index 0000000..c6d74ac
--- /dev/null
+++ b/developer-simulation/runs/2026-07-31--homecare-gap-fill/README.md
@@ -0,0 +1,96 @@
+# Caregiver scheduler cancellation trial
+
+This is a small, standalone Rust prototype for testing whether BogKit helps a
+single-process caregiver scheduler respond to cancellation bursts without
+reshuffling unaffected work.
+
+## Outcome
+
+**No fit for the SQLite-authoritative handoff as implemented.** Fold
+demonstrates useful atomic state and counts inside an isolated projection, but
+the required SQLite-to-Fold synchronization and atomic publication boundary
+were not implemented. Fold is not a scheduling solver. The candidate index,
+scheduling policy, explanations, and independent validator remain plain Rust.
+ESE and ANNy do not fit this problem.
+
+The existing SQLite importer is represented by deterministic normalized input.
+An actual SQLite adapter is deliberately outside this compact prototype. The
+time parser accepts RFC3339 instants with explicit UTC offsets and rejects
+offset-free strings. It does not apply IANA timezone rules or reject a
+nonexistent local wall time when the caller supplies an offset.
+
+## What the demo does
+
+- Generates a seeded 14-day workload with 2,000 caregivers and 12,000 visits,
+  exactly 10% of the requested scale.
+- Models interval availability, certifications, regions, travel time, required
+  rest, hour limits, urgency, and continuity preferences.
+- Measures a full-rescan greedy baseline before exercising the incremental path.
+- Processes a burst of 200 committed and checkpointed cancellations. Only the
+  canceled visit and, when possible, one newly fillable visit are changed.
+- Independently checks all constraints and reason codes, including a regression
+  that rejects a spurious travel-conflict explanation when a caregiver is
+  actually eligible.
+- Replays the same seed and changes and compares a deterministic digest.
+- Reopens the durable state, then runs a child process that commits one change
+  and aborts; the parent verifies that the committed state recovers correctly.
+
+The last measured run produced:
+
+```text
+BASELINE sampled_p95_ms=116.540 sampled_mean_preservation_pct=98.2940
+INCREMENTAL burst_changes=200 burst_ms=900.334 p95_ms=5.363 throughput_changes_per_s=222.1 preservation_pct=100.0000
+BASELINE filled=10000 urgent_filled=2761/2913
+INCREMENTAL filled=10000 urgent_filled=2761/2913
+RESTART recovery_ms=47.200
+CRASH_RESTART recovery_ms=50.553
+REPLAY digest=3a9719e0c8654377
+```
+
+Across the author run and two reviewer reruns, baseline sampled p95 was
+102.118–116.540 ms and incremental p95 was 5.244–5.517 ms. These are
+representative-scale measurements on this machine, not evidence that the full
+20,000/120,000 workload or the 1 GiB limit passes.
+
+## Reproduce
+
+From this directory:
+
+```console
+cargo test --all-targets
+cargo fmt --check
+cargo clippy --all-targets -- -D warnings
+cargo run --release
+```
+
+After dependencies have been downloaded once, append `--offline` before the
+final `--` (if any) to reproduce without network access:
+
+```console
+cargo test --all-targets --offline
+cargo clippy --all-targets --offline -- -D warnings
+cargo run --release --offline
+```
+
+The demo recreates `target/caregiver-scheduler-demo-state` on each run. The
+child abort is intentional and is treated as success only if the parent can
+recover and validate its committed change.
+
+## Archive layout
+
+This crate is a member of the nested `developer-simulation` workspace and uses:
+
+```toml
+fold = { path = "../../../fold" }
+```
+
+No ESE or ANNy dependency is included because neither was selected.
+
+## Files
+
+- `src/model.rs`: normalized records, seeded data, explicit-offset time import.
+- `src/scheduler.rs`: baseline and incremental scheduling paths.
+- `src/store.rs`: Fold-backed atomic records and incremental count views.
+- `src/validator.rs`: independent constraint and explanation checker.
+- `src/main.rs`: measurements, replay, recovery, and crash harness.
+- `EVIDENCE.md`: discovery log, exact command results, findings, and decision.
diff --git a/developer-simulation/runs/2026-07-31--homecare-gap-fill/src/lib.rs b/developer-simulation/runs/2026-07-31--homecare-gap-fill/src/lib.rs
new file mode 100644
index 0000000..c63b8ce
--- /dev/null
+++ b/developer-simulation/runs/2026-07-31--homecare-gap-fill/src/lib.rs
@@ -0,0 +1,126 @@
+pub mod model;
+pub mod scheduler;
+pub mod store;
+pub mod validator;
+
+#[cfg(test)]
+mod tests {
+    use std::collections::BTreeMap;
+
+    use crate::model::{
+        Caregiver, EntityKey, Interval, Outcome, Record, Scale, State, UnfilledReason, Visit,
+        generate, parse_import_minute,
+    };
+    use crate::scheduler::{CandidateIndex, IncrementalScheduler, Mode, build_schedule};
+    use crate::store::{load_state, open_store, persist_initial};
+    use crate::validator::validate;
+
+    #[test]
+    fn explicit_offsets_handle_dst_gap_and_fold() {
+        let before_gap = parse_import_minute("2026-03-08T01:30:00-05:00").unwrap();
+        let after_gap = parse_import_minute("2026-03-08T03:30:00-04:00").unwrap();
+        assert_eq!(after_gap - before_gap, 60);
+
+        let first_fold = parse_import_minute("2026-11-01T01:30:00-04:00").unwrap();
+        let second_fold = parse_import_minute("2026-11-01T01:30:00-05:00").unwrap();
+        assert_eq!(second_fold - first_fold, 60);
+        assert!(parse_import_minute("2026-03-08T02:30:00").is_err());
+    }
+
+    #[test]
+    fn scheduler_is_deterministic_and_validator_accepts_it() {
+        let state = generate(7, Scale::Tiny);
+        let index = CandidateIndex::new(&state);
+        let first = build_schedule(&state, &index, Mode::ContinuityAware);
+        let second = build_schedule(&state, &index, Mode::ContinuityAware);
+        assert_eq!(first, second);
+        validate(&state, &first, None).unwrap();
+    }
+
+    #[test]
+    fn validator_rejects_spurious_travel_conflict() {
+        let caregiver = Caregiver {
+            id: 7,
+            certification_mask: 1,
+            region_mask: 1,
+            availability: vec![Interval { start: 0, end: 600 }],
+            required_rest: Vec::new(),
+            max_minutes: 600,
+        };
+        let visit = Visit {
+            id: 11,
+            client_id: 1,
+            start: 60,
+            end: 120,
+            region: 0,
+            required_certification: 0,
+            urgency: 5,
+            preferred_caregiver: None,
+            canceled: false,
+        };
+        let state = State {
+            caregivers: [(caregiver.id, caregiver)].into(),
+            visits: [(visit.id, visit)].into(),
+        };
+        let outcomes = [(11, Outcome::Unfilled(UnfilledReason::TravelConflict))].into();
+
+        let error = validate(&state, &outcomes, None).unwrap_err();
+        assert!(error.contains("caregiver 7 is independently eligible"));
+    }
+
+    #[test]
+    fn cancellation_preserves_unaffected_assignments() {
+        let mut state = generate(7, Scale::Tiny);
+        let index = CandidateIndex::new(&state);
+        let schedule = build_schedule(&state, &index, Mode::ContinuityAware);
+        let before: BTreeMap<_, _> = schedule
+            .iter()
+            .filter_map(|(visit, outcome)| match outcome {
+                Outcome::Assigned(caregiver) => Some((*visit, *caregiver)),
+                Outcome::Unfilled(_) => None,
+            })
+            .collect();
+        let cancel_id = *before.keys().next().unwrap();
+        let mut incremental = IncrementalScheduler::new(&state, schedule);
+        incremental.cancel(&mut state, cancel_id).unwrap();
+        validate(&state, incremental.outcomes(), Some((&before, cancel_id))).unwrap();
+    }
+
+    #[test]
+    fn fold_round_trip_recovers_records_and_metrics() {
+        let state = generate(9, Scale::Tiny);
+        let index = CandidateIndex::new(&state);
+        let schedule = build_schedule(&state, &index, Mode::ContinuityAware);
+        let path = std::env::current_dir()
+            .unwrap()
+            .join("target/fold-round-trip-test");
+        let _ = std::fs::remove_dir_all(&path);
+        {
+            let mut store = open_store(&path);
+            persist_initial(&mut store, &state, &schedule);
+            store.checkpoint();
+        }
+        let store = open_store(&path);
+        let (loaded, loaded_schedule, metrics) = load_state(&store);
+        assert_eq!(state, loaded);
+        assert_eq!(schedule, loaded_schedule);
+        assert_eq!(metrics.caregivers, state.caregivers.len() as i64);
+        assert_eq!(
+            metrics.assignments,
+            schedule
+                .values()
+                .filter(|o| matches!(o, Outcome::Assigned(_)))
+                .count() as i64
+        );
+        drop(store);
+        let _ = std::fs::remove_dir_all(path);
+
+        let _type_check = (
+            EntityKey::Visit(0),
+            Record::Outcome {
+                visit_id: 0,
+                outcome: Outcome::Unfilled(crate::model::UnfilledReason::NoCertification),
+            },
+        );
+    }
+}
diff --git a/developer-simulation/runs/2026-07-31--homecare-gap-fill/src/main.rs b/developer-simulation/runs/2026-07-31--homecare-gap-fill/src/main.rs
new file mode 100644
index 0000000..6ff439e
--- /dev/null
+++ b/developer-simulation/runs/2026-07-31--homecare-gap-fill/src/main.rs
@@ -0,0 +1,349 @@
+use std::collections::{BTreeMap, BTreeSet};
+use std::path::Path;
+use std::process::Command;
+use std::time::{Duration, Instant};
+
+use homecare_gap_fill::model::{Outcome, Scale, State, UnfilledReason, VisitId, generate};
+use homecare_gap_fill::scheduler::{
+    CandidateIndex, IncrementalScheduler, Mode, build_schedule, counts, digest,
+};
+use homecare_gap_fill::store::{load_state, open_store, persist_cancellation, persist_initial};
+use homecare_gap_fill::validator::{PublishedAssignments, validate};
+
+const SEED: u64 = 0x5eed_cafe;
+const BURST_CHANGES: usize = 200;
+const BASELINE_LATENCY_SAMPLES: usize = 12;
+
+fn main() -> Result<(), String> {
+    let args: Vec<String> = std::env::args().collect();
+    if args.get(1).map(String::as_str) == Some("--crash-after-commit") {
+        let path = args.get(2).ok_or("missing crash database path")?;
+        let visit_id = args
+            .get(3)
+            .ok_or("missing crash visit id")?
+            .parse::<VisitId>()
+            .map_err(|error| error.to_string())?;
+        crash_after_commit(Path::new(path), visit_id);
+    }
+    run_demo()
+}
+
+fn run_demo() -> Result<(), String> {
+    let generated_at = Instant::now();
+    let seed_state = generate(SEED, Scale::Representative);
+    let generation_time = generated_at.elapsed();
+    let index = CandidateIndex::new(&seed_state);
+
+    let baseline_started = Instant::now();
+    let baseline_initial = build_schedule(&seed_state, &index, Mode::Baseline);
+    let baseline_initial_time = baseline_started.elapsed();
+    validate(&seed_state, &baseline_initial, None)?;
+
+    let incremental_started = Instant::now();
+    let incremental_initial = build_schedule(&seed_state, &index, Mode::ContinuityAware);
+    let incremental_initial_time = incremental_started.elapsed();
+    validate(&seed_state, &incremental_initial, None)?;
+
+    let cancellation_ids = choose_cancellations(&seed_state, &incremental_initial);
+    if cancellation_ids.len() != BURST_CHANGES {
+        return Err(format!(
+            "needed {BURST_CHANGES} assigned visits for burst, found {}",
+            cancellation_ids.len()
+        ));
+    }
+
+    let (baseline_p95, baseline_preservation) = baseline_latency_sample(
+        &seed_state,
+        &index,
+        &baseline_initial,
+        &cancellation_ids[..BASELINE_LATENCY_SAMPLES],
+    )?;
+
+    let mut baseline_final_state = seed_state.clone();
+    for visit_id in &cancellation_ids {
+        baseline_final_state
+            .visits
+            .get_mut(visit_id)
+            .unwrap()
+            .canceled = true;
+    }
+    let baseline_final_started = Instant::now();
+    let baseline_final = build_schedule(&baseline_final_state, &index, Mode::Baseline);
+    let baseline_final_time = baseline_final_started.elapsed();
+    validate(&baseline_final_state, &baseline_final, None)?;
+
+    let demo_path = std::env::current_dir()
+        .map_err(|error| error.to_string())?
+        .join("target/caregiver-scheduler-demo-state");
+    if demo_path.exists() {
+        std::fs::remove_dir_all(&demo_path).map_err(|error| error.to_string())?;
+    }
+    let mut store = open_store(&demo_path);
+    persist_initial(&mut store, &seed_state, &incremental_initial);
+    store.checkpoint();
+
+    let initial_published = published(&incremental_initial);
+    let mut incremental_state = seed_state.clone();
+    let mut incremental = IncrementalScheduler::new(&incremental_state, incremental_initial);
+    let burst_started = Instant::now();
+    let mut incremental_latencies = Vec::with_capacity(cancellation_ids.len());
+    for visit_id in &cancellation_ids {
+        let started = Instant::now();
+        let delta = incremental.cancel(&mut incremental_state, *visit_id)?;
+        persist_cancellation(
+            &mut store,
+            &incremental_state,
+            incremental.outcomes(),
+            delta,
+        );
+        store.checkpoint();
+        incremental_latencies.push(started.elapsed());
+    }
+    let burst_time = burst_started.elapsed();
+    let incremental_p95 = percentile_95(&incremental_latencies);
+    let final_incremental_digest = digest(&incremental_state, incremental.outcomes());
+    validate(
+        &incremental_state,
+        incremental.outcomes(),
+        Some((&initial_published, cancellation_ids[0])),
+    )?;
+    let preservation = preservation_ratio(
+        &initial_published,
+        incremental.outcomes(),
+        &cancellation_ids.iter().copied().collect(),
+    );
+
+    let baseline_counts = counts(&baseline_final, &baseline_final_state);
+    let incremental_counts = counts(incremental.outcomes(), &incremental_state);
+    if incremental_counts.0 < baseline_counts.0 || incremental_counts.1 < baseline_counts.1 {
+        return Err(format!(
+            "incremental coverage regressed: baseline {baseline_counts:?}, incremental {incremental_counts:?}"
+        ));
+    }
+    if preservation < 0.995 {
+        return Err(format!("preservation {preservation:.6} missed 99.5%"));
+    }
+
+    let replay_started = Instant::now();
+    let mut replay_state = generate(SEED, Scale::Representative);
+    let replay_index = CandidateIndex::new(&replay_state);
+    let replay_initial = build_schedule(&replay_state, &replay_index, Mode::ContinuityAware);
+    let mut replay = IncrementalScheduler::new(&replay_state, replay_initial);
+    for visit_id in &cancellation_ids {
+        replay.cancel(&mut replay_state, *visit_id)?;
+    }
+    let replay_digest = digest(&replay_state, replay.outcomes());
+    let replay_time = replay_started.elapsed();
+    if replay_digest != final_incremental_digest {
+        return Err("deterministic replay digest mismatch".to_string());
+    }
+
+    drop(store);
+    let recovery_started = Instant::now();
+    let recovered_store = open_store(&demo_path);
+    let (recovered_state, recovered_outcomes, recovered_metrics) = load_state(&recovered_store);
+    let recovery_time = recovery_started.elapsed();
+    validate(&recovered_state, &recovered_outcomes, None)?;
+    if digest(&recovered_state, &recovered_outcomes) != final_incremental_digest {
+        return Err("restart recovery digest mismatch".to_string());
+    }
+    if recovery_time >= Duration::from_secs(30) {
+        return Err("restart recovery exceeded 30 seconds".to_string());
+    }
+    drop(recovered_store);
+
+    let crash_visit = recovered_outcomes
+        .iter()
+        .find_map(|(id, outcome)| matches!(outcome, Outcome::Assigned(_)).then_some(*id))
+        .ok_or("no assignment available for crash harness")?;
+    let crash = Command::new(std::env::current_exe().map_err(|error| error.to_string())?)
+        .arg("--crash-after-commit")
+        .arg(&demo_path)
+        .arg(crash_visit.to_string())
+        .output()
+        .map_err(|error| format!("failed to run crash child: {error}"))?;
+    if crash.status.success() {
+        return Err("crash harness child unexpectedly exited cleanly".to_string());
+    }
+    let crash_recovery_started = Instant::now();
+    let crashed_store = open_store(&demo_path);
+    let (crashed_state, crashed_outcomes, crashed_metrics) = load_state(&crashed_store);
+    let crash_recovery_time = crash_recovery_started.elapsed();
+    if !crashed_state.visits[&crash_visit].canceled {
+        return Err("committed cancellation was lost after crash".to_string());
+    }
+    validate(&crashed_state, &crashed_outcomes, None)?;
+
+    let reason_counts = reason_counts(incremental.outcomes());
+    let change_rate = cancellation_ids.len() as f64 / burst_time.as_secs_f64();
+    println!(
+        "DATASET label=10%-representative caregivers={} visits={} horizon_days=14 generated_ms={:.3}",
+        seed_state.caregivers.len(),
+        seed_state.visits.len(),
+        generation_time.as_secs_f64() * 1_000.0
+    );
+    println!(
+        "BOGKIT component=fold role=atomic-keyed-persistence-and-materialized-counts ese=no-fit anny=no-fit"
+    );
+    println!(
+        "BASELINE initial_ms={:.3} sampled_changes={} sampled_p95_ms={:.3} sampled_mean_preservation_pct={:.4} final_rescan_ms={:.3} filled={} urgent_filled={}/{}",
+        baseline_initial_time.as_secs_f64() * 1_000.0,
+        BASELINE_LATENCY_SAMPLES,
+        baseline_p95.as_secs_f64() * 1_000.0,
+        baseline_preservation * 100.0,
+        baseline_final_time.as_secs_f64() * 1_000.0,
+        baseline_counts.0,
+        baseline_counts.1,
+        baseline_counts.2,
+    );
+    println!(
+        "INCREMENTAL initial_ms={:.3} burst_changes={} burst_ms={:.3} p95_ms={:.3} throughput_changes_per_s={:.1} preservation_pct={:.4} filled={} urgent_filled={}/{}",
+        incremental_initial_time.as_secs_f64() * 1_000.0,
+        cancellation_ids.len(),
+        burst_time.as_secs_f64() * 1_000.0,
+        incremental_p95.as_secs_f64() * 1_000.0,
+        change_rate,
+        preservation * 100.0,
+        incremental_counts.0,
+        incremental_counts.1,
+        incremental_counts.2,
+    );
+    println!(
+        "VALIDATOR status=ok constraint_violations=0 active_visits={} outcomes={} unfilled_reason_codes={:?}",
+        incremental_state
+            .visits
+            .values()
+            .filter(|visit| !visit.canceled)
+            .count(),
+        incremental.outcomes().len(),
+        reason_counts,
+    );
+    println!(
+        "REPLAY status=deterministic digest={final_incremental_digest:016x} replay_ms={:.3}",
+        replay_time.as_secs_f64() * 1_000.0
+    );
+    println!(
+        "RESTART status=ok recovery_ms={:.3} caregivers={} active_visits={} assignments={} unfilled={}",
+        recovery_time.as_secs_f64() * 1_000.0,
+        recovered_metrics.caregivers,
+        recovered_metrics.active_visits,
+        recovered_metrics.assignments,
+        recovered_metrics.unfilled,
+    );
+    println!(
+        "CRASH_RESTART status=ok child_status={} recovery_ms={:.3} committed_visit={} canceled_visits={}",
+        crash.status,
+        crash_recovery_time.as_secs_f64() * 1_000.0,
+        crash_visit,
+        crashed_metrics.canceled_visits,
+    );
+    println!("STATE path={}", demo_path.display());
+    Ok(())
+}
+
+fn crash_after_commit(path: &Path, visit_id: VisitId) -> ! {
+    let mut store = open_store(path);
+    let (mut state, outcomes, _) = load_state(&store);
+    let mut scheduler = IncrementalScheduler::new(&state, outcomes);
+    let delta = scheduler.cancel(&mut state, visit_id).unwrap();
+    persist_cancellation(&mut store, &state, scheduler.outcomes(), delta);
+    store.checkpoint();
+    eprintln!("crash harness: committed visit {visit_id}, aborting now");
+    std::process::abort();
+}
+
+fn choose_cancellations(state: &State, outcomes: &BTreeMap<VisitId, Outcome>) -> Vec<VisitId> {
+    outcomes
+        .iter()
+        .filter_map(|(id, outcome)| {
+            let visit = &state.visits[id];
+            (matches!(outcome, Outcome::Assigned(_)) && visit.start >= state.visits[&0].start + 360)
+                .then_some(*id)
+        })
+        .take(BURST_CHANGES)
+        .collect()
+}
+
+fn baseline_latency_sample(
+    seed_state: &State,
+    index: &CandidateIndex,
+    initial: &BTreeMap<VisitId, Outcome>,
+    cancellations: &[VisitId],
+) -> Result<(Duration, f64), String> {
+    let mut state = seed_state.clone();
+    let mut schedule = initial.clone();
+    let mut latencies = Vec::new();
+    let mut preservation_sum = 0.0;
+    for visit_id in cancellations {
+        let before = published(&schedule);
+        state.visits.get_mut(visit_id).unwrap().canceled = true;
+        let started = Instant::now();
+        schedule = build_schedule(&state, index, Mode::Baseline);
+        latencies.push(started.elapsed());
+        validate(&state, &schedule, None)?;
+        preservation_sum += preservation_ratio(&before, &schedule, &BTreeSet::from([*visit_id]));
+    }
+    Ok((
+        percentile_95(&latencies),
+        preservation_sum / cancellations.len() as f64,
+    ))
+}
+
+fn published(outcomes: &BTreeMap<VisitId, Outcome>) -> PublishedAssignments {
+    outcomes
+        .iter()
+        .filter_map(|(visit, outcome)| match outcome {
+            Outcome::Assigned(caregiver) => Some((*visit, *caregiver)),
+            Outcome::Unfilled(_) => None,
+        })
+        .collect()
+}
+
+fn preservation_ratio(
+    before: &PublishedAssignments,
+    after: &BTreeMap<VisitId, Outcome>,
+    affected: &BTreeSet<VisitId>,
+) -> f64 {
+    let mut eligible = 0;
+    let mut preserved = 0;
+    for (visit_id, caregiver_id) in before {
+        if affected.contains(visit_id) {
+            continue;
+        }
+        eligible += 1;
+        if after.get(visit_id) == Some(&Outcome::Assigned(*caregiver_id)) {
+            preserved += 1;
+        }
+    }
+    if eligible == 0 {
+        1.0
+    } else {
+        preserved as f64 / eligible as f64
+    }
+}
+
+fn percentile_95(samples: &[Duration]) -> Duration {
+    let mut sorted = samples.to_vec();
+    sorted.sort_unstable();
+    sorted[((sorted.len() * 95).div_ceil(100)).saturating_sub(1)]
+}
+
+fn reason_counts(outcomes: &BTreeMap<VisitId, Outcome>) -> BTreeMap<&'static str, usize> {
+    let mut counts = BTreeMap::new();
+    for outcome in outcomes.values() {
+        if let Outcome::Unfilled(reason) = outcome {
+            *counts.entry(reason.code()).or_default() += 1;
+        }
+    }
+    for reason in [
+        UnfilledReason::NoCertification,
+        UnfilledReason::NoRegionCoverage,
+        UnfilledReason::OutsideAvailability,
+        UnfilledReason::RequiredRest,
+        UnfilledReason::HourLimit,
+        UnfilledReason::TravelConflict,
+    ] {
+        counts.entry(reason.code()).or_insert(0);
+    }
+    counts
+}
diff --git a/developer-simulation/runs/2026-07-31--homecare-gap-fill/src/model.rs b/developer-simulation/runs/2026-07-31--homecare-gap-fill/src/model.rs
new file mode 100644
index 0000000..695898c
--- /dev/null
+++ b/developer-simulation/runs/2026-07-31--homecare-gap-fill/src/model.rs
@@ -0,0 +1,226 @@
+use std::collections::BTreeMap;
+
+use chrono::DateTime;
+use serde::{Deserialize, Serialize};
+
+pub type Minute = i64;
+pub type CaregiverId = u32;
+pub type VisitId = u64;
+
+pub const REGIONS: u8 = 8;
+pub const CERTIFICATIONS: u8 = 8;
+pub const BASE_MINUTE: Minute = 29_541_900; // 2026-03-02T00:00:00-05:00
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum Scale {
+    Tiny,
+    Representative,
+}
+
+impl Scale {
+    pub fn counts(self) -> (u32, u64) {
+        match self {
+            Self::Tiny => (80, 480),
+            Self::Representative => (2_000, 12_000),
+        }
+    }
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, PartialOrd, Ord, Serialize, Deserialize)]
+pub struct Interval {
+    pub start: Minute,
+    pub end: Minute,
+}
+
+impl Interval {
+    pub fn contains(self, start: Minute, end: Minute) -> bool {
+        self.start <= start && end <= self.end
+    }
+
+    pub fn overlaps(self, start: Minute, end: Minute) -> bool {
+        self.start < end && start < self.end
+    }
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+pub struct Caregiver {
+    pub id: CaregiverId,
+    pub certification_mask: u16,
+    pub region_mask: u16,
+    pub availability: Vec<Interval>,
+    pub required_rest: Vec<Interval>,
+    pub max_minutes: Minute,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+pub struct Visit {
+    pub id: VisitId,
+    pub client_id: u32,
+    pub start: Minute,
+    pub end: Minute,
+    pub region: u8,
+    pub required_certification: u8,
+    pub urgency: u8,
+    pub preferred_caregiver: Option<CaregiverId>,
+    pub canceled: bool,
+}
+
+impl Visit {
+    pub fn duration(&self) -> Minute {
+        self.end - self.start
+    }
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, PartialOrd, Ord, Serialize, Deserialize)]
+pub enum UnfilledReason {
+    NoCertification,
+    NoRegionCoverage,
+    OutsideAvailability,
+    RequiredRest,
+    HourLimit,
+    TravelConflict,
+}
+
+impl UnfilledReason {
+    pub fn code(self) -> &'static str {
+        match self {
+            Self::NoCertification => "NO_CERTIFICATION",
+            Self::NoRegionCoverage => "NO_REGION_COVERAGE",
+            Self::OutsideAvailability => "OUTSIDE_AVAILABILITY",
+            Self::RequiredRest => "REQUIRED_REST",
+            Self::HourLimit => "HOUR_LIMIT",
+            Self::TravelConflict => "TRAVEL_CONFLICT",
+        }
+    }
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
+pub enum Outcome {
+    Assigned(CaregiverId),
+    Unfilled(UnfilledReason),
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Default)]
+pub struct State {
+    pub caregivers: BTreeMap<CaregiverId, Caregiver>,
+    pub visits: BTreeMap<VisitId, Visit>,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, PartialOrd, Ord, Serialize, Deserialize)]
+pub enum EntityKey {
+    Caregiver(CaregiverId),
+    Visit(VisitId),
+    Outcome(VisitId),
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+pub enum Record {
+    Caregiver(Caregiver),
+    Visit(Visit),
+    Outcome { visit_id: VisitId, outcome: Outcome },
+}
+
+#[derive(Clone, Copy)]
+struct Rng(u64);
+
+impl Rng {
+    fn new(seed: u64) -> Self {
+        Self(seed)
+    }
+
+    fn next(&mut self) -> u64 {
+        self.0 ^= self.0 << 13;
+        self.0 ^= self.0 >> 7;
+        self.0 ^= self.0 << 17;
+        self.0
+    }
+
+    fn range(&mut self, upper: u64) -> u64 {
+        self.next() % upper
+    }
+}
+
+pub fn parse_import_minute(value: &str) -> Result<Minute, String> {
+    DateTime::parse_from_rfc3339(value)
+        .map(|value| value.timestamp() / 60)
+        .map_err(|error| format!("timestamp must be RFC3339 with an explicit offset: {error}"))
+}
+
+pub fn generate(seed: u64, scale: Scale) -> State {
+    let (caregiver_count, visit_count) = scale.counts();
+    let mut rng = Rng::new(seed);
+    let mut caregivers = BTreeMap::new();
+    for id in 0..caregiver_count {
+        let home_region = (id % u32::from(REGIONS)) as u8;
+        let second_region = (home_region + 1 + (rng.range(2) as u8)) % REGIONS;
+        let first_cert = rng.range(u64::from(CERTIFICATIONS)) as u8;
+        let second_cert = (first_cert + 1 + rng.range(3) as u8) % CERTIFICATIONS;
+        let mut availability = Vec::with_capacity(14);
+        let mut required_rest = Vec::with_capacity(14);
+        for day in 0..14 {
+            let day_start = BASE_MINUTE + day * 1_440;
+            availability.push(Interval {
+                start: day_start + 6 * 60,
+                end: day_start + 23 * 60,
+            });
+            required_rest.push(Interval {
+                start: day_start + 22 * 60,
+                end: day_start + 23 * 60,
+            });
+        }
+        caregivers.insert(
+            id,
+            Caregiver {
+                id,
+                certification_mask: (1 << first_cert) | (1 << second_cert),
+                region_mask: (1 << home_region) | (1 << second_region),
+                availability,
+                required_rest,
+                max_minutes: 4 * 60,
+            },
+        );
+    }
+
+    let mut visits = BTreeMap::new();
+    for id in 0..visit_count {
+        let day = (id % 14) as i64;
+        let slot = rng.range(60) as i64;
+        let night_case = id % 97 == 0;
+        let start = if night_case {
+            BASE_MINUTE + day * 1_440 + 22 * 60
+        } else {
+            BASE_MINUTE + day * 1_440 + 7 * 60 + slot * 15
+        };
+        let required_certification = if id % 211 == 0 {
+            15
+        } else {
+            rng.range(u64::from(CERTIFICATIONS)) as u8
+        };
+        let preferred = if id % 3 == 0 {
+            Some(rng.range(u64::from(caregiver_count)) as u32)
+        } else {
+            None
+        };
+        visits.insert(
+            id,
+            Visit {
+                id,
+                client_id: (id % (visit_count / 5).max(1)) as u32,
+                start,
+                end: start + 45,
+                region: rng.range(u64::from(REGIONS)) as u8,
+                required_certification,
+                urgency: (rng.range(4) + 1) as u8,
+                preferred_caregiver: preferred,
+                canceled: false,
+            },
+        );
+    }
+
+    State { caregivers, visits }
+}
+
+pub fn travel_minutes(from_region: u8, to_region: u8) -> Minute {
+    let distance = (i64::from(from_region) - i64::from(to_region)).abs();
+    10 + distance * 5
+}
diff --git a/developer-simulation/runs/2026-07-31--homecare-gap-fill/src/scheduler.rs b/developer-simulation/runs/2026-07-31--homecare-gap-fill/src/scheduler.rs
new file mode 100644
index 0000000..04bd99e
--- /dev/null
+++ b/developer-simulation/runs/2026-07-31--homecare-gap-fill/src/scheduler.rs
@@ -0,0 +1,345 @@
+use std::cmp::Reverse;
+use std::collections::{BTreeMap, BTreeSet};
+
+use crate::model::{
+    CERTIFICATIONS, Caregiver, CaregiverId, Minute, Outcome, REGIONS, State, UnfilledReason, Visit,
+    VisitId, travel_minutes,
+};
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum Mode {
+    Baseline,
+    ContinuityAware,
+}
+
+#[derive(Debug)]
+pub struct CandidateIndex {
+    by_region_certification: Vec<Vec<Vec<CaregiverId>>>,
+}
+
+impl CandidateIndex {
+    pub fn new(state: &State) -> Self {
+        let mut by_region_certification =
+            vec![vec![Vec::new(); usize::from(CERTIFICATIONS)]; usize::from(REGIONS)];
+        for caregiver in state.caregivers.values() {
+            for region in 0..REGIONS {
+                for certification in 0..CERTIFICATIONS {
+                    if caregiver.region_mask & (1 << region) != 0
+                        && caregiver.certification_mask & (1 << certification) != 0
+                    {
+                        by_region_certification[usize::from(region)][usize::from(certification)]
+                            .push(caregiver.id);
+                    }
+                }
+            }
+        }
+        Self {
+            by_region_certification,
+        }
+    }
+
+    pub fn candidates(&self, visit: &Visit) -> &[CaregiverId] {
+        if visit.region >= REGIONS || visit.required_certification >= CERTIFICATIONS {
+            return &[];
+        }
+        &self.by_region_certification[usize::from(visit.region)]
+            [usize::from(visit.required_certification)]
+    }
+}
+
+type PriorityKey = (Reverse<u8>, Minute, VisitId);
+
+fn priority(visit: &Visit) -> PriorityKey {
+    (Reverse(visit.urgency), visit.start, visit.id)
+}
+
+#[derive(Default)]
+struct WorkingSchedule {
+    outcomes: BTreeMap<VisitId, Outcome>,
+    by_caregiver: BTreeMap<CaregiverId, BTreeSet<VisitId>>,
+    minutes: BTreeMap<CaregiverId, Minute>,
+}
+
+impl WorkingSchedule {
+    fn assigned_visits<'a>(
+        &'a self,
+        state: &'a State,
+        caregiver_id: CaregiverId,
+    ) -> impl Iterator<Item = &'a Visit> {
+        self.by_caregiver
+            .get(&caregiver_id)
+            .into_iter()
+            .flatten()
+            .filter_map(|id| state.visits.get(id))
+    }
+
+    fn assign(&mut self, visit: &Visit, caregiver_id: CaregiverId) {
+        self.outcomes
+            .insert(visit.id, Outcome::Assigned(caregiver_id));
+        self.by_caregiver
+            .entry(caregiver_id)
+            .or_default()
+            .insert(visit.id);
+        *self.minutes.entry(caregiver_id).or_default() += visit.duration();
+    }
+}
+
+pub fn build_schedule(
+    state: &State,
+    index: &CandidateIndex,
+    mode: Mode,
+) -> BTreeMap<VisitId, Outcome> {
+    let mut work = WorkingSchedule::default();
+    let mut order: Vec<_> = state
+        .visits
+        .values()
+        .filter(|visit| !visit.canceled)
+        .collect();
+    order.sort_by_key(|visit| priority(visit));
+
+    for visit in order {
+        let mut eligible: Vec<_> = index
+            .candidates(visit)
+            .iter()
+            .copied()
+            .filter(|caregiver_id| can_assign(state, &work, *caregiver_id, visit))
+            .collect();
+        match mode {
+            Mode::Baseline => eligible.sort_unstable(),
+            Mode::ContinuityAware => eligible.sort_by_key(|caregiver_id| {
+                (
+                    visit.preferred_caregiver != Some(*caregiver_id),
+                    work.minutes.get(caregiver_id).copied().unwrap_or(0),
+                    *caregiver_id,
+                )
+            }),
+        }
+        if let Some(caregiver_id) = eligible.first().copied() {
+            work.assign(visit, caregiver_id);
+        } else {
+            work.outcomes
+                .insert(visit.id, Outcome::Unfilled(UnfilledReason::TravelConflict));
+        }
+    }
+
+    let unfilled: Vec<_> = work
+        .outcomes
+        .iter()
+        .filter_map(|(id, outcome)| matches!(outcome, Outcome::Unfilled(_)).then_some(*id))
+        .collect();
+    for id in unfilled {
+        let visit = &state.visits[&id];
+        let reason = explain_unfilled(state, &work, visit);
+        work.outcomes.insert(id, Outcome::Unfilled(reason));
+    }
+    work.outcomes
+}
+
+fn covers(caregiver: &Caregiver, visit: &Visit) -> bool {
+    caregiver
+        .availability
+        .iter()
+        .any(|window| window.contains(visit.start, visit.end))
+}
+
+fn rests(caregiver: &Caregiver, visit: &Visit) -> bool {
+    caregiver
+        .required_rest
+        .iter()
+        .any(|rest| rest.overlaps(visit.start, visit.end))
+}
+
+fn has_travel_room(existing: &Visit, candidate: &Visit) -> bool {
+    if existing.end <= candidate.start {
+        existing.end + travel_minutes(existing.region, candidate.region) <= candidate.start
+    } else if candidate.end <= existing.start {
+        candidate.end + travel_minutes(candidate.region, existing.region) <= existing.start
+    } else {
+        false
+    }
+}
+
+fn can_assign(
+    state: &State,
+    work: &WorkingSchedule,
+    caregiver_id: CaregiverId,
+    visit: &Visit,
+) -> bool {
+    let Some(caregiver) = state.caregivers.get(&caregiver_id) else {
+        return false;
+    };
+    caregiver.certification_mask & (1 << visit.required_certification) != 0
+        && caregiver.region_mask & (1 << visit.region) != 0
+        && covers(caregiver, visit)
+        && !rests(caregiver, visit)
+        && work.minutes.get(&caregiver_id).copied().unwrap_or(0) + visit.duration()
+            <= caregiver.max_minutes
+        && work
+            .assigned_visits(state, caregiver_id)
+            .all(|existing| has_travel_room(existing, visit))
+}
+
+fn explain_unfilled(state: &State, work: &WorkingSchedule, visit: &Visit) -> UnfilledReason {
+    let mut candidates: Vec<_> = state.caregivers.values().collect();
+    candidates.retain(|caregiver| {
+        caregiver.certification_mask & (1 << visit.required_certification) != 0
+    });
+    if candidates.is_empty() {
+        return UnfilledReason::NoCertification;
+    }
+    candidates.retain(|caregiver| caregiver.region_mask & (1 << visit.region) != 0);
+    if candidates.is_empty() {
+        return UnfilledReason::NoRegionCoverage;
+    }
+    candidates.retain(|caregiver| covers(caregiver, visit));
+    if candidates.is_empty() {
+        return UnfilledReason::OutsideAvailability;
+    }
+    candidates.retain(|caregiver| !rests(caregiver, visit));
+    if candidates.is_empty() {
+        return UnfilledReason::RequiredRest;
+    }
+    candidates.retain(|caregiver| {
+        work.minutes.get(&caregiver.id).copied().unwrap_or(0) + visit.duration()
+            <= caregiver.max_minutes
+    });
+    if candidates.is_empty() {
+        return UnfilledReason::HourLimit;
+    }
+    UnfilledReason::TravelConflict
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub struct CancellationDelta {
+    pub canceled_visit: VisitId,
+    pub replacement_visit: Option<VisitId>,
+}
+
+pub struct IncrementalScheduler {
+    work: WorkingSchedule,
+    open: BTreeSet<PriorityKey>,
+}
+
+impl IncrementalScheduler {
+    pub fn new(state: &State, outcomes: BTreeMap<VisitId, Outcome>) -> Self {
+        let mut work = WorkingSchedule {
+            outcomes,
+            ..WorkingSchedule::default()
+        };
+        let mut open = BTreeSet::new();
+        for (id, outcome) in &work.outcomes {
+            let visit = &state.visits[id];
+            match outcome {
+                Outcome::Assigned(caregiver_id) => {
+                    work.by_caregiver
+                        .entry(*caregiver_id)
+                        .or_default()
+                        .insert(*id);
+                    *work.minutes.entry(*caregiver_id).or_default() += visit.duration();
+                }
+                Outcome::Unfilled(_) => {
+                    open.insert(priority(visit));
+                }
+            }
+        }
+        Self { work, open }
+    }
+
+    pub fn outcomes(&self) -> &BTreeMap<VisitId, Outcome> {
+        &self.work.outcomes
+    }
+
+    pub fn cancel(
+        &mut self,
+        state: &mut State,
+        visit_id: VisitId,
+    ) -> Result<CancellationDelta, String> {
+        let visit = state
+            .visits
+            .get_mut(&visit_id)
+            .ok_or_else(|| format!("unknown visit {visit_id}"))?;
+        if visit.canceled {
+            return Err(format!("visit {visit_id} was already canceled"));
+        }
+        visit.canceled = true;
+        let canceled_visit = visit.clone();
+        let old = self
+            .work
+            .outcomes
+            .remove(&visit_id)
+            .ok_or_else(|| format!("visit {visit_id} had no published outcome"))?;
+        self.open.remove(&priority(&canceled_visit));
+
+        let freed = match old {
+            Outcome::Assigned(caregiver_id) => {
+                self.work
+                    .by_caregiver
+                    .entry(caregiver_id)
+                    .or_default()
+                    .remove(&visit_id);
+                *self.work.minutes.entry(caregiver_id).or_default() -= canceled_visit.duration();
+                Some(caregiver_id)
+            }
+            Outcome::Unfilled(_) => None,
+        };
+
+        let mut replacement = None;
+        if let Some(caregiver_id) = freed {
+            for key in &self.open {
+                let open_visit = &state.visits[&key.2];
+                if can_assign(state, &self.work, caregiver_id, open_visit) {
+                    replacement = Some(open_visit.id);
+                    break;
+                }
+            }
+            if let Some(replacement_id) = replacement {
+                let open_visit = &state.visits[&replacement_id];
+                self.open.remove(&priority(open_visit));
+                self.work.assign(open_visit, caregiver_id);
+            }
+        }
+
+        Ok(CancellationDelta {
+            canceled_visit: visit_id,
+            replacement_visit: replacement,
+        })
+    }
+}
+
+pub fn counts(outcomes: &BTreeMap<VisitId, Outcome>, state: &State) -> (usize, usize, usize) {
+    let mut filled = 0;
+    let mut urgent_total = 0;
+    let mut urgent_filled = 0;
+    for (id, outcome) in outcomes {
+        let visit = &state.visits[id];
+        if visit.urgency >= 4 {
+            urgent_total += 1;
+        }
+        if matches!(outcome, Outcome::Assigned(_)) {
+            filled += 1;
+            if visit.urgency >= 4 {
+                urgent_filled += 1;
+            }
+        }
+    }
+    (filled, urgent_filled, urgent_total)
+}
+
+pub fn digest(state: &State, outcomes: &BTreeMap<VisitId, Outcome>) -> u64 {
+    let mut hash = 0xcbf2_9ce4_8422_2325_u64;
+    for visit in state.visits.values() {
+        hash ^= visit.id;
+        hash = hash.wrapping_mul(0x100_0000_01b3);
+        hash ^= u64::from(visit.canceled);
+        hash = hash.wrapping_mul(0x100_0000_01b3);
+        if let Some(outcome) = outcomes.get(&visit.id) {
+            let word = match outcome {
+                Outcome::Assigned(id) => u64::from(*id) << 1,
+                Outcome::Unfilled(reason) => 1 | ((*reason as u64) << 8),
+            };
+            hash ^= word;
+            hash = hash.wrapping_mul(0x100_0000_01b3);
+        }
+    }
+    hash
+}
diff --git a/developer-simulation/runs/2026-07-31--homecare-gap-fill/src/store.rs b/developer-simulation/runs/2026-07-31--homecare-gap-fill/src/store.rs
new file mode 100644
index 0000000..f5cdfcc
--- /dev/null
+++ b/developer-simulation/runs/2026-07-31--homecare-gap-fill/src/store.rs
@@ -0,0 +1,155 @@
+use std::collections::BTreeMap;
+use std::path::Path;
+
+use fold::pipeline::{Aggregate, FilterMap, KeyBy, Keyed, terminal};
+use fold::stream::KeyedStream;
+use serde::{Deserialize, Serialize};
+
+use crate::model::{EntityKey, Outcome, Record, State, VisitId};
+use crate::scheduler::CancellationDelta;
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, PartialOrd, Ord, Serialize, Deserialize)]
+pub enum Metric {
+    Caregivers,
+    ActiveVisits,
+    CanceledVisits,
+    Assignments,
+    Unfilled,
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Default)]
+pub struct Metrics {
+    pub caregivers: i64,
+    pub active_visits: i64,
+    pub canceled_visits: i64,
+    pub assignments: i64,
+    pub unfilled: i64,
+}
+
+type MetricAggregate =
+    Aggregate<Metric, Metric, i64, fn(&mut i64, &Metric, isize), terminal::Table<Metric, i64>>;
+type MetricKeyBy = KeyBy<fn(&Metric) -> Metric, MetricAggregate, Metric, Metric>;
+type MetricPipeline = FilterMap<
+    fn(&Keyed<EntityKey, Record>) -> Option<Metric>,
+    MetricKeyBy,
+    Keyed<EntityKey, Record>,
+    Metric,
+>;
+type Pipeline = (terminal::Table<EntityKey, Record>, MetricPipeline);
+pub type Store = KeyedStream<EntityKey, Record, Pipeline>;
+
+fn record_metric(row: &Keyed<EntityKey, Record>) -> Option<Metric> {
+    match &row.val {
+        Record::Caregiver(_) => Some(Metric::Caregivers),
+        Record::Visit(visit) if visit.canceled => Some(Metric::CanceledVisits),
+        Record::Visit(_) => Some(Metric::ActiveVisits),
+        Record::Outcome {
+            outcome: Outcome::Assigned(_),
+            ..
+        } => Some(Metric::Assignments),
+        Record::Outcome {
+            outcome: Outcome::Unfilled(_),
+            ..
+        } => Some(Metric::Unfilled),
+    }
+}
+
+fn same_metric(metric: &Metric) -> Metric {
+    *metric
+}
+
+fn count_metric(count: &mut i64, _metric: &Metric, delta: isize) {
+    *count += delta as i64;
+}
+
+pub fn open_store(path: impl AsRef<Path>) -> Store {
+    let records = terminal::Table::<EntityKey, Record>::new("records");
+    let metrics = FilterMap::new(
+        record_metric as fn(&Keyed<EntityKey, Record>) -> Option<Metric>,
+        KeyBy::new(
+            same_metric as fn(&Metric) -> Metric,
+            Aggregate::new(
+                "metric_counts",
+                count_metric as fn(&mut i64, &Metric, isize),
+                terminal::Table::<Metric, i64>::new("metrics"),
+            ),
+        ),
+    );
+    KeyedStream::new(path, (records, metrics))
+}
+
+pub fn persist_initial(store: &mut Store, state: &State, outcomes: &BTreeMap<VisitId, Outcome>) {
+    store.wtx(|tx| {
+        for caregiver in state.caregivers.values() {
+            tx.upsert(
+                &EntityKey::Caregiver(caregiver.id),
+                &Record::Caregiver(caregiver.clone()),
+            );
+        }
+        for visit in state.visits.values() {
+            tx.upsert(&EntityKey::Visit(visit.id), &Record::Visit(visit.clone()));
+        }
+        for (visit_id, outcome) in outcomes {
+            tx.upsert(
+                &EntityKey::Outcome(*visit_id),
+                &Record::Outcome {
+                    visit_id: *visit_id,
+                    outcome: *outcome,
+                },
+            );
+        }
+    });
+}
+
+pub fn persist_cancellation(
+    store: &mut Store,
+    state: &State,
+    outcomes: &BTreeMap<VisitId, Outcome>,
+    delta: CancellationDelta,
+) {
+    let canceled = state.visits[&delta.canceled_visit].clone();
+    store.wtx(|tx| {
+        tx.upsert(
+            &EntityKey::Visit(delta.canceled_visit),
+            &Record::Visit(canceled),
+        );
+        tx.remove(&EntityKey::Outcome(delta.canceled_visit));
+        if let Some(visit_id) = delta.replacement_visit {
+            tx.upsert(
+                &EntityKey::Outcome(visit_id),
+                &Record::Outcome {
+                    visit_id,
+                    outcome: outcomes[&visit_id],
+                },
+            );
+        }
+    });
+}
+
+pub fn load_state(store: &Store) -> (State, BTreeMap<VisitId, Outcome>, Metrics) {
+    store.rtx(|(records, metrics)| {
+        let mut state = State::default();
+        let mut outcomes = BTreeMap::new();
+        for (_, record) in records.iter() {
+            match record {
+                Record::Caregiver(caregiver) => {
+                    state.caregivers.insert(caregiver.id, caregiver);
+                }
+                Record::Visit(visit) => {
+                    state.visits.insert(visit.id, visit);
+                }
+                Record::Outcome { visit_id, outcome } => {
+                    outcomes.insert(visit_id, outcome);
+                }
+            }
+        }
+        let metrics = Metrics {
+            caregivers: metrics.get(&Metric::Caregivers).unwrap_or(0),
+            active_visits: metrics.get(&Metric::ActiveVisits).unwrap_or(0),
+            canceled_visits: metrics.get(&Metric::CanceledVisits).unwrap_or(0),
+            assignments: metrics.get(&Metric::Assignments).unwrap_or(0),
+            unfilled: metrics.get(&Metric::Unfilled).unwrap_or(0),
+        };
+        (state, outcomes, metrics)
+    })
+}
diff --git a/developer-simulation/runs/2026-07-31--homecare-gap-fill/src/validator.rs b/developer-simulation/runs/2026-07-31--homecare-gap-fill/src/validator.rs
new file mode 100644
index 0000000..29cb719
--- /dev/null
+++ b/developer-simulation/runs/2026-07-31--homecare-gap-fill/src/validator.rs
@@ -0,0 +1,193 @@
+use std::collections::BTreeMap;
+
+use crate::model::{
+    CERTIFICATIONS, Caregiver, CaregiverId, Outcome, REGIONS, State, UnfilledReason, Visit,
+    VisitId, travel_minutes,
+};
+
+pub type PublishedAssignments = BTreeMap<VisitId, CaregiverId>;
+
+pub fn validate(
+    state: &State,
+    outcomes: &BTreeMap<VisitId, Outcome>,
+    protected: Option<(&PublishedAssignments, VisitId)>,
+) -> Result<(), String> {
+    let active = state
+        .visits
+        .values()
+        .filter(|visit| !visit.canceled)
+        .count();
+    if outcomes.len() != active {
+        return Err(format!(
+            "expected one outcome per active visit: {active} active, {} outcomes",
+            outcomes.len()
+        ));
+    }
+
+    let mut assigned: BTreeMap<CaregiverId, Vec<&Visit>> = BTreeMap::new();
+    for (visit_id, outcome) in outcomes {
+        let visit = state
+            .visits
+            .get(visit_id)
+            .ok_or_else(|| format!("outcome references missing visit {visit_id}"))?;
+        if visit.canceled {
+            return Err(format!("canceled visit {visit_id} still has an outcome"));
+        }
+        if let Outcome::Assigned(caregiver_id) = outcome {
+            assigned.entry(*caregiver_id).or_default().push(visit);
+        }
+    }
+
+    for (caregiver_id, visits) in &mut assigned {
+        let caregiver = state
+            .caregivers
+            .get(caregiver_id)
+            .ok_or_else(|| format!("assignment references missing caregiver {caregiver_id}"))?;
+        visits.sort_by_key(|visit| (visit.start, visit.id));
+        let minutes: i64 = visits.iter().map(|visit| visit.duration()).sum();
+        if minutes > caregiver.max_minutes {
+            return Err(format!("caregiver {caregiver_id} exceeds hour limit"));
+        }
+        for visit in visits.iter() {
+            validate_static(caregiver, visit)?;
+        }
+        for pair in visits.windows(2) {
+            let first = pair[0];
+            let second = pair[1];
+            let earliest = first.end + travel_minutes(first.region, second.region);
+            if earliest > second.start {
+                return Err(format!(
+                    "caregiver {caregiver_id} lacks travel time between {} and {}",
+                    first.id, second.id
+                ));
+            }
+        }
+    }
+
+    for (visit_id, outcome) in outcomes {
+        if let Outcome::Unfilled(reported) = outcome {
+            let visit = &state.visits[visit_id];
+            let expected = independent_reason(state, &assigned, visit)?;
+            if *reported != expected {
+                return Err(format!(
+                    "visit {visit_id}: reason {} did not match validator reason {}",
+                    reported.code(),
+                    expected.code()
+                ));
+            }
+        }
+    }
+
+    if let Some((before, changed_visit)) = protected {
+        for (visit_id, caregiver_id) in before {
+            if *visit_id == changed_visit || state.visits[visit_id].canceled {
+                continue;
+            }
+            if outcomes.get(visit_id) != Some(&Outcome::Assigned(*caregiver_id)) {
+                return Err(format!(
+                    "unaffected published assignment for visit {visit_id} changed"
+                ));
+            }
+        }
+    }
+    Ok(())
+}
+
+fn validate_static(caregiver: &Caregiver, visit: &Visit) -> Result<(), String> {
+    if visit.required_certification >= CERTIFICATIONS
+        || caregiver.certification_mask & (1 << visit.required_certification) == 0
+    {
+        return Err(format!("visit {} lacks certification", visit.id));
+    }
+    if visit.region >= REGIONS || caregiver.region_mask & (1 << visit.region) == 0 {
+        return Err(format!("visit {} lacks region coverage", visit.id));
+    }
+    if !caregiver
+        .availability
+        .iter()
+        .any(|window| window.start <= visit.start && visit.end <= window.end)
+    {
+        return Err(format!("visit {} is outside availability", visit.id));
+    }
+    if caregiver
+        .required_rest
+        .iter()
+        .any(|rest| rest.start < visit.end && visit.start < rest.end)
+    {
+        return Err(format!("visit {} overlaps required rest", visit.id));
+    }
+    Ok(())
+}
+
+fn independent_reason(
+    state: &State,
+    assigned: &BTreeMap<CaregiverId, Vec<&Visit>>,
+    visit: &Visit,
+) -> Result<UnfilledReason, String> {
+    let mut candidates: Vec<_> = state.caregivers.values().collect();
+    candidates.retain(|caregiver| {
+        visit.required_certification < CERTIFICATIONS
+            && caregiver.certification_mask & (1 << visit.required_certification) != 0
+    });
+    if candidates.is_empty() {
+        return Ok(UnfilledReason::NoCertification);
+    }
+    candidates.retain(|caregiver| {
+        visit.region < REGIONS && caregiver.region_mask & (1 << visit.region) != 0
+    });
+    if candidates.is_empty() {
+        return Ok(UnfilledReason::NoRegionCoverage);
+    }
+    candidates.retain(|caregiver| {
+        caregiver
+            .availability
+            .iter()
+            .any(|window| window.start <= visit.start && visit.end <= window.end)
+    });
+    if candidates.is_empty() {
+        return Ok(UnfilledReason::OutsideAvailability);
+    }
+    candidates.retain(|caregiver| {
+        !caregiver
+            .required_rest
+            .iter()
+            .any(|rest| rest.start < visit.end && visit.start < rest.end)
+    });
+    if candidates.is_empty() {
+        return Ok(UnfilledReason::RequiredRest);
+    }
+    candidates.retain(|caregiver| {
+        let minutes: i64 = assigned
+            .get(&caregiver.id)
+            .into_iter()
+            .flatten()
+            .map(|assigned_visit| assigned_visit.duration())
+            .sum();
+        minutes + visit.duration() <= caregiver.max_minutes
+    });
+    if candidates.is_empty() {
+        return Ok(UnfilledReason::HourLimit);
+    }
+    for caregiver in candidates {
+        let travel_feasible = assigned
+            .get(&caregiver.id)
+            .into_iter()
+            .flatten()
+            .all(|existing| {
+                if existing.end <= visit.start {
+                    existing.end + travel_minutes(existing.region, visit.region) <= visit.start
+                } else if visit.end <= existing.start {
+                    visit.end + travel_minutes(visit.region, existing.region) <= existing.start
+                } else {
+                    false
+                }
+            });
+        if travel_feasible {
+            return Err(format!(
+                "visit {} is unfilled but caregiver {} is independently eligible",
+                visit.id, caregiver.id
+            ));
+        }
+    }
+    Ok(UnfilledReason::TravelConflict)
+}
diff --git a/developer-simulation/runs/2026-07-31--parts-catalog-evolution/Cargo.toml b/developer-simulation/runs/2026-07-31--parts-catalog-evolution/Cargo.toml
new file mode 100644
index 0000000..d3f2967
--- /dev/null
+++ b/developer-simulation/runs/2026-07-31--parts-catalog-evolution/Cargo.toml
@@ -0,0 +1,15 @@
+[package]
+name = "parts-catalog-evolution"
+version = "0.1.0"
+edition.workspace = true
+publish.workspace = true
+
+[dependencies]
+axum = "0.8.9"
+serde = { version = "1.0.229", features = ["derive"] }
+serde_json = "1.0.150"
+tokio = { version = "1.52.3", features = ["macros", "net", "rt-multi-thread", "sync"] }
+tower = { version = "0.5.3", features = ["util"] }
+
+[dev-dependencies]
+http-body-util = "0.1"
diff --git a/developer-simulation/runs/2026-07-31--parts-catalog-evolution/EVIDENCE.md b/developer-simulation/runs/2026-07-31--parts-catalog-evolution/EVIDENCE.md
new file mode 100644
index 0000000..03ab527
--- /dev/null
+++ b/developer-simulation/runs/2026-07-31--parts-catalog-evolution/EVIDENCE.md
@@ -0,0 +1,272 @@
+# Evidence
+
+Run date: 2026-07-31 (America/New_York)
+
+## Outcome
+
+The prototype outcome is **BogKit no-fit for the authoritative catalog path**. The smallest credible solution keeps SQLite authoritative and uses ordinary transactional tables and compact facet indexes. Fold's incremental views are promising for optional derived analytics later, but adopting them here would introduce a second durable store without solving schema validation, conditional updates, SQLite-file preservation, or online category revisions.
+
+ESE and ANNy are also no-fit because embeddings, semantic search, and recommendations are explicit non-goals.
+
+## Ordered discovery and friction
+
+1. `sed -n '1,240p' README.md`
+   - The top-level description says Fold incrementally maintains fast views and names ESE/ANNy, but gives no catalog, SQLite coexistence, schema evolution, or optimistic-update guidance.
+2. Read the four public examples under `examples/`.
+   - `starter` demonstrates durable counts/bags and atomic retraction.
+   - `timeseries` demonstrates typed, fixed-at-compile-time materialized views.
+   - `chat` demonstrates one thread owning Fold and publishing snapshots to Axum clients.
+   - `search` demonstrates keyed upsert/retraction plus BM25/HNSW derived indexes.
+3. Read Fold's public crate documentation and relevant public operators.
+   - Fold persists through Fjall, not the existing SQLite file. Pipelines are concrete Rust types assembled at startup. This is a direct mismatch for SQLite authority and user-defined category schemas activated online.
+4. Evaluated the baseline before choosing a component.
+   - SQLite already provides atomic compare-and-swap updates, online additive tables/indexes, WAL restart safety, parameterized exact/range queries, and atomic import checkpoints in the same file.
+5. Initial dependency check found no cached `rusqlite` package in the sanitized workspace.
+   - Smallest improvement made in the prototype: a narrow parameterized wrapper around the system SQLite library in `src/sqlite.rs`. This added implementation friction and is not a recommendation to replace `rusqlite` in production.
+6. First compile found two expressions unsupported directly inside `serde_json::json!`.
+   - Moved the selected seed values into local variables. Tests then compiled and passed.
+7. First test run reported two unused SQLite functions.
+   - Removed them; the required lint command then completed with no warnings.
+8. Scale verification was run first on 25,000 records, then repeated at the full 250,000-record boundary.
+9. Skeptical review found that import jobs were bound only to a record count and
+   `INSERT OR IGNORE` allowed conflicting pre-existing IDs to advance the
+   checkpoint. Independent reproducers produced mixed payload sizes and a false
+   completion. The importer now persists a generator/payload fingerprint,
+   rejects changed sources, compares the complete expected product on duplicate
+   IDs, and rolls back before checkpoint advancement on conflict.
+10. Review narrowed the HTTP, concurrency, schema, interruption, performance,
+    and storage claims and removed the unused optional Fold dependency.
+
+## Exact verification and observed results
+
+### Formatting
+
+Command:
+
+```console
+cargo fmt --check
+```
+
+Observed: exit 0, no output.
+
+### Tests
+
+Command:
+
+```console
+CARGO_NET_OFFLINE=true cargo test
+```
+
+Observed:
+
+```text
+running 9 tests
+test result: ok. 9 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out
+```
+
+The tests cover stable nested error paths, omitted-field patch behavior, stale
+versions, v1 readability and v1-to-v2 migration, exact/range agreement with an
+independent evaluator, orderly import reopen with every expected ID, rejection
+of changed resume sources and conflicting pre-existing rows, POST/GET response
+shape within this prototype, and preservation of an unrelated legacy table.
+
+### Lint
+
+Command:
+
+```console
+CARGO_NET_OFFLINE=true cargo clippy --all-targets -- -D warnings
+```
+
+Observed: exit 0; finished with no warnings.
+
+### Demo
+
+Command:
+
+```console
+CARGO_NET_OFFLINE=true cargo run --release -- demo
+```
+
+Observed:
+
+```text
+legacy SQLite table preserved: yes
+v1 readable after v2 activation: spec_version=1
+tested migration: spec_version=2, version=2
+partial patch preserved connector="usb-c", new version=2
+stale conditional patch rejected: true
+independent filter evaluator: exact=1, range=1, all matched
+Fold decision: no-fit for authoritative catalog path; SQLite retained
+```
+
+### Full orderly reopen and resume
+
+Command:
+
+```console
+CARGO_NET_OFFLINE=true cargo run --release -- import-check 250000 2048
+```
+
+Observed:
+
+```text
+simulated interruption checkpoint: 7000/250000
+resume completed: true
+rows: 250000; distinct ids: 250000; expected: 250000
+record payload: 2048 bytes; database: 1139924992 bytes
+elapsed: 8.623s
+```
+
+The command drops the database connection after the first seven committed
+batches, reopens the same SQLite file, validates the source fingerprint, resumes
+by durable ordinal, and verifies total and distinct IDs. This is an orderly
+reopen after committed batches, not a crash or power-loss test. The unit test
+additionally checks the complete expected ID set on a 2,503-row uneven final
+batch, changed-source rejection, and duplicate-content conflict rollback.
+
+### Full-population 150-request burst
+
+Command:
+
+```console
+CARGO_NET_OFFLINE=true cargo run --release -- burst 250000
+```
+
+Observed:
+
+```text
+simultaneous burst: 150 requests (120 reads / 30 writes)
+seed: 250000 representative 2 KiB records
+read p95: 4.037 ms
+write p95: 2.314 ms
+targets: reads <50 ms; writes <100 ms
+```
+
+This is an in-process Axum burst against the full population on the trial host.
+One global mutex serializes SQLite access. Two reviewer reruns measured read
+p95 at 1.903 and 1.518 ms and write p95 at 1.615 and 1.389 ms. The post-fix run
+measured 2.104 and 2.721 ms, making the observed ranges 1.518–4.037 ms and
+1.389–2.721 ms. The test excludes network latency, a second process, a
+same-version write race, and a memory-limited VM.
+
+### Full-population storage comparison
+
+Command:
+
+```console
+CARGO_NET_OFFLINE=true cargo run --release -- storage-check 250000 2048
+```
+
+Observed:
+
+```text
+storage sample: 250000 records at 2048 payload bytes
+baseline SQLite: 1039552512 bytes
+indexed SQLite: 1139924992 bytes
+ratio: 1.097x; target: <1.5x
+```
+
+The baseline contains identical product rows with primary-key, category, and price indexes. The indexed version adds category schemas, import progress, per-product scalar facets, and exact/range indexes.
+
+## Acceptance coverage
+
+| Requirement | Evidence | Status |
+|---|---|---|
+| CRUD compatibility | Axum POST/GET route smoke test plus direct patch/filter/delete behavior | Only the prototype shape is exercised; the real service contract was unavailable |
+| Stable nested validation paths | `specs.battery_wh` test | Demonstrated |
+| Safe partial updates | omitted connector/name preserved; stale version gives 409 | Demonstrated |
+| Exact/range correctness | SQLite results compared to separate JSON evaluator across three query shapes | Demonstrated on generated data |
+| v1 readable after v2 | read old row after activating v2; explicit migration adds `battery_wh` | Demonstrated |
+| p95 targets at burst | 1.518–4.037 ms reads, 1.389–2.721 ms writes at 150 in-process requests | Passed under one global mutex on the trial host, not a 512 MiB VM |
+| Reopened 250,000 import | orderly close, reopen, source check, resume; total = distinct = 250,000 | Demonstrated at full count with 2 KiB payloads; no crash injection |
+| Storage under 1.5x | 1.097x against a synthetic SQLite baseline | Demonstrated at full count with 2 KiB payloads and three categories |
+| Existing SQLite preserved | unrelated table survives schema initialization | Demonstrated |
+| Category revision | active schema flip is transactional while v1 stays readable | Demonstrated only for hardcoded laptop v1/v2 |
+
+## Categorized findings
+
+### 1. Storage integration — high severity, high confidence
+
+- Reproduction: top-level and Fold crate documentation identify Fjall as Fold's durable store; public examples open a Fold-owned database path.
+- Finding: Fold is not an extension of an existing SQLite transaction. Making it authoritative would break the preserve-SQLite constraint; making it derived introduces untested dual-write/rebuild responsibilities. Sidecar storage cost was not measured.
+- Smallest improvement: document this boundary prominently in the top-level README, including a supported SQLite-derived-view synchronization pattern if one exists.
+
+### 2. Dynamic category schemas — high severity, high confidence
+
+- Reproduction: examples build typed pipelines from Rust closures and concrete record types at startup.
+- Finding: that model is strong for known static records but does not directly validate 30 user-revised category schemas online with stable JSON paths.
+- Smallest improvement: add an explicit no-fit example or guide for runtime-defined schemas, and identify the intended external validation layer.
+
+### 3. Conditional updates — high severity, high confidence
+
+- Reproduction: keyed upsert retracts the prior value, but the examples expose no expected-version condition.
+- Finding: safe concurrent editing still needs a compare-and-swap check in the authoritative transaction.
+- Smallest improvement: document an expected-version keyed update recipe or add a conditional-upsert result type.
+
+### 4. Query fit — medium severity, high confidence
+
+- Reproduction: Ranked provides range traversal for one compile-time score; filtering operators materialize predicates chosen at pipeline construction.
+- Finding: 30 evolving categories create many runtime paths and combinations; a compact SQLite facet table is simpler for the required exact/range subset.
+- Smallest improvement: provide guidance on dynamic facet indexing and storage amplification, including a benchmark against a relational baseline.
+
+### 5. Onboarding — medium severity, high confidence
+
+- Reproduction: the top-level README describes Fold in one paragraph and routes users to internal docs; examples contain the clearest operational explanations.
+- Finding: a new developer must infer transaction ownership, storage format, schema stability expectations, and migration boundaries from source and examples.
+- Smallest improvement: add a short “fits / does not fit” matrix covering source-of-truth storage, runtime schemas, query types, and update concurrency.
+
+### 6. Local SQLite wrapper — medium severity, high confidence
+
+- Reproduction: `CARGO_NET_OFFLINE=true cargo info rusqlite@0.37.0` reported that the package was unavailable in the sanitized registry cache.
+- Finding: the trial needed a small direct wrapper to stay runnable offline. It is appropriately narrow but less mature than `rusqlite`.
+- Smallest improvement: productionize with a maintained SQLite crate, pooled read connections, migration tooling, and error-code mapping.
+
+### 7. Import identity defect, fixed — high severity, high confidence
+
+- Reproduction: the reviewer resumed one job with a changed payload size and
+  inserted a conflicting `bulk-000000`; the original code accepted both and
+  advanced the checkpoint.
+- Finding: count-only job identity and unchecked `INSERT OR IGNORE` could report
+  a mixed or conflicting import as complete. This was a prototype defect, not a
+  BogKit defect.
+- Smallest improvement: persist a source fingerprint and compare complete
+  duplicate content before advancing a checkpoint. Both regressions now pass.
+
+## Decision audit
+
+| Option | Decision | Reason |
+|---|---|---|
+| Keep hand-written optional columns | Rejected | Repeats category conditionals and migrations |
+| Unvalidated JSON only | Rejected | Cannot provide reliable validation, filtering, or safe patch semantics |
+| Fold as the authority | Rejected, no-fit | Does not preserve the existing SQLite file |
+| SQLite authority plus Fold sidecar views | Rejected for this slice | Dual-store recovery is unproven and unnecessary for the tested exact/range filters; sidecar storage was not measured |
+| ESE or ANNy | Rejected, no-fit | Search/recommendations are non-goals |
+| SQLite products + schema registry + compact facets | Chosen | Meets the compact boundary in one crash-consistent file with measured headroom |
+
+## Unresolved uncertainty
+
+- The real service's exact HTTP response and error shapes were not present. The
+  route-level smoke test covers POST/GET only; other operations are exercised
+  directly or in the demo.
+- The burst ran on the trial host, not under a 512 MiB cgroup or VM; peak resident memory was not measured.
+- Records use deterministic 2 KiB descriptions, the low end of 2–20 KiB. Larger mixed-size payload behavior was not measured.
+- The compact boundary uses three categories, not all 30; schema rules are
+  handwritten rather than runtime-defined.
+- The “interruption” is an orderly connection close at a committed checkpoint,
+  not a forced process exit or power loss during an SQLite commit. SQLite WAL
+  durability itself was not fault-injected.
+- One global mutex serializes database access. Same-version races and
+  multi-process concurrency were not tested.
+- Only scalar nested specification fields are indexed. Arrays or deeper objects would need a declared canonical facet policy.
+- The direct SQLite wrapper is intentionally prototype-sized; production should use a maintained binding and operational migration tooling.
+
+## Files for coordinator review
+
+- `README.md` — reproduction, component decision, API examples, and honest scope.
+- `EVIDENCE.md` — this trial record.
+- `src/main.rs` — catalog, routes, generator, evaluator, import, measurements, and tests.
+- `src/sqlite.rs` — narrow system-SQLite wrapper; highest implementation-risk file.
+- `Cargo.toml` — nested-workspace dependencies; no BogKit component dependency.
+
+No BogKit core or public example files were modified.
diff --git a/developer-simulation/runs/2026-07-31--parts-catalog-evolution/README.md b/developer-simulation/runs/2026-07-31--parts-catalog-evolution/README.md
new file mode 100644
index 0000000..d86e8c2
--- /dev/null
+++ b/developer-simulation/runs/2026-07-31--parts-catalog-evolution/README.md
@@ -0,0 +1,87 @@
+# Wholesale catalog trial B
+
+This is a standalone Rust prototype for a three-category wholesale catalog. It keeps the existing SQLite file as the source of truth and adds:
+
+- Axum create, read, update, delete, and filter routes;
+- three hardcoded category validators with laptop revision activation;
+- stable nested validation errors such as `specs.battery_wh`;
+- version-checked partial updates that preserve omitted fields;
+- exact and numeric-range indexes checked against a separate in-memory evaluator;
+- explicit laptop schema migration from revision 1 to revision 2; and
+- checkpointed imports that bind each job to a source fingerprint, verify
+  duplicate content, and resume after an orderly database reopen.
+
+## Component decision
+
+Fold, ESE, and ANNy are deliberately not used in the runtime path. Fold's
+durable incremental views use a separate Fjall store. That is useful for
+derived views, but this brief requires preserving SQLite as the authority. A
+sidecar's synchronization and storage cost were not measured. ESE and ANNy
+solve embedding and nearest-neighbor search, which are non-goals here. No
+BogKit dependency is included.
+
+## Exact reproduction
+
+Run from this directory:
+
+```console
+cargo fmt --check
+CARGO_NET_OFFLINE=true cargo test
+CARGO_NET_OFFLINE=true cargo clippy --all-targets -- -D warnings
+CARGO_NET_OFFLINE=true cargo run --release -- demo
+CARGO_NET_OFFLINE=true cargo run --release -- import-check 250000 2048
+CARGO_NET_OFFLINE=true cargo run --release -- burst 250000
+CARGO_NET_OFFLINE=true cargo run --release -- storage-check 250000 2048
+```
+
+The first build uses dependencies already available with BogKit and requires a
+linkable system `sqlite3` library. Generated databases stay under
+`target/trial-data`.
+
+## Run the HTTP API
+
+```console
+CARGO_NET_OFFLINE=true cargo run --release -- serve target/trial-data/server.sqlite
+```
+
+In another terminal:
+
+```console
+curl -sS http://127.0.0.1:3000/products \
+  -H 'content-type: application/json' \
+  -d '{"id":"c-1","category":"cable","name":"USB-C cable","price_cents":1299,"description":"2 KiB records are used by the scale checks","specs":{"length_m":2.0,"connector":"usb-c"},"compatibility":[{"system":"inventory","model":"v1"}],"tags":["wholesale"]}'
+
+curl -sS 'http://127.0.0.1:3000/products?exact_path=specs.connector&exact_value=usb-c'
+
+curl -sS -X PATCH http://127.0.0.1:3000/products/c-1 \
+  -H 'content-type: application/json' \
+  -d '{"expected_version":1,"specs":{"length_m":3.5}}'
+
+curl -sS -X DELETE 'http://127.0.0.1:3000/products/c-1?expected_version=2'
+```
+
+Responses retain the product fields used by this prototype. The route-level
+smoke test covers POST and GET. PATCH, filtering, stale-version rejection,
+validation, and DELETE behavior are implemented and exercised directly or by
+the demo, but are not claimed compatible with an unavailable real-service
+contract.
+
+## Compact boundary and honest limits
+
+The generator covers laptop, cable, and chair records, including common
+scalars, nested category specifications, one compatibility entry, tags, and a
+deterministic 2 KiB description. The validators are hardcoded in Rust; this is
+not general runtime-defined schema support. Laptop schemas have two revisions.
+The scale commands use all 250,000 records at the low end of the requested
+2–20 KiB range.
+
+The burst test sends 150 simultaneous in-process HTTP requests, with 120 reads
+and 30 writes, against the full population. One global mutex serializes SQLite
+access. The test does not emulate network latency, exercise a second process or
+same-version write race, or enforce a 512 MiB process limit. Across the author,
+reviewer, and post-fix runs, read p95 was 1.518–4.037 ms and write p95 was
+1.389–2.721 ms. The storage comparison uses a synthetic baseline SQLite
+database with the same 2 KiB product rows and ordinary category/price indexes,
+then compares it with the schema/facet-indexed database.
+
+See `EVIDENCE.md` for observed results, friction, the decision audit, and remaining uncertainty.
diff --git a/developer-simulation/runs/2026-07-31--parts-catalog-evolution/src/main.rs b/developer-simulation/runs/2026-07-31--parts-catalog-evolution/src/main.rs
new file mode 100644
index 0000000..7841489
--- /dev/null
+++ b/developer-simulation/runs/2026-07-31--parts-catalog-evolution/src/main.rs
@@ -0,0 +1,1517 @@
+mod sqlite;
+
+use std::path::{Path, PathBuf};
+use std::sync::{Arc, Mutex};
+use std::time::{Duration, Instant};
+
+use axum::extract::{Path as AxumPath, Query, State};
+use axum::http::StatusCode;
+use axum::routing::{get, post};
+use axum::{Json, Router};
+use serde::{Deserialize, Serialize};
+use serde_json::{Map, Value, json};
+use sqlite::{Connection, Step};
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+struct Compatibility {
+    system: String,
+    model: String,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+struct ProductInput {
+    id: String,
+    category: String,
+    name: String,
+    price_cents: i64,
+    #[serde(default)]
+    description: String,
+    specs: Value,
+    #[serde(default)]
+    compatibility: Vec<Compatibility>,
+    #[serde(default)]
+    tags: Vec<String>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+struct Product {
+    id: String,
+    version: i64,
+    category: String,
+    name: String,
+    price_cents: i64,
+    #[serde(default)]
+    description: String,
+    spec_version: i64,
+    specs: Value,
+    compatibility: Vec<Compatibility>,
+    tags: Vec<String>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, Default)]
+struct ProductPatch {
+    expected_version: i64,
+    name: Option<String>,
+    price_cents: Option<i64>,
+    description: Option<String>,
+    specs: Option<Value>,
+    compatibility: Option<Vec<Compatibility>>,
+    tags: Option<Vec<String>>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+struct ApiError {
+    error: String,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    path: Option<String>,
+}
+
+#[derive(Debug)]
+struct Failure {
+    status: StatusCode,
+    body: ApiError,
+}
+
+type Result<T> = std::result::Result<T, Failure>;
+
+impl Failure {
+    fn invalid(path: impl Into<String>, message: impl Into<String>) -> Self {
+        Self {
+            status: StatusCode::UNPROCESSABLE_ENTITY,
+            body: ApiError {
+                error: message.into(),
+                path: Some(path.into()),
+            },
+        }
+    }
+
+    fn not_found(id: &str) -> Self {
+        Self {
+            status: StatusCode::NOT_FOUND,
+            body: ApiError {
+                error: format!("product {id} not found"),
+                path: None,
+            },
+        }
+    }
+
+    fn conflict(expected: i64, actual: i64) -> Self {
+        Self {
+            status: StatusCode::CONFLICT,
+            body: ApiError {
+                error: format!("stale version: expected {expected}, current is {actual}"),
+                path: Some("expected_version".into()),
+            },
+        }
+    }
+
+    fn internal(error: impl std::fmt::Display) -> Self {
+        Self {
+            status: StatusCode::INTERNAL_SERVER_ERROR,
+            body: ApiError {
+                error: error.to_string(),
+                path: None,
+            },
+        }
+    }
+}
+
+impl From<sqlite::Error> for Failure {
+    fn from(value: sqlite::Error) -> Self {
+        Self::internal(value)
+    }
+}
+
+type HttpError = (StatusCode, Json<ApiError>);
+
+impl From<Failure> for HttpError {
+    fn from(value: Failure) -> Self {
+        (value.status, Json(value.body))
+    }
+}
+
+struct Catalog {
+    db: Connection,
+}
+
+impl Catalog {
+    fn open(path: &Path) -> Result<Self> {
+        let db = Connection::open(path)?;
+        db.execute_batch(
+            "PRAGMA journal_mode=WAL;
+             PRAGMA synchronous=NORMAL;
+             PRAGMA foreign_keys=ON;
+             PRAGMA busy_timeout=5000;
+             CREATE TABLE IF NOT EXISTS category_schemas (
+               category TEXT NOT NULL, revision INTEGER NOT NULL,
+               active INTEGER NOT NULL DEFAULT 0, schema_json TEXT NOT NULL,
+               PRIMARY KEY(category, revision)
+             );
+             CREATE UNIQUE INDEX IF NOT EXISTS one_active_schema
+               ON category_schemas(category) WHERE active=1;
+             CREATE TABLE IF NOT EXISTS products (
+               id TEXT PRIMARY KEY, version INTEGER NOT NULL,
+               category TEXT NOT NULL, name TEXT NOT NULL,
+               price_cents INTEGER NOT NULL, description TEXT NOT NULL DEFAULT '',
+               spec_version INTEGER NOT NULL, specs_json TEXT NOT NULL,
+               compatibility_json TEXT NOT NULL, tags_json TEXT NOT NULL
+             );
+             CREATE INDEX IF NOT EXISTS products_category ON products(category);
+             CREATE INDEX IF NOT EXISTS products_price ON products(price_cents);
+             CREATE TABLE IF NOT EXISTS product_facets (
+               product_id TEXT NOT NULL REFERENCES products(id) ON DELETE CASCADE,
+               path TEXT NOT NULL, text_value TEXT, num_value REAL,
+               PRIMARY KEY(product_id, path)
+             );
+             CREATE INDEX IF NOT EXISTS facets_text ON product_facets(path, text_value, product_id);
+             CREATE INDEX IF NOT EXISTS facets_num ON product_facets(path, num_value, product_id);
+             CREATE TABLE IF NOT EXISTS import_jobs (
+               job_id TEXT PRIMARY KEY, next_ordinal INTEGER NOT NULL,
+               total INTEGER NOT NULL, source_fingerprint TEXT NOT NULL,
+               completed INTEGER NOT NULL DEFAULT 0
+             );",
+        )?;
+        Ok(Self { db })
+    }
+
+    fn install_demo_schemas(&self, laptop_revision: i64) -> Result<()> {
+        for (category, revision, schema) in [
+            (
+                "laptop",
+                1,
+                r#"{"ram_gb":"integer 4..128","screen_inches":"number 10..20"}"#,
+            ),
+            (
+                "laptop",
+                2,
+                r#"{"ram_gb":"integer 4..128","screen_inches":"number 10..20","battery_wh":"integer 20..150"}"#,
+            ),
+            (
+                "cable",
+                1,
+                r#"{"length_m":"number 0..100","connector":"usb-c|hdmi|ethernet"}"#,
+            ),
+            (
+                "chair",
+                1,
+                r#"{"max_weight_kg":"integer 40..300","adjustable":"boolean"}"#,
+            ),
+        ] {
+            let mut statement = self.db.prepare(
+                "INSERT OR IGNORE INTO category_schemas(category,revision,active,schema_json)
+                 VALUES(?,?,0,?)",
+            )?;
+            statement.bind_text(1, category)?;
+            statement.bind_i64(2, revision)?;
+            statement.bind_text(3, schema)?;
+            statement.execute()?;
+        }
+        for category in ["laptop", "cable", "chair"] {
+            let revision = if category == "laptop" {
+                laptop_revision
+            } else {
+                1
+            };
+            self.activate_schema(category, revision)?;
+        }
+        Ok(())
+    }
+
+    fn activate_schema(&self, category: &str, revision: i64) -> Result<()> {
+        self.db.transaction(|| {
+            let mut off = self
+                .db
+                .prepare("UPDATE category_schemas SET active=0 WHERE category=?")?;
+            off.bind_text(1, category)?;
+            off.execute()?;
+            let mut on = self
+                .db
+                .prepare("UPDATE category_schemas SET active=1 WHERE category=? AND revision=?")?;
+            on.bind_text(1, category)?;
+            on.bind_i64(2, revision)?;
+            on.execute()?;
+            if self.db.changes() != 1 {
+                return Err(sqlite::Error(format!(
+                    "missing schema {category} revision {revision}"
+                )));
+            }
+            Ok(())
+        })?;
+        Ok(())
+    }
+
+    fn active_revision(&self, category: &str) -> Result<i64> {
+        let mut statement = self
+            .db
+            .prepare("SELECT revision FROM category_schemas WHERE category=? AND active=1")?;
+        statement.bind_text(1, category)?;
+        match statement.step()? {
+            Step::Row => Ok(statement.column_i64(0)),
+            Step::Done => Err(Failure::invalid("category", "unknown category")),
+        }
+    }
+
+    fn create(&self, input: ProductInput) -> Result<Product> {
+        let revision = self.active_revision(&input.category)?;
+        self.create_at_revision(input, revision)
+    }
+
+    fn create_at_revision(&self, input: ProductInput, revision: i64) -> Result<Product> {
+        validate_input(&input, revision)?;
+        let product = Product {
+            id: input.id,
+            version: 1,
+            category: input.category,
+            name: input.name,
+            price_cents: input.price_cents,
+            description: input.description,
+            spec_version: revision,
+            specs: input.specs,
+            compatibility: input.compatibility,
+            tags: input.tags,
+        };
+        self.db
+            .transaction(|| self.insert_raw(&product, false).map(|_| ()))?;
+        Ok(product)
+    }
+
+    fn insert_raw(&self, product: &Product, ignore_duplicate: bool) -> sqlite::Result<bool> {
+        let verb = if ignore_duplicate { "OR IGNORE " } else { "" };
+        let sql = format!(
+            "INSERT {verb}INTO products
+             (id,version,category,name,price_cents,description,spec_version,specs_json,compatibility_json,tags_json)
+             VALUES(?,?,?,?,?,?,?,?,?,?)"
+        );
+        let mut statement = self.db.prepare(&sql)?;
+        statement.bind_text(1, &product.id)?;
+        statement.bind_i64(2, product.version)?;
+        statement.bind_text(3, &product.category)?;
+        statement.bind_text(4, &product.name)?;
+        statement.bind_i64(5, product.price_cents)?;
+        statement.bind_text(6, &product.description)?;
+        statement.bind_i64(7, product.spec_version)?;
+        statement.bind_text(8, &serde_json::to_string(&product.specs).unwrap())?;
+        statement.bind_text(9, &serde_json::to_string(&product.compatibility).unwrap())?;
+        statement.bind_text(10, &serde_json::to_string(&product.tags).unwrap())?;
+        statement.execute()?;
+        let inserted = self.db.changes() == 1;
+        if !ignore_duplicate || inserted {
+            self.replace_facets(product)?;
+        }
+        Ok(inserted)
+    }
+
+    fn replace_facets(&self, product: &Product) -> sqlite::Result<()> {
+        let mut delete = self
+            .db
+            .prepare("DELETE FROM product_facets WHERE product_id=?")?;
+        delete.bind_text(1, &product.id)?;
+        delete.execute()?;
+        let object = product.specs.as_object().expect("validated specs object");
+        for (name, value) in object {
+            let path = format!("specs.{name}");
+            let mut insert = self.db.prepare(
+                "INSERT INTO product_facets(product_id,path,text_value,num_value)
+                 VALUES(?,?,?,?)",
+            )?;
+            insert.bind_text(1, &product.id)?;
+            insert.bind_text(2, &path)?;
+            match value {
+                Value::String(text) => {
+                    insert.bind_text(3, text)?;
+                    insert.bind_null(4)?;
+                }
+                Value::Number(number) => {
+                    insert.bind_null(3)?;
+                    insert.bind_f64(4, number.as_f64().unwrap())?;
+                }
+                Value::Bool(value) => {
+                    insert.bind_text(3, if *value { "true" } else { "false" })?;
+                    insert.bind_null(4)?;
+                }
+                _ => continue,
+            }
+            insert.execute()?;
+        }
+        Ok(())
+    }
+
+    fn get(&self, id: &str) -> Result<Product> {
+        self.get_raw(id)?.ok_or_else(|| Failure::not_found(id))
+    }
+
+    fn get_raw(&self, id: &str) -> sqlite::Result<Option<Product>> {
+        let mut statement = self.db.prepare(
+            "SELECT id,version,category,name,price_cents,description,spec_version,
+                    specs_json,compatibility_json,tags_json FROM products WHERE id=?",
+        )?;
+        statement.bind_text(1, id)?;
+        match statement.step()? {
+            Step::Row => row_product(&statement).map(Some).map_err(sqlite::Error),
+            Step::Done => Ok(None),
+        }
+    }
+
+    fn patch(&self, id: &str, patch: ProductPatch) -> Result<Product> {
+        self.db
+            .transaction(|| {
+                let mut product = self.get(id).map_err(|e| sqlite::Error(e.body.error))?;
+                if product.version != patch.expected_version {
+                    return Err(sqlite::Error(format!(
+                        "STALE:{}:{}",
+                        patch.expected_version, product.version
+                    )));
+                }
+                if let Some(name) = patch.name {
+                    product.name = name;
+                }
+                if let Some(price) = patch.price_cents {
+                    product.price_cents = price;
+                }
+                if let Some(description) = patch.description {
+                    product.description = description;
+                }
+                if let Some(spec_patch) = patch.specs {
+                    merge_specs(&mut product.specs, spec_patch).map_err(|e| {
+                        sqlite::Error(format!(
+                            "INVALID:{}:{}",
+                            e.body.path.unwrap_or_default(),
+                            e.body.error
+                        ))
+                    })?;
+                }
+                if let Some(compatibility) = patch.compatibility {
+                    product.compatibility = compatibility;
+                }
+                if let Some(tags) = patch.tags {
+                    product.tags = tags;
+                }
+                validate_product(&product).map_err(|e| {
+                    sqlite::Error(format!(
+                        "INVALID:{}:{}",
+                        e.body.path.unwrap_or_default(),
+                        e.body.error
+                    ))
+                })?;
+                product.version += 1;
+                let mut update = self.db.prepare(
+                    "UPDATE products SET version=?,name=?,price_cents=?,description=?,specs_json=?,
+                 compatibility_json=?,tags_json=? WHERE id=? AND version=?",
+                )?;
+                update.bind_i64(1, product.version)?;
+                update.bind_text(2, &product.name)?;
+                update.bind_i64(3, product.price_cents)?;
+                update.bind_text(4, &product.description)?;
+                update.bind_text(5, &serde_json::to_string(&product.specs).unwrap())?;
+                update.bind_text(6, &serde_json::to_string(&product.compatibility).unwrap())?;
+                update.bind_text(7, &serde_json::to_string(&product.tags).unwrap())?;
+                update.bind_text(8, id)?;
+                update.bind_i64(9, patch.expected_version)?;
+                update.execute()?;
+                if self.db.changes() != 1 {
+                    return Err(sqlite::Error("concurrent update lost race".into()));
+                }
+                self.replace_facets(&product)?;
+                Ok(product)
+            })
+            .map_err(|error| decode_transaction_error(error, id))
+    }
+
+    fn delete(&self, id: &str, expected_version: i64) -> Result<Product> {
+        let product = self.get(id)?;
+        if product.version != expected_version {
+            return Err(Failure::conflict(expected_version, product.version));
+        }
+        let mut statement = self
+            .db
+            .prepare("DELETE FROM products WHERE id=? AND version=?")?;
+        statement.bind_text(1, id)?;
+        statement.bind_i64(2, expected_version)?;
+        statement.execute()?;
+        if self.db.changes() != 1 {
+            return Err(Failure::conflict(expected_version, self.get(id)?.version));
+        }
+        Ok(product)
+    }
+
+    fn migrate_laptop_v1_to_v2(&self, id: &str, default_battery_wh: i64) -> Result<Product> {
+        let mut product = self.get(id)?;
+        if product.category != "laptop" || product.spec_version != 1 {
+            return Err(Failure::invalid(
+                "spec_version",
+                "expected laptop revision 1",
+            ));
+        }
+        product
+            .specs
+            .as_object_mut()
+            .unwrap()
+            .insert("battery_wh".into(), json!(default_battery_wh));
+        product.spec_version = 2;
+        validate_product(&product)?;
+        let old_version = product.version;
+        product.version += 1;
+        self.db.transaction(|| {
+            let mut update = self.db.prepare(
+                "UPDATE products SET version=?,spec_version=2,specs_json=? WHERE id=? AND version=?",
+            )?;
+            update.bind_i64(1, product.version)?;
+            update.bind_text(2, &serde_json::to_string(&product.specs).unwrap())?;
+            update.bind_text(3, id)?;
+            update.bind_i64(4, old_version)?;
+            update.execute()?;
+            if self.db.changes() != 1 {
+                return Err(sqlite::Error("migration version race".into()));
+            }
+            self.replace_facets(&product)
+        })?;
+        Ok(product)
+    }
+
+    fn filter(&self, query: &FilterQuery) -> Result<Vec<Product>> {
+        let mut sql = String::from(
+            "SELECT id,version,category,name,price_cents,description,spec_version,
+             specs_json,compatibility_json,tags_json FROM products p WHERE 1=1",
+        );
+        if query.category.is_some() {
+            sql.push_str(" AND p.category=?");
+        }
+        if query.exact_path.is_some() {
+            sql.push_str(
+                " AND EXISTS (SELECT 1 FROM product_facets f WHERE f.product_id=p.id
+                   AND f.path=? AND (f.text_value=? OR f.num_value=?))",
+            );
+        }
+        if query.range_path.is_some() {
+            sql.push_str(
+                " AND EXISTS (SELECT 1 FROM product_facets r WHERE r.product_id=p.id
+                   AND r.path=? AND (? IS NULL OR r.num_value>=?)
+                   AND (? IS NULL OR r.num_value<=?))",
+            );
+        }
+        sql.push_str(" ORDER BY p.id");
+        let mut statement = self.db.prepare(&sql)?;
+        let mut index = 1;
+        if let Some(category) = &query.category {
+            statement.bind_text(index, category)?;
+            index += 1;
+        }
+        if let Some(path) = &query.exact_path {
+            let value = query.exact_value.as_deref().unwrap_or("");
+            statement.bind_text(index, path)?;
+            statement.bind_text(index + 1, value)?;
+            if let Ok(number) = value.parse::<f64>() {
+                statement.bind_f64(index + 2, number)?;
+            } else {
+                statement.bind_null(index + 2)?;
+            }
+            index += 3;
+        }
+        if let Some(path) = &query.range_path {
+            statement.bind_text(index, path)?;
+            bind_optional_f64(&mut statement, index + 1, query.min)?;
+            bind_optional_f64(&mut statement, index + 2, query.min)?;
+            bind_optional_f64(&mut statement, index + 3, query.max)?;
+            bind_optional_f64(&mut statement, index + 4, query.max)?;
+        }
+        let mut products = Vec::new();
+        while matches!(statement.step()?, Step::Row) {
+            products.push(row_product(&statement).map_err(Failure::internal)?);
+        }
+        Ok(products)
+    }
+
+    fn all(&self) -> Result<Vec<Product>> {
+        self.filter(&FilterQuery::default())
+    }
+
+    fn resume_import(
+        &self,
+        job_id: &str,
+        total: usize,
+        batch_size: usize,
+        stop_after_batches: Option<usize>,
+        payload_bytes: usize,
+    ) -> Result<ImportProgress> {
+        let source_fingerprint = format!("catalog-seed:v1:payload-bytes={payload_bytes}");
+        let mut progress = self.import_progress(job_id)?.unwrap_or(ImportProgress {
+            next_ordinal: 0,
+            total,
+            source_fingerprint: source_fingerprint.clone(),
+            completed: false,
+        });
+        if progress.total != total {
+            return Err(Failure::invalid("total", "import total changed on resume"));
+        }
+        if progress.source_fingerprint != source_fingerprint {
+            return Err(Failure::invalid(
+                "source_fingerprint",
+                "import source changed on resume",
+            ));
+        }
+        let mut batches = 0;
+        while progress.next_ordinal < total {
+            let end = (progress.next_ordinal + batch_size).min(total);
+            self.db.transaction(|| {
+                for ordinal in progress.next_ordinal..end {
+                    let product = generated_product(ordinal, payload_bytes);
+                    if !self.insert_raw(&product, true)?
+                        && self.get_raw(&product.id)?.as_ref() != Some(&product)
+                    {
+                        return Err(sqlite::Error(format!(
+                            "import product {} conflicts with existing content",
+                            product.id
+                        )));
+                    }
+                }
+                let mut checkpoint = self.db.prepare(
+                    "INSERT INTO import_jobs
+                     (job_id,next_ordinal,total,source_fingerprint,completed) VALUES(?,?,?,?,?)
+                     ON CONFLICT(job_id) DO UPDATE SET next_ordinal=excluded.next_ordinal,
+                     total=excluded.total,source_fingerprint=excluded.source_fingerprint,
+                     completed=excluded.completed",
+                )?;
+                checkpoint.bind_text(1, job_id)?;
+                checkpoint.bind_i64(2, end as i64)?;
+                checkpoint.bind_i64(3, total as i64)?;
+                checkpoint.bind_text(4, &source_fingerprint)?;
+                checkpoint.bind_i64(5, i64::from(end == total))?;
+                checkpoint.execute()
+            })?;
+            progress.next_ordinal = end;
+            progress.completed = end == total;
+            batches += 1;
+            if stop_after_batches == Some(batches) {
+                break;
+            }
+        }
+        Ok(progress)
+    }
+
+    fn import_progress(&self, job_id: &str) -> Result<Option<ImportProgress>> {
+        let mut statement = self.db.prepare(
+            "SELECT next_ordinal,total,source_fingerprint,completed
+                 FROM import_jobs WHERE job_id=?",
+        )?;
+        statement.bind_text(1, job_id)?;
+        match statement.step()? {
+            Step::Row => Ok(Some(ImportProgress {
+                next_ordinal: statement.column_i64(0) as usize,
+                total: statement.column_i64(1) as usize,
+                source_fingerprint: statement.column_text(2),
+                completed: statement.column_i64(3) != 0,
+            })),
+            Step::Done => Ok(None),
+        }
+    }
+
+    fn count_products(&self) -> Result<(usize, usize)> {
+        let mut statement = self
+            .db
+            .prepare("SELECT COUNT(*),COUNT(DISTINCT id) FROM products")?;
+        statement.step()?;
+        Ok((
+            statement.column_i64(0) as usize,
+            statement.column_i64(1) as usize,
+        ))
+    }
+
+    fn checkpoint(&self) -> Result<()> {
+        self.db.execute_batch("PRAGMA wal_checkpoint(TRUNCATE)")?;
+        Ok(())
+    }
+}
+
+fn decode_transaction_error(error: sqlite::Error, id: &str) -> Failure {
+    if let Some(rest) = error.0.strip_prefix("STALE:") {
+        let mut numbers = rest.split(':').filter_map(|n| n.parse().ok());
+        return Failure::conflict(numbers.next().unwrap_or(0), numbers.next().unwrap_or(0));
+    }
+    if let Some(rest) = error.0.strip_prefix("INVALID:") {
+        let (path, message) = rest.split_once(':').unwrap_or(("specs", rest));
+        return Failure::invalid(path, message);
+    }
+    if error.0.contains("not found") {
+        return Failure::not_found(id);
+    }
+    Failure::from(error)
+}
+
+fn bind_optional_f64(
+    statement: &mut sqlite::Statement,
+    index: i32,
+    value: Option<f64>,
+) -> sqlite::Result<()> {
+    match value {
+        Some(value) => statement.bind_f64(index, value),
+        None => statement.bind_null(index),
+    }
+}
+
+fn row_product(statement: &sqlite::Statement) -> std::result::Result<Product, String> {
+    Ok(Product {
+        id: statement.column_text(0),
+        version: statement.column_i64(1),
+        category: statement.column_text(2),
+        name: statement.column_text(3),
+        price_cents: statement.column_i64(4),
+        description: statement.column_text(5),
+        spec_version: statement.column_i64(6),
+        specs: serde_json::from_str(&statement.column_text(7)).map_err(|e| e.to_string())?,
+        compatibility: serde_json::from_str(&statement.column_text(8))
+            .map_err(|e| e.to_string())?,
+        tags: serde_json::from_str(&statement.column_text(9)).map_err(|e| e.to_string())?,
+    })
+}
+
+fn validate_input(input: &ProductInput, revision: i64) -> Result<()> {
+    if input.id.trim().is_empty() {
+        return Err(Failure::invalid("id", "must not be empty"));
+    }
+    let product = Product {
+        id: input.id.clone(),
+        version: 1,
+        category: input.category.clone(),
+        name: input.name.clone(),
+        price_cents: input.price_cents,
+        description: input.description.clone(),
+        spec_version: revision,
+        specs: input.specs.clone(),
+        compatibility: input.compatibility.clone(),
+        tags: input.tags.clone(),
+    };
+    validate_product(&product)
+}
+
+fn validate_product(product: &Product) -> Result<()> {
+    if product.name.trim().is_empty() {
+        return Err(Failure::invalid("name", "must not be empty"));
+    }
+    if product.price_cents < 0 {
+        return Err(Failure::invalid("price_cents", "must be non-negative"));
+    }
+    if product.tags.len() > 32 {
+        return Err(Failure::invalid("tags", "must contain at most 32 tags"));
+    }
+    for (index, entry) in product.compatibility.iter().enumerate() {
+        if entry.system.trim().is_empty() || entry.model.trim().is_empty() {
+            return Err(Failure::invalid(
+                format!("compatibility[{index}]"),
+                "system and model must not be empty",
+            ));
+        }
+    }
+    let specs = product
+        .specs
+        .as_object()
+        .ok_or_else(|| Failure::invalid("specs", "must be an object"))?;
+    match (product.category.as_str(), product.spec_version) {
+        ("laptop", 1) => {
+            integer_in(specs, "ram_gb", 4, 128)?;
+            number_in(specs, "screen_inches", 10.0, 20.0)?;
+            reject_unknown(specs, &["ram_gb", "screen_inches"])?;
+        }
+        ("laptop", 2) => {
+            integer_in(specs, "ram_gb", 4, 128)?;
+            number_in(specs, "screen_inches", 10.0, 20.0)?;
+            integer_in(specs, "battery_wh", 20, 150)?;
+            reject_unknown(specs, &["ram_gb", "screen_inches", "battery_wh"])?;
+        }
+        ("cable", 1) => {
+            number_in(specs, "length_m", 0.01, 100.0)?;
+            let connector = specs
+                .get("connector")
+                .and_then(Value::as_str)
+                .ok_or_else(|| Failure::invalid("specs.connector", "must be a string"))?;
+            if !["usb-c", "hdmi", "ethernet"].contains(&connector) {
+                return Err(Failure::invalid("specs.connector", "unsupported connector"));
+            }
+            reject_unknown(specs, &["length_m", "connector"])?;
+        }
+        ("chair", 1) => {
+            integer_in(specs, "max_weight_kg", 40, 300)?;
+            if !specs.get("adjustable").is_some_and(Value::is_boolean) {
+                return Err(Failure::invalid("specs.adjustable", "must be a boolean"));
+            }
+            reject_unknown(specs, &["max_weight_kg", "adjustable"])?;
+        }
+        _ => {
+            return Err(Failure::invalid(
+                "spec_version",
+                "unsupported schema revision",
+            ));
+        }
+    }
+    Ok(())
+}
+
+fn integer_in(specs: &Map<String, Value>, key: &str, min: i64, max: i64) -> Result<()> {
+    let value = specs
+        .get(key)
+        .and_then(Value::as_i64)
+        .ok_or_else(|| Failure::invalid(format!("specs.{key}"), "must be an integer"))?;
+    if !(min..=max).contains(&value) {
+        return Err(Failure::invalid(
+            format!("specs.{key}"),
+            format!("must be between {min} and {max}"),
+        ));
+    }
+    Ok(())
+}
+
+fn number_in(specs: &Map<String, Value>, key: &str, min: f64, max: f64) -> Result<()> {
+    let value = specs
+        .get(key)
+        .and_then(Value::as_f64)
+        .ok_or_else(|| Failure::invalid(format!("specs.{key}"), "must be a number"))?;
+    if !(min..=max).contains(&value) {
+        return Err(Failure::invalid(
+            format!("specs.{key}"),
+            format!("must be between {min} and {max}"),
+        ));
+    }
+    Ok(())
+}
+
+fn reject_unknown(specs: &Map<String, Value>, allowed: &[&str]) -> Result<()> {
+    if let Some(key) = specs.keys().find(|key| !allowed.contains(&key.as_str())) {
+        return Err(Failure::invalid(
+            format!("specs.{key}"),
+            "field is not in this schema revision",
+        ));
+    }
+    Ok(())
+}
+
+fn merge_specs(target: &mut Value, patch: Value) -> Result<()> {
+    let patch = patch
+        .as_object()
+        .ok_or_else(|| Failure::invalid("specs", "patch must be an object"))?;
+    let target = target.as_object_mut().expect("stored specs are validated");
+    for (key, value) in patch {
+        target.insert(key.clone(), value.clone());
+    }
+    Ok(())
+}
+
+#[derive(Debug, Clone, Deserialize, Default)]
+struct FilterQuery {
+    category: Option<String>,
+    exact_path: Option<String>,
+    exact_value: Option<String>,
+    range_path: Option<String>,
+    min: Option<f64>,
+    max: Option<f64>,
+}
+
+#[derive(Debug, Clone, Deserialize)]
+struct DeleteQuery {
+    expected_version: i64,
+}
+
+#[derive(Debug, Clone)]
+struct ImportProgress {
+    next_ordinal: usize,
+    total: usize,
+    source_fingerprint: String,
+    completed: bool,
+}
+
+type Shared = Arc<Mutex<Catalog>>;
+
+fn app(catalog: Catalog) -> Router {
+    Router::new()
+        .route("/products", post(http_create).get(http_filter))
+        .route(
+            "/products/{id}",
+            get(http_get).patch(http_patch).delete(http_delete),
+        )
+        .with_state(Arc::new(Mutex::new(catalog)))
+}
+
+async fn http_create(
+    State(state): State<Shared>,
+    Json(input): Json<ProductInput>,
+) -> std::result::Result<(StatusCode, Json<Product>), HttpError> {
+    let product = state
+        .lock()
+        .unwrap()
+        .create(input)
+        .map_err(HttpError::from)?;
+    Ok((StatusCode::CREATED, Json(product)))
+}
+
+async fn http_get(
+    State(state): State<Shared>,
+    AxumPath(id): AxumPath<String>,
+) -> std::result::Result<Json<Product>, HttpError> {
+    state
+        .lock()
+        .unwrap()
+        .get(&id)
+        .map(Json)
+        .map_err(HttpError::from)
+}
+
+async fn http_patch(
+    State(state): State<Shared>,
+    AxumPath(id): AxumPath<String>,
+    Json(patch): Json<ProductPatch>,
+) -> std::result::Result<Json<Product>, HttpError> {
+    state
+        .lock()
+        .unwrap()
+        .patch(&id, patch)
+        .map(Json)
+        .map_err(HttpError::from)
+}
+
+async fn http_delete(
+    State(state): State<Shared>,
+    AxumPath(id): AxumPath<String>,
+    Query(query): Query<DeleteQuery>,
+) -> std::result::Result<Json<Product>, HttpError> {
+    state
+        .lock()
+        .unwrap()
+        .delete(&id, query.expected_version)
+        .map(Json)
+        .map_err(HttpError::from)
+}
+
+async fn http_filter(
+    State(state): State<Shared>,
+    Query(query): Query<FilterQuery>,
+) -> std::result::Result<Json<Vec<Product>>, HttpError> {
+    state
+        .lock()
+        .unwrap()
+        .filter(&query)
+        .map(Json)
+        .map_err(HttpError::from)
+}
+
+fn generated_product(ordinal: usize, payload_bytes: usize) -> Product {
+    let category = match ordinal % 3 {
+        0 => "laptop",
+        1 => "cable",
+        _ => "chair",
+    };
+    let ram_gb = [8, 16, 32, 64][(ordinal / 3) % 4];
+    let connector = ["usb-c", "hdmi", "ethernet"][(ordinal / 3) % 3];
+    let specs = match category {
+        "laptop" => json!({
+            "ram_gb": ram_gb,
+            "screen_inches": 13.0 + (ordinal % 4) as f64,
+            "battery_wh": 40 + (ordinal % 80) as i64
+        }),
+        "cable" => json!({
+            "length_m": 0.5 + (ordinal % 20) as f64 * 0.5,
+            "connector": connector
+        }),
+        _ => json!({
+            "max_weight_kg": 80 + (ordinal % 140) as i64,
+            "adjustable": ordinal.is_multiple_of(2)
+        }),
+    };
+    Product {
+        id: format!("bulk-{ordinal:06}"),
+        version: 1,
+        category: category.into(),
+        name: format!("Seed product {ordinal}"),
+        price_cents: 1_000 + (ordinal % 100_000) as i64,
+        description: seeded_text(ordinal as u64, payload_bytes),
+        spec_version: if category == "laptop" { 2 } else { 1 },
+        specs,
+        compatibility: vec![Compatibility {
+            system: "catalog".into(),
+            model: format!("m-{}", ordinal % 50),
+        }],
+        tags: vec![format!("tag-{}", ordinal % 20)],
+    }
+}
+
+fn seeded_text(mut state: u64, bytes: usize) -> String {
+    let mut output = String::with_capacity(bytes);
+    const ALPHABET: &[u8] = b"abcdefghijklmnopqrstuvwxyz0123456789";
+    while output.len() < bytes {
+        state ^= state << 13;
+        state ^= state >> 7;
+        state ^= state << 17;
+        output.push(ALPHABET[(state as usize) % ALPHABET.len()] as char);
+    }
+    output
+}
+
+fn reference_filter(products: &[Product], query: &FilterQuery) -> Vec<String> {
+    let mut ids = products
+        .iter()
+        .filter(|product| {
+            query
+                .category
+                .as_ref()
+                .is_none_or(|category| product.category == *category)
+        })
+        .filter(|product| {
+            query.exact_path.as_ref().is_none_or(|path| {
+                let value = query.exact_value.as_deref().unwrap_or("");
+                json_path(&product.specs, path).is_some_and(|candidate| match candidate {
+                    Value::String(text) => text == value,
+                    Value::Number(number) => value
+                        .parse::<f64>()
+                        .ok()
+                        .is_some_and(|v| number.as_f64() == Some(v)),
+                    Value::Bool(flag) => value == flag.to_string(),
+                    _ => false,
+                })
+            })
+        })
+        .filter(|product| {
+            query.range_path.as_ref().is_none_or(|path| {
+                json_path(&product.specs, path)
+                    .and_then(Value::as_f64)
+                    .is_some_and(|value| {
+                        query.min.is_none_or(|min| value >= min)
+                            && query.max.is_none_or(|max| value <= max)
+                    })
+            })
+        })
+        .map(|product| product.id.clone())
+        .collect::<Vec<_>>();
+    ids.sort();
+    ids
+}
+
+fn json_path<'a>(specs: &'a Value, path: &str) -> Option<&'a Value> {
+    let key = path.strip_prefix("specs.")?;
+    specs.get(key)
+}
+
+fn assert_reference(catalog: &Catalog, query: FilterQuery) -> Result<usize> {
+    let expected = reference_filter(&catalog.all()?, &query);
+    let actual = catalog
+        .filter(&query)?
+        .into_iter()
+        .map(|product| product.id)
+        .collect::<Vec<_>>();
+    if actual != expected {
+        return Err(Failure::internal(format!(
+            "filter mismatch: actual={actual:?}, expected={expected:?}"
+        )));
+    }
+    Ok(actual.len())
+}
+
+fn example_input(id: &str, category: &str) -> ProductInput {
+    let specs = match category {
+        "laptop" => json!({"ram_gb":16,"screen_inches":14.0,"battery_wh":70}),
+        "cable" => json!({"length_m":2.0,"connector":"usb-c"}),
+        _ => json!({"max_weight_kg":120,"adjustable":true}),
+    };
+    ProductInput {
+        id: id.into(),
+        category: category.into(),
+        name: format!("Example {category}"),
+        price_cents: 12_500,
+        description: "representative product".into(),
+        specs,
+        compatibility: vec![Compatibility {
+            system: "inventory".into(),
+            model: "v1".into(),
+        }],
+        tags: vec!["wholesale".into()],
+    }
+}
+
+fn fresh_path(name: &str) -> PathBuf {
+    let root = Path::new(env!("CARGO_MANIFEST_DIR")).join("target/trial-data");
+    std::fs::create_dir_all(&root).unwrap();
+    let path = root.join(name);
+    for suffix in ["", "-wal", "-shm"] {
+        let _ = std::fs::remove_file(format!("{}{}", path.display(), suffix));
+    }
+    path
+}
+
+fn run_demo() -> Result<()> {
+    let path = fresh_path("demo.sqlite");
+    {
+        let legacy = Connection::open(&path)?;
+        legacy.execute_batch("CREATE TABLE legacy_orders(id INTEGER PRIMARY KEY); INSERT INTO legacy_orders VALUES(7);")?;
+    }
+    let catalog = Catalog::open(&path)?;
+    catalog.install_demo_schemas(1)?;
+    let mut old = example_input("legacy-laptop", "laptop");
+    old.specs = json!({"ram_gb":16,"screen_inches":14.0});
+    catalog.create_at_revision(old, 1)?;
+    catalog.activate_schema("laptop", 2)?;
+    catalog.create(example_input("cable-1", "cable"))?;
+    catalog.create(example_input("chair-1", "chair"))?;
+    let before = catalog.get("legacy-laptop")?;
+    let migrated = catalog.migrate_laptop_v1_to_v2("legacy-laptop", 60)?;
+    let patched = catalog.patch(
+        "cable-1",
+        ProductPatch {
+            expected_version: 1,
+            specs: Some(json!({"length_m":3.5})),
+            ..ProductPatch::default()
+        },
+    )?;
+    let stale_rejected = catalog
+        .patch(
+            "cable-1",
+            ProductPatch {
+                expected_version: 1,
+                name: Some("stale".into()),
+                ..ProductPatch::default()
+            },
+        )
+        .is_err();
+    let exact = assert_reference(
+        &catalog,
+        FilterQuery {
+            exact_path: Some("specs.connector".into()),
+            exact_value: Some("usb-c".into()),
+            ..FilterQuery::default()
+        },
+    )?;
+    let range = assert_reference(
+        &catalog,
+        FilterQuery {
+            range_path: Some("specs.length_m".into()),
+            min: Some(3.0),
+            max: Some(4.0),
+            ..FilterQuery::default()
+        },
+    )?;
+    println!("demo database: {}", path.display());
+    println!("legacy SQLite table preserved: yes");
+    println!(
+        "v1 readable after v2 activation: spec_version={}",
+        before.spec_version
+    );
+    println!(
+        "tested migration: spec_version={}, version={}",
+        migrated.spec_version, migrated.version
+    );
+    println!(
+        "partial patch preserved connector={}, new version={}",
+        patched.specs["connector"], patched.version
+    );
+    println!("stale conditional patch rejected: {stale_rejected}");
+    println!("independent filter evaluator: exact={exact}, range={range}, all matched");
+    println!("Fold decision: no-fit for authoritative catalog path; SQLite retained");
+    Ok(())
+}
+
+fn run_import_check(total: usize, payload_bytes: usize) -> Result<()> {
+    let path = fresh_path(&format!("import-{total}-{payload_bytes}.sqlite"));
+    let start = Instant::now();
+    {
+        let catalog = Catalog::open(&path)?;
+        catalog.install_demo_schemas(2)?;
+        let interrupted = catalog.resume_import("seed-v1", total, 1_000, Some(7), payload_bytes)?;
+        println!(
+            "simulated interruption checkpoint: {}/{}",
+            interrupted.next_ordinal, total
+        );
+    }
+    let catalog = Catalog::open(&path)?;
+    catalog.install_demo_schemas(2)?;
+    let resumed = catalog.resume_import("seed-v1", total, 1_000, None, payload_bytes)?;
+    let (count, distinct) = catalog.count_products()?;
+    catalog.checkpoint()?;
+    let bytes = std::fs::metadata(&path).map_err(Failure::internal)?.len();
+    println!("resume completed: {}", resumed.completed);
+    println!("rows: {count}; distinct ids: {distinct}; expected: {total}");
+    println!("record payload: {payload_bytes} bytes; database: {bytes} bytes");
+    println!("elapsed: {:.3}s", start.elapsed().as_secs_f64());
+    if count != total || distinct != total || !resumed.completed {
+        return Err(Failure::internal("import integrity check failed"));
+    }
+    Ok(())
+}
+
+fn run_storage_check(total: usize, payload_bytes: usize) -> Result<()> {
+    let indexed_path = fresh_path(&format!("storage-indexed-{total}-{payload_bytes}.sqlite"));
+    let baseline_path = fresh_path(&format!("storage-baseline-{total}-{payload_bytes}.sqlite"));
+    let catalog = Catalog::open(&indexed_path)?;
+    catalog.install_demo_schemas(2)?;
+    catalog.resume_import("storage", total, 1_000, None, payload_bytes)?;
+    catalog.checkpoint()?;
+
+    let baseline = Connection::open(&baseline_path)?;
+    baseline.execute_batch(
+        "CREATE TABLE products (
+           id TEXT PRIMARY KEY, version INTEGER NOT NULL, category TEXT NOT NULL,
+           name TEXT NOT NULL, price_cents INTEGER NOT NULL, description TEXT NOT NULL,
+           spec_version INTEGER NOT NULL, specs_json TEXT NOT NULL,
+           compatibility_json TEXT NOT NULL, tags_json TEXT NOT NULL
+         );
+         CREATE INDEX products_category ON products(category);
+         CREATE INDEX products_price ON products(price_cents);",
+    )?;
+    baseline.transaction(|| {
+        let mut insert = baseline.prepare(
+            "INSERT INTO products
+             (id,version,category,name,price_cents,description,spec_version,specs_json,compatibility_json,tags_json)
+             VALUES(?,?,?,?,?,?,?,?,?,?)",
+        )?;
+        for ordinal in 0..total {
+            let product = generated_product(ordinal, payload_bytes);
+            insert.bind_text(1, &product.id)?;
+            insert.bind_i64(2, product.version)?;
+            insert.bind_text(3, &product.category)?;
+            insert.bind_text(4, &product.name)?;
+            insert.bind_i64(5, product.price_cents)?;
+            insert.bind_text(6, &product.description)?;
+            insert.bind_i64(7, product.spec_version)?;
+            insert.bind_text(8, &serde_json::to_string(&product.specs).unwrap())?;
+            insert.bind_text(9, &serde_json::to_string(&product.compatibility).unwrap())?;
+            insert.bind_text(10, &serde_json::to_string(&product.tags).unwrap())?;
+            insert.execute()?;
+            insert.reset()?;
+        }
+        Ok(())
+    })?;
+    drop(baseline);
+    let indexed_bytes = std::fs::metadata(&indexed_path)
+        .map_err(Failure::internal)?
+        .len();
+    let baseline_bytes = std::fs::metadata(&baseline_path)
+        .map_err(Failure::internal)?
+        .len();
+    let ratio = indexed_bytes as f64 / baseline_bytes as f64;
+    println!("storage sample: {total} records at {payload_bytes} payload bytes");
+    println!("baseline SQLite: {baseline_bytes} bytes");
+    println!("indexed SQLite: {indexed_bytes} bytes");
+    println!("ratio: {ratio:.3}x; target: <1.5x");
+    if ratio >= 1.5 {
+        return Err(Failure::internal("storage ratio exceeded 1.5x"));
+    }
+    Ok(())
+}
+
+async fn run_burst(count: usize) -> Result<()> {
+    use axum::body::Body;
+    use axum::http::Request;
+    use tower::ServiceExt;
+
+    let path = fresh_path(&format!("burst-{count}.sqlite"));
+    let catalog = Catalog::open(&path)?;
+    catalog.install_demo_schemas(2)?;
+    catalog.resume_import("burst-seed", count, 1_000, None, 2_048)?;
+    let router = app(catalog);
+    let mut tasks = Vec::new();
+    for index in 0..150 {
+        let service = router.clone();
+        tasks.push(tokio::spawn(async move {
+            let start = Instant::now();
+            let request = if index < 120 {
+                Request::builder()
+                    .uri(format!("/products/bulk-{:06}", index % count))
+                    .body(Body::empty())
+                    .unwrap()
+            } else {
+                Request::builder()
+                    .method("PATCH")
+                    .header("content-type", "application/json")
+                    .uri(format!("/products/bulk-{:06}", index % count))
+                    .body(Body::from(format!(
+                        r#"{{"expected_version":1,"price_cents":{}}}"#,
+                        20_000 + index
+                    )))
+                    .unwrap()
+            };
+            let status = service.oneshot(request).await.unwrap().status();
+            (index < 120, status, start.elapsed())
+        }));
+    }
+    let mut reads = Vec::new();
+    let mut writes = Vec::new();
+    for task in tasks {
+        let (is_read, status, duration) = task.await.map_err(Failure::internal)?;
+        if !status.is_success() {
+            return Err(Failure::internal(format!("burst request failed: {status}")));
+        }
+        if is_read {
+            reads.push(duration);
+        } else {
+            writes.push(duration);
+        }
+    }
+    reads.sort();
+    writes.sort();
+    let read_p95 = percentile(&reads, 95);
+    let write_p95 = percentile(&writes, 95);
+    println!("simultaneous burst: 150 requests (120 reads / 30 writes)");
+    println!("seed: {count} representative 2 KiB records");
+    println!("read p95: {:.3} ms", read_p95.as_secs_f64() * 1_000.0);
+    println!("write p95: {:.3} ms", write_p95.as_secs_f64() * 1_000.0);
+    println!("targets: reads <50 ms; writes <100 ms");
+    Ok(())
+}
+
+fn percentile(values: &[Duration], percentile: usize) -> Duration {
+    values[((values.len() - 1) * percentile).div_ceil(100)]
+}
+
+async fn serve(path: PathBuf) -> Result<()> {
+    let catalog = Catalog::open(&path)?;
+    catalog.install_demo_schemas(2)?;
+    let listener = tokio::net::TcpListener::bind("127.0.0.1:3000")
+        .await
+        .map_err(Failure::internal)?;
+    println!("catalog API listening at http://127.0.0.1:3000");
+    axum::serve(listener, app(catalog))
+        .await
+        .map_err(Failure::internal)
+}
+
+#[tokio::main]
+async fn main() {
+    let args = std::env::args().skip(1).collect::<Vec<_>>();
+    let result = match args.first().map(String::as_str) {
+        None | Some("demo") => run_demo(),
+        Some("import-check") => {
+            let total = args.get(1).and_then(|v| v.parse().ok()).unwrap_or(25_000);
+            let bytes = args.get(2).and_then(|v| v.parse().ok()).unwrap_or(2_048);
+            run_import_check(total, bytes)
+        }
+        Some("burst") => {
+            let count = args.get(1).and_then(|v| v.parse().ok()).unwrap_or(25_000);
+            run_burst(count).await
+        }
+        Some("storage-check") => {
+            let total = args.get(1).and_then(|v| v.parse().ok()).unwrap_or(25_000);
+            let bytes = args.get(2).and_then(|v| v.parse().ok()).unwrap_or(2_048);
+            run_storage_check(total, bytes)
+        }
+        Some("serve") => {
+            let path = args
+                .get(1)
+                .map(PathBuf::from)
+                .unwrap_or_else(|| fresh_path("server.sqlite"));
+            serve(path).await
+        }
+        Some(command) => Err(Failure::invalid(
+            "command",
+            format!(
+                "unknown command {command}; use demo, import-check, storage-check, burst, or serve"
+            ),
+        )),
+    };
+    if let Err(error) = result {
+        eprintln!("{}", serde_json::to_string(&error.body).unwrap());
+        std::process::exit(1);
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use axum::body::Body;
+    use axum::http::Request;
+    use http_body_util::BodyExt;
+    use std::collections::BTreeSet;
+    use tower::ServiceExt;
+
+    fn catalog(name: &str) -> Catalog {
+        let catalog = Catalog::open(&fresh_path(name)).unwrap();
+        catalog.install_demo_schemas(2).unwrap();
+        catalog
+    }
+
+    #[test]
+    fn validation_has_stable_nested_path() {
+        let catalog = catalog("validation.sqlite");
+        let mut input = example_input("bad", "laptop");
+        input.specs["battery_wh"] = json!(5);
+        let error = catalog.create(input).unwrap_err();
+        assert_eq!(error.body.path.as_deref(), Some("specs.battery_wh"));
+    }
+
+    #[test]
+    fn partial_patch_preserves_omitted_fields_and_rejects_stale_version() {
+        let catalog = catalog("patch.sqlite");
+        let original = catalog.create(example_input("c-1", "cable")).unwrap();
+        let updated = catalog
+            .patch(
+                "c-1",
+                ProductPatch {
+                    expected_version: original.version,
+                    specs: Some(json!({"length_m":4.0})),
+                    ..ProductPatch::default()
+                },
+            )
+            .unwrap();
+        assert_eq!(updated.specs["connector"], "usb-c");
+        assert_eq!(updated.name, original.name);
+        let stale = catalog
+            .patch(
+                "c-1",
+                ProductPatch {
+                    expected_version: 1,
+                    name: Some("lost update".into()),
+                    ..ProductPatch::default()
+                },
+            )
+            .unwrap_err();
+        assert_eq!(stale.status, StatusCode::CONFLICT);
+    }
+
+    #[test]
+    fn old_revision_is_readable_and_migration_is_tested() {
+        let path = fresh_path("migration.sqlite");
+        let catalog = Catalog::open(&path).unwrap();
+        catalog.install_demo_schemas(1).unwrap();
+        let mut input = example_input("old", "laptop");
+        input.specs = json!({"ram_gb":16,"screen_inches":14.0});
+        catalog.create_at_revision(input, 1).unwrap();
+        catalog.activate_schema("laptop", 2).unwrap();
+        assert_eq!(catalog.get("old").unwrap().spec_version, 1);
+        let migrated = catalog.migrate_laptop_v1_to_v2("old", 55).unwrap();
+        assert_eq!(migrated.spec_version, 2);
+        assert_eq!(migrated.specs["battery_wh"], 55);
+    }
+
+    #[test]
+    fn exact_and_range_filters_match_independent_evaluator() {
+        let catalog = catalog("filters.sqlite");
+        catalog
+            .resume_import("filters", 300, 100, None, 128)
+            .unwrap();
+        for query in [
+            FilterQuery {
+                exact_path: Some("specs.connector".into()),
+                exact_value: Some("hdmi".into()),
+                ..FilterQuery::default()
+            },
+            FilterQuery {
+                category: Some("laptop".into()),
+                range_path: Some("specs.ram_gb".into()),
+                min: Some(16.0),
+                max: Some(32.0),
+                ..FilterQuery::default()
+            },
+            FilterQuery {
+                range_path: Some("specs.max_weight_kg".into()),
+                min: Some(100.0),
+                max: Some(180.0),
+                ..FilterQuery::default()
+            },
+        ] {
+            assert_reference(&catalog, query).unwrap();
+        }
+    }
+
+    #[test]
+    fn interrupted_import_resumes_without_gaps_or_duplicates() {
+        let path = fresh_path("resume.sqlite");
+        {
+            let catalog = Catalog::open(&path).unwrap();
+            catalog.install_demo_schemas(2).unwrap();
+            let progress = catalog
+                .resume_import("job", 2_503, 100, Some(4), 128)
+                .unwrap();
+            assert_eq!(progress.next_ordinal, 400);
+        }
+        let catalog = Catalog::open(&path).unwrap();
+        catalog.install_demo_schemas(2).unwrap();
+        assert!(
+            catalog
+                .resume_import("job", 2_503, 100, None, 128)
+                .unwrap()
+                .completed
+        );
+        assert_eq!(catalog.count_products().unwrap(), (2_503, 2_503));
+        let ids = catalog
+            .all()
+            .unwrap()
+            .into_iter()
+            .map(|p| p.id)
+            .collect::<BTreeSet<_>>();
+        assert!((0..2_503).all(|i| ids.contains(&format!("bulk-{i:06}"))));
+    }
+
+    #[test]
+    fn import_resume_rejects_changed_source() {
+        let path = fresh_path("resume-source-mismatch.sqlite");
+        {
+            let catalog = Catalog::open(&path).unwrap();
+            catalog.install_demo_schemas(2).unwrap();
+            catalog.resume_import("job", 250, 100, Some(1), 8).unwrap();
+        }
+        let catalog = Catalog::open(&path).unwrap();
+        catalog.install_demo_schemas(2).unwrap();
+        let error = catalog
+            .resume_import("job", 250, 100, None, 64)
+            .unwrap_err();
+        assert_eq!(error.body.path.as_deref(), Some("source_fingerprint"));
+        assert_eq!(catalog.count_products().unwrap(), (100, 100));
+    }
+
+    #[test]
+    fn import_rejects_conflicting_preexisting_product() {
+        let catalog = catalog("resume-conflict.sqlite");
+        catalog
+            .create(example_input("bulk-000000", "laptop"))
+            .unwrap();
+
+        let error = catalog.resume_import("job", 10, 10, None, 64).unwrap_err();
+        assert!(error.body.error.contains("conflicts with existing content"));
+        assert!(catalog.import_progress("job").unwrap().is_none());
+        assert_eq!(catalog.count_products().unwrap(), (1, 1));
+        assert_eq!(catalog.get("bulk-000000").unwrap().name, "Example laptop");
+    }
+
+    #[tokio::test]
+    async fn http_crud_keeps_product_response_shape() {
+        let router = app(catalog("http.sqlite"));
+        let input = example_input("api-1", "chair");
+        let create = router
+            .clone()
+            .oneshot(
+                Request::builder()
+                    .method("POST")
+                    .uri("/products")
+                    .header("content-type", "application/json")
+                    .body(Body::from(serde_json::to_vec(&input).unwrap()))
+                    .unwrap(),
+            )
+            .await
+            .unwrap();
+        assert_eq!(create.status(), StatusCode::CREATED);
+        let created: Product =
+            serde_json::from_slice(&create.into_body().collect().await.unwrap().to_bytes())
+                .unwrap();
+        let get = router
+            .oneshot(
+                Request::builder()
+                    .uri("/products/api-1")
+                    .body(Body::empty())
+                    .unwrap(),
+            )
+            .await
+            .unwrap();
+        let fetched: Product =
+            serde_json::from_slice(&get.into_body().collect().await.unwrap().to_bytes()).unwrap();
+        assert_eq!(fetched, created);
+    }
+
+    #[test]
+    fn opening_catalog_preserves_unrelated_legacy_table() {
+        let path = fresh_path("legacy.sqlite");
+        let legacy = Connection::open(&path).unwrap();
+        legacy
+            .execute_batch(
+                "CREATE TABLE orders(id INTEGER PRIMARY KEY); INSERT INTO orders VALUES(9);",
+            )
+            .unwrap();
+        drop(legacy);
+        let catalog = Catalog::open(&path).unwrap();
+        let mut statement = catalog.db.prepare("SELECT id FROM orders").unwrap();
+        assert!(matches!(statement.step().unwrap(), Step::Row));
+        assert_eq!(statement.column_i64(0), 9);
+    }
+}
diff --git a/developer-simulation/runs/2026-07-31--parts-catalog-evolution/src/sqlite.rs b/developer-simulation/runs/2026-07-31--parts-catalog-evolution/src/sqlite.rs
new file mode 100644
index 0000000..edbb448
--- /dev/null
+++ b/developer-simulation/runs/2026-07-31--parts-catalog-evolution/src/sqlite.rs
@@ -0,0 +1,290 @@
+//! Minimal, parameterized SQLite wrapper for the prototype.
+//!
+//! This avoids adding a database dependency that was not available in the
+//! sanitized checkout while still exercising the real system SQLite library.
+
+use std::ffi::{CStr, CString, c_char, c_int, c_void};
+use std::fmt::{Display, Formatter};
+use std::path::Path;
+use std::ptr::{null, null_mut};
+
+#[allow(non_camel_case_types)]
+enum sqlite3 {}
+#[allow(non_camel_case_types)]
+enum sqlite3_stmt {}
+
+const SQLITE_OK: c_int = 0;
+const SQLITE_ROW: c_int = 100;
+const SQLITE_DONE: c_int = 101;
+const SQLITE_OPEN_READWRITE: c_int = 0x0000_0002;
+const SQLITE_OPEN_CREATE: c_int = 0x0000_0004;
+const SQLITE_OPEN_FULLMUTEX: c_int = 0x0001_0000;
+
+#[link(name = "sqlite3")]
+unsafe extern "C" {
+    fn sqlite3_open_v2(
+        filename: *const c_char,
+        pp_db: *mut *mut sqlite3,
+        flags: c_int,
+        z_vfs: *const c_char,
+    ) -> c_int;
+    fn sqlite3_close_v2(db: *mut sqlite3) -> c_int;
+    fn sqlite3_errmsg(db: *mut sqlite3) -> *const c_char;
+    fn sqlite3_exec(
+        db: *mut sqlite3,
+        sql: *const c_char,
+        callback: Option<unsafe extern "C" fn() -> c_int>,
+        arg: *mut c_void,
+        errmsg: *mut *mut c_char,
+    ) -> c_int;
+    fn sqlite3_prepare_v2(
+        db: *mut sqlite3,
+        sql: *const c_char,
+        n_byte: c_int,
+        statement: *mut *mut sqlite3_stmt,
+        tail: *mut *const c_char,
+    ) -> c_int;
+    fn sqlite3_finalize(statement: *mut sqlite3_stmt) -> c_int;
+    fn sqlite3_step(statement: *mut sqlite3_stmt) -> c_int;
+    fn sqlite3_reset(statement: *mut sqlite3_stmt) -> c_int;
+    fn sqlite3_clear_bindings(statement: *mut sqlite3_stmt) -> c_int;
+    fn sqlite3_bind_int64(statement: *mut sqlite3_stmt, index: c_int, value: i64) -> c_int;
+    fn sqlite3_bind_double(statement: *mut sqlite3_stmt, index: c_int, value: f64) -> c_int;
+    fn sqlite3_bind_text(
+        statement: *mut sqlite3_stmt,
+        index: c_int,
+        value: *const c_char,
+        length: c_int,
+        destructor: unsafe extern "C" fn(*mut c_void),
+    ) -> c_int;
+    fn sqlite3_bind_null(statement: *mut sqlite3_stmt, index: c_int) -> c_int;
+    fn sqlite3_column_int64(statement: *mut sqlite3_stmt, column: c_int) -> i64;
+    fn sqlite3_column_text(statement: *mut sqlite3_stmt, column: c_int) -> *const u8;
+    fn sqlite3_column_bytes(statement: *mut sqlite3_stmt, column: c_int) -> c_int;
+    fn sqlite3_changes64(db: *mut sqlite3) -> i64;
+}
+
+unsafe extern "C" fn transient_destructor(_: *mut c_void) {}
+
+#[derive(Debug, Clone)]
+pub struct Error(pub String);
+
+impl Display for Error {
+    fn fmt(&self, f: &mut Formatter<'_>) -> std::fmt::Result {
+        f.write_str(&self.0)
+    }
+}
+
+impl std::error::Error for Error {}
+
+pub type Result<T> = std::result::Result<T, Error>;
+
+pub struct Connection {
+    raw: *mut sqlite3,
+}
+
+// The connection is opened in SQLite's full-mutex mode and the application
+// additionally places it behind a Rust Mutex before sharing it.
+unsafe impl Send for Connection {}
+
+impl Connection {
+    pub fn open(path: &Path) -> Result<Self> {
+        let filename = CString::new(path.to_string_lossy().as_bytes())
+            .map_err(|_| Error("database path contains a NUL byte".into()))?;
+        let mut raw = null_mut();
+        // SAFETY: filename is NUL-terminated, raw is a valid out pointer, and
+        // the returned handle is owned by Connection.
+        let rc = unsafe {
+            sqlite3_open_v2(
+                filename.as_ptr(),
+                &mut raw,
+                SQLITE_OPEN_READWRITE | SQLITE_OPEN_CREATE | SQLITE_OPEN_FULLMUTEX,
+                null(),
+            )
+        };
+        if rc != SQLITE_OK {
+            let message = if raw.is_null() {
+                format!("sqlite open failed with code {rc}")
+            } else {
+                error_message(raw)
+            };
+            if !raw.is_null() {
+                // SAFETY: raw came from sqlite3_open_v2 and is not retained.
+                unsafe { sqlite3_close_v2(raw) };
+            }
+            return Err(Error(message));
+        }
+        Ok(Self { raw })
+    }
+
+    pub fn execute_batch(&self, sql: &str) -> Result<()> {
+        let sql = CString::new(sql).map_err(|_| Error("SQL contains a NUL byte".into()))?;
+        // SAFETY: self.raw is an open handle and sql is NUL-terminated.
+        let rc = unsafe { sqlite3_exec(self.raw, sql.as_ptr(), None, null_mut(), null_mut()) };
+        self.check(rc)
+    }
+
+    pub fn prepare(&self, sql: &str) -> Result<Statement> {
+        let sql = CString::new(sql).map_err(|_| Error("SQL contains a NUL byte".into()))?;
+        let mut raw = null_mut();
+        // SAFETY: pointers are valid for this call; SQLite owns the compiled
+        // statement until Statement::drop finalizes it.
+        let rc = unsafe { sqlite3_prepare_v2(self.raw, sql.as_ptr(), -1, &mut raw, null_mut()) };
+        self.check(rc)?;
+        Ok(Statement { raw, db: self.raw })
+    }
+
+    pub fn changes(&self) -> i64 {
+        // SAFETY: self.raw is an open handle.
+        unsafe { sqlite3_changes64(self.raw) }
+    }
+
+    pub fn transaction<T>(&self, operation: impl FnOnce() -> Result<T>) -> Result<T> {
+        self.execute_batch("BEGIN IMMEDIATE")?;
+        match operation() {
+            Ok(value) => {
+                self.execute_batch("COMMIT")?;
+                Ok(value)
+            }
+            Err(error) => {
+                let _ = self.execute_batch("ROLLBACK");
+                Err(error)
+            }
+        }
+    }
+
+    fn check(&self, rc: c_int) -> Result<()> {
+        if rc == SQLITE_OK {
+            Ok(())
+        } else {
+            Err(Error(error_message(self.raw)))
+        }
+    }
+}
+
+impl Drop for Connection {
+    fn drop(&mut self) {
+        // SAFETY: raw is uniquely owned and not used after drop.
+        unsafe { sqlite3_close_v2(self.raw) };
+    }
+}
+
+pub enum Step {
+    Row,
+    Done,
+}
+
+pub struct Statement {
+    raw: *mut sqlite3_stmt,
+    db: *mut sqlite3,
+}
+
+impl Statement {
+    pub fn bind_text(&mut self, index: i32, value: &str) -> Result<()> {
+        let bytes = value.as_bytes();
+        let length =
+            i32::try_from(bytes.len()).map_err(|_| Error("bound text too large".into()))?;
+        // SAFETY: bytes remains valid for the call and SQLITE_TRANSIENT is
+        // represented by the special destructor value documented by SQLite.
+        let rc = unsafe {
+            sqlite3_bind_text(
+                self.raw,
+                index,
+                bytes.as_ptr().cast(),
+                length,
+                std::mem::transmute::<*const c_void, unsafe extern "C" fn(*mut c_void)>(
+                    (-1_isize) as *const c_void,
+                ),
+            )
+        };
+        self.check(rc)
+    }
+
+    pub fn bind_i64(&mut self, index: i32, value: i64) -> Result<()> {
+        // SAFETY: raw is a valid prepared statement.
+        self.check(unsafe { sqlite3_bind_int64(self.raw, index, value) })
+    }
+
+    pub fn bind_f64(&mut self, index: i32, value: f64) -> Result<()> {
+        // SAFETY: raw is a valid prepared statement.
+        self.check(unsafe { sqlite3_bind_double(self.raw, index, value) })
+    }
+
+    #[allow(dead_code)]
+    pub fn bind_null(&mut self, index: i32) -> Result<()> {
+        // SAFETY: raw is a valid prepared statement.
+        self.check(unsafe { sqlite3_bind_null(self.raw, index) })
+    }
+
+    pub fn step(&mut self) -> Result<Step> {
+        // SAFETY: raw is a valid prepared statement.
+        match unsafe { sqlite3_step(self.raw) } {
+            SQLITE_ROW => Ok(Step::Row),
+            SQLITE_DONE => Ok(Step::Done),
+            _ => Err(Error(error_message(self.db))),
+        }
+    }
+
+    pub fn execute(&mut self) -> Result<()> {
+        match self.step()? {
+            Step::Done => Ok(()),
+            Step::Row => Err(Error("statement unexpectedly returned a row".into())),
+        }
+    }
+
+    #[allow(dead_code)]
+    pub fn reset(&mut self) -> Result<()> {
+        // SAFETY: raw is a valid prepared statement.
+        self.check(unsafe { sqlite3_reset(self.raw) })?;
+        // SAFETY: raw is a valid prepared statement.
+        self.check(unsafe { sqlite3_clear_bindings(self.raw) })
+    }
+
+    pub fn column_i64(&self, column: i32) -> i64 {
+        // SAFETY: caller only reads columns while positioned on a row.
+        unsafe { sqlite3_column_int64(self.raw, column) }
+    }
+
+    pub fn column_text(&self, column: i32) -> String {
+        // SAFETY: caller only reads columns while positioned on a row; SQLite
+        // owns this buffer until the statement advances or is finalized.
+        unsafe {
+            let pointer = sqlite3_column_text(self.raw, column);
+            if pointer.is_null() {
+                return String::new();
+            }
+            let length = sqlite3_column_bytes(self.raw, column) as usize;
+            String::from_utf8_lossy(std::slice::from_raw_parts(pointer, length)).into_owned()
+        }
+    }
+
+    fn check(&self, rc: c_int) -> Result<()> {
+        if rc == SQLITE_OK {
+            Ok(())
+        } else {
+            Err(Error(error_message(self.db)))
+        }
+    }
+}
+
+impl Drop for Statement {
+    fn drop(&mut self) {
+        // SAFETY: raw is uniquely owned and no longer used after drop.
+        unsafe { sqlite3_finalize(self.raw) };
+    }
+}
+
+fn error_message(db: *mut sqlite3) -> String {
+    // SAFETY: db is an open SQLite handle and sqlite3_errmsg returns a stable
+    // NUL-terminated string owned by SQLite.
+    unsafe {
+        CStr::from_ptr(sqlite3_errmsg(db))
+            .to_string_lossy()
+            .into_owned()
+    }
+}
+
+#[allow(dead_code)]
+fn _keep_transient_symbol_referenced() {
+    let _ = transient_destructor as unsafe extern "C" fn(*mut c_void);
+}
diff --git a/developer-simulation/runs/2026-08-01--cnc-job-bundle-preflight/BASELINE.md b/developer-simulation/runs/2026-08-01--cnc-job-bundle-preflight/BASELINE.md
new file mode 100644
index 0000000..32137e5
--- /dev/null
+++ b/developer-simulation/runs/2026-08-01--cnc-job-bundle-preflight/BASELINE.md
@@ -0,0 +1,32 @@
+# Concrete baseline
+
+The baseline is a small Python preflight that opens a ZIP, requires an exact
+`manifest.json` member name, and rejects archive members whose filename does
+not end in `.json`, `.nc`, or `.gcode` (case-insensitive). It does not parse
+the manifest, read member contents, calculate checksums, compare declared byte
+counts, check tools, reject unsafe paths, detect case-colliding names, enforce
+a bundle-size policy, or stage files.
+
+Expected baseline classifications before implementation:
+
+| Fixture | Baseline expectation | Required classification |
+| --- | --- | --- |
+| valid | ready | ready |
+| truncated member | ready | invalid |
+| checksum mismatch | ready | invalid |
+| undeclared file with allowed extension | ready | invalid |
+| missing declared file | ready | invalid |
+| duplicate path differing only by case | ready | invalid |
+| absolute path | ready | invalid |
+| parent traversal | ready | invalid |
+| oversized bundle | ready | invalid |
+| undeclared disallowed extension | invalid | invalid |
+
+This is deliberately concrete and runnable, but it represents only the stated
+existing checks. It is not presented as a safe implementation.
+
+Measured correction: Python 3.14.6's `zipfile.ZipFile` rejected the physically
+truncated fixture while opening it, so the measured baseline result for that
+row was invalid rather than the predicted ready. It marked valid and every
+other adversarial fixture ready. The prediction is retained above to make the
+discovery trail explicit rather than retroactively changing the baseline.
diff --git a/developer-simulation/runs/2026-08-01--cnc-job-bundle-preflight/Cargo.toml b/developer-simulation/runs/2026-08-01--cnc-job-bundle-preflight/Cargo.toml
new file mode 100644
index 0000000..be036e0
--- /dev/null
+++ b/developer-simulation/runs/2026-08-01--cnc-job-bundle-preflight/Cargo.toml
@@ -0,0 +1,13 @@
+[package]
+name = "cnc-job-bundle-preflight"
+version = "0.1.0"
+edition.workspace = true
+publish.workspace = true
+
+[dependencies]
+serde = { version = "1", features = ["derive"] }
+serde_json = "1"
+
+[lints.clippy]
+all = "deny"
+pedantic = "deny"
diff --git a/developer-simulation/runs/2026-08-01--cnc-job-bundle-preflight/EVIDENCE.md b/developer-simulation/runs/2026-08-01--cnc-job-bundle-preflight/EVIDENCE.md
new file mode 100644
index 0000000..7fbca21
--- /dev/null
+++ b/developer-simulation/runs/2026-08-01--cnc-job-bundle-preflight/EVIDENCE.md
@@ -0,0 +1,310 @@
+# Trial report: CNC job bundle preflight
+
+Run completed: 2026-08-01 06:22 EDT
+
+## Outcome
+
+The result is a useful, runnable local prototype and a **no-fit conclusion for
+BogKit**. The prototype correctly classified the required valid, truncated,
+checksum-mismatched, undeclared, missing, case-colliding, absolute-path,
+parent-traversal, and oversized fixtures within its documented ZIP subset. It
+also rejected a missing tool, reported a multi-error manifest in stable order,
+accepted exactly 1,000 declared files, staged only the valid bundle, and failed
+closed when the selected staging root was a symlink. After skeptical review,
+staging also uses a temporary directory, removes incomplete output after an
+ordinary write failure, rechecks every copied member, and assigns the `ready`
+name only after the whole copy succeeds.
+
+The 2 GiB sparse member was actually read and hashed, not skipped from header
+metadata. The final archived-workspace timed run reported 1,998,848 bytes
+maximum resident set (about 1.91 MiB), below the 32 MiB acceptance limit, and
+2,147,483,919 streamed bytes including the manifest. The fixture was rejected
+only by the prototype's 1 GiB total-member policy and was never staged.
+
+This is not production-ready. It supports only classic stored ZIPs, its 1 GiB
+policy needs a product decision, and staging is not hardened against an active
+local process racing path checks. It intentionally does not interpret or run
+G-code.
+
+## Brief used
+
+The simulated developer maintains an on-premises machine controller and has
+intermediate Rust experience. The existing Python preflight checks required
+filenames and extensions in operator ZIP bundles. The recurring failures are
+truncation, checksums, undeclared or missing files, case-colliding names,
+unsafe paths, and missing tools. Bundles are untrusted, contain 1-1,000 files,
+are usually 10 MB and occasionally 2 GB, must be checked offline by streaming,
+must stay below 32 MB working memory, and must never write outside selected
+staging. G-code semantics, malware detection, repair, authentication, and
+production deployment are out of scope.
+
+## Ordered discovery, friction, and debugging trail
+
+1. I listed only the public root README and public examples. I then read the
+   root README plus each public example manifest and main source. I did not
+   inspect another checkout, a prior trial, the internet, or simulation state.
+2. Before choosing any BogKit component, I froze a runnable Python baseline in
+   `baseline.py` and its predicted comparison in `BASELINE.md`: exact
+   `manifest.json` presence plus case-insensitive `.json`, `.nc`, or `.gcode`
+   filename checks, with no extraction or content reads.
+3. Only after freezing that baseline, I inspected the root Cargo workspace and
+   local tool versions. The public examples showed Fold for persistent,
+   incrementally maintained views, ESE for embeddings, and ANNy for nearest
+   neighbors. None addresses archive parsing, trust-boundary path handling, or
+   streaming checksums, so I chose no BogKit component.
+4. I created an isolated nested Rust workspace under `trial-output` and made no
+   change to the root workspace or BogKit core. The CLI uses only Serde and
+   Serde JSON; the classic ZIP reader/writer, SHA-256, and CRC32 are local.
+5. The initial formatter check failed with formatting diffs. After formatting,
+   all three unit tests passed, but strict Clippy rejected ten issues. I moved
+   the 64 KiB stream buffer from the stack to bounded heap storage, fixed style
+   findings, and narrowly allowed length/name lints in the ZIP parser, fixture
+   generator, manifest validator, and standard SHA-256 round variables.
+6. The first fixture-generation run failed with `File exists (os error 17)`
+   because the generator required the selected output directory not to exist.
+   I changed it to accept an existing directory, matching safe temporary-folder
+   practice, and regenerated successfully.
+7. The normal demonstration produced the expected ten classifications. Only
+   valid staged. The staged program hash was independently checked.
+8. The measured Python baseline corrected one prediction: Python 3.14.6
+   rejected the physically truncated ZIP on open. It still marked checksum
+   mismatch, undeclared, missing, duplicate-case, absolute-path,
+   parent-traversal, missing-tool, and multi-error bundles ready.
+9. A 2 GiB logical sparse ZIP (20 KiB physical allocation) was generated. The
+   first sandboxed `/usr/bin/time -l` run completed the scan in 17.09 seconds
+   but could not query memory (`sysctl kern.clockrate: Operation not
+   permitted`). A `ps` sampler was also blocked and correctly discarded as
+   evidence. The approved read-only rerun reported full process accounting.
+10. Two multi-error runs had identical whole-output hashes. The 1,000-file
+    fixture passed. A valid bundle aimed at a symlinked staging root became
+    invalid with `staging_failed`, and the symlink target stayed empty.
+11. Skeptical review found that a late ordinary write failure could leave an
+    incomplete directory named `ready`, and that the second member read used
+    for staging was not rechecked. The coordinator changed staging to use a
+    temporary directory, remove incomplete output on failure, recheck byte
+    count, CRC, and SHA-256 for every copy, and rename only after completion.
+    Three regressions cover file/parent path collisions, incomplete-output
+    cleanup, and content rechecking. Entry count and member-name length are now
+    rejected before metadata allocation can grow beyond the trial policy.
+
+## Baseline comparison
+
+| Fixture | Python baseline measured | Rust prototype measured |
+| --- | --- | --- |
+| valid | ready | ready, staged |
+| truncated | invalid (`zipfile` open failure) | invalid (`archive_invalid`) |
+| checksum mismatch | **ready** | invalid (`checksum_mismatch`) |
+| undeclared allowed-extension file | **ready** | invalid (`archive_file_undeclared`) |
+| missing declared file | **ready** | invalid (`declared_file_missing`) |
+| duplicate case | **ready** | invalid (archive and manifest case collision) |
+| absolute path | **ready** | invalid (archive, manifest, and entry path unsafe) |
+| parent traversal | **ready** | invalid (archive, manifest, and entry path unsafe) |
+| missing tool | **ready** | invalid (`required_tool_missing`) |
+| independent manifest errors | **ready** | invalid, 15 stable-ordered diagnostics |
+| 2 GiB oversized sparse member | not run; baseline never reads members | invalid after full stream/hash |
+
+The baseline's useful behavior is limited to central-directory readability,
+the exact manifest filename, and extensions. The smallest safe improvement is
+the prototype's sequence: inventory all names first, parse a bounded manifest,
+collect independent errors, stream declared content for size/hash/CRC, and
+only then create staging.
+
+## Exact commands and observed evidence
+
+### Public discovery
+
+From `/private/tmp/bogkit-2026-08-01-trial-b.LaXksh`:
+
+```console
+pwd && rg --files -g 'README*' -g 'examples/**' -g '!target'
+sed -n '1,240p' README.md; for f in examples/*/Cargo.toml examples/*/src/main.rs; do echo "FILE $f"; sed -n '1,260p' "$f"; done
+```
+
+Observed: one root README and four public examples (`starter`, `timeseries`,
+`chat`, `search`). The first command confirmed the assigned checkout path.
+
+### Build checks
+
+From the prototype directory:
+
+```console
+cargo fmt --all -- --check
+cargo test --offline
+cargo clippy --offline --all-targets -- -D warnings
+cargo build --offline --release
+```
+
+Observed after skeptical-review fixes: formatting passed; 6 tests passed, 0 failed; strict
+Clippy passed with warnings denied; release build passed. Rust was
+`rustc 1.95.0` and Cargo was `1.95.0`.
+
+### Fixture generation and normal demonstration
+
+```console
+target/release/cnc-job-bundle-preflight generate-fixtures /private/tmp/cnc-preflight-fixtures.LTnBpG
+target/release/cnc-job-bundle-preflight demo /private/tmp/cnc-preflight-fixtures.LTnBpG /private/tmp/cnc-preflight-staging.xRDZkg
+```
+
+Observed: generation succeeded. Demo exited 0 because valid was ready and the
+nine normal adversarial fixtures were all invalid. Valid staged to
+`/private/tmp/cnc-preflight-staging.xRDZkg/valid/ready`; each invalid report had
+`ready: false` and `staged: null`.
+
+```console
+rg --files -uu /private/tmp/cnc-preflight-staging.xRDZkg
+test ! -e /private/tmp/cnc-preflight-staging.xRDZkg/escape.nc
+test ! -e /escape.nc
+shasum -a 256 /private/tmp/cnc-preflight-staging.xRDZkg/valid/ready/programs/job.nc
+```
+
+Observed: the staging tree contained only valid's `manifest.json` and
+`programs/job.nc`. Neither escape target existed. The staged program hash was
+`b9cea1cced0aa93d046077443fe7ebfd0d5c217d0ba32a0dcc39fa3a18033861`,
+matching the manifest and streamed diagnostic evidence.
+
+### Measured Python baseline
+
+```console
+for f in valid truncated checksum-mismatch undeclared missing duplicate-case absolute-path parent-traversal missing-tool multi-error; do python3 baseline.py "/private/tmp/cnc-preflight-fixtures.LTnBpG/$f.zip"; done
+```
+
+Observed with Python 3.14.6: only truncated was invalid; all other bundles,
+including all content/reference/path adversaries, were ready.
+
+### Stable independent diagnostics
+
+```console
+target/release/cnc-job-bundle-preflight check /private/tmp/cnc-preflight-fixtures.LTnBpG/multi-error.zip --tools /private/tmp/cnc-preflight-fixtures.LTnBpG/tools.json | shasum -a 256
+target/release/cnc-job-bundle-preflight check /private/tmp/cnc-preflight-fixtures.LTnBpG/multi-error.zip --tools /private/tmp/cnc-preflight-fixtures.LTnBpG/tools.json | shasum -a 256
+```
+
+Observed: both complete JSON outputs hashed to
+`48eab7f13f5d8badf732bd67030e4e3349279f2c0ff124b9811fd1cfb78235c8`.
+The output contained 15 diagnostics sorted by code, path, and message,
+including independent archive, checksum, size, missing-file, entry-program,
+manifest-version, manifest-format, duplicate, and tool errors.
+
+### 1,000-file boundary
+
+```console
+target/release/cnc-job-bundle-preflight check /private/tmp/cnc-preflight-fixtures.LTnBpG/thousand-files.zip --tools /private/tmp/cnc-preflight-fixtures.LTnBpG/tools.json
+```
+
+Observed: `ready: true`, no diagnostics, 1,001 archive members including the
+manifest, and 172,118 streamed bytes.
+
+### 2 GiB streaming and memory
+
+```console
+target/release/cnc-job-bundle-preflight generate-fixtures /private/tmp/cnc-preflight-fixtures.LTnBpG --include-huge
+ls -lh /private/tmp/cnc-preflight-fixtures.LTnBpG/oversized-2gib-sparse.zip
+du -h /private/tmp/cnc-preflight-fixtures.LTnBpG/oversized-2gib-sparse.zip
+/usr/bin/time -l target/release/cnc-job-bundle-preflight check /private/tmp/cnc-preflight-fixtures.LTnBpG/oversized-2gib-sparse.zip --tools /private/tmp/cnc-preflight-fixtures.LTnBpG/tools.json --staging /private/tmp/cnc-preflight-staging.xRDZkg/oversized
+```
+
+Observed: 2.0 GiB logical length, 20 KiB physical allocation. The final
+archived-workspace timed run took 17.00 seconds, streamed 2,147,483,919 bytes
+with a reported 65,536-byte buffer, matched the declared SHA-256 and ZIP CRC
+(no mismatch diagnostics), and reported 1,998,848 bytes maximum resident set. It returned
+exit 1 with only `archive_oversized`, `ready: false`, and `staged: null`.
+`/private/tmp/cnc-preflight-staging.xRDZkg/oversized` did not exist afterwards.
+
+### Symlinked staging root
+
+```console
+ln -s /private/tmp/cnc-preflight-outside.OpDeMm /private/tmp/cnc-preflight-staging-symlink.LTnBpG
+target/release/cnc-job-bundle-preflight check /private/tmp/cnc-preflight-fixtures.LTnBpG/valid.zip --tools /private/tmp/cnc-preflight-fixtures.LTnBpG/tools.json --staging /private/tmp/cnc-preflight-staging-symlink.LTnBpG
+```
+
+Observed: a content-valid archive became `ready: false` with `staging_failed:
+selected staging root must be a real directory`; nothing was staged and the
+symlink target remained empty.
+
+## Consequential decision audit
+
+| Decision | Consequence | Evidence/reversibility |
+| --- | --- | --- |
+| Use no BogKit crate | Avoids a database and lifecycle that do not help the trust boundary | No core/workspace edits; easy to revisit if requirements become incremental |
+| Validate fully before staging | Invalid bundles create no staging output | Demonstrated across nine normal adversaries plus oversized; invalid reports always had `staged: null` |
+| Stage through a temporary directory and recheck every copy | A late failure cannot leave incomplete output named `ready`; copied bytes must still match validated content | Two skeptical-review regressions require cleanup and content rechecking before final naming |
+| Treat a staging failure as not ready | A valid bundle is never reported ready if its requested write did not complete | Symlink-root and incomplete-copy tests returned no `ready` output |
+| Reject compressed, encrypted, multi-disk, and ZIP64 inputs | Safe false negatives; many normal production ZIPs are currently unsupported | Explicit deterministic diagnostics; replace parser behind the same validation interface |
+| Set total member cap to 1 GiB | Provides an oversized classification but conflicts with the brief's occasional 2 GiB workload | Prototype-only constant; needs operator/product decision before deployment |
+| Require exact UTF-8 names and reject case collisions | Avoids controller/filesystem disagreement | Demonstrated ASCII case collision; Unicode normalization remains uncertain |
+| Rename a completed temporary directory to `ready` | Prevents partial output from carrying the final name and avoids overwriting existing work | Existing destinations fail closed; copied content is rechecked; broader filesystem coordination remains unresolved |
+| Hash with streaming SHA-256 and verify ZIP CRC | Detects manifest mismatch and archive corruption without member-sized allocation | Known SHA-256 unit vector plus 2 GiB cross-check against precomputed standard digest |
+
+## Categorized findings
+
+| Category | Severity | Confidence | Reproduction | Smallest improvement |
+| --- | --- | --- | --- | --- |
+| Baseline accepts unsafe archive paths | Critical for controller staging | High | Run `baseline.py` on absolute and traversal fixtures | Reject unsafe/case-colliding names before any write |
+| Baseline accepts checksum, declaration, size, and tool failures | High | High | Baseline loop above | Parse bounded manifest and stream SHA-256/size/CRC before ready |
+| BogKit component fit | Informational: no fit | High | Compare public examples to acceptance criteria | Keep BogKit out unless incremental multi-bundle state becomes a requirement |
+| Compressed and ZIP64 bundles rejected | Medium compatibility limitation | High | Create a compressed or ZIP64 input; it fails closed | Use a mature streaming ZIP parser without extraction APIs |
+| Staging path checks have local race windows | Medium hardening gap | Medium | Not safely reproduced without a racing local process | Use directory file descriptors plus `openat`/`mkdirat` and no-follow flags |
+| 1 GiB policy conflicts with occasional 2 GiB workload | Medium product-policy gap | High | 2 GiB fixture returns only `archive_oversized` | Make a reviewed local configuration or raise the policy with disk-budget checks |
+| Unicode normalization aliases are not detected | Low-to-medium portability gap | Medium | Not covered; composed/decomposed names may alias on some filesystems | Normalize to a chosen Unicode form before collision checks |
+
+## Rejected alternatives
+
+- **Fold:** durable incremental counts/tables do not make a one-shot bundle
+  safer, and would add persistent state to a stateless controller gate.
+- **ESE and ANNy:** embeddings and nearest-neighbor search do not address any
+  manifest, archive, memory, or staging criterion.
+- **Extract first, validate later:** violates the central trust boundary and
+  makes absolute/traversal paths consequential before classification.
+- **Read each member into memory:** simple but cannot meet the 32 MiB target for
+  ordinary 10 MB growth or 2 GiB inputs.
+- **Shell out to an archive extractor:** harder to make portable and prove
+  extraction-free; the prototype instead reads member byte ranges directly.
+- **Repair malformed bundles:** explicitly outside scope and risks turning an
+  operator error into silently changed machine input.
+
+## Skeptical review and coordinator corrections
+
+The reviewer reproduced the build checks, required fixture classifications,
+stable diagnostics, 1,000-file boundary, sparse 2 GiB stream, and the no-fit
+comparison. The no-fit label stood: none of the BogKit components supplies the
+one-shot archive parsing, manifest validation, or bounded copy gate required by
+this prototype.
+
+The reviewer found two high-severity prototype-quality problems before
+archival: incomplete output could retain the final `ready` name after a late
+copy failure, and staged content was not compared with the content validated on
+the first read. Both are fixed by temporary staging, cleanup, per-copy
+byte/CRC/SHA-256 checks, and final rename, with regressions. The reviewer also
+required early archive-entry and member-name bounds and narrower compatibility
+language for the hand-written classic stored-ZIP subset.
+
+These were prototype defects, not BogKit defects. No new feature or API
+candidate meets the dashboard threshold.
+
+## Unresolved uncertainty
+
+- No compressed, ZIP64, data-descriptor, or multi-disk interoperability was
+  implemented; these fail closed rather than receiving broad parser coverage.
+- The parser has unit and generated-fixture coverage but no fuzzing or corpus
+  testing against independently created ZIP implementations.
+- The 2 GiB RSS number is one macOS run. The bounded 64 KiB member buffer and
+  bounded 65,557-byte end-record scan explain the low result, but other
+  allocators/platforms should be measured.
+- Staging rejects pre-existing symlinks, uses temporary output, rechecks copied
+  content, and cleans ordinary failures, but it does not provide coordinated
+  filesystem access against another local process changing paths concurrently.
+- Case folding is deterministic, but Unicode normalization and controller
+  filesystem semantics need an explicit policy.
+- The 1 GiB cap was selected to make “oversized” concrete. It is not justified
+  as the correct operational limit given occasional 2 GiB jobs.
+- G-code and tool usage inside program text are intentionally not interpreted;
+  only manifest-declared tool identifiers are checked against inventory.
+
+## Deliverable and workspace state
+
+All prototype source, baseline material, lockfile, usage notes, and this report
+are under
+`/private/tmp/bogkit-2026-08-01-trial-b.LaXksh/trial-output/cnc-job-bundle-preflight`.
+Generated fixtures and staging evidence were kept under separate `/private/tmp`
+directories. The root Git status showed only untracked `trial-output/`; no
+BogKit core or existing example was edited. The nested `[workspace]` avoided
+any root Cargo workspace membership change.
diff --git a/developer-simulation/runs/2026-08-01--cnc-job-bundle-preflight/README.md b/developer-simulation/runs/2026-08-01--cnc-job-bundle-preflight/README.md
new file mode 100644
index 0000000..35d63ab
--- /dev/null
+++ b/developer-simulation/runs/2026-08-01--cnc-job-bundle-preflight/README.md
@@ -0,0 +1,43 @@
+# CNC job bundle preflight prototype
+
+This offline Rust command checks untrusted CNC job ZIPs before staging. It
+validates safe names, a versioned JSON manifest, exact/case-colliding names,
+declared file presence, undeclared members, byte counts, SHA-256 and ZIP CRC,
+entry-program and tool references, and a 1 GiB total-member policy. It stages
+only a fully valid bundle through a temporary directory, rechecks every copied
+member, and assigns the `ready` name only after the complete copy succeeds.
+Incomplete temporary output is removed after an ordinary write failure.
+
+This prototype intentionally accepts only classic, uncompressed ZIP members.
+Compressed, encrypted, multi-disk, and ZIP64 archives fail closed.
+
+## Build and test
+
+```console
+cargo fmt --all -- --check
+cargo test --offline
+cargo clippy --offline --all-targets -- -D warnings
+cargo build --offline --release
+```
+
+The nested empty `[workspace]` in `Cargo.toml` keeps this crate isolated from
+the surrounding BogKit workspace. It uses no BogKit crate because the trial
+found no component that improves a one-shot streaming trust-boundary check.
+
+## Generate and inspect fixtures
+
+Keep generated fixtures and staging outside this archiveable directory:
+
+```console
+target/release/cnc-job-bundle-preflight generate-fixtures /tmp/cnc-fixtures --include-huge
+target/release/cnc-job-bundle-preflight demo /tmp/cnc-fixtures /tmp/cnc-staging
+target/release/cnc-job-bundle-preflight check /tmp/cnc-fixtures/valid.zip \
+  --tools /tmp/cnc-fixtures/tools.json --staging /tmp/cnc-one-stage
+```
+
+`demo` exits successfully only if `valid.zip` is ready and all adversarial
+fixtures are invalid. `check` prints deterministic JSON and exits 0 for ready,
+1 for invalid, or 2 for command/setup errors.
+
+`baseline.py BUNDLE.zip` reproduces the filename-only Python comparison.
+See `EVIDENCE.md` for the evidence and limitations.
diff --git a/developer-simulation/runs/2026-08-01--cnc-job-bundle-preflight/baseline.py b/developer-simulation/runs/2026-08-01--cnc-job-bundle-preflight/baseline.py
new file mode 100644
index 0000000..78b07b6
--- /dev/null
+++ b/developer-simulation/runs/2026-08-01--cnc-job-bundle-preflight/baseline.py
@@ -0,0 +1,29 @@
+#!/usr/bin/env python3
+"""Concrete reproducer for the filename-only Python baseline."""
+
+import json
+import sys
+import zipfile
+
+
+def check(path: str) -> dict[str, object]:
+    errors: list[dict[str, str]] = []
+    try:
+        with zipfile.ZipFile(path) as archive:
+            names = archive.namelist()
+            if "manifest.json" not in names:
+                errors.append({"code": "missing_required", "path": "manifest.json"})
+            for name in names:
+                lowered = name.lower()
+                if not lowered.endswith((".json", ".nc", ".gcode")):
+                    errors.append({"code": "extension_not_allowed", "path": name})
+    except (OSError, zipfile.BadZipFile) as error:
+        errors.append({"code": "unreadable_zip", "path": str(error)})
+    errors.sort(key=lambda item: (item["code"], item["path"]))
+    return {"ready": not errors, "diagnostics": errors}
+
+
+if __name__ == "__main__":
+    if len(sys.argv) != 2:
+        raise SystemExit("usage: baseline.py BUNDLE.zip")
+    print(json.dumps(check(sys.argv[1]), sort_keys=True))
diff --git a/developer-simulation/runs/2026-08-01--cnc-job-bundle-preflight/src/archive.rs b/developer-simulation/runs/2026-08-01--cnc-job-bundle-preflight/src/archive.rs
new file mode 100644
index 0000000..b7843c1
--- /dev/null
+++ b/developer-simulation/runs/2026-08-01--cnc-job-bundle-preflight/src/archive.rs
@@ -0,0 +1,345 @@
+use std::fs::File;
+use std::io::{self, Read, Seek, SeekFrom, Write};
+use std::path::Path;
+
+const LOCAL_SIGNATURE: u32 = 0x0403_4b50;
+const CENTRAL_SIGNATURE: u32 = 0x0201_4b50;
+const END_SIGNATURE: u32 = 0x0605_4b50;
+const UTF8_FLAG: u16 = 0x0800;
+const MAX_ARCHIVE_ENTRIES: usize = 1_001;
+const MAX_MEMBER_NAME_BYTES: usize = 4_096;
+
+#[derive(Debug, Clone)]
+pub struct Entry {
+    pub name: String,
+    pub compressed_size: u64,
+    pub size: u64,
+    pub method: u16,
+    pub encrypted: bool,
+    pub crc32: u32,
+    pub data_offset: u64,
+}
+
+pub struct Archive {
+    file: File,
+    pub entries: Vec<Entry>,
+}
+
+impl Archive {
+    #[allow(clippy::too_many_lines)]
+    pub fn open(path: &Path) -> io::Result<Self> {
+        let mut file = File::open(path)?;
+        let length = file.metadata()?.len();
+        let search_length = length.min(65_557);
+        if search_length < 22 {
+            return Err(invalid("archive is truncated: no end record"));
+        }
+        file.seek(SeekFrom::End(
+            -i64::try_from(search_length).map_err(|_| invalid("archive tail is too large"))?,
+        ))?;
+        let mut tail = vec![
+            0_u8;
+            usize::try_from(search_length)
+                .map_err(|_| { invalid("archive tail does not fit in memory") })?
+        ];
+        file.read_exact(&mut tail)?;
+        let end_index = tail
+            .windows(4)
+            .rposition(|window| le_u32(window) == END_SIGNATURE)
+            .ok_or_else(|| invalid("archive is truncated: no end record"))?;
+        if tail.len() - end_index < 22 {
+            return Err(invalid("archive is truncated: partial end record"));
+        }
+        let end = &tail[end_index..];
+        let disk = le_u16(&end[4..6]);
+        let central_disk = le_u16(&end[6..8]);
+        let disk_entries = le_u16(&end[8..10]);
+        let entry_count = le_u16(&end[10..12]);
+        let central_size = u64::from(le_u32(&end[12..16]));
+        let central_offset = u64::from(le_u32(&end[16..20]));
+        let comment_length = usize::from(le_u16(&end[20..22]));
+        if disk != 0 || central_disk != 0 || disk_entries != entry_count {
+            return Err(invalid("multi-disk ZIP archives are unsupported"));
+        }
+        if usize::from(entry_count) > MAX_ARCHIVE_ENTRIES {
+            return Err(invalid("archive exceeds the 1,001-member limit"));
+        }
+        if end.len() < 22 + comment_length {
+            return Err(invalid("archive is truncated: partial ZIP comment"));
+        }
+        let central_end = central_offset
+            .checked_add(central_size)
+            .ok_or_else(|| invalid("central directory offset overflow"))?;
+        if central_end > length {
+            return Err(invalid(
+                "archive is truncated: central directory exceeds file",
+            ));
+        }
+
+        file.seek(SeekFrom::Start(central_offset))?;
+        let mut entries = Vec::with_capacity(usize::from(entry_count).min(1_001));
+        for _ in 0..entry_count {
+            let mut fixed = [0_u8; 46];
+            file.read_exact(&mut fixed)
+                .map_err(|_| invalid("archive is truncated: partial central entry"))?;
+            if le_u32(&fixed[..4]) != CENTRAL_SIGNATURE {
+                return Err(invalid("invalid central directory signature"));
+            }
+            let flags = le_u16(&fixed[8..10]);
+            let method = le_u16(&fixed[10..12]);
+            let crc32 = le_u32(&fixed[16..20]);
+            let compressed_size = u64::from(le_u32(&fixed[20..24]));
+            let size = u64::from(le_u32(&fixed[24..28]));
+            let name_length = usize::from(le_u16(&fixed[28..30]));
+            let extra_length = usize::from(le_u16(&fixed[30..32]));
+            let comment_length = usize::from(le_u16(&fixed[32..34]));
+            let local_offset = u64::from(le_u32(&fixed[42..46]));
+            if compressed_size == u64::from(u32::MAX)
+                || size == u64::from(u32::MAX)
+                || local_offset == u64::from(u32::MAX)
+            {
+                return Err(invalid("ZIP64 archives are unsupported by this prototype"));
+            }
+            if name_length > MAX_MEMBER_NAME_BYTES {
+                return Err(invalid("member name exceeds the 4,096-byte limit"));
+            }
+            let mut name = vec![0_u8; name_length];
+            file.read_exact(&mut name)
+                .map_err(|_| invalid("archive is truncated: partial member name"))?;
+            if flags & UTF8_FLAG == 0 || std::str::from_utf8(&name).is_err() {
+                return Err(invalid("member name is not explicitly valid UTF-8"));
+            }
+            file.seek(SeekFrom::Current(
+                i64::try_from(extra_length + comment_length)
+                    .map_err(|_| invalid("central metadata is too large"))?,
+            ))?;
+
+            let return_position = file.stream_position()?;
+            file.seek(SeekFrom::Start(local_offset))?;
+            let mut local = [0_u8; 30];
+            file.read_exact(&mut local)
+                .map_err(|_| invalid("archive is truncated: partial local entry"))?;
+            if le_u32(&local[..4]) != LOCAL_SIGNATURE {
+                return Err(invalid("invalid local entry signature"));
+            }
+            let local_name_length = u64::from(le_u16(&local[26..28]));
+            let local_extra_length = u64::from(le_u16(&local[28..30]));
+            let data_offset = local_offset
+                .checked_add(30)
+                .and_then(|value| value.checked_add(local_name_length))
+                .and_then(|value| value.checked_add(local_extra_length))
+                .ok_or_else(|| invalid("local entry offset overflow"))?;
+            let data_end = data_offset
+                .checked_add(compressed_size)
+                .ok_or_else(|| invalid("member data offset overflow"))?;
+            if data_end > central_offset {
+                return Err(invalid(
+                    "archive is truncated: member data overlaps central directory",
+                ));
+            }
+            file.seek(SeekFrom::Start(return_position))?;
+
+            entries.push(Entry {
+                name: String::from_utf8(name).expect("validated UTF-8"),
+                compressed_size,
+                size,
+                method,
+                encrypted: flags & 1 != 0,
+                crc32,
+                data_offset,
+            });
+        }
+        if file.stream_position()? != central_end {
+            return Err(invalid("central directory size does not match its entries"));
+        }
+        Ok(Self { file, entries })
+    }
+
+    pub fn stream_entry<W: Write>(
+        &mut self,
+        entry: &Entry,
+        mut destination: Option<&mut W>,
+    ) -> io::Result<StreamResult> {
+        if entry.encrypted {
+            return Err(invalid("encrypted member is unsupported"));
+        }
+        if entry.method != 0 || entry.compressed_size != entry.size {
+            return Err(invalid("only uncompressed ZIP members are supported"));
+        }
+        self.file.seek(SeekFrom::Start(entry.data_offset))?;
+        let mut remaining = entry.compressed_size;
+        let mut buffer = vec![0_u8; 64 * 1024].into_boxed_slice();
+        let mut sha = crate::sha256::Sha256::new();
+        let mut crc = Crc32::new();
+        let mut count = 0_u64;
+        while remaining != 0 {
+            let amount = usize::try_from(remaining.min(buffer.len() as u64))
+                .expect("bounded by buffer length");
+            let read = self.file.read(&mut buffer[..amount])?;
+            if read == 0 {
+                return Err(invalid("archive is truncated inside member data"));
+            }
+            sha.update(&buffer[..read]);
+            crc.update(&buffer[..read]);
+            if let Some(writer) = destination.as_deref_mut() {
+                writer.write_all(&buffer[..read])?;
+            }
+            let read = u64::try_from(read).expect("buffer length fits u64");
+            count += read;
+            remaining -= read;
+        }
+        Ok(StreamResult {
+            bytes: count,
+            sha256: crate::sha256::hex(&sha.finish()),
+            crc32: crc.finish(),
+        })
+    }
+}
+
+#[derive(Debug)]
+pub struct StreamResult {
+    pub bytes: u64,
+    pub sha256: String,
+    pub crc32: u32,
+}
+
+pub struct Writer {
+    file: File,
+    entries: Vec<WrittenEntry>,
+}
+
+struct WrittenEntry {
+    name: String,
+    size: u32,
+    crc32: u32,
+    local_offset: u32,
+}
+
+impl Writer {
+    pub fn create(path: &Path) -> io::Result<Self> {
+        Ok(Self {
+            file: File::create(path)?,
+            entries: Vec::new(),
+        })
+    }
+
+    pub fn member(&mut self, name: &str, data: &[u8]) -> io::Result<()> {
+        let mut crc = Crc32::new();
+        crc.update(data);
+        let size = u32::try_from(data.len()).map_err(|_| invalid("fixture member too large"))?;
+        self.header(name, size, crc.finish())?;
+        self.file.write_all(data)
+    }
+
+    pub fn sparse_zero_member(&mut self, name: &str, size: u32, crc32: u32) -> io::Result<()> {
+        self.header(name, size, crc32)?;
+        self.file.seek(SeekFrom::Current(i64::from(size)))?;
+        Ok(())
+    }
+
+    fn header(&mut self, name: &str, size: u32, crc32: u32) -> io::Result<()> {
+        let name_length = u16::try_from(name.len()).map_err(|_| invalid("member name too long"))?;
+        let local_offset = u32::try_from(self.file.stream_position()?)
+            .map_err(|_| invalid("fixture exceeds classic ZIP offsets"))?;
+        write_u32(&mut self.file, LOCAL_SIGNATURE)?;
+        write_u16(&mut self.file, 20)?;
+        write_u16(&mut self.file, UTF8_FLAG)?;
+        write_u16(&mut self.file, 0)?;
+        write_u16(&mut self.file, 0)?;
+        write_u16(&mut self.file, 0)?;
+        write_u32(&mut self.file, crc32)?;
+        write_u32(&mut self.file, size)?;
+        write_u32(&mut self.file, size)?;
+        write_u16(&mut self.file, name_length)?;
+        write_u16(&mut self.file, 0)?;
+        self.file.write_all(name.as_bytes())?;
+        self.entries.push(WrittenEntry {
+            name: name.to_owned(),
+            size,
+            crc32,
+            local_offset,
+        });
+        Ok(())
+    }
+
+    pub fn finish(mut self) -> io::Result<()> {
+        let central_offset = u32::try_from(self.file.stream_position()?)
+            .map_err(|_| invalid("fixture exceeds classic ZIP offsets"))?;
+        for entry in &self.entries {
+            write_u32(&mut self.file, CENTRAL_SIGNATURE)?;
+            write_u16(&mut self.file, 20)?;
+            write_u16(&mut self.file, 20)?;
+            write_u16(&mut self.file, UTF8_FLAG)?;
+            write_u16(&mut self.file, 0)?;
+            write_u16(&mut self.file, 0)?;
+            write_u16(&mut self.file, 0)?;
+            write_u32(&mut self.file, entry.crc32)?;
+            write_u32(&mut self.file, entry.size)?;
+            write_u32(&mut self.file, entry.size)?;
+            write_u16(
+                &mut self.file,
+                u16::try_from(entry.name.len()).map_err(|_| invalid("member name too long"))?,
+            )?;
+            write_u16(&mut self.file, 0)?;
+            write_u16(&mut self.file, 0)?;
+            write_u16(&mut self.file, 0)?;
+            write_u16(&mut self.file, 0)?;
+            write_u32(&mut self.file, 0)?;
+            write_u32(&mut self.file, entry.local_offset)?;
+            self.file.write_all(entry.name.as_bytes())?;
+        }
+        let central_end = u32::try_from(self.file.stream_position()?)
+            .map_err(|_| invalid("fixture exceeds classic ZIP offsets"))?;
+        let count = u16::try_from(self.entries.len()).map_err(|_| invalid("too many members"))?;
+        write_u32(&mut self.file, END_SIGNATURE)?;
+        write_u16(&mut self.file, 0)?;
+        write_u16(&mut self.file, 0)?;
+        write_u16(&mut self.file, count)?;
+        write_u16(&mut self.file, count)?;
+        write_u32(&mut self.file, central_end - central_offset)?;
+        write_u32(&mut self.file, central_offset)?;
+        write_u16(&mut self.file, 0)?;
+        self.file.flush()
+    }
+}
+
+pub struct Crc32(u32);
+
+impl Crc32 {
+    pub fn new() -> Self {
+        Self(0xffff_ffff)
+    }
+
+    pub fn update(&mut self, data: &[u8]) {
+        for &byte in data {
+            self.0 ^= u32::from(byte);
+            for _ in 0..8 {
+                self.0 = (self.0 >> 1) ^ (0xedb8_8320 & (0_u32.wrapping_sub(self.0 & 1)));
+            }
+        }
+    }
+
+    pub fn finish(self) -> u32 {
+        !self.0
+    }
+}
+
+fn invalid(message: &str) -> io::Error {
+    io::Error::new(io::ErrorKind::InvalidData, message)
+}
+
+fn le_u16(bytes: &[u8]) -> u16 {
+    u16::from_le_bytes(bytes[..2].try_into().expect("two bytes"))
+}
+
+fn le_u32(bytes: &[u8]) -> u32 {
+    u32::from_le_bytes(bytes[..4].try_into().expect("four bytes"))
+}
+
+fn write_u16(writer: &mut File, value: u16) -> io::Result<()> {
+    writer.write_all(&value.to_le_bytes())
+}
+
+fn write_u32(writer: &mut File, value: u32) -> io::Result<()> {
+    writer.write_all(&value.to_le_bytes())
+}
diff --git a/developer-simulation/runs/2026-08-01--cnc-job-bundle-preflight/src/fixtures.rs b/developer-simulation/runs/2026-08-01--cnc-job-bundle-preflight/src/fixtures.rs
new file mode 100644
index 0000000..c2877b3
--- /dev/null
+++ b/developer-simulation/runs/2026-08-01--cnc-job-bundle-preflight/src/fixtures.rs
@@ -0,0 +1,237 @@
+use std::fs::{self, OpenOptions};
+use std::io;
+use std::path::Path;
+
+use crate::archive::Writer;
+use crate::preflight::{FileDeclaration, Inventory, Manifest};
+use crate::sha256::{Sha256, hex};
+
+const PROGRAM: &[u8] = b"%\nT01 M06\nG00 X0 Y0\nM30\n%\n";
+const SECOND_PROGRAM: &[u8] = b"%\nT02 M06\nM30\n%\n";
+const TWO_GIB: u32 = 2 * 1024 * 1024 * 1024;
+const TWO_GIB_ZERO_SHA256: &str =
+    "a7c744c13cc101ed66c29f672f92455547889cc586ce6d44fe76ae824958ea51";
+const TWO_GIB_ZERO_CRC32: u32 = 0x4dbd_f21c;
+
+#[allow(clippy::too_many_lines)]
+pub fn generate(output: &Path, include_huge: bool) -> io::Result<()> {
+    fs::create_dir_all(output)?;
+    write_json(
+        &output.join("tools.json"),
+        &Inventory {
+            tool_ids: vec!["T01".to_owned(), "T02".to_owned()],
+        },
+    )?;
+
+    let valid = base_manifest();
+    bundle(
+        &output.join("valid.zip"),
+        &valid,
+        &[("programs/job.nc", PROGRAM)],
+    )?;
+
+    let mut mismatch = base_manifest();
+    mismatch.files[0].sha256 = "0".repeat(64);
+    bundle(
+        &output.join("checksum-mismatch.zip"),
+        &mismatch,
+        &[("programs/job.nc", PROGRAM)],
+    )?;
+
+    bundle(
+        &output.join("undeclared.zip"),
+        &base_manifest(),
+        &[
+            ("programs/job.nc", PROGRAM),
+            ("programs/extra.gcode", SECOND_PROGRAM),
+        ],
+    )?;
+
+    let mut missing = base_manifest();
+    missing
+        .files
+        .push(declaration("programs/missing.nc", SECOND_PROGRAM));
+    bundle(
+        &output.join("missing.zip"),
+        &missing,
+        &[("programs/job.nc", PROGRAM)],
+    )?;
+
+    let duplicate_case = Manifest {
+        version: 1,
+        files: vec![
+            declaration("programs/job.nc", PROGRAM),
+            declaration("PROGRAMS/JOB.NC", SECOND_PROGRAM),
+        ],
+        entry_program: "programs/job.nc".to_owned(),
+        required_tool_ids: vec!["T01".to_owned()],
+    };
+    bundle(
+        &output.join("duplicate-case.zip"),
+        &duplicate_case,
+        &[
+            ("programs/job.nc", PROGRAM),
+            ("PROGRAMS/JOB.NC", SECOND_PROGRAM),
+        ],
+    )?;
+
+    let absolute = Manifest {
+        version: 1,
+        files: vec![declaration("/escape.nc", PROGRAM)],
+        entry_program: "/escape.nc".to_owned(),
+        required_tool_ids: vec!["T01".to_owned()],
+    };
+    bundle(
+        &output.join("absolute-path.zip"),
+        &absolute,
+        &[("/escape.nc", PROGRAM)],
+    )?;
+
+    let traversal = Manifest {
+        version: 1,
+        files: vec![declaration("../escape.nc", PROGRAM)],
+        entry_program: "../escape.nc".to_owned(),
+        required_tool_ids: vec!["T01".to_owned()],
+    };
+    bundle(
+        &output.join("parent-traversal.zip"),
+        &traversal,
+        &[("../escape.nc", PROGRAM)],
+    )?;
+
+    let mut missing_tool = base_manifest();
+    missing_tool.required_tool_ids = vec!["T404".to_owned()];
+    bundle(
+        &output.join("missing-tool.zip"),
+        &missing_tool,
+        &[("programs/job.nc", PROGRAM)],
+    )?;
+
+    let multi_error = Manifest {
+        version: 2,
+        files: vec![
+            FileDeclaration {
+                path: "programs/job.nc".to_owned(),
+                bytes: 999,
+                sha256: "0".repeat(64),
+            },
+            declaration("programs/missing.nc", SECOND_PROGRAM),
+            FileDeclaration {
+                path: "notes.txt".to_owned(),
+                bytes: 1,
+                sha256: "invalid".to_owned(),
+            },
+            declaration("programs/job.nc", PROGRAM),
+        ],
+        entry_program: "programs/not-declared.nc".to_owned(),
+        required_tool_ids: vec!["T404".to_owned(), "T404".to_owned(), String::new()],
+    };
+    bundle(
+        &output.join("multi-error.zip"),
+        &multi_error,
+        &[
+            ("programs/job.nc", PROGRAM),
+            ("programs/extra.gcode", SECOND_PROGRAM),
+        ],
+    )?;
+
+    bundle(
+        &output.join("truncated.zip"),
+        &base_manifest(),
+        &[("programs/job.nc", PROGRAM)],
+    )?;
+    let truncated = OpenOptions::new()
+        .write(true)
+        .open(output.join("truncated.zip"))?;
+    let shortened = truncated.metadata()?.len().saturating_sub(11);
+    truncated.set_len(shortened)?;
+
+    thousand_file_bundle(&output.join("thousand-files.zip"))?;
+
+    if include_huge {
+        oversized_bundle(&output.join("oversized-2gib-sparse.zip"))?;
+    }
+    Ok(())
+}
+
+fn base_manifest() -> Manifest {
+    Manifest {
+        version: 1,
+        files: vec![declaration("programs/job.nc", PROGRAM)],
+        entry_program: "programs/job.nc".to_owned(),
+        required_tool_ids: vec!["T01".to_owned()],
+    }
+}
+
+fn declaration(path: &str, data: &[u8]) -> FileDeclaration {
+    FileDeclaration {
+        path: path.to_owned(),
+        bytes: data.len() as u64,
+        sha256: digest(data),
+    }
+}
+
+fn digest(data: &[u8]) -> String {
+    let mut hash = Sha256::new();
+    hash.update(data);
+    hex(&hash.finish())
+}
+
+fn bundle(path: &Path, manifest: &Manifest, members: &[(&str, &[u8])]) -> io::Result<()> {
+    let manifest = serde_json::to_vec_pretty(manifest).map_err(io::Error::other)?;
+    let mut writer = Writer::create(path)?;
+    writer.member("manifest.json", &manifest)?;
+    for (name, data) in members {
+        writer.member(name, data)?;
+    }
+    writer.finish()
+}
+
+fn oversized_bundle(path: &Path) -> io::Result<()> {
+    let manifest = Manifest {
+        version: 1,
+        files: vec![FileDeclaration {
+            path: "programs/huge.nc".to_owned(),
+            bytes: u64::from(TWO_GIB),
+            sha256: TWO_GIB_ZERO_SHA256.to_owned(),
+        }],
+        entry_program: "programs/huge.nc".to_owned(),
+        required_tool_ids: vec!["T01".to_owned()],
+    };
+    let manifest = serde_json::to_vec_pretty(&manifest).map_err(io::Error::other)?;
+    let mut writer = Writer::create(path)?;
+    writer.member("manifest.json", &manifest)?;
+    writer.sparse_zero_member("programs/huge.nc", TWO_GIB, TWO_GIB_ZERO_CRC32)?;
+    writer.finish()
+}
+
+fn thousand_file_bundle(path: &Path) -> io::Result<()> {
+    let files: Vec<(String, Vec<u8>)> = (0..1_000)
+        .map(|index| {
+            let name = format!("programs/job-{index:04}.nc");
+            let data = format!("%\n(job {index:04})\nM30\n%\n").into_bytes();
+            (name, data)
+        })
+        .collect();
+    let manifest = Manifest {
+        version: 1,
+        files: files
+            .iter()
+            .map(|(name, data)| declaration(name, data))
+            .collect(),
+        entry_program: "programs/job-0000.nc".to_owned(),
+        required_tool_ids: vec!["T01".to_owned()],
+    };
+    let manifest = serde_json::to_vec_pretty(&manifest).map_err(io::Error::other)?;
+    let mut writer = Writer::create(path)?;
+    writer.member("manifest.json", &manifest)?;
+    for (name, data) in &files {
+        writer.member(name, data)?;
+    }
+    writer.finish()
+}
+
+fn write_json<T: serde::Serialize>(path: &Path, value: &T) -> io::Result<()> {
+    let bytes = serde_json::to_vec_pretty(value).map_err(io::Error::other)?;
+    fs::write(path, bytes)
+}
diff --git a/developer-simulation/runs/2026-08-01--cnc-job-bundle-preflight/src/main.rs b/developer-simulation/runs/2026-08-01--cnc-job-bundle-preflight/src/main.rs
new file mode 100644
index 0000000..f310c17
--- /dev/null
+++ b/developer-simulation/runs/2026-08-01--cnc-job-bundle-preflight/src/main.rs
@@ -0,0 +1,113 @@
+mod archive;
+mod fixtures;
+mod preflight;
+mod sha256;
+
+use std::env;
+use std::path::{Path, PathBuf};
+
+use preflight::Report;
+
+fn main() {
+    if let Err(message) = run() {
+        eprintln!("{message}");
+        std::process::exit(2);
+    }
+}
+
+fn run() -> Result<(), String> {
+    let mut arguments = env::args_os().skip(1);
+    let Some(command) = arguments.next() else {
+        return Err(usage());
+    };
+    match command.to_string_lossy().as_ref() {
+        "generate-fixtures" => {
+            let output = arguments.next().ok_or_else(usage)?;
+            let include_huge = arguments.any(|argument| argument == "--include-huge");
+            fixtures::generate(Path::new(&output), include_huge)
+                .map_err(|error| error.to_string())?;
+            println!("generated fixtures in {}", Path::new(&output).display());
+            Ok(())
+        }
+        "check" => check_command(&arguments.collect::<Vec<_>>()),
+        "demo" => demo_command(&arguments.collect::<Vec<_>>()),
+        _ => Err(usage()),
+    }
+}
+
+fn check_command(arguments: &[std::ffi::OsString]) -> Result<(), String> {
+    let bundle = arguments.first().ok_or_else(usage).map(PathBuf::from)?;
+    let mut tools = None;
+    let mut staging = None;
+    let mut index = 1;
+    while index < arguments.len() {
+        match arguments[index].to_string_lossy().as_ref() {
+            "--tools" => {
+                index += 1;
+                tools = arguments.get(index).map(PathBuf::from);
+            }
+            "--staging" => {
+                index += 1;
+                staging = arguments.get(index).map(PathBuf::from);
+            }
+            other => return Err(format!("unknown argument {other:?}\n{}", usage())),
+        }
+        index += 1;
+    }
+    let tools = tools.ok_or_else(usage)?;
+    let report = preflight::check(&bundle, &tools, staging.as_deref());
+    println!(
+        "{}",
+        serde_json::to_string_pretty(&report).map_err(|error| error.to_string())?
+    );
+    if report.ready {
+        Ok(())
+    } else {
+        std::process::exit(1);
+    }
+}
+
+fn demo_command(arguments: &[std::ffi::OsString]) -> Result<(), String> {
+    if arguments.len() != 2 {
+        return Err(usage());
+    }
+    let fixtures = PathBuf::from(&arguments[0]);
+    let staging = PathBuf::from(&arguments[1]);
+    let tools = fixtures.join("tools.json");
+    let expected = [
+        ("valid.zip", true),
+        ("truncated.zip", false),
+        ("checksum-mismatch.zip", false),
+        ("undeclared.zip", false),
+        ("missing.zip", false),
+        ("duplicate-case.zip", false),
+        ("absolute-path.zip", false),
+        ("parent-traversal.zip", false),
+        ("missing-tool.zip", false),
+        ("multi-error.zip", false),
+    ];
+    let mut reports: Vec<Report> = Vec::new();
+    let mut wrong = Vec::new();
+    for (name, should_be_ready) in expected {
+        let stage = staging.join(name.trim_end_matches(".zip"));
+        let report = preflight::check(&fixtures.join(name), &tools, Some(&stage));
+        if report.ready != should_be_ready {
+            wrong.push(name);
+        }
+        reports.push(report);
+    }
+    println!(
+        "{}",
+        serde_json::to_string_pretty(&reports).map_err(|error| error.to_string())?
+    );
+    if wrong.is_empty() {
+        Ok(())
+    } else {
+        Err(format!("unexpected classifications: {}", wrong.join(", ")))
+    }
+}
+
+fn usage() -> String {
+    "usage:\n  cnc-job-bundle-preflight generate-fixtures DIR [--include-huge]\n  cnc-job-bundle-preflight check BUNDLE --tools INVENTORY [--staging DIR]\n  cnc-job-bundle-preflight demo FIXTURE_DIR STAGING_ROOT"
+        .to_owned()
+}
diff --git a/developer-simulation/runs/2026-08-01--cnc-job-bundle-preflight/src/preflight.rs b/developer-simulation/runs/2026-08-01--cnc-job-bundle-preflight/src/preflight.rs
new file mode 100644
index 0000000..3b155eb
--- /dev/null
+++ b/developer-simulation/runs/2026-08-01--cnc-job-bundle-preflight/src/preflight.rs
@@ -0,0 +1,923 @@
+use std::collections::{BTreeMap, BTreeSet};
+use std::fs::{self, File, OpenOptions};
+use std::io::Write;
+use std::path::{Component, Path, PathBuf};
+use std::sync::atomic::{AtomicU64, Ordering};
+
+use serde::{Deserialize, Serialize};
+
+use crate::archive::{Archive, Entry};
+
+const MAX_FILES: usize = 1_000;
+const MAX_MANIFEST_BYTES: u64 = 1024 * 1024;
+const MAX_TOTAL_BYTES: u64 = 1024 * 1024 * 1024;
+const STREAM_BUFFER_BYTES: u64 = 64 * 1024;
+
+#[derive(Debug, Deserialize, Serialize)]
+#[serde(deny_unknown_fields)]
+pub struct Manifest {
+    pub version: u32,
+    pub files: Vec<FileDeclaration>,
+    pub entry_program: String,
+    pub required_tool_ids: Vec<String>,
+}
+
+#[derive(Debug, Clone, Deserialize, Serialize)]
+#[serde(deny_unknown_fields)]
+pub struct FileDeclaration {
+    pub path: String,
+    pub bytes: u64,
+    pub sha256: String,
+}
+
+#[derive(Debug, Deserialize, Serialize)]
+#[serde(deny_unknown_fields)]
+pub struct Inventory {
+    pub tool_ids: Vec<String>,
+}
+
+#[derive(Debug, Clone, Eq, Ord, PartialEq, PartialOrd, Serialize)]
+pub struct Diagnostic {
+    pub code: String,
+    pub path: String,
+    pub message: String,
+}
+
+#[derive(Debug, Default, Serialize)]
+pub struct Metrics {
+    pub archive_members: usize,
+    pub streamed_bytes: u64,
+    pub stream_buffer_bytes: u64,
+    pub total_member_bytes: u64,
+}
+
+#[derive(Debug, Serialize)]
+pub struct Report {
+    pub bundle: String,
+    pub ready: bool,
+    pub staged: Option<String>,
+    pub diagnostics: Vec<Diagnostic>,
+    pub metrics: Metrics,
+}
+
+struct LoadedManifest {
+    value: Manifest,
+    raw_sha256: String,
+}
+
+pub fn check(bundle: &Path, inventory_path: &Path, staging: Option<&Path>) -> Report {
+    let mut diagnostics = Vec::new();
+    let mut metrics = Metrics {
+        stream_buffer_bytes: STREAM_BUFFER_BYTES,
+        ..Metrics::default()
+    };
+    let inventory = load_inventory(inventory_path, &mut diagnostics);
+    let mut archive = match Archive::open(bundle) {
+        Ok(archive) => archive,
+        Err(error) => {
+            add(&mut diagnostics, "archive_invalid", "", &error.to_string());
+            diagnostics.sort();
+            return Report {
+                bundle: bundle.display().to_string(),
+                ready: false,
+                staged: None,
+                diagnostics,
+                metrics,
+            };
+        }
+    };
+    metrics.archive_members = archive.entries.len();
+    metrics.total_member_bytes = archive.entries.iter().map(|entry| entry.size).sum();
+
+    validate_archive_inventory(&archive.entries, &mut diagnostics);
+    if archive.entries.len().saturating_sub(1) > MAX_FILES {
+        add(
+            &mut diagnostics,
+            "archive_too_many_files",
+            "",
+            &format!("maximum is {MAX_FILES}"),
+        );
+    }
+    if metrics.total_member_bytes > MAX_TOTAL_BYTES {
+        add(
+            &mut diagnostics,
+            "archive_oversized",
+            "",
+            &format!(
+                "{} bytes exceeds {} byte policy",
+                metrics.total_member_bytes, MAX_TOTAL_BYTES
+            ),
+        );
+    }
+
+    let manifest_indexes: Vec<usize> = archive
+        .entries
+        .iter()
+        .enumerate()
+        .filter_map(|(index, entry)| (entry.name == "manifest.json").then_some(index))
+        .collect();
+    if manifest_indexes.is_empty() {
+        add(
+            &mut diagnostics,
+            "manifest_missing",
+            "manifest.json",
+            "exact root member is required",
+        );
+    } else if manifest_indexes.len() > 1 {
+        add(
+            &mut diagnostics,
+            "manifest_duplicate",
+            "manifest.json",
+            "manifest must occur exactly once",
+        );
+    }
+
+    let manifest = manifest_indexes.first().and_then(|&index| {
+        let entry = archive.entries[index].clone();
+        read_manifest(&mut archive, &entry, &mut diagnostics, &mut metrics)
+    });
+
+    if let Some(manifest) = &manifest {
+        validate_manifest(
+            &mut archive,
+            &manifest.value,
+            inventory.as_ref(),
+            &mut diagnostics,
+            &mut metrics,
+        );
+    }
+
+    diagnostics.sort();
+    diagnostics.dedup();
+    let mut staged = None;
+    if diagnostics.is_empty()
+        && let (Some(staging), Some(manifest)) = (staging, manifest.as_ref())
+    {
+        match stage(&mut archive, &manifest.value, &manifest.raw_sha256, staging) {
+            Ok(path) => staged = Some(path.display().to_string()),
+            Err(error) => add(&mut diagnostics, "staging_failed", "", &error.to_string()),
+        }
+    }
+    diagnostics.sort();
+    Report {
+        bundle: bundle.display().to_string(),
+        ready: diagnostics.is_empty(),
+        staged,
+        diagnostics,
+        metrics,
+    }
+}
+
+fn load_inventory(path: &Path, diagnostics: &mut Vec<Diagnostic>) -> Option<Inventory> {
+    match fs::read(path) {
+        Ok(bytes) => match serde_json::from_slice::<Inventory>(&bytes) {
+            Ok(inventory) => {
+                let mut seen = BTreeSet::new();
+                for tool in &inventory.tool_ids {
+                    if tool.is_empty() {
+                        add(
+                            diagnostics,
+                            "inventory_tool_id_empty",
+                            "",
+                            "tool IDs cannot be empty",
+                        );
+                    } else if !seen.insert(tool) {
+                        add(
+                            diagnostics,
+                            "inventory_tool_id_duplicate",
+                            tool,
+                            "tool ID occurs more than once",
+                        );
+                    }
+                }
+                Some(inventory)
+            }
+            Err(error) => {
+                add(diagnostics, "inventory_invalid", "", &error.to_string());
+                None
+            }
+        },
+        Err(error) => {
+            add(diagnostics, "inventory_unreadable", "", &error.to_string());
+            None
+        }
+    }
+}
+
+fn validate_archive_inventory(entries: &[Entry], diagnostics: &mut Vec<Diagnostic>) {
+    let mut exact: BTreeMap<&str, usize> = BTreeMap::new();
+    let mut folded: BTreeMap<String, Vec<&str>> = BTreeMap::new();
+    for entry in entries {
+        if let Err(reason) = safe_relative_path(&entry.name) {
+            add(diagnostics, "archive_path_unsafe", &entry.name, reason);
+        }
+        *exact.entry(&entry.name).or_default() += 1;
+        folded
+            .entry(entry.name.to_lowercase())
+            .or_default()
+            .push(&entry.name);
+        if entry.encrypted {
+            add(
+                diagnostics,
+                "archive_member_encrypted",
+                &entry.name,
+                "encrypted members are unsupported",
+            );
+        }
+        if entry.method != 0 || entry.compressed_size != entry.size {
+            add(
+                diagnostics,
+                "archive_compression_unsupported",
+                &entry.name,
+                "prototype requires stored members",
+            );
+        }
+    }
+    add_path_prefix_collisions(
+        exact.keys().copied(),
+        diagnostics,
+        "archive_path_type_collision",
+    );
+    for (path, count) in exact {
+        if count > 1 {
+            add(
+                diagnostics,
+                "archive_name_duplicate",
+                path,
+                "member name occurs more than once",
+            );
+        }
+    }
+    for names in folded.values_mut() {
+        names.sort_unstable();
+        names.dedup();
+        if names.len() > 1 {
+            add(
+                diagnostics,
+                "archive_name_case_collision",
+                &names.join(" | "),
+                "member names differ only by case",
+            );
+        }
+    }
+}
+
+fn read_manifest(
+    archive: &mut Archive,
+    entry: &Entry,
+    diagnostics: &mut Vec<Diagnostic>,
+    metrics: &mut Metrics,
+) -> Option<LoadedManifest> {
+    if entry.size > MAX_MANIFEST_BYTES {
+        add(
+            diagnostics,
+            "manifest_oversized",
+            "manifest.json",
+            "manifest exceeds 1 MiB",
+        );
+        return None;
+    }
+    let mut bytes = Vec::with_capacity(usize::try_from(entry.size).unwrap_or(0));
+    match archive.stream_entry(entry, Some(&mut bytes)) {
+        Ok(result) => {
+            metrics.streamed_bytes += result.bytes;
+            if result.crc32 != entry.crc32 {
+                add(
+                    diagnostics,
+                    "archive_crc_mismatch",
+                    "manifest.json",
+                    "ZIP CRC does not match content",
+                );
+            }
+            match serde_json::from_slice(&bytes) {
+                Ok(value) => Some(LoadedManifest {
+                    value,
+                    raw_sha256: result.sha256,
+                }),
+                Err(error) => {
+                    add(
+                        diagnostics,
+                        "manifest_invalid",
+                        "manifest.json",
+                        &error.to_string(),
+                    );
+                    None
+                }
+            }
+        }
+        Err(error) => {
+            add(
+                diagnostics,
+                "manifest_unreadable",
+                "manifest.json",
+                &error.to_string(),
+            );
+            None
+        }
+    }
+}
+
+#[allow(clippy::too_many_lines)]
+fn validate_manifest(
+    archive: &mut Archive,
+    manifest: &Manifest,
+    inventory: Option<&Inventory>,
+    diagnostics: &mut Vec<Diagnostic>,
+    metrics: &mut Metrics,
+) {
+    if manifest.version != 1 {
+        add(
+            diagnostics,
+            "manifest_version_unsupported",
+            "manifest.json",
+            "only version 1 is supported",
+        );
+    }
+    if manifest.files.len() > MAX_FILES {
+        add(
+            diagnostics,
+            "manifest_too_many_files",
+            "manifest.json",
+            &format!("maximum is {MAX_FILES}"),
+        );
+    }
+
+    let mut declarations: BTreeMap<&str, &FileDeclaration> = BTreeMap::new();
+    let mut folded: BTreeMap<String, Vec<&str>> = BTreeMap::new();
+    for declaration in &manifest.files {
+        if let Err(reason) = safe_relative_path(&declaration.path) {
+            add(
+                diagnostics,
+                "manifest_path_unsafe",
+                &declaration.path,
+                reason,
+            );
+        }
+        let allowed_extension = Path::new(&declaration.path)
+            .extension()
+            .is_some_and(|extension| {
+                extension.eq_ignore_ascii_case("nc") || extension.eq_ignore_ascii_case("gcode")
+            });
+        if !allowed_extension {
+            add(
+                diagnostics,
+                "manifest_extension_disallowed",
+                &declaration.path,
+                "program must end in .nc or .gcode",
+            );
+        }
+        if !valid_sha256(&declaration.sha256) {
+            add(
+                diagnostics,
+                "manifest_checksum_invalid",
+                &declaration.path,
+                "SHA-256 must be 64 lowercase hexadecimal characters",
+            );
+        }
+        if declarations
+            .insert(&declaration.path, declaration)
+            .is_some()
+        {
+            add(
+                diagnostics,
+                "manifest_path_duplicate",
+                &declaration.path,
+                "path is declared more than once",
+            );
+        }
+        folded
+            .entry(declaration.path.to_lowercase())
+            .or_default()
+            .push(&declaration.path);
+    }
+    for names in folded.values_mut() {
+        names.sort_unstable();
+        names.dedup();
+        if names.len() > 1 {
+            add(
+                diagnostics,
+                "manifest_path_case_collision",
+                &names.join(" | "),
+                "declared paths differ only by case",
+            );
+        }
+    }
+    add_path_prefix_collisions(
+        declarations.keys().copied(),
+        diagnostics,
+        "manifest_path_type_collision",
+    );
+
+    if safe_relative_path(&manifest.entry_program).is_err() {
+        add(
+            diagnostics,
+            "entry_program_path_unsafe",
+            &manifest.entry_program,
+            "entry program must be a safe relative path",
+        );
+    }
+    if !declarations.contains_key(manifest.entry_program.as_str()) {
+        add(
+            diagnostics,
+            "entry_program_undeclared",
+            &manifest.entry_program,
+            "entry program must be declared",
+        );
+    }
+
+    let archive_by_name: BTreeMap<&str, &Entry> = archive
+        .entries
+        .iter()
+        .filter(|entry| entry.name != "manifest.json")
+        .map(|entry| (entry.name.as_str(), entry))
+        .collect();
+    for path in declarations.keys() {
+        if !archive_by_name.contains_key(path) {
+            add(
+                diagnostics,
+                "declared_file_missing",
+                path,
+                "manifest path is absent from archive",
+            );
+        }
+    }
+    for path in archive_by_name.keys() {
+        if !declarations.contains_key(path) {
+            add(
+                diagnostics,
+                "archive_file_undeclared",
+                path,
+                "archive member is absent from manifest",
+            );
+        }
+    }
+
+    if let Some(inventory) = inventory {
+        let available: BTreeSet<&str> = inventory.tool_ids.iter().map(String::as_str).collect();
+        let mut requested = BTreeSet::new();
+        for tool in &manifest.required_tool_ids {
+            if tool.is_empty() {
+                add(
+                    diagnostics,
+                    "manifest_tool_id_empty",
+                    "",
+                    "required tool IDs cannot be empty",
+                );
+            } else if !requested.insert(tool) {
+                add(
+                    diagnostics,
+                    "manifest_tool_id_duplicate",
+                    tool,
+                    "required tool ID occurs more than once",
+                );
+            }
+            if !available.contains(tool.as_str()) {
+                add(
+                    diagnostics,
+                    "required_tool_missing",
+                    tool,
+                    "tool ID is absent from inventory",
+                );
+            }
+        }
+    }
+
+    let declared_entries: Vec<(FileDeclaration, Entry)> = manifest
+        .files
+        .iter()
+        .filter_map(|declaration| {
+            archive_by_name
+                .get(declaration.path.as_str())
+                .map(|entry| (declaration.clone(), (*entry).clone()))
+        })
+        .collect();
+    for (declaration, entry) in declared_entries {
+        if declaration.bytes != entry.size {
+            add(
+                diagnostics,
+                "declared_size_mismatch",
+                &declaration.path,
+                &format!(
+                    "manifest says {} bytes; ZIP says {}",
+                    declaration.bytes, entry.size
+                ),
+            );
+        }
+        match archive.stream_entry::<File>(&entry, None) {
+            Ok(result) => {
+                metrics.streamed_bytes += result.bytes;
+                if result.bytes != declaration.bytes {
+                    add(
+                        diagnostics,
+                        "content_size_mismatch",
+                        &declaration.path,
+                        &format!(
+                            "manifest says {} bytes; streamed {}",
+                            declaration.bytes, result.bytes
+                        ),
+                    );
+                }
+                if result.sha256 != declaration.sha256 {
+                    add(
+                        diagnostics,
+                        "checksum_mismatch",
+                        &declaration.path,
+                        &format!("expected {}; got {}", declaration.sha256, result.sha256),
+                    );
+                }
+                if result.crc32 != entry.crc32 {
+                    add(
+                        diagnostics,
+                        "archive_crc_mismatch",
+                        &declaration.path,
+                        "ZIP CRC does not match content",
+                    );
+                }
+            }
+            Err(error) => add(
+                diagnostics,
+                "member_unreadable",
+                &declaration.path,
+                &error.to_string(),
+            ),
+        }
+    }
+}
+
+fn stage(
+    archive: &mut Archive,
+    manifest: &Manifest,
+    manifest_sha256: &str,
+    staging: &Path,
+) -> std::io::Result<PathBuf> {
+    if staging.exists() {
+        let metadata = fs::symlink_metadata(staging)?;
+        if metadata.file_type().is_symlink() || !metadata.is_dir() {
+            return Err(std::io::Error::other(
+                "selected staging root must be a real directory",
+            ));
+        }
+    } else {
+        fs::create_dir(staging)?;
+    }
+    let ready = staging.join("ready");
+    match fs::symlink_metadata(&ready) {
+        Ok(_) => {
+            return Err(std::io::Error::new(
+                std::io::ErrorKind::AlreadyExists,
+                "ready destination already exists",
+            ));
+        }
+        Err(error) if error.kind() == std::io::ErrorKind::NotFound => {}
+        Err(error) => return Err(error),
+    }
+
+    let pending = create_pending_directory(staging)?;
+    let copy_result = stage_into(archive, manifest, manifest_sha256, &pending);
+    if let Err(error) = copy_result {
+        let _ = fs::remove_dir_all(&pending);
+        return Err(error);
+    }
+    if let Err(error) = fs::rename(&pending, &ready) {
+        let _ = fs::remove_dir_all(&pending);
+        return Err(error);
+    }
+    Ok(ready)
+}
+
+fn stage_into(
+    archive: &mut Archive,
+    manifest: &Manifest,
+    manifest_sha256: &str,
+    pending: &Path,
+) -> std::io::Result<()> {
+    let declarations: BTreeMap<&str, &FileDeclaration> = manifest
+        .files
+        .iter()
+        .map(|declaration| (declaration.path.as_str(), declaration))
+        .collect();
+    let entries = archive.entries.clone();
+    for entry in entries {
+        let relative = safe_relative_path(&entry.name).map_err(std::io::Error::other)?;
+        let destination = pending.join(&relative);
+        if !destination.starts_with(pending) {
+            return Err(std::io::Error::other("destination escaped staging"));
+        }
+        if let Some(parent) = destination.parent() {
+            create_safe_directories(pending, parent)?;
+        }
+        let mut file = OpenOptions::new()
+            .write(true)
+            .create_new(true)
+            .open(&destination)?;
+        let copied = archive.stream_entry(&entry, Some(&mut file))?;
+        file.flush()?;
+        file.sync_all()?;
+
+        if copied.bytes != entry.size || copied.crc32 != entry.crc32 {
+            return Err(std::io::Error::other(format!(
+                "copied content changed for {:?}",
+                entry.name
+            )));
+        }
+        let expected_sha256 = if entry.name == "manifest.json" {
+            manifest_sha256
+        } else {
+            declarations
+                .get(entry.name.as_str())
+                .ok_or_else(|| std::io::Error::other("staging member was not declared"))?
+                .sha256
+                .as_str()
+        };
+        if copied.sha256 != expected_sha256 {
+            return Err(std::io::Error::other(format!(
+                "copied content changed for {:?}",
+                entry.name
+            )));
+        }
+    }
+    Ok(())
+}
+
+fn create_pending_directory(staging: &Path) -> std::io::Result<PathBuf> {
+    static NEXT_PENDING: AtomicU64 = AtomicU64::new(0);
+    for _ in 0..100 {
+        let sequence = NEXT_PENDING.fetch_add(1, Ordering::Relaxed);
+        let pending = staging.join(format!(".ready.pending-{}-{sequence}", std::process::id()));
+        match fs::create_dir(&pending) {
+            Ok(()) => return Ok(pending),
+            Err(error) if error.kind() == std::io::ErrorKind::AlreadyExists => {}
+            Err(error) => return Err(error),
+        }
+    }
+    Err(std::io::Error::other(
+        "could not allocate a temporary staging directory",
+    ))
+}
+
+fn create_safe_directories(root: &Path, parent: &Path) -> std::io::Result<()> {
+    let relative = parent
+        .strip_prefix(root)
+        .map_err(|_| std::io::Error::other("parent escaped staging"))?;
+    let mut current = root.to_path_buf();
+    for component in relative.components() {
+        current.push(component);
+        match fs::symlink_metadata(&current) {
+            Ok(metadata) => {
+                if metadata.file_type().is_symlink() || !metadata.is_dir() {
+                    return Err(std::io::Error::other(
+                        "staging path contains a non-directory or symlink",
+                    ));
+                }
+            }
+            Err(error) if error.kind() == std::io::ErrorKind::NotFound => {
+                fs::create_dir(&current)?;
+            }
+            Err(error) => return Err(error),
+        }
+    }
+    Ok(())
+}
+
+pub fn safe_relative_path(path: &str) -> Result<PathBuf, &'static str> {
+    if path.is_empty() {
+        return Err("path is empty");
+    }
+    if path.contains('\\') {
+        return Err("backslash separators are forbidden");
+    }
+    if path.contains('\0') {
+        return Err("NUL bytes are forbidden");
+    }
+    if path.starts_with('/') || path.starts_with("//") {
+        return Err("absolute paths are forbidden");
+    }
+    let bytes = path.as_bytes();
+    if bytes.len() >= 2 && bytes[0].is_ascii_alphabetic() && bytes[1] == b':' {
+        return Err("drive-prefixed paths are forbidden");
+    }
+    let candidate = Path::new(path);
+    let mut output = PathBuf::new();
+    for component in candidate.components() {
+        match component {
+            Component::Normal(value) => output.push(value),
+            Component::ParentDir => return Err("parent traversal is forbidden"),
+            Component::CurDir => return Err("dot segments are forbidden"),
+            Component::RootDir | Component::Prefix(_) => {
+                return Err("absolute paths are forbidden");
+            }
+        }
+    }
+    if path.split('/').any(str::is_empty) {
+        return Err("empty path segments are forbidden");
+    }
+    Ok(output)
+}
+
+fn valid_sha256(value: &str) -> bool {
+    value.len() == 64
+        && value
+            .bytes()
+            .all(|byte| byte.is_ascii_digit() || (b'a'..=b'f').contains(&byte))
+}
+
+fn add_path_prefix_collisions<'a>(
+    paths: impl IntoIterator<Item = &'a str>,
+    diagnostics: &mut Vec<Diagnostic>,
+    code: &str,
+) {
+    let paths: BTreeSet<&str> = paths.into_iter().collect();
+    for path in &paths {
+        for (index, byte) in path.bytes().enumerate() {
+            if byte == b'/' {
+                let parent = &path[..index];
+                if paths.contains(parent) {
+                    add(
+                        diagnostics,
+                        code,
+                        &format!("{parent} | {path}"),
+                        "one file path is also the parent of another file path",
+                    );
+                }
+            }
+        }
+    }
+}
+
+fn add(diagnostics: &mut Vec<Diagnostic>, code: &str, path: &str, message: &str) {
+    diagnostics.push(Diagnostic {
+        code: code.to_owned(),
+        path: path.to_owned(),
+        message: message.to_owned(),
+    });
+}
+
+#[cfg(test)]
+mod tests {
+    use std::fs::{self, OpenOptions};
+    use std::io::{Seek, SeekFrom, Write};
+    use std::path::{Path, PathBuf};
+    use std::time::{SystemTime, UNIX_EPOCH};
+
+    use super::{FileDeclaration, Manifest, add_path_prefix_collisions, safe_relative_path, stage};
+    use crate::archive::{Archive, Writer};
+    use crate::sha256::{Sha256, hex};
+
+    #[test]
+    fn accepts_safe_program_path() {
+        assert!(safe_relative_path("programs/job.nc").is_ok());
+    }
+
+    #[test]
+    fn rejects_escape_forms() {
+        for path in [
+            "/etc/passwd",
+            "../escape.nc",
+            "a/../../escape.nc",
+            "C:/escape.nc",
+            r"..\escape.nc",
+            "a//b.nc",
+            "./job.nc",
+        ] {
+            assert!(safe_relative_path(path).is_err(), "accepted {path:?}");
+        }
+    }
+
+    #[test]
+    fn reports_file_and_parent_path_collisions() {
+        let mut diagnostics = Vec::new();
+        add_path_prefix_collisions(
+            ["programs/job.nc", "programs/job.nc/child.nc"],
+            &mut diagnostics,
+            "path_type_collision",
+        );
+        assert_eq!(diagnostics.len(), 1);
+        assert_eq!(diagnostics[0].code, "path_type_collision");
+    }
+
+    #[test]
+    fn late_copy_failure_leaves_no_ready_or_pending_directory() {
+        let root = temporary_directory("late-copy");
+        let bundle = root.join("bundle.zip");
+        let staging = root.join("staging");
+        let first = b"%\nM30\n";
+        let second = b"%\nM31\n";
+        let manifest = Manifest {
+            version: 1,
+            files: vec![
+                declaration("programs/job.nc", first),
+                declaration("programs/job.nc/child.nc", second),
+            ],
+            entry_program: "programs/job.nc".to_owned(),
+            required_tool_ids: Vec::new(),
+        };
+        let manifest_sha256 = write_bundle(
+            &bundle,
+            &manifest,
+            &[
+                ("programs/job.nc", first.as_slice()),
+                ("programs/job.nc/child.nc", second.as_slice()),
+            ],
+        );
+        let mut archive = Archive::open(&bundle).expect("open generated bundle");
+
+        let error = stage(&mut archive, &manifest, &manifest_sha256, &staging)
+            .expect_err("copy conflict must fail");
+        assert!(!error.to_string().is_empty());
+        assert!(!staging.join("ready").exists());
+        assert_eq!(
+            fs::read_dir(&staging).expect("read staging root").count(),
+            0
+        );
+        fs::remove_dir_all(&root).expect("remove test directory");
+    }
+
+    #[test]
+    fn copied_content_is_rechecked_before_ready_is_named() {
+        let root = temporary_directory("copy-recheck");
+        let bundle = root.join("bundle.zip");
+        let staging = root.join("staging");
+        let original = b"%\nM30\n";
+        let replacement = b"%\nM31\n";
+        let manifest = Manifest {
+            version: 1,
+            files: vec![declaration("programs/job.nc", original)],
+            entry_program: "programs/job.nc".to_owned(),
+            required_tool_ids: Vec::new(),
+        };
+        let manifest_sha256 = write_bundle(
+            &bundle,
+            &manifest,
+            &[("programs/job.nc", original.as_slice())],
+        );
+        let mut archive = Archive::open(&bundle).expect("open generated bundle");
+        let data_offset = archive
+            .entries
+            .iter()
+            .find(|entry| entry.name == "programs/job.nc")
+            .expect("program entry")
+            .data_offset;
+        let mut source = OpenOptions::new()
+            .write(true)
+            .open(&bundle)
+            .expect("open bundle for ordinary update");
+        source
+            .seek(SeekFrom::Start(data_offset))
+            .expect("seek to program data");
+        source
+            .write_all(replacement)
+            .expect("replace program bytes");
+        source.flush().expect("flush replacement");
+
+        let error = stage(&mut archive, &manifest, &manifest_sha256, &staging)
+            .expect_err("changed copy must fail");
+        assert!(error.to_string().contains("copied content changed"));
+        assert!(!staging.join("ready").exists());
+        assert_eq!(
+            fs::read_dir(&staging).expect("read staging root").count(),
+            0
+        );
+        fs::remove_dir_all(&root).expect("remove test directory");
+    }
+
+    fn temporary_directory(label: &str) -> PathBuf {
+        let nonce = SystemTime::now()
+            .duration_since(UNIX_EPOCH)
+            .expect("clock after epoch")
+            .as_nanos();
+        let path = std::env::temp_dir().join(format!(
+            "cnc-job-bundle-preflight-{label}-{}-{nonce}",
+            std::process::id()
+        ));
+        fs::create_dir(&path).expect("create test directory");
+        path
+    }
+
+    fn declaration(path: &str, data: &[u8]) -> FileDeclaration {
+        FileDeclaration {
+            path: path.to_owned(),
+            bytes: data.len() as u64,
+            sha256: digest(data),
+        }
+    }
+
+    fn digest(data: &[u8]) -> String {
+        let mut sha = Sha256::new();
+        sha.update(data);
+        hex(&sha.finish())
+    }
+
+    fn write_bundle(path: &Path, manifest: &Manifest, members: &[(&str, &[u8])]) -> String {
+        let manifest_bytes = serde_json::to_vec(manifest).expect("serialize manifest");
+        let manifest_sha256 = digest(&manifest_bytes);
+        let mut writer = Writer::create(path).expect("create bundle");
+        writer
+            .member("manifest.json", &manifest_bytes)
+            .expect("write manifest");
+        for (name, data) in members {
+            writer.member(name, data).expect("write member");
+        }
+        writer.finish().expect("finish bundle");
+        manifest_sha256
+    }
+}
diff --git a/developer-simulation/runs/2026-08-01--cnc-job-bundle-preflight/src/sha256.rs b/developer-simulation/runs/2026-08-01--cnc-job-bundle-preflight/src/sha256.rs
new file mode 100644
index 0000000..c44d391
--- /dev/null
+++ b/developer-simulation/runs/2026-08-01--cnc-job-bundle-preflight/src/sha256.rs
@@ -0,0 +1,211 @@
+//! Small streaming SHA-256 implementation used to keep the prototype offline.
+
+pub struct Sha256 {
+    state: [u32; 8],
+    buffer: [u8; 64],
+    buffered: usize,
+    bytes: u64,
+}
+
+const INITIAL: [u32; 8] = [
+    0x6a09_e667,
+    0xbb67_ae85,
+    0x3c6e_f372,
+    0xa54f_f53a,
+    0x510e_527f,
+    0x9b05_688c,
+    0x1f83_d9ab,
+    0x5be0_cd19,
+];
+
+const K: [u32; 64] = [
+    0x428a_2f98,
+    0x7137_4491,
+    0xb5c0_fbcf,
+    0xe9b5_dba5,
+    0x3956_c25b,
+    0x59f1_11f1,
+    0x923f_82a4,
+    0xab1c_5ed5,
+    0xd807_aa98,
+    0x1283_5b01,
+    0x2431_85be,
+    0x550c_7dc3,
+    0x72be_5d74,
+    0x80de_b1fe,
+    0x9bdc_06a7,
+    0xc19b_f174,
+    0xe49b_69c1,
+    0xefbe_4786,
+    0x0fc1_9dc6,
+    0x240c_a1cc,
+    0x2de9_2c6f,
+    0x4a74_84aa,
+    0x5cb0_a9dc,
+    0x76f9_88da,
+    0x983e_5152,
+    0xa831_c66d,
+    0xb003_27c8,
+    0xbf59_7fc7,
+    0xc6e0_0bf3,
+    0xd5a7_9147,
+    0x06ca_6351,
+    0x1429_2967,
+    0x27b7_0a85,
+    0x2e1b_2138,
+    0x4d2c_6dfc,
+    0x5338_0d13,
+    0x650a_7354,
+    0x766a_0abb,
+    0x81c2_c92e,
+    0x9272_2c85,
+    0xa2bf_e8a1,
+    0xa81a_664b,
+    0xc24b_8b70,
+    0xc76c_51a3,
+    0xd192_e819,
+    0xd699_0624,
+    0xf40e_3585,
+    0x106a_a070,
+    0x19a4_c116,
+    0x1e37_6c08,
+    0x2748_774c,
+    0x34b0_bcb5,
+    0x391c_0cb3,
+    0x4ed8_aa4a,
+    0x5b9c_ca4f,
+    0x682e_6ff3,
+    0x748f_82ee,
+    0x78a5_636f,
+    0x84c8_7814,
+    0x8cc7_0208,
+    0x90be_fffa,
+    0xa450_6ceb,
+    0xbef9_a3f7,
+    0xc671_78f2,
+];
+
+impl Sha256 {
+    pub fn new() -> Self {
+        Self {
+            state: INITIAL,
+            buffer: [0; 64],
+            buffered: 0,
+            bytes: 0,
+        }
+    }
+
+    pub fn update(&mut self, mut input: &[u8]) {
+        self.bytes = self.bytes.saturating_add(input.len() as u64);
+        if self.buffered != 0 {
+            let amount = (64 - self.buffered).min(input.len());
+            self.buffer[self.buffered..self.buffered + amount].copy_from_slice(&input[..amount]);
+            self.buffered += amount;
+            input = &input[amount..];
+            if self.buffered == 64 {
+                let block = self.buffer;
+                self.compress(&block);
+                self.buffered = 0;
+            }
+        }
+        while input.len() >= 64 {
+            let (block, rest) = input.split_at(64);
+            self.compress(block.try_into().expect("64-byte chunk"));
+            input = rest;
+        }
+        self.buffer[..input.len()].copy_from_slice(input);
+        self.buffered = input.len();
+    }
+
+    pub fn finish(mut self) -> [u8; 32] {
+        let bit_len = self.bytes.wrapping_mul(8);
+        self.buffer[self.buffered] = 0x80;
+        self.buffered += 1;
+        if self.buffered > 56 {
+            self.buffer[self.buffered..].fill(0);
+            let block = self.buffer;
+            self.compress(&block);
+            self.buffered = 0;
+        }
+        self.buffer[self.buffered..56].fill(0);
+        self.buffer[56..].copy_from_slice(&bit_len.to_be_bytes());
+        let block = self.buffer;
+        self.compress(&block);
+
+        let mut output = [0; 32];
+        for (chunk, word) in output.chunks_exact_mut(4).zip(self.state) {
+            chunk.copy_from_slice(&word.to_be_bytes());
+        }
+        output
+    }
+
+    #[allow(clippy::many_single_char_names)]
+    fn compress(&mut self, block: &[u8; 64]) {
+        let mut schedule = [0_u32; 64];
+        for (word, chunk) in schedule[..16].iter_mut().zip(block.chunks_exact(4)) {
+            *word = u32::from_be_bytes(chunk.try_into().expect("4-byte chunk"));
+        }
+        for i in 16..64 {
+            let s0 = schedule[i - 15].rotate_right(7)
+                ^ schedule[i - 15].rotate_right(18)
+                ^ (schedule[i - 15] >> 3);
+            let s1 = schedule[i - 2].rotate_right(17)
+                ^ schedule[i - 2].rotate_right(19)
+                ^ (schedule[i - 2] >> 10);
+            schedule[i] = schedule[i - 16]
+                .wrapping_add(s0)
+                .wrapping_add(schedule[i - 7])
+                .wrapping_add(s1);
+        }
+
+        let [mut a, mut b, mut c, mut d, mut e, mut f, mut g, mut h] = self.state;
+        for (&constant, &word) in K.iter().zip(&schedule) {
+            let upper = e.rotate_right(6) ^ e.rotate_right(11) ^ e.rotate_right(25);
+            let choice = (e & f) ^ ((!e) & g);
+            let first = h
+                .wrapping_add(upper)
+                .wrapping_add(choice)
+                .wrapping_add(constant)
+                .wrapping_add(word);
+            let lower = a.rotate_right(2) ^ a.rotate_right(13) ^ a.rotate_right(22);
+            let majority = (a & b) ^ (a & c) ^ (b & c);
+            let second = lower.wrapping_add(majority);
+            h = g;
+            g = f;
+            f = e;
+            e = d.wrapping_add(first);
+            d = c;
+            c = b;
+            b = a;
+            a = first.wrapping_add(second);
+        }
+        for (state, value) in self.state.iter_mut().zip([a, b, c, d, e, f, g, h]) {
+            *state = state.wrapping_add(value);
+        }
+    }
+}
+
+pub fn hex(bytes: &[u8]) -> String {
+    const DIGITS: &[u8; 16] = b"0123456789abcdef";
+    let mut output = String::with_capacity(bytes.len() * 2);
+    for &byte in bytes {
+        output.push(char::from(DIGITS[usize::from(byte >> 4)]));
+        output.push(char::from(DIGITS[usize::from(byte & 0x0f)]));
+    }
+    output
+}
+
+#[cfg(test)]
+mod tests {
+    use super::{Sha256, hex};
+
+    #[test]
+    fn known_vector() {
+        let mut hash = Sha256::new();
+        hash.update(b"abc");
+        assert_eq!(
+            hex(&hash.finish()),
+            "ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad"
+        );
+    }
+}
diff --git a/developer-simulation/runs/2026-08-01--offline-flag-parity/Cargo.toml b/developer-simulation/runs/2026-08-01--offline-flag-parity/Cargo.toml
new file mode 100644
index 0000000..121c85d
--- /dev/null
+++ b/developer-simulation/runs/2026-08-01--offline-flag-parity/Cargo.toml
@@ -0,0 +1,9 @@
+[package]
+name = "offline-flag-parity"
+version = "0.1.0"
+edition.workspace = true
+publish.workspace = true
+
+[dependencies]
+serde = { version = "1", features = ["derive"] }
+serde_json = "1"
diff --git a/developer-simulation/runs/2026-08-01--offline-flag-parity/EVIDENCE.md b/developer-simulation/runs/2026-08-01--offline-flag-parity/EVIDENCE.md
new file mode 100644
index 0000000..d64ee43
--- /dev/null
+++ b/developer-simulation/runs/2026-08-01--offline-flag-parity/EVIDENCE.md
@@ -0,0 +1,394 @@
+# Offline Flag Parity Trial Report
+
+Run date: 2026-08-01 EDT
+Persona: client-platform SDK developer, production TypeScript experience, Rust beginner
+Sanitized checkout: `/private/tmp/bogkit-2026-08-01-trial-a.AF7gv4`
+Prototype: `/private/tmp/bogkit-2026-08-01-trial-a.AF7gv4/trial-output/offline-flag-parity`
+
+## Outcome
+
+**Runnable prototype; BogKit no-fit for this bounded workload.**
+
+The direct baseline—validate a complete JSON candidate, then atomically replace
+one immutable in-memory snapshot—was smaller and more directly aligned than a
+durable incremental database. I therefore used no BogKit crate and did not edit
+BogKit core or its examples.
+
+The prototype met the trial's measured checks:
+
+- 250 stored golden decisions matched in Rust and in a dependency-free
+  TypeScript-style JavaScript reference evaluator.
+- Reversing every JSON object's key order left all 250 decisions and full
+  explanations unchanged in both evaluators.
+- All 12 malformed fixtures were rejected. A bad reload left the last good
+  in-memory snapshot and its decisions unchanged.
+- Ten fresh CLI processes produced the one fingerprint `99c04dd07bb96094`.
+- Four clean release benchmark processes each ran five 20,000-evaluation
+  batches against 5,000 flags and 50,000 rules. Across the 20 batches, p95 was
+  1.000–1.333 microseconds; all were below 250 microseconds.
+- The highest sampled same-size reload RSS across the developer and
+  post-review runs for the generated 6.2 MB, 5,000-flag/50,000-rule workload
+  was 63,569,920 bytes, below the
+  67,108,864-byte (64 MiB) ceiling. This is a sampled process-level
+  measurement for that workload, not a guarantee for every accepted file or a
+  proof that no shorter spike occurred.
+
+## Brief
+
+Build a local library and CLI that loads generated JSON flag snapshots,
+evaluates ordered rules against flat scalar contexts without network access,
+records a rule-level explanation, retains the active configuration after a bad
+reload, uses stable percentage assignment across machines and restarts, and
+demonstrates correctness and speed with synthetic fixtures.
+
+Target workload: up to 5,000 flags, 50,000 rules, and about 100,000 evaluations
+per minute within 64 MiB working memory. Non-goals were authoring, delivery,
+analytics, UI, authentication, and commercial-format compatibility.
+
+## Ordered discovery, friction, and debugging trail
+
+1. Read only the public root `README.md`. It presented Fold as a durable,
+   transactional incremental-programming framework, ESE as static embeddings,
+   ANNy as nearest-neighbor search, and four public examples.
+2. Listed public example files, then read them in this order: `chat`, `search`,
+   `starter`, `timeseries` (each manifest followed by its `src/main.rs`). The
+   examples showed transactional writes, persistent sinks, consistent reads,
+   and incremental aggregation/search. None showed configuration admission or
+   an immutable hot-path rules evaluator.
+3. Before inspecting any BogKit implementation, defined the concrete baseline:
+   parse a candidate snapshot completely; reject syntax, duplicate keys,
+   unknown fields, invalid limits, and invalid rule semantics; retain the
+   current `Arc<Snapshot>` until validation succeeds; evaluate rule arrays in
+   order; use a specified stable hash rather than a process-randomized map hash;
+   and return the trace of every visited rule.
+4. Inspected the root workspace manifest, Fold manifest, and the Fold stream
+   transaction/snapshot API. Compared those capabilities with the baseline.
+   Fold can atomically update durable materialized views, but it does not remove
+   the need to parse and validate the entire candidate before activation. A
+   database on the evaluation path would add files, lifecycle work, and memory
+   without improving this prototype's decision lookup.
+5. Chose no BogKit component. Added an independent Cargo package under
+   `trial-output/offline-flag-parity` with its own empty `[workspace]` table, so
+   no parent-workspace edit or membership was needed.
+6. Implemented the Rust library and CLI. The first ordinary `cargo test` tried
+   to update the crates.io index and failed because DNS/network was unavailable.
+   Re-running with `--offline` used cached dependencies and succeeded. All
+   subsequent Cargo evidence commands used `--offline` where dependency
+   resolution was involved.
+7. The first fixed-bucket unit test contained my incorrect expected number
+   (`7452`). The Rust implementation returned `7307`. I did not accept that
+   value only because the implementation produced it: an independent Node
+   `BigInt` FNV-1a calculation also returned `7307`, after which the fixed known
+   vector was corrected.
+8. Strict Clippy initially found two manual modulo expressions. Replaced them
+   with the standard `is_multiple_of` form and reran formatting and Clippy.
+9. Generated 250 golden contexts, a normal snapshot, a recursively
+   reverse-object-key-order snapshot, good/bad reloads, and 12 malformed
+   snapshots. Rust verification passed all fixtures.
+10. The first full benchmark built, serialized, and loaded the 50,000-rule
+    snapshot inside one process. macOS retained temporary generator allocations,
+    and sampled RSS reached 146,587,648 bytes, failing the 64 MiB requirement.
+    This was treated as a real failure, not reported as a passing evaluator.
+11. Changed duplicate-key validation from a retained generic JSON tree to a
+    streaming preflight, followed by direct typed deserialization. Separated the
+    deterministic large-fixture generator into its own CLI process. The clean
+    benchmark process then loaded an existing snapshot and performed a
+    same-size reload while the old snapshot remained active.
+12. The sandbox blocked `/bin/ps` and made `/usr/bin/time -l` fail its macOS
+    system query. The final benchmark was run with read-only access to its own
+    process statistics. Four clean runs passed latency and sampled RSS limits.
+13. Added and ran a dependency-free TypeScript-style reference evaluator. It
+    independently matched all 250 Rust golden decisions, their explanations,
+    reordered-object results, and the known bucket vector.
+14. Preserved the small 276 KiB fixture corpus in the prototype, reran ten fresh
+    process fingerprints, and began the final validation sweep.
+15. Skeptical review rejected the broad memory wording: a 48 MiB policy did not
+    follow from the measured 6.2 MB workload, and `fs::read` could allocate an
+    entire oversized input before enforcing the cap. The coordinator changed
+    file loading to read at most 8 MiB plus one byte, added a sparse-file
+    regression, and limited the 64 MiB statement to the measured workload.
+
+## Concrete baseline and comparison
+
+The baseline is the shape a small TypeScript SDK would normally use:
+
+1. Parse JSON into a candidate object.
+2. Validate the complete candidate without mutating live state.
+3. Swap the active immutable reference only on success.
+4. Look up a flag by key and walk its ordered rule array.
+5. Hash `salt`, flag key, rule id, and a typed user attribute with one published
+   algorithm for percentage rules.
+6. Return the selected value plus every visited rule's result.
+
+| Concern | Direct immutable baseline | Fold comparison | Decision |
+| --- | --- | --- | --- |
+| Malformed snapshot admission | Parse and validate before swap | A database transaction starts after parsing; it does not validate JSON by itself | Baseline fits directly |
+| Failed reload | Candidate error leaves active `Arc` untouched | Could make storage writes atomic, but still needs an admission layer | Baseline is smaller |
+| Offline evaluation | In-memory key lookup and short ordered scan | Durable reads are available but unnecessary on each decision | Baseline is faster/simpler |
+| Restart-stable percentage | Explicit local FNV-1a 64 specification | Not a database concern | Baseline owns it |
+| Durable derived views | Not needed by the brief | Strong Fold fit | Non-goal |
+| Persistent last-known-good after process exit | Snapshot file remains an external responsibility | Fold could help if this becomes a requirement | Unresolved product boundary |
+
+The JavaScript reference is at
+`baseline/reference-evaluator.mjs`. It provides concrete evidence that the Rust
+rule and hashing semantics can match a TypeScript-style client. It is not a
+claim of compatibility with an unspecified production evaluator.
+
+## Prototype contents
+
+- `src/lib.rs`: strict loader, semantic validation, immutable evaluator,
+  atomic reload, ordered-rule evaluation, stable bucketing, explanations, and
+  active-snapshot memory estimate.
+- `src/main.rs`: fixture generation, NDJSON evaluation, demo, verification,
+  fresh-process fingerprint, large deterministic snapshot generation, and
+  repeated benchmark.
+- `baseline/reference-evaluator.mjs`: independent TypeScript-style reference.
+- `fixtures/`: 250 contexts and golden cases, normal/reordered snapshots,
+  good/bad reloads, and 12 malformed cases.
+- `Cargo.lock`: exact cached dependency resolution.
+
+No BogKit path dependency is present because no BogKit component fit the
+bounded problem. The package uses cached `serde` and `serde_json` only.
+
+## Exact evidence
+
+Environment:
+
+```console
+$ rustc --version
+rustc 1.95.0 (59807616e 2026-04-14)
+$ cargo --version
+cargo 1.95.0 (f2d3ce0bd 2026-03-21)
+$ uname -a
+Darwin violaceae 25.5.0 Darwin Kernel Version 25.5.0: Tue Jun  9 22:28:34 PDT 2026; root:xnu-12377.121.10~1/RELEASE_ARM64_T6041 arm64
+```
+
+All commands below were run from
+`/private/tmp/bogkit-2026-08-01-trial-a.AF7gv4` with build output at
+`/private/tmp/offline-flag-parity-target`.
+
+Formatting:
+
+```console
+$ cargo fmt --manifest-path trial-output/offline-flag-parity/Cargo.toml -- --check
+# exit 0, no output
+```
+
+Tests:
+
+```console
+$ CARGO_TARGET_DIR=/private/tmp/offline-flag-parity-target cargo test --offline --manifest-path trial-output/offline-flag-parity/Cargo.toml
+running 4 tests
+test tests::bucket_has_a_fixed_known_value ... ok
+test tests::duplicate_json_keys_are_rejected ... ok
+test tests::failed_reload_keeps_active_snapshot ... ok
+test tests::file_reader_stops_at_the_snapshot_limit ... ok
+test result: ok. 4 passed; 0 failed
+# main tests: 0 passed; doc tests: 0 passed; command exit 0
+```
+
+Strict lint:
+
+```console
+$ CARGO_TARGET_DIR=/private/tmp/offline-flag-parity-target cargo clippy --offline --manifest-path trial-output/offline-flag-parity/Cargo.toml --all-targets -- -D warnings
+Finished `dev` profile ...
+# exit 0
+```
+
+Fixture generation and Rust verification:
+
+```console
+$ /private/tmp/offline-flag-parity-target/release/offline-flag-parity generate trial-output/offline-flag-parity/fixtures
+generated snapshot, reordered snapshot, 250 NDJSON contexts/golden cases, reload fixtures, and 12 malformed snapshots in trial-output/offline-flag-parity/fixtures
+
+$ /private/tmp/offline-flag-parity-target/release/offline-flag-parity verify trial-output/offline-flag-parity/fixtures
+verified 250 golden cases; object ordering invariant; 12 malformed snapshots rejected; good reload true -> false; bad reload preserved false
+```
+
+The `true -> false` line is an intentional good-reload behavior change for the
+first context. The subsequent bad reload kept `demo-v2` and the same `false`
+decision.
+
+Independent TypeScript-style comparison:
+
+```console
+$ node trial-output/offline-flag-parity/baseline/reference-evaluator.mjs trial-output/offline-flag-parity/fixtures
+TypeScript-style reference matched 250 golden cases and reordered-object decisions; known bucket=7307
+```
+
+NDJSON CLI:
+
+```console
+$ /private/tmp/offline-flag-parity-target/release/offline-flag-parity eval trial-output/offline-flag-parity/fixtures/snapshot.json trial-output/offline-flag-parity/fixtures/contexts.ndjson > /private/tmp/offline-flag-parity-eval-output.ndjson
+$ wc -l /private/tmp/offline-flag-parity-eval-output.ndjson
+250 /private/tmp/offline-flag-parity-eval-output.ndjson
+```
+
+Ten fresh-process restart check:
+
+```console
+$ for i in 1 2 3 4 5 6 7 8 9 10; do /private/tmp/offline-flag-parity-target/release/offline-flag-parity fingerprint trial-output/offline-flag-parity/fixtures; done > /private/tmp/offline-flag-parity-final-restarts.txt
+$ wc -l /private/tmp/offline-flag-parity-final-restarts.txt
+10 /private/tmp/offline-flag-parity-final-restarts.txt
+$ sort -u /private/tmp/offline-flag-parity-final-restarts.txt
+99c04dd07bb96094
+$ sort -u /private/tmp/offline-flag-parity-final-restarts.txt | wc -l
+1
+```
+
+Large deterministic fixture:
+
+```console
+$ /private/tmp/offline-flag-parity-target/release/offline-flag-parity generate-benchmark /private/tmp/offline-flag-parity-benchmark-20260801.json
+generated 5000-flag/50000-rule benchmark snapshot: 6203976 bytes at /private/tmp/offline-flag-parity-benchmark-20260801.json
+```
+
+Each benchmark run loaded that file, held the parsed snapshot active, reloaded
+the same full snapshot while sampling process RSS, then timed five separate
+20,000-evaluation batches. The checksum was `324795` in all four runs.
+
+```text
+Run 1 p95 ns: 1209, 1084, 1042, 1083, 1042
+Run 1 median p95: 1083 ns; max p95: 1209 ns
+Run 1 sampled peak same-size reload RSS: 55,197,696 bytes
+Run 1 current RSS after evaluation: 55,705,600 bytes
+
+Run 2 p95 ns: 1291, 1333, 1292, 1125, 1084
+Run 2 median p95: 1291 ns; max p95: 1333 ns
+Run 2 sampled peak same-size reload RSS: 55,132,160 bytes
+Run 2 current RSS after evaluation: 55,672,832 bytes
+
+Run 3 p95 ns: 1250, 1125, 1084, 1083, 1208
+Run 3 median p95: 1125 ns; max p95: 1250 ns
+Run 3 sampled peak same-size reload RSS: 55,115,776 bytes
+Run 3 current RSS after evaluation: 55,640,064 bytes
+
+Run 4 p95 ns: 1292, 1167, 1209, 1209, 1167
+Run 4 median p95: 1209 ns; max p95: 1292 ns
+Run 4 sampled peak same-size reload RSS: 55,066,624 bytes
+Run 4 current RSS after evaluation: 55,623,680 bytes
+```
+
+All 20 original measured p95 batches were more than two orders of magnitude
+below the 250-microsecond ceiling. Four post-review runs added 20 more batches:
+their maximum p95 was 1,250 ns, while sampled peak reload RSS ranged from
+63,471,616 to 63,569,920 bytes. The closest post-review run left 3,538,944
+bytes of headroom under 64 MiB, materially narrower than the original process
+observations.
+
+## Categorized findings
+
+### Correctness and safety
+
+| Finding | Severity | Confidence | Reproduction | Smallest improvement |
+| --- | --- | --- | --- | --- |
+| Standard JSON-to-map parsing can silently accept duplicate object keys and let a later value replace an earlier one. | High | High | `fixtures/malformed/06-duplicate-flag-key.json`; `verify` rejects it | Keep the streaming duplicate-key preflight, or use a parser with duplicate rejection built in |
+| Candidate parsing must complete before any live reference changes; otherwise semantic validation failures can partially activate. | High | High | `verify` activates `demo-v2`, rejects `bad-reload.json`, then compares config id and decision | Preserve a single replace-on-success method; do not expose partial mutation APIs |
+| Rule-array order is semantic, while object-key order is not. Treating both kinds of reordering alike would be a compatibility bug. | High | High for this schema | `snapshot.json` and `snapshot-reordered.json` match all 250 cases; rules remain arrays | State this distinction in the public snapshot contract and version it |
+| FNV-1a 64 is stable and cross-language reproducible, but is not collision-resistant or abuse-resistant. | Medium | High | Rust unit vector and independent Node vector both return bucket `7307` | If untrusted users can choose identifiers adversarially, move to a specified keyed or cryptographic hash after a migration plan |
+
+### Performance and memory
+
+| Finding | Severity | Confidence | Reproduction | Smallest improvement |
+| --- | --- | --- | --- | --- |
+| A retained generic JSON tree plus typed snapshot, combined with in-process fixture generation, exceeded the memory budget (146,587,648-byte sampled RSS). | High | High for the failed implementation | Original full benchmark run | Keep duplicate checking streaming and keep tooling fixture construction out of the evaluator process |
+| The fixed implementation passed 64 MiB for the measured 6.2 MB synthetic snapshot, but the closest post-review same-size reload left only about 3.5 MB headroom on this machine. | Medium | Medium-high for the measured workload | Four original and four post-review `bench SNAPSHOT` runs | Keep file reads bounded, add production telemetry, and remeasure each production data shape before relying on the limit |
+| Explanation allocation is included in the roughly 1.0–1.3 microsecond p95, so it is not a current latency concern. | Low | High for this synthetic mix | Four clean benchmark runs | Retain structured explanations; optimize only if production profiles show pressure |
+
+### BogKit fit and developer experience
+
+| Finding | Severity | Confidence | Reproduction | Smallest improvement |
+| --- | --- | --- | --- | --- |
+| Fold's durable incremental views do not address strict JSON admission or deterministic percentage semantics, and a database is unnecessary on this read path. | Informational | High for the bounded brief | Compare public examples and Fold transaction API with the baseline table | Add a short “when not to use Fold” note and a configuration-snapshot example only if this becomes a supported use case |
+| An independent package inside the repository can avoid a parent workspace edit with its own `[workspace]` table. | Low | High | Prototype manifest builds directly with `--manifest-path` | Mention this option in prototype/hackathon documentation |
+| The README's normal Cargo path attempted an index refresh in a network-disabled environment even though dependencies were cached. | Low | High | First `cargo test` DNS failure; `cargo test --offline` passed | Document `--offline` for offline trials or vendor the tiny dependency set |
+
+## Consequential decision audit
+
+| Decision | Consequence | Evidence considered | Reversibility / guardrail |
+| --- | --- | --- | --- |
+| Use no BogKit crate | Trial concludes no-fit rather than forcing a component | Public README/examples, Fold stream transaction API, direct baseline | Fully reversible; all work is isolated and no core file changed |
+| Make rule arrays ordered | Reordering targeting rules may intentionally change a decision | Existing baseline description says ordered rules | Schema contract and golden cases make the behavior explicit |
+| Make object maps order-insensitive | Serializers may reorder fields/flags without changing results | Rust and JS both matched the reverse-key-order fixture | BTreeMap lookup plus 250 parity cases guard this behavior |
+| Reject duplicate keys, unknown fields, and invalid semantics | Some previously tolerated snapshots would now fail closed | Risk of silent replacement/partial activation | Errors are explicit; last active config remains available in process |
+| Use FNV-1a 64 with typed, null-separated fields | Stable assignment is portable, but not cryptographically strong | Fixed Rust/Node vector and ten restart fingerprints | Algorithm is documented; changing it requires an explicit migration/version |
+| Include explanations on every decision | Hot path allocates a short trace | Acceptance requires rule-level explanation; benchmark includes it | Can add a borrowed/compact representation later without changing semantics |
+| Keep generated fixtures in the archive | Adds 276 KiB, improves reproducibility | Golden/reorder/malformed acceptance checks | Small, synthetic, regenerable, and contains no private data |
+
+## Skeptical review and coordinator corrections
+
+The reviewer reproduced the format, test, strict-lint, fixture-verification,
+reference-evaluator, restart-fingerprint, and release-benchmark paths. The
+bounded no-fit decision stood: the direct immutable evaluator met this compact
+workload without a BogKit component.
+
+The reviewer rejected two broader claims. First, one host running Rust and Node
+does not establish cross-machine portability. Second, the measured 6.2 MB
+snapshot did not justify a 48 MiB accepted-input policy under a 64 MiB process
+budget. The coordinator changed file loading to read at most 8 MiB plus one
+byte, added the sparse oversized-file regression above, and scoped the memory
+result to the measured 5,000-flag/50,000-rule snapshot. Persisted last-known-good
+state, a platform CI matrix, every accepted data shape, and concurrent reloads
+remain unresolved.
+
+The coordinator then ran four fresh corrected release benchmarks. All 20 new
+p95 batches remained at or below 1.250 microseconds. Peak sampled reload RSS was
+63,471,616–63,569,920 bytes, so the workload still passed the 64 MiB criterion
+but with only about 3.5 MB of closest observed headroom.
+
+No BogKit correctness defect was found. Configuration-snapshot guidance remains
+a one-trial observation below the dashboard threshold.
+
+## Rejected alternatives
+
+- **Fold `KeyedStream` for flags/rules:** rejected because the candidate still
+  requires full JSON validation and the evaluation workload does not need
+  incremental materialized views or database persistence.
+- **Persist every decision or explanation:** rejected as analytics, explicitly a
+  non-goal, and incompatible with the small offline hot path.
+- **Use Rust's default map hasher for percentage buckets:** rejected because its
+  seed is process-specific and not a cross-language contract.
+- **Canonicalize/sort rule arrays:** rejected because targeting rule order is
+  meaningful. Only JSON object keys are irrelevant.
+- **Accept duplicate keys with “last value wins”:** rejected because malformed
+  delivery could silently activate a different configuration.
+- **Claim the original 146 MB benchmark was only tooling overhead and ignore
+  it:** rejected. The loader was changed and the workload was re-measured in a
+  clean process.
+- **Add commercial feature-flag schema compatibility:** rejected as a stated
+  non-goal; the prototype schema stays intentionally small.
+
+## Unresolved uncertainty
+
+- The TypeScript-style evaluator is an independent reference written for this
+  trial, not the unspecified production kiosk implementation. Real production
+  parity needs its actual snapshots, operators, coercion rules, and golden
+  outputs.
+- The malformed corpus covers 12 important syntax/shape/semantic cases, not all
+  possible malformed byte strings. Fuzzing the streaming duplicate checker and
+  typed deserializer is the next correctness step.
+- Ten restart checks ran on one arm64 macOS machine. The fixed algorithm is
+  specified in integer operations and independently matched Node on that host,
+  but cross-machine wording was rejected until a CI matrix provides evidence.
+- RSS was sampled via `ps` during a same-size reload at roughly millisecond
+  intervals and checked again after evaluation. A shorter transient peak could
+  be missed. The observed result should be read as strong prototype evidence,
+  not a formal maximum-memory proof.
+- Benchmark contexts are sequential and synthetic. There was no concurrent
+  evaluator access, allocator stress, thermal study, or long-duration soak.
+- The evaluator preserves last-known-good state for the lifetime of the
+  process. Persisting a last-known-good copy across a process restart after an
+  external file replacement is not implemented and should be decided as a
+  delivery/storage responsibility before production use.
+- The 8 MiB file-read cap and 5,000/50,000 semantic caps bound prototype input.
+  They are policy choices, not proof that every accepted shape stays below the
+  measured process-memory ceiling.
+
+## Archive hygiene
+
+At the pre-report check, `git status --short` showed only `?? trial-output/`.
+BogKit core and existing examples remained untouched. The prototype occupied
+332 KiB before this report; fixtures occupied 276 KiB. No `target` directory,
+database, `.git` directory, file larger than 1 MiB, credential, or private data
+was present under `trial-output/offline-flag-parity`. All contexts and user ids
+are deterministic synthetic values.
diff --git a/developer-simulation/runs/2026-08-01--offline-flag-parity/README.md b/developer-simulation/runs/2026-08-01--offline-flag-parity/README.md
new file mode 100644
index 0000000..6405c6f
--- /dev/null
+++ b/developer-simulation/runs/2026-08-01--offline-flag-parity/README.md
@@ -0,0 +1,31 @@
+# Offline flag parity prototype
+
+A local Rust library and CLI for loading a validated JSON flag snapshot,
+evaluating ordered targeting rules, and retaining the last valid snapshot when
+a reload fails.
+
+The evaluator is deliberately independent from BogKit. `EVIDENCE.md`
+explains why the direct immutable-snapshot baseline fit this workload better
+than a durable incremental database.
+
+Run from this directory, while keeping build output outside the archive:
+
+```console
+export CARGO_TARGET_DIR=/tmp/offline-flag-parity-target
+cargo run --offline --release -- generate /tmp/offline-flag-fixtures
+cargo run --offline --release -- verify /tmp/offline-flag-fixtures
+cargo run --offline --release -- demo /tmp/offline-flag-fixtures
+cargo run --offline --release -- eval /tmp/offline-flag-fixtures/snapshot.json /tmp/offline-flag-fixtures/contexts.ndjson
+cargo run --offline --release -- fingerprint /tmp/offline-flag-fixtures
+node baseline/reference-evaluator.mjs /tmp/offline-flag-fixtures
+cargo run --offline --release -- generate-benchmark /tmp/offline-flag-benchmark.json
+cargo run --offline --release -- bench /tmp/offline-flag-benchmark.json
+```
+
+Snapshot rules are arrays, so their order is meaningful. JSON object order is
+not meaningful. Percentage rules use FNV-1a 64 over null-separated snapshot
+salt, flag key, rule id, and user attribute, then map the result into 10,000
+basis-point buckets. This algorithm is implemented locally so it does not vary
+with process-randomized hash maps or restarts. Rust and the independent
+JavaScript reference matched on the measured host; broader platform parity
+still needs a CI matrix.
diff --git a/developer-simulation/runs/2026-08-01--offline-flag-parity/baseline/reference-evaluator.mjs b/developer-simulation/runs/2026-08-01--offline-flag-parity/baseline/reference-evaluator.mjs
new file mode 100644
index 0000000..6b1acd4
--- /dev/null
+++ b/developer-simulation/runs/2026-08-01--offline-flag-parity/baseline/reference-evaluator.mjs
@@ -0,0 +1,159 @@
+#!/usr/bin/env node
+
+// Dependency-free TypeScript-style reference evaluator. It is intentionally
+// separate from the Rust library so the golden suite exercises cross-language
+// rule and percentage semantics rather than only replaying Rust output.
+
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import path from "node:path";
+
+const fixtureDirectory = process.argv[2];
+if (!fixtureDirectory) {
+  throw new Error("usage: node baseline/reference-evaluator.mjs FIXTURE_DIR");
+}
+
+const snapshot = readJson("snapshot.json");
+const reordered = readJson("snapshot-reordered.json");
+const golden = readJson("golden.json");
+
+for (const testCase of golden) {
+  const actual = evaluate(snapshot, testCase.input.flag, testCase.input.context);
+  const reorderedActual = evaluate(
+    reordered,
+    testCase.input.flag,
+    testCase.input.context,
+  );
+  assert.deepStrictEqual(actual, testCase.expected, testCase.input.case_id);
+  assert.deepStrictEqual(
+    reorderedActual,
+    actual,
+    `${testCase.input.case_id} reordered`,
+  );
+}
+
+assert.equal(stableBucket("salt", "flag", "rule", "user-42"), 7307);
+console.log(
+  `TypeScript-style reference matched ${golden.length} golden cases and reordered-object decisions; known bucket=7307`,
+);
+
+function readJson(name) {
+  return JSON.parse(fs.readFileSync(path.join(fixtureDirectory, name), "utf8"));
+}
+
+function evaluate(config, flagKey, context) {
+  const flag = config.flags[flagKey];
+  if (!flag) throw new Error(`unknown flag ${JSON.stringify(flagKey)}`);
+  const explanation = [];
+
+  for (const rule of flag.rules) {
+    let failure;
+    for (const condition of rule.conditions ?? []) {
+      if (!Object.hasOwn(context, condition.attribute)) {
+        failure = `missing attribute ${JSON.stringify(condition.attribute)}`;
+        break;
+      }
+      const actual = context[condition.attribute];
+      if (!conditionMatches(actual, condition)) {
+        failure = `attribute ${JSON.stringify(condition.attribute)} was ${display(actual)}; condition did not match`;
+        break;
+      }
+    }
+
+    if (failure) {
+      explanation.push({ rule_id: rule.id, matched: false, reason: failure });
+      continue;
+    }
+
+    if (rule.percentage) {
+      const attribute = rule.percentage.attribute;
+      if (!Object.hasOwn(context, attribute)) {
+        explanation.push({
+          rule_id: rule.id,
+          matched: false,
+          reason: `missing percentage attribute ${JSON.stringify(attribute)}`,
+        });
+        continue;
+      }
+      const bucket = stableBucket(
+        config.salt,
+        flagKey,
+        rule.id,
+        bucketKey(context[attribute]),
+      );
+      if (bucket >= rule.percentage.basis_points) {
+        explanation.push({
+          rule_id: rule.id,
+          matched: false,
+          reason: `stable bucket ${bucket} was outside 0..${rule.percentage.basis_points}`,
+        });
+        continue;
+      }
+      explanation.push({
+        rule_id: rule.id,
+        matched: true,
+        reason: `conditions matched; stable bucket ${bucket} was inside 0..${rule.percentage.basis_points}`,
+      });
+    } else {
+      explanation.push({
+        rule_id: rule.id,
+        matched: true,
+        reason: "all conditions matched",
+      });
+    }
+
+    return {
+      flag: flagKey,
+      value: rule.serve,
+      source: rule.id,
+      explanation,
+    };
+  }
+
+  explanation.push({
+    rule_id: "default",
+    matched: true,
+    reason: "no targeting rule matched",
+  });
+  return {
+    flag: flagKey,
+    value: flag.default,
+    source: "default",
+    explanation,
+  };
+}
+
+function conditionMatches(actual, condition) {
+  switch (condition.op) {
+    case "eq":
+      return actual === condition.value;
+    case "not_eq":
+      return actual !== condition.value;
+    case "greater_than":
+      return typeof actual === "number" && actual > condition.value;
+    default:
+      throw new Error(`unknown operator ${condition.op}`);
+  }
+}
+
+function display(value) {
+  return typeof value === "string" ? JSON.stringify(value) : String(value);
+}
+
+function bucketKey(value) {
+  if (typeof value === "boolean") return `b:${value}`;
+  if (typeof value === "number") return `n:${value}`;
+  return `s:${value}`;
+}
+
+function stableBucket(salt, flag, rule, attribute) {
+  let hash = 0xcbf29ce484222325n;
+  for (const part of [salt, flag, rule, attribute]) {
+    for (const byte of Buffer.from(part)) {
+      hash ^= BigInt(byte);
+      hash = BigInt.asUintN(64, hash * 0x100000001b3n);
+    }
+    hash = BigInt.asUintN(64, hash * 0x100000001b3n);
+  }
+  return Number(hash % 10000n);
+}
diff --git a/developer-simulation/runs/2026-08-01--offline-flag-parity/fixtures/bad-reload.json b/developer-simulation/runs/2026-08-01--offline-flag-parity/fixtures/bad-reload.json
new file mode 100644
index 0000000..8c9d7d5
--- /dev/null
+++ b/developer-simulation/runs/2026-08-01--offline-flag-parity/fixtures/bad-reload.json
@@ -0,0 +1 @@
+{"schema_version":1,"config_id":"bad","salt":"retail-kiosk-v1","flags":{"checkout_redesign":{"default":false,"rules":[{"id":"bad-rollout","conditions":[],"serve":true,"percentage":{"attribute":"user_id","basis_points":10001}}]}}}
\ No newline at end of file
diff --git a/developer-simulation/runs/2026-08-01--offline-flag-parity/fixtures/contexts.ndjson b/developer-simulation/runs/2026-08-01--offline-flag-parity/fixtures/contexts.ndjson
new file mode 100644
index 0000000..a926572
--- /dev/null
+++ b/developer-simulation/runs/2026-08-01--offline-flag-parity/fixtures/contexts.ndjson
@@ -0,0 +1,250 @@
+{"case_id":"golden-000","flag":"checkout_redesign","context":{"accessibility_mode":true,"kiosk":false,"store_size":8000.0,"tier":"employee","user_id":"synthetic-user-000"}}
+{"case_id":"golden-001","flag":"max_cart_items","context":{"accessibility_mode":false,"kiosk":true,"store_size":8257.0,"tier":"guest","user_id":"synthetic-user-001"}}
+{"case_id":"golden-002","flag":"receipt_style","context":{"accessibility_mode":false,"kiosk":true,"store_size":8514.0,"tier":"member","user_id":"synthetic-user-002"}}
+{"case_id":"golden-003","flag":"support_prompt","context":{"accessibility_mode":false,"kiosk":false,"store_size":8771.0,"tier":"member","user_id":"synthetic-user-003"}}
+{"case_id":"golden-004","flag":"checkout_redesign","context":{"accessibility_mode":false,"kiosk":true,"store_size":9028.0,"tier":"member","user_id":"synthetic-user-004"}}
+{"case_id":"golden-005","flag":"max_cart_items","context":{"accessibility_mode":false,"kiosk":true,"store_size":9285.0,"tier":"employee","user_id":"synthetic-user-005"}}
+{"case_id":"golden-006","flag":"receipt_style","context":{"accessibility_mode":false,"kiosk":false,"store_size":9542.0,"tier":"guest","user_id":"synthetic-user-006"}}
+{"case_id":"golden-007","flag":"support_prompt","context":{"accessibility_mode":true,"kiosk":true,"store_size":9799.0,"tier":"member","user_id":"synthetic-user-007"}}
+{"case_id":"golden-008","flag":"checkout_redesign","context":{"accessibility_mode":false,"kiosk":true,"store_size":10056.0,"tier":"member","user_id":"synthetic-user-008"}}
+{"case_id":"golden-009","flag":"max_cart_items","context":{"accessibility_mode":false,"kiosk":false,"store_size":10313.0,"tier":"member","user_id":"synthetic-user-009"}}
+{"case_id":"golden-010","flag":"receipt_style","context":{"accessibility_mode":false,"kiosk":true,"store_size":10570.0,"tier":"employee","user_id":"synthetic-user-010"}}
+{"case_id":"golden-011","flag":"support_prompt","context":{"accessibility_mode":false,"kiosk":true,"store_size":10827.0,"tier":"guest","user_id":"synthetic-user-011"}}
+{"case_id":"golden-012","flag":"checkout_redesign","context":{"accessibility_mode":false,"kiosk":false,"store_size":11084.0,"tier":"member","user_id":"synthetic-user-012"}}
+{"case_id":"golden-013","flag":"max_cart_items","context":{"accessibility_mode":false,"kiosk":true,"store_size":11341.0,"tier":"member","user_id":"synthetic-user-013"}}
+{"case_id":"golden-014","flag":"receipt_style","context":{"accessibility_mode":true,"kiosk":true,"store_size":11598.0,"tier":"member","user_id":"synthetic-user-014"}}
+{"case_id":"golden-015","flag":"support_prompt","context":{"accessibility_mode":false,"kiosk":false,"store_size":11855.0,"tier":"employee","user_id":"synthetic-user-015"}}
+{"case_id":"golden-016","flag":"checkout_redesign","context":{"accessibility_mode":false,"kiosk":true,"store_size":12112.0,"tier":"guest","user_id":"synthetic-user-016"}}
+{"case_id":"golden-017","flag":"max_cart_items","context":{"accessibility_mode":false,"kiosk":true,"store_size":12369.0,"tier":"member","user_id":"synthetic-user-017"}}
+{"case_id":"golden-018","flag":"receipt_style","context":{"accessibility_mode":false,"kiosk":false,"store_size":12626.0,"tier":"member","user_id":"synthetic-user-018"}}
+{"case_id":"golden-019","flag":"support_prompt","context":{"accessibility_mode":false,"kiosk":true,"store_size":12883.0,"tier":"member","user_id":"synthetic-user-019"}}
+{"case_id":"golden-020","flag":"checkout_redesign","context":{"accessibility_mode":false,"kiosk":true,"store_size":13140.0,"tier":"employee","user_id":"synthetic-user-020"}}
+{"case_id":"golden-021","flag":"max_cart_items","context":{"accessibility_mode":true,"kiosk":false,"store_size":13397.0,"tier":"guest","user_id":"synthetic-user-021"}}
+{"case_id":"golden-022","flag":"receipt_style","context":{"accessibility_mode":false,"kiosk":true,"store_size":13654.0,"tier":"member","user_id":"synthetic-user-022"}}
+{"case_id":"golden-023","flag":"support_prompt","context":{"accessibility_mode":false,"kiosk":true,"store_size":13911.0,"tier":"member","user_id":"synthetic-user-023"}}
+{"case_id":"golden-024","flag":"checkout_redesign","context":{"accessibility_mode":false,"kiosk":false,"store_size":14168.0,"tier":"member","user_id":"synthetic-user-024"}}
+{"case_id":"golden-025","flag":"max_cart_items","context":{"accessibility_mode":false,"kiosk":true,"store_size":14425.0,"tier":"employee","user_id":"synthetic-user-025"}}
+{"case_id":"golden-026","flag":"receipt_style","context":{"accessibility_mode":false,"kiosk":true,"store_size":14682.0,"tier":"guest","user_id":"synthetic-user-026"}}
+{"case_id":"golden-027","flag":"support_prompt","context":{"accessibility_mode":false,"kiosk":false,"store_size":14939.0,"tier":"member","user_id":"synthetic-user-027"}}
+{"case_id":"golden-028","flag":"checkout_redesign","context":{"accessibility_mode":true,"kiosk":true,"store_size":15196.0,"tier":"member","user_id":"synthetic-user-028"}}
+{"case_id":"golden-029","flag":"max_cart_items","context":{"accessibility_mode":false,"kiosk":true,"store_size":15453.0,"tier":"member","user_id":"synthetic-user-029"}}
+{"case_id":"golden-030","flag":"receipt_style","context":{"accessibility_mode":false,"kiosk":false,"store_size":15710.0,"tier":"employee","user_id":"synthetic-user-030"}}
+{"case_id":"golden-031","flag":"support_prompt","context":{"accessibility_mode":false,"kiosk":true,"store_size":15967.0,"tier":"guest","user_id":"synthetic-user-031"}}
+{"case_id":"golden-032","flag":"checkout_redesign","context":{"accessibility_mode":false,"kiosk":true,"store_size":16224.0,"tier":"member","user_id":"synthetic-user-032"}}
+{"case_id":"golden-033","flag":"max_cart_items","context":{"accessibility_mode":false,"kiosk":false,"store_size":16481.0,"tier":"member","user_id":"synthetic-user-033"}}
+{"case_id":"golden-034","flag":"receipt_style","context":{"accessibility_mode":false,"kiosk":true,"store_size":16738.0,"tier":"member","user_id":"synthetic-user-034"}}
+{"case_id":"golden-035","flag":"support_prompt","context":{"accessibility_mode":true,"kiosk":true,"store_size":16995.0,"tier":"employee","user_id":"synthetic-user-035"}}
+{"case_id":"golden-036","flag":"checkout_redesign","context":{"accessibility_mode":false,"kiosk":false,"store_size":17252.0,"tier":"guest","user_id":"synthetic-user-036"}}
+{"case_id":"golden-037","flag":"max_cart_items","context":{"accessibility_mode":false,"kiosk":true,"store_size":17509.0,"tier":"member","user_id":"synthetic-user-037"}}
+{"case_id":"golden-038","flag":"receipt_style","context":{"accessibility_mode":false,"kiosk":true,"store_size":17766.0,"tier":"member","user_id":"synthetic-user-038"}}
+{"case_id":"golden-039","flag":"support_prompt","context":{"accessibility_mode":false,"kiosk":false,"store_size":18023.0,"tier":"member","user_id":"synthetic-user-039"}}
+{"case_id":"golden-040","flag":"checkout_redesign","context":{"accessibility_mode":false,"kiosk":true,"store_size":18280.0,"tier":"employee","user_id":"synthetic-user-040"}}
+{"case_id":"golden-041","flag":"max_cart_items","context":{"accessibility_mode":false,"kiosk":true,"store_size":18537.0,"tier":"guest","user_id":"synthetic-user-041"}}
+{"case_id":"golden-042","flag":"receipt_style","context":{"accessibility_mode":true,"kiosk":false,"store_size":18794.0,"tier":"member","user_id":"synthetic-user-042"}}
+{"case_id":"golden-043","flag":"support_prompt","context":{"accessibility_mode":false,"kiosk":true,"store_size":19051.0,"tier":"member","user_id":"synthetic-user-043"}}
+{"case_id":"golden-044","flag":"checkout_redesign","context":{"accessibility_mode":false,"kiosk":true,"store_size":19308.0,"tier":"member","user_id":"synthetic-user-044"}}
+{"case_id":"golden-045","flag":"max_cart_items","context":{"accessibility_mode":false,"kiosk":false,"store_size":19565.0,"tier":"employee","user_id":"synthetic-user-045"}}
+{"case_id":"golden-046","flag":"receipt_style","context":{"accessibility_mode":false,"kiosk":true,"store_size":19822.0,"tier":"guest","user_id":"synthetic-user-046"}}
+{"case_id":"golden-047","flag":"support_prompt","context":{"accessibility_mode":false,"kiosk":true,"store_size":20079.0,"tier":"member","user_id":"synthetic-user-047"}}
+{"case_id":"golden-048","flag":"checkout_redesign","context":{"accessibility_mode":false,"kiosk":false,"store_size":20336.0,"tier":"member","user_id":"synthetic-user-048"}}
+{"case_id":"golden-049","flag":"max_cart_items","context":{"accessibility_mode":true,"kiosk":true,"store_size":20593.0,"tier":"member","user_id":"synthetic-user-049"}}
+{"case_id":"golden-050","flag":"receipt_style","context":{"accessibility_mode":false,"kiosk":true,"store_size":20850.0,"tier":"employee","user_id":"synthetic-user-050"}}
+{"case_id":"golden-051","flag":"support_prompt","context":{"accessibility_mode":false,"kiosk":false,"store_size":21107.0,"tier":"guest","user_id":"synthetic-user-051"}}
+{"case_id":"golden-052","flag":"checkout_redesign","context":{"accessibility_mode":false,"kiosk":true,"store_size":21364.0,"tier":"member","user_id":"synthetic-user-052"}}
+{"case_id":"golden-053","flag":"max_cart_items","context":{"accessibility_mode":false,"kiosk":true,"store_size":21621.0,"tier":"member","user_id":"synthetic-user-053"}}
+{"case_id":"golden-054","flag":"receipt_style","context":{"accessibility_mode":false,"kiosk":false,"store_size":21878.0,"tier":"member","user_id":"synthetic-user-054"}}
+{"case_id":"golden-055","flag":"support_prompt","context":{"accessibility_mode":false,"kiosk":true,"store_size":22135.0,"tier":"employee","user_id":"synthetic-user-055"}}
+{"case_id":"golden-056","flag":"checkout_redesign","context":{"accessibility_mode":true,"kiosk":true,"store_size":22392.0,"tier":"guest","user_id":"synthetic-user-056"}}
+{"case_id":"golden-057","flag":"max_cart_items","context":{"accessibility_mode":false,"kiosk":false,"store_size":22649.0,"tier":"member","user_id":"synthetic-user-057"}}
+{"case_id":"golden-058","flag":"receipt_style","context":{"accessibility_mode":false,"kiosk":true,"store_size":22906.0,"tier":"member","user_id":"synthetic-user-058"}}
+{"case_id":"golden-059","flag":"support_prompt","context":{"accessibility_mode":false,"kiosk":true,"store_size":23163.0,"tier":"member","user_id":"synthetic-user-059"}}
+{"case_id":"golden-060","flag":"checkout_redesign","context":{"accessibility_mode":false,"kiosk":false,"store_size":23420.0,"tier":"employee","user_id":"synthetic-user-060"}}
+{"case_id":"golden-061","flag":"max_cart_items","context":{"accessibility_mode":false,"kiosk":true,"store_size":23677.0,"tier":"guest","user_id":"synthetic-user-061"}}
+{"case_id":"golden-062","flag":"receipt_style","context":{"accessibility_mode":false,"kiosk":true,"store_size":23934.0,"tier":"member","user_id":"synthetic-user-062"}}
+{"case_id":"golden-063","flag":"support_prompt","context":{"accessibility_mode":true,"kiosk":false,"store_size":24191.0,"tier":"member","user_id":"synthetic-user-063"}}
+{"case_id":"golden-064","flag":"checkout_redesign","context":{"accessibility_mode":false,"kiosk":true,"store_size":24448.0,"tier":"member","user_id":"synthetic-user-064"}}
+{"case_id":"golden-065","flag":"max_cart_items","context":{"accessibility_mode":false,"kiosk":true,"store_size":24705.0,"tier":"employee","user_id":"synthetic-user-065"}}
+{"case_id":"golden-066","flag":"receipt_style","context":{"accessibility_mode":false,"kiosk":false,"store_size":24962.0,"tier":"guest","user_id":"synthetic-user-066"}}
+{"case_id":"golden-067","flag":"support_prompt","context":{"accessibility_mode":false,"kiosk":true,"store_size":25219.0,"tier":"member","user_id":"synthetic-user-067"}}
+{"case_id":"golden-068","flag":"checkout_redesign","context":{"accessibility_mode":false,"kiosk":true,"store_size":25476.0,"tier":"member","user_id":"synthetic-user-068"}}
+{"case_id":"golden-069","flag":"max_cart_items","context":{"accessibility_mode":false,"kiosk":false,"store_size":25733.0,"tier":"member","user_id":"synthetic-user-069"}}
+{"case_id":"golden-070","flag":"receipt_style","context":{"accessibility_mode":true,"kiosk":true,"store_size":25990.0,"tier":"employee","user_id":"synthetic-user-070"}}
+{"case_id":"golden-071","flag":"support_prompt","context":{"accessibility_mode":false,"kiosk":true,"store_size":26247.0,"tier":"guest","user_id":"synthetic-user-071"}}
+{"case_id":"golden-072","flag":"checkout_redesign","context":{"accessibility_mode":false,"kiosk":false,"store_size":26504.0,"tier":"member","user_id":"synthetic-user-072"}}
+{"case_id":"golden-073","flag":"max_cart_items","context":{"accessibility_mode":false,"kiosk":true,"store_size":26761.0,"tier":"member","user_id":"synthetic-user-073"}}
+{"case_id":"golden-074","flag":"receipt_style","context":{"accessibility_mode":false,"kiosk":true,"store_size":27018.0,"tier":"member","user_id":"synthetic-user-074"}}
+{"case_id":"golden-075","flag":"support_prompt","context":{"accessibility_mode":false,"kiosk":false,"store_size":27275.0,"tier":"employee","user_id":"synthetic-user-075"}}
+{"case_id":"golden-076","flag":"checkout_redesign","context":{"accessibility_mode":false,"kiosk":true,"store_size":27532.0,"tier":"guest","user_id":"synthetic-user-076"}}
+{"case_id":"golden-077","flag":"max_cart_items","context":{"accessibility_mode":true,"kiosk":true,"store_size":27789.0,"tier":"member","user_id":"synthetic-user-077"}}
+{"case_id":"golden-078","flag":"receipt_style","context":{"accessibility_mode":false,"kiosk":false,"store_size":28046.0,"tier":"member","user_id":"synthetic-user-078"}}
+{"case_id":"golden-079","flag":"support_prompt","context":{"accessibility_mode":false,"kiosk":true,"store_size":28303.0,"tier":"member","user_id":"synthetic-user-079"}}
+{"case_id":"golden-080","flag":"checkout_redesign","context":{"accessibility_mode":false,"kiosk":true,"store_size":28560.0,"tier":"employee","user_id":"synthetic-user-080"}}
+{"case_id":"golden-081","flag":"max_cart_items","context":{"accessibility_mode":false,"kiosk":false,"store_size":28817.0,"tier":"guest","user_id":"synthetic-user-081"}}
+{"case_id":"golden-082","flag":"receipt_style","context":{"accessibility_mode":false,"kiosk":true,"store_size":29074.0,"tier":"member","user_id":"synthetic-user-082"}}
+{"case_id":"golden-083","flag":"support_prompt","context":{"accessibility_mode":false,"kiosk":true,"store_size":29331.0,"tier":"member","user_id":"synthetic-user-083"}}
+{"case_id":"golden-084","flag":"checkout_redesign","context":{"accessibility_mode":true,"kiosk":false,"store_size":29588.0,"tier":"member","user_id":"synthetic-user-084"}}
+{"case_id":"golden-085","flag":"max_cart_items","context":{"accessibility_mode":false,"kiosk":true,"store_size":29845.0,"tier":"employee","user_id":"synthetic-user-085"}}
+{"case_id":"golden-086","flag":"receipt_style","context":{"accessibility_mode":false,"kiosk":true,"store_size":30102.0,"tier":"guest","user_id":"synthetic-user-086"}}
+{"case_id":"golden-087","flag":"support_prompt","context":{"accessibility_mode":false,"kiosk":false,"store_size":30359.0,"tier":"member","user_id":"synthetic-user-087"}}
+{"case_id":"golden-088","flag":"checkout_redesign","context":{"accessibility_mode":false,"kiosk":true,"store_size":30616.0,"tier":"member","user_id":"synthetic-user-088"}}
+{"case_id":"golden-089","flag":"max_cart_items","context":{"accessibility_mode":false,"kiosk":true,"store_size":30873.0,"tier":"member","user_id":"synthetic-user-089"}}
+{"case_id":"golden-090","flag":"receipt_style","context":{"accessibility_mode":false,"kiosk":false,"store_size":31130.0,"tier":"employee","user_id":"synthetic-user-090"}}
+{"case_id":"golden-091","flag":"support_prompt","context":{"accessibility_mode":true,"kiosk":true,"store_size":31387.0,"tier":"guest","user_id":"synthetic-user-091"}}
+{"case_id":"golden-092","flag":"checkout_redesign","context":{"accessibility_mode":false,"kiosk":true,"store_size":31644.0,"tier":"member","user_id":"synthetic-user-092"}}
+{"case_id":"golden-093","flag":"max_cart_items","context":{"accessibility_mode":false,"kiosk":false,"store_size":31901.0,"tier":"member","user_id":"synthetic-user-093"}}
+{"case_id":"golden-094","flag":"receipt_style","context":{"accessibility_mode":false,"kiosk":true,"store_size":32158.0,"tier":"member","user_id":"synthetic-user-094"}}
+{"case_id":"golden-095","flag":"support_prompt","context":{"accessibility_mode":false,"kiosk":true,"store_size":32415.0,"tier":"employee","user_id":"synthetic-user-095"}}
+{"case_id":"golden-096","flag":"checkout_redesign","context":{"accessibility_mode":false,"kiosk":false,"store_size":32672.0,"tier":"guest","user_id":"synthetic-user-096"}}
+{"case_id":"golden-097","flag":"max_cart_items","context":{"accessibility_mode":false,"kiosk":true,"store_size":32929.0,"tier":"member","user_id":"synthetic-user-097"}}
+{"case_id":"golden-098","flag":"receipt_style","context":{"accessibility_mode":true,"kiosk":true,"store_size":8186.0,"tier":"member","user_id":"synthetic-user-098"}}
+{"case_id":"golden-099","flag":"support_prompt","context":{"accessibility_mode":false,"kiosk":false,"store_size":8443.0,"tier":"member","user_id":"synthetic-user-099"}}
+{"case_id":"golden-100","flag":"checkout_redesign","context":{"accessibility_mode":false,"kiosk":true,"store_size":8700.0,"tier":"employee","user_id":"synthetic-user-100"}}
+{"case_id":"golden-101","flag":"max_cart_items","context":{"accessibility_mode":false,"kiosk":true,"store_size":8957.0,"tier":"guest","user_id":"synthetic-user-101"}}
+{"case_id":"golden-102","flag":"receipt_style","context":{"accessibility_mode":false,"kiosk":false,"store_size":9214.0,"tier":"member","user_id":"synthetic-user-102"}}
+{"case_id":"golden-103","flag":"support_prompt","context":{"accessibility_mode":false,"kiosk":true,"store_size":9471.0,"tier":"member","user_id":"synthetic-user-103"}}
+{"case_id":"golden-104","flag":"checkout_redesign","context":{"accessibility_mode":false,"kiosk":true,"store_size":9728.0,"tier":"member","user_id":"synthetic-user-104"}}
+{"case_id":"golden-105","flag":"max_cart_items","context":{"accessibility_mode":true,"kiosk":false,"store_size":9985.0,"tier":"employee","user_id":"synthetic-user-105"}}
+{"case_id":"golden-106","flag":"receipt_style","context":{"accessibility_mode":false,"kiosk":true,"store_size":10242.0,"tier":"guest","user_id":"synthetic-user-106"}}
+{"case_id":"golden-107","flag":"support_prompt","context":{"accessibility_mode":false,"kiosk":true,"store_size":10499.0,"tier":"member","user_id":"synthetic-user-107"}}
+{"case_id":"golden-108","flag":"checkout_redesign","context":{"accessibility_mode":false,"kiosk":false,"store_size":10756.0,"tier":"member","user_id":"synthetic-user-108"}}
+{"case_id":"golden-109","flag":"max_cart_items","context":{"accessibility_mode":false,"kiosk":true,"store_size":11013.0,"tier":"member","user_id":"synthetic-user-109"}}
+{"case_id":"golden-110","flag":"receipt_style","context":{"accessibility_mode":false,"kiosk":true,"store_size":11270.0,"tier":"employee","user_id":"synthetic-user-110"}}
+{"case_id":"golden-111","flag":"support_prompt","context":{"accessibility_mode":false,"kiosk":false,"store_size":11527.0,"tier":"guest","user_id":"synthetic-user-111"}}
+{"case_id":"golden-112","flag":"checkout_redesign","context":{"accessibility_mode":true,"kiosk":true,"store_size":11784.0,"tier":"member","user_id":"synthetic-user-112"}}
+{"case_id":"golden-113","flag":"max_cart_items","context":{"accessibility_mode":false,"kiosk":true,"store_size":12041.0,"tier":"member","user_id":"synthetic-user-113"}}
+{"case_id":"golden-114","flag":"receipt_style","context":{"accessibility_mode":false,"kiosk":false,"store_size":12298.0,"tier":"member","user_id":"synthetic-user-114"}}
+{"case_id":"golden-115","flag":"support_prompt","context":{"accessibility_mode":false,"kiosk":true,"store_size":12555.0,"tier":"employee","user_id":"synthetic-user-115"}}
+{"case_id":"golden-116","flag":"checkout_redesign","context":{"accessibility_mode":false,"kiosk":true,"store_size":12812.0,"tier":"guest","user_id":"synthetic-user-116"}}
+{"case_id":"golden-117","flag":"max_cart_items","context":{"accessibility_mode":false,"kiosk":false,"store_size":13069.0,"tier":"member","user_id":"synthetic-user-117"}}
+{"case_id":"golden-118","flag":"receipt_style","context":{"accessibility_mode":false,"kiosk":true,"store_size":13326.0,"tier":"member","user_id":"synthetic-user-118"}}
+{"case_id":"golden-119","flag":"support_prompt","context":{"accessibility_mode":true,"kiosk":true,"store_size":13583.0,"tier":"member","user_id":"synthetic-user-119"}}
+{"case_id":"golden-120","flag":"checkout_redesign","context":{"accessibility_mode":false,"kiosk":false,"store_size":13840.0,"tier":"employee","user_id":"synthetic-user-120"}}
+{"case_id":"golden-121","flag":"max_cart_items","context":{"accessibility_mode":false,"kiosk":true,"store_size":14097.0,"tier":"guest","user_id":"synthetic-user-121"}}
+{"case_id":"golden-122","flag":"receipt_style","context":{"accessibility_mode":false,"kiosk":true,"store_size":14354.0,"tier":"member","user_id":"synthetic-user-122"}}
+{"case_id":"golden-123","flag":"support_prompt","context":{"accessibility_mode":false,"kiosk":false,"store_size":14611.0,"tier":"member","user_id":"synthetic-user-123"}}
+{"case_id":"golden-124","flag":"checkout_redesign","context":{"accessibility_mode":false,"kiosk":true,"store_size":14868.0,"tier":"member","user_id":"synthetic-user-124"}}
+{"case_id":"golden-125","flag":"max_cart_items","context":{"accessibility_mode":false,"kiosk":true,"store_size":15125.0,"tier":"employee","user_id":"synthetic-user-125"}}
+{"case_id":"golden-126","flag":"receipt_style","context":{"accessibility_mode":true,"kiosk":false,"store_size":15382.0,"tier":"guest","user_id":"synthetic-user-126"}}
+{"case_id":"golden-127","flag":"support_prompt","context":{"accessibility_mode":false,"kiosk":true,"store_size":15639.0,"tier":"member","user_id":"synthetic-user-127"}}
+{"case_id":"golden-128","flag":"checkout_redesign","context":{"accessibility_mode":false,"kiosk":true,"store_size":15896.0,"tier":"member","user_id":"synthetic-user-128"}}
+{"case_id":"golden-129","flag":"max_cart_items","context":{"accessibility_mode":false,"kiosk":false,"store_size":16153.0,"tier":"member","user_id":"synthetic-user-129"}}
+{"case_id":"golden-130","flag":"receipt_style","context":{"accessibility_mode":false,"kiosk":true,"store_size":16410.0,"tier":"employee","user_id":"synthetic-user-130"}}
+{"case_id":"golden-131","flag":"support_prompt","context":{"accessibility_mode":false,"kiosk":true,"store_size":16667.0,"tier":"guest","user_id":"synthetic-user-131"}}
+{"case_id":"golden-132","flag":"checkout_redesign","context":{"accessibility_mode":false,"kiosk":false,"store_size":16924.0,"tier":"member","user_id":"synthetic-user-132"}}
+{"case_id":"golden-133","flag":"max_cart_items","context":{"accessibility_mode":true,"kiosk":true,"store_size":17181.0,"tier":"member","user_id":"synthetic-user-133"}}
+{"case_id":"golden-134","flag":"receipt_style","context":{"accessibility_mode":false,"kiosk":true,"store_size":17438.0,"tier":"member","user_id":"synthetic-user-134"}}
+{"case_id":"golden-135","flag":"support_prompt","context":{"accessibility_mode":false,"kiosk":false,"store_size":17695.0,"tier":"employee","user_id":"synthetic-user-135"}}
+{"case_id":"golden-136","flag":"checkout_redesign","context":{"accessibility_mode":false,"kiosk":true,"store_size":17952.0,"tier":"guest","user_id":"synthetic-user-136"}}
+{"case_id":"golden-137","flag":"max_cart_items","context":{"accessibility_mode":false,"kiosk":true,"store_size":18209.0,"tier":"member","user_id":"synthetic-user-137"}}
+{"case_id":"golden-138","flag":"receipt_style","context":{"accessibility_mode":false,"kiosk":false,"store_size":18466.0,"tier":"member","user_id":"synthetic-user-138"}}
+{"case_id":"golden-139","flag":"support_prompt","context":{"accessibility_mode":false,"kiosk":true,"store_size":18723.0,"tier":"member","user_id":"synthetic-user-139"}}
+{"case_id":"golden-140","flag":"checkout_redesign","context":{"accessibility_mode":true,"kiosk":true,"store_size":18980.0,"tier":"employee","user_id":"synthetic-user-140"}}
+{"case_id":"golden-141","flag":"max_cart_items","context":{"accessibility_mode":false,"kiosk":false,"store_size":19237.0,"tier":"guest","user_id":"synthetic-user-141"}}
+{"case_id":"golden-142","flag":"receipt_style","context":{"accessibility_mode":false,"kiosk":true,"store_size":19494.0,"tier":"member","user_id":"synthetic-user-142"}}
+{"case_id":"golden-143","flag":"support_prompt","context":{"accessibility_mode":false,"kiosk":true,"store_size":19751.0,"tier":"member","user_id":"synthetic-user-143"}}
+{"case_id":"golden-144","flag":"checkout_redesign","context":{"accessibility_mode":false,"kiosk":false,"store_size":20008.0,"tier":"member","user_id":"synthetic-user-144"}}
+{"case_id":"golden-145","flag":"max_cart_items","context":{"accessibility_mode":false,"kiosk":true,"store_size":20265.0,"tier":"employee","user_id":"synthetic-user-145"}}
+{"case_id":"golden-146","flag":"receipt_style","context":{"accessibility_mode":false,"kiosk":true,"store_size":20522.0,"tier":"guest","user_id":"synthetic-user-146"}}
+{"case_id":"golden-147","flag":"support_prompt","context":{"accessibility_mode":true,"kiosk":false,"store_size":20779.0,"tier":"member","user_id":"synthetic-user-147"}}
+{"case_id":"golden-148","flag":"checkout_redesign","context":{"accessibility_mode":false,"kiosk":true,"store_size":21036.0,"tier":"member","user_id":"synthetic-user-148"}}
+{"case_id":"golden-149","flag":"max_cart_items","context":{"accessibility_mode":false,"kiosk":true,"store_size":21293.0,"tier":"member","user_id":"synthetic-user-149"}}
+{"case_id":"golden-150","flag":"receipt_style","context":{"accessibility_mode":false,"kiosk":false,"store_size":21550.0,"tier":"employee","user_id":"synthetic-user-150"}}
+{"case_id":"golden-151","flag":"support_prompt","context":{"accessibility_mode":false,"kiosk":true,"store_size":21807.0,"tier":"guest","user_id":"synthetic-user-151"}}
+{"case_id":"golden-152","flag":"checkout_redesign","context":{"accessibility_mode":false,"kiosk":true,"store_size":22064.0,"tier":"member","user_id":"synthetic-user-152"}}
+{"case_id":"golden-153","flag":"max_cart_items","context":{"accessibility_mode":false,"kiosk":false,"store_size":22321.0,"tier":"member","user_id":"synthetic-user-153"}}
+{"case_id":"golden-154","flag":"receipt_style","context":{"accessibility_mode":true,"kiosk":true,"store_size":22578.0,"tier":"member","user_id":"synthetic-user-154"}}
+{"case_id":"golden-155","flag":"support_prompt","context":{"accessibility_mode":false,"kiosk":true,"store_size":22835.0,"tier":"employee","user_id":"synthetic-user-155"}}
+{"case_id":"golden-156","flag":"checkout_redesign","context":{"accessibility_mode":false,"kiosk":false,"store_size":23092.0,"tier":"guest","user_id":"synthetic-user-156"}}
+{"case_id":"golden-157","flag":"max_cart_items","context":{"accessibility_mode":false,"kiosk":true,"store_size":23349.0,"tier":"member","user_id":"synthetic-user-157"}}
+{"case_id":"golden-158","flag":"receipt_style","context":{"accessibility_mode":false,"kiosk":true,"store_size":23606.0,"tier":"member","user_id":"synthetic-user-158"}}
+{"case_id":"golden-159","flag":"support_prompt","context":{"accessibility_mode":false,"kiosk":false,"store_size":23863.0,"tier":"member","user_id":"synthetic-user-159"}}
+{"case_id":"golden-160","flag":"checkout_redesign","context":{"accessibility_mode":false,"kiosk":true,"store_size":24120.0,"tier":"employee","user_id":"synthetic-user-160"}}
+{"case_id":"golden-161","flag":"max_cart_items","context":{"accessibility_mode":true,"kiosk":true,"store_size":24377.0,"tier":"guest","user_id":"synthetic-user-161"}}
+{"case_id":"golden-162","flag":"receipt_style","context":{"accessibility_mode":false,"kiosk":false,"store_size":24634.0,"tier":"member","user_id":"synthetic-user-162"}}
+{"case_id":"golden-163","flag":"support_prompt","context":{"accessibility_mode":false,"kiosk":true,"store_size":24891.0,"tier":"member","user_id":"synthetic-user-163"}}
+{"case_id":"golden-164","flag":"checkout_redesign","context":{"accessibility_mode":false,"kiosk":true,"store_size":25148.0,"tier":"member","user_id":"synthetic-user-164"}}
+{"case_id":"golden-165","flag":"max_cart_items","context":{"accessibility_mode":false,"kiosk":false,"store_size":25405.0,"tier":"employee","user_id":"synthetic-user-165"}}
+{"case_id":"golden-166","flag":"receipt_style","context":{"accessibility_mode":false,"kiosk":true,"store_size":25662.0,"tier":"guest","user_id":"synthetic-user-166"}}
+{"case_id":"golden-167","flag":"support_prompt","context":{"accessibility_mode":false,"kiosk":true,"store_size":25919.0,"tier":"member","user_id":"synthetic-user-167"}}
+{"case_id":"golden-168","flag":"checkout_redesign","context":{"accessibility_mode":true,"kiosk":false,"store_size":26176.0,"tier":"member","user_id":"synthetic-user-168"}}
+{"case_id":"golden-169","flag":"max_cart_items","context":{"accessibility_mode":false,"kiosk":true,"store_size":26433.0,"tier":"member","user_id":"synthetic-user-169"}}
+{"case_id":"golden-170","flag":"receipt_style","context":{"accessibility_mode":false,"kiosk":true,"store_size":26690.0,"tier":"employee","user_id":"synthetic-user-170"}}
+{"case_id":"golden-171","flag":"support_prompt","context":{"accessibility_mode":false,"kiosk":false,"store_size":26947.0,"tier":"guest","user_id":"synthetic-user-171"}}
+{"case_id":"golden-172","flag":"checkout_redesign","context":{"accessibility_mode":false,"kiosk":true,"store_size":27204.0,"tier":"member","user_id":"synthetic-user-172"}}
+{"case_id":"golden-173","flag":"max_cart_items","context":{"accessibility_mode":false,"kiosk":true,"store_size":27461.0,"tier":"member","user_id":"synthetic-user-173"}}
+{"case_id":"golden-174","flag":"receipt_style","context":{"accessibility_mode":false,"kiosk":false,"store_size":27718.0,"tier":"member","user_id":"synthetic-user-174"}}
+{"case_id":"golden-175","flag":"support_prompt","context":{"accessibility_mode":true,"kiosk":true,"store_size":27975.0,"tier":"employee","user_id":"synthetic-user-175"}}
+{"case_id":"golden-176","flag":"checkout_redesign","context":{"accessibility_mode":false,"kiosk":true,"store_size":28232.0,"tier":"guest","user_id":"synthetic-user-176"}}
+{"case_id":"golden-177","flag":"max_cart_items","context":{"accessibility_mode":false,"kiosk":false,"store_size":28489.0,"tier":"member","user_id":"synthetic-user-177"}}
+{"case_id":"golden-178","flag":"receipt_style","context":{"accessibility_mode":false,"kiosk":true,"store_size":28746.0,"tier":"member","user_id":"synthetic-user-178"}}
+{"case_id":"golden-179","flag":"support_prompt","context":{"accessibility_mode":false,"kiosk":true,"store_size":29003.0,"tier":"member","user_id":"synthetic-user-179"}}
+{"case_id":"golden-180","flag":"checkout_redesign","context":{"accessibility_mode":false,"kiosk":false,"store_size":29260.0,"tier":"employee","user_id":"synthetic-user-180"}}
+{"case_id":"golden-181","flag":"max_cart_items","context":{"accessibility_mode":false,"kiosk":true,"store_size":29517.0,"tier":"guest","user_id":"synthetic-user-181"}}
+{"case_id":"golden-182","flag":"receipt_style","context":{"accessibility_mode":true,"kiosk":true,"store_size":29774.0,"tier":"member","user_id":"synthetic-user-182"}}
+{"case_id":"golden-183","flag":"support_prompt","context":{"accessibility_mode":false,"kiosk":false,"store_size":30031.0,"tier":"member","user_id":"synthetic-user-183"}}
+{"case_id":"golden-184","flag":"checkout_redesign","context":{"accessibility_mode":false,"kiosk":true,"store_size":30288.0,"tier":"member","user_id":"synthetic-user-184"}}
+{"case_id":"golden-185","flag":"max_cart_items","context":{"accessibility_mode":false,"kiosk":true,"store_size":30545.0,"tier":"employee","user_id":"synthetic-user-185"}}
+{"case_id":"golden-186","flag":"receipt_style","context":{"accessibility_mode":false,"kiosk":false,"store_size":30802.0,"tier":"guest","user_id":"synthetic-user-186"}}
+{"case_id":"golden-187","flag":"support_prompt","context":{"accessibility_mode":false,"kiosk":true,"store_size":31059.0,"tier":"member","user_id":"synthetic-user-187"}}
+{"case_id":"golden-188","flag":"checkout_redesign","context":{"accessibility_mode":false,"kiosk":true,"store_size":31316.0,"tier":"member","user_id":"synthetic-user-188"}}
+{"case_id":"golden-189","flag":"max_cart_items","context":{"accessibility_mode":true,"kiosk":false,"store_size":31573.0,"tier":"member","user_id":"synthetic-user-189"}}
+{"case_id":"golden-190","flag":"receipt_style","context":{"accessibility_mode":false,"kiosk":true,"store_size":31830.0,"tier":"employee","user_id":"synthetic-user-190"}}
+{"case_id":"golden-191","flag":"support_prompt","context":{"accessibility_mode":false,"kiosk":true,"store_size":32087.0,"tier":"guest","user_id":"synthetic-user-191"}}
+{"case_id":"golden-192","flag":"checkout_redesign","context":{"accessibility_mode":false,"kiosk":false,"store_size":32344.0,"tier":"member","user_id":"synthetic-user-192"}}
+{"case_id":"golden-193","flag":"max_cart_items","context":{"accessibility_mode":false,"kiosk":true,"store_size":32601.0,"tier":"member","user_id":"synthetic-user-193"}}
+{"case_id":"golden-194","flag":"receipt_style","context":{"accessibility_mode":false,"kiosk":true,"store_size":32858.0,"tier":"member","user_id":"synthetic-user-194"}}
+{"case_id":"golden-195","flag":"support_prompt","context":{"accessibility_mode":false,"kiosk":false,"store_size":8115.0,"tier":"employee","user_id":"synthetic-user-195"}}
+{"case_id":"golden-196","flag":"checkout_redesign","context":{"accessibility_mode":true,"kiosk":true,"store_size":8372.0,"tier":"guest","user_id":"synthetic-user-196"}}
+{"case_id":"golden-197","flag":"max_cart_items","context":{"accessibility_mode":false,"kiosk":true,"store_size":8629.0,"tier":"member","user_id":"synthetic-user-197"}}
+{"case_id":"golden-198","flag":"receipt_style","context":{"accessibility_mode":false,"kiosk":false,"store_size":8886.0,"tier":"member","user_id":"synthetic-user-198"}}
+{"case_id":"golden-199","flag":"support_prompt","context":{"accessibility_mode":false,"kiosk":true,"store_size":9143.0,"tier":"member","user_id":"synthetic-user-199"}}
+{"case_id":"golden-200","flag":"checkout_redesign","context":{"accessibility_mode":false,"kiosk":true,"store_size":9400.0,"tier":"employee","user_id":"synthetic-user-200"}}
+{"case_id":"golden-201","flag":"max_cart_items","context":{"accessibility_mode":false,"kiosk":false,"store_size":9657.0,"tier":"guest","user_id":"synthetic-user-201"}}
+{"case_id":"golden-202","flag":"receipt_style","context":{"accessibility_mode":false,"kiosk":true,"store_size":9914.0,"tier":"member","user_id":"synthetic-user-202"}}
+{"case_id":"golden-203","flag":"support_prompt","context":{"accessibility_mode":true,"kiosk":true,"store_size":10171.0,"tier":"member","user_id":"synthetic-user-203"}}
+{"case_id":"golden-204","flag":"checkout_redesign","context":{"accessibility_mode":false,"kiosk":false,"store_size":10428.0,"tier":"member","user_id":"synthetic-user-204"}}
+{"case_id":"golden-205","flag":"max_cart_items","context":{"accessibility_mode":false,"kiosk":true,"store_size":10685.0,"tier":"employee","user_id":"synthetic-user-205"}}
+{"case_id":"golden-206","flag":"receipt_style","context":{"accessibility_mode":false,"kiosk":true,"store_size":10942.0,"tier":"guest","user_id":"synthetic-user-206"}}
+{"case_id":"golden-207","flag":"support_prompt","context":{"accessibility_mode":false,"kiosk":false,"store_size":11199.0,"tier":"member","user_id":"synthetic-user-207"}}
+{"case_id":"golden-208","flag":"checkout_redesign","context":{"accessibility_mode":false,"kiosk":true,"store_size":11456.0,"tier":"member","user_id":"synthetic-user-208"}}
+{"case_id":"golden-209","flag":"max_cart_items","context":{"accessibility_mode":false,"kiosk":true,"store_size":11713.0,"tier":"member","user_id":"synthetic-user-209"}}
+{"case_id":"golden-210","flag":"receipt_style","context":{"accessibility_mode":true,"kiosk":false,"store_size":11970.0,"tier":"employee","user_id":"synthetic-user-210"}}
+{"case_id":"golden-211","flag":"support_prompt","context":{"accessibility_mode":false,"kiosk":true,"store_size":12227.0,"tier":"guest","user_id":"synthetic-user-211"}}
+{"case_id":"golden-212","flag":"checkout_redesign","context":{"accessibility_mode":false,"kiosk":true,"store_size":12484.0,"tier":"member","user_id":"synthetic-user-212"}}
+{"case_id":"golden-213","flag":"max_cart_items","context":{"accessibility_mode":false,"kiosk":false,"store_size":12741.0,"tier":"member","user_id":"synthetic-user-213"}}
+{"case_id":"golden-214","flag":"receipt_style","context":{"accessibility_mode":false,"kiosk":true,"store_size":12998.0,"tier":"member","user_id":"synthetic-user-214"}}
+{"case_id":"golden-215","flag":"support_prompt","context":{"accessibility_mode":false,"kiosk":true,"store_size":13255.0,"tier":"employee","user_id":"synthetic-user-215"}}
+{"case_id":"golden-216","flag":"checkout_redesign","context":{"accessibility_mode":false,"kiosk":false,"store_size":13512.0,"tier":"guest","user_id":"synthetic-user-216"}}
+{"case_id":"golden-217","flag":"max_cart_items","context":{"accessibility_mode":true,"kiosk":true,"store_size":13769.0,"tier":"member","user_id":"synthetic-user-217"}}
+{"case_id":"golden-218","flag":"receipt_style","context":{"accessibility_mode":false,"kiosk":true,"store_size":14026.0,"tier":"member","user_id":"synthetic-user-218"}}
+{"case_id":"golden-219","flag":"support_prompt","context":{"accessibility_mode":false,"kiosk":false,"store_size":14283.0,"tier":"member","user_id":"synthetic-user-219"}}
+{"case_id":"golden-220","flag":"checkout_redesign","context":{"accessibility_mode":false,"kiosk":true,"store_size":14540.0,"tier":"employee","user_id":"synthetic-user-220"}}
+{"case_id":"golden-221","flag":"max_cart_items","context":{"accessibility_mode":false,"kiosk":true,"store_size":14797.0,"tier":"guest","user_id":"synthetic-user-221"}}
+{"case_id":"golden-222","flag":"receipt_style","context":{"accessibility_mode":false,"kiosk":false,"store_size":15054.0,"tier":"member","user_id":"synthetic-user-222"}}
+{"case_id":"golden-223","flag":"support_prompt","context":{"accessibility_mode":false,"kiosk":true,"store_size":15311.0,"tier":"member","user_id":"synthetic-user-223"}}
+{"case_id":"golden-224","flag":"checkout_redesign","context":{"accessibility_mode":true,"kiosk":true,"store_size":15568.0,"tier":"member","user_id":"synthetic-user-224"}}
+{"case_id":"golden-225","flag":"max_cart_items","context":{"accessibility_mode":false,"kiosk":false,"store_size":15825.0,"tier":"employee","user_id":"synthetic-user-225"}}
+{"case_id":"golden-226","flag":"receipt_style","context":{"accessibility_mode":false,"kiosk":true,"store_size":16082.0,"tier":"guest","user_id":"synthetic-user-226"}}
+{"case_id":"golden-227","flag":"support_prompt","context":{"accessibility_mode":false,"kiosk":true,"store_size":16339.0,"tier":"member","user_id":"synthetic-user-227"}}
+{"case_id":"golden-228","flag":"checkout_redesign","context":{"accessibility_mode":false,"kiosk":false,"store_size":16596.0,"tier":"member","user_id":"synthetic-user-228"}}
+{"case_id":"golden-229","flag":"max_cart_items","context":{"accessibility_mode":false,"kiosk":true,"store_size":16853.0,"tier":"member","user_id":"synthetic-user-229"}}
+{"case_id":"golden-230","flag":"receipt_style","context":{"accessibility_mode":false,"kiosk":true,"store_size":17110.0,"tier":"employee","user_id":"synthetic-user-230"}}
+{"case_id":"golden-231","flag":"support_prompt","context":{"accessibility_mode":true,"kiosk":false,"store_size":17367.0,"tier":"guest","user_id":"synthetic-user-231"}}
+{"case_id":"golden-232","flag":"checkout_redesign","context":{"accessibility_mode":false,"kiosk":true,"store_size":17624.0,"tier":"member","user_id":"synthetic-user-232"}}
+{"case_id":"golden-233","flag":"max_cart_items","context":{"accessibility_mode":false,"kiosk":true,"store_size":17881.0,"tier":"member","user_id":"synthetic-user-233"}}
+{"case_id":"golden-234","flag":"receipt_style","context":{"accessibility_mode":false,"kiosk":false,"store_size":18138.0,"tier":"member","user_id":"synthetic-user-234"}}
+{"case_id":"golden-235","flag":"support_prompt","context":{"accessibility_mode":false,"kiosk":true,"store_size":18395.0,"tier":"employee","user_id":"synthetic-user-235"}}
+{"case_id":"golden-236","flag":"checkout_redesign","context":{"accessibility_mode":false,"kiosk":true,"store_size":18652.0,"tier":"guest","user_id":"synthetic-user-236"}}
+{"case_id":"golden-237","flag":"max_cart_items","context":{"accessibility_mode":false,"kiosk":false,"store_size":18909.0,"tier":"member","user_id":"synthetic-user-237"}}
+{"case_id":"golden-238","flag":"receipt_style","context":{"accessibility_mode":true,"kiosk":true,"store_size":19166.0,"tier":"member","user_id":"synthetic-user-238"}}
+{"case_id":"golden-239","flag":"support_prompt","context":{"accessibility_mode":false,"kiosk":true,"store_size":19423.0,"tier":"member","user_id":"synthetic-user-239"}}
+{"case_id":"golden-240","flag":"checkout_redesign","context":{"accessibility_mode":false,"kiosk":false,"store_size":19680.0,"tier":"employee","user_id":"synthetic-user-240"}}
+{"case_id":"golden-241","flag":"max_cart_items","context":{"accessibility_mode":false,"kiosk":true,"store_size":19937.0,"tier":"guest","user_id":"synthetic-user-241"}}
+{"case_id":"golden-242","flag":"receipt_style","context":{"accessibility_mode":false,"kiosk":true,"store_size":20194.0,"tier":"member","user_id":"synthetic-user-242"}}
+{"case_id":"golden-243","flag":"support_prompt","context":{"accessibility_mode":false,"kiosk":false,"store_size":20451.0,"tier":"member","user_id":"synthetic-user-243"}}
+{"case_id":"golden-244","flag":"checkout_redesign","context":{"accessibility_mode":false,"kiosk":true,"store_size":20708.0,"tier":"member","user_id":"synthetic-user-244"}}
+{"case_id":"golden-245","flag":"max_cart_items","context":{"accessibility_mode":true,"kiosk":true,"store_size":20965.0,"tier":"employee","user_id":"synthetic-user-245"}}
+{"case_id":"golden-246","flag":"receipt_style","context":{"accessibility_mode":false,"kiosk":false,"store_size":21222.0,"tier":"guest","user_id":"synthetic-user-246"}}
+{"case_id":"golden-247","flag":"support_prompt","context":{"accessibility_mode":false,"kiosk":true,"store_size":21479.0,"tier":"member","user_id":"synthetic-user-247"}}
+{"case_id":"golden-248","flag":"checkout_redesign","context":{"accessibility_mode":false,"kiosk":true,"store_size":21736.0,"tier":"member","user_id":"synthetic-user-248"}}
+{"case_id":"golden-249","flag":"max_cart_items","context":{"accessibility_mode":false,"kiosk":false,"store_size":21993.0,"tier":"member","user_id":"synthetic-user-249"}}
diff --git a/developer-simulation/runs/2026-08-01--offline-flag-parity/fixtures/golden.json b/developer-simulation/runs/2026-08-01--offline-flag-parity/fixtures/golden.json
new file mode 100644
index 0000000..51055f0
--- /dev/null
+++ b/developer-simulation/runs/2026-08-01--offline-flag-parity/fixtures/golden.json
@@ -0,0 +1,7212 @@
+[
+  {
+    "input": {
+      "case_id": "golden-000",
+      "flag": "checkout_redesign",
+      "context": {
+        "accessibility_mode": true,
+        "kiosk": false,
+        "store_size": 8000.0,
+        "tier": "employee",
+        "user_id": "synthetic-user-000"
+      }
+    },
+    "expected": {
+      "flag": "checkout_redesign",
+      "value": true,
+      "source": "employees-first",
+      "explanation": [
+        {
+          "rule_id": "employees-first",
+          "matched": true,
+          "reason": "all conditions matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-001",
+      "flag": "max_cart_items",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": true,
+        "store_size": 8257.0,
+        "tier": "guest",
+        "user_id": "synthetic-user-001"
+      }
+    },
+    "expected": {
+      "flag": "max_cart_items",
+      "value": 30.0,
+      "source": "default",
+      "explanation": [
+        {
+          "rule_id": "large-store",
+          "matched": false,
+          "reason": "attribute \"store_size\" was 8257; condition did not match"
+        },
+        {
+          "rule_id": "default",
+          "matched": true,
+          "reason": "no targeting rule matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-002",
+      "flag": "receipt_style",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": true,
+        "store_size": 8514.0,
+        "tier": "member",
+        "user_id": "synthetic-user-002"
+      }
+    },
+    "expected": {
+      "flag": "receipt_style",
+      "value": "compact",
+      "source": "default",
+      "explanation": [
+        {
+          "rule_id": "accessible-store",
+          "matched": false,
+          "reason": "attribute \"accessibility_mode\" was false; condition did not match"
+        },
+        {
+          "rule_id": "default",
+          "matched": true,
+          "reason": "no targeting rule matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-003",
+      "flag": "support_prompt",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": false,
+        "store_size": 8771.0,
+        "tier": "member",
+        "user_id": "synthetic-user-003"
+      }
+    },
+    "expected": {
+      "flag": "support_prompt",
+      "value": true,
+      "source": "non-guest",
+      "explanation": [
+        {
+          "rule_id": "non-guest",
+          "matched": true,
+          "reason": "all conditions matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-004",
+      "flag": "checkout_redesign",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": true,
+        "store_size": 9028.0,
+        "tier": "member",
+        "user_id": "synthetic-user-004"
+      }
+    },
+    "expected": {
+      "flag": "checkout_redesign",
+      "value": false,
+      "source": "default",
+      "explanation": [
+        {
+          "rule_id": "employees-first",
+          "matched": false,
+          "reason": "attribute \"tier\" was \"member\"; condition did not match"
+        },
+        {
+          "rule_id": "kiosk-rollout",
+          "matched": false,
+          "reason": "stable bucket 7272 was outside 0..3500"
+        },
+        {
+          "rule_id": "default",
+          "matched": true,
+          "reason": "no targeting rule matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-005",
+      "flag": "max_cart_items",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": true,
+        "store_size": 9285.0,
+        "tier": "employee",
+        "user_id": "synthetic-user-005"
+      }
+    },
+    "expected": {
+      "flag": "max_cart_items",
+      "value": 30.0,
+      "source": "default",
+      "explanation": [
+        {
+          "rule_id": "large-store",
+          "matched": false,
+          "reason": "attribute \"store_size\" was 9285; condition did not match"
+        },
+        {
+          "rule_id": "default",
+          "matched": true,
+          "reason": "no targeting rule matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-006",
+      "flag": "receipt_style",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": false,
+        "store_size": 9542.0,
+        "tier": "guest",
+        "user_id": "synthetic-user-006"
+      }
+    },
+    "expected": {
+      "flag": "receipt_style",
+      "value": "compact",
+      "source": "default",
+      "explanation": [
+        {
+          "rule_id": "accessible-store",
+          "matched": false,
+          "reason": "attribute \"accessibility_mode\" was false; condition did not match"
+        },
+        {
+          "rule_id": "default",
+          "matched": true,
+          "reason": "no targeting rule matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-007",
+      "flag": "support_prompt",
+      "context": {
+        "accessibility_mode": true,
+        "kiosk": true,
+        "store_size": 9799.0,
+        "tier": "member",
+        "user_id": "synthetic-user-007"
+      }
+    },
+    "expected": {
+      "flag": "support_prompt",
+      "value": true,
+      "source": "non-guest",
+      "explanation": [
+        {
+          "rule_id": "non-guest",
+          "matched": true,
+          "reason": "all conditions matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-008",
+      "flag": "checkout_redesign",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": true,
+        "store_size": 10056.0,
+        "tier": "member",
+        "user_id": "synthetic-user-008"
+      }
+    },
+    "expected": {
+      "flag": "checkout_redesign",
+      "value": false,
+      "source": "default",
+      "explanation": [
+        {
+          "rule_id": "employees-first",
+          "matched": false,
+          "reason": "attribute \"tier\" was \"member\"; condition did not match"
+        },
+        {
+          "rule_id": "kiosk-rollout",
+          "matched": false,
+          "reason": "stable bucket 9892 was outside 0..3500"
+        },
+        {
+          "rule_id": "default",
+          "matched": true,
+          "reason": "no targeting rule matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-009",
+      "flag": "max_cart_items",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": false,
+        "store_size": 10313.0,
+        "tier": "member",
+        "user_id": "synthetic-user-009"
+      }
+    },
+    "expected": {
+      "flag": "max_cart_items",
+      "value": 30.0,
+      "source": "default",
+      "explanation": [
+        {
+          "rule_id": "large-store",
+          "matched": false,
+          "reason": "attribute \"store_size\" was 10313; condition did not match"
+        },
+        {
+          "rule_id": "default",
+          "matched": true,
+          "reason": "no targeting rule matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-010",
+      "flag": "receipt_style",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": true,
+        "store_size": 10570.0,
+        "tier": "employee",
+        "user_id": "synthetic-user-010"
+      }
+    },
+    "expected": {
+      "flag": "receipt_style",
+      "value": "compact",
+      "source": "default",
+      "explanation": [
+        {
+          "rule_id": "accessible-store",
+          "matched": false,
+          "reason": "attribute \"accessibility_mode\" was false; condition did not match"
+        },
+        {
+          "rule_id": "default",
+          "matched": true,
+          "reason": "no targeting rule matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-011",
+      "flag": "support_prompt",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": true,
+        "store_size": 10827.0,
+        "tier": "guest",
+        "user_id": "synthetic-user-011"
+      }
+    },
+    "expected": {
+      "flag": "support_prompt",
+      "value": false,
+      "source": "default",
+      "explanation": [
+        {
+          "rule_id": "non-guest",
+          "matched": false,
+          "reason": "attribute \"tier\" was \"guest\"; condition did not match"
+        },
+        {
+          "rule_id": "default",
+          "matched": true,
+          "reason": "no targeting rule matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-012",
+      "flag": "checkout_redesign",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": false,
+        "store_size": 11084.0,
+        "tier": "member",
+        "user_id": "synthetic-user-012"
+      }
+    },
+    "expected": {
+      "flag": "checkout_redesign",
+      "value": false,
+      "source": "default",
+      "explanation": [
+        {
+          "rule_id": "employees-first",
+          "matched": false,
+          "reason": "attribute \"tier\" was \"member\"; condition did not match"
+        },
+        {
+          "rule_id": "kiosk-rollout",
+          "matched": false,
+          "reason": "attribute \"kiosk\" was false; condition did not match"
+        },
+        {
+          "rule_id": "default",
+          "matched": true,
+          "reason": "no targeting rule matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-013",
+      "flag": "max_cart_items",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": true,
+        "store_size": 11341.0,
+        "tier": "member",
+        "user_id": "synthetic-user-013"
+      }
+    },
+    "expected": {
+      "flag": "max_cart_items",
+      "value": 30.0,
+      "source": "default",
+      "explanation": [
+        {
+          "rule_id": "large-store",
+          "matched": false,
+          "reason": "attribute \"store_size\" was 11341; condition did not match"
+        },
+        {
+          "rule_id": "default",
+          "matched": true,
+          "reason": "no targeting rule matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-014",
+      "flag": "receipt_style",
+      "context": {
+        "accessibility_mode": true,
+        "kiosk": true,
+        "store_size": 11598.0,
+        "tier": "member",
+        "user_id": "synthetic-user-014"
+      }
+    },
+    "expected": {
+      "flag": "receipt_style",
+      "value": "large-print",
+      "source": "accessible-store",
+      "explanation": [
+        {
+          "rule_id": "accessible-store",
+          "matched": true,
+          "reason": "all conditions matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-015",
+      "flag": "support_prompt",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": false,
+        "store_size": 11855.0,
+        "tier": "employee",
+        "user_id": "synthetic-user-015"
+      }
+    },
+    "expected": {
+      "flag": "support_prompt",
+      "value": true,
+      "source": "non-guest",
+      "explanation": [
+        {
+          "rule_id": "non-guest",
+          "matched": true,
+          "reason": "all conditions matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-016",
+      "flag": "checkout_redesign",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": true,
+        "store_size": 12112.0,
+        "tier": "guest",
+        "user_id": "synthetic-user-016"
+      }
+    },
+    "expected": {
+      "flag": "checkout_redesign",
+      "value": false,
+      "source": "default",
+      "explanation": [
+        {
+          "rule_id": "employees-first",
+          "matched": false,
+          "reason": "attribute \"tier\" was \"guest\"; condition did not match"
+        },
+        {
+          "rule_id": "kiosk-rollout",
+          "matched": false,
+          "reason": "stable bucket 5137 was outside 0..3500"
+        },
+        {
+          "rule_id": "default",
+          "matched": true,
+          "reason": "no targeting rule matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-017",
+      "flag": "max_cart_items",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": true,
+        "store_size": 12369.0,
+        "tier": "member",
+        "user_id": "synthetic-user-017"
+      }
+    },
+    "expected": {
+      "flag": "max_cart_items",
+      "value": 30.0,
+      "source": "default",
+      "explanation": [
+        {
+          "rule_id": "large-store",
+          "matched": false,
+          "reason": "attribute \"store_size\" was 12369; condition did not match"
+        },
+        {
+          "rule_id": "default",
+          "matched": true,
+          "reason": "no targeting rule matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-018",
+      "flag": "receipt_style",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": false,
+        "store_size": 12626.0,
+        "tier": "member",
+        "user_id": "synthetic-user-018"
+      }
+    },
+    "expected": {
+      "flag": "receipt_style",
+      "value": "compact",
+      "source": "default",
+      "explanation": [
+        {
+          "rule_id": "accessible-store",
+          "matched": false,
+          "reason": "attribute \"accessibility_mode\" was false; condition did not match"
+        },
+        {
+          "rule_id": "default",
+          "matched": true,
+          "reason": "no targeting rule matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-019",
+      "flag": "support_prompt",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": true,
+        "store_size": 12883.0,
+        "tier": "member",
+        "user_id": "synthetic-user-019"
+      }
+    },
+    "expected": {
+      "flag": "support_prompt",
+      "value": true,
+      "source": "non-guest",
+      "explanation": [
+        {
+          "rule_id": "non-guest",
+          "matched": true,
+          "reason": "all conditions matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-020",
+      "flag": "checkout_redesign",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": true,
+        "store_size": 13140.0,
+        "tier": "employee",
+        "user_id": "synthetic-user-020"
+      }
+    },
+    "expected": {
+      "flag": "checkout_redesign",
+      "value": true,
+      "source": "employees-first",
+      "explanation": [
+        {
+          "rule_id": "employees-first",
+          "matched": true,
+          "reason": "all conditions matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-021",
+      "flag": "max_cart_items",
+      "context": {
+        "accessibility_mode": true,
+        "kiosk": false,
+        "store_size": 13397.0,
+        "tier": "guest",
+        "user_id": "synthetic-user-021"
+      }
+    },
+    "expected": {
+      "flag": "max_cart_items",
+      "value": 30.0,
+      "source": "default",
+      "explanation": [
+        {
+          "rule_id": "large-store",
+          "matched": false,
+          "reason": "attribute \"store_size\" was 13397; condition did not match"
+        },
+        {
+          "rule_id": "default",
+          "matched": true,
+          "reason": "no targeting rule matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-022",
+      "flag": "receipt_style",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": true,
+        "store_size": 13654.0,
+        "tier": "member",
+        "user_id": "synthetic-user-022"
+      }
+    },
+    "expected": {
+      "flag": "receipt_style",
+      "value": "compact",
+      "source": "default",
+      "explanation": [
+        {
+          "rule_id": "accessible-store",
+          "matched": false,
+          "reason": "attribute \"accessibility_mode\" was false; condition did not match"
+        },
+        {
+          "rule_id": "default",
+          "matched": true,
+          "reason": "no targeting rule matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-023",
+      "flag": "support_prompt",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": true,
+        "store_size": 13911.0,
+        "tier": "member",
+        "user_id": "synthetic-user-023"
+      }
+    },
+    "expected": {
+      "flag": "support_prompt",
+      "value": true,
+      "source": "non-guest",
+      "explanation": [
+        {
+          "rule_id": "non-guest",
+          "matched": true,
+          "reason": "all conditions matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-024",
+      "flag": "checkout_redesign",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": false,
+        "store_size": 14168.0,
+        "tier": "member",
+        "user_id": "synthetic-user-024"
+      }
+    },
+    "expected": {
+      "flag": "checkout_redesign",
+      "value": false,
+      "source": "default",
+      "explanation": [
+        {
+          "rule_id": "employees-first",
+          "matched": false,
+          "reason": "attribute \"tier\" was \"member\"; condition did not match"
+        },
+        {
+          "rule_id": "kiosk-rollout",
+          "matched": false,
+          "reason": "attribute \"kiosk\" was false; condition did not match"
+        },
+        {
+          "rule_id": "default",
+          "matched": true,
+          "reason": "no targeting rule matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-025",
+      "flag": "max_cart_items",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": true,
+        "store_size": 14425.0,
+        "tier": "employee",
+        "user_id": "synthetic-user-025"
+      }
+    },
+    "expected": {
+      "flag": "max_cart_items",
+      "value": 30.0,
+      "source": "default",
+      "explanation": [
+        {
+          "rule_id": "large-store",
+          "matched": false,
+          "reason": "attribute \"store_size\" was 14425; condition did not match"
+        },
+        {
+          "rule_id": "default",
+          "matched": true,
+          "reason": "no targeting rule matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-026",
+      "flag": "receipt_style",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": true,
+        "store_size": 14682.0,
+        "tier": "guest",
+        "user_id": "synthetic-user-026"
+      }
+    },
+    "expected": {
+      "flag": "receipt_style",
+      "value": "compact",
+      "source": "default",
+      "explanation": [
+        {
+          "rule_id": "accessible-store",
+          "matched": false,
+          "reason": "attribute \"accessibility_mode\" was false; condition did not match"
+        },
+        {
+          "rule_id": "default",
+          "matched": true,
+          "reason": "no targeting rule matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-027",
+      "flag": "support_prompt",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": false,
+        "store_size": 14939.0,
+        "tier": "member",
+        "user_id": "synthetic-user-027"
+      }
+    },
+    "expected": {
+      "flag": "support_prompt",
+      "value": true,
+      "source": "non-guest",
+      "explanation": [
+        {
+          "rule_id": "non-guest",
+          "matched": true,
+          "reason": "all conditions matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-028",
+      "flag": "checkout_redesign",
+      "context": {
+        "accessibility_mode": true,
+        "kiosk": true,
+        "store_size": 15196.0,
+        "tier": "member",
+        "user_id": "synthetic-user-028"
+      }
+    },
+    "expected": {
+      "flag": "checkout_redesign",
+      "value": false,
+      "source": "default",
+      "explanation": [
+        {
+          "rule_id": "employees-first",
+          "matched": false,
+          "reason": "attribute \"tier\" was \"member\"; condition did not match"
+        },
+        {
+          "rule_id": "kiosk-rollout",
+          "matched": false,
+          "reason": "stable bucket 9642 was outside 0..3500"
+        },
+        {
+          "rule_id": "default",
+          "matched": true,
+          "reason": "no targeting rule matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-029",
+      "flag": "max_cart_items",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": true,
+        "store_size": 15453.0,
+        "tier": "member",
+        "user_id": "synthetic-user-029"
+      }
+    },
+    "expected": {
+      "flag": "max_cart_items",
+      "value": 30.0,
+      "source": "default",
+      "explanation": [
+        {
+          "rule_id": "large-store",
+          "matched": false,
+          "reason": "attribute \"store_size\" was 15453; condition did not match"
+        },
+        {
+          "rule_id": "default",
+          "matched": true,
+          "reason": "no targeting rule matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-030",
+      "flag": "receipt_style",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": false,
+        "store_size": 15710.0,
+        "tier": "employee",
+        "user_id": "synthetic-user-030"
+      }
+    },
+    "expected": {
+      "flag": "receipt_style",
+      "value": "compact",
+      "source": "default",
+      "explanation": [
+        {
+          "rule_id": "accessible-store",
+          "matched": false,
+          "reason": "attribute \"accessibility_mode\" was false; condition did not match"
+        },
+        {
+          "rule_id": "default",
+          "matched": true,
+          "reason": "no targeting rule matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-031",
+      "flag": "support_prompt",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": true,
+        "store_size": 15967.0,
+        "tier": "guest",
+        "user_id": "synthetic-user-031"
+      }
+    },
+    "expected": {
+      "flag": "support_prompt",
+      "value": false,
+      "source": "default",
+      "explanation": [
+        {
+          "rule_id": "non-guest",
+          "matched": false,
+          "reason": "attribute \"tier\" was \"guest\"; condition did not match"
+        },
+        {
+          "rule_id": "default",
+          "matched": true,
+          "reason": "no targeting rule matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-032",
+      "flag": "checkout_redesign",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": true,
+        "store_size": 16224.0,
+        "tier": "member",
+        "user_id": "synthetic-user-032"
+      }
+    },
+    "expected": {
+      "flag": "checkout_redesign",
+      "value": false,
+      "source": "default",
+      "explanation": [
+        {
+          "rule_id": "employees-first",
+          "matched": false,
+          "reason": "attribute \"tier\" was \"member\"; condition did not match"
+        },
+        {
+          "rule_id": "kiosk-rollout",
+          "matched": false,
+          "reason": "stable bucket 6287 was outside 0..3500"
+        },
+        {
+          "rule_id": "default",
+          "matched": true,
+          "reason": "no targeting rule matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-033",
+      "flag": "max_cart_items",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": false,
+        "store_size": 16481.0,
+        "tier": "member",
+        "user_id": "synthetic-user-033"
+      }
+    },
+    "expected": {
+      "flag": "max_cart_items",
+      "value": 30.0,
+      "source": "default",
+      "explanation": [
+        {
+          "rule_id": "large-store",
+          "matched": false,
+          "reason": "attribute \"store_size\" was 16481; condition did not match"
+        },
+        {
+          "rule_id": "default",
+          "matched": true,
+          "reason": "no targeting rule matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-034",
+      "flag": "receipt_style",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": true,
+        "store_size": 16738.0,
+        "tier": "member",
+        "user_id": "synthetic-user-034"
+      }
+    },
+    "expected": {
+      "flag": "receipt_style",
+      "value": "compact",
+      "source": "default",
+      "explanation": [
+        {
+          "rule_id": "accessible-store",
+          "matched": false,
+          "reason": "attribute \"accessibility_mode\" was false; condition did not match"
+        },
+        {
+          "rule_id": "default",
+          "matched": true,
+          "reason": "no targeting rule matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-035",
+      "flag": "support_prompt",
+      "context": {
+        "accessibility_mode": true,
+        "kiosk": true,
+        "store_size": 16995.0,
+        "tier": "employee",
+        "user_id": "synthetic-user-035"
+      }
+    },
+    "expected": {
+      "flag": "support_prompt",
+      "value": true,
+      "source": "non-guest",
+      "explanation": [
+        {
+          "rule_id": "non-guest",
+          "matched": true,
+          "reason": "all conditions matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-036",
+      "flag": "checkout_redesign",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": false,
+        "store_size": 17252.0,
+        "tier": "guest",
+        "user_id": "synthetic-user-036"
+      }
+    },
+    "expected": {
+      "flag": "checkout_redesign",
+      "value": false,
+      "source": "default",
+      "explanation": [
+        {
+          "rule_id": "employees-first",
+          "matched": false,
+          "reason": "attribute \"tier\" was \"guest\"; condition did not match"
+        },
+        {
+          "rule_id": "kiosk-rollout",
+          "matched": false,
+          "reason": "attribute \"kiosk\" was false; condition did not match"
+        },
+        {
+          "rule_id": "default",
+          "matched": true,
+          "reason": "no targeting rule matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-037",
+      "flag": "max_cart_items",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": true,
+        "store_size": 17509.0,
+        "tier": "member",
+        "user_id": "synthetic-user-037"
+      }
+    },
+    "expected": {
+      "flag": "max_cart_items",
+      "value": 30.0,
+      "source": "default",
+      "explanation": [
+        {
+          "rule_id": "large-store",
+          "matched": false,
+          "reason": "attribute \"store_size\" was 17509; condition did not match"
+        },
+        {
+          "rule_id": "default",
+          "matched": true,
+          "reason": "no targeting rule matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-038",
+      "flag": "receipt_style",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": true,
+        "store_size": 17766.0,
+        "tier": "member",
+        "user_id": "synthetic-user-038"
+      }
+    },
+    "expected": {
+      "flag": "receipt_style",
+      "value": "compact",
+      "source": "default",
+      "explanation": [
+        {
+          "rule_id": "accessible-store",
+          "matched": false,
+          "reason": "attribute \"accessibility_mode\" was false; condition did not match"
+        },
+        {
+          "rule_id": "default",
+          "matched": true,
+          "reason": "no targeting rule matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-039",
+      "flag": "support_prompt",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": false,
+        "store_size": 18023.0,
+        "tier": "member",
+        "user_id": "synthetic-user-039"
+      }
+    },
+    "expected": {
+      "flag": "support_prompt",
+      "value": true,
+      "source": "non-guest",
+      "explanation": [
+        {
+          "rule_id": "non-guest",
+          "matched": true,
+          "reason": "all conditions matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-040",
+      "flag": "checkout_redesign",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": true,
+        "store_size": 18280.0,
+        "tier": "employee",
+        "user_id": "synthetic-user-040"
+      }
+    },
+    "expected": {
+      "flag": "checkout_redesign",
+      "value": true,
+      "source": "employees-first",
+      "explanation": [
+        {
+          "rule_id": "employees-first",
+          "matched": true,
+          "reason": "all conditions matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-041",
+      "flag": "max_cart_items",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": true,
+        "store_size": 18537.0,
+        "tier": "guest",
+        "user_id": "synthetic-user-041"
+      }
+    },
+    "expected": {
+      "flag": "max_cart_items",
+      "value": 30.0,
+      "source": "default",
+      "explanation": [
+        {
+          "rule_id": "large-store",
+          "matched": false,
+          "reason": "attribute \"store_size\" was 18537; condition did not match"
+        },
+        {
+          "rule_id": "default",
+          "matched": true,
+          "reason": "no targeting rule matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-042",
+      "flag": "receipt_style",
+      "context": {
+        "accessibility_mode": true,
+        "kiosk": false,
+        "store_size": 18794.0,
+        "tier": "member",
+        "user_id": "synthetic-user-042"
+      }
+    },
+    "expected": {
+      "flag": "receipt_style",
+      "value": "large-print",
+      "source": "accessible-store",
+      "explanation": [
+        {
+          "rule_id": "accessible-store",
+          "matched": true,
+          "reason": "all conditions matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-043",
+      "flag": "support_prompt",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": true,
+        "store_size": 19051.0,
+        "tier": "member",
+        "user_id": "synthetic-user-043"
+      }
+    },
+    "expected": {
+      "flag": "support_prompt",
+      "value": true,
+      "source": "non-guest",
+      "explanation": [
+        {
+          "rule_id": "non-guest",
+          "matched": true,
+          "reason": "all conditions matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-044",
+      "flag": "checkout_redesign",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": true,
+        "store_size": 19308.0,
+        "tier": "member",
+        "user_id": "synthetic-user-044"
+      }
+    },
+    "expected": {
+      "flag": "checkout_redesign",
+      "value": false,
+      "source": "default",
+      "explanation": [
+        {
+          "rule_id": "employees-first",
+          "matched": false,
+          "reason": "attribute \"tier\" was \"member\"; condition did not match"
+        },
+        {
+          "rule_id": "kiosk-rollout",
+          "matched": false,
+          "reason": "stable bucket 7332 was outside 0..3500"
+        },
+        {
+          "rule_id": "default",
+          "matched": true,
+          "reason": "no targeting rule matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-045",
+      "flag": "max_cart_items",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": false,
+        "store_size": 19565.0,
+        "tier": "employee",
+        "user_id": "synthetic-user-045"
+      }
+    },
+    "expected": {
+      "flag": "max_cart_items",
+      "value": 30.0,
+      "source": "default",
+      "explanation": [
+        {
+          "rule_id": "large-store",
+          "matched": false,
+          "reason": "attribute \"store_size\" was 19565; condition did not match"
+        },
+        {
+          "rule_id": "default",
+          "matched": true,
+          "reason": "no targeting rule matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-046",
+      "flag": "receipt_style",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": true,
+        "store_size": 19822.0,
+        "tier": "guest",
+        "user_id": "synthetic-user-046"
+      }
+    },
+    "expected": {
+      "flag": "receipt_style",
+      "value": "compact",
+      "source": "default",
+      "explanation": [
+        {
+          "rule_id": "accessible-store",
+          "matched": false,
+          "reason": "attribute \"accessibility_mode\" was false; condition did not match"
+        },
+        {
+          "rule_id": "default",
+          "matched": true,
+          "reason": "no targeting rule matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-047",
+      "flag": "support_prompt",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": true,
+        "store_size": 20079.0,
+        "tier": "member",
+        "user_id": "synthetic-user-047"
+      }
+    },
+    "expected": {
+      "flag": "support_prompt",
+      "value": true,
+      "source": "non-guest",
+      "explanation": [
+        {
+          "rule_id": "non-guest",
+          "matched": true,
+          "reason": "all conditions matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-048",
+      "flag": "checkout_redesign",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": false,
+        "store_size": 20336.0,
+        "tier": "member",
+        "user_id": "synthetic-user-048"
+      }
+    },
+    "expected": {
+      "flag": "checkout_redesign",
+      "value": false,
+      "source": "default",
+      "explanation": [
+        {
+          "rule_id": "employees-first",
+          "matched": false,
+          "reason": "attribute \"tier\" was \"member\"; condition did not match"
+        },
+        {
+          "rule_id": "kiosk-rollout",
+          "matched": false,
+          "reason": "attribute \"kiosk\" was false; condition did not match"
+        },
+        {
+          "rule_id": "default",
+          "matched": true,
+          "reason": "no targeting rule matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-049",
+      "flag": "max_cart_items",
+      "context": {
+        "accessibility_mode": true,
+        "kiosk": true,
+        "store_size": 20593.0,
+        "tier": "member",
+        "user_id": "synthetic-user-049"
+      }
+    },
+    "expected": {
+      "flag": "max_cart_items",
+      "value": 50.0,
+      "source": "large-store",
+      "explanation": [
+        {
+          "rule_id": "large-store",
+          "matched": true,
+          "reason": "all conditions matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-050",
+      "flag": "receipt_style",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": true,
+        "store_size": 20850.0,
+        "tier": "employee",
+        "user_id": "synthetic-user-050"
+      }
+    },
+    "expected": {
+      "flag": "receipt_style",
+      "value": "compact",
+      "source": "default",
+      "explanation": [
+        {
+          "rule_id": "accessible-store",
+          "matched": false,
+          "reason": "attribute \"accessibility_mode\" was false; condition did not match"
+        },
+        {
+          "rule_id": "default",
+          "matched": true,
+          "reason": "no targeting rule matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-051",
+      "flag": "support_prompt",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": false,
+        "store_size": 21107.0,
+        "tier": "guest",
+        "user_id": "synthetic-user-051"
+      }
+    },
+    "expected": {
+      "flag": "support_prompt",
+      "value": false,
+      "source": "default",
+      "explanation": [
+        {
+          "rule_id": "non-guest",
+          "matched": false,
+          "reason": "attribute \"tier\" was \"guest\"; condition did not match"
+        },
+        {
+          "rule_id": "default",
+          "matched": true,
+          "reason": "no targeting rule matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-052",
+      "flag": "checkout_redesign",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": true,
+        "store_size": 21364.0,
+        "tier": "member",
+        "user_id": "synthetic-user-052"
+      }
+    },
+    "expected": {
+      "flag": "checkout_redesign",
+      "value": false,
+      "source": "default",
+      "explanation": [
+        {
+          "rule_id": "employees-first",
+          "matched": false,
+          "reason": "attribute \"tier\" was \"member\"; condition did not match"
+        },
+        {
+          "rule_id": "kiosk-rollout",
+          "matched": false,
+          "reason": "stable bucket 7817 was outside 0..3500"
+        },
+        {
+          "rule_id": "default",
+          "matched": true,
+          "reason": "no targeting rule matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-053",
+      "flag": "max_cart_items",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": true,
+        "store_size": 21621.0,
+        "tier": "member",
+        "user_id": "synthetic-user-053"
+      }
+    },
+    "expected": {
+      "flag": "max_cart_items",
+      "value": 50.0,
+      "source": "large-store",
+      "explanation": [
+        {
+          "rule_id": "large-store",
+          "matched": true,
+          "reason": "all conditions matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-054",
+      "flag": "receipt_style",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": false,
+        "store_size": 21878.0,
+        "tier": "member",
+        "user_id": "synthetic-user-054"
+      }
+    },
+    "expected": {
+      "flag": "receipt_style",
+      "value": "compact",
+      "source": "default",
+      "explanation": [
+        {
+          "rule_id": "accessible-store",
+          "matched": false,
+          "reason": "attribute \"accessibility_mode\" was false; condition did not match"
+        },
+        {
+          "rule_id": "default",
+          "matched": true,
+          "reason": "no targeting rule matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-055",
+      "flag": "support_prompt",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": true,
+        "store_size": 22135.0,
+        "tier": "employee",
+        "user_id": "synthetic-user-055"
+      }
+    },
+    "expected": {
+      "flag": "support_prompt",
+      "value": true,
+      "source": "non-guest",
+      "explanation": [
+        {
+          "rule_id": "non-guest",
+          "matched": true,
+          "reason": "all conditions matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-056",
+      "flag": "checkout_redesign",
+      "context": {
+        "accessibility_mode": true,
+        "kiosk": true,
+        "store_size": 22392.0,
+        "tier": "guest",
+        "user_id": "synthetic-user-056"
+      }
+    },
+    "expected": {
+      "flag": "checkout_redesign",
+      "value": false,
+      "source": "default",
+      "explanation": [
+        {
+          "rule_id": "employees-first",
+          "matched": false,
+          "reason": "attribute \"tier\" was \"guest\"; condition did not match"
+        },
+        {
+          "rule_id": "kiosk-rollout",
+          "matched": false,
+          "reason": "stable bucket 5197 was outside 0..3500"
+        },
+        {
+          "rule_id": "default",
+          "matched": true,
+          "reason": "no targeting rule matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-057",
+      "flag": "max_cart_items",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": false,
+        "store_size": 22649.0,
+        "tier": "member",
+        "user_id": "synthetic-user-057"
+      }
+    },
+    "expected": {
+      "flag": "max_cart_items",
+      "value": 50.0,
+      "source": "large-store",
+      "explanation": [
+        {
+          "rule_id": "large-store",
+          "matched": true,
+          "reason": "all conditions matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-058",
+      "flag": "receipt_style",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": true,
+        "store_size": 22906.0,
+        "tier": "member",
+        "user_id": "synthetic-user-058"
+      }
+    },
+    "expected": {
+      "flag": "receipt_style",
+      "value": "compact",
+      "source": "default",
+      "explanation": [
+        {
+          "rule_id": "accessible-store",
+          "matched": false,
+          "reason": "attribute \"accessibility_mode\" was false; condition did not match"
+        },
+        {
+          "rule_id": "default",
+          "matched": true,
+          "reason": "no targeting rule matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-059",
+      "flag": "support_prompt",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": true,
+        "store_size": 23163.0,
+        "tier": "member",
+        "user_id": "synthetic-user-059"
+      }
+    },
+    "expected": {
+      "flag": "support_prompt",
+      "value": true,
+      "source": "non-guest",
+      "explanation": [
+        {
+          "rule_id": "non-guest",
+          "matched": true,
+          "reason": "all conditions matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-060",
+      "flag": "checkout_redesign",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": false,
+        "store_size": 23420.0,
+        "tier": "employee",
+        "user_id": "synthetic-user-060"
+      }
+    },
+    "expected": {
+      "flag": "checkout_redesign",
+      "value": true,
+      "source": "employees-first",
+      "explanation": [
+        {
+          "rule_id": "employees-first",
+          "matched": true,
+          "reason": "all conditions matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-061",
+      "flag": "max_cart_items",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": true,
+        "store_size": 23677.0,
+        "tier": "guest",
+        "user_id": "synthetic-user-061"
+      }
+    },
+    "expected": {
+      "flag": "max_cart_items",
+      "value": 50.0,
+      "source": "large-store",
+      "explanation": [
+        {
+          "rule_id": "large-store",
+          "matched": true,
+          "reason": "all conditions matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-062",
+      "flag": "receipt_style",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": true,
+        "store_size": 23934.0,
+        "tier": "member",
+        "user_id": "synthetic-user-062"
+      }
+    },
+    "expected": {
+      "flag": "receipt_style",
+      "value": "compact",
+      "source": "default",
+      "explanation": [
+        {
+          "rule_id": "accessible-store",
+          "matched": false,
+          "reason": "attribute \"accessibility_mode\" was false; condition did not match"
+        },
+        {
+          "rule_id": "default",
+          "matched": true,
+          "reason": "no targeting rule matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-063",
+      "flag": "support_prompt",
+      "context": {
+        "accessibility_mode": true,
+        "kiosk": false,
+        "store_size": 24191.0,
+        "tier": "member",
+        "user_id": "synthetic-user-063"
+      }
+    },
+    "expected": {
+      "flag": "support_prompt",
+      "value": true,
+      "source": "non-guest",
+      "explanation": [
+        {
+          "rule_id": "non-guest",
+          "matched": true,
+          "reason": "all conditions matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-064",
+      "flag": "checkout_redesign",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": true,
+        "store_size": 24448.0,
+        "tier": "member",
+        "user_id": "synthetic-user-064"
+      }
+    },
+    "expected": {
+      "flag": "checkout_redesign",
+      "value": true,
+      "source": "kiosk-rollout",
+      "explanation": [
+        {
+          "rule_id": "employees-first",
+          "matched": false,
+          "reason": "attribute \"tier\" was \"member\"; condition did not match"
+        },
+        {
+          "rule_id": "kiosk-rollout",
+          "matched": true,
+          "reason": "conditions matched; stable bucket 1842 was inside 0..3500"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-065",
+      "flag": "max_cart_items",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": true,
+        "store_size": 24705.0,
+        "tier": "employee",
+        "user_id": "synthetic-user-065"
+      }
+    },
+    "expected": {
+      "flag": "max_cart_items",
+      "value": 50.0,
+      "source": "large-store",
+      "explanation": [
+        {
+          "rule_id": "large-store",
+          "matched": true,
+          "reason": "all conditions matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-066",
+      "flag": "receipt_style",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": false,
+        "store_size": 24962.0,
+        "tier": "guest",
+        "user_id": "synthetic-user-066"
+      }
+    },
+    "expected": {
+      "flag": "receipt_style",
+      "value": "compact",
+      "source": "default",
+      "explanation": [
+        {
+          "rule_id": "accessible-store",
+          "matched": false,
+          "reason": "attribute \"accessibility_mode\" was false; condition did not match"
+        },
+        {
+          "rule_id": "default",
+          "matched": true,
+          "reason": "no targeting rule matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-067",
+      "flag": "support_prompt",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": true,
+        "store_size": 25219.0,
+        "tier": "member",
+        "user_id": "synthetic-user-067"
+      }
+    },
+    "expected": {
+      "flag": "support_prompt",
+      "value": true,
+      "source": "non-guest",
+      "explanation": [
+        {
+          "rule_id": "non-guest",
+          "matched": true,
+          "reason": "all conditions matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-068",
+      "flag": "checkout_redesign",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": true,
+        "store_size": 25476.0,
+        "tier": "member",
+        "user_id": "synthetic-user-068"
+      }
+    },
+    "expected": {
+      "flag": "checkout_redesign",
+      "value": false,
+      "source": "default",
+      "explanation": [
+        {
+          "rule_id": "employees-first",
+          "matched": false,
+          "reason": "attribute \"tier\" was \"member\"; condition did not match"
+        },
+        {
+          "rule_id": "kiosk-rollout",
+          "matched": false,
+          "reason": "stable bucket 3982 was outside 0..3500"
+        },
+        {
+          "rule_id": "default",
+          "matched": true,
+          "reason": "no targeting rule matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-069",
+      "flag": "max_cart_items",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": false,
+        "store_size": 25733.0,
+        "tier": "member",
+        "user_id": "synthetic-user-069"
+      }
+    },
+    "expected": {
+      "flag": "max_cart_items",
+      "value": 50.0,
+      "source": "large-store",
+      "explanation": [
+        {
+          "rule_id": "large-store",
+          "matched": true,
+          "reason": "all conditions matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-070",
+      "flag": "receipt_style",
+      "context": {
+        "accessibility_mode": true,
+        "kiosk": true,
+        "store_size": 25990.0,
+        "tier": "employee",
+        "user_id": "synthetic-user-070"
+      }
+    },
+    "expected": {
+      "flag": "receipt_style",
+      "value": "large-print",
+      "source": "accessible-store",
+      "explanation": [
+        {
+          "rule_id": "accessible-store",
+          "matched": true,
+          "reason": "all conditions matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-071",
+      "flag": "support_prompt",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": true,
+        "store_size": 26247.0,
+        "tier": "guest",
+        "user_id": "synthetic-user-071"
+      }
+    },
+    "expected": {
+      "flag": "support_prompt",
+      "value": false,
+      "source": "default",
+      "explanation": [
+        {
+          "rule_id": "non-guest",
+          "matched": false,
+          "reason": "attribute \"tier\" was \"guest\"; condition did not match"
+        },
+        {
+          "rule_id": "default",
+          "matched": true,
+          "reason": "no targeting rule matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-072",
+      "flag": "checkout_redesign",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": false,
+        "store_size": 26504.0,
+        "tier": "member",
+        "user_id": "synthetic-user-072"
+      }
+    },
+    "expected": {
+      "flag": "checkout_redesign",
+      "value": false,
+      "source": "default",
+      "explanation": [
+        {
+          "rule_id": "employees-first",
+          "matched": false,
+          "reason": "attribute \"tier\" was \"member\"; condition did not match"
+        },
+        {
+          "rule_id": "kiosk-rollout",
+          "matched": false,
+          "reason": "attribute \"kiosk\" was false; condition did not match"
+        },
+        {
+          "rule_id": "default",
+          "matched": true,
+          "reason": "no targeting rule matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-073",
+      "flag": "max_cart_items",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": true,
+        "store_size": 26761.0,
+        "tier": "member",
+        "user_id": "synthetic-user-073"
+      }
+    },
+    "expected": {
+      "flag": "max_cart_items",
+      "value": 50.0,
+      "source": "large-store",
+      "explanation": [
+        {
+          "rule_id": "large-store",
+          "matched": true,
+          "reason": "all conditions matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-074",
+      "flag": "receipt_style",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": true,
+        "store_size": 27018.0,
+        "tier": "member",
+        "user_id": "synthetic-user-074"
+      }
+    },
+    "expected": {
+      "flag": "receipt_style",
+      "value": "compact",
+      "source": "default",
+      "explanation": [
+        {
+          "rule_id": "accessible-store",
+          "matched": false,
+          "reason": "attribute \"accessibility_mode\" was false; condition did not match"
+        },
+        {
+          "rule_id": "default",
+          "matched": true,
+          "reason": "no targeting rule matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-075",
+      "flag": "support_prompt",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": false,
+        "store_size": 27275.0,
+        "tier": "employee",
+        "user_id": "synthetic-user-075"
+      }
+    },
+    "expected": {
+      "flag": "support_prompt",
+      "value": true,
+      "source": "non-guest",
+      "explanation": [
+        {
+          "rule_id": "non-guest",
+          "matched": true,
+          "reason": "all conditions matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-076",
+      "flag": "checkout_redesign",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": true,
+        "store_size": 27532.0,
+        "tier": "guest",
+        "user_id": "synthetic-user-076"
+      }
+    },
+    "expected": {
+      "flag": "checkout_redesign",
+      "value": false,
+      "source": "default",
+      "explanation": [
+        {
+          "rule_id": "employees-first",
+          "matched": false,
+          "reason": "attribute \"tier\" was \"guest\"; condition did not match"
+        },
+        {
+          "rule_id": "kiosk-rollout",
+          "matched": false,
+          "reason": "stable bucket 8007 was outside 0..3500"
+        },
+        {
+          "rule_id": "default",
+          "matched": true,
+          "reason": "no targeting rule matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-077",
+      "flag": "max_cart_items",
+      "context": {
+        "accessibility_mode": true,
+        "kiosk": true,
+        "store_size": 27789.0,
+        "tier": "member",
+        "user_id": "synthetic-user-077"
+      }
+    },
+    "expected": {
+      "flag": "max_cart_items",
+      "value": 50.0,
+      "source": "large-store",
+      "explanation": [
+        {
+          "rule_id": "large-store",
+          "matched": true,
+          "reason": "all conditions matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-078",
+      "flag": "receipt_style",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": false,
+        "store_size": 28046.0,
+        "tier": "member",
+        "user_id": "synthetic-user-078"
+      }
+    },
+    "expected": {
+      "flag": "receipt_style",
+      "value": "compact",
+      "source": "default",
+      "explanation": [
+        {
+          "rule_id": "accessible-store",
+          "matched": false,
+          "reason": "attribute \"accessibility_mode\" was false; condition did not match"
+        },
+        {
+          "rule_id": "default",
+          "matched": true,
+          "reason": "no targeting rule matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-079",
+      "flag": "support_prompt",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": true,
+        "store_size": 28303.0,
+        "tier": "member",
+        "user_id": "synthetic-user-079"
+      }
+    },
+    "expected": {
+      "flag": "support_prompt",
+      "value": true,
+      "source": "non-guest",
+      "explanation": [
+        {
+          "rule_id": "non-guest",
+          "matched": true,
+          "reason": "all conditions matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-080",
+      "flag": "checkout_redesign",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": true,
+        "store_size": 28560.0,
+        "tier": "employee",
+        "user_id": "synthetic-user-080"
+      }
+    },
+    "expected": {
+      "flag": "checkout_redesign",
+      "value": true,
+      "source": "employees-first",
+      "explanation": [
+        {
+          "rule_id": "employees-first",
+          "matched": true,
+          "reason": "all conditions matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-081",
+      "flag": "max_cart_items",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": false,
+        "store_size": 28817.0,
+        "tier": "guest",
+        "user_id": "synthetic-user-081"
+      }
+    },
+    "expected": {
+      "flag": "max_cart_items",
+      "value": 50.0,
+      "source": "large-store",
+      "explanation": [
+        {
+          "rule_id": "large-store",
+          "matched": true,
+          "reason": "all conditions matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-082",
+      "flag": "receipt_style",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": true,
+        "store_size": 29074.0,
+        "tier": "member",
+        "user_id": "synthetic-user-082"
+      }
+    },
+    "expected": {
+      "flag": "receipt_style",
+      "value": "compact",
+      "source": "default",
+      "explanation": [
+        {
+          "rule_id": "accessible-store",
+          "matched": false,
+          "reason": "attribute \"accessibility_mode\" was false; condition did not match"
+        },
+        {
+          "rule_id": "default",
+          "matched": true,
+          "reason": "no targeting rule matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-083",
+      "flag": "support_prompt",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": true,
+        "store_size": 29331.0,
+        "tier": "member",
+        "user_id": "synthetic-user-083"
+      }
+    },
+    "expected": {
+      "flag": "support_prompt",
+      "value": true,
+      "source": "non-guest",
+      "explanation": [
+        {
+          "rule_id": "non-guest",
+          "matched": true,
+          "reason": "all conditions matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-084",
+      "flag": "checkout_redesign",
+      "context": {
+        "accessibility_mode": true,
+        "kiosk": false,
+        "store_size": 29588.0,
+        "tier": "member",
+        "user_id": "synthetic-user-084"
+      }
+    },
+    "expected": {
+      "flag": "checkout_redesign",
+      "value": false,
+      "source": "default",
+      "explanation": [
+        {
+          "rule_id": "employees-first",
+          "matched": false,
+          "reason": "attribute \"tier\" was \"member\"; condition did not match"
+        },
+        {
+          "rule_id": "kiosk-rollout",
+          "matched": false,
+          "reason": "attribute \"kiosk\" was false; condition did not match"
+        },
+        {
+          "rule_id": "default",
+          "matched": true,
+          "reason": "no targeting rule matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-085",
+      "flag": "max_cart_items",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": true,
+        "store_size": 29845.0,
+        "tier": "employee",
+        "user_id": "synthetic-user-085"
+      }
+    },
+    "expected": {
+      "flag": "max_cart_items",
+      "value": 50.0,
+      "source": "large-store",
+      "explanation": [
+        {
+          "rule_id": "large-store",
+          "matched": true,
+          "reason": "all conditions matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-086",
+      "flag": "receipt_style",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": true,
+        "store_size": 30102.0,
+        "tier": "guest",
+        "user_id": "synthetic-user-086"
+      }
+    },
+    "expected": {
+      "flag": "receipt_style",
+      "value": "compact",
+      "source": "default",
+      "explanation": [
+        {
+          "rule_id": "accessible-store",
+          "matched": false,
+          "reason": "attribute \"accessibility_mode\" was false; condition did not match"
+        },
+        {
+          "rule_id": "default",
+          "matched": true,
+          "reason": "no targeting rule matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-087",
+      "flag": "support_prompt",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": false,
+        "store_size": 30359.0,
+        "tier": "member",
+        "user_id": "synthetic-user-087"
+      }
+    },
+    "expected": {
+      "flag": "support_prompt",
+      "value": true,
+      "source": "non-guest",
+      "explanation": [
+        {
+          "rule_id": "non-guest",
+          "matched": true,
+          "reason": "all conditions matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-088",
+      "flag": "checkout_redesign",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": true,
+        "store_size": 30616.0,
+        "tier": "member",
+        "user_id": "synthetic-user-088"
+      }
+    },
+    "expected": {
+      "flag": "checkout_redesign",
+      "value": true,
+      "source": "kiosk-rollout",
+      "explanation": [
+        {
+          "rule_id": "employees-first",
+          "matched": false,
+          "reason": "attribute \"tier\" was \"member\"; condition did not match"
+        },
+        {
+          "rule_id": "kiosk-rollout",
+          "matched": true,
+          "reason": "conditions matched; stable bucket 732 was inside 0..3500"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-089",
+      "flag": "max_cart_items",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": true,
+        "store_size": 30873.0,
+        "tier": "member",
+        "user_id": "synthetic-user-089"
+      }
+    },
+    "expected": {
+      "flag": "max_cart_items",
+      "value": 50.0,
+      "source": "large-store",
+      "explanation": [
+        {
+          "rule_id": "large-store",
+          "matched": true,
+          "reason": "all conditions matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-090",
+      "flag": "receipt_style",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": false,
+        "store_size": 31130.0,
+        "tier": "employee",
+        "user_id": "synthetic-user-090"
+      }
+    },
+    "expected": {
+      "flag": "receipt_style",
+      "value": "compact",
+      "source": "default",
+      "explanation": [
+        {
+          "rule_id": "accessible-store",
+          "matched": false,
+          "reason": "attribute \"accessibility_mode\" was false; condition did not match"
+        },
+        {
+          "rule_id": "default",
+          "matched": true,
+          "reason": "no targeting rule matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-091",
+      "flag": "support_prompt",
+      "context": {
+        "accessibility_mode": true,
+        "kiosk": true,
+        "store_size": 31387.0,
+        "tier": "guest",
+        "user_id": "synthetic-user-091"
+      }
+    },
+    "expected": {
+      "flag": "support_prompt",
+      "value": false,
+      "source": "default",
+      "explanation": [
+        {
+          "rule_id": "non-guest",
+          "matched": false,
+          "reason": "attribute \"tier\" was \"guest\"; condition did not match"
+        },
+        {
+          "rule_id": "default",
+          "matched": true,
+          "reason": "no targeting rule matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-092",
+      "flag": "checkout_redesign",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": true,
+        "store_size": 31644.0,
+        "tier": "member",
+        "user_id": "synthetic-user-092"
+      }
+    },
+    "expected": {
+      "flag": "checkout_redesign",
+      "value": false,
+      "source": "default",
+      "explanation": [
+        {
+          "rule_id": "employees-first",
+          "matched": false,
+          "reason": "attribute \"tier\" was \"member\"; condition did not match"
+        },
+        {
+          "rule_id": "kiosk-rollout",
+          "matched": false,
+          "reason": "stable bucket 9997 was outside 0..3500"
+        },
+        {
+          "rule_id": "default",
+          "matched": true,
+          "reason": "no targeting rule matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-093",
+      "flag": "max_cart_items",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": false,
+        "store_size": 31901.0,
+        "tier": "member",
+        "user_id": "synthetic-user-093"
+      }
+    },
+    "expected": {
+      "flag": "max_cart_items",
+      "value": 50.0,
+      "source": "large-store",
+      "explanation": [
+        {
+          "rule_id": "large-store",
+          "matched": true,
+          "reason": "all conditions matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-094",
+      "flag": "receipt_style",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": true,
+        "store_size": 32158.0,
+        "tier": "member",
+        "user_id": "synthetic-user-094"
+      }
+    },
+    "expected": {
+      "flag": "receipt_style",
+      "value": "compact",
+      "source": "default",
+      "explanation": [
+        {
+          "rule_id": "accessible-store",
+          "matched": false,
+          "reason": "attribute \"accessibility_mode\" was false; condition did not match"
+        },
+        {
+          "rule_id": "default",
+          "matched": true,
+          "reason": "no targeting rule matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-095",
+      "flag": "support_prompt",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": true,
+        "store_size": 32415.0,
+        "tier": "employee",
+        "user_id": "synthetic-user-095"
+      }
+    },
+    "expected": {
+      "flag": "support_prompt",
+      "value": true,
+      "source": "non-guest",
+      "explanation": [
+        {
+          "rule_id": "non-guest",
+          "matched": true,
+          "reason": "all conditions matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-096",
+      "flag": "checkout_redesign",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": false,
+        "store_size": 32672.0,
+        "tier": "guest",
+        "user_id": "synthetic-user-096"
+      }
+    },
+    "expected": {
+      "flag": "checkout_redesign",
+      "value": false,
+      "source": "default",
+      "explanation": [
+        {
+          "rule_id": "employees-first",
+          "matched": false,
+          "reason": "attribute \"tier\" was \"guest\"; condition did not match"
+        },
+        {
+          "rule_id": "kiosk-rollout",
+          "matched": false,
+          "reason": "attribute \"kiosk\" was false; condition did not match"
+        },
+        {
+          "rule_id": "default",
+          "matched": true,
+          "reason": "no targeting rule matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-097",
+      "flag": "max_cart_items",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": true,
+        "store_size": 32929.0,
+        "tier": "member",
+        "user_id": "synthetic-user-097"
+      }
+    },
+    "expected": {
+      "flag": "max_cart_items",
+      "value": 50.0,
+      "source": "large-store",
+      "explanation": [
+        {
+          "rule_id": "large-store",
+          "matched": true,
+          "reason": "all conditions matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-098",
+      "flag": "receipt_style",
+      "context": {
+        "accessibility_mode": true,
+        "kiosk": true,
+        "store_size": 8186.0,
+        "tier": "member",
+        "user_id": "synthetic-user-098"
+      }
+    },
+    "expected": {
+      "flag": "receipt_style",
+      "value": "large-print",
+      "source": "accessible-store",
+      "explanation": [
+        {
+          "rule_id": "accessible-store",
+          "matched": true,
+          "reason": "all conditions matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-099",
+      "flag": "support_prompt",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": false,
+        "store_size": 8443.0,
+        "tier": "member",
+        "user_id": "synthetic-user-099"
+      }
+    },
+    "expected": {
+      "flag": "support_prompt",
+      "value": true,
+      "source": "non-guest",
+      "explanation": [
+        {
+          "rule_id": "non-guest",
+          "matched": true,
+          "reason": "all conditions matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-100",
+      "flag": "checkout_redesign",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": true,
+        "store_size": 8700.0,
+        "tier": "employee",
+        "user_id": "synthetic-user-100"
+      }
+    },
+    "expected": {
+      "flag": "checkout_redesign",
+      "value": true,
+      "source": "employees-first",
+      "explanation": [
+        {
+          "rule_id": "employees-first",
+          "matched": true,
+          "reason": "all conditions matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-101",
+      "flag": "max_cart_items",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": true,
+        "store_size": 8957.0,
+        "tier": "guest",
+        "user_id": "synthetic-user-101"
+      }
+    },
+    "expected": {
+      "flag": "max_cart_items",
+      "value": 30.0,
+      "source": "default",
+      "explanation": [
+        {
+          "rule_id": "large-store",
+          "matched": false,
+          "reason": "attribute \"store_size\" was 8957; condition did not match"
+        },
+        {
+          "rule_id": "default",
+          "matched": true,
+          "reason": "no targeting rule matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-102",
+      "flag": "receipt_style",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": false,
+        "store_size": 9214.0,
+        "tier": "member",
+        "user_id": "synthetic-user-102"
+      }
+    },
+    "expected": {
+      "flag": "receipt_style",
+      "value": "compact",
+      "source": "default",
+      "explanation": [
+        {
+          "rule_id": "accessible-store",
+          "matched": false,
+          "reason": "attribute \"accessibility_mode\" was false; condition did not match"
+        },
+        {
+          "rule_id": "default",
+          "matched": true,
+          "reason": "no targeting rule matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-103",
+      "flag": "support_prompt",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": true,
+        "store_size": 9471.0,
+        "tier": "member",
+        "user_id": "synthetic-user-103"
+      }
+    },
+    "expected": {
+      "flag": "support_prompt",
+      "value": true,
+      "source": "non-guest",
+      "explanation": [
+        {
+          "rule_id": "non-guest",
+          "matched": true,
+          "reason": "all conditions matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-104",
+      "flag": "checkout_redesign",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": true,
+        "store_size": 9728.0,
+        "tier": "member",
+        "user_id": "synthetic-user-104"
+      }
+    },
+    "expected": {
+      "flag": "checkout_redesign",
+      "value": false,
+      "source": "default",
+      "explanation": [
+        {
+          "rule_id": "employees-first",
+          "matched": false,
+          "reason": "attribute \"tier\" was \"member\"; condition did not match"
+        },
+        {
+          "rule_id": "kiosk-rollout",
+          "matched": false,
+          "reason": "stable bucket 6521 was outside 0..3500"
+        },
+        {
+          "rule_id": "default",
+          "matched": true,
+          "reason": "no targeting rule matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-105",
+      "flag": "max_cart_items",
+      "context": {
+        "accessibility_mode": true,
+        "kiosk": false,
+        "store_size": 9985.0,
+        "tier": "employee",
+        "user_id": "synthetic-user-105"
+      }
+    },
+    "expected": {
+      "flag": "max_cart_items",
+      "value": 30.0,
+      "source": "default",
+      "explanation": [
+        {
+          "rule_id": "large-store",
+          "matched": false,
+          "reason": "attribute \"store_size\" was 9985; condition did not match"
+        },
+        {
+          "rule_id": "default",
+          "matched": true,
+          "reason": "no targeting rule matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-106",
+      "flag": "receipt_style",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": true,
+        "store_size": 10242.0,
+        "tier": "guest",
+        "user_id": "synthetic-user-106"
+      }
+    },
+    "expected": {
+      "flag": "receipt_style",
+      "value": "compact",
+      "source": "default",
+      "explanation": [
+        {
+          "rule_id": "accessible-store",
+          "matched": false,
+          "reason": "attribute \"accessibility_mode\" was false; condition did not match"
+        },
+        {
+          "rule_id": "default",
+          "matched": true,
+          "reason": "no targeting rule matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-107",
+      "flag": "support_prompt",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": true,
+        "store_size": 10499.0,
+        "tier": "member",
+        "user_id": "synthetic-user-107"
+      }
+    },
+    "expected": {
+      "flag": "support_prompt",
+      "value": true,
+      "source": "non-guest",
+      "explanation": [
+        {
+          "rule_id": "non-guest",
+          "matched": true,
+          "reason": "all conditions matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-108",
+      "flag": "checkout_redesign",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": false,
+        "store_size": 10756.0,
+        "tier": "member",
+        "user_id": "synthetic-user-108"
+      }
+    },
+    "expected": {
+      "flag": "checkout_redesign",
+      "value": false,
+      "source": "default",
+      "explanation": [
+        {
+          "rule_id": "employees-first",
+          "matched": false,
+          "reason": "attribute \"tier\" was \"member\"; condition did not match"
+        },
+        {
+          "rule_id": "kiosk-rollout",
+          "matched": false,
+          "reason": "attribute \"kiosk\" was false; condition did not match"
+        },
+        {
+          "rule_id": "default",
+          "matched": true,
+          "reason": "no targeting rule matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-109",
+      "flag": "max_cart_items",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": true,
+        "store_size": 11013.0,
+        "tier": "member",
+        "user_id": "synthetic-user-109"
+      }
+    },
+    "expected": {
+      "flag": "max_cart_items",
+      "value": 30.0,
+      "source": "default",
+      "explanation": [
+        {
+          "rule_id": "large-store",
+          "matched": false,
+          "reason": "attribute \"store_size\" was 11013; condition did not match"
+        },
+        {
+          "rule_id": "default",
+          "matched": true,
+          "reason": "no targeting rule matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-110",
+      "flag": "receipt_style",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": true,
+        "store_size": 11270.0,
+        "tier": "employee",
+        "user_id": "synthetic-user-110"
+      }
+    },
+    "expected": {
+      "flag": "receipt_style",
+      "value": "compact",
+      "source": "default",
+      "explanation": [
+        {
+          "rule_id": "accessible-store",
+          "matched": false,
+          "reason": "attribute \"accessibility_mode\" was false; condition did not match"
+        },
+        {
+          "rule_id": "default",
+          "matched": true,
+          "reason": "no targeting rule matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-111",
+      "flag": "support_prompt",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": false,
+        "store_size": 11527.0,
+        "tier": "guest",
+        "user_id": "synthetic-user-111"
+      }
+    },
+    "expected": {
+      "flag": "support_prompt",
+      "value": false,
+      "source": "default",
+      "explanation": [
+        {
+          "rule_id": "non-guest",
+          "matched": false,
+          "reason": "attribute \"tier\" was \"guest\"; condition did not match"
+        },
+        {
+          "rule_id": "default",
+          "matched": true,
+          "reason": "no targeting rule matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-112",
+      "flag": "checkout_redesign",
+      "context": {
+        "accessibility_mode": true,
+        "kiosk": true,
+        "store_size": 11784.0,
+        "tier": "member",
+        "user_id": "synthetic-user-112"
+      }
+    },
+    "expected": {
+      "flag": "checkout_redesign",
+      "value": false,
+      "source": "default",
+      "explanation": [
+        {
+          "rule_id": "employees-first",
+          "matched": false,
+          "reason": "attribute \"tier\" was \"member\"; condition did not match"
+        },
+        {
+          "rule_id": "kiosk-rollout",
+          "matched": false,
+          "reason": "stable bucket 4112 was outside 0..3500"
+        },
+        {
+          "rule_id": "default",
+          "matched": true,
+          "reason": "no targeting rule matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-113",
+      "flag": "max_cart_items",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": true,
+        "store_size": 12041.0,
+        "tier": "member",
+        "user_id": "synthetic-user-113"
+      }
+    },
+    "expected": {
+      "flag": "max_cart_items",
+      "value": 30.0,
+      "source": "default",
+      "explanation": [
+        {
+          "rule_id": "large-store",
+          "matched": false,
+          "reason": "attribute \"store_size\" was 12041; condition did not match"
+        },
+        {
+          "rule_id": "default",
+          "matched": true,
+          "reason": "no targeting rule matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-114",
+      "flag": "receipt_style",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": false,
+        "store_size": 12298.0,
+        "tier": "member",
+        "user_id": "synthetic-user-114"
+      }
+    },
+    "expected": {
+      "flag": "receipt_style",
+      "value": "compact",
+      "source": "default",
+      "explanation": [
+        {
+          "rule_id": "accessible-store",
+          "matched": false,
+          "reason": "attribute \"accessibility_mode\" was false; condition did not match"
+        },
+        {
+          "rule_id": "default",
+          "matched": true,
+          "reason": "no targeting rule matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-115",
+      "flag": "support_prompt",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": true,
+        "store_size": 12555.0,
+        "tier": "employee",
+        "user_id": "synthetic-user-115"
+      }
+    },
+    "expected": {
+      "flag": "support_prompt",
+      "value": true,
+      "source": "non-guest",
+      "explanation": [
+        {
+          "rule_id": "non-guest",
+          "matched": true,
+          "reason": "all conditions matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-116",
+      "flag": "checkout_redesign",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": true,
+        "store_size": 12812.0,
+        "tier": "guest",
+        "user_id": "synthetic-user-116"
+      }
+    },
+    "expected": {
+      "flag": "checkout_redesign",
+      "value": true,
+      "source": "kiosk-rollout",
+      "explanation": [
+        {
+          "rule_id": "employees-first",
+          "matched": false,
+          "reason": "attribute \"tier\" was \"guest\"; condition did not match"
+        },
+        {
+          "rule_id": "kiosk-rollout",
+          "matched": true,
+          "reason": "conditions matched; stable bucket 1492 was inside 0..3500"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-117",
+      "flag": "max_cart_items",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": false,
+        "store_size": 13069.0,
+        "tier": "member",
+        "user_id": "synthetic-user-117"
+      }
+    },
+    "expected": {
+      "flag": "max_cart_items",
+      "value": 30.0,
+      "source": "default",
+      "explanation": [
+        {
+          "rule_id": "large-store",
+          "matched": false,
+          "reason": "attribute \"store_size\" was 13069; condition did not match"
+        },
+        {
+          "rule_id": "default",
+          "matched": true,
+          "reason": "no targeting rule matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-118",
+      "flag": "receipt_style",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": true,
+        "store_size": 13326.0,
+        "tier": "member",
+        "user_id": "synthetic-user-118"
+      }
+    },
+    "expected": {
+      "flag": "receipt_style",
+      "value": "compact",
+      "source": "default",
+      "explanation": [
+        {
+          "rule_id": "accessible-store",
+          "matched": false,
+          "reason": "attribute \"accessibility_mode\" was false; condition did not match"
+        },
+        {
+          "rule_id": "default",
+          "matched": true,
+          "reason": "no targeting rule matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-119",
+      "flag": "support_prompt",
+      "context": {
+        "accessibility_mode": true,
+        "kiosk": true,
+        "store_size": 13583.0,
+        "tier": "member",
+        "user_id": "synthetic-user-119"
+      }
+    },
+    "expected": {
+      "flag": "support_prompt",
+      "value": true,
+      "source": "non-guest",
+      "explanation": [
+        {
+          "rule_id": "non-guest",
+          "matched": true,
+          "reason": "all conditions matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-120",
+      "flag": "checkout_redesign",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": false,
+        "store_size": 13840.0,
+        "tier": "employee",
+        "user_id": "synthetic-user-120"
+      }
+    },
+    "expected": {
+      "flag": "checkout_redesign",
+      "value": true,
+      "source": "employees-first",
+      "explanation": [
+        {
+          "rule_id": "employees-first",
+          "matched": true,
+          "reason": "all conditions matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-121",
+      "flag": "max_cart_items",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": true,
+        "store_size": 14097.0,
+        "tier": "guest",
+        "user_id": "synthetic-user-121"
+      }
+    },
+    "expected": {
+      "flag": "max_cart_items",
+      "value": 30.0,
+      "source": "default",
+      "explanation": [
+        {
+          "rule_id": "large-store",
+          "matched": false,
+          "reason": "attribute \"store_size\" was 14097; condition did not match"
+        },
+        {
+          "rule_id": "default",
+          "matched": true,
+          "reason": "no targeting rule matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-122",
+      "flag": "receipt_style",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": true,
+        "store_size": 14354.0,
+        "tier": "member",
+        "user_id": "synthetic-user-122"
+      }
+    },
+    "expected": {
+      "flag": "receipt_style",
+      "value": "compact",
+      "source": "default",
+      "explanation": [
+        {
+          "rule_id": "accessible-store",
+          "matched": false,
+          "reason": "attribute \"accessibility_mode\" was false; condition did not match"
+        },
+        {
+          "rule_id": "default",
+          "matched": true,
+          "reason": "no targeting rule matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-123",
+      "flag": "support_prompt",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": false,
+        "store_size": 14611.0,
+        "tier": "member",
+        "user_id": "synthetic-user-123"
+      }
+    },
+    "expected": {
+      "flag": "support_prompt",
+      "value": true,
+      "source": "non-guest",
+      "explanation": [
+        {
+          "rule_id": "non-guest",
+          "matched": true,
+          "reason": "all conditions matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-124",
+      "flag": "checkout_redesign",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": true,
+        "store_size": 14868.0,
+        "tier": "member",
+        "user_id": "synthetic-user-124"
+      }
+    },
+    "expected": {
+      "flag": "checkout_redesign",
+      "value": true,
+      "source": "kiosk-rollout",
+      "explanation": [
+        {
+          "rule_id": "employees-first",
+          "matched": false,
+          "reason": "attribute \"tier\" was \"member\"; condition did not match"
+        },
+        {
+          "rule_id": "kiosk-rollout",
+          "matched": true,
+          "reason": "conditions matched; stable bucket 1747 was inside 0..3500"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-125",
+      "flag": "max_cart_items",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": true,
+        "store_size": 15125.0,
+        "tier": "employee",
+        "user_id": "synthetic-user-125"
+      }
+    },
+    "expected": {
+      "flag": "max_cart_items",
+      "value": 30.0,
+      "source": "default",
+      "explanation": [
+        {
+          "rule_id": "large-store",
+          "matched": false,
+          "reason": "attribute \"store_size\" was 15125; condition did not match"
+        },
+        {
+          "rule_id": "default",
+          "matched": true,
+          "reason": "no targeting rule matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-126",
+      "flag": "receipt_style",
+      "context": {
+        "accessibility_mode": true,
+        "kiosk": false,
+        "store_size": 15382.0,
+        "tier": "guest",
+        "user_id": "synthetic-user-126"
+      }
+    },
+    "expected": {
+      "flag": "receipt_style",
+      "value": "large-print",
+      "source": "accessible-store",
+      "explanation": [
+        {
+          "rule_id": "accessible-store",
+          "matched": true,
+          "reason": "all conditions matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-127",
+      "flag": "support_prompt",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": true,
+        "store_size": 15639.0,
+        "tier": "member",
+        "user_id": "synthetic-user-127"
+      }
+    },
+    "expected": {
+      "flag": "support_prompt",
+      "value": true,
+      "source": "non-guest",
+      "explanation": [
+        {
+          "rule_id": "non-guest",
+          "matched": true,
+          "reason": "all conditions matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-128",
+      "flag": "checkout_redesign",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": true,
+        "store_size": 15896.0,
+        "tier": "member",
+        "user_id": "synthetic-user-128"
+      }
+    },
+    "expected": {
+      "flag": "checkout_redesign",
+      "value": false,
+      "source": "default",
+      "explanation": [
+        {
+          "rule_id": "employees-first",
+          "matched": false,
+          "reason": "attribute \"tier\" was \"member\"; condition did not match"
+        },
+        {
+          "rule_id": "kiosk-rollout",
+          "matched": false,
+          "reason": "stable bucket 4367 was outside 0..3500"
+        },
+        {
+          "rule_id": "default",
+          "matched": true,
+          "reason": "no targeting rule matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-129",
+      "flag": "max_cart_items",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": false,
+        "store_size": 16153.0,
+        "tier": "member",
+        "user_id": "synthetic-user-129"
+      }
+    },
+    "expected": {
+      "flag": "max_cart_items",
+      "value": 30.0,
+      "source": "default",
+      "explanation": [
+        {
+          "rule_id": "large-store",
+          "matched": false,
+          "reason": "attribute \"store_size\" was 16153; condition did not match"
+        },
+        {
+          "rule_id": "default",
+          "matched": true,
+          "reason": "no targeting rule matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-130",
+      "flag": "receipt_style",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": true,
+        "store_size": 16410.0,
+        "tier": "employee",
+        "user_id": "synthetic-user-130"
+      }
+    },
+    "expected": {
+      "flag": "receipt_style",
+      "value": "compact",
+      "source": "default",
+      "explanation": [
+        {
+          "rule_id": "accessible-store",
+          "matched": false,
+          "reason": "attribute \"accessibility_mode\" was false; condition did not match"
+        },
+        {
+          "rule_id": "default",
+          "matched": true,
+          "reason": "no targeting rule matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-131",
+      "flag": "support_prompt",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": true,
+        "store_size": 16667.0,
+        "tier": "guest",
+        "user_id": "synthetic-user-131"
+      }
+    },
+    "expected": {
+      "flag": "support_prompt",
+      "value": false,
+      "source": "default",
+      "explanation": [
+        {
+          "rule_id": "non-guest",
+          "matched": false,
+          "reason": "attribute \"tier\" was \"guest\"; condition did not match"
+        },
+        {
+          "rule_id": "default",
+          "matched": true,
+          "reason": "no targeting rule matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-132",
+      "flag": "checkout_redesign",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": false,
+        "store_size": 16924.0,
+        "tier": "member",
+        "user_id": "synthetic-user-132"
+      }
+    },
+    "expected": {
+      "flag": "checkout_redesign",
+      "value": false,
+      "source": "default",
+      "explanation": [
+        {
+          "rule_id": "employees-first",
+          "matched": false,
+          "reason": "attribute \"tier\" was \"member\"; condition did not match"
+        },
+        {
+          "rule_id": "kiosk-rollout",
+          "matched": false,
+          "reason": "attribute \"kiosk\" was false; condition did not match"
+        },
+        {
+          "rule_id": "default",
+          "matched": true,
+          "reason": "no targeting rule matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-133",
+      "flag": "max_cart_items",
+      "context": {
+        "accessibility_mode": true,
+        "kiosk": true,
+        "store_size": 17181.0,
+        "tier": "member",
+        "user_id": "synthetic-user-133"
+      }
+    },
+    "expected": {
+      "flag": "max_cart_items",
+      "value": 30.0,
+      "source": "default",
+      "explanation": [
+        {
+          "rule_id": "large-store",
+          "matched": false,
+          "reason": "attribute \"store_size\" was 17181; condition did not match"
+        },
+        {
+          "rule_id": "default",
+          "matched": true,
+          "reason": "no targeting rule matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-134",
+      "flag": "receipt_style",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": true,
+        "store_size": 17438.0,
+        "tier": "member",
+        "user_id": "synthetic-user-134"
+      }
+    },
+    "expected": {
+      "flag": "receipt_style",
+      "value": "compact",
+      "source": "default",
+      "explanation": [
+        {
+          "rule_id": "accessible-store",
+          "matched": false,
+          "reason": "attribute \"accessibility_mode\" was false; condition did not match"
+        },
+        {
+          "rule_id": "default",
+          "matched": true,
+          "reason": "no targeting rule matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-135",
+      "flag": "support_prompt",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": false,
+        "store_size": 17695.0,
+        "tier": "employee",
+        "user_id": "synthetic-user-135"
+      }
+    },
+    "expected": {
+      "flag": "support_prompt",
+      "value": true,
+      "source": "non-guest",
+      "explanation": [
+        {
+          "rule_id": "non-guest",
+          "matched": true,
+          "reason": "all conditions matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-136",
+      "flag": "checkout_redesign",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": true,
+        "store_size": 17952.0,
+        "tier": "guest",
+        "user_id": "synthetic-user-136"
+      }
+    },
+    "expected": {
+      "flag": "checkout_redesign",
+      "value": false,
+      "source": "default",
+      "explanation": [
+        {
+          "rule_id": "employees-first",
+          "matched": false,
+          "reason": "attribute \"tier\" was \"guest\"; condition did not match"
+        },
+        {
+          "rule_id": "kiosk-rollout",
+          "matched": false,
+          "reason": "stable bucket 7722 was outside 0..3500"
+        },
+        {
+          "rule_id": "default",
+          "matched": true,
+          "reason": "no targeting rule matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-137",
+      "flag": "max_cart_items",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": true,
+        "store_size": 18209.0,
+        "tier": "member",
+        "user_id": "synthetic-user-137"
+      }
+    },
+    "expected": {
+      "flag": "max_cart_items",
+      "value": 30.0,
+      "source": "default",
+      "explanation": [
+        {
+          "rule_id": "large-store",
+          "matched": false,
+          "reason": "attribute \"store_size\" was 18209; condition did not match"
+        },
+        {
+          "rule_id": "default",
+          "matched": true,
+          "reason": "no targeting rule matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-138",
+      "flag": "receipt_style",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": false,
+        "store_size": 18466.0,
+        "tier": "member",
+        "user_id": "synthetic-user-138"
+      }
+    },
+    "expected": {
+      "flag": "receipt_style",
+      "value": "compact",
+      "source": "default",
+      "explanation": [
+        {
+          "rule_id": "accessible-store",
+          "matched": false,
+          "reason": "attribute \"accessibility_mode\" was false; condition did not match"
+        },
+        {
+          "rule_id": "default",
+          "matched": true,
+          "reason": "no targeting rule matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-139",
+      "flag": "support_prompt",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": true,
+        "store_size": 18723.0,
+        "tier": "member",
+        "user_id": "synthetic-user-139"
+      }
+    },
+    "expected": {
+      "flag": "support_prompt",
+      "value": true,
+      "source": "non-guest",
+      "explanation": [
+        {
+          "rule_id": "non-guest",
+          "matched": true,
+          "reason": "all conditions matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-140",
+      "flag": "checkout_redesign",
+      "context": {
+        "accessibility_mode": true,
+        "kiosk": true,
+        "store_size": 18980.0,
+        "tier": "employee",
+        "user_id": "synthetic-user-140"
+      }
+    },
+    "expected": {
+      "flag": "checkout_redesign",
+      "value": true,
+      "source": "employees-first",
+      "explanation": [
+        {
+          "rule_id": "employees-first",
+          "matched": true,
+          "reason": "all conditions matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-141",
+      "flag": "max_cart_items",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": false,
+        "store_size": 19237.0,
+        "tier": "guest",
+        "user_id": "synthetic-user-141"
+      }
+    },
+    "expected": {
+      "flag": "max_cart_items",
+      "value": 30.0,
+      "source": "default",
+      "explanation": [
+        {
+          "rule_id": "large-store",
+          "matched": false,
+          "reason": "attribute \"store_size\" was 19237; condition did not match"
+        },
+        {
+          "rule_id": "default",
+          "matched": true,
+          "reason": "no targeting rule matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-142",
+      "flag": "receipt_style",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": true,
+        "store_size": 19494.0,
+        "tier": "member",
+        "user_id": "synthetic-user-142"
+      }
+    },
+    "expected": {
+      "flag": "receipt_style",
+      "value": "compact",
+      "source": "default",
+      "explanation": [
+        {
+          "rule_id": "accessible-store",
+          "matched": false,
+          "reason": "attribute \"accessibility_mode\" was false; condition did not match"
+        },
+        {
+          "rule_id": "default",
+          "matched": true,
+          "reason": "no targeting rule matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-143",
+      "flag": "support_prompt",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": true,
+        "store_size": 19751.0,
+        "tier": "member",
+        "user_id": "synthetic-user-143"
+      }
+    },
+    "expected": {
+      "flag": "support_prompt",
+      "value": true,
+      "source": "non-guest",
+      "explanation": [
+        {
+          "rule_id": "non-guest",
+          "matched": true,
+          "reason": "all conditions matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-144",
+      "flag": "checkout_redesign",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": false,
+        "store_size": 20008.0,
+        "tier": "member",
+        "user_id": "synthetic-user-144"
+      }
+    },
+    "expected": {
+      "flag": "checkout_redesign",
+      "value": false,
+      "source": "default",
+      "explanation": [
+        {
+          "rule_id": "employees-first",
+          "matched": false,
+          "reason": "attribute \"tier\" was \"member\"; condition did not match"
+        },
+        {
+          "rule_id": "kiosk-rollout",
+          "matched": false,
+          "reason": "attribute \"kiosk\" was false; condition did not match"
+        },
+        {
+          "rule_id": "default",
+          "matched": true,
+          "reason": "no targeting rule matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-145",
+      "flag": "max_cart_items",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": true,
+        "store_size": 20265.0,
+        "tier": "employee",
+        "user_id": "synthetic-user-145"
+      }
+    },
+    "expected": {
+      "flag": "max_cart_items",
+      "value": 50.0,
+      "source": "large-store",
+      "explanation": [
+        {
+          "rule_id": "large-store",
+          "matched": true,
+          "reason": "all conditions matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-146",
+      "flag": "receipt_style",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": true,
+        "store_size": 20522.0,
+        "tier": "guest",
+        "user_id": "synthetic-user-146"
+      }
+    },
+    "expected": {
+      "flag": "receipt_style",
+      "value": "compact",
+      "source": "default",
+      "explanation": [
+        {
+          "rule_id": "accessible-store",
+          "matched": false,
+          "reason": "attribute \"accessibility_mode\" was false; condition did not match"
+        },
+        {
+          "rule_id": "default",
+          "matched": true,
+          "reason": "no targeting rule matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-147",
+      "flag": "support_prompt",
+      "context": {
+        "accessibility_mode": true,
+        "kiosk": false,
+        "store_size": 20779.0,
+        "tier": "member",
+        "user_id": "synthetic-user-147"
+      }
+    },
+    "expected": {
+      "flag": "support_prompt",
+      "value": true,
+      "source": "non-guest",
+      "explanation": [
+        {
+          "rule_id": "non-guest",
+          "matched": true,
+          "reason": "all conditions matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-148",
+      "flag": "checkout_redesign",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": true,
+        "store_size": 21036.0,
+        "tier": "member",
+        "user_id": "synthetic-user-148"
+      }
+    },
+    "expected": {
+      "flag": "checkout_redesign",
+      "value": false,
+      "source": "default",
+      "explanation": [
+        {
+          "rule_id": "employees-first",
+          "matched": false,
+          "reason": "attribute \"tier\" was \"member\"; condition did not match"
+        },
+        {
+          "rule_id": "kiosk-rollout",
+          "matched": false,
+          "reason": "stable bucket 5097 was outside 0..3500"
+        },
+        {
+          "rule_id": "default",
+          "matched": true,
+          "reason": "no targeting rule matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-149",
+      "flag": "max_cart_items",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": true,
+        "store_size": 21293.0,
+        "tier": "member",
+        "user_id": "synthetic-user-149"
+      }
+    },
+    "expected": {
+      "flag": "max_cart_items",
+      "value": 50.0,
+      "source": "large-store",
+      "explanation": [
+        {
+          "rule_id": "large-store",
+          "matched": true,
+          "reason": "all conditions matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-150",
+      "flag": "receipt_style",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": false,
+        "store_size": 21550.0,
+        "tier": "employee",
+        "user_id": "synthetic-user-150"
+      }
+    },
+    "expected": {
+      "flag": "receipt_style",
+      "value": "compact",
+      "source": "default",
+      "explanation": [
+        {
+          "rule_id": "accessible-store",
+          "matched": false,
+          "reason": "attribute \"accessibility_mode\" was false; condition did not match"
+        },
+        {
+          "rule_id": "default",
+          "matched": true,
+          "reason": "no targeting rule matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-151",
+      "flag": "support_prompt",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": true,
+        "store_size": 21807.0,
+        "tier": "guest",
+        "user_id": "synthetic-user-151"
+      }
+    },
+    "expected": {
+      "flag": "support_prompt",
+      "value": false,
+      "source": "default",
+      "explanation": [
+        {
+          "rule_id": "non-guest",
+          "matched": false,
+          "reason": "attribute \"tier\" was \"guest\"; condition did not match"
+        },
+        {
+          "rule_id": "default",
+          "matched": true,
+          "reason": "no targeting rule matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-152",
+      "flag": "checkout_redesign",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": true,
+        "store_size": 22064.0,
+        "tier": "member",
+        "user_id": "synthetic-user-152"
+      }
+    },
+    "expected": {
+      "flag": "checkout_redesign",
+      "value": false,
+      "source": "default",
+      "explanation": [
+        {
+          "rule_id": "employees-first",
+          "matched": false,
+          "reason": "attribute \"tier\" was \"member\"; condition did not match"
+        },
+        {
+          "rule_id": "kiosk-rollout",
+          "matched": false,
+          "reason": "stable bucket 8452 was outside 0..3500"
+        },
+        {
+          "rule_id": "default",
+          "matched": true,
+          "reason": "no targeting rule matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-153",
+      "flag": "max_cart_items",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": false,
+        "store_size": 22321.0,
+        "tier": "member",
+        "user_id": "synthetic-user-153"
+      }
+    },
+    "expected": {
+      "flag": "max_cart_items",
+      "value": 50.0,
+      "source": "large-store",
+      "explanation": [
+        {
+          "rule_id": "large-store",
+          "matched": true,
+          "reason": "all conditions matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-154",
+      "flag": "receipt_style",
+      "context": {
+        "accessibility_mode": true,
+        "kiosk": true,
+        "store_size": 22578.0,
+        "tier": "member",
+        "user_id": "synthetic-user-154"
+      }
+    },
+    "expected": {
+      "flag": "receipt_style",
+      "value": "large-print",
+      "source": "accessible-store",
+      "explanation": [
+        {
+          "rule_id": "accessible-store",
+          "matched": true,
+          "reason": "all conditions matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-155",
+      "flag": "support_prompt",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": true,
+        "store_size": 22835.0,
+        "tier": "employee",
+        "user_id": "synthetic-user-155"
+      }
+    },
+    "expected": {
+      "flag": "support_prompt",
+      "value": true,
+      "source": "non-guest",
+      "explanation": [
+        {
+          "rule_id": "non-guest",
+          "matched": true,
+          "reason": "all conditions matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-156",
+      "flag": "checkout_redesign",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": false,
+        "store_size": 23092.0,
+        "tier": "guest",
+        "user_id": "synthetic-user-156"
+      }
+    },
+    "expected": {
+      "flag": "checkout_redesign",
+      "value": false,
+      "source": "default",
+      "explanation": [
+        {
+          "rule_id": "employees-first",
+          "matched": false,
+          "reason": "attribute \"tier\" was \"guest\"; condition did not match"
+        },
+        {
+          "rule_id": "kiosk-rollout",
+          "matched": false,
+          "reason": "attribute \"kiosk\" was false; condition did not match"
+        },
+        {
+          "rule_id": "default",
+          "matched": true,
+          "reason": "no targeting rule matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-157",
+      "flag": "max_cart_items",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": true,
+        "store_size": 23349.0,
+        "tier": "member",
+        "user_id": "synthetic-user-157"
+      }
+    },
+    "expected": {
+      "flag": "max_cart_items",
+      "value": 50.0,
+      "source": "large-store",
+      "explanation": [
+        {
+          "rule_id": "large-store",
+          "matched": true,
+          "reason": "all conditions matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-158",
+      "flag": "receipt_style",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": true,
+        "store_size": 23606.0,
+        "tier": "member",
+        "user_id": "synthetic-user-158"
+      }
+    },
+    "expected": {
+      "flag": "receipt_style",
+      "value": "compact",
+      "source": "default",
+      "explanation": [
+        {
+          "rule_id": "accessible-store",
+          "matched": false,
+          "reason": "attribute \"accessibility_mode\" was false; condition did not match"
+        },
+        {
+          "rule_id": "default",
+          "matched": true,
+          "reason": "no targeting rule matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-159",
+      "flag": "support_prompt",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": false,
+        "store_size": 23863.0,
+        "tier": "member",
+        "user_id": "synthetic-user-159"
+      }
+    },
+    "expected": {
+      "flag": "support_prompt",
+      "value": true,
+      "source": "non-guest",
+      "explanation": [
+        {
+          "rule_id": "non-guest",
+          "matched": true,
+          "reason": "all conditions matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-160",
+      "flag": "checkout_redesign",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": true,
+        "store_size": 24120.0,
+        "tier": "employee",
+        "user_id": "synthetic-user-160"
+      }
+    },
+    "expected": {
+      "flag": "checkout_redesign",
+      "value": true,
+      "source": "employees-first",
+      "explanation": [
+        {
+          "rule_id": "employees-first",
+          "matched": true,
+          "reason": "all conditions matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-161",
+      "flag": "max_cart_items",
+      "context": {
+        "accessibility_mode": true,
+        "kiosk": true,
+        "store_size": 24377.0,
+        "tier": "guest",
+        "user_id": "synthetic-user-161"
+      }
+    },
+    "expected": {
+      "flag": "max_cart_items",
+      "value": 50.0,
+      "source": "large-store",
+      "explanation": [
+        {
+          "rule_id": "large-store",
+          "matched": true,
+          "reason": "all conditions matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-162",
+      "flag": "receipt_style",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": false,
+        "store_size": 24634.0,
+        "tier": "member",
+        "user_id": "synthetic-user-162"
+      }
+    },
+    "expected": {
+      "flag": "receipt_style",
+      "value": "compact",
+      "source": "default",
+      "explanation": [
+        {
+          "rule_id": "accessible-store",
+          "matched": false,
+          "reason": "attribute \"accessibility_mode\" was false; condition did not match"
+        },
+        {
+          "rule_id": "default",
+          "matched": true,
+          "reason": "no targeting rule matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-163",
+      "flag": "support_prompt",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": true,
+        "store_size": 24891.0,
+        "tier": "member",
+        "user_id": "synthetic-user-163"
+      }
+    },
+    "expected": {
+      "flag": "support_prompt",
+      "value": true,
+      "source": "non-guest",
+      "explanation": [
+        {
+          "rule_id": "non-guest",
+          "matched": true,
+          "reason": "all conditions matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-164",
+      "flag": "checkout_redesign",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": true,
+        "store_size": 25148.0,
+        "tier": "member",
+        "user_id": "synthetic-user-164"
+      }
+    },
+    "expected": {
+      "flag": "checkout_redesign",
+      "value": true,
+      "source": "kiosk-rollout",
+      "explanation": [
+        {
+          "rule_id": "employees-first",
+          "matched": false,
+          "reason": "attribute \"tier\" was \"member\"; condition did not match"
+        },
+        {
+          "rule_id": "kiosk-rollout",
+          "matched": true,
+          "reason": "conditions matched; stable bucket 1807 was inside 0..3500"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-165",
+      "flag": "max_cart_items",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": false,
+        "store_size": 25405.0,
+        "tier": "employee",
+        "user_id": "synthetic-user-165"
+      }
+    },
+    "expected": {
+      "flag": "max_cart_items",
+      "value": 50.0,
+      "source": "large-store",
+      "explanation": [
+        {
+          "rule_id": "large-store",
+          "matched": true,
+          "reason": "all conditions matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-166",
+      "flag": "receipt_style",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": true,
+        "store_size": 25662.0,
+        "tier": "guest",
+        "user_id": "synthetic-user-166"
+      }
+    },
+    "expected": {
+      "flag": "receipt_style",
+      "value": "compact",
+      "source": "default",
+      "explanation": [
+        {
+          "rule_id": "accessible-store",
+          "matched": false,
+          "reason": "attribute \"accessibility_mode\" was false; condition did not match"
+        },
+        {
+          "rule_id": "default",
+          "matched": true,
+          "reason": "no targeting rule matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-167",
+      "flag": "support_prompt",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": true,
+        "store_size": 25919.0,
+        "tier": "member",
+        "user_id": "synthetic-user-167"
+      }
+    },
+    "expected": {
+      "flag": "support_prompt",
+      "value": true,
+      "source": "non-guest",
+      "explanation": [
+        {
+          "rule_id": "non-guest",
+          "matched": true,
+          "reason": "all conditions matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-168",
+      "flag": "checkout_redesign",
+      "context": {
+        "accessibility_mode": true,
+        "kiosk": false,
+        "store_size": 26176.0,
+        "tier": "member",
+        "user_id": "synthetic-user-168"
+      }
+    },
+    "expected": {
+      "flag": "checkout_redesign",
+      "value": false,
+      "source": "default",
+      "explanation": [
+        {
+          "rule_id": "employees-first",
+          "matched": false,
+          "reason": "attribute \"tier\" was \"member\"; condition did not match"
+        },
+        {
+          "rule_id": "kiosk-rollout",
+          "matched": false,
+          "reason": "attribute \"kiosk\" was false; condition did not match"
+        },
+        {
+          "rule_id": "default",
+          "matched": true,
+          "reason": "no targeting rule matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-169",
+      "flag": "max_cart_items",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": true,
+        "store_size": 26433.0,
+        "tier": "member",
+        "user_id": "synthetic-user-169"
+      }
+    },
+    "expected": {
+      "flag": "max_cart_items",
+      "value": 50.0,
+      "source": "large-store",
+      "explanation": [
+        {
+          "rule_id": "large-store",
+          "matched": true,
+          "reason": "all conditions matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-170",
+      "flag": "receipt_style",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": true,
+        "store_size": 26690.0,
+        "tier": "employee",
+        "user_id": "synthetic-user-170"
+      }
+    },
+    "expected": {
+      "flag": "receipt_style",
+      "value": "compact",
+      "source": "default",
+      "explanation": [
+        {
+          "rule_id": "accessible-store",
+          "matched": false,
+          "reason": "attribute \"accessibility_mode\" was false; condition did not match"
+        },
+        {
+          "rule_id": "default",
+          "matched": true,
+          "reason": "no targeting rule matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-171",
+      "flag": "support_prompt",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": false,
+        "store_size": 26947.0,
+        "tier": "guest",
+        "user_id": "synthetic-user-171"
+      }
+    },
+    "expected": {
+      "flag": "support_prompt",
+      "value": false,
+      "source": "default",
+      "explanation": [
+        {
+          "rule_id": "non-guest",
+          "matched": false,
+          "reason": "attribute \"tier\" was \"guest\"; condition did not match"
+        },
+        {
+          "rule_id": "default",
+          "matched": true,
+          "reason": "no targeting rule matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-172",
+      "flag": "checkout_redesign",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": true,
+        "store_size": 27204.0,
+        "tier": "member",
+        "user_id": "synthetic-user-172"
+      }
+    },
+    "expected": {
+      "flag": "checkout_redesign",
+      "value": true,
+      "source": "kiosk-rollout",
+      "explanation": [
+        {
+          "rule_id": "employees-first",
+          "matched": false,
+          "reason": "attribute \"tier\" was \"member\"; condition did not match"
+        },
+        {
+          "rule_id": "kiosk-rollout",
+          "matched": true,
+          "reason": "conditions matched; stable bucket 402 was inside 0..3500"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-173",
+      "flag": "max_cart_items",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": true,
+        "store_size": 27461.0,
+        "tier": "member",
+        "user_id": "synthetic-user-173"
+      }
+    },
+    "expected": {
+      "flag": "max_cart_items",
+      "value": 50.0,
+      "source": "large-store",
+      "explanation": [
+        {
+          "rule_id": "large-store",
+          "matched": true,
+          "reason": "all conditions matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-174",
+      "flag": "receipt_style",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": false,
+        "store_size": 27718.0,
+        "tier": "member",
+        "user_id": "synthetic-user-174"
+      }
+    },
+    "expected": {
+      "flag": "receipt_style",
+      "value": "compact",
+      "source": "default",
+      "explanation": [
+        {
+          "rule_id": "accessible-store",
+          "matched": false,
+          "reason": "attribute \"accessibility_mode\" was false; condition did not match"
+        },
+        {
+          "rule_id": "default",
+          "matched": true,
+          "reason": "no targeting rule matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-175",
+      "flag": "support_prompt",
+      "context": {
+        "accessibility_mode": true,
+        "kiosk": true,
+        "store_size": 27975.0,
+        "tier": "employee",
+        "user_id": "synthetic-user-175"
+      }
+    },
+    "expected": {
+      "flag": "support_prompt",
+      "value": true,
+      "source": "non-guest",
+      "explanation": [
+        {
+          "rule_id": "non-guest",
+          "matched": true,
+          "reason": "all conditions matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-176",
+      "flag": "checkout_redesign",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": true,
+        "store_size": 28232.0,
+        "tier": "guest",
+        "user_id": "synthetic-user-176"
+      }
+    },
+    "expected": {
+      "flag": "checkout_redesign",
+      "value": false,
+      "source": "default",
+      "explanation": [
+        {
+          "rule_id": "employees-first",
+          "matched": false,
+          "reason": "attribute \"tier\" was \"guest\"; condition did not match"
+        },
+        {
+          "rule_id": "kiosk-rollout",
+          "matched": false,
+          "reason": "stable bucket 7782 was outside 0..3500"
+        },
+        {
+          "rule_id": "default",
+          "matched": true,
+          "reason": "no targeting rule matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-177",
+      "flag": "max_cart_items",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": false,
+        "store_size": 28489.0,
+        "tier": "member",
+        "user_id": "synthetic-user-177"
+      }
+    },
+    "expected": {
+      "flag": "max_cart_items",
+      "value": 50.0,
+      "source": "large-store",
+      "explanation": [
+        {
+          "rule_id": "large-store",
+          "matched": true,
+          "reason": "all conditions matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-178",
+      "flag": "receipt_style",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": true,
+        "store_size": 28746.0,
+        "tier": "member",
+        "user_id": "synthetic-user-178"
+      }
+    },
+    "expected": {
+      "flag": "receipt_style",
+      "value": "compact",
+      "source": "default",
+      "explanation": [
+        {
+          "rule_id": "accessible-store",
+          "matched": false,
+          "reason": "attribute \"accessibility_mode\" was false; condition did not match"
+        },
+        {
+          "rule_id": "default",
+          "matched": true,
+          "reason": "no targeting rule matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-179",
+      "flag": "support_prompt",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": true,
+        "store_size": 29003.0,
+        "tier": "member",
+        "user_id": "synthetic-user-179"
+      }
+    },
+    "expected": {
+      "flag": "support_prompt",
+      "value": true,
+      "source": "non-guest",
+      "explanation": [
+        {
+          "rule_id": "non-guest",
+          "matched": true,
+          "reason": "all conditions matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-180",
+      "flag": "checkout_redesign",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": false,
+        "store_size": 29260.0,
+        "tier": "employee",
+        "user_id": "synthetic-user-180"
+      }
+    },
+    "expected": {
+      "flag": "checkout_redesign",
+      "value": true,
+      "source": "employees-first",
+      "explanation": [
+        {
+          "rule_id": "employees-first",
+          "matched": true,
+          "reason": "all conditions matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-181",
+      "flag": "max_cart_items",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": true,
+        "store_size": 29517.0,
+        "tier": "guest",
+        "user_id": "synthetic-user-181"
+      }
+    },
+    "expected": {
+      "flag": "max_cart_items",
+      "value": 50.0,
+      "source": "large-store",
+      "explanation": [
+        {
+          "rule_id": "large-store",
+          "matched": true,
+          "reason": "all conditions matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-182",
+      "flag": "receipt_style",
+      "context": {
+        "accessibility_mode": true,
+        "kiosk": true,
+        "store_size": 29774.0,
+        "tier": "member",
+        "user_id": "synthetic-user-182"
+      }
+    },
+    "expected": {
+      "flag": "receipt_style",
+      "value": "large-print",
+      "source": "accessible-store",
+      "explanation": [
+        {
+          "rule_id": "accessible-store",
+          "matched": true,
+          "reason": "all conditions matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-183",
+      "flag": "support_prompt",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": false,
+        "store_size": 30031.0,
+        "tier": "member",
+        "user_id": "synthetic-user-183"
+      }
+    },
+    "expected": {
+      "flag": "support_prompt",
+      "value": true,
+      "source": "non-guest",
+      "explanation": [
+        {
+          "rule_id": "non-guest",
+          "matched": true,
+          "reason": "all conditions matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-184",
+      "flag": "checkout_redesign",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": true,
+        "store_size": 30288.0,
+        "tier": "member",
+        "user_id": "synthetic-user-184"
+      }
+    },
+    "expected": {
+      "flag": "checkout_redesign",
+      "value": false,
+      "source": "default",
+      "explanation": [
+        {
+          "rule_id": "employees-first",
+          "matched": false,
+          "reason": "attribute \"tier\" was \"member\"; condition did not match"
+        },
+        {
+          "rule_id": "kiosk-rollout",
+          "matched": false,
+          "reason": "stable bucket 6881 was outside 0..3500"
+        },
+        {
+          "rule_id": "default",
+          "matched": true,
+          "reason": "no targeting rule matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-185",
+      "flag": "max_cart_items",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": true,
+        "store_size": 30545.0,
+        "tier": "employee",
+        "user_id": "synthetic-user-185"
+      }
+    },
+    "expected": {
+      "flag": "max_cart_items",
+      "value": 50.0,
+      "source": "large-store",
+      "explanation": [
+        {
+          "rule_id": "large-store",
+          "matched": true,
+          "reason": "all conditions matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-186",
+      "flag": "receipt_style",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": false,
+        "store_size": 30802.0,
+        "tier": "guest",
+        "user_id": "synthetic-user-186"
+      }
+    },
+    "expected": {
+      "flag": "receipt_style",
+      "value": "compact",
+      "source": "default",
+      "explanation": [
+        {
+          "rule_id": "accessible-store",
+          "matched": false,
+          "reason": "attribute \"accessibility_mode\" was false; condition did not match"
+        },
+        {
+          "rule_id": "default",
+          "matched": true,
+          "reason": "no targeting rule matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-187",
+      "flag": "support_prompt",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": true,
+        "store_size": 31059.0,
+        "tier": "member",
+        "user_id": "synthetic-user-187"
+      }
+    },
+    "expected": {
+      "flag": "support_prompt",
+      "value": true,
+      "source": "non-guest",
+      "explanation": [
+        {
+          "rule_id": "non-guest",
+          "matched": true,
+          "reason": "all conditions matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-188",
+      "flag": "checkout_redesign",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": true,
+        "store_size": 31316.0,
+        "tier": "member",
+        "user_id": "synthetic-user-188"
+      }
+    },
+    "expected": {
+      "flag": "checkout_redesign",
+      "value": false,
+      "source": "default",
+      "explanation": [
+        {
+          "rule_id": "employees-first",
+          "matched": false,
+          "reason": "attribute \"tier\" was \"member\"; condition did not match"
+        },
+        {
+          "rule_id": "kiosk-rollout",
+          "matched": false,
+          "reason": "stable bucket 9501 was outside 0..3500"
+        },
+        {
+          "rule_id": "default",
+          "matched": true,
+          "reason": "no targeting rule matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-189",
+      "flag": "max_cart_items",
+      "context": {
+        "accessibility_mode": true,
+        "kiosk": false,
+        "store_size": 31573.0,
+        "tier": "member",
+        "user_id": "synthetic-user-189"
+      }
+    },
+    "expected": {
+      "flag": "max_cart_items",
+      "value": 50.0,
+      "source": "large-store",
+      "explanation": [
+        {
+          "rule_id": "large-store",
+          "matched": true,
+          "reason": "all conditions matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-190",
+      "flag": "receipt_style",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": true,
+        "store_size": 31830.0,
+        "tier": "employee",
+        "user_id": "synthetic-user-190"
+      }
+    },
+    "expected": {
+      "flag": "receipt_style",
+      "value": "compact",
+      "source": "default",
+      "explanation": [
+        {
+          "rule_id": "accessible-store",
+          "matched": false,
+          "reason": "attribute \"accessibility_mode\" was false; condition did not match"
+        },
+        {
+          "rule_id": "default",
+          "matched": true,
+          "reason": "no targeting rule matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-191",
+      "flag": "support_prompt",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": true,
+        "store_size": 32087.0,
+        "tier": "guest",
+        "user_id": "synthetic-user-191"
+      }
+    },
+    "expected": {
+      "flag": "support_prompt",
+      "value": false,
+      "source": "default",
+      "explanation": [
+        {
+          "rule_id": "non-guest",
+          "matched": false,
+          "reason": "attribute \"tier\" was \"guest\"; condition did not match"
+        },
+        {
+          "rule_id": "default",
+          "matched": true,
+          "reason": "no targeting rule matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-192",
+      "flag": "checkout_redesign",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": false,
+        "store_size": 32344.0,
+        "tier": "member",
+        "user_id": "synthetic-user-192"
+      }
+    },
+    "expected": {
+      "flag": "checkout_redesign",
+      "value": false,
+      "source": "default",
+      "explanation": [
+        {
+          "rule_id": "employees-first",
+          "matched": false,
+          "reason": "attribute \"tier\" was \"member\"; condition did not match"
+        },
+        {
+          "rule_id": "kiosk-rollout",
+          "matched": false,
+          "reason": "attribute \"kiosk\" was false; condition did not match"
+        },
+        {
+          "rule_id": "default",
+          "matched": true,
+          "reason": "no targeting rule matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-193",
+      "flag": "max_cart_items",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": true,
+        "store_size": 32601.0,
+        "tier": "member",
+        "user_id": "synthetic-user-193"
+      }
+    },
+    "expected": {
+      "flag": "max_cart_items",
+      "value": 50.0,
+      "source": "large-store",
+      "explanation": [
+        {
+          "rule_id": "large-store",
+          "matched": true,
+          "reason": "all conditions matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-194",
+      "flag": "receipt_style",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": true,
+        "store_size": 32858.0,
+        "tier": "member",
+        "user_id": "synthetic-user-194"
+      }
+    },
+    "expected": {
+      "flag": "receipt_style",
+      "value": "compact",
+      "source": "default",
+      "explanation": [
+        {
+          "rule_id": "accessible-store",
+          "matched": false,
+          "reason": "attribute \"accessibility_mode\" was false; condition did not match"
+        },
+        {
+          "rule_id": "default",
+          "matched": true,
+          "reason": "no targeting rule matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-195",
+      "flag": "support_prompt",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": false,
+        "store_size": 8115.0,
+        "tier": "employee",
+        "user_id": "synthetic-user-195"
+      }
+    },
+    "expected": {
+      "flag": "support_prompt",
+      "value": true,
+      "source": "non-guest",
+      "explanation": [
+        {
+          "rule_id": "non-guest",
+          "matched": true,
+          "reason": "all conditions matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-196",
+      "flag": "checkout_redesign",
+      "context": {
+        "accessibility_mode": true,
+        "kiosk": true,
+        "store_size": 8372.0,
+        "tier": "guest",
+        "user_id": "synthetic-user-196"
+      }
+    },
+    "expected": {
+      "flag": "checkout_redesign",
+      "value": true,
+      "source": "kiosk-rollout",
+      "explanation": [
+        {
+          "rule_id": "employees-first",
+          "matched": false,
+          "reason": "attribute \"tier\" was \"guest\"; condition did not match"
+        },
+        {
+          "rule_id": "kiosk-rollout",
+          "matched": true,
+          "reason": "conditions matched; stable bucket 236 was inside 0..3500"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-197",
+      "flag": "max_cart_items",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": true,
+        "store_size": 8629.0,
+        "tier": "member",
+        "user_id": "synthetic-user-197"
+      }
+    },
+    "expected": {
+      "flag": "max_cart_items",
+      "value": 30.0,
+      "source": "default",
+      "explanation": [
+        {
+          "rule_id": "large-store",
+          "matched": false,
+          "reason": "attribute \"store_size\" was 8629; condition did not match"
+        },
+        {
+          "rule_id": "default",
+          "matched": true,
+          "reason": "no targeting rule matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-198",
+      "flag": "receipt_style",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": false,
+        "store_size": 8886.0,
+        "tier": "member",
+        "user_id": "synthetic-user-198"
+      }
+    },
+    "expected": {
+      "flag": "receipt_style",
+      "value": "compact",
+      "source": "default",
+      "explanation": [
+        {
+          "rule_id": "accessible-store",
+          "matched": false,
+          "reason": "attribute \"accessibility_mode\" was false; condition did not match"
+        },
+        {
+          "rule_id": "default",
+          "matched": true,
+          "reason": "no targeting rule matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-199",
+      "flag": "support_prompt",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": true,
+        "store_size": 9143.0,
+        "tier": "member",
+        "user_id": "synthetic-user-199"
+      }
+    },
+    "expected": {
+      "flag": "support_prompt",
+      "value": true,
+      "source": "non-guest",
+      "explanation": [
+        {
+          "rule_id": "non-guest",
+          "matched": true,
+          "reason": "all conditions matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-200",
+      "flag": "checkout_redesign",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": true,
+        "store_size": 9400.0,
+        "tier": "employee",
+        "user_id": "synthetic-user-200"
+      }
+    },
+    "expected": {
+      "flag": "checkout_redesign",
+      "value": true,
+      "source": "employees-first",
+      "explanation": [
+        {
+          "rule_id": "employees-first",
+          "matched": true,
+          "reason": "all conditions matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-201",
+      "flag": "max_cart_items",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": false,
+        "store_size": 9657.0,
+        "tier": "guest",
+        "user_id": "synthetic-user-201"
+      }
+    },
+    "expected": {
+      "flag": "max_cart_items",
+      "value": 30.0,
+      "source": "default",
+      "explanation": [
+        {
+          "rule_id": "large-store",
+          "matched": false,
+          "reason": "attribute \"store_size\" was 9657; condition did not match"
+        },
+        {
+          "rule_id": "default",
+          "matched": true,
+          "reason": "no targeting rule matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-202",
+      "flag": "receipt_style",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": true,
+        "store_size": 9914.0,
+        "tier": "member",
+        "user_id": "synthetic-user-202"
+      }
+    },
+    "expected": {
+      "flag": "receipt_style",
+      "value": "compact",
+      "source": "default",
+      "explanation": [
+        {
+          "rule_id": "accessible-store",
+          "matched": false,
+          "reason": "attribute \"accessibility_mode\" was false; condition did not match"
+        },
+        {
+          "rule_id": "default",
+          "matched": true,
+          "reason": "no targeting rule matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-203",
+      "flag": "support_prompt",
+      "context": {
+        "accessibility_mode": true,
+        "kiosk": true,
+        "store_size": 10171.0,
+        "tier": "member",
+        "user_id": "synthetic-user-203"
+      }
+    },
+    "expected": {
+      "flag": "support_prompt",
+      "value": true,
+      "source": "non-guest",
+      "explanation": [
+        {
+          "rule_id": "non-guest",
+          "matched": true,
+          "reason": "all conditions matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-204",
+      "flag": "checkout_redesign",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": false,
+        "store_size": 10428.0,
+        "tier": "member",
+        "user_id": "synthetic-user-204"
+      }
+    },
+    "expected": {
+      "flag": "checkout_redesign",
+      "value": false,
+      "source": "default",
+      "explanation": [
+        {
+          "rule_id": "employees-first",
+          "matched": false,
+          "reason": "attribute \"tier\" was \"member\"; condition did not match"
+        },
+        {
+          "rule_id": "kiosk-rollout",
+          "matched": false,
+          "reason": "attribute \"kiosk\" was false; condition did not match"
+        },
+        {
+          "rule_id": "default",
+          "matched": true,
+          "reason": "no targeting rule matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-205",
+      "flag": "max_cart_items",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": true,
+        "store_size": 10685.0,
+        "tier": "employee",
+        "user_id": "synthetic-user-205"
+      }
+    },
+    "expected": {
+      "flag": "max_cart_items",
+      "value": 30.0,
+      "source": "default",
+      "explanation": [
+        {
+          "rule_id": "large-store",
+          "matched": false,
+          "reason": "attribute \"store_size\" was 10685; condition did not match"
+        },
+        {
+          "rule_id": "default",
+          "matched": true,
+          "reason": "no targeting rule matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-206",
+      "flag": "receipt_style",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": true,
+        "store_size": 10942.0,
+        "tier": "guest",
+        "user_id": "synthetic-user-206"
+      }
+    },
+    "expected": {
+      "flag": "receipt_style",
+      "value": "compact",
+      "source": "default",
+      "explanation": [
+        {
+          "rule_id": "accessible-store",
+          "matched": false,
+          "reason": "attribute \"accessibility_mode\" was false; condition did not match"
+        },
+        {
+          "rule_id": "default",
+          "matched": true,
+          "reason": "no targeting rule matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-207",
+      "flag": "support_prompt",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": false,
+        "store_size": 11199.0,
+        "tier": "member",
+        "user_id": "synthetic-user-207"
+      }
+    },
+    "expected": {
+      "flag": "support_prompt",
+      "value": true,
+      "source": "non-guest",
+      "explanation": [
+        {
+          "rule_id": "non-guest",
+          "matched": true,
+          "reason": "all conditions matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-208",
+      "flag": "checkout_redesign",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": true,
+        "store_size": 11456.0,
+        "tier": "member",
+        "user_id": "synthetic-user-208"
+      }
+    },
+    "expected": {
+      "flag": "checkout_redesign",
+      "value": false,
+      "source": "default",
+      "explanation": [
+        {
+          "rule_id": "employees-first",
+          "matched": false,
+          "reason": "attribute \"tier\" was \"member\"; condition did not match"
+        },
+        {
+          "rule_id": "kiosk-rollout",
+          "matched": false,
+          "reason": "stable bucket 9046 was outside 0..3500"
+        },
+        {
+          "rule_id": "default",
+          "matched": true,
+          "reason": "no targeting rule matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-209",
+      "flag": "max_cart_items",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": true,
+        "store_size": 11713.0,
+        "tier": "member",
+        "user_id": "synthetic-user-209"
+      }
+    },
+    "expected": {
+      "flag": "max_cart_items",
+      "value": 30.0,
+      "source": "default",
+      "explanation": [
+        {
+          "rule_id": "large-store",
+          "matched": false,
+          "reason": "attribute \"store_size\" was 11713; condition did not match"
+        },
+        {
+          "rule_id": "default",
+          "matched": true,
+          "reason": "no targeting rule matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-210",
+      "flag": "receipt_style",
+      "context": {
+        "accessibility_mode": true,
+        "kiosk": false,
+        "store_size": 11970.0,
+        "tier": "employee",
+        "user_id": "synthetic-user-210"
+      }
+    },
+    "expected": {
+      "flag": "receipt_style",
+      "value": "large-print",
+      "source": "accessible-store",
+      "explanation": [
+        {
+          "rule_id": "accessible-store",
+          "matched": true,
+          "reason": "all conditions matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-211",
+      "flag": "support_prompt",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": true,
+        "store_size": 12227.0,
+        "tier": "guest",
+        "user_id": "synthetic-user-211"
+      }
+    },
+    "expected": {
+      "flag": "support_prompt",
+      "value": false,
+      "source": "default",
+      "explanation": [
+        {
+          "rule_id": "non-guest",
+          "matched": false,
+          "reason": "attribute \"tier\" was \"guest\"; condition did not match"
+        },
+        {
+          "rule_id": "default",
+          "matched": true,
+          "reason": "no targeting rule matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-212",
+      "flag": "checkout_redesign",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": true,
+        "store_size": 12484.0,
+        "tier": "member",
+        "user_id": "synthetic-user-212"
+      }
+    },
+    "expected": {
+      "flag": "checkout_redesign",
+      "value": false,
+      "source": "default",
+      "explanation": [
+        {
+          "rule_id": "employees-first",
+          "matched": false,
+          "reason": "attribute \"tier\" was \"member\"; condition did not match"
+        },
+        {
+          "rule_id": "kiosk-rollout",
+          "matched": false,
+          "reason": "stable bucket 6171 was outside 0..3500"
+        },
+        {
+          "rule_id": "default",
+          "matched": true,
+          "reason": "no targeting rule matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-213",
+      "flag": "max_cart_items",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": false,
+        "store_size": 12741.0,
+        "tier": "member",
+        "user_id": "synthetic-user-213"
+      }
+    },
+    "expected": {
+      "flag": "max_cart_items",
+      "value": 30.0,
+      "source": "default",
+      "explanation": [
+        {
+          "rule_id": "large-store",
+          "matched": false,
+          "reason": "attribute \"store_size\" was 12741; condition did not match"
+        },
+        {
+          "rule_id": "default",
+          "matched": true,
+          "reason": "no targeting rule matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-214",
+      "flag": "receipt_style",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": true,
+        "store_size": 12998.0,
+        "tier": "member",
+        "user_id": "synthetic-user-214"
+      }
+    },
+    "expected": {
+      "flag": "receipt_style",
+      "value": "compact",
+      "source": "default",
+      "explanation": [
+        {
+          "rule_id": "accessible-store",
+          "matched": false,
+          "reason": "attribute \"accessibility_mode\" was false; condition did not match"
+        },
+        {
+          "rule_id": "default",
+          "matched": true,
+          "reason": "no targeting rule matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-215",
+      "flag": "support_prompt",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": true,
+        "store_size": 13255.0,
+        "tier": "employee",
+        "user_id": "synthetic-user-215"
+      }
+    },
+    "expected": {
+      "flag": "support_prompt",
+      "value": true,
+      "source": "non-guest",
+      "explanation": [
+        {
+          "rule_id": "non-guest",
+          "matched": true,
+          "reason": "all conditions matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-216",
+      "flag": "checkout_redesign",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": false,
+        "store_size": 13512.0,
+        "tier": "guest",
+        "user_id": "synthetic-user-216"
+      }
+    },
+    "expected": {
+      "flag": "checkout_redesign",
+      "value": false,
+      "source": "default",
+      "explanation": [
+        {
+          "rule_id": "employees-first",
+          "matched": false,
+          "reason": "attribute \"tier\" was \"guest\"; condition did not match"
+        },
+        {
+          "rule_id": "kiosk-rollout",
+          "matched": false,
+          "reason": "attribute \"kiosk\" was false; condition did not match"
+        },
+        {
+          "rule_id": "default",
+          "matched": true,
+          "reason": "no targeting rule matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-217",
+      "flag": "max_cart_items",
+      "context": {
+        "accessibility_mode": true,
+        "kiosk": true,
+        "store_size": 13769.0,
+        "tier": "member",
+        "user_id": "synthetic-user-217"
+      }
+    },
+    "expected": {
+      "flag": "max_cart_items",
+      "value": 30.0,
+      "source": "default",
+      "explanation": [
+        {
+          "rule_id": "large-store",
+          "matched": false,
+          "reason": "attribute \"store_size\" was 13769; condition did not match"
+        },
+        {
+          "rule_id": "default",
+          "matched": true,
+          "reason": "no targeting rule matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-218",
+      "flag": "receipt_style",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": true,
+        "store_size": 14026.0,
+        "tier": "member",
+        "user_id": "synthetic-user-218"
+      }
+    },
+    "expected": {
+      "flag": "receipt_style",
+      "value": "compact",
+      "source": "default",
+      "explanation": [
+        {
+          "rule_id": "accessible-store",
+          "matched": false,
+          "reason": "attribute \"accessibility_mode\" was false; condition did not match"
+        },
+        {
+          "rule_id": "default",
+          "matched": true,
+          "reason": "no targeting rule matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-219",
+      "flag": "support_prompt",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": false,
+        "store_size": 14283.0,
+        "tier": "member",
+        "user_id": "synthetic-user-219"
+      }
+    },
+    "expected": {
+      "flag": "support_prompt",
+      "value": true,
+      "source": "non-guest",
+      "explanation": [
+        {
+          "rule_id": "non-guest",
+          "matched": true,
+          "reason": "all conditions matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-220",
+      "flag": "checkout_redesign",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": true,
+        "store_size": 14540.0,
+        "tier": "employee",
+        "user_id": "synthetic-user-220"
+      }
+    },
+    "expected": {
+      "flag": "checkout_redesign",
+      "value": true,
+      "source": "employees-first",
+      "explanation": [
+        {
+          "rule_id": "employees-first",
+          "matched": true,
+          "reason": "all conditions matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-221",
+      "flag": "max_cart_items",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": true,
+        "store_size": 14797.0,
+        "tier": "guest",
+        "user_id": "synthetic-user-221"
+      }
+    },
+    "expected": {
+      "flag": "max_cart_items",
+      "value": 30.0,
+      "source": "default",
+      "explanation": [
+        {
+          "rule_id": "large-store",
+          "matched": false,
+          "reason": "attribute \"store_size\" was 14797; condition did not match"
+        },
+        {
+          "rule_id": "default",
+          "matched": true,
+          "reason": "no targeting rule matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-222",
+      "flag": "receipt_style",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": false,
+        "store_size": 15054.0,
+        "tier": "member",
+        "user_id": "synthetic-user-222"
+      }
+    },
+    "expected": {
+      "flag": "receipt_style",
+      "value": "compact",
+      "source": "default",
+      "explanation": [
+        {
+          "rule_id": "accessible-store",
+          "matched": false,
+          "reason": "attribute \"accessibility_mode\" was false; condition did not match"
+        },
+        {
+          "rule_id": "default",
+          "matched": true,
+          "reason": "no targeting rule matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-223",
+      "flag": "support_prompt",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": true,
+        "store_size": 15311.0,
+        "tier": "member",
+        "user_id": "synthetic-user-223"
+      }
+    },
+    "expected": {
+      "flag": "support_prompt",
+      "value": true,
+      "source": "non-guest",
+      "explanation": [
+        {
+          "rule_id": "non-guest",
+          "matched": true,
+          "reason": "all conditions matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-224",
+      "flag": "checkout_redesign",
+      "context": {
+        "accessibility_mode": true,
+        "kiosk": true,
+        "store_size": 15568.0,
+        "tier": "member",
+        "user_id": "synthetic-user-224"
+      }
+    },
+    "expected": {
+      "flag": "checkout_redesign",
+      "value": false,
+      "source": "default",
+      "explanation": [
+        {
+          "rule_id": "employees-first",
+          "matched": false,
+          "reason": "attribute \"tier\" was \"member\"; condition did not match"
+        },
+        {
+          "rule_id": "kiosk-rollout",
+          "matched": false,
+          "reason": "stable bucket 5756 was outside 0..3500"
+        },
+        {
+          "rule_id": "default",
+          "matched": true,
+          "reason": "no targeting rule matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-225",
+      "flag": "max_cart_items",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": false,
+        "store_size": 15825.0,
+        "tier": "employee",
+        "user_id": "synthetic-user-225"
+      }
+    },
+    "expected": {
+      "flag": "max_cart_items",
+      "value": 30.0,
+      "source": "default",
+      "explanation": [
+        {
+          "rule_id": "large-store",
+          "matched": false,
+          "reason": "attribute \"store_size\" was 15825; condition did not match"
+        },
+        {
+          "rule_id": "default",
+          "matched": true,
+          "reason": "no targeting rule matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-226",
+      "flag": "receipt_style",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": true,
+        "store_size": 16082.0,
+        "tier": "guest",
+        "user_id": "synthetic-user-226"
+      }
+    },
+    "expected": {
+      "flag": "receipt_style",
+      "value": "compact",
+      "source": "default",
+      "explanation": [
+        {
+          "rule_id": "accessible-store",
+          "matched": false,
+          "reason": "attribute \"accessibility_mode\" was false; condition did not match"
+        },
+        {
+          "rule_id": "default",
+          "matched": true,
+          "reason": "no targeting rule matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-227",
+      "flag": "support_prompt",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": true,
+        "store_size": 16339.0,
+        "tier": "member",
+        "user_id": "synthetic-user-227"
+      }
+    },
+    "expected": {
+      "flag": "support_prompt",
+      "value": true,
+      "source": "non-guest",
+      "explanation": [
+        {
+          "rule_id": "non-guest",
+          "matched": true,
+          "reason": "all conditions matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-228",
+      "flag": "checkout_redesign",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": false,
+        "store_size": 16596.0,
+        "tier": "member",
+        "user_id": "synthetic-user-228"
+      }
+    },
+    "expected": {
+      "flag": "checkout_redesign",
+      "value": false,
+      "source": "default",
+      "explanation": [
+        {
+          "rule_id": "employees-first",
+          "matched": false,
+          "reason": "attribute \"tier\" was \"member\"; condition did not match"
+        },
+        {
+          "rule_id": "kiosk-rollout",
+          "matched": false,
+          "reason": "attribute \"kiosk\" was false; condition did not match"
+        },
+        {
+          "rule_id": "default",
+          "matched": true,
+          "reason": "no targeting rule matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-229",
+      "flag": "max_cart_items",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": true,
+        "store_size": 16853.0,
+        "tier": "member",
+        "user_id": "synthetic-user-229"
+      }
+    },
+    "expected": {
+      "flag": "max_cart_items",
+      "value": 30.0,
+      "source": "default",
+      "explanation": [
+        {
+          "rule_id": "large-store",
+          "matched": false,
+          "reason": "attribute \"store_size\" was 16853; condition did not match"
+        },
+        {
+          "rule_id": "default",
+          "matched": true,
+          "reason": "no targeting rule matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-230",
+      "flag": "receipt_style",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": true,
+        "store_size": 17110.0,
+        "tier": "employee",
+        "user_id": "synthetic-user-230"
+      }
+    },
+    "expected": {
+      "flag": "receipt_style",
+      "value": "compact",
+      "source": "default",
+      "explanation": [
+        {
+          "rule_id": "accessible-store",
+          "matched": false,
+          "reason": "attribute \"accessibility_mode\" was false; condition did not match"
+        },
+        {
+          "rule_id": "default",
+          "matched": true,
+          "reason": "no targeting rule matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-231",
+      "flag": "support_prompt",
+      "context": {
+        "accessibility_mode": true,
+        "kiosk": false,
+        "store_size": 17367.0,
+        "tier": "guest",
+        "user_id": "synthetic-user-231"
+      }
+    },
+    "expected": {
+      "flag": "support_prompt",
+      "value": false,
+      "source": "default",
+      "explanation": [
+        {
+          "rule_id": "non-guest",
+          "matched": false,
+          "reason": "attribute \"tier\" was \"guest\"; condition did not match"
+        },
+        {
+          "rule_id": "default",
+          "matched": true,
+          "reason": "no targeting rule matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-232",
+      "flag": "checkout_redesign",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": true,
+        "store_size": 17624.0,
+        "tier": "member",
+        "user_id": "synthetic-user-232"
+      }
+    },
+    "expected": {
+      "flag": "checkout_redesign",
+      "value": true,
+      "source": "kiosk-rollout",
+      "explanation": [
+        {
+          "rule_id": "employees-first",
+          "matched": false,
+          "reason": "attribute \"tier\" was \"member\"; condition did not match"
+        },
+        {
+          "rule_id": "kiosk-rollout",
+          "matched": true,
+          "reason": "conditions matched; stable bucket 2401 was inside 0..3500"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-233",
+      "flag": "max_cart_items",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": true,
+        "store_size": 17881.0,
+        "tier": "member",
+        "user_id": "synthetic-user-233"
+      }
+    },
+    "expected": {
+      "flag": "max_cart_items",
+      "value": 30.0,
+      "source": "default",
+      "explanation": [
+        {
+          "rule_id": "large-store",
+          "matched": false,
+          "reason": "attribute \"store_size\" was 17881; condition did not match"
+        },
+        {
+          "rule_id": "default",
+          "matched": true,
+          "reason": "no targeting rule matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-234",
+      "flag": "receipt_style",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": false,
+        "store_size": 18138.0,
+        "tier": "member",
+        "user_id": "synthetic-user-234"
+      }
+    },
+    "expected": {
+      "flag": "receipt_style",
+      "value": "compact",
+      "source": "default",
+      "explanation": [
+        {
+          "rule_id": "accessible-store",
+          "matched": false,
+          "reason": "attribute \"accessibility_mode\" was false; condition did not match"
+        },
+        {
+          "rule_id": "default",
+          "matched": true,
+          "reason": "no targeting rule matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-235",
+      "flag": "support_prompt",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": true,
+        "store_size": 18395.0,
+        "tier": "employee",
+        "user_id": "synthetic-user-235"
+      }
+    },
+    "expected": {
+      "flag": "support_prompt",
+      "value": true,
+      "source": "non-guest",
+      "explanation": [
+        {
+          "rule_id": "non-guest",
+          "matched": true,
+          "reason": "all conditions matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-236",
+      "flag": "checkout_redesign",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": true,
+        "store_size": 18652.0,
+        "tier": "guest",
+        "user_id": "synthetic-user-236"
+      }
+    },
+    "expected": {
+      "flag": "checkout_redesign",
+      "value": false,
+      "source": "default",
+      "explanation": [
+        {
+          "rule_id": "employees-first",
+          "matched": false,
+          "reason": "attribute \"tier\" was \"guest\"; condition did not match"
+        },
+        {
+          "rule_id": "kiosk-rollout",
+          "matched": false,
+          "reason": "stable bucket 9781 was outside 0..3500"
+        },
+        {
+          "rule_id": "default",
+          "matched": true,
+          "reason": "no targeting rule matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-237",
+      "flag": "max_cart_items",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": false,
+        "store_size": 18909.0,
+        "tier": "member",
+        "user_id": "synthetic-user-237"
+      }
+    },
+    "expected": {
+      "flag": "max_cart_items",
+      "value": 30.0,
+      "source": "default",
+      "explanation": [
+        {
+          "rule_id": "large-store",
+          "matched": false,
+          "reason": "attribute \"store_size\" was 18909; condition did not match"
+        },
+        {
+          "rule_id": "default",
+          "matched": true,
+          "reason": "no targeting rule matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-238",
+      "flag": "receipt_style",
+      "context": {
+        "accessibility_mode": true,
+        "kiosk": true,
+        "store_size": 19166.0,
+        "tier": "member",
+        "user_id": "synthetic-user-238"
+      }
+    },
+    "expected": {
+      "flag": "receipt_style",
+      "value": "large-print",
+      "source": "accessible-store",
+      "explanation": [
+        {
+          "rule_id": "accessible-store",
+          "matched": true,
+          "reason": "all conditions matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-239",
+      "flag": "support_prompt",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": true,
+        "store_size": 19423.0,
+        "tier": "member",
+        "user_id": "synthetic-user-239"
+      }
+    },
+    "expected": {
+      "flag": "support_prompt",
+      "value": true,
+      "source": "non-guest",
+      "explanation": [
+        {
+          "rule_id": "non-guest",
+          "matched": true,
+          "reason": "all conditions matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-240",
+      "flag": "checkout_redesign",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": false,
+        "store_size": 19680.0,
+        "tier": "employee",
+        "user_id": "synthetic-user-240"
+      }
+    },
+    "expected": {
+      "flag": "checkout_redesign",
+      "value": true,
+      "source": "employees-first",
+      "explanation": [
+        {
+          "rule_id": "employees-first",
+          "matched": true,
+          "reason": "all conditions matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-241",
+      "flag": "max_cart_items",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": true,
+        "store_size": 19937.0,
+        "tier": "guest",
+        "user_id": "synthetic-user-241"
+      }
+    },
+    "expected": {
+      "flag": "max_cart_items",
+      "value": 30.0,
+      "source": "default",
+      "explanation": [
+        {
+          "rule_id": "large-store",
+          "matched": false,
+          "reason": "attribute \"store_size\" was 19937; condition did not match"
+        },
+        {
+          "rule_id": "default",
+          "matched": true,
+          "reason": "no targeting rule matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-242",
+      "flag": "receipt_style",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": true,
+        "store_size": 20194.0,
+        "tier": "member",
+        "user_id": "synthetic-user-242"
+      }
+    },
+    "expected": {
+      "flag": "receipt_style",
+      "value": "compact",
+      "source": "default",
+      "explanation": [
+        {
+          "rule_id": "accessible-store",
+          "matched": false,
+          "reason": "attribute \"accessibility_mode\" was false; condition did not match"
+        },
+        {
+          "rule_id": "default",
+          "matched": true,
+          "reason": "no targeting rule matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-243",
+      "flag": "support_prompt",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": false,
+        "store_size": 20451.0,
+        "tier": "member",
+        "user_id": "synthetic-user-243"
+      }
+    },
+    "expected": {
+      "flag": "support_prompt",
+      "value": true,
+      "source": "non-guest",
+      "explanation": [
+        {
+          "rule_id": "non-guest",
+          "matched": true,
+          "reason": "all conditions matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-244",
+      "flag": "checkout_redesign",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": true,
+        "store_size": 20708.0,
+        "tier": "member",
+        "user_id": "synthetic-user-244"
+      }
+    },
+    "expected": {
+      "flag": "checkout_redesign",
+      "value": false,
+      "source": "default",
+      "explanation": [
+        {
+          "rule_id": "employees-first",
+          "matched": false,
+          "reason": "attribute \"tier\" was \"member\"; condition did not match"
+        },
+        {
+          "rule_id": "kiosk-rollout",
+          "matched": false,
+          "reason": "stable bucket 6846 was outside 0..3500"
+        },
+        {
+          "rule_id": "default",
+          "matched": true,
+          "reason": "no targeting rule matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-245",
+      "flag": "max_cart_items",
+      "context": {
+        "accessibility_mode": true,
+        "kiosk": true,
+        "store_size": 20965.0,
+        "tier": "employee",
+        "user_id": "synthetic-user-245"
+      }
+    },
+    "expected": {
+      "flag": "max_cart_items",
+      "value": 50.0,
+      "source": "large-store",
+      "explanation": [
+        {
+          "rule_id": "large-store",
+          "matched": true,
+          "reason": "all conditions matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-246",
+      "flag": "receipt_style",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": false,
+        "store_size": 21222.0,
+        "tier": "guest",
+        "user_id": "synthetic-user-246"
+      }
+    },
+    "expected": {
+      "flag": "receipt_style",
+      "value": "compact",
+      "source": "default",
+      "explanation": [
+        {
+          "rule_id": "accessible-store",
+          "matched": false,
+          "reason": "attribute \"accessibility_mode\" was false; condition did not match"
+        },
+        {
+          "rule_id": "default",
+          "matched": true,
+          "reason": "no targeting rule matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-247",
+      "flag": "support_prompt",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": true,
+        "store_size": 21479.0,
+        "tier": "member",
+        "user_id": "synthetic-user-247"
+      }
+    },
+    "expected": {
+      "flag": "support_prompt",
+      "value": true,
+      "source": "non-guest",
+      "explanation": [
+        {
+          "rule_id": "non-guest",
+          "matched": true,
+          "reason": "all conditions matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-248",
+      "flag": "checkout_redesign",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": true,
+        "store_size": 21736.0,
+        "tier": "member",
+        "user_id": "synthetic-user-248"
+      }
+    },
+    "expected": {
+      "flag": "checkout_redesign",
+      "value": false,
+      "source": "default",
+      "explanation": [
+        {
+          "rule_id": "employees-first",
+          "matched": false,
+          "reason": "attribute \"tier\" was \"member\"; condition did not match"
+        },
+        {
+          "rule_id": "kiosk-rollout",
+          "matched": false,
+          "reason": "stable bucket 4706 was outside 0..3500"
+        },
+        {
+          "rule_id": "default",
+          "matched": true,
+          "reason": "no targeting rule matched"
+        }
+      ]
+    }
+  },
+  {
+    "input": {
+      "case_id": "golden-249",
+      "flag": "max_cart_items",
+      "context": {
+        "accessibility_mode": false,
+        "kiosk": false,
+        "store_size": 21993.0,
+        "tier": "member",
+        "user_id": "synthetic-user-249"
+      }
+    },
+    "expected": {
+      "flag": "max_cart_items",
+      "value": 50.0,
+      "source": "large-store",
+      "explanation": [
+        {
+          "rule_id": "large-store",
+          "matched": true,
+          "reason": "all conditions matched"
+        }
+      ]
+    }
+  }
+]
\ No newline at end of file
diff --git a/developer-simulation/runs/2026-08-01--offline-flag-parity/fixtures/good-reload.json b/developer-simulation/runs/2026-08-01--offline-flag-parity/fixtures/good-reload.json
new file mode 100644
index 0000000..52a33e5
--- /dev/null
+++ b/developer-simulation/runs/2026-08-01--offline-flag-parity/fixtures/good-reload.json
@@ -0,0 +1,75 @@
+{
+  "schema_version": 1,
+  "config_id": "demo-v2",
+  "salt": "retail-kiosk-v1",
+  "flags": {
+    "checkout_redesign": {
+      "default": false,
+      "rules": [
+        {
+          "id": "all-kiosks-after-reload",
+          "conditions": [
+            {
+              "attribute": "kiosk",
+              "op": "eq",
+              "value": true
+            }
+          ],
+          "serve": true,
+          "percentage": null
+        }
+      ]
+    },
+    "max_cart_items": {
+      "default": 30.0,
+      "rules": [
+        {
+          "id": "large-store",
+          "conditions": [
+            {
+              "attribute": "store_size",
+              "op": "greater_than",
+              "value": 20000.0
+            }
+          ],
+          "serve": 50.0,
+          "percentage": null
+        }
+      ]
+    },
+    "receipt_style": {
+      "default": "compact",
+      "rules": [
+        {
+          "id": "accessible-store",
+          "conditions": [
+            {
+              "attribute": "accessibility_mode",
+              "op": "eq",
+              "value": true
+            }
+          ],
+          "serve": "large-print",
+          "percentage": null
+        }
+      ]
+    },
+    "support_prompt": {
+      "default": false,
+      "rules": [
+        {
+          "id": "non-guest",
+          "conditions": [
+            {
+              "attribute": "tier",
+              "op": "not_eq",
+              "value": "guest"
+            }
+          ],
+          "serve": true,
+          "percentage": null
+        }
+      ]
+    }
+  }
+}
\ No newline at end of file
diff --git a/developer-simulation/runs/2026-08-01--offline-flag-parity/fixtures/malformed/01-syntax.json b/developer-simulation/runs/2026-08-01--offline-flag-parity/fixtures/malformed/01-syntax.json
new file mode 100644
index 0000000..b10d2a0
--- /dev/null
+++ b/developer-simulation/runs/2026-08-01--offline-flag-parity/fixtures/malformed/01-syntax.json
@@ -0,0 +1 @@
+{not-json
\ No newline at end of file
diff --git a/developer-simulation/runs/2026-08-01--offline-flag-parity/fixtures/malformed/02-unknown-field.json b/developer-simulation/runs/2026-08-01--offline-flag-parity/fixtures/malformed/02-unknown-field.json
new file mode 100644
index 0000000..bfac84f
--- /dev/null
+++ b/developer-simulation/runs/2026-08-01--offline-flag-parity/fixtures/malformed/02-unknown-field.json
@@ -0,0 +1 @@
+{"schema_version":1,"config_id":"x","salt":"s","extra":true,"flags":{"f":{"default":false,"rules":[]}}}
\ No newline at end of file
diff --git a/developer-simulation/runs/2026-08-01--offline-flag-parity/fixtures/malformed/03-wrong-schema.json b/developer-simulation/runs/2026-08-01--offline-flag-parity/fixtures/malformed/03-wrong-schema.json
new file mode 100644
index 0000000..59db84e
--- /dev/null
+++ b/developer-simulation/runs/2026-08-01--offline-flag-parity/fixtures/malformed/03-wrong-schema.json
@@ -0,0 +1 @@
+{"schema_version":2,"config_id":"x","salt":"s","flags":{"f":{"default":false,"rules":[]}}}
\ No newline at end of file
diff --git a/developer-simulation/runs/2026-08-01--offline-flag-parity/fixtures/malformed/04-empty-id.json b/developer-simulation/runs/2026-08-01--offline-flag-parity/fixtures/malformed/04-empty-id.json
new file mode 100644
index 0000000..bb6a31c
--- /dev/null
+++ b/developer-simulation/runs/2026-08-01--offline-flag-parity/fixtures/malformed/04-empty-id.json
@@ -0,0 +1 @@
+{"schema_version":1,"config_id":"","salt":"s","flags":{"f":{"default":false,"rules":[]}}}
\ No newline at end of file
diff --git a/developer-simulation/runs/2026-08-01--offline-flag-parity/fixtures/malformed/05-empty-salt.json b/developer-simulation/runs/2026-08-01--offline-flag-parity/fixtures/malformed/05-empty-salt.json
new file mode 100644
index 0000000..d444f56
--- /dev/null
+++ b/developer-simulation/runs/2026-08-01--offline-flag-parity/fixtures/malformed/05-empty-salt.json
@@ -0,0 +1 @@
+{"schema_version":1,"config_id":"x","salt":"","flags":{"f":{"default":false,"rules":[]}}}
\ No newline at end of file
diff --git a/developer-simulation/runs/2026-08-01--offline-flag-parity/fixtures/malformed/06-duplicate-flag-key.json b/developer-simulation/runs/2026-08-01--offline-flag-parity/fixtures/malformed/06-duplicate-flag-key.json
new file mode 100644
index 0000000..525306b
--- /dev/null
+++ b/developer-simulation/runs/2026-08-01--offline-flag-parity/fixtures/malformed/06-duplicate-flag-key.json
@@ -0,0 +1 @@
+{"schema_version":1,"config_id":"x","salt":"s","flags":{"f":{"default":false,"rules":[]},"f":{"default":true,"rules":[]}}}
\ No newline at end of file
diff --git a/developer-simulation/runs/2026-08-01--offline-flag-parity/fixtures/malformed/07-duplicate-rule-id.json b/developer-simulation/runs/2026-08-01--offline-flag-parity/fixtures/malformed/07-duplicate-rule-id.json
new file mode 100644
index 0000000..321eb60
--- /dev/null
+++ b/developer-simulation/runs/2026-08-01--offline-flag-parity/fixtures/malformed/07-duplicate-rule-id.json
@@ -0,0 +1 @@
+{"schema_version":1,"config_id":"x","salt":"s","flags":{"f":{"default":false,"rules":[{"id":"r","conditions":[{"attribute":"x","op":"eq","value":true}],"serve":true},{"id":"r","conditions":[{"attribute":"x","op":"eq","value":false}],"serve":false}]}}}
\ No newline at end of file
diff --git a/developer-simulation/runs/2026-08-01--offline-flag-parity/fixtures/malformed/08-empty-rule.json b/developer-simulation/runs/2026-08-01--offline-flag-parity/fixtures/malformed/08-empty-rule.json
new file mode 100644
index 0000000..c7cded6
--- /dev/null
+++ b/developer-simulation/runs/2026-08-01--offline-flag-parity/fixtures/malformed/08-empty-rule.json
@@ -0,0 +1 @@
+{"schema_version":1,"config_id":"x","salt":"s","flags":{"f":{"default":false,"rules":[{"id":"r","conditions":[],"serve":true}]}}}
\ No newline at end of file
diff --git a/developer-simulation/runs/2026-08-01--offline-flag-parity/fixtures/malformed/09-invalid-percentage.json b/developer-simulation/runs/2026-08-01--offline-flag-parity/fixtures/malformed/09-invalid-percentage.json
new file mode 100644
index 0000000..85c4ff7
--- /dev/null
+++ b/developer-simulation/runs/2026-08-01--offline-flag-parity/fixtures/malformed/09-invalid-percentage.json
@@ -0,0 +1 @@
+{"schema_version":1,"config_id":"x","salt":"s","flags":{"f":{"default":false,"rules":[{"id":"r","conditions":[],"serve":true,"percentage":{"attribute":"user_id","basis_points":10001}}]}}}
\ No newline at end of file
diff --git a/developer-simulation/runs/2026-08-01--offline-flag-parity/fixtures/malformed/10-invalid-operator-type.json b/developer-simulation/runs/2026-08-01--offline-flag-parity/fixtures/malformed/10-invalid-operator-type.json
new file mode 100644
index 0000000..0fd9260
--- /dev/null
+++ b/developer-simulation/runs/2026-08-01--offline-flag-parity/fixtures/malformed/10-invalid-operator-type.json
@@ -0,0 +1 @@
+{"schema_version":1,"config_id":"x","salt":"s","flags":{"f":{"default":false,"rules":[{"id":"r","conditions":[{"attribute":"age","op":"greater_than","value":"old"}],"serve":true}]}}}
\ No newline at end of file
diff --git a/developer-simulation/runs/2026-08-01--offline-flag-parity/fixtures/malformed/11-null-scalar.json b/developer-simulation/runs/2026-08-01--offline-flag-parity/fixtures/malformed/11-null-scalar.json
new file mode 100644
index 0000000..e61d138
--- /dev/null
+++ b/developer-simulation/runs/2026-08-01--offline-flag-parity/fixtures/malformed/11-null-scalar.json
@@ -0,0 +1 @@
+{"schema_version":1,"config_id":"x","salt":"s","flags":{"f":{"default":null,"rules":[]}}}
\ No newline at end of file
diff --git a/developer-simulation/runs/2026-08-01--offline-flag-parity/fixtures/malformed/12-missing-flags.json b/developer-simulation/runs/2026-08-01--offline-flag-parity/fixtures/malformed/12-missing-flags.json
new file mode 100644
index 0000000..3fef90b
--- /dev/null
+++ b/developer-simulation/runs/2026-08-01--offline-flag-parity/fixtures/malformed/12-missing-flags.json
@@ -0,0 +1 @@
+{"schema_version":1,"config_id":"x","salt":"s"}
\ No newline at end of file
diff --git a/developer-simulation/runs/2026-08-01--offline-flag-parity/fixtures/snapshot-reordered.json b/developer-simulation/runs/2026-08-01--offline-flag-parity/fixtures/snapshot-reordered.json
new file mode 100644
index 0000000..99d9e37
--- /dev/null
+++ b/developer-simulation/runs/2026-08-01--offline-flag-parity/fixtures/snapshot-reordered.json
@@ -0,0 +1 @@
+{"schema_version":1,"salt":"retail-kiosk-v1","flags":{"support_prompt":{"rules":[{"serve":true,"percentage":null,"id":"non-guest","conditions":[{"value":"guest","op":"not_eq","attribute":"tier"}]}],"default":false},"receipt_style":{"rules":[{"serve":"large-print","percentage":null,"id":"accessible-store","conditions":[{"value":true,"op":"eq","attribute":"accessibility_mode"}]}],"default":"compact"},"max_cart_items":{"rules":[{"serve":50.0,"percentage":null,"id":"large-store","conditions":[{"value":20000.0,"op":"greater_than","attribute":"store_size"}]}],"default":30.0},"checkout_redesign":{"rules":[{"serve":true,"percentage":null,"id":"employees-first","conditions":[{"value":"employee","op":"eq","attribute":"tier"}]},{"serve":true,"percentage":{"basis_points":3500,"attribute":"user_id"},"id":"kiosk-rollout","conditions":[{"value":true,"op":"eq","attribute":"kiosk"}]}],"default":false}},"config_id":"demo-v1"}
diff --git a/developer-simulation/runs/2026-08-01--offline-flag-parity/fixtures/snapshot.json b/developer-simulation/runs/2026-08-01--offline-flag-parity/fixtures/snapshot.json
new file mode 100644
index 0000000..e9655ee
--- /dev/null
+++ b/developer-simulation/runs/2026-08-01--offline-flag-parity/fixtures/snapshot.json
@@ -0,0 +1,90 @@
+{
+  "schema_version": 1,
+  "config_id": "demo-v1",
+  "salt": "retail-kiosk-v1",
+  "flags": {
+    "checkout_redesign": {
+      "default": false,
+      "rules": [
+        {
+          "id": "employees-first",
+          "conditions": [
+            {
+              "attribute": "tier",
+              "op": "eq",
+              "value": "employee"
+            }
+          ],
+          "serve": true,
+          "percentage": null
+        },
+        {
+          "id": "kiosk-rollout",
+          "conditions": [
+            {
+              "attribute": "kiosk",
+              "op": "eq",
+              "value": true
+            }
+          ],
+          "serve": true,
+          "percentage": {
+            "attribute": "user_id",
+            "basis_points": 3500
+          }
+        }
+      ]
+    },
+    "max_cart_items": {
+      "default": 30.0,
+      "rules": [
+        {
+          "id": "large-store",
+          "conditions": [
+            {
+              "attribute": "store_size",
+              "op": "greater_than",
+              "value": 20000.0
+            }
+          ],
+          "serve": 50.0,
+          "percentage": null
+        }
+      ]
+    },
+    "receipt_style": {
+      "default": "compact",
+      "rules": [
+        {
+          "id": "accessible-store",
+          "conditions": [
+            {
+              "attribute": "accessibility_mode",
+              "op": "eq",
+              "value": true
+            }
+          ],
+          "serve": "large-print",
+          "percentage": null
+        }
+      ]
+    },
+    "support_prompt": {
+      "default": false,
+      "rules": [
+        {
+          "id": "non-guest",
+          "conditions": [
+            {
+              "attribute": "tier",
+              "op": "not_eq",
+              "value": "guest"
+            }
+          ],
+          "serve": true,
+          "percentage": null
+        }
+      ]
+    }
+  }
+}
\ No newline at end of file
diff --git a/developer-simulation/runs/2026-08-01--offline-flag-parity/src/lib.rs b/developer-simulation/runs/2026-08-01--offline-flag-parity/src/lib.rs
new file mode 100644
index 0000000..852bbe8
--- /dev/null
+++ b/developer-simulation/runs/2026-08-01--offline-flag-parity/src/lib.rs
@@ -0,0 +1,623 @@
+use std::collections::{BTreeMap, BTreeSet};
+use std::fmt;
+use std::fs::File;
+use std::io::Read;
+use std::path::Path;
+use std::sync::Arc;
+
+use serde::de::{self, MapAccess, SeqAccess, Visitor};
+use serde::{Deserialize, Deserializer, Serialize};
+
+pub const MAX_SNAPSHOT_BYTES: usize = 8 * 1024 * 1024;
+pub const MAX_FLAGS: usize = 5_000;
+pub const MAX_RULES: usize = 50_000;
+
+#[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
+#[serde(untagged)]
+pub enum Scalar {
+    Bool(bool),
+    Number(f64),
+    String(String),
+}
+
+impl fmt::Display for Scalar {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        match self {
+            Self::Bool(value) => write!(f, "{value}"),
+            Self::Number(value) => write!(f, "{value}"),
+            Self::String(value) => write!(f, "{value:?}"),
+        }
+    }
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct Snapshot {
+    pub schema_version: u32,
+    pub config_id: String,
+    pub salt: String,
+    pub flags: BTreeMap<String, Flag>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct Flag {
+    pub default: Scalar,
+    pub rules: Vec<Rule>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct Rule {
+    pub id: String,
+    #[serde(default)]
+    pub conditions: Vec<Condition>,
+    pub serve: Scalar,
+    #[serde(default)]
+    pub percentage: Option<Percentage>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct Condition {
+    pub attribute: String,
+    pub op: Operator,
+    pub value: Scalar,
+}
+
+#[derive(Debug, Clone, Copy, Serialize, Deserialize)]
+#[serde(rename_all = "snake_case")]
+pub enum Operator {
+    Eq,
+    NotEq,
+    GreaterThan,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct Percentage {
+    pub attribute: String,
+    pub basis_points: u16,
+}
+
+pub type Context = BTreeMap<String, Scalar>;
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct EvaluationInput {
+    pub case_id: String,
+    pub flag: String,
+    pub context: Context,
+}
+
+#[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
+pub struct RuleTrace {
+    pub rule_id: String,
+    pub matched: bool,
+    pub reason: String,
+}
+
+#[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
+pub struct Decision {
+    pub flag: String,
+    pub value: Scalar,
+    pub source: String,
+    pub explanation: Vec<RuleTrace>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct GoldenCase {
+    pub input: EvaluationInput,
+    pub expected: Decision,
+}
+
+#[derive(Debug, Clone)]
+pub struct LoadError(String);
+
+impl LoadError {
+    fn new(message: impl Into<String>) -> Self {
+        Self(message.into())
+    }
+}
+
+impl fmt::Display for LoadError {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.write_str(&self.0)
+    }
+}
+
+impl std::error::Error for LoadError {}
+
+pub fn load_snapshot_file(path: impl AsRef<Path>) -> Result<Snapshot, LoadError> {
+    let path = path.as_ref();
+    let bytes = read_snapshot_file_bounded(path)?;
+    load_snapshot_bytes(&bytes)
+}
+
+fn read_snapshot_file_bounded(path: &Path) -> Result<Vec<u8>, LoadError> {
+    let file = File::open(path)
+        .map_err(|error| LoadError::new(format!("open {}: {error}", path.display())))?;
+    let limit = u64::try_from(MAX_SNAPSHOT_BYTES)
+        .expect("snapshot byte limit fits u64")
+        .saturating_add(1);
+    let mut bytes = Vec::new();
+    file.take(limit)
+        .read_to_end(&mut bytes)
+        .map_err(|error| LoadError::new(format!("read {}: {error}", path.display())))?;
+    if bytes.len() > MAX_SNAPSHOT_BYTES {
+        return Err(LoadError::new(format!(
+            "snapshot exceeds {MAX_SNAPSHOT_BYTES} byte file-read limit"
+        )));
+    }
+    Ok(bytes)
+}
+
+pub fn load_snapshot_bytes(bytes: &[u8]) -> Result<Snapshot, LoadError> {
+    if bytes.len() > MAX_SNAPSHOT_BYTES {
+        return Err(LoadError::new(format!(
+            "snapshot is {} bytes; limit is {MAX_SNAPSHOT_BYTES}",
+            bytes.len()
+        )));
+    }
+
+    let mut duplicate_check = serde_json::Deserializer::from_slice(bytes);
+    UniqueJson::deserialize(&mut duplicate_check)
+        .map_err(|error| LoadError::new(format!("invalid JSON: {error}")))?;
+    duplicate_check
+        .end()
+        .map_err(|error| LoadError::new(format!("invalid JSON: {error}")))?;
+    let snapshot: Snapshot = serde_json::from_slice(bytes)
+        .map_err(|error| LoadError::new(format!("invalid snapshot shape: {error}")))?;
+    validate_snapshot(&snapshot)?;
+    Ok(snapshot)
+}
+
+pub fn validate_snapshot(snapshot: &Snapshot) -> Result<(), LoadError> {
+    if snapshot.schema_version != 1 {
+        return Err(LoadError::new("schema_version must be 1"));
+    }
+    if snapshot.config_id.trim().is_empty() {
+        return Err(LoadError::new("config_id must not be empty"));
+    }
+    if snapshot.salt.is_empty() {
+        return Err(LoadError::new("salt must not be empty"));
+    }
+    if snapshot.flags.is_empty() || snapshot.flags.len() > MAX_FLAGS {
+        return Err(LoadError::new(format!(
+            "flag count must be between 1 and {MAX_FLAGS}"
+        )));
+    }
+
+    let mut rule_count = 0usize;
+    for (flag_key, flag) in &snapshot.flags {
+        if flag_key.trim().is_empty() {
+            return Err(LoadError::new("flag keys must not be empty"));
+        }
+        rule_count = rule_count
+            .checked_add(flag.rules.len())
+            .ok_or_else(|| LoadError::new("rule count overflow"))?;
+        if rule_count > MAX_RULES {
+            return Err(LoadError::new(format!("rule count exceeds {MAX_RULES}")));
+        }
+
+        let mut ids = BTreeSet::new();
+        for rule in &flag.rules {
+            if rule.id.trim().is_empty() {
+                return Err(LoadError::new(format!(
+                    "flag {flag_key:?} has an empty rule id"
+                )));
+            }
+            if !ids.insert(rule.id.as_str()) {
+                return Err(LoadError::new(format!(
+                    "flag {flag_key:?} has duplicate rule id {:?}",
+                    rule.id
+                )));
+            }
+            if rule.conditions.is_empty() && rule.percentage.is_none() {
+                return Err(LoadError::new(format!(
+                    "rule {:?} must have a condition or percentage",
+                    rule.id
+                )));
+            }
+            for condition in &rule.conditions {
+                if condition.attribute.trim().is_empty() {
+                    return Err(LoadError::new(format!(
+                        "rule {:?} has an empty condition attribute",
+                        rule.id
+                    )));
+                }
+                if matches!(condition.op, Operator::GreaterThan)
+                    && !matches!(condition.value, Scalar::Number(_))
+                {
+                    return Err(LoadError::new(format!(
+                        "rule {:?} greater_than requires a numeric comparison value",
+                        rule.id
+                    )));
+                }
+            }
+            if let Some(percentage) = &rule.percentage {
+                if percentage.attribute.trim().is_empty() {
+                    return Err(LoadError::new(format!(
+                        "rule {:?} has an empty percentage attribute",
+                        rule.id
+                    )));
+                }
+                if percentage.basis_points > 10_000 {
+                    return Err(LoadError::new(format!(
+                        "rule {:?} percentage exceeds 10000 basis points",
+                        rule.id
+                    )));
+                }
+            }
+        }
+    }
+    Ok(())
+}
+
+#[derive(Debug, Clone)]
+pub struct Evaluator {
+    active: Arc<Snapshot>,
+}
+
+impl Evaluator {
+    pub fn new(snapshot: Snapshot) -> Self {
+        Self {
+            active: Arc::new(snapshot),
+        }
+    }
+
+    pub fn config_id(&self) -> &str {
+        &self.active.config_id
+    }
+
+    pub fn flag_keys(&self) -> impl Iterator<Item = &str> {
+        self.active.flags.keys().map(String::as_str)
+    }
+
+    pub fn evaluate(&self, flag_key: &str, context: &Context) -> Result<Decision, String> {
+        evaluate_snapshot(&self.active, flag_key, context)
+    }
+
+    pub fn reload_bytes(&mut self, bytes: &[u8]) -> Result<(), LoadError> {
+        let candidate = load_snapshot_bytes(bytes)?;
+        self.active = Arc::new(candidate);
+        Ok(())
+    }
+
+    pub fn reload_file(&mut self, path: impl AsRef<Path>) -> Result<(), LoadError> {
+        let path = path.as_ref();
+        let bytes = read_snapshot_file_bounded(path)?;
+        self.reload_bytes(&bytes)
+    }
+}
+
+pub fn evaluate_snapshot(
+    snapshot: &Snapshot,
+    flag_key: &str,
+    context: &Context,
+) -> Result<Decision, String> {
+    let flag = snapshot
+        .flags
+        .get(flag_key)
+        .ok_or_else(|| format!("unknown flag {flag_key:?}"))?;
+    let mut explanation = Vec::with_capacity(flag.rules.len() + 1);
+
+    for rule in &flag.rules {
+        let mut failed = None;
+        for condition in &rule.conditions {
+            match context.get(&condition.attribute) {
+                None => {
+                    failed = Some(format!("missing attribute {:?}", condition.attribute));
+                    break;
+                }
+                Some(actual) if !condition_matches(actual, condition) => {
+                    failed = Some(format!(
+                        "attribute {:?} was {actual}; condition did not match",
+                        condition.attribute
+                    ));
+                    break;
+                }
+                Some(_) => {}
+            }
+        }
+
+        if let Some(reason) = failed {
+            explanation.push(RuleTrace {
+                rule_id: rule.id.clone(),
+                matched: false,
+                reason,
+            });
+            continue;
+        }
+
+        if let Some(percentage) = &rule.percentage {
+            let Some(bucket_value) = context.get(&percentage.attribute) else {
+                explanation.push(RuleTrace {
+                    rule_id: rule.id.clone(),
+                    matched: false,
+                    reason: format!("missing percentage attribute {:?}", percentage.attribute),
+                });
+                continue;
+            };
+            let bucket_key = scalar_bucket_key(bucket_value);
+            let bucket = stable_bucket(&snapshot.salt, flag_key, &rule.id, bucket_key.as_bytes());
+            if bucket >= percentage.basis_points {
+                explanation.push(RuleTrace {
+                    rule_id: rule.id.clone(),
+                    matched: false,
+                    reason: format!(
+                        "stable bucket {bucket} was outside 0..{}",
+                        percentage.basis_points
+                    ),
+                });
+                continue;
+            }
+            explanation.push(RuleTrace {
+                rule_id: rule.id.clone(),
+                matched: true,
+                reason: format!(
+                    "conditions matched; stable bucket {bucket} was inside 0..{}",
+                    percentage.basis_points
+                ),
+            });
+        } else {
+            explanation.push(RuleTrace {
+                rule_id: rule.id.clone(),
+                matched: true,
+                reason: "all conditions matched".to_string(),
+            });
+        }
+
+        return Ok(Decision {
+            flag: flag_key.to_string(),
+            value: rule.serve.clone(),
+            source: rule.id.clone(),
+            explanation,
+        });
+    }
+
+    explanation.push(RuleTrace {
+        rule_id: "default".to_string(),
+        matched: true,
+        reason: "no targeting rule matched".to_string(),
+    });
+    Ok(Decision {
+        flag: flag_key.to_string(),
+        value: flag.default.clone(),
+        source: "default".to_string(),
+        explanation,
+    })
+}
+
+fn condition_matches(actual: &Scalar, condition: &Condition) -> bool {
+    match condition.op {
+        Operator::Eq => actual == &condition.value,
+        Operator::NotEq => actual != &condition.value,
+        Operator::GreaterThan => match (actual, &condition.value) {
+            (Scalar::Number(actual), Scalar::Number(expected)) => actual > expected,
+            _ => false,
+        },
+    }
+}
+
+fn scalar_bucket_key(value: &Scalar) -> String {
+    match value {
+        Scalar::Bool(value) => format!("b:{value}"),
+        Scalar::Number(value) => format!("n:{value}"),
+        Scalar::String(value) => format!("s:{value}"),
+    }
+}
+
+pub fn stable_bucket(salt: &str, flag: &str, rule: &str, attribute: &[u8]) -> u16 {
+    let mut hash = 0xcbf29ce484222325u64;
+    for part in [salt.as_bytes(), flag.as_bytes(), rule.as_bytes(), attribute] {
+        for byte in part {
+            hash ^= u64::from(*byte);
+            hash = hash.wrapping_mul(0x100000001b3);
+        }
+        hash ^= 0;
+        hash = hash.wrapping_mul(0x100000001b3);
+    }
+    (hash % 10_000) as u16
+}
+
+/// Rough retained heap estimate for the active parsed snapshot. This excludes
+/// allocator bookkeeping and process/runtime overhead; use OS peak RSS as the
+/// acceptance measurement.
+pub fn estimated_snapshot_heap(snapshot: &Snapshot) -> usize {
+    let mut bytes =
+        std::mem::size_of::<Snapshot>() + snapshot.config_id.capacity() + snapshot.salt.capacity();
+    for (flag_key, flag) in &snapshot.flags {
+        bytes += std::mem::size_of::<String>() + flag_key.capacity();
+        bytes += std::mem::size_of::<Flag>() + scalar_heap(&flag.default);
+        bytes += flag.rules.capacity() * std::mem::size_of::<Rule>();
+        for rule in &flag.rules {
+            bytes += rule.id.capacity() + scalar_heap(&rule.serve);
+            bytes += rule.conditions.capacity() * std::mem::size_of::<Condition>();
+            for condition in &rule.conditions {
+                bytes += condition.attribute.capacity() + scalar_heap(&condition.value);
+            }
+            if let Some(percentage) = &rule.percentage {
+                bytes += percentage.attribute.capacity();
+            }
+        }
+    }
+    bytes
+}
+
+fn scalar_heap(value: &Scalar) -> usize {
+    match value {
+        Scalar::String(value) => value.capacity(),
+        Scalar::Bool(_) | Scalar::Number(_) => 0,
+    }
+}
+
+struct UniqueJson;
+
+impl<'de> Deserialize<'de> for UniqueJson {
+    fn deserialize<D>(deserializer: D) -> Result<Self, D::Error>
+    where
+        D: Deserializer<'de>,
+    {
+        deserializer.deserialize_any(UniqueJsonVisitor)
+    }
+}
+
+struct UniqueJsonVisitor;
+
+impl<'de> Visitor<'de> for UniqueJsonVisitor {
+    type Value = UniqueJson;
+
+    fn expecting(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        formatter.write_str("a JSON value without duplicate object keys")
+    }
+
+    fn visit_bool<E>(self, value: bool) -> Result<Self::Value, E> {
+        let _ = value;
+        Ok(UniqueJson)
+    }
+
+    fn visit_i64<E>(self, value: i64) -> Result<Self::Value, E> {
+        let _ = value;
+        Ok(UniqueJson)
+    }
+
+    fn visit_u64<E>(self, value: u64) -> Result<Self::Value, E> {
+        let _ = value;
+        Ok(UniqueJson)
+    }
+
+    fn visit_f64<E>(self, value: f64) -> Result<Self::Value, E>
+    where
+        E: de::Error,
+    {
+        if value.is_finite() {
+            Ok(UniqueJson)
+        } else {
+            Err(E::custom("non-finite JSON number"))
+        }
+    }
+
+    fn visit_str<E>(self, value: &str) -> Result<Self::Value, E>
+    where
+        E: de::Error,
+    {
+        let _ = value;
+        Ok(UniqueJson)
+    }
+
+    fn visit_string<E>(self, value: String) -> Result<Self::Value, E> {
+        let _ = value;
+        Ok(UniqueJson)
+    }
+
+    fn visit_none<E>(self) -> Result<Self::Value, E> {
+        Ok(UniqueJson)
+    }
+
+    fn visit_unit<E>(self) -> Result<Self::Value, E> {
+        Ok(UniqueJson)
+    }
+
+    fn visit_seq<A>(self, mut sequence: A) -> Result<Self::Value, A::Error>
+    where
+        A: SeqAccess<'de>,
+    {
+        while sequence.next_element::<UniqueJson>()?.is_some() {}
+        Ok(UniqueJson)
+    }
+
+    fn visit_map<A>(self, mut object: A) -> Result<Self::Value, A::Error>
+    where
+        A: MapAccess<'de>,
+    {
+        let mut keys = BTreeSet::new();
+        while let Some(key) = object.next_key::<String>()? {
+            if !keys.insert(key.clone()) {
+                return Err(de::Error::custom(format!(
+                    "duplicate JSON object key {key:?}"
+                )));
+            }
+            object.next_value::<UniqueJson>()?;
+        }
+        Ok(UniqueJson)
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn duplicate_json_keys_are_rejected() {
+        let bytes = br#"{
+            "schema_version":1,
+            "config_id":"a",
+            "salt":"s",
+            "flags":{},
+            "flags":{}
+        }"#;
+        let error = load_snapshot_bytes(bytes).unwrap_err().to_string();
+        assert!(error.contains("duplicate JSON object key \"flags\""));
+    }
+
+    #[test]
+    fn failed_reload_keeps_active_snapshot() {
+        let snapshot = one_flag_snapshot();
+        let mut evaluator = Evaluator::new(snapshot);
+        let before = evaluator.evaluate("checkout", &Context::new()).unwrap();
+        assert!(evaluator.reload_bytes(b"not json").is_err());
+        assert_eq!(evaluator.config_id(), "one");
+        assert_eq!(
+            evaluator.evaluate("checkout", &Context::new()).unwrap(),
+            before
+        );
+    }
+
+    #[test]
+    fn bucket_has_a_fixed_known_value() {
+        assert_eq!(stable_bucket("salt", "flag", "rule", b"user-42"), 7_307);
+    }
+
+    #[test]
+    fn file_reader_stops_at_the_snapshot_limit() {
+        use std::io::{Seek, SeekFrom, Write};
+        use std::time::{SystemTime, UNIX_EPOCH};
+
+        let nonce = SystemTime::now()
+            .duration_since(UNIX_EPOCH)
+            .expect("clock after epoch")
+            .as_nanos();
+        let path = std::env::temp_dir().join(format!(
+            "offline-flag-parity-oversized-{}-{nonce}.json",
+            std::process::id()
+        ));
+        let mut file = File::create(&path).expect("create sparse oversized fixture");
+        file.seek(SeekFrom::Start(MAX_SNAPSHOT_BYTES as u64))
+            .expect("seek to byte after limit");
+        file.write_all(b"x").expect("finish sparse fixture");
+        drop(file);
+
+        let error = load_snapshot_file(&path)
+            .expect_err("oversized file must fail")
+            .to_string();
+        std::fs::remove_file(&path).expect("remove sparse fixture");
+        assert!(error.contains("file-read limit"), "{error}");
+    }
+
+    fn one_flag_snapshot() -> Snapshot {
+        Snapshot {
+            schema_version: 1,
+            config_id: "one".to_string(),
+            salt: "salt".to_string(),
+            flags: BTreeMap::from([(
+                "checkout".to_string(),
+                Flag {
+                    default: Scalar::Bool(false),
+                    rules: Vec::new(),
+                },
+            )]),
+        }
+    }
+}
diff --git a/developer-simulation/runs/2026-08-01--offline-flag-parity/src/main.rs b/developer-simulation/runs/2026-08-01--offline-flag-parity/src/main.rs
new file mode 100644
index 0000000..a548874
--- /dev/null
+++ b/developer-simulation/runs/2026-08-01--offline-flag-parity/src/main.rs
@@ -0,0 +1,624 @@
+use std::collections::BTreeMap;
+use std::env;
+use std::fs::{self, File};
+use std::hint::black_box;
+use std::io::{BufRead, BufReader, BufWriter, Write};
+use std::path::{Path, PathBuf};
+use std::process::Command;
+use std::sync::Arc;
+use std::sync::atomic::{AtomicBool, AtomicU64, Ordering};
+use std::thread;
+use std::time::{Duration, Instant};
+
+use offline_flag_parity::{
+    Condition, Context, EvaluationInput, Evaluator, Flag, GoldenCase, Operator, Percentage, Rule,
+    Scalar, Snapshot, estimated_snapshot_heap, evaluate_snapshot, load_snapshot_file,
+};
+use serde::Serialize;
+use serde_json::Value;
+
+type CliResult<T = ()> = Result<T, Box<dyn std::error::Error>>;
+
+fn main() {
+    if let Err(error) = run() {
+        eprintln!("error: {error}");
+        std::process::exit(1);
+    }
+}
+
+fn run() -> CliResult {
+    let mut args = env::args().skip(1);
+    match args.next().as_deref() {
+        Some("generate") => generate(Path::new(&required_arg(&mut args, "output directory")?)),
+        Some("verify") => verify(Path::new(&required_arg(&mut args, "fixture directory")?)),
+        Some("demo") => demo(Path::new(&required_arg(&mut args, "fixture directory")?)),
+        Some("eval") => evaluate_ndjson(
+            Path::new(&required_arg(&mut args, "snapshot path")?),
+            Path::new(&required_arg(&mut args, "NDJSON context path")?),
+        ),
+        Some("fingerprint") => {
+            fingerprint(Path::new(&required_arg(&mut args, "fixture directory")?))
+        }
+        Some("generate-benchmark") => {
+            generate_benchmark(Path::new(&required_arg(&mut args, "snapshot path")?))
+        }
+        Some("bench") => benchmark(Path::new(&required_arg(
+            &mut args,
+            "generated benchmark snapshot path",
+        )?)),
+        _ => {
+            eprintln!(
+                "usage: offline-flag-parity <generate DIR|verify DIR|demo DIR|eval SNAPSHOT NDJSON|fingerprint DIR|generate-benchmark SNAPSHOT|bench SNAPSHOT>"
+            );
+            std::process::exit(2);
+        }
+    }
+}
+
+fn required_arg(args: &mut impl Iterator<Item = String>, name: &str) -> CliResult<String> {
+    args.next().ok_or_else(|| format!("missing {name}").into())
+}
+
+fn generate(directory: &Path) -> CliResult {
+    fs::create_dir_all(directory)?;
+    let malformed = directory.join("malformed");
+    fs::create_dir_all(&malformed)?;
+
+    let snapshot = demo_snapshot("demo-v1", false);
+    write_json(directory.join("snapshot.json"), &snapshot)?;
+    write_reordered_json(directory.join("snapshot-reordered.json"), &snapshot)?;
+    write_json(
+        directory.join("good-reload.json"),
+        &demo_snapshot("demo-v2", true),
+    )?;
+    fs::write(
+        directory.join("bad-reload.json"),
+        br#"{"schema_version":1,"config_id":"bad","salt":"retail-kiosk-v1","flags":{"checkout_redesign":{"default":false,"rules":[{"id":"bad-rollout","conditions":[],"serve":true,"percentage":{"attribute":"user_id","basis_points":10001}}]}}}"#,
+    )?;
+
+    let evaluator = Evaluator::new(snapshot);
+    let context_file = File::create(directory.join("contexts.ndjson"))?;
+    let golden_file = File::create(directory.join("golden.json"))?;
+    let mut contexts = BufWriter::new(context_file);
+    let mut golden = Vec::with_capacity(250);
+    for index in 0..250 {
+        let input = golden_input(index);
+        serde_json::to_writer(&mut contexts, &input)?;
+        contexts.write_all(b"\n")?;
+        let expected = evaluator.evaluate(&input.flag, &input.context)?;
+        golden.push(GoldenCase { input, expected });
+    }
+    contexts.flush()?;
+    serde_json::to_writer_pretty(BufWriter::new(golden_file), &golden)?;
+
+    let malformed_cases = malformed_cases();
+    for (name, contents) in &malformed_cases {
+        fs::write(malformed.join(name), contents)?;
+    }
+
+    println!(
+        "generated snapshot, reordered snapshot, 250 NDJSON contexts/golden cases, reload fixtures, and {} malformed snapshots in {}",
+        malformed_cases.len(),
+        directory.display()
+    );
+    Ok(())
+}
+
+fn verify(directory: &Path) -> CliResult {
+    let snapshot = load_snapshot_file(directory.join("snapshot.json"))?;
+    let reordered = load_snapshot_file(directory.join("snapshot-reordered.json"))?;
+    let golden: Vec<GoldenCase> =
+        serde_json::from_reader(File::open(directory.join("golden.json"))?)?;
+    if golden.len() != 250 {
+        return Err(format!("expected 250 golden cases, found {}", golden.len()).into());
+    }
+
+    for case in &golden {
+        let actual = evaluate_snapshot(&snapshot, &case.input.flag, &case.input.context)?;
+        if actual != case.expected {
+            return Err(format!("golden mismatch for {}", case.input.case_id).into());
+        }
+        let reordered_actual =
+            evaluate_snapshot(&reordered, &case.input.flag, &case.input.context)?;
+        if reordered_actual != actual {
+            return Err(format!("object-order mismatch for {}", case.input.case_id).into());
+        }
+    }
+
+    let malformed_directory = directory.join("malformed");
+    let mut malformed_paths: Vec<_> = fs::read_dir(&malformed_directory)?
+        .map(|entry| entry.map(|entry| entry.path()))
+        .collect::<Result<_, _>>()?;
+    malformed_paths.sort();
+    for path in &malformed_paths {
+        if load_snapshot_file(path).is_ok() {
+            return Err(format!("malformed fixture activated: {}", path.display()).into());
+        }
+    }
+
+    let mut evaluator = Evaluator::new(snapshot);
+    let before = evaluator.evaluate("checkout_redesign", &golden[0].input.context)?;
+    evaluator.reload_file(directory.join("good-reload.json"))?;
+    let after_good = evaluator.evaluate("checkout_redesign", &golden[0].input.context)?;
+    if evaluator.config_id() != "demo-v2" {
+        return Err("good reload did not activate demo-v2".into());
+    }
+    let rejected = evaluator.reload_file(directory.join("bad-reload.json"));
+    if rejected.is_ok() || evaluator.config_id() != "demo-v2" {
+        return Err("bad reload did not preserve demo-v2".into());
+    }
+    let after_bad = evaluator.evaluate("checkout_redesign", &golden[0].input.context)?;
+    if after_bad != after_good {
+        return Err("bad reload partially changed active decisions".into());
+    }
+
+    println!(
+        "verified {} golden cases; object ordering invariant; {} malformed snapshots rejected; good reload {} -> {}; bad reload preserved {}",
+        golden.len(),
+        malformed_paths.len(),
+        before.value,
+        after_good.value,
+        after_bad.value
+    );
+    Ok(())
+}
+
+fn demo(directory: &Path) -> CliResult {
+    let snapshot = load_snapshot_file(directory.join("snapshot.json"))?;
+    let mut evaluator = Evaluator::new(snapshot);
+    let inputs = read_inputs(&directory.join("contexts.ndjson"))?;
+
+    println!("active config: {}", evaluator.config_id());
+    for input in inputs.iter().take(4) {
+        let decision = evaluator.evaluate(&input.flag, &input.context)?;
+        println!("{}", serde_json::to_string(&decision)?);
+    }
+
+    evaluator.reload_file(directory.join("good-reload.json"))?;
+    let after_good = evaluator.evaluate("checkout_redesign", &inputs[0].context)?;
+    println!(
+        "good reload activated config {}: {}",
+        evaluator.config_id(),
+        serde_json::to_string(&after_good)?
+    );
+
+    let error = evaluator
+        .reload_file(directory.join("bad-reload.json"))
+        .expect_err("bad reload should fail");
+    let after_bad = evaluator.evaluate("checkout_redesign", &inputs[0].context)?;
+    println!(
+        "bad reload rejected ({error}); active config remains {}: {}",
+        evaluator.config_id(),
+        serde_json::to_string(&after_bad)?
+    );
+    Ok(())
+}
+
+fn evaluate_ndjson(snapshot_path: &Path, contexts_path: &Path) -> CliResult {
+    let evaluator = Evaluator::new(load_snapshot_file(snapshot_path)?);
+    for input in read_inputs(contexts_path)? {
+        let decision = evaluator.evaluate(&input.flag, &input.context)?;
+        println!("{}", serde_json::to_string(&decision)?);
+    }
+    Ok(())
+}
+
+fn fingerprint(directory: &Path) -> CliResult {
+    let evaluator = Evaluator::new(load_snapshot_file(directory.join("snapshot.json"))?);
+    let mut hash = 0xcbf29ce484222325u64;
+    for input in read_inputs(&directory.join("contexts.ndjson"))? {
+        let decision = evaluator.evaluate(&input.flag, &input.context)?;
+        let bytes = serde_json::to_vec(&decision)?;
+        for byte in bytes {
+            hash ^= u64::from(byte);
+            hash = hash.wrapping_mul(0x100000001b3);
+        }
+    }
+    println!("{hash:016x}");
+    Ok(())
+}
+
+fn generate_benchmark(path: &Path) -> CliResult {
+    let snapshot = benchmark_snapshot();
+    serde_json::to_writer(BufWriter::new(File::create(path)?), &snapshot)?;
+    let bytes = fs::metadata(path)?.len();
+    println!(
+        "generated 5000-flag/50000-rule benchmark snapshot: {} bytes at {}",
+        bytes,
+        path.display()
+    );
+    Ok(())
+}
+
+fn benchmark(path: &Path) -> CliResult {
+    let snapshot_bytes = fs::metadata(path)?.len();
+    let snapshot = load_snapshot_file(path)?;
+
+    let flag_count = snapshot.flags.len();
+    let rule_count: usize = snapshot.flags.values().map(|flag| flag.rules.len()).sum();
+    let heap_estimate = estimated_snapshot_heap(&snapshot);
+    let mut evaluator = Evaluator::new(snapshot);
+    let (reload_result, peak_reload_rss_bytes) = sample_peak_rss(|| evaluator.reload_file(path));
+    reload_result?;
+    let mut checksum = 0u64;
+    let mut p95_values = Vec::new();
+
+    for round in 0..5u64 {
+        let mut timings = Vec::with_capacity(20_000);
+        for index in 0..20_000u64 {
+            let flag = format!("flag-{}", (index * 2_653 + round * 977) % 5_000);
+            let context = benchmark_context(index, round);
+            let start = Instant::now();
+            let decision = evaluator.evaluate(&flag, &context)?;
+            let elapsed = start.elapsed();
+            black_box(&decision);
+            timings.push(elapsed);
+            checksum = checksum.wrapping_add(decision.source.len() as u64);
+        }
+        timings.sort_unstable();
+        let p95 = timings[(timings.len() * 95) / 100];
+        p95_values.push(p95);
+        println!("round {} p95_ns={}", round + 1, p95.as_nanos());
+    }
+    p95_values.sort_unstable();
+    let median_p95 = p95_values[p95_values.len() / 2];
+    let max_p95 = *p95_values.last().expect("five p95 values");
+    let current_rss_bytes = current_rss_bytes().unwrap_or(0);
+    println!(
+        "benchmark flags={flag_count} rules={rule_count} evaluations=100000 snapshot_bytes={snapshot_bytes} estimated_active_heap_bytes={heap_estimate} sampled_peak_same_size_reload_rss_bytes={peak_reload_rss_bytes} current_rss_bytes={current_rss_bytes} median_p95_ns={} max_p95_ns={} checksum={checksum}",
+        median_p95.as_nanos(),
+        max_p95.as_nanos()
+    );
+    if max_p95 >= Duration::from_micros(250) {
+        return Err(format!("maximum measured p95 {max_p95:?} exceeded 250us").into());
+    }
+    if peak_reload_rss_bytes >= 64 * 1024 * 1024 {
+        return Err(
+            format!("sampled peak reload RSS {peak_reload_rss_bytes} exceeded 64 MiB").into(),
+        );
+    }
+    Ok(())
+}
+
+fn sample_peak_rss<T>(work: impl FnOnce() -> T) -> (T, u64) {
+    let running = Arc::new(AtomicBool::new(true));
+    let maximum = Arc::new(AtomicU64::new(current_rss_bytes().unwrap_or(0)));
+    let sampler_running = Arc::clone(&running);
+    let sampler_maximum = Arc::clone(&maximum);
+    let sampler = thread::spawn(move || {
+        while sampler_running.load(Ordering::Relaxed) {
+            if let Some(rss) = current_rss_bytes() {
+                sampler_maximum.fetch_max(rss, Ordering::Relaxed);
+            }
+            thread::sleep(Duration::from_millis(1));
+        }
+    });
+    let result = work();
+    if let Some(rss) = current_rss_bytes() {
+        maximum.fetch_max(rss, Ordering::Relaxed);
+    }
+    running.store(false, Ordering::Relaxed);
+    sampler.join().expect("RSS sampler thread should not panic");
+    (result, maximum.load(Ordering::Relaxed))
+}
+
+fn current_rss_bytes() -> Option<u64> {
+    let output = Command::new("/bin/ps")
+        .args(["-o", "rss=", "-p", &std::process::id().to_string()])
+        .output()
+        .ok()?;
+    if !output.status.success() {
+        return None;
+    }
+    let kib = String::from_utf8(output.stdout)
+        .ok()?
+        .trim()
+        .parse::<u64>()
+        .ok()?;
+    Some(kib * 1024)
+}
+
+fn demo_snapshot(config_id: &str, reloaded: bool) -> Snapshot {
+    let checkout_rules = if reloaded {
+        vec![Rule {
+            id: "all-kiosks-after-reload".to_string(),
+            conditions: vec![Condition {
+                attribute: "kiosk".to_string(),
+                op: Operator::Eq,
+                value: Scalar::Bool(true),
+            }],
+            serve: Scalar::Bool(true),
+            percentage: None,
+        }]
+    } else {
+        vec![
+            Rule {
+                id: "employees-first".to_string(),
+                conditions: vec![Condition {
+                    attribute: "tier".to_string(),
+                    op: Operator::Eq,
+                    value: Scalar::String("employee".to_string()),
+                }],
+                serve: Scalar::Bool(true),
+                percentage: None,
+            },
+            Rule {
+                id: "kiosk-rollout".to_string(),
+                conditions: vec![Condition {
+                    attribute: "kiosk".to_string(),
+                    op: Operator::Eq,
+                    value: Scalar::Bool(true),
+                }],
+                serve: Scalar::Bool(true),
+                percentage: Some(Percentage {
+                    attribute: "user_id".to_string(),
+                    basis_points: 3_500,
+                }),
+            },
+        ]
+    };
+
+    Snapshot {
+        schema_version: 1,
+        config_id: config_id.to_string(),
+        salt: "retail-kiosk-v1".to_string(),
+        flags: BTreeMap::from([
+            (
+                "checkout_redesign".to_string(),
+                Flag {
+                    default: Scalar::Bool(false),
+                    rules: checkout_rules,
+                },
+            ),
+            (
+                "max_cart_items".to_string(),
+                Flag {
+                    default: Scalar::Number(30.0),
+                    rules: vec![Rule {
+                        id: "large-store".to_string(),
+                        conditions: vec![Condition {
+                            attribute: "store_size".to_string(),
+                            op: Operator::GreaterThan,
+                            value: Scalar::Number(20_000.0),
+                        }],
+                        serve: Scalar::Number(50.0),
+                        percentage: None,
+                    }],
+                },
+            ),
+            (
+                "receipt_style".to_string(),
+                Flag {
+                    default: Scalar::String("compact".to_string()),
+                    rules: vec![Rule {
+                        id: "accessible-store".to_string(),
+                        conditions: vec![Condition {
+                            attribute: "accessibility_mode".to_string(),
+                            op: Operator::Eq,
+                            value: Scalar::Bool(true),
+                        }],
+                        serve: Scalar::String("large-print".to_string()),
+                        percentage: None,
+                    }],
+                },
+            ),
+            (
+                "support_prompt".to_string(),
+                Flag {
+                    default: Scalar::Bool(false),
+                    rules: vec![Rule {
+                        id: "non-guest".to_string(),
+                        conditions: vec![Condition {
+                            attribute: "tier".to_string(),
+                            op: Operator::NotEq,
+                            value: Scalar::String("guest".to_string()),
+                        }],
+                        serve: Scalar::Bool(true),
+                        percentage: None,
+                    }],
+                },
+            ),
+        ]),
+    }
+}
+
+fn golden_input(index: usize) -> EvaluationInput {
+    let flags = [
+        "checkout_redesign",
+        "max_cart_items",
+        "receipt_style",
+        "support_prompt",
+    ];
+    let mut context = Context::new();
+    context.insert(
+        "user_id".to_string(),
+        Scalar::String(format!("synthetic-user-{index:03}")),
+    );
+    context.insert("kiosk".to_string(), Scalar::Bool(!index.is_multiple_of(3)));
+    context.insert(
+        "tier".to_string(),
+        Scalar::String(
+            match index % 5 {
+                0 => "employee",
+                1 => "guest",
+                _ => "member",
+            }
+            .to_string(),
+        ),
+    );
+    context.insert(
+        "store_size".to_string(),
+        Scalar::Number((8_000 + (index * 257) % 25_000) as f64),
+    );
+    context.insert(
+        "accessibility_mode".to_string(),
+        Scalar::Bool(index.is_multiple_of(7)),
+    );
+    EvaluationInput {
+        case_id: format!("golden-{index:03}"),
+        flag: flags[index % flags.len()].to_string(),
+        context,
+    }
+}
+
+fn benchmark_snapshot() -> Snapshot {
+    let mut flags = BTreeMap::new();
+    for flag_index in 0..5_000usize {
+        let mut rules = Vec::with_capacity(10);
+        for rule_index in 0..10usize {
+            rules.push(Rule {
+                id: format!("r{rule_index}"),
+                conditions: vec![Condition {
+                    attribute: "segment".to_string(),
+                    op: Operator::Eq,
+                    value: Scalar::Number(rule_index as f64),
+                }],
+                serve: Scalar::Bool((flag_index + rule_index) % 2 == 0),
+                percentage: if rule_index % 3 == 0 {
+                    Some(Percentage {
+                        attribute: "user_id".to_string(),
+                        basis_points: 7_500,
+                    })
+                } else {
+                    None
+                },
+            });
+        }
+        flags.insert(
+            format!("flag-{flag_index}"),
+            Flag {
+                default: Scalar::Bool(false),
+                rules,
+            },
+        );
+    }
+    Snapshot {
+        schema_version: 1,
+        config_id: "synthetic-5000x10".to_string(),
+        salt: "benchmark-salt".to_string(),
+        flags,
+    }
+}
+
+fn benchmark_context(index: u64, round: u64) -> Context {
+    BTreeMap::from([
+        (
+            "segment".to_string(),
+            Scalar::Number(((index * 7 + round * 3) % 12) as f64),
+        ),
+        (
+            "user_id".to_string(),
+            Scalar::String(format!("bench-user-{index}-{round}")),
+        ),
+        ("kiosk".to_string(), Scalar::Bool(true)),
+    ])
+}
+
+fn malformed_cases() -> Vec<(&'static str, Vec<u8>)> {
+    vec![
+        ("01-syntax.json", b"{not-json".to_vec()),
+        (
+            "02-unknown-field.json",
+            br#"{"schema_version":1,"config_id":"x","salt":"s","extra":true,"flags":{"f":{"default":false,"rules":[]}}}"#.to_vec(),
+        ),
+        (
+            "03-wrong-schema.json",
+            br#"{"schema_version":2,"config_id":"x","salt":"s","flags":{"f":{"default":false,"rules":[]}}}"#.to_vec(),
+        ),
+        (
+            "04-empty-id.json",
+            br#"{"schema_version":1,"config_id":"","salt":"s","flags":{"f":{"default":false,"rules":[]}}}"#.to_vec(),
+        ),
+        (
+            "05-empty-salt.json",
+            br#"{"schema_version":1,"config_id":"x","salt":"","flags":{"f":{"default":false,"rules":[]}}}"#.to_vec(),
+        ),
+        (
+            "06-duplicate-flag-key.json",
+            br#"{"schema_version":1,"config_id":"x","salt":"s","flags":{"f":{"default":false,"rules":[]},"f":{"default":true,"rules":[]}}}"#.to_vec(),
+        ),
+        (
+            "07-duplicate-rule-id.json",
+            br#"{"schema_version":1,"config_id":"x","salt":"s","flags":{"f":{"default":false,"rules":[{"id":"r","conditions":[{"attribute":"x","op":"eq","value":true}],"serve":true},{"id":"r","conditions":[{"attribute":"x","op":"eq","value":false}],"serve":false}]}}}"#.to_vec(),
+        ),
+        (
+            "08-empty-rule.json",
+            br#"{"schema_version":1,"config_id":"x","salt":"s","flags":{"f":{"default":false,"rules":[{"id":"r","conditions":[],"serve":true}]}}}"#.to_vec(),
+        ),
+        (
+            "09-invalid-percentage.json",
+            br#"{"schema_version":1,"config_id":"x","salt":"s","flags":{"f":{"default":false,"rules":[{"id":"r","conditions":[],"serve":true,"percentage":{"attribute":"user_id","basis_points":10001}}]}}}"#.to_vec(),
+        ),
+        (
+            "10-invalid-operator-type.json",
+            br#"{"schema_version":1,"config_id":"x","salt":"s","flags":{"f":{"default":false,"rules":[{"id":"r","conditions":[{"attribute":"age","op":"greater_than","value":"old"}],"serve":true}]}}}"#.to_vec(),
+        ),
+        (
+            "11-null-scalar.json",
+            br#"{"schema_version":1,"config_id":"x","salt":"s","flags":{"f":{"default":null,"rules":[]}}}"#.to_vec(),
+        ),
+        (
+            "12-missing-flags.json",
+            br#"{"schema_version":1,"config_id":"x","salt":"s"}"#.to_vec(),
+        ),
+    ]
+}
+
+fn read_inputs(path: &Path) -> CliResult<Vec<EvaluationInput>> {
+    let reader = BufReader::new(File::open(path)?);
+    let mut inputs = Vec::new();
+    for (index, line) in reader.lines().enumerate() {
+        let line = line?;
+        if line.trim().is_empty() {
+            continue;
+        }
+        let input = serde_json::from_str(&line)
+            .map_err(|error| format!("{} line {}: {error}", path.display(), index + 1))?;
+        inputs.push(input);
+    }
+    Ok(inputs)
+}
+
+fn write_json(path: PathBuf, value: &impl Serialize) -> CliResult {
+    serde_json::to_writer_pretty(BufWriter::new(File::create(path)?), value)?;
+    Ok(())
+}
+
+fn write_reordered_json(path: PathBuf, value: &impl Serialize) -> CliResult {
+    let value = serde_json::to_value(value)?;
+    let mut writer = BufWriter::new(File::create(path)?);
+    write_value_reverse(&mut writer, &value)?;
+    writer.write_all(b"\n")?;
+    Ok(())
+}
+
+fn write_value_reverse(writer: &mut impl Write, value: &Value) -> CliResult {
+    match value {
+        Value::Null | Value::Bool(_) | Value::Number(_) | Value::String(_) => {
+            serde_json::to_writer(writer, value)?;
+        }
+        Value::Array(values) => {
+            writer.write_all(b"[")?;
+            for (index, value) in values.iter().enumerate() {
+                if index > 0 {
+                    writer.write_all(b",")?;
+                }
+                write_value_reverse(writer, value)?;
+            }
+            writer.write_all(b"]")?;
+        }
+        Value::Object(values) => {
+            writer.write_all(b"{")?;
+            for (index, (key, value)) in values.iter().rev().enumerate() {
+                if index > 0 {
+                    writer.write_all(b",")?;
+                }
+                serde_json::to_writer(&mut *writer, key)?;
+                writer.write_all(b":")?;
+                write_value_reverse(writer, value)?;
+            }
+            writer.write_all(b"}")?;
+        }
+    }
+    Ok(())
+}
diff --git a/developer-simulation/runs/2026-08-02--carrier-label-ambiguity/Cargo.toml b/developer-simulation/runs/2026-08-02--carrier-label-ambiguity/Cargo.toml
new file mode 100644
index 0000000..52889f5
--- /dev/null
+++ b/developer-simulation/runs/2026-08-02--carrier-label-ambiguity/Cargo.toml
@@ -0,0 +1,11 @@
+[package]
+name = "carrier-label-ambiguity"
+version = "0.1.0"
+edition = "2024"
+publish = false
+
+[lints.rust]
+unsafe_code = "forbid"
+
+[lints.clippy]
+all = "deny"
diff --git a/developer-simulation/runs/2026-08-02--carrier-label-ambiguity/README.md b/developer-simulation/runs/2026-08-02--carrier-label-ambiguity/README.md
new file mode 100644
index 0000000..61ba9b5
--- /dev/null
+++ b/developer-simulation/runs/2026-08-02--carrier-label-ambiguity/README.md
@@ -0,0 +1,61 @@
+# Carrier label ambiguity reliability core
+
+This is a self-contained Rust simulation of the safety boundary around a carrier label purchase. It models the existing PostgreSQL transaction as a checksummed local decision journal, while the carrier simulator remains a separate authority for charges. It deliberately does not use a BogKit crate; the reason is recorded in `TRIAL_REPORT.md`.
+
+The central rule is simple: persist one purchase intent before contacting the carrier, and never automatically call the purchase endpoint again after that intent exists. A missing response is resolved by carrier lookup, a trustworthy callback, or `needs_review`.
+
+## What is included
+
+- deterministic carrier outcomes, including exactly 10% ambiguous timeouts;
+- a synced workflow journal whose recorded post-state is verified by replay;
+- repair of a recognized incomplete final journal record before later appends;
+- duplicate and reordered carrier callbacks with monotonic state changes;
+- a reconciliation worker that resolves known labels and exposes unknown outcomes;
+- four real child-process exits around network and persistence boundaries;
+- a 20,000-shipment, 30-seed acceptance harness with invariant checks;
+- no third-party dependencies, secrets, private data, databases, or generated fixtures.
+
+The journal is a stand-in for an existing PostgreSQL transaction, not a proposed production storage replacement. In production, each journal commit corresponds to updating the shipment row and inserting the decision-history row in one PostgreSQL transaction.
+
+## Exact reproduction
+
+Run these commands from the repository's `developer-simulation` directory.
+
+```sh
+cargo fmt --manifest-path runs/2026-08-02--carrier-label-ambiguity/Cargo.toml -- --check
+cargo clippy -p carrier-label-ambiguity --all-targets -- -D warnings
+cargo test -p carrier-label-ambiguity --all-targets
+cargo build -p carrier-label-ambiguity --release
+
+DEMO_ROOT="$(mktemp -d /private/tmp/carrier-label-demo.XXXXXX)"
+./target/release/carrier-label-ambiguity demo --dir "$DEMO_ROOT/run"
+
+CRASH_ROOT="$(mktemp -d /private/tmp/carrier-label-crashes.XXXXXX)"
+./target/release/carrier-label-ambiguity crash-demo --dir "$CRASH_ROOT/run"
+
+ACCEPTANCE_ROOT="$(mktemp -d /private/tmp/carrier-label-acceptance.XXXXXX)"
+./target/release/carrier-label-ambiguity acceptance \
+  --dir "$ACCEPTANCE_ROOT/run" \
+  --shipments 20000 \
+  --seeds 30
+```
+
+On macOS, measure peak resident memory while running the same realistic fixture:
+
+```sh
+MEASURED_ROOT="$(mktemp -d /private/tmp/carrier-label-measured.XXXXXX)"
+./runs/2026-08-02--carrier-label-ambiguity/scripts/measure-acceptance.sh \
+  ./target/release/carrier-label-ambiguity \
+  "$MEASURED_ROOT/run" \
+  "$MEASURED_ROOT/output.log"
+```
+
+The measurement script uses `ps` to sample the process. A restricted sandbox may need permission to inspect the local process.
+
+## Expected completion lines
+
+The small demo ends with `ACCEPTANCE PASS seeds=1 shipments=100`. The crash harness ends with `CRASH/RESTART PASS scenarios=4 automatic_retries=0`. The realistic fixture ends with `ACCEPTANCE PASS seeds=30 shipments=600000` and the measurement script prints `MEASURED PEAK RSS`.
+
+The fixture fails immediately if a purchase is called twice, a carrier-created label is lost, a timeout without authoritative evidence avoids review, a shipment remains nonterminal, convergence exceeds 60 simulated seconds, an attempt disappears across restart, or replay disagrees with recorded workflow state. The focused journal regression also proves partial write, reopen, later commit, and second reopen.
+
+The durability evidence covers ordinary process termination after completed sync calls on the measured host. It is not a PostgreSQL, concurrent-worker, network, kernel-failure, or power-loss qualification.
diff --git a/developer-simulation/runs/2026-08-02--carrier-label-ambiguity/TRIAL_REPORT.md b/developer-simulation/runs/2026-08-02--carrier-label-ambiguity/TRIAL_REPORT.md
new file mode 100644
index 0000000..d06a0ea
--- /dev/null
+++ b/developer-simulation/runs/2026-08-02--carrier-label-ambiguity/TRIAL_REPORT.md
@@ -0,0 +1,187 @@
+# Trial report: carrier-label ambiguity
+
+Date: 2026-08-02
+Role: fulfillment-platform engineer, intermediate Rust and strong TypeScript, no prior BogKit knowledge
+Source revision: `80fd3c9a023e877fff2e5d127accca386d437af0`
+
+## Outcome
+
+After skeptical-review correction, the reliability prototype passes the requested 20,000-shipment workload for all 30 deterministic seeds. Across 600,000 simulated shipments it made exactly one carrier purchase call per shipment, exposed 30,154 unresolved outcomes as `needs_review`, reconstructed all 3,478,477 decisions from the synced journal model, and converged by 30 simulated seconds. Developer, reviewer, and post-fix optimized runs took 2.795–2.857 local seconds and sampled 11.48–18.20 MiB peak resident memory on one host.
+
+BogKit decision: **no fit for this reliability core**. Fold provides a useful durable incremental-view engine, but introducing its embedded store beside the required PostgreSQL authority would create another persistence boundary. It does not make the carrier request and PostgreSQL update atomic, and its retraction/materialization model does not replace the required write-ahead purchase intent, carrier reconciliation, or human review state. ESE and ANNy are unrelated to this problem.
+
+## Ordered discovery and friction trail
+
+1. Read the public root `README.md`. It recommends generating a project with `scripts/new-project.sh` and describes Fold, ESE, ANNy, and four examples.
+2. Read public examples in the README order: `starter`, `timeseries`, `chat`, and `search`, including each example's `Cargo.toml` and `src/main.rs`.
+3. `starter` established that Fold has transactional writes, consistent reads, persistence, counts, and bags.
+4. `timeseries` showed keyed incremental aggregates and retractions into materialized tables.
+5. `chat` showed one writer owning a Fold stream and publishing consistent snapshots.
+6. `search` showed `KeyedStream` upsert/retraction and confirmed ESE/ANNy target search rather than workflow safety.
+7. Froze the checkout baseline at `80fd3c9a023e877fff2e5d127accca386d437af0`; `git status --short` was empty. Toolchain was `rustc 1.95.0` and `cargo 1.95.0`.
+8. `cargo fmt --all -- --check` failed on existing formatting differences in `examples/search/src/main.rs`.
+9. `cargo test --workspace --all-targets` stopped while ESE's build script attempted to download `model.safetensors`; DNS/network access was unavailable. This occurred before the full baseline could run.
+10. `cargo test -p fold --all-targets` passed all 18 Fold tests in 1.66 seconds.
+11. `cargo clippy -p fold --all-targets -- -D warnings` was blocked by five existing `needless_range_loop` findings in ANNy.
+12. Selected no BogKit dependency and built a dependency-free, archive-safe prototype so the test addressed only the carrier/PostgreSQL ambiguity boundary.
+13. The first complete implementation passed functionally but measured 293.66 MiB peak resident memory. Inspection found that audit verification retained every decoded record and repeatedly rescanned the full history.
+14. Replaced retained audit records with streaming replay and per-shipment attempt counters. The developer's final realistic run measured 18.16 MiB and 2.799 seconds. The discarded high-memory implementation was not available for independent review, so its historical 293.66 MiB observation is not treated as reproduced evidence.
+15. Skeptical review reproduced the main workload but found that reopen ignored an incomplete journal tail without truncating it. A later commit appended behind the bad bytes and the next reopen failed its checksum. Reopen now truncates and syncs the recognized tail before returning, and the regression covers partial write, reopen, later commit, and second reopen.
+16. Review also found that a sandboxed measurement could report zero when `ps` returned no samples. The script now fails without a valid sample. A post-fix process-inspected run measured 11.48 MiB and 2.795 seconds.
+
+## Baseline comparison
+
+The unsafe baseline described in the problem retries after a timeout. In this fixture, every seed has exactly 2,000 ambiguous timeouts. Across 30 seeds, about half of the 60,000 ambiguous calls created a paid label at the carrier. Replaying purchase for any of those would create a second paid label when the carrier does not provide a trusted idempotency guarantee.
+
+The prototype changes only the reliability policy:
+
+| Boundary | Unsafe baseline | Prototype |
+| --- | --- | --- |
+| Before carrier call | May have no durable attempt | Persists one attempt first |
+| Missing response | Automatically retries purchase | Never purchases again; reconciles |
+| Carrier lookup inconclusive | May remain hidden in a retry queue | Becomes `needs_review` at 30 seconds |
+| Callback order/duplicates | Can race or downgrade state | Monotonic reducer; same final carrier transaction |
+| Restart after carrier charge | Can repeat the purchase | Recovers intent and finds the carrier label |
+| Audit | State and attempts can disagree | Every stored post-state is checked by fresh replay |
+
+This prototype does not claim that the pre-existing service was executed. The baseline comparison is against the explicitly supplied unsafe retry behavior; the repository baseline checks above cover BogKit itself.
+
+## Final validation evidence
+
+All commands below ran from the sanitized checkout root.
+
+### Prototype quality gates
+
+```sh
+cargo fmt --all --manifest-path trial-output/Cargo.toml -- --check
+cargo clippy --manifest-path trial-output/Cargo.toml --all-targets -- -D warnings
+cargo test --manifest-path trial-output/Cargo.toml --all-targets
+cargo build --release --manifest-path trial-output/Cargo.toml
+```
+
+Observed after the review fix: formatting passed; strict lint passed with warnings denied; all three focused tests passed; the release build passed. Tests cover callback order and duplication, partial-tail repair followed by a later commit and second reopen, and a three-seed end-to-end fixture.
+
+### Demonstration
+
+```sh
+cargo run --manifest-path trial-output/Cargo.toml -- demo \
+  --dir trial-output/.verification-demo
+```
+
+Observed: 100 shipments passed; 10 ambiguous timeouts were injected; 94 carrier labels were safely recovered; five unresolved calls became review items; 591 decisions replayed; four simulated restarts recovered; maximum convergence was 30 seconds.
+
+### Actual process exits
+
+```sh
+cargo run --manifest-path trial-output/Cargo.toml -- crash-demo \
+  --dir trial-output/.verification-crashes
+```
+
+Observed: all four child processes exited with the expected crash code. Recovery after a durable intent but no authoritative label ended in `NeedsReview`; exits after carrier creation, local confirmation, and callback persistence all recovered as `Purchased`. Every case retained one attempt, and automatic retries were zero.
+
+### Realistic acceptance and resource measurement
+
+```sh
+trial-output/scripts/measure-acceptance.sh \
+  trial-output/target/release/carrier-label-ambiguity \
+  trial-output/.verification-final \
+  trial-output/.verification-final.log
+```
+
+Observed post-review final lines:
+
+```text
+ACCEPTANCE PASS seeds=30 shipments=600000 paid_labels=542813 needs_review=30154 decisions=3478477 max_final_at=30s journal_mib=186.73 elapsed_seconds=2.795
+MEASURED PEAK RSS: 11760 KiB (11.48 MiB)
+```
+
+Per seed: exactly 20,000 shipments, exactly 2,000 ambiguous timeouts, four injected restart boundaries, no second purchase calls, and no nonterminal shipment. Duplicate/reordered callbacks were injected for every created label; the reducer test directly compares them with one ordered callback.
+
+## Categorized findings
+
+### F1: A durable attempt is the safety barrier
+
+- Evidence: four child-process crash cases plus all 600,000 shipments retained exactly one attempt and performed no automatic second purchase.
+- Severity: critical.
+- Confidence: high; directly asserted and replayed.
+- Reproduction: run `crash-demo`, then the realistic acceptance command.
+- Smallest improvement: in the existing service, commit the attempt row before the HTTP call and prohibit the retry worker from purchasing when any attempt exists.
+
+### F2: Unknown is a durable business state, not a retry condition
+
+- Evidence: 30,154 carrier-inconclusive outcomes became `needs_review` at 30 simulated seconds; none triggered another purchase.
+- Severity: critical.
+- Confidence: high; deterministic across all 30 seeds.
+- Reproduction: run the realistic acceptance command and inspect each seed's `needs_review` count.
+- Smallest improvement: add an explicit transition from ambiguous/unfinished attempt to the existing review representation, without changing the external HTTP shape.
+
+### F3: Callback handling must be monotonic by carrier transaction
+
+- Evidence: every carrier label receives duplicates and reordered pending/active callbacks; the focused reducer test proves the same final state and transaction as one ordered sequence.
+- Severity: high.
+- Confidence: high.
+- Reproduction: `cargo test --all-targets reordered_duplicate_callbacks_are_monotonic`.
+- Smallest improvement: make callbacks idempotent by carrier transaction and forbid pending callbacks from downgrading `purchased`.
+
+### F4: Incomplete journal tails must be repaired before later writes
+
+- Evidence: skeptical review reproduced a successful first reopen followed by checksum failure after a later append. The corrected regression now completes a second reopen with three valid records.
+- Severity: high prototype correctness defect, fixed before archival.
+- Confidence: high; reproduced before the fix and covered afterward.
+- Reproduction: run `cargo test --all-targets journal_repairs_a_partial_tail_before_later_commits`.
+- Smallest improvement: truncate and sync a recognized incomplete final record before permitting another append.
+
+### F5: Decision history can be verified without retaining the fixture
+
+- Evidence: the checksummed journal replays and verifies each recorded post-state; 3,478,477 decisions matched. Post-fix one-host runs sampled 11.48–18.20 MiB. The developer observed 293.66 MiB before replacing the retained-history approach, but that discarded implementation was not independently reproduced.
+- Severity: high for audit correctness, medium for the initial memory implementation.
+- Confidence: high; corruption/partial-tail behavior and full replay are exercised.
+- Reproduction: run tests and the measured acceptance fixture.
+- Smallest improvement: replay audit history as a stream and retain only the current shipment projection and compact counters.
+
+### F6: Fold is not the transaction-boundary fix
+
+- Evidence: public examples demonstrate local transactional views and persistence but no carrier-call/PostgreSQL atomicity, external-authority reconciliation, or review transition.
+- Severity: high if forced into the write path because it adds another durable authority.
+- Confidence: high for this scoped prototype; production integration details remain unknown.
+- Reproduction: compare the public `starter`/`chat` ownership model with the supplied PostgreSQL-authority constraint.
+- Smallest improvement: document a workflow-safety example or integration boundary if Fold is intended only for derived, rebuildable views.
+
+### F7: Public baseline has avoidable first-run friction
+
+- Evidence: root format check fails in `examples/search`; full tests require an ESE model download; strict Fold clippy reaches existing ANNy warnings.
+- Severity: low for this carrier trial, medium for onboarding confidence.
+- Confidence: high; exact commands were run on the clean source revision.
+- Reproduction: run the three baseline commands in the discovery trail.
+- Smallest improvement: format the search example, make ESE test assets explicitly prefetchable or skippable offline, and clear workspace lint warnings.
+
+## Decision audit
+
+### Consequential choices
+
+- Persist intent before network. This is the only local action that makes a later missing response safe to interpret without purchasing again.
+- Treat carrier lookup and active callbacks as authoritative evidence of purchase; treat an unknown lookup as review, never proof that purchase did not happen.
+- Keep state transitions monotonic and bind all carrier evidence to one carrier transaction ID.
+- Store the event and its resulting row state together, then independently reduce the event on reopen. This mirrors a PostgreSQL transaction updating workflow state and inserting history.
+- Use a checksummed newline journal and ignore only a final incomplete record, modeling a process exit during a write.
+- Use no dependencies. The reliability core needs deterministic state transitions and file durability, not embeddings, nearest-neighbor search, or another database.
+
+### Rejected alternatives
+
+- Automatic retry with the merchant request ID: rejected because the brief does not grant a trustworthy carrier idempotency contract.
+- Retry after a carrier lookup returns no result: rejected because absence can be stale or inconclusive.
+- Fold as workflow authority: rejected because PostgreSQL must remain authoritative and no distributed transaction exists.
+- Fold as audit projection inside this prototype: rejected because the audit must prove the PostgreSQL decision history itself; a second store would only prove its own projection.
+- Retaining all decoded audit records: rejected after it exceeded the 256 MiB ceiling.
+- Modeling refunds: rejected as an explicit non-goal.
+
+### Remaining uncertainties and limits
+
+- Carrier lookup semantics vary. Production code must distinguish a conclusive carrier rejection from a missing, stale, or unavailable lookup; this prototype intentionally treats missing evidence as review.
+- The journal models the required atomic PostgreSQL row-plus-history transaction but is not a PostgreSQL integration test, because existing database and HTTP shapes were deliberately kept out of scope.
+- Actual process exits cover four representative one-shipment boundaries. The 30-seed fixture uses durable close/reopen recovery at four boundaries per seed so it can remain fast and deterministic.
+- Peak memory was sampled every 20 milliseconds with `ps`; the large margin below 256 MiB makes sampling error immaterial to the result.
+- The simulator is sequential. Database-enforced single-attempt uniqueness or conditional transitions, concurrent workers, conflicting callbacks, callback authentication, real carrier lookup semantics, PostgreSQL, and network faults remain untested.
+- Sync evidence covers ordinary process exits after completed local filesystem calls, not kernel failure or power loss.
+
+After the partial-tail fix, no requested acceptance criterion remains blocked for the sequential reliability-core prototype. Production PostgreSQL, carrier, and concurrency integration remains outside the prototype boundary.
diff --git a/developer-simulation/runs/2026-08-02--carrier-label-ambiguity/scripts/measure-acceptance.sh b/developer-simulation/runs/2026-08-02--carrier-label-ambiguity/scripts/measure-acceptance.sh
new file mode 100755
index 0000000..edc88d6
--- /dev/null
+++ b/developer-simulation/runs/2026-08-02--carrier-label-ambiguity/scripts/measure-acceptance.sh
@@ -0,0 +1,36 @@
+#!/bin/sh
+set -eu
+
+if [ "$#" -ne 3 ]; then
+  echo "usage: $0 BINARY RUN_DIRECTORY OUTPUT_LOG" >&2
+  exit 2
+fi
+
+binary=$1
+run_directory=$2
+output_log=$3
+
+"$binary" acceptance --dir "$run_directory" --shipments 20000 --seeds 30 >"$output_log" 2>&1 &
+worker_pid=$!
+peak_rss_kib=0
+sample_count=0
+
+while kill -0 "$worker_pid" 2>/dev/null; do
+  current_rss_kib=$(ps -o rss= -p "$worker_pid" 2>/dev/null | tr -d ' ' || true)
+  if [ -n "$current_rss_kib" ]; then
+    sample_count=$((sample_count + 1))
+    if [ "$current_rss_kib" -gt "$peak_rss_kib" ]; then
+      peak_rss_kib=$current_rss_kib
+    fi
+  fi
+  sleep 0.02
+done
+
+wait "$worker_pid"
+cat "$output_log"
+if [ "$sample_count" -eq 0 ]; then
+  echo "MEASUREMENT FAILED: ps returned no valid RSS samples" >&2
+  exit 1
+fi
+peak_rss_mib=$(awk "BEGIN { printf \"%.2f\", $peak_rss_kib / 1024 }")
+echo "MEASURED PEAK RSS: ${peak_rss_kib} KiB (${peak_rss_mib} MiB)"
diff --git a/developer-simulation/runs/2026-08-02--carrier-label-ambiguity/src/lib.rs b/developer-simulation/runs/2026-08-02--carrier-label-ambiguity/src/lib.rs
new file mode 100644
index 0000000..c37f775
--- /dev/null
+++ b/developer-simulation/runs/2026-08-02--carrier-label-ambiguity/src/lib.rs
@@ -0,0 +1,1030 @@
+use std::fmt::Write as _;
+use std::fs::{self, File, OpenOptions};
+use std::io::{self, BufRead, BufReader, BufWriter, Write};
+use std::path::{Path, PathBuf};
+
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+pub enum WorkflowState {
+    Absent,
+    Created,
+    Requesting,
+    Ambiguous,
+    Purchased,
+    Failed,
+    NeedsReview,
+}
+
+impl WorkflowState {
+    const fn code(self) -> char {
+        match self {
+            Self::Absent => '0',
+            Self::Created => 'C',
+            Self::Requesting => 'Q',
+            Self::Ambiguous => 'A',
+            Self::Purchased => 'P',
+            Self::Failed => 'F',
+            Self::NeedsReview => 'R',
+        }
+    }
+
+    fn from_code(value: &str) -> Result<Self, String> {
+        match value {
+            "0" => Ok(Self::Absent),
+            "C" => Ok(Self::Created),
+            "Q" => Ok(Self::Requesting),
+            "A" => Ok(Self::Ambiguous),
+            "P" => Ok(Self::Purchased),
+            "F" => Ok(Self::Failed),
+            "R" => Ok(Self::NeedsReview),
+            _ => Err(format!("unknown workflow state {value:?}")),
+        }
+    }
+
+    pub const fn is_terminal(self) -> bool {
+        matches!(self, Self::Purchased | Self::Failed | Self::NeedsReview)
+    }
+}
+
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+pub struct StateRow {
+    pub state: WorkflowState,
+    pub carrier_tx: u64,
+    pub price_cents: u32,
+    pub attempts: u8,
+    pub final_at: u32,
+    pub saw_timeout: bool,
+}
+
+impl Default for StateRow {
+    fn default() -> Self {
+        Self {
+            state: WorkflowState::Absent,
+            carrier_tx: 0,
+            price_cents: 0,
+            attempts: 0,
+            final_at: 0,
+            saw_timeout: false,
+        }
+    }
+}
+
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+pub enum EventKind {
+    ShipmentCreated,
+    AttemptStarted,
+    PurchaseConfirmed,
+    PurchaseRejected,
+    PurchaseTimedOut,
+    CallbackPending,
+    CallbackActive,
+    ReconcileFound,
+    ReconcileUnknown,
+}
+
+impl EventKind {
+    const fn code(self) -> char {
+        match self {
+            Self::ShipmentCreated => 'C',
+            Self::AttemptStarted => 'A',
+            Self::PurchaseConfirmed => 'P',
+            Self::PurchaseRejected => 'F',
+            Self::PurchaseTimedOut => 'T',
+            Self::CallbackPending => 'B',
+            Self::CallbackActive => 'V',
+            Self::ReconcileFound => 'R',
+            Self::ReconcileUnknown => 'U',
+        }
+    }
+
+    fn from_code(value: &str) -> Result<Self, String> {
+        match value {
+            "C" => Ok(Self::ShipmentCreated),
+            "A" => Ok(Self::AttemptStarted),
+            "P" => Ok(Self::PurchaseConfirmed),
+            "F" => Ok(Self::PurchaseRejected),
+            "T" => Ok(Self::PurchaseTimedOut),
+            "B" => Ok(Self::CallbackPending),
+            "V" => Ok(Self::CallbackActive),
+            "R" => Ok(Self::ReconcileFound),
+            "U" => Ok(Self::ReconcileUnknown),
+            _ => Err(format!("unknown event kind {value:?}")),
+        }
+    }
+}
+
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+pub struct Event {
+    pub kind: EventKind,
+    pub shipment: u32,
+    pub at: u32,
+    pub carrier_tx: u64,
+    pub price_cents: u32,
+}
+
+impl Event {
+    pub const fn new(kind: EventKind, shipment: u32, at: u32) -> Self {
+        Self {
+            kind,
+            shipment,
+            at,
+            carrier_tx: 0,
+            price_cents: 0,
+        }
+    }
+
+    pub const fn carrier(mut self, tx: u64, price_cents: u32) -> Self {
+        self.carrier_tx = tx;
+        self.price_cents = price_cents;
+        self
+    }
+}
+
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+struct StoredEvent {
+    event: Event,
+    after: StateRow,
+}
+
+fn set_purchased(row: &mut StateRow, event: Event) -> Result<(), String> {
+    if event.carrier_tx == 0 {
+        return Err("a purchased decision requires a carrier transaction id".to_string());
+    }
+    if row.carrier_tx != 0 && row.carrier_tx != event.carrier_tx {
+        return Err(format!(
+            "shipment {} changed carrier transaction from {} to {}",
+            event.shipment, row.carrier_tx, event.carrier_tx
+        ));
+    }
+    let was_purchased = row.state == WorkflowState::Purchased;
+    row.state = WorkflowState::Purchased;
+    row.carrier_tx = event.carrier_tx;
+    if event.price_cents != 0 {
+        row.price_cents = event.price_cents;
+    }
+    if !was_purchased {
+        row.final_at = event.at;
+    }
+    Ok(())
+}
+
+fn reduce(previous: StateRow, event: Event) -> Result<StateRow, String> {
+    let mut row = previous;
+    match event.kind {
+        EventKind::ShipmentCreated => {
+            if row.state != WorkflowState::Absent {
+                return Err(format!("shipment {} was created twice", event.shipment));
+            }
+            row.state = WorkflowState::Created;
+        }
+        EventKind::AttemptStarted => {
+            if row.state != WorkflowState::Created || row.attempts != 0 {
+                return Err(format!(
+                    "shipment {} attempted purchase from {:?} with {} prior attempts",
+                    event.shipment, row.state, row.attempts
+                ));
+            }
+            row.state = WorkflowState::Requesting;
+            row.attempts = 1;
+        }
+        EventKind::PurchaseConfirmed | EventKind::CallbackActive | EventKind::ReconcileFound => {
+            set_purchased(&mut row, event)?
+        }
+        EventKind::PurchaseRejected => {
+            if row.state != WorkflowState::Purchased {
+                row.state = WorkflowState::Failed;
+                if row.final_at == 0 {
+                    row.final_at = event.at;
+                }
+            }
+        }
+        EventKind::PurchaseTimedOut => {
+            row.saw_timeout = true;
+            if row.state != WorkflowState::Purchased {
+                row.state = WorkflowState::Ambiguous;
+                row.final_at = 0;
+            }
+        }
+        EventKind::CallbackPending => {
+            if row.state == WorkflowState::Absent {
+                return Err(format!(
+                    "shipment {} received a callback before creation",
+                    event.shipment
+                ));
+            }
+            if row.carrier_tx != 0 && row.carrier_tx != event.carrier_tx {
+                return Err(format!(
+                    "shipment {} received a conflicting callback transaction",
+                    event.shipment
+                ));
+            }
+            row.carrier_tx = event.carrier_tx;
+            if event.price_cents != 0 {
+                row.price_cents = event.price_cents;
+            }
+        }
+        EventKind::ReconcileUnknown => {
+            if row.state != WorkflowState::Purchased {
+                row.state = WorkflowState::NeedsReview;
+                row.final_at = event.at;
+            }
+        }
+    }
+    Ok(row)
+}
+
+fn checksum(bytes: &[u8]) -> u64 {
+    let mut hash = 0xcbf2_9ce4_8422_2325_u64;
+    for byte in bytes {
+        hash ^= u64::from(*byte);
+        hash = hash.wrapping_mul(0x0000_0100_0000_01b3);
+    }
+    hash
+}
+
+fn encode(record: StoredEvent) -> String {
+    let mut payload = String::with_capacity(96);
+    write!(
+        payload,
+        "1|{}|{}|{}|{}|{}|{}|{}|{}|{}|{}|{}",
+        record.event.kind.code(),
+        record.event.shipment,
+        record.event.at,
+        record.event.carrier_tx,
+        record.event.price_cents,
+        record.after.state.code(),
+        record.after.carrier_tx,
+        record.after.price_cents,
+        record.after.attempts,
+        record.after.final_at,
+        u8::from(record.after.saw_timeout)
+    )
+    .expect("writing to a String cannot fail");
+    let digest = checksum(payload.as_bytes());
+    format!("{payload}|{digest:016x}\n")
+}
+
+fn parse_num<T: std::str::FromStr>(value: &str, name: &str) -> Result<T, String> {
+    value
+        .parse()
+        .map_err(|_| format!("invalid {name} value {value:?}"))
+}
+
+fn decode(line: &str) -> Result<StoredEvent, String> {
+    let (payload, digest) = line
+        .rsplit_once('|')
+        .ok_or_else(|| "journal record has no checksum".to_string())?;
+    let expected =
+        u64::from_str_radix(digest, 16).map_err(|_| format!("invalid checksum {digest:?}"))?;
+    let actual = checksum(payload.as_bytes());
+    if expected != actual {
+        return Err(format!(
+            "journal checksum mismatch: expected {expected:016x}, got {actual:016x}"
+        ));
+    }
+    let mut fields = payload.split('|');
+    let version = fields.next().unwrap_or_default();
+    let event_kind = fields.next().unwrap_or_default();
+    let shipment = fields.next().unwrap_or_default();
+    let event_time = fields.next().unwrap_or_default();
+    let event_tx = fields.next().unwrap_or_default();
+    let event_price = fields.next().unwrap_or_default();
+    let state = fields.next().unwrap_or_default();
+    let stored_tx = fields.next().unwrap_or_default();
+    let stored_price = fields.next().unwrap_or_default();
+    let attempts = fields.next().unwrap_or_default();
+    let final_time = fields.next().unwrap_or_default();
+    let timeout = fields.next().unwrap_or_default();
+    if version != "1" || fields.next().is_some() {
+        return Err(format!("unsupported journal record {payload:?}"));
+    }
+    Ok(StoredEvent {
+        event: Event {
+            kind: EventKind::from_code(event_kind)?,
+            shipment: parse_num(shipment, "shipment")?,
+            at: parse_num(event_time, "event time")?,
+            carrier_tx: parse_num(event_tx, "carrier transaction")?,
+            price_cents: parse_num(event_price, "price")?,
+        },
+        after: StateRow {
+            state: WorkflowState::from_code(state)?,
+            carrier_tx: parse_num(stored_tx, "stored carrier transaction")?,
+            price_cents: parse_num(stored_price, "stored price")?,
+            attempts: parse_num(attempts, "attempt count")?,
+            final_at: parse_num(final_time, "final time")?,
+            saw_timeout: match timeout {
+                "0" => false,
+                "1" => true,
+                value => return Err(format!("invalid timeout marker {value:?}")),
+            },
+        },
+    })
+}
+
+pub struct Journal {
+    path: PathBuf,
+    states: Vec<StateRow>,
+    attempt_records: Vec<u8>,
+    record_count: usize,
+}
+
+impl Journal {
+    pub fn create(path: &Path, shipments: usize) -> Result<Self, String> {
+        if let Some(parent) = path.parent() {
+            fs::create_dir_all(parent).map_err(|error| error.to_string())?;
+        }
+        OpenOptions::new()
+            .create_new(true)
+            .write(true)
+            .open(path)
+            .map_err(|error| format!("create {}: {error}", path.display()))?;
+        Ok(Self {
+            path: path.to_path_buf(),
+            states: vec![StateRow::default(); shipments],
+            attempt_records: vec![0; shipments],
+            record_count: 0,
+        })
+    }
+
+    pub fn open(path: &Path, shipments: usize) -> Result<Self, String> {
+        let file = File::open(path).map_err(|error| format!("open {}: {error}", path.display()))?;
+        let mut states = vec![StateRow::default(); shipments];
+        let mut attempt_records = vec![0_u8; shipments];
+        let mut record_count = 0;
+        let mut reader = BufReader::new(file);
+        let mut bytes = Vec::new();
+        let mut valid_len = 0_u64;
+        loop {
+            bytes.clear();
+            let read = reader
+                .read_until(b'\n', &mut bytes)
+                .map_err(|error| format!("read {}: {error}", path.display()))?;
+            if read == 0 {
+                break;
+            }
+            if !bytes.ends_with(b"\n") {
+                break;
+            }
+            valid_len = valid_len
+                .checked_add(
+                    u64::try_from(read).map_err(|_| "journal length overflow".to_string())?,
+                )
+                .ok_or_else(|| "journal length overflow".to_string())?;
+            bytes.pop();
+            let line = std::str::from_utf8(&bytes)
+                .map_err(|error| format!("journal is not UTF-8: {error}"))?;
+            let record = decode(line)?;
+            let index = usize::try_from(record.event.shipment)
+                .map_err(|_| "shipment index overflow".to_string())?;
+            let previous = *states.get(index).ok_or_else(|| {
+                format!("shipment {} is outside the fixture", record.event.shipment)
+            })?;
+            let reconstructed = reduce(previous, record.event)?;
+            if reconstructed != record.after {
+                return Err(format!(
+                    "audit mismatch for shipment {}: reconstructed {reconstructed:?}, stored {:?}",
+                    record.event.shipment, record.after
+                ));
+            }
+            states[index] = record.after;
+            if record.event.kind == EventKind::AttemptStarted {
+                attempt_records[index] = attempt_records[index]
+                    .checked_add(1)
+                    .ok_or_else(|| "attempt audit counter overflow".to_string())?;
+            }
+            record_count += 1;
+        }
+        let file_len = fs::metadata(path)
+            .map_err(|error| format!("stat {}: {error}", path.display()))?
+            .len();
+        if file_len != valid_len {
+            let file = OpenOptions::new()
+                .write(true)
+                .open(path)
+                .map_err(|error| format!("repair {}: {error}", path.display()))?;
+            file.set_len(valid_len)
+                .map_err(|error| format!("truncate {}: {error}", path.display()))?;
+            file.sync_data()
+                .map_err(|error| format!("sync repaired {}: {error}", path.display()))?;
+        }
+        Ok(Self {
+            path: path.to_path_buf(),
+            states,
+            attempt_records,
+            record_count,
+        })
+    }
+
+    pub fn commit_batch(&mut self, events: &[Event]) -> Result<(), String> {
+        let mut next_states = self.states.clone();
+        let mut next_attempt_records = self.attempt_records.clone();
+        let mut encoded = String::with_capacity(events.len().saturating_mul(64));
+        for event in events {
+            let index = usize::try_from(event.shipment)
+                .map_err(|_| "shipment index overflow".to_string())?;
+            let previous = *next_states
+                .get(index)
+                .ok_or_else(|| format!("shipment {} is outside the fixture", event.shipment))?;
+            let after = reduce(previous, *event)?;
+            let record = StoredEvent {
+                event: *event,
+                after,
+            };
+            encoded.push_str(&encode(record));
+            next_states[index] = after;
+            if event.kind == EventKind::AttemptStarted {
+                next_attempt_records[index] = next_attempt_records[index]
+                    .checked_add(1)
+                    .ok_or_else(|| "attempt audit counter overflow".to_string())?;
+            }
+        }
+
+        let file = OpenOptions::new()
+            .append(true)
+            .open(&self.path)
+            .map_err(|error| format!("append {}: {error}", self.path.display()))?;
+        let mut writer = BufWriter::new(file);
+        writer
+            .write_all(encoded.as_bytes())
+            .map_err(|error| format!("write {}: {error}", self.path.display()))?;
+        writer
+            .flush()
+            .map_err(|error| format!("flush {}: {error}", self.path.display()))?;
+        writer
+            .get_ref()
+            .sync_data()
+            .map_err(|error| format!("sync {}: {error}", self.path.display()))?;
+        self.states = next_states;
+        self.attempt_records = next_attempt_records;
+        self.record_count += events.len();
+        Ok(())
+    }
+
+    pub fn row(&self, shipment: usize) -> StateRow {
+        self.states[shipment]
+    }
+
+    pub fn rows(&self) -> &[StateRow] {
+        &self.states
+    }
+
+    pub fn record_count(&self) -> usize {
+        self.record_count
+    }
+
+    pub fn attempt_record_count(&self, shipment: usize) -> u8 {
+        self.attempt_records[shipment]
+    }
+}
+
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+struct CarrierLabel {
+    tx: u64,
+    price_cents: u32,
+}
+
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+enum PlannedOutcome {
+    Confirmed,
+    Rejected,
+    TimedOutCharged,
+    TimedOutUnknown,
+}
+
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+enum PurchaseOutcome {
+    Confirmed(CarrierLabel),
+    Rejected,
+    TimedOut,
+}
+
+fn mix(mut value: u64) -> u64 {
+    value = value.wrapping_add(0x9e37_79b9_7f4a_7c15);
+    value = (value ^ (value >> 30)).wrapping_mul(0xbf58_476d_1ce4_e5b9);
+    value = (value ^ (value >> 27)).wrapping_mul(0x94d0_49bb_1331_11eb);
+    value ^ (value >> 31)
+}
+
+fn planned_outcome(seed: u64, shipment: u32) -> PlannedOutcome {
+    if (u64::from(shipment) + seed).is_multiple_of(10) {
+        if mix(seed.rotate_left(17) ^ u64::from(shipment)) & 1 == 0 {
+            PlannedOutcome::TimedOutCharged
+        } else {
+            PlannedOutcome::TimedOutUnknown
+        }
+    } else if mix(seed ^ u64::from(shipment).wrapping_mul(0x9e37_79b9)).is_multiple_of(20) {
+        PlannedOutcome::Rejected
+    } else {
+        PlannedOutcome::Confirmed
+    }
+}
+
+fn price_for(seed: u64, shipment: u32) -> u32 {
+    500 + u32::try_from(mix(seed ^ u64::from(shipment)) % 2_000).expect("bounded price")
+}
+
+struct CarrierSimulator {
+    seed: u64,
+    labels: Vec<Option<CarrierLabel>>,
+    calls: Vec<u8>,
+}
+
+impl CarrierSimulator {
+    fn new(seed: u64, shipments: usize) -> Self {
+        Self {
+            seed,
+            labels: vec![None; shipments],
+            calls: vec![0; shipments],
+        }
+    }
+
+    fn purchase(&mut self, shipment: u32, price_cents: u32) -> Result<PurchaseOutcome, String> {
+        let index = usize::try_from(shipment).map_err(|_| "shipment index overflow".to_string())?;
+        self.calls[index] = self.calls[index]
+            .checked_add(1)
+            .ok_or_else(|| "carrier call counter overflow".to_string())?;
+        if self.calls[index] != 1 {
+            return Err(format!(
+                "unsafe automatic second purchase for shipment {shipment}"
+            ));
+        }
+        let label = CarrierLabel {
+            tx: self
+                .seed
+                .wrapping_mul(1_000_000)
+                .wrapping_add(u64::from(shipment) + 1),
+            price_cents,
+        };
+        match planned_outcome(self.seed, shipment) {
+            PlannedOutcome::Confirmed => {
+                self.labels[index] = Some(label);
+                Ok(PurchaseOutcome::Confirmed(label))
+            }
+            PlannedOutcome::Rejected => Ok(PurchaseOutcome::Rejected),
+            PlannedOutcome::TimedOutCharged => {
+                self.labels[index] = Some(label);
+                Ok(PurchaseOutcome::TimedOut)
+            }
+            PlannedOutcome::TimedOutUnknown => Ok(PurchaseOutcome::TimedOut),
+        }
+    }
+
+    fn lookup(&self, shipment: usize) -> Option<CarrierLabel> {
+        self.labels[shipment]
+    }
+}
+
+#[derive(Clone, Debug)]
+pub struct SeedMetrics {
+    pub seed: u64,
+    pub shipments: usize,
+    pub purchased: usize,
+    pub failed: usize,
+    pub needs_review: usize,
+    pub ambiguous_timeouts: usize,
+    pub paid_labels: usize,
+    pub callbacks: usize,
+    pub injected_restarts: usize,
+    pub decision_records: usize,
+    pub max_final_at: u32,
+    pub journal_bytes: u64,
+}
+
+fn reopen(journal: Journal, shipments: usize) -> Result<Journal, String> {
+    let path = journal.path.clone();
+    drop(journal);
+    Journal::open(&path, shipments)
+}
+
+fn callback_sequence(seed: u64, shipment: u32, label: CarrierLabel, start_at: u32) -> [Event; 3] {
+    let pending = Event::new(EventKind::CallbackPending, shipment, start_at)
+        .carrier(label.tx, label.price_cents);
+    let active = Event::new(EventKind::CallbackActive, shipment, start_at + 1)
+        .carrier(label.tx, label.price_cents);
+    if mix(seed ^ u64::from(shipment)) & 1 == 0 {
+        [active, pending, active]
+    } else {
+        [pending, active, pending]
+    }
+}
+
+fn find_confirmed(seed: u64, shipments: usize) -> Result<u32, String> {
+    (0..u32::try_from(shipments).map_err(|_| "fixture is too large".to_string())?)
+        .find(|shipment| planned_outcome(seed, *shipment) == PlannedOutcome::Confirmed)
+        .ok_or_else(|| "fixture has no confirmed purchase for the network crash".to_string())
+}
+
+pub fn run_seed(root: &Path, seed: u64, shipments: usize) -> Result<SeedMetrics, String> {
+    if shipments < 10 {
+        return Err("fixture must contain at least 10 shipments".to_string());
+    }
+    let seed_dir = root.join(format!("seed-{seed:02}"));
+    fs::create_dir(&seed_dir).map_err(|error| format!("create {}: {error}", seed_dir.display()))?;
+    let journal_path = seed_dir.join("workflow.journal");
+    let mut journal = Journal::create(&journal_path, shipments)?;
+    let mut carrier = CarrierSimulator::new(seed, shipments);
+    let mut restarts = 0;
+
+    let shipment_count =
+        u32::try_from(shipments).map_err(|_| "fixture is too large".to_string())?;
+    let created: Vec<_> = (0..shipment_count)
+        .map(|shipment| Event::new(EventKind::ShipmentCreated, shipment, 0))
+        .collect();
+    journal.commit_batch(&created)?;
+
+    // Crash before attempt persistence: the shipment rows survive and no network call has happened.
+    journal = reopen(journal, shipments)?;
+    restarts += 1;
+
+    // Write-ahead intent is durable for every shipment before any carrier request.
+    let attempts: Vec<_> = (0..shipment_count)
+        .map(|shipment| Event::new(EventKind::AttemptStarted, shipment, 1))
+        .collect();
+    journal.commit_batch(&attempts)?;
+    journal = reopen(journal, shipments)?;
+    restarts += 1;
+
+    let crash_after_network = find_confirmed(seed, shipments)?;
+    let mut results = Vec::with_capacity(shipments);
+    for shipment in 0..shipment_count {
+        if journal.row(shipment as usize).attempts != 1 {
+            return Err(format!(
+                "shipment {shipment} reached the carrier without a durable attempt"
+            ));
+        }
+        let price = price_for(seed, shipment);
+        let outcome = carrier.purchase(shipment, price)?;
+        if shipment == crash_after_network {
+            // The carrier has charged and created the label. The local result is intentionally lost.
+            journal.commit_batch(&results)?;
+            results.clear();
+            journal = reopen(journal, shipments)?;
+            restarts += 1;
+            continue;
+        }
+        let event = match outcome {
+            PurchaseOutcome::Confirmed(label) => {
+                Event::new(EventKind::PurchaseConfirmed, shipment, 2)
+                    .carrier(label.tx, label.price_cents)
+            }
+            PurchaseOutcome::Rejected => Event::new(EventKind::PurchaseRejected, shipment, 2),
+            PurchaseOutcome::TimedOut => Event::new(EventKind::PurchaseTimedOut, shipment, 2),
+        };
+        results.push(event);
+    }
+    journal.commit_batch(&results)?;
+
+    // Crash after the local result commit: terminal rows must resume without another purchase.
+    journal = reopen(journal, shipments)?;
+    restarts += 1;
+
+    let mut callbacks = 0;
+    let mut early_callbacks = Vec::new();
+    let mut late_callbacks = Vec::new();
+    for shipment in 0..shipment_count {
+        let Some(label) = carrier.lookup(shipment as usize) else {
+            continue;
+        };
+        let group = mix(seed.rotate_right(9) ^ u64::from(shipment)) % 3;
+        let sequence = callback_sequence(seed, shipment, label, if group == 0 { 5 } else { 35 });
+        callbacks += sequence.len();
+        match group {
+            0 => early_callbacks.extend(sequence),
+            1 => late_callbacks.extend(sequence),
+            _ => {
+                early_callbacks.push(
+                    Event::new(EventKind::CallbackPending, shipment, 5)
+                        .carrier(label.tx, label.price_cents),
+                );
+                early_callbacks.push(
+                    Event::new(EventKind::CallbackPending, shipment, 6)
+                        .carrier(label.tx, label.price_cents),
+                );
+                late_callbacks.push(
+                    Event::new(EventKind::CallbackActive, shipment, 35)
+                        .carrier(label.tx, label.price_cents),
+                );
+            }
+        }
+    }
+    journal.commit_batch(&early_callbacks)?;
+
+    let mut reconciliation = Vec::new();
+    for shipment in 0..shipment_count {
+        let row = journal.row(shipment as usize);
+        if row.state.is_terminal() {
+            continue;
+        }
+        if let Some(label) = carrier.lookup(shipment as usize) {
+            reconciliation.push(
+                Event::new(EventKind::ReconcileFound, shipment, 30)
+                    .carrier(label.tx, label.price_cents),
+            );
+        } else {
+            reconciliation.push(Event::new(EventKind::ReconcileUnknown, shipment, 30));
+        }
+    }
+    journal.commit_batch(&reconciliation)?;
+    journal.commit_batch(&late_callbacks)?;
+
+    // A final reopen is the audit: each stored post-state is checked against a fresh replay.
+    journal = reopen(journal, shipments)?;
+
+    let mut purchased = 0;
+    let mut failed = 0;
+    let mut needs_review = 0;
+    let mut max_final_at = 0;
+    let mut ambiguous_timeouts = 0;
+    let mut paid_labels = 0;
+    for shipment in 0..shipments {
+        let row = journal.row(shipment);
+        if row.attempts != 1 || carrier.calls[shipment] != 1 {
+            return Err(format!(
+                "shipment {shipment} did not preserve exactly one durable attempt and one carrier call"
+            ));
+        }
+        if journal.attempt_record_count(shipment) != 1 {
+            return Err(format!(
+                "shipment {shipment} audit lost its purchase attempt"
+            ));
+        }
+        let label = carrier.lookup(shipment);
+        if let Some(label) = label {
+            paid_labels += 1;
+            if row.state != WorkflowState::Purchased || row.carrier_tx != label.tx {
+                return Err(format!(
+                    "shipment {shipment} did not converge to its authoritative carrier label"
+                ));
+            }
+        } else {
+            match planned_outcome(seed, shipment as u32) {
+                PlannedOutcome::Rejected => {
+                    if row.state != WorkflowState::Failed {
+                        return Err(format!("shipment {shipment} lost a carrier rejection"));
+                    }
+                }
+                PlannedOutcome::TimedOutUnknown => {
+                    if row.state != WorkflowState::NeedsReview || !row.saw_timeout {
+                        return Err(format!(
+                            "shipment {shipment} did not expose an inconclusive timeout for review"
+                        ));
+                    }
+                }
+                PlannedOutcome::Confirmed | PlannedOutcome::TimedOutCharged => {
+                    return Err(format!(
+                        "shipment {shipment} is missing an authoritative label"
+                    ));
+                }
+            }
+        }
+        match row.state {
+            WorkflowState::Purchased => purchased += 1,
+            WorkflowState::Failed => failed += 1,
+            WorkflowState::NeedsReview => needs_review += 1,
+            other => {
+                return Err(format!(
+                    "shipment {shipment} remained nonterminal in {other:?}"
+                ));
+            }
+        }
+        if row.final_at > 60 {
+            return Err(format!(
+                "shipment {shipment} converged after the 60-second deadline"
+            ));
+        }
+        max_final_at = max_final_at.max(row.final_at);
+        if (u64::try_from(shipment).expect("usize fits u64") + seed).is_multiple_of(10) {
+            ambiguous_timeouts += 1;
+            if carrier.calls[shipment] != 1 {
+                return Err(format!("ambiguous shipment {shipment} was purchased twice"));
+            }
+        }
+    }
+    if ambiguous_timeouts * 10 != shipments {
+        return Err(format!(
+            "expected exactly 10% timeouts, got {ambiguous_timeouts}/{shipments}"
+        ));
+    }
+    if purchased + failed + needs_review != shipments {
+        return Err("terminal-state counts do not cover the fixture".to_string());
+    }
+
+    let decision_records = journal.record_count();
+    let journal_bytes = fs::metadata(&journal_path)
+        .map_err(|error| format!("stat {}: {error}", journal_path.display()))?
+        .len();
+    Ok(SeedMetrics {
+        seed,
+        shipments,
+        purchased,
+        failed,
+        needs_review,
+        ambiguous_timeouts,
+        paid_labels,
+        callbacks,
+        injected_restarts: restarts,
+        decision_records,
+        max_final_at,
+        journal_bytes,
+    })
+}
+
+pub fn run_fixture(root: &Path, shipments: usize, seeds: u64) -> Result<Vec<SeedMetrics>, String> {
+    fs::create_dir(root).map_err(|error| format!("create {}: {error}", root.display()))?;
+    let mut metrics = Vec::with_capacity(usize::try_from(seeds).unwrap_or(0));
+    for seed in 0..seeds {
+        metrics.push(run_seed(root, seed, shipments)?);
+    }
+    Ok(metrics)
+}
+
+fn write_carrier_label(path: &Path) -> Result<CarrierLabel, String> {
+    if path.exists() {
+        return Err("a second carrier purchase was attempted".to_string());
+    }
+    let label = CarrierLabel {
+        tx: 424_242,
+        price_cents: 1_299,
+    };
+    let mut file = OpenOptions::new()
+        .create_new(true)
+        .write(true)
+        .open(path)
+        .map_err(|error| format!("create {}: {error}", path.display()))?;
+    writeln!(file, "{}|{}", label.tx, label.price_cents)
+        .map_err(|error| format!("write {}: {error}", path.display()))?;
+    file.sync_data()
+        .map_err(|error| format!("sync {}: {error}", path.display()))?;
+    Ok(label)
+}
+
+fn read_carrier_label(path: &Path) -> Result<Option<CarrierLabel>, String> {
+    match fs::read_to_string(path) {
+        Ok(contents) => {
+            let (tx, price) = contents
+                .trim()
+                .split_once('|')
+                .ok_or_else(|| "invalid carrier authority record".to_string())?;
+            Ok(Some(CarrierLabel {
+                tx: parse_num(tx, "carrier transaction")?,
+                price_cents: parse_num(price, "carrier price")?,
+            }))
+        }
+        Err(error) if error.kind() == io::ErrorKind::NotFound => Ok(None),
+        Err(error) => Err(format!("read {}: {error}", path.display())),
+    }
+}
+
+pub fn run_crash_child(dir: &Path, stage: &str) -> Result<(), String> {
+    let journal_path = dir.join("workflow.journal");
+    let carrier_path = dir.join("carrier-authority.log");
+    let mut journal = Journal::open(&journal_path, 1)?;
+    match stage {
+        "before-network" => {}
+        "after-carrier" => {
+            write_carrier_label(&carrier_path)?;
+        }
+        "after-confirm" => {
+            let label = write_carrier_label(&carrier_path)?;
+            journal
+                .commit_batch(&[Event::new(EventKind::PurchaseConfirmed, 0, 2)
+                    .carrier(label.tx, label.price_cents)])?;
+        }
+        "after-callback" => {
+            let label = write_carrier_label(&carrier_path)?;
+            journal
+                .commit_batch(&[Event::new(EventKind::CallbackActive, 0, 3)
+                    .carrier(label.tx, label.price_cents)])?;
+        }
+        other => return Err(format!("unknown crash stage {other:?}")),
+    }
+    Ok(())
+}
+
+#[derive(Clone, Debug)]
+pub struct CrashMetrics {
+    pub stage: String,
+    pub final_state: WorkflowState,
+    pub carrier_purchases: usize,
+    pub attempts: u8,
+}
+
+pub fn prepare_crash_scenario(dir: &Path) -> Result<(), String> {
+    fs::create_dir(dir).map_err(|error| format!("create {}: {error}", dir.display()))?;
+    let mut journal = Journal::create(&dir.join("workflow.journal"), 1)?;
+    journal.commit_batch(&[
+        Event::new(EventKind::ShipmentCreated, 0, 0),
+        Event::new(EventKind::AttemptStarted, 0, 1),
+    ])
+}
+
+pub fn resume_crash_scenario(dir: &Path, stage: &str) -> Result<CrashMetrics, String> {
+    let journal_path = dir.join("workflow.journal");
+    let carrier_path = dir.join("carrier-authority.log");
+    let mut journal = Journal::open(&journal_path, 1)?;
+    let label = read_carrier_label(&carrier_path)?;
+    if !journal.row(0).state.is_terminal() {
+        let event = match label {
+            Some(label) => {
+                Event::new(EventKind::ReconcileFound, 0, 30).carrier(label.tx, label.price_cents)
+            }
+            None => Event::new(EventKind::ReconcileUnknown, 0, 30),
+        };
+        journal.commit_batch(&[event])?;
+    }
+    let journal = Journal::open(&journal_path, 1)?;
+    let row = journal.row(0);
+    let expected = if label.is_some() {
+        WorkflowState::Purchased
+    } else {
+        WorkflowState::NeedsReview
+    };
+    if row.state != expected || row.attempts != 1 {
+        return Err(format!(
+            "crash stage {stage} resumed as {:?} with {} attempts",
+            row.state, row.attempts
+        ));
+    }
+    Ok(CrashMetrics {
+        stage: stage.to_string(),
+        final_state: row.state,
+        carrier_purchases: usize::from(label.is_some()),
+        attempts: row.attempts,
+    })
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::time::{SystemTime, UNIX_EPOCH};
+
+    fn temp_path(name: &str) -> PathBuf {
+        let nonce = SystemTime::now()
+            .duration_since(UNIX_EPOCH)
+            .expect("clock")
+            .as_nanos();
+        std::env::temp_dir().join(format!(
+            "carrier-label-ambiguity-{name}-{}-{nonce}",
+            std::process::id()
+        ))
+    }
+
+    #[test]
+    fn reordered_duplicate_callbacks_are_monotonic() {
+        let start = StateRow {
+            state: WorkflowState::Ambiguous,
+            attempts: 1,
+            saw_timeout: true,
+            ..StateRow::default()
+        };
+        let pending = Event::new(EventKind::CallbackPending, 0, 5).carrier(9, 700);
+        let active = Event::new(EventKind::CallbackActive, 0, 6).carrier(9, 700);
+        let ordered = reduce(reduce(start, pending).expect("pending"), active).expect("active");
+        let reordered = reduce(
+            reduce(reduce(start, active).expect("active"), pending).expect("pending"),
+            active,
+        )
+        .expect("duplicate active");
+        assert_eq!(ordered.state, WorkflowState::Purchased);
+        assert_eq!(ordered.state, reordered.state);
+        assert_eq!(ordered.carrier_tx, reordered.carrier_tx);
+    }
+
+    #[test]
+    fn journal_repairs_a_partial_tail_before_later_commits() {
+        let dir = temp_path("partial-tail");
+        fs::create_dir(&dir).expect("temp directory");
+        let path = dir.join("workflow.journal");
+        let mut journal = Journal::create(&path, 1).expect("create journal");
+        journal
+            .commit_batch(&[
+                Event::new(EventKind::ShipmentCreated, 0, 0),
+                Event::new(EventKind::AttemptStarted, 0, 1),
+            ])
+            .expect("commit");
+        let mut file = OpenOptions::new().append(true).open(&path).expect("append");
+        file.write_all(b"partial-without-newline")
+            .expect("partial write");
+        file.sync_data().expect("sync partial");
+        let mut recovered = Journal::open(&path, 1).expect("recover journal");
+        assert_eq!(recovered.row(0).state, WorkflowState::Requesting);
+        assert_eq!(recovered.record_count(), 2);
+        recovered
+            .commit_batch(&[Event::new(EventKind::PurchaseTimedOut, 0, 2)])
+            .expect("commit after recovery");
+        drop(recovered);
+        let reopened = Journal::open(&path, 1).expect("reopen repaired journal");
+        assert_eq!(reopened.row(0).state, WorkflowState::Ambiguous);
+        assert_eq!(reopened.record_count(), 3);
+        fs::remove_dir_all(dir).expect("cleanup");
+    }
+
+    #[test]
+    fn realistic_rules_hold_on_small_fixture() {
+        let dir = temp_path("small-fixture");
+        let metrics = run_fixture(&dir, 100, 3).expect("fixture passes");
+        assert_eq!(metrics.len(), 3);
+        assert!(metrics.iter().all(|seed| seed.ambiguous_timeouts == 10));
+        assert!(metrics.iter().all(|seed| seed.injected_restarts == 4));
+        fs::remove_dir_all(dir).expect("cleanup");
+    }
+}
diff --git a/developer-simulation/runs/2026-08-02--carrier-label-ambiguity/src/main.rs b/developer-simulation/runs/2026-08-02--carrier-label-ambiguity/src/main.rs
new file mode 100644
index 0000000..1f78537
--- /dev/null
+++ b/developer-simulation/runs/2026-08-02--carrier-label-ambiguity/src/main.rs
@@ -0,0 +1,152 @@
+use std::env;
+use std::path::{Path, PathBuf};
+use std::process::{Command, ExitCode};
+use std::time::Instant;
+
+use carrier_label_ambiguity::{
+    prepare_crash_scenario, resume_crash_scenario, run_crash_child, run_fixture,
+};
+
+fn usage() -> &'static str {
+    "usage:\n  carrier-label-ambiguity demo --dir PATH\n  carrier-label-ambiguity acceptance --dir PATH [--shipments 20000] [--seeds 30]\n  carrier-label-ambiguity crash-demo --dir PATH"
+}
+
+fn option(args: &[String], name: &str) -> Result<Option<String>, String> {
+    let Some(index) = args.iter().position(|arg| arg == name) else {
+        return Ok(None);
+    };
+    args.get(index + 1)
+        .cloned()
+        .ok_or_else(|| format!("{name} requires a value"))
+        .map(Some)
+}
+
+fn required_dir(args: &[String]) -> Result<PathBuf, String> {
+    option(args, "--dir")?
+        .map(PathBuf::from)
+        .ok_or_else(|| "--dir is required".to_string())
+}
+
+fn parse_or<T>(args: &[String], name: &str, default: T) -> Result<T, String>
+where
+    T: std::str::FromStr,
+{
+    option(args, name)?.map_or(Ok(default), |value| {
+        value
+            .parse()
+            .map_err(|_| format!("invalid {name} value {value:?}"))
+    })
+}
+
+fn run_and_print(root: &Path, shipments: usize, seeds: u64) -> Result<(), String> {
+    let started = Instant::now();
+    let metrics = run_fixture(root, shipments, seeds)?;
+    let mut total_shipments = 0;
+    let mut total_paid = 0;
+    let mut total_review = 0;
+    let mut total_records = 0;
+    let mut total_bytes = 0;
+    let mut max_final_at = 0;
+    for seed in &metrics {
+        println!(
+            "seed {:02}: PASS shipments={} purchased={} failed={} needs_review={} ambiguous={} paid_labels={} callbacks={} restarts={} decisions={} max_final_at={}s",
+            seed.seed,
+            seed.shipments,
+            seed.purchased,
+            seed.failed,
+            seed.needs_review,
+            seed.ambiguous_timeouts,
+            seed.paid_labels,
+            seed.callbacks,
+            seed.injected_restarts,
+            seed.decision_records,
+            seed.max_final_at
+        );
+        total_shipments += seed.shipments;
+        total_paid += seed.paid_labels;
+        total_review += seed.needs_review;
+        total_records += seed.decision_records;
+        total_bytes += seed.journal_bytes;
+        max_final_at = max_final_at.max(seed.max_final_at);
+    }
+    println!(
+        "ACCEPTANCE PASS seeds={} shipments={} paid_labels={} needs_review={} decisions={} max_final_at={}s journal_mib={:.2} elapsed_seconds={:.3}",
+        metrics.len(),
+        total_shipments,
+        total_paid,
+        total_review,
+        total_records,
+        max_final_at,
+        total_bytes as f64 / 1_048_576.0,
+        started.elapsed().as_secs_f64()
+    );
+    Ok(())
+}
+
+fn crash_demo(root: &Path) -> Result<(), String> {
+    std::fs::create_dir(root).map_err(|error| format!("create {}: {error}", root.display()))?;
+    let executable =
+        env::current_exe().map_err(|error| format!("find current executable: {error}"))?;
+    for stage in [
+        "before-network",
+        "after-carrier",
+        "after-confirm",
+        "after-callback",
+    ] {
+        let dir = root.join(stage);
+        prepare_crash_scenario(&dir)?;
+        let status = Command::new(&executable)
+            .arg("__crash-child")
+            .arg("--dir")
+            .arg(&dir)
+            .arg("--stage")
+            .arg(stage)
+            .status()
+            .map_err(|error| format!("run crash child: {error}"))?;
+        if status.code() != Some(86) {
+            return Err(format!(
+                "crash child for {stage} exited with {status}, expected code 86"
+            ));
+        }
+        let metrics = resume_crash_scenario(&dir, stage)?;
+        println!(
+            "crash {stage}: PASS final={:?} durable_attempts={} carrier_purchases={}",
+            metrics.final_state, metrics.attempts, metrics.carrier_purchases
+        );
+    }
+    println!("CRASH/RESTART PASS scenarios=4 automatic_retries=0");
+    Ok(())
+}
+
+fn run() -> Result<(), String> {
+    let args: Vec<String> = env::args().skip(1).collect();
+    let command = args.first().ok_or_else(|| usage().to_string())?;
+    match command.as_str() {
+        "demo" => run_and_print(&required_dir(&args)?, 100, 1),
+        "acceptance" => {
+            let root = required_dir(&args)?;
+            let shipments = parse_or(&args, "--shipments", 20_000_usize)?;
+            let seeds = parse_or(&args, "--seeds", 30_u64)?;
+            run_and_print(&root, shipments, seeds)
+        }
+        "crash-demo" => crash_demo(&required_dir(&args)?),
+        "__crash-child" => {
+            let dir = required_dir(&args)?;
+            let stage = option(&args, "--stage")?
+                .ok_or_else(|| "--stage is required for crash child".to_string())?;
+            run_crash_child(&dir, &stage)?;
+            std::process::exit(86);
+        }
+        _ => Err(usage().to_string()),
+    }
+}
+
+fn main() -> ExitCode {
+    match run() {
+        Ok(()) => ExitCode::SUCCESS,
+        Err(error) => {
+            eprintln!("error: {error}");
+            ExitCode::FAILURE
+        }
+    }
+}
diff --git a/developer-simulation/runs/2026-08-02--snapshot-gc-safety/Cargo.toml b/developer-simulation/runs/2026-08-02--snapshot-gc-safety/Cargo.toml
new file mode 100644
index 0000000..9364e2e
--- /dev/null
+++ b/developer-simulation/runs/2026-08-02--snapshot-gc-safety/Cargo.toml
@@ -0,0 +1,14 @@
+[package]
+name = "snapshot-gc-safety"
+version = "0.1.0"
+edition = "2024"
+publish = false
+
+[dependencies]
+serde_json = "1"
+
+[lints.rust]
+unsafe_code = "forbid"
+
+[lints.clippy]
+pedantic = "deny"
diff --git a/developer-simulation/runs/2026-08-02--snapshot-gc-safety/README.md b/developer-simulation/runs/2026-08-02--snapshot-gc-safety/README.md
new file mode 100644
index 0000000..f2c121b
--- /dev/null
+++ b/developer-simulation/runs/2026-08-02--snapshot-gc-safety/README.md
@@ -0,0 +1,113 @@
+# Snapshot GC Safety
+
+This is a runnable prototype for bounded-memory, recoverable garbage collection of
+content-addressed blobs referenced by append-only JSONL snapshot manifests. It is
+self-contained and does not modify BogKit or use a BogKit component.
+
+## What it does
+
+`plan` validates every committed `manifests/*.jsonl` record before doing anything
+destructive. It externally sorts fixed-size binary hashes in small chunks, compares
+them with the blob inventory, and commits a named candidate list.
+
+`apply` takes the publication lock, validates all currently committed manifests
+again, and atomically renames only currently unreferenced candidates into the plan's
+quarantine. A successful apply deliberately stops there so recovery remains possible.
+
+`resume` takes the same lock, validates manifests again, restores any quarantined
+blob that has become referenced, deletes the remaining quarantined blobs, and writes
+a completion marker. The phase markers and filesystem state make all three commands
+safe to repeat after ordinary process termination at any mutation boundary.
+
+`publish` demonstrates the required publisher side of the protocol without changing
+the manifest format: write and flush a temporary JSONL file, take the publication
+lock, reject an existing final name, restore a referenced blob from quarantine if
+necessary, then atomically rename the manifest into its committed `.jsonl` name.
+Production publishers must follow this lock-and-rename contract for the concurrency
+guarantee to hold.
+
+Only regular files with a `.jsonl` suffix are treated as committed manifests. Every
+record must end in a newline and contain a string `hash` field with exactly 64 hex
+characters. A bad committed record reports its manifest and one-based record number.
+
+## Build and verify
+
+The only dependency is `serde_json`, used to parse JSON correctly. The commands below
+keep generated build output outside this archive-safe directory.
+
+```sh
+cd developer-simulation
+export CARGO_TARGET_DIR=/private/tmp/snapshot-gc-safety-target
+cargo fmt --manifest-path runs/2026-08-02--snapshot-gc-safety/Cargo.toml -- --check
+cargo test -p snapshot-gc-safety --all-targets --offline
+cargo clippy -p snapshot-gc-safety --all-targets --offline -- -D warnings
+cargo build -p snapshot-gc-safety --release --offline
+python3 runs/2026-08-02--snapshot-gc-safety/acceptance.py "$CARGO_TARGET_DIR/release/snapshot-gc-safety"
+```
+
+The acceptance harness checks 30 differently seeded repositories against an
+independent in-memory oracle. It also checks truncated and malformed committed
+manifests, a manifest published during planning, publication from quarantine, two
+same-name publishers forced to contend for the lock, every quarantine and
+finalization crash boundary, and repeated plan/apply/resume calls.
+
+## Small demonstration
+
+```sh
+DEMO_ROOT="$(mktemp -d /private/tmp/snapshot-gc-demo.XXXXXX)"
+BIN="$CARGO_TARGET_DIR/release/snapshot-gc-safety"
+"$BIN" fixture "$DEMO_ROOT" --manifests 10 --references 1000 --unique 250 --inventory 300 --missing 3
+"$BIN" plan "$DEMO_ROOT" nightly
+"$BIN" verify-plan "$DEMO_ROOT" nightly
+"$BIN" apply "$DEMO_ROOT" nightly
+"$BIN" status "$DEMO_ROOT" nightly
+"$BIN" resume "$DEMO_ROOT" nightly
+"$BIN" status "$DEMO_ROOT" nightly
+```
+
+Expected key lines are `planned 53 candidates`, `oracle match ... zero referenced
+blobs selected`, then `quarantined`, and finally `complete`.
+
+To publish a manifest safely, pass its final name and referenced hashes:
+
+```sh
+"$BIN" publish "$DEMO_ROOT" snapshot-new.jsonl 0000000000000000000000000000000000000000000000000000000000000001
+```
+
+## Realistic scale and measurement
+
+```sh
+SCALE_ROOT="$(mktemp -d /private/tmp/snapshot-gc-scale.XXXXXX)"
+"$BIN" fixture "$SCALE_ROOT"
+python3 runs/2026-08-02--snapshot-gc-safety/measure.py --scratch "$SCALE_ROOT/.snapshot-gc" -- "$BIN" plan "$SCALE_ROOT" realistic
+"$BIN" verify-plan "$SCALE_ROOT" realistic
+python3 runs/2026-08-02--snapshot-gc-safety/measure.py -- "$BIN" apply "$SCALE_ROOT" realistic
+python3 runs/2026-08-02--snapshot-gc-safety/measure.py -- "$BIN" resume "$SCALE_ROOT" realistic
+```
+
+The default fixture is the requested scale: 10,000 manifests, 1,000,000 reference
+records, 250,000 unique hashes, 300,000 zero-byte inventory blobs, 1,000 missing
+referenced blobs, duplicates, and 51,000 unreachable inventory blobs. To exercise the
+malformed guard, add a committed file without its final newline before `plan`:
+
+```sh
+printf '%s' '{"hash":"abc"}' > "$SCALE_ROOT/manifests/truncated.jsonl"
+"$BIN" plan "$SCALE_ROOT" must-abort
+```
+
+## Frozen comparison baseline
+
+`baseline.py` is the runnable Python behavior frozen before the BogKit fit decision.
+It loads every referenced hash into one Python set and directly unlinks unreferenced
+blobs. Its SHA-256 is
+`682bc139ce3ed25b16e16daef616014d6be890f0da30eaecd5fb6c9719b27bea`.
+
+```sh
+BASELINE=runs/2026-08-02--snapshot-gc-safety/baseline.py
+shasum -a 256 "$BASELINE"
+python3 "$BASELINE" seed /private/tmp/snapshot-gc-baseline --references 100000 --unique 25000 --inventory 30000 --manifests 1000
+python3 "$BASELINE" collect /private/tmp/snapshot-gc-baseline
+```
+
+The detailed observed results, design audit, limitations, and discovery trail are in
+`TRIAL_REPORT.md`.
diff --git a/developer-simulation/runs/2026-08-02--snapshot-gc-safety/TRIAL_REPORT.md b/developer-simulation/runs/2026-08-02--snapshot-gc-safety/TRIAL_REPORT.md
new file mode 100644
index 0000000..4c2ac0c
--- /dev/null
+++ b/developer-simulation/runs/2026-08-02--snapshot-gc-safety/TRIAL_REPORT.md
@@ -0,0 +1,236 @@
+# Snapshot GC Safety Trial Report
+
+## Outcome
+
+After skeptical-review correction, the prototype met every prototype acceptance check at the requested scale. Planning
+selected all 51,000 eligible unreachable blobs and zero referenced blobs. A committed
+truncated or malformed record stopped plan/apply before quarantine and named the file
+and record. Cooperative publication during planning and from an existing quarantine
+preserved the newly referenced blob. Subprocess exits after every tested quarantine,
+finalization, and phase-marker boundary resumed to completion without losing live
+blobs. Repeating plan, apply, and resume was harmless.
+
+Skeptical review reproduced a serious same-name publication race: two cooperative
+publishers could both pass the pre-lock existence check, both report success, and the
+second rename could replace the first manifest. The final-name check now occurs while
+holding the publication lock, temporary output is cleaned on rejection, and a forced-
+contention regression requires exactly one publisher to succeed.
+
+The production integration requirement is explicit: manifest publishers must use the
+same advisory publication lock and temporary-file rename protocol demonstrated by the
+`publish` command. No collector can close the check-to-rename race against an entirely
+uncooperative POSIX writer. Integrating that protocol into the daemon was a stated
+non-goal, so it is not attempted here.
+
+## Ordered discovery and friction trail
+
+1. Read the public root `README.md`. It described Fold as an incremental materialized
+   view engine and directed new users to the public examples.
+2. Read the public starter, time-series, chat, and search examples in that order. The
+   useful concepts were atomic transactions and consistent snapshots; none addressed
+   ownership of external manifest files, publication fencing, quarantine, or bounded
+   external sorting.
+3. Wrote and ran `baseline.py` before inspecting Fold internals. On 100,000 records it
+   loaded 25,000 unique strings and directly deleted 5,000 blobs in 0.36 seconds. The
+   file was then frozen at the SHA-256 recorded in the README.
+4. Inspected the workspace manifest and Fold's public crate documentation. Fold stores
+   application-ingested deltas in an embedded LSM database. Using it would require a
+   second durable copy of external manifest state and would not provide the missing
+   publisher/quarantine protocol.
+5. Chose no BogKit component. Implemented a small standalone Rust package using only
+   the standard library plus `serde_json` for correct parsing.
+6. The first online Cargo check could not resolve `index.crates.io`. The dependency was
+   already locally available, so all subsequent builds and checks used `--offline`.
+7. Strict lint found two ambiguous file-opening/extension checks; both were corrected.
+8. The first small demonstration showed per-object directory flushes were unnecessarily
+   slow. Phase markers retain durability and the state is derivable after process exit,
+   so directory flushes were moved to phase commits. The crash matrix was rerun after
+   that change.
+9. Ran the 30-repository oracle matrix, malformed guards, concurrency cases, crash
+   matrix, idempotence checks, and the full million-record fixture.
+10. Skeptical review reproduced the full workload and then forced two same-name
+    publishers to wait behind the same lock. Both originally reported success and the
+    later rename replaced the earlier manifest. The existence check was moved under
+    the lock, cleanup was added, and the acceptance harness now requires one success
+    and one existing-name failure.
+11. Review also found that Python baseline memory varied materially across runs. The
+    direct-deletion and publication-race failures remain proven, but the memory result
+    is now reported as inadequate and variable headroom rather than a stable breach.
+
+## Exact validation and observed results
+
+All commands ran from the `trial-output` directory. Generated Rust output was directed
+to `/private/tmp/snapshot-gc-target-trial-b`.
+
+```text
+cargo fmt --all -- --check
+  PASS
+
+cargo test --all-targets --offline
+  3 passed; 0 failed
+
+cargo clippy --all-targets --offline -- -D warnings
+  PASS; zero warnings
+
+python3 acceptance.py /private/tmp/snapshot-gc-target-trial-b/release/snapshot-gc-safety
+  acceptance: 30/30 oracle repos, malformed guards, concurrent publication,
+  all crash boundaries, idempotence: PASS
+```
+
+The post-fix acceptance includes a forced same-name contention regression that
+observed exactly one successful publisher and one existing-name failure.
+
+Requested-scale fixture creation (developer run):
+
+```text
+fixture: 10000 manifests, 1000000 references, 250000 unique,
+300000 inventory, 1000 missing, 51000 unreachable
+wall_seconds=17.410, peak_rss_bytes=1,982,464
+manifest corpus logical bytes=76,000,000
+```
+
+Requested-scale post-fix plan:
+
+```text
+planned 51000 candidates from 1000000 records and 300000 blobs in 1.475s
+measured wall_seconds=1.485
+peak_rss_bytes=6,160,384
+peak_scratch_bytes=38,376,656
+```
+
+The corrected plan therefore remained comfortably inside the 90-second, 128 MiB,
+and manifest-corpus scratch limits on the measured host.
+
+Requested-scale independent oracle and mutations:
+
+```text
+oracle match: all 51000 eligible unreachable blobs selected;
+zero referenced blobs selected
+oracle: independently rechecked all 51,000 candidates
+
+apply realistic: quarantined 51000 blobs in 6.864s
+resume realistic: removed 51000, restored 0 in 2.963s
+status: complete
+```
+
+The oracle intentionally uses an independent in-memory `HashSet`; its memory is not
+part of the collector's planning bound.
+
+Frozen Python baseline on the same requested-scale Rust-generated fixture:
+
+```text
+loaded 250000 unique references; directly removed 51000 blobs
+wall_seconds=8.938
+peak_rss_bytes=183,648,256
+```
+
+The developer observed one 183,648,256-byte run. Skeptical review reproduced highly
+variable one-host results from 124,436,480 to 133,971,968 bytes; the largest was only
+245,760 bytes below 128 MiB. This does not establish a stable breach, but it leaves
+inadequate production headroom. Independently of memory, the baseline has no
+recoverable quarantine or publisher fence and directly deletes candidates.
+
+## Categorized findings
+
+### Evidence: Python reference-set memory is variable with inadequate headroom
+
+- Severity: medium.
+- Confidence: high that headroom is inadequate on the measured host; low that it
+  always breaches the threshold.
+- Reproduction: generate the default Rust fixture, then run
+  `python3 measure.py -- python3 baseline.py collect <fixture>`.
+- Smallest improvement: replace the in-memory string set with fixed-width external
+  chunk sorting and a streaming merge, and repeat under the production runtime.
+
+### Evidence: direct deletion has a publication race
+
+- Severity: critical for data safety.
+- Confidence: high; the baseline freezes the manifest list, then directly unlinks.
+- Reproduction: publish a committed manifest after its manifest enumeration and before
+  its inventory deletion.
+- Smallest improvement: make publishers write temporary files and take the shared
+  publication lock for blob validation/resurrection plus the final manifest rename.
+
+### Prototype correctness defect, fixed: same-name publishers could both succeed
+
+- Severity: critical for append-only publication safety.
+- Confidence: high; skeptical review forced the contention and observed the first
+  successful manifest being replaced before the fix.
+- Reproduction: run `acceptance.py`; its same-name case holds the publication lock
+  until both publishers have created temporary files and then requires one success
+  and one failure.
+- Smallest improvement: check the final name while holding the shared publication
+  lock, reject an existing destination, and clean the losing temporary file.
+
+### Evidence: malformed committed input is fail-closed
+
+- Severity: critical safeguard.
+- Confidence: high; tested before both plan and apply mutations.
+- Reproduction: `printf` a JSON object without its final newline into
+  `manifests/bad.jsonl`, then run plan or apply.
+- Smallest improvement: preserve the current file-and-record diagnostic in any daemon
+  integration and alert on it.
+
+### Evidence: crash recovery is derived from filesystem state
+
+- Severity: high.
+- Confidence: high for ordinary process termination; the harness injected exit code 86
+  after each of four object mutations and the phase marker in both apply and resume.
+- Reproduction: set `SNAPSHOT_GC_CRASH_AFTER=1` through `5`, rerun on a four-candidate
+  fixture, then invoke resume.
+- Smallest improvement: add power-loss testing on the production filesystem before
+  claiming durability against kernel or hardware failure.
+
+### Evidence: Fold is not a fit for this bounded prototype
+
+- Severity: medium architecture decision.
+- Confidence: high for the stated non-integration prototype.
+- Reproduction: compare Fold's public stream/table persistence model with the required
+  external manifest validation, bounded scratch, publication fence, and quarantine.
+- Smallest improvement: no BogKit change is justified by this trial. Re-evaluate only
+  if Fold gains a bounded external-set primitive that directly owns this protocol.
+
+## Decision audit
+
+- Chose fixed 32-byte binary hashes and 65,536-hash sort chunks. This bounds working
+  memory and makes scratch smaller than the original JSONL corpus.
+- Chose a two-step apply/resume flow. A normal successful apply leaves recoverable
+  quarantine; resume revalidates live references immediately before final deletion.
+- Chose an advisory file lock instead of a lock directory. The operating system releases
+  a file lock when an injected crash exits, so resume never needs unsafe stale-lock theft.
+- Chose strict final-newline validation. A partial last JSONL record is treated as a
+  truncated committed manifest, not a record to ignore.
+- Chose to rescan every committed manifest under the publication lock for apply and
+  resume. A stale plan can over-select, but cannot move a hash that is referenced at
+  apply time, and cannot finalize a hash referenced at resume time.
+- Rejected Fold because it duplicates source state, consumes additional durable scratch,
+  and does not solve the publication race.
+- Rejected SQLite or another embedded database because it adds a dependency and a second
+  data model when sorted fixed-width files are sufficient.
+- Rejected probabilistic filters because zero false negatives are mandatory; false
+  positives would also prevent selection of every eligible unreachable blob.
+- Rejected a grace-period-only design because a new manifest can legitimately reference
+  an old blob, so age alone cannot prove safety.
+- Uncertainty: the prototype tests process exits, not sudden power loss. Directory syncs
+  protect committed phase markers and publisher ordering, but production filesystems and
+  mount options need a dedicated power-failure qualification.
+- Uncertainty: non-cooperative writers can bypass advisory locks. The CLI refuses to
+  publish a reference whose blob is neither live nor recoverable, but daemon integration
+  is required to make every real publisher follow that rule.
+- Uncertainty: evidence covers ordinary exits after completed filesystem operations,
+  not interruption inside a syscall, kernel failure, or power loss. Production also
+  needs same-filesystem rename, directory-sync, canonical lowercase filename, and
+  case-sensitive-filesystem qualification.
+- Uncertainty: concurrent planners sharing a plan name, publisher crash points,
+  candidate-file corruption, and an input-independent memory bound remain untested.
+
+## Files
+
+- `Cargo.toml` and `Cargo.lock`: standalone package and reproducible dependency lock.
+- `src/main.rs`: fixture, plan, apply, resume, status, publisher, oracle, bounded sorter,
+  validation, and unit tests.
+- `acceptance.py`: 30-seed oracle matrix and subprocess safety harness.
+- `baseline.py`: frozen Python comparison.
+- `measure.py`: wall-time, child RSS, and peak scratch measurement.
+- `README.md`: exact reproduction and operating contract.
+- `TRIAL_REPORT.md`: this evidence and decision audit.
diff --git a/developer-simulation/runs/2026-08-02--snapshot-gc-safety/acceptance.py b/developer-simulation/runs/2026-08-02--snapshot-gc-safety/acceptance.py
new file mode 100644
index 0000000..8bf943e
--- /dev/null
+++ b/developer-simulation/runs/2026-08-02--snapshot-gc-safety/acceptance.py
@@ -0,0 +1,225 @@
+#!/usr/bin/env python3
+"""Seeded oracle, malformed-input, concurrency, idempotence, and crash harness."""
+
+from __future__ import annotations
+
+import argparse
+import fcntl
+import json
+import os
+from pathlib import Path
+import subprocess
+import tempfile
+import time
+
+CRASH_EXIT = 86
+
+
+def run(binary: Path, *args: object, env: dict[str, str] | None = None, expected: int = 0):
+    command = [str(binary), *(str(arg) for arg in args)]
+    result = subprocess.run(command, text=True, capture_output=True, env=env, check=False)
+    if result.returncode != expected:
+        raise AssertionError(
+            f"expected exit {expected}, got {result.returncode}: {' '.join(command)}\n"
+            f"stdout:\n{result.stdout}\nstderr:\n{result.stderr}"
+        )
+    return result
+
+
+def fixture(binary: Path, root: Path, *, manifests=7, references=400, unique=100,
+            inventory=125, missing=2) -> None:
+    run(
+        binary,
+        "fixture",
+        root,
+        "--manifests",
+        manifests,
+        "--references",
+        references,
+        "--unique",
+        unique,
+        "--inventory",
+        inventory,
+        "--missing",
+        missing,
+    )
+
+
+def hash_number(value: int) -> str:
+    return f"{value:064x}"
+
+
+def assert_live_references(root: Path) -> None:
+    for manifest in (root / "manifests").glob("*.jsonl"):
+        with manifest.open(encoding="utf-8") as source:
+            for line in source:
+                value = json.loads(line)["hash"]
+                # Missing blobs are part of the seeded input and stay missing; all initially
+                # present references and all successfully published references must be live.
+                numeric = int(value, 16)
+                if numeric < 98 or manifest.name.startswith("published"):
+                    assert (root / "blobs" / value).is_file(), (manifest, value)
+
+
+def seeded_oracle_matrix(binary: Path, parent: Path) -> None:
+    for seed in range(30):
+        root = parent / f"oracle-{seed:02}"
+        unique = 80 + seed * 3
+        missing = seed % 5
+        inventory = unique + 20 + (seed % 7)
+        fixture(
+            binary,
+            root,
+            manifests=5 + seed % 9,
+            references=unique * 4 + seed,
+            unique=unique,
+            inventory=inventory,
+            missing=missing,
+        )
+        run(binary, "plan", root, "oracle")
+        result = run(binary, "verify-plan", root, "oracle")
+        assert "zero referenced blobs selected" in result.stdout
+
+
+def malformed_guards(binary: Path, parent: Path) -> None:
+    root = parent / "malformed-plan"
+    fixture(binary, root)
+    (root / "manifests" / "bad.jsonl").write_text('{"hash":"abc"}', encoding="utf-8")
+    result = run(binary, "plan", root, "bad", expected=1)
+    assert "bad.jsonl record 1" in result.stderr
+    assert not (root / ".snapshot-gc" / "plans" / "bad" / "quarantine").exists()
+
+    root = parent / "malformed-apply"
+    fixture(binary, root)
+    run(binary, "plan", root, "bad-apply")
+    (root / "manifests" / "bad.jsonl").write_text("not-json\n", encoding="utf-8")
+    result = run(binary, "apply", root, "bad-apply", expected=1)
+    assert "bad.jsonl record 1" in result.stderr
+    quarantine = root / ".snapshot-gc" / "plans" / "bad-apply" / "quarantine"
+    assert not quarantine.exists() or not any(quarantine.iterdir())
+
+
+def concurrent_publication(binary: Path, parent: Path) -> None:
+    root = parent / "concurrent-plan"
+    fixture(binary, root, manifests=20, references=2_000, unique=500, inventory=550, missing=0)
+    value = hash_number(500)
+    environment = os.environ.copy()
+    environment["SNAPSHOT_GC_TEST_PAUSE_BEFORE_CANDIDATES_MS"] = "500"
+    planner = subprocess.Popen(
+        [str(binary), "plan", str(root), "race"],
+        text=True,
+        stdout=subprocess.PIPE,
+        stderr=subprocess.PIPE,
+        env=environment,
+    )
+    time.sleep(0.15)
+    run(binary, "publish", root, "published-during-plan.jsonl", value)
+    stdout, stderr = planner.communicate(timeout=15)
+    assert planner.returncode == 0, (stdout, stderr)
+    candidates = (root / ".snapshot-gc" / "plans" / "race" / "candidates.bin").read_bytes()
+    assert bytes.fromhex(value) in [candidates[index:index + 32] for index in range(0, len(candidates), 32)]
+    run(binary, "apply", root, "race")
+    assert (root / "blobs" / value).is_file()
+    run(binary, "resume", root, "race")
+    assert (root / "blobs" / value).is_file()
+    assert_live_references(root)
+
+    root = parent / "publish-from-quarantine"
+    fixture(binary, root, unique=100, inventory=104, missing=0)
+    value = hash_number(100)
+    run(binary, "plan", root, "resurrect")
+    run(binary, "apply", root, "resurrect")
+    assert not (root / "blobs" / value).exists()
+    run(binary, "publish", root, "published-after-apply.jsonl", value)
+    assert (root / "blobs" / value).is_file()
+    run(binary, "resume", root, "resurrect")
+    assert (root / "blobs" / value).is_file()
+
+    root = parent / "same-name-publishers"
+    fixture(binary, root, manifests=1, references=2, unique=2, inventory=4, missing=0)
+    first = hash_number(2)
+    second = hash_number(3)
+    lock_path = root / ".snapshot-gc" / "publication.lock"
+    lock_path.parent.mkdir(parents=True, exist_ok=True)
+    with lock_path.open("a+") as publication_lock:
+        fcntl.flock(publication_lock, fcntl.LOCK_EX)
+        publishers = [
+            subprocess.Popen(
+                [str(binary), "publish", str(root), "same.jsonl", value],
+                text=True,
+                stdout=subprocess.PIPE,
+                stderr=subprocess.PIPE,
+            )
+            for value in (first, second)
+        ]
+        deadline = time.monotonic() + 5
+        while len(list((root / "manifests").glob(".same.jsonl.*.tmp"))) != 2:
+            if time.monotonic() >= deadline:
+                raise AssertionError("publishers did not both reach the publication lock")
+            time.sleep(0.01)
+        fcntl.flock(publication_lock, fcntl.LOCK_UN)
+    results = [publisher.communicate(timeout=10) for publisher in publishers]
+    exit_codes = sorted(publisher.returncode for publisher in publishers)
+    assert exit_codes == [0, 1], (exit_codes, results)
+    records = [
+        json.loads(line)["hash"]
+        for line in (root / "manifests" / "same.jsonl").read_text(encoding="utf-8").splitlines()
+    ]
+    assert records in ([first], [second]), records
+
+
+def crash_matrix(binary: Path, parent: Path) -> None:
+    for boundary in range(1, 6):
+        root = parent / f"crash-quarantine-{boundary}"
+        fixture(binary, root, unique=10, inventory=14, references=40, missing=0)
+        run(binary, "plan", root, "crash")
+        environment = os.environ.copy()
+        environment["SNAPSHOT_GC_CRASH_AFTER"] = str(boundary)
+        run(binary, "apply", root, "crash", env=environment, expected=CRASH_EXIT)
+        run(binary, "resume", root, "crash")
+        assert_live_references(root)
+        assert run(binary, "status", root, "crash").stdout.strip().endswith("complete")
+
+    for boundary in range(1, 6):
+        root = parent / f"crash-finalize-{boundary}"
+        fixture(binary, root, unique=10, inventory=14, references=40, missing=0)
+        run(binary, "plan", root, "crash")
+        run(binary, "apply", root, "crash")
+        environment = os.environ.copy()
+        environment["SNAPSHOT_GC_CRASH_AFTER"] = str(boundary)
+        run(binary, "resume", root, "crash", env=environment, expected=CRASH_EXIT)
+        run(binary, "resume", root, "crash")
+        assert_live_references(root)
+        assert run(binary, "status", root, "crash").stdout.strip().endswith("complete")
+
+
+def idempotence(binary: Path, parent: Path) -> None:
+    root = parent / "idempotent"
+    fixture(binary, root)
+    run(binary, "plan", root, "same")
+    run(binary, "plan", root, "same")
+    run(binary, "apply", root, "same")
+    run(binary, "apply", root, "same")
+    run(binary, "resume", root, "same")
+    run(binary, "resume", root, "same")
+    run(binary, "apply", root, "same")
+    assert_live_references(root)
+
+
+def main() -> None:
+    parser = argparse.ArgumentParser()
+    parser.add_argument("binary", type=Path)
+    args = parser.parse_args()
+    binary = args.binary.resolve()
+    with tempfile.TemporaryDirectory(prefix="snapshot-gc-acceptance-") as temporary:
+        parent = Path(temporary)
+        seeded_oracle_matrix(binary, parent)
+        malformed_guards(binary, parent)
+        concurrent_publication(binary, parent)
+        crash_matrix(binary, parent)
+        idempotence(binary, parent)
+    print("acceptance: 30/30 oracle repos, malformed guards, concurrent publication, all crash boundaries, idempotence: PASS")
+
+
+if __name__ == "__main__":
+    main()
diff --git a/developer-simulation/runs/2026-08-02--snapshot-gc-safety/baseline.py b/developer-simulation/runs/2026-08-02--snapshot-gc-safety/baseline.py
new file mode 100755
index 0000000..9b40f10
--- /dev/null
+++ b/developer-simulation/runs/2026-08-02--snapshot-gc-safety/baseline.py
@@ -0,0 +1,88 @@
+#!/usr/bin/env python3
+"""Frozen comparison baseline: the existing in-memory direct-delete collector."""
+
+from __future__ import annotations
+
+import argparse
+import json
+from pathlib import Path
+
+
+def object_hash(number: int) -> str:
+    return f"{number:064x}"
+
+
+def seed(root: Path, references: int, unique: int, inventory: int, manifests: int) -> None:
+    if unique > inventory or references < unique:
+        raise ValueError("require references >= unique and inventory >= unique")
+    manifest_dir = root / "manifests"
+    blob_dir = root / "blobs"
+    manifest_dir.mkdir(parents=True, exist_ok=True)
+    blob_dir.mkdir(parents=True, exist_ok=True)
+    handles = [
+        (manifest_dir / f"snapshot-{index:08}.jsonl").open("w", encoding="utf-8")
+        for index in range(manifests)
+    ]
+    try:
+        for index in range(references):
+            value = index if index < unique else index % unique
+            handles[index % manifests].write(json.dumps({"hash": object_hash(value)}) + "\n")
+    finally:
+        for handle in handles:
+            handle.close()
+    for index in range(inventory):
+        (blob_dir / object_hash(index)).touch()
+
+
+def collect(root: Path) -> tuple[int, int]:
+    # The observed production shape: every reference lives as a Python string
+    # in one set, and collection deletes immediately after the scan.
+    referenced: set[str] = set()
+    manifests = sorted((root / "manifests").glob("*.jsonl"))
+    for manifest in manifests:
+        with manifest.open(encoding="utf-8") as source:
+            for record_number, line in enumerate(source, 1):
+                try:
+                    record = json.loads(line)
+                    value = record["hash"]
+                except (json.JSONDecodeError, KeyError, TypeError) as error:
+                    raise RuntimeError(
+                        f"malformed manifest {manifest} record {record_number}: {error}"
+                    ) from error
+                if not isinstance(value, str) or len(value) != 64:
+                    raise RuntimeError(
+                        f"malformed manifest {manifest} record {record_number}: invalid hash"
+                    )
+                referenced.add(value)
+
+    removed = 0
+    for blob in (root / "blobs").iterdir():
+        if blob.is_file() and blob.name not in referenced:
+            blob.unlink()
+            removed += 1
+    return len(referenced), removed
+
+
+def main() -> None:
+    parser = argparse.ArgumentParser()
+    commands = parser.add_subparsers(dest="command", required=True)
+    seed_parser = commands.add_parser("seed")
+    seed_parser.add_argument("root", type=Path)
+    seed_parser.add_argument("--references", type=int, default=1_000)
+    seed_parser.add_argument("--unique", type=int, default=250)
+    seed_parser.add_argument("--inventory", type=int, default=300)
+    seed_parser.add_argument("--manifests", type=int, default=10)
+    collect_parser = commands.add_parser("collect")
+    collect_parser.add_argument("root", type=Path)
+    args = parser.parse_args()
+
+    if args.command == "seed":
+        seed(args.root, args.references, args.unique, args.inventory, args.manifests)
+        print(f"seeded {args.root}")
+    else:
+        referenced, removed = collect(args.root)
+        print(f"loaded {referenced} unique references; directly removed {removed} blobs")
+
+
+if __name__ == "__main__":
+    main()
diff --git a/developer-simulation/runs/2026-08-02--snapshot-gc-safety/measure.py b/developer-simulation/runs/2026-08-02--snapshot-gc-safety/measure.py
new file mode 100644
index 0000000..3732551
--- /dev/null
+++ b/developer-simulation/runs/2026-08-02--snapshot-gc-safety/measure.py
@@ -0,0 +1,79 @@
+#!/usr/bin/env python3
+"""Run one command and report wall time, peak RSS, and optional peak scratch bytes."""
+
+from __future__ import annotations
+
+import argparse
+import json
+import os
+from pathlib import Path
+import resource
+import subprocess
+import sys
+import threading
+import time
+
+
+def logical_size(root: Path) -> int:
+    total = 0
+    if not root.exists():
+        return total
+    for directory, _subdirectories, files in os.walk(root):
+        for name in files:
+            try:
+                total += (Path(directory) / name).stat().st_size
+            except FileNotFoundError:
+                pass
+    return total
+
+
+def main() -> None:
+    parser = argparse.ArgumentParser()
+    parser.add_argument("--scratch", type=Path)
+    parser.add_argument("command", nargs=argparse.REMAINDER)
+    args = parser.parse_args()
+    command = args.command
+    if command and command[0] == "--":
+        command = command[1:]
+    if not command:
+        parser.error("a command is required after --")
+
+    peak_scratch = 0
+    stop = threading.Event()
+
+    def monitor() -> None:
+        nonlocal peak_scratch
+        if args.scratch is None:
+            return
+        while not stop.wait(0.01):
+            peak_scratch = max(peak_scratch, logical_size(args.scratch))
+
+    watcher = threading.Thread(target=monitor, daemon=True)
+    watcher.start()
+    started = time.monotonic()
+    result = subprocess.run(command, check=False)
+    wall_seconds = time.monotonic() - started
+    stop.set()
+    watcher.join()
+    if args.scratch is not None:
+        peak_scratch = max(peak_scratch, logical_size(args.scratch))
+
+    peak_rss = resource.getrusage(resource.RUSAGE_CHILDREN).ru_maxrss
+    if sys.platform.startswith("linux"):
+        peak_rss *= 1024
+    print(
+        json.dumps(
+            {
+                "exit": result.returncode,
+                "wall_seconds": round(wall_seconds, 3),
+                "peak_rss_bytes": peak_rss,
+                "peak_scratch_bytes": peak_scratch,
+            },
+            sort_keys=True,
+        )
+    )
+    raise SystemExit(result.returncode)
+
+
+if __name__ == "__main__":
+    main()
diff --git a/developer-simulation/runs/2026-08-02--snapshot-gc-safety/src/main.rs b/developer-simulation/runs/2026-08-02--snapshot-gc-safety/src/main.rs
new file mode 100644
index 0000000..eea7ab5
--- /dev/null
+++ b/developer-simulation/runs/2026-08-02--snapshot-gc-safety/src/main.rs
@@ -0,0 +1,955 @@
+use std::cmp::Reverse;
+use std::collections::{BinaryHeap, HashSet};
+use std::env;
+use std::error::Error;
+use std::fmt::Write as _;
+use std::fs::{self, File, OpenOptions};
+use std::io::{self, BufRead, BufReader, BufWriter, Read, Write};
+use std::path::{Path, PathBuf};
+use std::process;
+use std::thread;
+use std::time::{Duration, Instant};
+
+type AnyResult<T> = Result<T, Box<dyn Error>>;
+type Hash = [u8; 32];
+
+const CHUNK_HASHES: usize = 65_536;
+const CRASH_EXIT: i32 = 86;
+
+fn main() {
+    if let Err(error) = run() {
+        eprintln!("error: {error}");
+        process::exit(1);
+    }
+}
+
+fn run() -> AnyResult<()> {
+    let mut args = env::args().skip(1);
+    let command = args.next().ok_or_else(usage)?;
+    match command.as_str() {
+        "fixture" => {
+            let root = required_path(&mut args, "fixture root")?;
+            let config = FixtureConfig::parse(args)?;
+            fixture(&root, &config)
+        }
+        "plan" => {
+            let root = required_path(&mut args, "repository root")?;
+            let plan = required_arg(&mut args, "plan name")?;
+            no_extra(args)?;
+            create_plan(&root, &plan)
+        }
+        "apply" => {
+            let root = required_path(&mut args, "repository root")?;
+            let plan = required_arg(&mut args, "plan name")?;
+            no_extra(args)?;
+            apply(&root, &plan)
+        }
+        "resume" => {
+            let root = required_path(&mut args, "repository root")?;
+            let plan = required_arg(&mut args, "plan name")?;
+            no_extra(args)?;
+            resume(&root, &plan)
+        }
+        "verify-plan" => {
+            let root = required_path(&mut args, "repository root")?;
+            let plan = required_arg(&mut args, "plan name")?;
+            no_extra(args)?;
+            verify_plan(&root, &plan)
+        }
+        "publish" => {
+            let root = required_path(&mut args, "repository root")?;
+            let manifest = required_arg(&mut args, "manifest file name")?;
+            let hashes: Vec<String> = args.collect();
+            publish(&root, &manifest, &hashes)
+        }
+        "status" => {
+            let root = required_path(&mut args, "repository root")?;
+            let plan = required_arg(&mut args, "plan name")?;
+            no_extra(args)?;
+            status(&root, &plan)
+        }
+        _ => Err(usage().into()),
+    }
+}
+
+fn usage() -> String {
+    "usage: snapshot-gc-safety <fixture|plan|apply|resume|verify-plan|publish|status> ..."
+        .to_owned()
+}
+
+fn required_arg(args: &mut impl Iterator<Item = String>, label: &str) -> AnyResult<String> {
+    args.next().ok_or_else(|| format!("missing {label}").into())
+}
+
+fn required_path(args: &mut impl Iterator<Item = String>, label: &str) -> AnyResult<PathBuf> {
+    Ok(PathBuf::from(required_arg(args, label)?))
+}
+
+fn no_extra(mut args: impl Iterator<Item = String>) -> AnyResult<()> {
+    if let Some(extra) = args.next() {
+        Err(format!("unexpected argument: {extra}").into())
+    } else {
+        Ok(())
+    }
+}
+
+#[derive(Debug)]
+struct FixtureConfig {
+    manifests: usize,
+    references: usize,
+    unique: usize,
+    inventory: usize,
+    missing: usize,
+}
+
+impl Default for FixtureConfig {
+    fn default() -> Self {
+        Self {
+            manifests: 10_000,
+            references: 1_000_000,
+            unique: 250_000,
+            inventory: 300_000,
+            missing: 1_000,
+        }
+    }
+}
+
+impl FixtureConfig {
+    fn parse(mut args: impl Iterator<Item = String>) -> AnyResult<Self> {
+        let mut config = Self::default();
+        while let Some(flag) = args.next() {
+            let value = args
+                .next()
+                .ok_or_else(|| format!("missing value for {flag}"))?
+                .parse::<usize>()?;
+            match flag.as_str() {
+                "--manifests" => config.manifests = value,
+                "--references" => config.references = value,
+                "--unique" => config.unique = value,
+                "--inventory" => config.inventory = value,
+                "--missing" => config.missing = value,
+                _ => return Err(format!("unknown fixture flag: {flag}").into()),
+            }
+        }
+        if config.manifests == 0
+            || config.unique == 0
+            || config.references < config.unique
+            || config.inventory < config.unique - config.missing
+            || config.missing > config.unique
+        {
+            return Err("invalid fixture dimensions".into());
+        }
+        Ok(config)
+    }
+}
+
+fn fixture(root: &Path, config: &FixtureConfig) -> AnyResult<()> {
+    if root.exists() && fs::read_dir(root)?.next().is_some() {
+        return Err(format!("fixture root must be absent or empty: {}", root.display()).into());
+    }
+    let manifests = root.join("manifests");
+    let blobs = root.join("blobs");
+    fs::create_dir_all(&manifests)?;
+    fs::create_dir_all(&blobs)?;
+
+    let per_manifest = config.references.div_ceil(config.manifests);
+    let mut record = 0_usize;
+    for manifest_number in 0..config.manifests {
+        let path = manifests.join(format!("snapshot-{manifest_number:08}.jsonl"));
+        let mut output = BufWriter::new(File::create(path)?);
+        for _ in 0..per_manifest {
+            if record == config.references {
+                break;
+            }
+            let object = if record < config.unique {
+                record
+            } else {
+                record % config.unique
+            };
+            writeln!(output, "{{\"hash\":\"{}\"}}", hash_number(object))?;
+            record += 1;
+        }
+    }
+
+    let referenced_present = config.unique - config.missing;
+    for object in 0..referenced_present {
+        File::create(blobs.join(hash_number(object)))?;
+    }
+    let unreachable = config.inventory - referenced_present;
+    for offset in 0..unreachable {
+        File::create(blobs.join(hash_number(config.unique + offset)))?;
+    }
+    sync_directory(&manifests)?;
+    sync_directory(&blobs)?;
+    println!(
+        "fixture: {} manifests, {} references, {} unique, {} inventory, {} missing, {} unreachable",
+        config.manifests,
+        config.references,
+        config.unique,
+        config.inventory,
+        config.missing,
+        unreachable
+    );
+    Ok(())
+}
+
+fn hash_number(value: usize) -> String {
+    format!("{value:064x}")
+}
+
+fn state_root(root: &Path) -> PathBuf {
+    root.join(".snapshot-gc")
+}
+
+fn plan_dir(root: &Path, plan: &str) -> AnyResult<PathBuf> {
+    validate_name(plan, "plan")?;
+    Ok(state_root(root).join("plans").join(plan))
+}
+
+fn validate_name(name: &str, kind: &str) -> AnyResult<()> {
+    if name.is_empty()
+        || name.len() > 100
+        || !name
+            .bytes()
+            .all(|byte| byte.is_ascii_alphanumeric() || matches!(byte, b'-' | b'_' | b'.'))
+        || name == "."
+        || name == ".."
+    {
+        return Err(format!("invalid {kind} name: {name}").into());
+    }
+    Ok(())
+}
+
+fn create_plan(root: &Path, plan: &str) -> AnyResult<()> {
+    let started = Instant::now();
+    validate_repository(root)?;
+    let final_dir = plan_dir(root, plan)?;
+    if final_dir.join("meta.json").is_file() {
+        println!("plan {plan} already exists; unchanged");
+        return Ok(());
+    }
+    let plans = final_dir
+        .parent()
+        .ok_or("plan path has no parent")?
+        .to_path_buf();
+    fs::create_dir_all(&plans)?;
+    let building = plans.join(format!(".{plan}.building"));
+    if building.exists() {
+        fs::remove_dir_all(&building)?;
+    }
+    fs::create_dir(&building)?;
+
+    let result = build_plan(root, plan, &building, started);
+    if let Err(error) = result {
+        let _ = fs::remove_dir_all(&building);
+        return Err(error);
+    }
+    fs::rename(&building, &final_dir)?;
+    sync_directory(&plans)?;
+    println!("plan {plan} committed at {}", final_dir.display());
+    Ok(())
+}
+
+fn build_plan(root: &Path, plan: &str, building: &Path, started: Instant) -> AnyResult<()> {
+    let manifests = committed_manifests(root)?;
+    let mut manifest_set = BufWriter::new(File::create(building.join("manifest-set.txt"))?);
+    for manifest in &manifests {
+        let metadata = fs::metadata(manifest)?;
+        writeln!(
+            manifest_set,
+            "{}\t{}",
+            metadata.len(),
+            manifest
+                .file_name()
+                .ok_or("manifest has no file name")?
+                .to_string_lossy()
+        )?;
+    }
+    manifest_set.flush()?;
+
+    let references_path = building.join("references.bin");
+    let reference_records = build_references(&manifests, building, &references_path)?;
+
+    if let Ok(value) = env::var("SNAPSHOT_GC_TEST_PAUSE_BEFORE_CANDIDATES_MS") {
+        thread::sleep(Duration::from_millis(value.parse()?));
+    }
+
+    let inventory_path = building.join("inventory.bin");
+    let inventory_count = build_inventory(root, building, &inventory_path)?;
+    let candidates_path = building.join("candidates.bin");
+    let (unique_references, candidates) =
+        sorted_difference(&inventory_path, &references_path, &candidates_path)?;
+    fs::remove_file(inventory_path)?;
+
+    let meta = serde_json::json!({
+        "version": 1,
+        "plan": plan,
+        "manifests": manifests.len(),
+        "reference_records": reference_records,
+        "unique_references": unique_references,
+        "inventory": inventory_count,
+        "candidates": candidates,
+        "elapsed_ms": started.elapsed().as_millis(),
+    });
+    let mut meta_file = File::create(building.join("meta.json"))?;
+    serde_json::to_writer_pretty(&mut meta_file, &meta)?;
+    writeln!(meta_file)?;
+    meta_file.sync_all()?;
+    sync_directory(building)?;
+    println!(
+        "planned {candidates} candidates from {reference_records} records and {inventory_count} blobs in {:.3}s",
+        started.elapsed().as_secs_f64()
+    );
+    Ok(())
+}
+
+fn validate_repository(root: &Path) -> AnyResult<()> {
+    for name in ["manifests", "blobs"] {
+        let path = root.join(name);
+        if !path.is_dir() {
+            return Err(format!("missing directory: {}", path.display()).into());
+        }
+    }
+    Ok(())
+}
+
+fn committed_manifests(root: &Path) -> AnyResult<Vec<PathBuf>> {
+    let mut paths = Vec::new();
+    for entry in fs::read_dir(root.join("manifests"))? {
+        let entry = entry?;
+        let file_type = entry.file_type()?;
+        if file_type.is_file()
+            && entry
+                .path()
+                .extension()
+                .is_some_and(|value| value == "jsonl")
+        {
+            paths.push(entry.path());
+        }
+    }
+    paths.sort();
+    Ok(paths)
+}
+
+fn build_references(manifests: &[PathBuf], scratch: &Path, output: &Path) -> AnyResult<u64> {
+    let chunks = scratch.join("reference-chunks");
+    let mut sorter = HashSorter::new(&chunks)?;
+    let mut records = 0_u64;
+    for manifest in manifests {
+        let before = fs::metadata(manifest)?;
+        let source = File::open(manifest)?;
+        let mut reader = BufReader::new(source);
+        let mut line = Vec::new();
+        let mut record_number = 0_u64;
+        loop {
+            line.clear();
+            let bytes = reader.read_until(b'\n', &mut line)?;
+            if bytes == 0 {
+                break;
+            }
+            record_number += 1;
+            if line.last() != Some(&b'\n') {
+                return Err(malformed(manifest, record_number, "truncated JSONL record"));
+            }
+            line.pop();
+            if line.last() == Some(&b'\r') {
+                line.pop();
+            }
+            let value: serde_json::Value = serde_json::from_slice(&line)
+                .map_err(|error| malformed(manifest, record_number, &error.to_string()))?;
+            let hash = value
+                .as_object()
+                .and_then(|object| object.get("hash"))
+                .and_then(serde_json::Value::as_str)
+                .ok_or_else(|| malformed(manifest, record_number, "missing string field `hash`"))?;
+            sorter.push(parse_hash(hash).map_err(|error| {
+                malformed(manifest, record_number, &format!("invalid hash: {error}"))
+            })?)?;
+            records += 1;
+        }
+        let after = fs::metadata(manifest)?;
+        if before.len() != after.len() || before.modified()? != after.modified()? {
+            return Err(malformed(
+                manifest,
+                record_number.max(1),
+                "manifest changed while being read",
+            ));
+        }
+    }
+    sorter.finish(output)?;
+    Ok(records)
+}
+
+fn malformed(path: &Path, record: u64, detail: &str) -> Box<dyn Error> {
+    format!(
+        "malformed committed manifest {} record {record}: {detail}",
+        path.display()
+    )
+    .into()
+}
+
+fn build_inventory(root: &Path, scratch: &Path, output: &Path) -> AnyResult<u64> {
+    let chunks = scratch.join("inventory-chunks");
+    let mut sorter = HashSorter::new(&chunks)?;
+    let mut count = 0_u64;
+    for entry in fs::read_dir(root.join("blobs"))? {
+        let entry = entry?;
+        if !entry.file_type()?.is_file() {
+            continue;
+        }
+        let name = entry.file_name();
+        let Some(name) = name.to_str() else {
+            continue;
+        };
+        if let Ok(hash) = parse_hash(name) {
+            sorter.push(hash)?;
+            count += 1;
+        }
+    }
+    sorter.finish(output)?;
+    Ok(count)
+}
+
+struct HashSorter {
+    directory: PathBuf,
+    buffer: Vec<Hash>,
+    chunks: Vec<PathBuf>,
+}
+
+impl HashSorter {
+    fn new(directory: &Path) -> AnyResult<Self> {
+        if directory.exists() {
+            fs::remove_dir_all(directory)?;
+        }
+        fs::create_dir(directory)?;
+        Ok(Self {
+            directory: directory.to_path_buf(),
+            buffer: Vec::with_capacity(CHUNK_HASHES),
+            chunks: Vec::new(),
+        })
+    }
+
+    fn push(&mut self, hash: Hash) -> AnyResult<()> {
+        self.buffer.push(hash);
+        if self.buffer.len() == CHUNK_HASHES {
+            self.flush()?;
+        }
+        Ok(())
+    }
+
+    fn flush(&mut self) -> AnyResult<()> {
+        if self.buffer.is_empty() {
+            return Ok(());
+        }
+        self.buffer.sort_unstable();
+        self.buffer.dedup();
+        let path = self
+            .directory
+            .join(format!("chunk-{:08}.bin", self.chunks.len()));
+        let mut output = BufWriter::new(File::create(&path)?);
+        for hash in &self.buffer {
+            output.write_all(hash)?;
+        }
+        output.flush()?;
+        self.chunks.push(path);
+        self.buffer.clear();
+        Ok(())
+    }
+
+    fn finish(mut self, output: &Path) -> AnyResult<u64> {
+        self.flush()?;
+        let mut readers: Vec<BufReader<File>> = self
+            .chunks
+            .iter()
+            .map(File::open)
+            .collect::<io::Result<Vec<_>>>()?
+            .into_iter()
+            .map(BufReader::new)
+            .collect();
+        let mut heap = BinaryHeap::new();
+        for (index, reader) in readers.iter_mut().enumerate() {
+            if let Some(hash) = read_hash(reader)? {
+                heap.push(Reverse((hash, index)));
+            }
+        }
+        let mut destination = BufWriter::new(File::create(output)?);
+        let mut last = None;
+        let mut count = 0_u64;
+        while let Some(Reverse((hash, index))) = heap.pop() {
+            if last != Some(hash) {
+                destination.write_all(&hash)?;
+                last = Some(hash);
+                count += 1;
+            }
+            if let Some(next) = read_hash(&mut readers[index])? {
+                heap.push(Reverse((next, index)));
+            }
+        }
+        destination.flush()?;
+        destination.get_ref().sync_all()?;
+        drop(destination);
+        drop(readers);
+        fs::remove_dir_all(&self.directory)?;
+        Ok(count)
+    }
+}
+
+fn read_hash(reader: &mut impl Read) -> io::Result<Option<Hash>> {
+    let mut hash = [0_u8; 32];
+    let mut read = 0;
+    while read < hash.len() {
+        let bytes = reader.read(&mut hash[read..])?;
+        if bytes == 0 {
+            if read == 0 {
+                return Ok(None);
+            }
+            return Err(io::Error::new(
+                io::ErrorKind::UnexpectedEof,
+                "partial binary hash",
+            ));
+        }
+        read += bytes;
+    }
+    Ok(Some(hash))
+}
+
+fn sorted_difference(inventory: &Path, references: &Path, output: &Path) -> AnyResult<(u64, u64)> {
+    let mut inventory = BufReader::new(File::open(inventory)?);
+    let mut references = BufReader::new(File::open(references)?);
+    let mut output = BufWriter::new(File::create(output)?);
+    let mut reference = read_hash(&mut references)?;
+    let mut unique_references = u64::from(reference.is_some());
+    let mut candidates = 0_u64;
+    while let Some(hash) = read_hash(&mut inventory)? {
+        while reference.is_some_and(|value| value < hash) {
+            reference = read_hash(&mut references)?;
+            unique_references += u64::from(reference.is_some());
+        }
+        if reference != Some(hash) {
+            output.write_all(&hash)?;
+            candidates += 1;
+        }
+    }
+    while read_hash(&mut references)?.is_some() {
+        unique_references += 1;
+    }
+    output.flush()?;
+    output.get_ref().sync_all()?;
+    Ok((unique_references, candidates))
+}
+
+fn parse_hash(value: &str) -> AnyResult<Hash> {
+    if value.len() != 64 || !value.bytes().all(|byte| byte.is_ascii_hexdigit()) {
+        return Err("expected exactly 64 hexadecimal characters".into());
+    }
+    let mut hash = [0_u8; 32];
+    for (index, pair) in value.as_bytes().chunks_exact(2).enumerate() {
+        hash[index] = (hex_value(pair[0])? << 4) | hex_value(pair[1])?;
+    }
+    Ok(hash)
+}
+
+fn hex_value(byte: u8) -> AnyResult<u8> {
+    match byte {
+        b'0'..=b'9' => Ok(byte - b'0'),
+        b'a'..=b'f' => Ok(byte - b'a' + 10),
+        b'A'..=b'F' => Ok(byte - b'A' + 10),
+        _ => Err("non-hexadecimal character".into()),
+    }
+}
+
+fn display_hash(hash: &Hash) -> String {
+    let mut value = String::with_capacity(64);
+    for byte in hash {
+        write!(value, "{byte:02x}").expect("writing into a String cannot fail");
+    }
+    value
+}
+
+fn lock_publication(root: &Path) -> AnyResult<File> {
+    let state = state_root(root);
+    fs::create_dir_all(&state)?;
+    let lock = OpenOptions::new()
+        .read(true)
+        .write(true)
+        .create(true)
+        .truncate(false)
+        .open(state.join("publication.lock"))?;
+    lock.lock()?;
+    Ok(lock)
+}
+
+fn apply(root: &Path, plan: &str) -> AnyResult<()> {
+    validate_repository(root)?;
+    let directory = require_plan(root, plan)?;
+    if directory.join("complete").is_file() {
+        println!("plan {plan} is already complete; unchanged");
+        return Ok(());
+    }
+    if directory.join("quarantined").is_file() {
+        println!("plan {plan} is already quarantined; run resume to finalize");
+        return Ok(());
+    }
+    quarantine_phase(
+        root,
+        plan,
+        &directory,
+        &mut CrashInjector::from_environment(),
+    )
+}
+
+fn resume(root: &Path, plan: &str) -> AnyResult<()> {
+    validate_repository(root)?;
+    let directory = require_plan(root, plan)?;
+    if directory.join("complete").is_file() {
+        println!("plan {plan} is already complete; unchanged");
+        return Ok(());
+    }
+    let mut crashes = CrashInjector::from_environment();
+    if !directory.join("quarantined").is_file() {
+        quarantine_phase(root, plan, &directory, &mut crashes)?;
+    }
+    finalize_phase(root, plan, &directory, &mut crashes)
+}
+
+fn require_plan(root: &Path, plan: &str) -> AnyResult<PathBuf> {
+    let directory = plan_dir(root, plan)?;
+    if !directory.join("meta.json").is_file() || !directory.join("candidates.bin").is_file() {
+        return Err(format!("plan {plan} does not exist or is incomplete").into());
+    }
+    Ok(directory)
+}
+
+fn quarantine_phase(
+    root: &Path,
+    plan: &str,
+    directory: &Path,
+    crashes: &mut CrashInjector,
+) -> AnyResult<()> {
+    let started = Instant::now();
+    let _lock = lock_publication(root)?;
+    let live = rebuild_live_references(root, directory)?;
+    let quarantine = directory.join("quarantine");
+    fs::create_dir_all(&quarantine)?;
+    let mut candidates = BufReader::new(File::open(directory.join("candidates.bin"))?);
+    let mut references = SortedMembership::new(&live)?;
+    let mut moved = 0_u64;
+    while let Some(hash) = read_hash(&mut candidates)? {
+        let source = root.join("blobs").join(display_hash(&hash));
+        let target = quarantine.join(display_hash(&hash));
+        if references.contains(hash)? {
+            if target.is_file() && !source.exists() {
+                fs::rename(&target, &source)?;
+                crashes.boundary("quarantine-live-restore");
+            }
+        } else if source.is_file() && !target.exists() {
+            fs::rename(&source, &target)?;
+            moved += 1;
+            crashes.boundary("quarantine-move");
+        }
+    }
+    write_marker(&directory.join("quarantined"), &format!("moved={moved}\n"))?;
+    crashes.boundary("quarantine-marker");
+    println!(
+        "apply {plan}: quarantined {moved} blobs in {:.3}s; run resume to finalize",
+        started.elapsed().as_secs_f64()
+    );
+    Ok(())
+}
+
+fn finalize_phase(
+    root: &Path,
+    plan: &str,
+    directory: &Path,
+    crashes: &mut CrashInjector,
+) -> AnyResult<()> {
+    let started = Instant::now();
+    let _lock = lock_publication(root)?;
+    let live = rebuild_live_references(root, directory)?;
+    let quarantine = directory.join("quarantine");
+    fs::create_dir_all(&quarantine)?;
+    let mut candidates = BufReader::new(File::open(directory.join("candidates.bin"))?);
+    let mut references = SortedMembership::new(&live)?;
+    let mut removed = 0_u64;
+    let mut restored = 0_u64;
+    while let Some(hash) = read_hash(&mut candidates)? {
+        let source = quarantine.join(display_hash(&hash));
+        if !source.is_file() {
+            continue;
+        }
+        let live_blob = root.join("blobs").join(display_hash(&hash));
+        if references.contains(hash)? {
+            if !live_blob.exists() {
+                fs::rename(&source, &live_blob)?;
+                restored += 1;
+                crashes.boundary("finalize-live-restore");
+            }
+        } else {
+            fs::remove_file(&source)?;
+            removed += 1;
+            crashes.boundary("finalize-remove");
+        }
+    }
+    write_marker(
+        &directory.join("complete"),
+        &format!("removed={removed}\nrestored={restored}\n"),
+    )?;
+    crashes.boundary("complete-marker");
+    println!(
+        "resume {plan}: removed {removed}, restored {restored} in {:.3}s",
+        started.elapsed().as_secs_f64()
+    );
+    Ok(())
+}
+
+fn rebuild_live_references(root: &Path, directory: &Path) -> AnyResult<PathBuf> {
+    let manifests = committed_manifests(root)?;
+    let scratch = directory.join("live-build");
+    if scratch.exists() {
+        fs::remove_dir_all(&scratch)?;
+    }
+    fs::create_dir(&scratch)?;
+    let output = directory.join("live-references.bin");
+    let result = build_references(&manifests, &scratch, &output);
+    let _ = fs::remove_dir_all(&scratch);
+    result?;
+    Ok(output)
+}
+
+struct SortedMembership {
+    reader: BufReader<File>,
+    current: Option<Hash>,
+}
+
+impl SortedMembership {
+    fn new(path: &Path) -> AnyResult<Self> {
+        let mut reader = BufReader::new(File::open(path)?);
+        let current = read_hash(&mut reader)?;
+        Ok(Self { reader, current })
+    }
+
+    fn contains(&mut self, wanted: Hash) -> AnyResult<bool> {
+        while self.current.is_some_and(|value| value < wanted) {
+            self.current = read_hash(&mut self.reader)?;
+        }
+        Ok(self.current == Some(wanted))
+    }
+}
+
+struct CrashInjector {
+    crash_after: Option<u64>,
+    boundaries: u64,
+}
+
+impl CrashInjector {
+    fn from_environment() -> Self {
+        let crash_after = env::var("SNAPSHOT_GC_CRASH_AFTER")
+            .ok()
+            .and_then(|value| value.parse().ok());
+        Self {
+            crash_after,
+            boundaries: 0,
+        }
+    }
+
+    fn boundary(&mut self, label: &str) {
+        self.boundaries += 1;
+        if self.crash_after == Some(self.boundaries) {
+            eprintln!(
+                "injected crash after boundary {} ({label})",
+                self.boundaries
+            );
+            process::exit(CRASH_EXIT);
+        }
+    }
+}
+
+fn write_marker(path: &Path, contents: &str) -> AnyResult<()> {
+    let file_name = path.file_name().ok_or("marker has no file name")?;
+    let temporary = path.with_file_name(format!(".{}.tmp", file_name.to_string_lossy()));
+    let mut file = File::create(&temporary)?;
+    file.write_all(contents.as_bytes())?;
+    file.sync_all()?;
+    fs::rename(&temporary, path)?;
+    sync_directory(path.parent().ok_or("marker has no parent")?)?;
+    Ok(())
+}
+
+fn publish(root: &Path, manifest: &str, values: &[String]) -> AnyResult<()> {
+    validate_repository(root)?;
+    validate_name(manifest, "manifest")?;
+    if Path::new(manifest)
+        .extension()
+        .is_none_or(|value| value != "jsonl")
+    {
+        return Err("published manifest name must end in .jsonl".into());
+    }
+    if values.is_empty() {
+        return Err("publish requires at least one hash".into());
+    }
+    let hashes: Vec<Hash> = values
+        .iter()
+        .map(|value| parse_hash(value))
+        .collect::<AnyResult<Vec<_>>>()?;
+    let manifests = root.join("manifests");
+    let final_path = manifests.join(manifest);
+    let temporary = manifests.join(format!(".{manifest}.{}.tmp", process::id()));
+    let mut output = BufWriter::new(File::create(&temporary)?);
+    for value in values {
+        writeln!(output, "{{\"hash\":\"{}\"}}", value.to_ascii_lowercase())?;
+    }
+    output.flush()?;
+    output.get_ref().sync_all()?;
+
+    let _lock = lock_publication(root)?;
+    if final_path.exists() {
+        let _ = fs::remove_file(&temporary);
+        return Err(format!("manifest already exists: {}", final_path.display()).into());
+    }
+    for hash in hashes {
+        ensure_blob_available(root, &hash)?;
+    }
+    fs::rename(&temporary, &final_path)?;
+    sync_directory(&manifests)?;
+    println!("published {}", final_path.display());
+    Ok(())
+}
+
+fn ensure_blob_available(root: &Path, hash: &Hash) -> AnyResult<()> {
+    let name = display_hash(hash);
+    let live = root.join("blobs").join(&name);
+    if live.is_file() {
+        return Ok(());
+    }
+    let plans = state_root(root).join("plans");
+    if plans.is_dir() {
+        for entry in fs::read_dir(plans)? {
+            let candidate = entry?.path().join("quarantine").join(&name);
+            if candidate.is_file() {
+                fs::rename(&candidate, &live)?;
+                sync_directory(candidate.parent().ok_or("quarantine has no parent")?)?;
+                sync_directory(&root.join("blobs"))?;
+                return Ok(());
+            }
+        }
+    }
+    Err(format!("cannot publish reference to unavailable blob {name}").into())
+}
+
+fn verify_plan(root: &Path, plan: &str) -> AnyResult<()> {
+    validate_repository(root)?;
+    let directory = require_plan(root, plan)?;
+    let mut referenced = HashSet::new();
+    for manifest in committed_manifests(root)? {
+        load_manifest_for_oracle(&manifest, &mut referenced)?;
+    }
+    let mut planned = HashSet::new();
+    let mut reader = BufReader::new(File::open(directory.join("candidates.bin"))?);
+    while let Some(hash) = read_hash(&mut reader)? {
+        planned.insert(hash);
+    }
+    let mut eligible = 0_usize;
+    for entry in fs::read_dir(root.join("blobs"))? {
+        let entry = entry?;
+        if !entry.file_type()?.is_file() {
+            continue;
+        }
+        let Some(name) = entry.file_name().to_str().map(ToOwned::to_owned) else {
+            continue;
+        };
+        let Ok(hash) = parse_hash(&name) else {
+            continue;
+        };
+        if !referenced.contains(&hash) {
+            eligible += 1;
+            if !planned.remove(&hash) {
+                return Err(
+                    format!("oracle mismatch: eligible blob {name} is absent from plan").into(),
+                );
+            }
+        } else if planned.contains(&hash) {
+            return Err(format!("oracle mismatch: referenced blob {name} is in plan").into());
+        }
+    }
+    if let Some(extra) = planned.iter().next() {
+        return Err(format!(
+            "oracle mismatch: non-inventory candidate {}",
+            display_hash(extra)
+        )
+        .into());
+    }
+    println!(
+        "oracle match: all {eligible} eligible unreachable blobs selected; zero referenced blobs selected"
+    );
+    Ok(())
+}
+
+fn load_manifest_for_oracle(path: &Path, referenced: &mut HashSet<Hash>) -> AnyResult<()> {
+    let mut reader = BufReader::new(File::open(path)?);
+    let mut line = String::new();
+    let mut record = 0_u64;
+    loop {
+        line.clear();
+        let bytes = reader.read_line(&mut line)?;
+        if bytes == 0 {
+            break;
+        }
+        record += 1;
+        if !line.ends_with('\n') {
+            return Err(malformed(path, record, "truncated JSONL record"));
+        }
+        let value: serde_json::Value = serde_json::from_str(&line)
+            .map_err(|error| malformed(path, record, &error.to_string()))?;
+        let hash = value
+            .get("hash")
+            .and_then(serde_json::Value::as_str)
+            .ok_or_else(|| malformed(path, record, "missing string field `hash`"))?;
+        referenced.insert(parse_hash(hash)?);
+    }
+    Ok(())
+}
+
+fn status(root: &Path, plan: &str) -> AnyResult<()> {
+    let directory = require_plan(root, plan)?;
+    let phase = if directory.join("complete").is_file() {
+        "complete"
+    } else if directory.join("quarantined").is_file() {
+        "quarantined"
+    } else {
+        "planned"
+    };
+    println!("plan {plan}: {phase}");
+    Ok(())
+}
+
+fn sync_directory(path: &Path) -> io::Result<()> {
+    File::open(path)?.sync_all()
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn hash_round_trip_and_case_normalization() {
+        let input = "0123456789abcdef0123456789ABCDEF0123456789abcdef0123456789ABCDEF";
+        let parsed = parse_hash(input).unwrap();
+        assert_eq!(
+            display_hash(&parsed),
+            "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+        );
+    }
+
+    #[test]
+    fn rejects_wrong_hash_shapes() {
+        assert!(parse_hash("abc").is_err());
+        assert!(parse_hash(&"z".repeat(64)).is_err());
+    }
+
+    #[test]
+    fn validates_names() {
+        assert!(validate_name("nightly-2026_08.02", "plan").is_ok());
+        assert!(validate_name("../escape", "plan").is_err());
+        assert!(validate_name("", "plan").is_err());
+    }
+}
diff --git a/developer-simulation/runs/2026-08-03--offline-door-policy-update/Cargo.toml b/developer-simulation/runs/2026-08-03--offline-door-policy-update/Cargo.toml
new file mode 100644
index 0000000..4b4c703
--- /dev/null
+++ b/developer-simulation/runs/2026-08-03--offline-door-policy-update/Cargo.toml
@@ -0,0 +1,13 @@
+[package]
+name = "offline-door-policy-fit-probe"
+version = "0.1.0"
+edition = "2024"
+publish = false
+
+[dependencies]
+fold = { path = "../../../fold" }
+libc = "0.2"
+serde = { version = "1", features = ["derive"] }
+
+[lints.clippy]
+all = "deny"
diff --git a/developer-simulation/runs/2026-08-03--offline-door-policy-update/README.md b/developer-simulation/runs/2026-08-03--offline-door-policy-update/README.md
new file mode 100644
index 0000000..3654783
--- /dev/null
+++ b/developer-simulation/runs/2026-08-03--offline-door-policy-update/README.md
@@ -0,0 +1,53 @@
+# Offline door policy update
+
+This is a host-side fit probe for frequent offline door-controller policy
+updates. Fold successfully applies grant retractions and policy-version metadata
+in one logical transaction, but the stated controller requires a fixed 16 MiB
+flash image, a 4 MiB working-memory bound, signed and truncation-safe delivery,
+and old-or-new recovery after every modeled 4 KiB write.
+
+The reviewed conclusion is no fit for the controller. Fold uses a
+filesystem-backed embedded store and does not expose the required raw-block fault
+model. No BogKit correctness defect was found.
+
+## Reproduce
+
+Run from the repository root. The binary requires an empty caller-supplied state
+directory, so tests and demonstrations never generate databases inside the
+archive.
+
+```sh
+export CARGO_TARGET_DIR=/private/tmp/offline-door-policy-target
+cargo fmt --manifest-path developer-simulation/Cargo.toml \
+  -p offline-door-policy-fit-probe -- --check
+cargo test --manifest-path developer-simulation/Cargo.toml \
+  -p offline-door-policy-fit-probe --offline --locked
+cargo clippy --manifest-path developer-simulation/Cargo.toml \
+  -p offline-door-policy-fit-probe --all-targets --offline --locked -- -D warnings
+cargo build --manifest-path developer-simulation/Cargo.toml \
+  -p offline-door-policy-fit-probe --release --offline --locked
+
+DOOR_ROOT="$(mktemp -d /private/tmp/offline-door-policy.XXXXXX)"
+"$CARGO_TARGET_DIR/release/offline-door-policy-fit-probe" "$DOOR_ROOT"
+```
+
+Expected evidence includes:
+
+- zero mismatches across 40,000 generated authorization queries;
+- 50,000 revoked grants applied within the two-second host criterion;
+- a wrong-base next version rejected as `BaseMismatch` without mutation;
+- same-version delivery labeled `SameVersionIgnoredUnverified` because bundle
+  identity and authenticity are outside the probe;
+- old and skipped versions rejected, contiguous repair accepted, and active
+  policy preserved across clean checkpoint/reopen;
+- a regular 16 MiB file rejected as the database path;
+- explicit `not_provided` or `not_injectable` results for signature,
+  truncation, and per-4 KiB power-cut requirements.
+
+Whole-process RSS includes the reference map, generated bundles, runtime, code,
+and database mappings. It is not a Fold-only or controller-memory measurement.
+The missing-version diagnostic is process-local; only active version and last
+verified time are persisted.
+
+See `TRIAL_REPORT.md` for the full blind-developer trail, the reviewer-discovered
+wrong-base defect and regression, decision audit, and exact limitations.
diff --git a/developer-simulation/runs/2026-08-03--offline-door-policy-update/TRIAL_REPORT.md b/developer-simulation/runs/2026-08-03--offline-door-policy-update/TRIAL_REPORT.md
new file mode 100644
index 0000000..4683966
--- /dev/null
+++ b/developer-simulation/runs/2026-08-03--offline-door-policy-update/TRIAL_REPORT.md
@@ -0,0 +1,273 @@
+# Blind trial report: offline door policy update
+
+## Result
+
+**Decision: explicit no-fit for BogKit on the door controller.**
+
+Fold is useful for one narrow part of the problem: it can apply grant retractions and a policy-version record in one logical transaction, and it did so quickly in the host probe. It does not expose the storage and recovery controls that define this controller problem: a fixed 16 MiB flash image, bounded working memory, signed/truncation-safe bundle intake, and failure injection after each modeled 4 KiB write. ESE and ANNy have no relationship to exact authorization policy lookup.
+
+The runnable probe is intentionally a fit test, not a claim that the acceptance contract has been implemented. It demonstrates the useful portion and makes the missing portions observable.
+
+## Perspective and scope
+
+I approached the repository as a building-access systems developer who is new to Rust and had no prior BogKit knowledge. I read the root `README.md` first, then all four public examples. I did not inspect earlier simulations, lab reports, another checkout, GitHub, automation state, or internet resources.
+
+Starting revision: `80fd3c9`.
+
+Finishing criteria were:
+
+1. Evaluate the existing nightly-file baseline before selecting a component.
+2. Select only a BogKit component with a plausible connection to the problem.
+3. Produce a runnable minimal prototype or failure reproducer under `trial-output`.
+4. Check formatting, tests, strict lint, representative correctness, timing, memory, storage, restart, and version-order behavior.
+5. Preserve every untested acceptance item as an explicit limitation.
+
+## Baseline evaluation
+
+The current complete-nightly-file design is not safe if it overwrites the active sorted table in place. The probe models an 8 KiB old generation, writes the first 4 KiB block of the new generation, and then stops. The result is neither the complete old generation nor the complete new generation:
+
+```text
+baseline_mixed_after_first_4k_write=true
+```
+
+A controller-specific design could stage a complete image in a second slot and switch a redundant activation record only after verification. That would solve mixed generations for snapshots, but it would not solve frequent emergency deltas, contiguous-version enforcement, signatures, or bounded delta recovery by itself. The baseline therefore justifies a change, but it does not make a general incremental database automatically suitable.
+
+## Ordered discovery and friction trail
+
+1. The root README describes Fold as an incremental programming framework whose materialized views update as data changes. It describes ESE as embeddings and ANNy as approximate nearest-neighbor search.
+2. The `starter` example showed the relevant idea: a batch of inserts/removals commits atomically and can be reopened from a directory path.
+3. The `timeseries` example showed incremental retractions, but no fixed-storage or fault model. `chat` and `search` were unrelated to exact offline authorization.
+4. Fold's public crate documentation says its state is an embedded Fjall LSM store. `Stream::new` opens a path as a database directory, transactions are logical and crash-safe, and `checkpoint` performs a filesystem synchronization for OS/power durability.
+5. That justified a narrow probe: use `KeyedStream` for credential/door grants, store the active version in the same transaction, and keep version-contiguity checks in controller application code.
+6. The first `cargo test` attempted to update the package index and failed because the host could not resolve `index.crates.io`. No network access was used. Repeating with `--offline` succeeded from the existing cache.
+7. Opening a pre-created 16 MiB file as a Fold database panicked inside `Stream::new`; the probe catches this and reports `fixed_16mib_image_rejected=true`. Fold expects a filesystem directory, not the required flash image/block interface.
+8. The logical prototype passed generated authorization comparisons, version-order cases, and restart. Its host performance was fast.
+9. Skeptical review found that a contiguous next version with the wrong
+   `based_on` value was mislabeled as a version gap and rendered the impossible
+   range `missing=2..1`. The coordinator separated base mismatch from missing
+   versions, added a no-mutation/reopen regression, and reran all evidence.
+10. In the final nested workspace, the open store had 14 files and a
+    67,115,332-byte logical extent, of which 3,129,344 bytes were physically
+    allocated on this sparse-file-capable host. After a clean close it had 11
+    files, 3,072,778 logical bytes, and 3,104,768 allocated bytes. The layout
+    relies on host filesystem behavior and is not a fixed 16 MiB image.
+11. Three final runs reported 25,526,272-26,820,608 bytes whole-process peak
+    resident memory. This includes the reference model, generated bundles,
+    runtime, code, and database mappings, so the 4 MiB controller working-memory
+    requirement remains not demonstrated rather than attributed to Fold.
+
+## Component fit audit
+
+| Component | Possible value | Decision |
+|---|---|---|
+| Fold | Atomic grant retractions, persisted keyed lookup, consistent version update | Rejected for controller use: filesystem/LSM persistence is not the fixed flash protocol; signed/truncated intake, bounded-memory evidence, and 4 KiB fault controls remain outside the probe |
+| ESE | Static text embeddings | No fit: authorization is exact structured lookup, not semantic similarity |
+| ANNy | Approximate vector search | No fit: approximate results are unacceptable and unrelated to badge/door/time checks |
+
+Using Fold only in the central compiler would not address the problem either: PostgreSQL remains authoritative, and the requested prototype value lies in controller image/recovery behavior. Adding Fold there would duplicate state without proving a required property.
+
+## Prototype
+
+Files:
+
+- `Cargo.toml`: nested-workspace member with a local Fold dependency.
+- `src/main.rs`: baseline mixed-generation reproducer, versioned grant
+  controller, reference comparer, regular-file-path rejection probe, timing,
+  storage measurement, and restart check.
+- `README.md`: exact reproduction using caller-supplied state under
+  `/private/tmp`; tests and demos do not generate state inside the archive.
+
+The probe uses one simulated controller for door 7. Version 1 contains 60,000
+time-bounded grants. Version 2 revokes 50,000. It compares 20,000 deterministic
+badge/door/time queries before and 20,000 after against a straightforward
+`BTreeMap` reference. It then rejects a next-version wrong-base bundle without
+mutation, ignores the same active version without verifying payload identity,
+rejects an older snapshot, rejects version 4 before version 3, and applies the
+version 3 repair followed by version 4. Version and last-verified time are
+persisted with the grants in the same Fold transaction. A rejected gap's
+diagnostic range remains process-local and is not claimed to survive restart.
+
+This is deliberately not a signed-bundle parser, flash emulator, or exhaustive power-loss harness. Those are the capabilities whose absence drives the no-fit decision.
+
+## Representative acceptance evidence
+
+| Acceptance item | Evidence | Result |
+|---|---|---|
+| Queries match reference | 20,000 before + 20,000 after; zero mismatches | Pass in host probe |
+| Old bundle cannot restore activated revocations | Version 1 after active version 2 returned `RejectedOld`; badge 0 stayed denied | Pass in application layer |
+| Same active version ignored | Repeated version 2 returned `SameVersionIgnoredUnverified`; payload identity/authenticity is absent | Narrow pass in application layer |
+| Wrong base rejected | Version 2 based on version 0 returned `BaseMismatch`; policy/status stayed at version 1 and the grant survived reopen | Pass after reviewer-required fix |
+| Gap rejected and contiguous repair accepted | Version 4 returned missing 3; version 3 then version 4 activated | Pass in application layer |
+| Deterministic status | Gap status was deterministic in-process; final/reopened active status was version 4, time 1030, no missing versions | Narrow pass; rejected-gap diagnostic is volatile |
+| Restart preserves active policy | Reopen reported version 4 and authorized the repaired temporary grant at its valid time | Pass after clean checkpoint |
+| 50,000 changes under 2 seconds | Three final runs applied in 48-51 ms and checkpointed in 4-5 ms | Pass for unsigned host transaction only |
+| Signed and truncated bundles | The probe has no envelope/parser/signature implementation | Not implemented; application-specific boundary |
+| Complete old or new at every 4 KiB power cut | Baseline mixing reproduced; Fold API does not expose each physical 4 KiB write or an injectable block device | Not demonstrated / missing capability |
+| Peak working memory below 4 MiB | Whole probe RSS 25,526,272-26,820,608 bytes; not isolated to controller state or Fold | Not demonstrated |
+| Active + recovery within 16 MiB fixed image | Fixed file rejected. Open directory: 67,115,332 logical / 3,129,344 allocated bytes. Closed: 3,072,778 logical / 3,104,768 allocated bytes | Required storage model not supported |
+
+## Exact commands and observed results
+
+Final commands ran from the repository root after this crate joined the nested
+`developer-simulation` workspace and resolved its shared lock. Generated state
+and build output stayed under `/private/tmp`.
+
+```console
+cargo fmt --manifest-path developer-simulation/Cargo.toml \
+  -p offline-door-policy-fit-probe -- --check
+CARGO_TARGET_DIR=/private/tmp/bogkit-sim-final-target \
+  cargo test --manifest-path developer-simulation/Cargo.toml \
+  -p offline-door-policy-fit-probe --offline --locked
+CARGO_TARGET_DIR=/private/tmp/bogkit-sim-final-target \
+  cargo clippy --manifest-path developer-simulation/Cargo.toml \
+  -p offline-door-policy-fit-probe --all-targets --offline --locked -- -D warnings
+CARGO_TARGET_DIR=/private/tmp/bogkit-sim-final-target \
+  cargo build --manifest-path developer-simulation/Cargo.toml \
+  -p offline-door-policy-fit-probe --release --offline --locked
+
+DOOR_BIN=/private/tmp/bogkit-sim-final-target/release/offline-door-policy-fit-probe
+for RUN_NUMBER in 1 2 3; do
+  DOOR_ROOT="$(mktemp -d /private/tmp/offline-door-final-${RUN_NUMBER}.XXXXXX)"
+  "$DOOR_BIN" "$DOOR_ROOT"
+done
+```
+
+Formatting and strict Clippy passed. Both tests passed, including the
+reviewer-required wrong-base/no-mutation/reopen regression. Each of the three
+release demonstrations printed the same decisions and storage figures. One
+representative decision/status sequence was:
+
+```text
+baseline_mixed_after_first_4k_write=true
+fixed_16mib_image_rejected=true
+queries_before=20000 mismatches=0
+queries_after=20000 mismatches=0
+wrong_base=BaseMismatch { expected_base: 1, received_base: 0 } wrong_base_status=active_version=1 last_verified_at=1000 missing=none wrong_base_unchanged=true
+same_version=SameVersionIgnoredUnverified old=RejectedOld gap=Missing { expected: 3, received: 4 }
+gap_status=active_version=2 last_verified_at=1010 missing=3..3
+repair=Activated after_repair=Activated
+final_status=active_version=4 last_verified_at=1030 missing=none
+reopened_status=active_version=4 last_verified_at=1030 missing=none reopened_query=true
+fold_store_open_files=14 open_logical_bytes=67115332 open_allocated_bytes=3129344
+fold_store_closed_files=11 closed_logical_bytes=3072778 closed_allocated_bytes=3104768 policy_limit_bytes=16777216
+signature_verification=not_provided_by_fold
+truncated_bundle_detection=not_provided_by_fold
+power_cut_at_each_4k_write=not_injectable_through_fold_api
+```
+
+Across the three final nested-workspace runs, the 60,000-entry snapshot applied
+in 49-63 ms, 50,000 revocations applied in 48-51 ms, checkpoint took 4-5 ms,
+and whole-probe RSS was 25,526,272-26,820,608 bytes. These are host observations
+for this full harness, not controller-hardware or Fold-only bounds.
+
+## Categorized findings
+
+### F-0 — Wrong-base bundle was mislabeled, fixed after review
+
+- Category: **prototype correctness defect**
+- Severity: **high**
+- Confidence: **high**
+- Reproduction: after active version 1, submit version 2 with `based_on=0`.
+  The original probe returned `Missing { expected: 2, received: 2 }` and
+  rendered `missing=2..1`.
+- Fix and regression: the corrected application layer returns `BaseMismatch`,
+  keeps the policy and coherent status unchanged, and proves the grant survives
+  reopen in `contiguous_version_with_wrong_base_is_rejected_without_mutation`.
+- Smallest improvement: keep base mismatch distinct from a missing version and
+  fail closed without applying changes.
+
+This was a defect in the trial prototype, not in Fold.
+
+### F-1 — Fixed-image storage mismatch
+
+- Category: **poor product fit**
+- Severity: **critical**
+- Confidence: **high**
+- Reproduction: run the release demonstration; it pre-creates a 16 MiB file and attempts `Stream::new` on it. Output is `fixed_16mib_image_rejected=true`.
+- Impact: the required simulator must control every byte and every 4 KiB flash write. Fold opens a directory-backed Fjall database instead.
+- Smallest improvement: document the fixed/raw-flash non-goal and use a
+  purpose-built fixed-extent controller format; do not infer a new BogKit
+  storage engine from this trial.
+
+### F-2 — No controllable 4 KiB recovery boundary
+
+- Category: **missing capability**
+- Severity: **critical**
+- Confidence: **high**
+- Reproduction: Fold exposes a logical transaction and `checkpoint`, but no write-plan enumeration, raw block backend, dual-root activation record, or power-cut injection point. The demo can only report `power_cut_at_each_4k_write=not_injectable_through_fold_api`.
+- Impact: “crash-safe” at the host filesystem layer cannot establish the required claim that every modeled flash cut yields exactly the old or new policy.
+- Smallest improvement: build the controller-specific recovery harness around a
+  purpose-built block format and retain this boundary in the public capability
+  matrix.
+
+### F-3 — No trusted bundle boundary
+
+- Category: **missing capability**
+- Severity: **high**
+- Confidence: **high**
+- Reproduction: the public component API accepts typed inserts/removals; it has no bundle framing, length validation, signature verification, monotonic sequence envelope, or snapshot/delta distinction.
+- Impact: untrusted, duplicated, skipped, reordered, or truncated network input must be solved entirely outside BogKit before a transaction begins.
+- Smallest improvement: implement a streaming, signed application envelope that
+  verifies header, payload length/hash/signature, controller identity, base
+  version, and target version before yielding changes. This one-trial need does
+  not justify a BogKit subsystem candidate.
+
+### F-4 — Working-memory limit not demonstrated
+
+- Category: **performance problem**
+- Severity: **high**
+- Confidence: **medium**
+- Reproduction: three final release demonstrations reported whole-process peak
+  RSS of 25,526,272-26,820,608 bytes against a 4,194,304-byte target.
+- Impact: the controller memory contract is not demonstrated.
+- Caveat: RSS includes the reference `BTreeMap`, both generated bundles, Rust runtime, and database; it does not isolate Fold's peak. The conclusion is limited to this implementation, not a precise Fold-only byte count.
+- Smallest improvement: provide a streaming transaction interface with a documented fixed memory bound plus allocator/storage telemetry that separates engine memory from the harness.
+
+### F-5 — Regular-file database path causes a documented open panic
+
+- Category: **API friction**
+- Severity: **high**
+- Confidence: **high**
+- Reproduction: opening the pre-created regular 16 MiB file as the database path
+  panics; the public constructor documents that store-open failure can panic.
+  The probe does not test general corruption or every unopenable-store case.
+- Impact: an embedded policy controller needs a recoverable, diagnosable status
+  for an incompatible storage region, not process termination.
+- Smallest improvement: return a typed `Result` from database construction and checkpoint operations.
+
+### F-6 — Durability boundary is easy to overread
+
+- Category: **documentation gap**
+- Severity: **medium**
+- Confidence: **high**
+- Reproduction: the root-level messaging emphasizes durable, atomic transactions. The more precise Fold API documentation says `wtx` is process-crash durable while `checkpoint` additionally hardens against OS/power failure. Neither defines guarantees for torn physical 4 KiB flash writes or a capacity bound.
+- Impact: a new user could mistake logical transaction atomicity for the controller's physical power-loss acceptance criterion.
+- Smallest improvement: document the exact durability layers, unsupported raw-flash cases, expected directory/file behavior, storage amplification, and whether embedded/no-std targets are supported.
+
+No Fold correctness defect was demonstrated. The successful logical results should not be relabeled as an engine bug merely because the product boundary does not fit.
+
+## Decision audit
+
+1. **Why not keep the baseline?** Direct in-place full-file replacement demonstrably mixes generations after one 4 KiB write. Dual slots would make snapshots safer but do not provide efficient frequent deltas or the complete delivery protocol.
+2. **Why consider Fold?** Grant add/revoke operations and version metadata form a transactional keyed-state update, matching Fold's advertised strength.
+3. **What did Fold prove?** Exact lookup matched the reference; retractions and
+   version metadata committed together; corrected wrong-base/old/gap rules
+   implemented above Fold behaved correctly; the same active version was ignored
+   without verifying payload identity; 50,000 retractions were fast on the host.
+4. **Why reject it?** The dominant requirements are below Fold's public abstraction: fixed flash extent, bounded memory, signed/truncated input, explicit two-generation activation, and exhaustive 4 KiB power-fault recovery.
+5. **Could surrounding code fill the gaps?** Yes, but that surrounding code would contain nearly the entire safety-critical controller design. Fold would then add a host filesystem LSM that the fixed-image prototype cannot use, so the integration cost has no demonstrated payoff.
+6. **Final choice:** use no BogKit component in the controller prototype. Build a purpose-specific fixed-image format with redundant generation metadata, a staged inactive region, streaming verification, monotonic contiguous version checks, and an activation record designed for torn-write recovery. Keep PostgreSQL as the authoritative compiler input as required.
+
+## Uncertainties and intentionally unproven items
+
+- The brief does not give a maximum per-controller grant count. The probe used 60,000 grants so one controller could receive the complete 50,000-revocation batch; this may be more concentrated than production.
+- Host timing does not include real signature verification or bundle parsing and is not a hardware performance prediction.
+- Whole-process RSS is an upper bound for this host prototype, not an isolated engine-memory profile.
+- The open store's large logical extent is sparse on this filesystem. Physical allocation was only about 3.1 MiB, but sparse host files do not establish compatibility with a fixed raw-flash image.
+- Only clean checkpoint/reopen was tested. No claim is made about the required old-or-new result at each physical write cut.
+- Missing-version status in this minimal probe is deterministic within the
+  current process but reopens as `missing=none`; a production controller would
+  need a specified persisted diagnostic policy.
+- Same-version delivery is ignored without proving that its payload matches the
+  active bundle. Bundle identity and authenticity remain outside the probe.
+- Signature choice, key provisioning, bundle wire format, wear limits, flash erase geometry, and hardware-specific atomic-write size remain outside this no-fit reproducer.
diff --git a/developer-simulation/runs/2026-08-03--offline-door-policy-update/src/main.rs b/developer-simulation/runs/2026-08-03--offline-door-policy-update/src/main.rs
new file mode 100644
index 0000000..3a115a1
--- /dev/null
+++ b/developer-simulation/runs/2026-08-03--offline-door-policy-update/src/main.rs
@@ -0,0 +1,612 @@
+use std::collections::BTreeMap;
+use std::fs;
+use std::mem::MaybeUninit;
+use std::os::unix::fs::MetadataExt;
+use std::panic::{AssertUnwindSafe, catch_unwind};
+use std::path::{Path, PathBuf};
+use std::time::Instant;
+
+use fold::pipeline::terminal;
+use fold::stream::{KeyedStream, Stream};
+use serde::{Deserialize, Serialize};
+
+const POLICY_BYTES: u64 = 16 * 1024 * 1024;
+const CONTROLLER_DOOR: u16 = 7;
+const INITIAL_GRANTS: u32 = 60_000;
+const EMERGENCY_REVOCATIONS: u32 = 50_000;
+const QUERY_CHECKS: usize = 20_000;
+
+#[derive(Clone, Debug, PartialEq, Eq, PartialOrd, Ord, Serialize, Deserialize)]
+enum PolicyKey {
+    Meta,
+    Grant { badge: u32, door: u16 },
+}
+
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+enum PolicyRecord {
+    Meta(PersistedStatus),
+    Grant(Grant),
+}
+
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+struct PersistedStatus {
+    active_version: u64,
+    last_verified_at: u64,
+}
+
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+struct Grant {
+    not_before: u64,
+    not_after: u64,
+}
+
+#[derive(Clone, Debug)]
+enum Change {
+    Grant { badge: u32, door: u16, grant: Grant },
+    Revoke { badge: u32, door: u16 },
+}
+
+#[derive(Clone, Debug)]
+struct Bundle {
+    based_on: u64,
+    version: u64,
+    verified_at: u64,
+    changes: Vec<Change>,
+}
+
+#[derive(Clone, Debug, PartialEq, Eq)]
+enum ApplyResult {
+    Activated,
+    SameVersionIgnoredUnverified,
+    RejectedOld,
+    BaseMismatch {
+        expected_base: u64,
+        received_base: u64,
+    },
+    Missing {
+        expected: u64,
+        received: u64,
+    },
+}
+
+struct Controller {
+    state: KeyedStream<PolicyKey, PolicyRecord, terminal::Count>,
+    active_version: u64,
+    last_verified_at: u64,
+    missing: Option<(u64, u64)>,
+}
+
+impl Controller {
+    fn open(path: &Path) -> Self {
+        let state = KeyedStream::new(path, terminal::Count::new("record_count"));
+        let persisted = match state.get(&PolicyKey::Meta) {
+            Some(PolicyRecord::Meta(status)) => status,
+            Some(PolicyRecord::Grant(_)) | None => PersistedStatus {
+                active_version: 0,
+                last_verified_at: 0,
+            },
+        };
+        Self {
+            state,
+            active_version: persisted.active_version,
+            last_verified_at: persisted.last_verified_at,
+            missing: None,
+        }
+    }
+
+    fn apply(&mut self, bundle: &Bundle) -> ApplyResult {
+        if bundle.version == self.active_version {
+            return ApplyResult::SameVersionIgnoredUnverified;
+        }
+        if bundle.version < self.active_version {
+            return ApplyResult::RejectedOld;
+        }
+
+        let expected = self.active_version + 1;
+        if bundle.version != expected {
+            self.missing = Some((expected, bundle.version));
+            return ApplyResult::Missing {
+                expected,
+                received: bundle.version,
+            };
+        }
+        if bundle.based_on != self.active_version {
+            self.missing = None;
+            return ApplyResult::BaseMismatch {
+                expected_base: self.active_version,
+                received_base: bundle.based_on,
+            };
+        }
+
+        self.state.wtx(|tx| {
+            for change in &bundle.changes {
+                match change {
+                    Change::Grant { badge, door, grant } => {
+                        tx.upsert(
+                            &PolicyKey::Grant {
+                                badge: *badge,
+                                door: *door,
+                            },
+                            &PolicyRecord::Grant(grant.clone()),
+                        );
+                    }
+                    Change::Revoke { badge, door } => {
+                        tx.remove(&PolicyKey::Grant {
+                            badge: *badge,
+                            door: *door,
+                        });
+                    }
+                }
+            }
+            tx.upsert(
+                &PolicyKey::Meta,
+                &PolicyRecord::Meta(PersistedStatus {
+                    active_version: bundle.version,
+                    last_verified_at: bundle.verified_at,
+                }),
+            );
+        });
+
+        self.active_version = bundle.version;
+        self.last_verified_at = bundle.verified_at;
+        self.missing = None;
+        ApplyResult::Activated
+    }
+
+    fn authorize(&self, badge: u32, door: u16, at: u64) -> bool {
+        match self.state.get(&PolicyKey::Grant { badge, door }) {
+            Some(PolicyRecord::Grant(grant)) => grant.not_before <= at && at < grant.not_after,
+            Some(PolicyRecord::Meta(_)) | None => false,
+        }
+    }
+
+    fn checkpoint(&mut self) {
+        self.state.checkpoint();
+    }
+
+    fn status(&self) -> String {
+        match self.missing {
+            Some((expected, received)) => format!(
+                "active_version={} last_verified_at={} missing={}..{}",
+                self.active_version,
+                self.last_verified_at,
+                expected,
+                received.saturating_sub(1)
+            ),
+            None => format!(
+                "active_version={} last_verified_at={} missing=none",
+                self.active_version, self.last_verified_at
+            ),
+        }
+    }
+}
+
+fn grant_key(badge: u32, door: u16) -> PolicyKey {
+    PolicyKey::Grant { badge, door }
+}
+
+fn initial_snapshot() -> Bundle {
+    let changes = (0..INITIAL_GRANTS)
+        .map(|badge| Change::Grant {
+            badge,
+            door: CONTROLLER_DOOR,
+            grant: Grant {
+                not_before: 100,
+                not_after: 10_000,
+            },
+        })
+        .collect();
+    Bundle {
+        based_on: 0,
+        version: 1,
+        verified_at: 1_000,
+        changes,
+    }
+}
+
+fn revocation_bundle() -> Bundle {
+    let changes = (0..EMERGENCY_REVOCATIONS)
+        .map(|badge| Change::Revoke {
+            badge,
+            door: CONTROLLER_DOOR,
+        })
+        .collect();
+    Bundle {
+        based_on: 1,
+        version: 2,
+        verified_at: 1_010,
+        changes,
+    }
+}
+
+fn reference_authorize(
+    reference: &BTreeMap<PolicyKey, Grant>,
+    badge: u32,
+    door: u16,
+    at: u64,
+) -> bool {
+    reference
+        .get(&grant_key(badge, door))
+        .is_some_and(|grant| grant.not_before <= at && at < grant.not_after)
+}
+
+fn check_queries(controller: &Controller, reference: &BTreeMap<PolicyKey, Grant>) -> usize {
+    let mut mismatches = 0;
+    let mut state = 0x9e37_79b9_u64;
+    for _ in 0..QUERY_CHECKS {
+        state = state
+            .wrapping_mul(6_364_136_223_846_793_005)
+            .wrapping_add(1);
+        let badge = ((state >> 16) % 70_000) as u32;
+        let door = if state & 1 == 0 {
+            CONTROLLER_DOOR
+        } else {
+            CONTROLLER_DOOR + 1
+        };
+        let at = (state >> 32) % 12_000;
+        if controller.authorize(badge, door, at) != reference_authorize(reference, badge, door, at)
+        {
+            mismatches += 1;
+        }
+    }
+    mismatches
+}
+
+fn store_stats(path: &Path) -> std::io::Result<(u64, u64, usize)> {
+    let mut logical_bytes = 0;
+    let mut allocated_bytes = 0;
+    let mut files = 0;
+    let mut pending = vec![path.to_path_buf()];
+    while let Some(item) = pending.pop() {
+        let metadata = fs::metadata(&item)?;
+        if metadata.is_dir() {
+            for entry in fs::read_dir(item)? {
+                pending.push(entry?.path());
+            }
+        } else if metadata.is_file() {
+            logical_bytes += metadata.len();
+            allocated_bytes += metadata.blocks() * 512;
+            files += 1;
+        }
+    }
+    Ok((logical_bytes, allocated_bytes, files))
+}
+
+fn fixed_image_probe(path: &Path) -> std::io::Result<bool> {
+    let image = path.join("fixed-flash.img");
+    let file = fs::File::create(&image)?;
+    file.set_len(POLICY_BYTES)?;
+    drop(file);
+
+    let previous_hook = std::panic::take_hook();
+    std::panic::set_hook(Box::new(|_| {}));
+    let open_result = catch_unwind(AssertUnwindSafe(|| {
+        let _stream: Stream<u32, terminal::Count> =
+            Stream::new(&image, terminal::Count::new("probe"));
+    }));
+    std::panic::set_hook(previous_hook);
+    Ok(open_result.is_err())
+}
+
+fn naive_baseline_mixes_generations_after_one_block() -> bool {
+    let old_generation = [0x11_u8; 8 * 1024];
+    let new_generation = [0x22_u8; 8 * 1024];
+    let mut flash = old_generation;
+    flash[..4 * 1024].copy_from_slice(&new_generation[..4 * 1024]);
+    flash != old_generation && flash != new_generation
+}
+
+fn run_root() -> Result<PathBuf, String> {
+    let mut args = std::env::args_os();
+    let program = args
+        .next()
+        .unwrap_or_else(|| "offline-door-policy-fit-probe".into());
+    let Some(root) = args.next() else {
+        return Err(format!(
+            "usage: {} <empty-state-directory>",
+            Path::new(&program).display()
+        ));
+    };
+    if args.next().is_some() {
+        return Err(format!(
+            "usage: {} <empty-state-directory>",
+            Path::new(&program).display()
+        ));
+    }
+    Ok(PathBuf::from(root))
+}
+
+fn peak_rss_bytes() -> Option<u64> {
+    let mut usage = MaybeUninit::<libc::rusage>::uninit();
+    // SAFETY: getrusage initializes the provided rusage when it returns zero.
+    let result = unsafe { libc::getrusage(libc::RUSAGE_SELF, usage.as_mut_ptr()) };
+    if result != 0 {
+        return None;
+    }
+    // SAFETY: a successful getrusage call initialized usage above.
+    let usage = unsafe { usage.assume_init() };
+    #[cfg(target_os = "macos")]
+    {
+        Some(usage.ru_maxrss as u64)
+    }
+    #[cfg(not(target_os = "macos"))]
+    {
+        Some((usage.ru_maxrss as u64) * 1024)
+    }
+}
+
+fn main() -> Result<(), Box<dyn std::error::Error>> {
+    let root = run_root()?;
+    if root.exists() && fs::read_dir(&root)?.next().is_some() {
+        return Err(format!("state directory must be empty: {}", root.display()).into());
+    }
+    fs::create_dir_all(&root)?;
+
+    let baseline_mixed = naive_baseline_mixes_generations_after_one_block();
+    let fixed_image_rejected = fixed_image_probe(&root)?;
+    let store_path = root.join("fold-store");
+    let mut controller = Controller::open(&store_path);
+    let mut reference = BTreeMap::new();
+
+    let snapshot = initial_snapshot();
+    let snapshot_started = Instant::now();
+    assert_eq!(controller.apply(&snapshot), ApplyResult::Activated);
+    let snapshot_apply_ms = snapshot_started.elapsed().as_millis();
+    for change in &snapshot.changes {
+        if let Change::Grant { badge, door, grant } = change {
+            reference.insert(grant_key(*badge, *door), grant.clone());
+        }
+    }
+    let before_mismatches = check_queries(&controller, &reference);
+    controller.checkpoint();
+
+    let wrong_base_bundle = Bundle {
+        based_on: 0,
+        version: 2,
+        verified_at: 1_005,
+        changes: vec![Change::Revoke {
+            badge: 55_000,
+            door: CONTROLLER_DOOR,
+        }],
+    };
+    let wrong_base = controller.apply(&wrong_base_bundle);
+    let wrong_base_status = controller.status();
+    let wrong_base_unchanged = controller.authorize(55_000, CONTROLLER_DOOR, 1_500);
+
+    let revocations = revocation_bundle();
+    let delta_started = Instant::now();
+    assert_eq!(controller.apply(&revocations), ApplyResult::Activated);
+    let delta_apply_ms = delta_started.elapsed().as_millis();
+    let checkpoint_started = Instant::now();
+    controller.checkpoint();
+    let checkpoint_ms = checkpoint_started.elapsed().as_millis();
+    for badge in 0..EMERGENCY_REVOCATIONS {
+        reference.remove(&grant_key(badge, CONTROLLER_DOOR));
+    }
+    let after_mismatches = check_queries(&controller, &reference);
+
+    let same_version = controller.apply(&revocations);
+    let old = controller.apply(&snapshot);
+    let version_four = Bundle {
+        based_on: 3,
+        version: 4,
+        verified_at: 1_030,
+        changes: vec![Change::Grant {
+            badge: 99_999,
+            door: CONTROLLER_DOOR,
+            grant: Grant {
+                not_before: 1_000,
+                not_after: 2_000,
+            },
+        }],
+    };
+    let gap = controller.apply(&version_four);
+    let gap_status = controller.status();
+    let version_three = Bundle {
+        based_on: 2,
+        version: 3,
+        verified_at: 1_020,
+        changes: Vec::new(),
+    };
+    let repair = controller.apply(&version_three);
+    let after_repair = controller.apply(&version_four);
+    let final_status = controller.status();
+    controller.checkpoint();
+
+    let (open_logical_bytes, open_allocated_bytes, open_store_files) = store_stats(&store_path)?;
+    let revoked_deny = !controller.authorize(0, CONTROLLER_DOOR, 1_500);
+    let final_allow = controller.authorize(99_999, CONTROLLER_DOOR, 1_500);
+    let expired_deny = !controller.authorize(99_999, CONTROLLER_DOOR, 2_000);
+    drop(controller);
+    let reopened = Controller::open(&store_path);
+    let reopened_status = reopened.status();
+    let reopened_allow = reopened.authorize(99_999, CONTROLLER_DOOR, 1_500);
+    drop(reopened);
+    let (closed_logical_bytes, closed_allocated_bytes, closed_store_files) =
+        store_stats(&store_path)?;
+    println!("baseline_mixed_after_first_4k_write={baseline_mixed}");
+    println!("fixed_16mib_image_rejected={fixed_image_rejected}");
+    println!(
+        "snapshot_entries={} snapshot_apply_ms={snapshot_apply_ms}",
+        snapshot.changes.len()
+    );
+    println!("queries_before={QUERY_CHECKS} mismatches={before_mismatches}");
+    println!(
+        "revocations={} delta_apply_ms={delta_apply_ms} checkpoint_ms={checkpoint_ms}",
+        revocations.changes.len()
+    );
+    println!("queries_after={QUERY_CHECKS} mismatches={after_mismatches}");
+    println!(
+        "wrong_base={wrong_base:?} wrong_base_status={wrong_base_status} wrong_base_unchanged={wrong_base_unchanged}"
+    );
+    println!("same_version={same_version:?} old={old:?} gap={gap:?}");
+    println!("gap_status={gap_status}");
+    println!("repair={repair:?} after_repair={after_repair:?}");
+    println!("final_status={final_status}");
+    println!("reopened_status={reopened_status} reopened_query={reopened_allow}");
+    println!(
+        "fold_store_open_files={open_store_files} open_logical_bytes={open_logical_bytes} open_allocated_bytes={open_allocated_bytes}"
+    );
+    println!(
+        "fold_store_closed_files={closed_store_files} closed_logical_bytes={closed_logical_bytes} closed_allocated_bytes={closed_allocated_bytes} policy_limit_bytes={POLICY_BYTES}"
+    );
+    let peak_rss = peak_rss_bytes().ok_or("peak RSS measurement unavailable")?;
+    println!(
+        "whole_probe_peak_rss_bytes={peak_rss} working_memory_limit_bytes={}",
+        4 * 1024 * 1024
+    );
+    println!("signature_verification=not_provided_by_fold");
+    println!("truncated_bundle_detection=not_provided_by_fold");
+    println!("power_cut_at_each_4k_write=not_injectable_through_fold_api");
+
+    assert!(baseline_mixed);
+    assert!(fixed_image_rejected);
+    assert_eq!(before_mismatches, 0);
+    assert_eq!(after_mismatches, 0);
+    assert_eq!(
+        wrong_base,
+        ApplyResult::BaseMismatch {
+            expected_base: 1,
+            received_base: 0,
+        }
+    );
+    assert_eq!(
+        wrong_base_status,
+        "active_version=1 last_verified_at=1000 missing=none"
+    );
+    assert!(wrong_base_unchanged);
+    assert_eq!(same_version, ApplyResult::SameVersionIgnoredUnverified);
+    assert_eq!(old, ApplyResult::RejectedOld);
+    assert_eq!(
+        gap,
+        ApplyResult::Missing {
+            expected: 3,
+            received: 4,
+        }
+    );
+    assert_eq!(repair, ApplyResult::Activated);
+    assert_eq!(after_repair, ApplyResult::Activated);
+    assert!(revoked_deny);
+    assert!(final_allow);
+    assert!(expired_deny);
+    assert_eq!(reopened_status, final_status);
+    assert!(reopened_allow);
+    Ok(())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn test_store(name: &str) -> PathBuf {
+        let nonce = std::time::SystemTime::now()
+            .duration_since(std::time::SystemTime::UNIX_EPOCH)
+            .expect("system time must follow the Unix epoch")
+            .as_nanos();
+        std::env::temp_dir().join(format!(
+            "offline-door-policy-{name}-{}-{nonce}",
+            std::process::id()
+        ))
+    }
+
+    #[test]
+    fn sequence_rules_and_time_bounds_are_deterministic() {
+        let path = test_store("sequence");
+        if path.exists() {
+            fs::remove_dir_all(&path).unwrap();
+        }
+        let mut controller = Controller::open(&path);
+        let v1 = Bundle {
+            based_on: 0,
+            version: 1,
+            verified_at: 10,
+            changes: vec![Change::Grant {
+                badge: 42,
+                door: CONTROLLER_DOOR,
+                grant: Grant {
+                    not_before: 100,
+                    not_after: 200,
+                },
+            }],
+        };
+        assert_eq!(controller.apply(&v1), ApplyResult::Activated);
+        assert!(!controller.authorize(42, CONTROLLER_DOOR, 99));
+        assert!(controller.authorize(42, CONTROLLER_DOOR, 100));
+        assert!(!controller.authorize(42, CONTROLLER_DOOR, 200));
+        assert_eq!(
+            controller.apply(&v1),
+            ApplyResult::SameVersionIgnoredUnverified
+        );
+
+        let v3 = Bundle {
+            based_on: 2,
+            version: 3,
+            verified_at: 30,
+            changes: Vec::new(),
+        };
+        assert_eq!(
+            controller.apply(&v3),
+            ApplyResult::Missing {
+                expected: 2,
+                received: 3,
+            }
+        );
+        assert_eq!(
+            controller.status(),
+            "active_version=1 last_verified_at=10 missing=2..2"
+        );
+        drop(controller);
+        fs::remove_dir_all(&path).unwrap();
+    }
+
+    #[test]
+    fn contiguous_version_with_wrong_base_is_rejected_without_mutation() {
+        let path = test_store("wrong-base");
+        let mut controller = Controller::open(&path);
+        let v1 = Bundle {
+            based_on: 0,
+            version: 1,
+            verified_at: 10,
+            changes: vec![Change::Grant {
+                badge: 42,
+                door: CONTROLLER_DOOR,
+                grant: Grant {
+                    not_before: 100,
+                    not_after: 200,
+                },
+            }],
+        };
+        assert_eq!(controller.apply(&v1), ApplyResult::Activated);
+
+        let wrong_base = Bundle {
+            based_on: 0,
+            version: 2,
+            verified_at: 20,
+            changes: vec![Change::Revoke {
+                badge: 42,
+                door: CONTROLLER_DOOR,
+            }],
+        };
+        assert_eq!(
+            controller.apply(&wrong_base),
+            ApplyResult::BaseMismatch {
+                expected_base: 1,
+                received_base: 0,
+            }
+        );
+        assert!(controller.authorize(42, CONTROLLER_DOOR, 150));
+        assert_eq!(
+            controller.status(),
+            "active_version=1 last_verified_at=10 missing=none"
+        );
+        drop(controller);
+        let reopened = Controller::open(&path);
+        assert!(reopened.authorize(42, CONTROLLER_DOOR, 150));
+        assert_eq!(
+            reopened.status(),
+            "active_version=1 last_verified_at=10 missing=none"
+        );
+        drop(reopened);
+        fs::remove_dir_all(&path).unwrap();
+    }
+}
diff --git a/developer-simulation/runs/2026-08-03--provenance-revocation-impact/Cargo.toml b/developer-simulation/runs/2026-08-03--provenance-revocation-impact/Cargo.toml
new file mode 100644
index 0000000..2bca1f5
--- /dev/null
+++ b/developer-simulation/runs/2026-08-03--provenance-revocation-impact/Cargo.toml
@@ -0,0 +1,16 @@
+[package]
+name = "provenance-revocation-reproducer"
+version = "0.1.0"
+edition = "2024"
+publish = false
+
+[dependencies]
+fold = { path = "../../../fold" }
+serde = { version = "1", features = ["derive"] }
+serde_json = "1"
+
+[lints.rust]
+unsafe_code = "forbid"
+
+[lints.clippy]
+all = "deny"
diff --git a/developer-simulation/runs/2026-08-03--provenance-revocation-impact/README.md b/developer-simulation/runs/2026-08-03--provenance-revocation-impact/README.md
new file mode 100644
index 0000000..3a2f5bc
--- /dev/null
+++ b/developer-simulation/runs/2026-08-03--provenance-revocation-impact/README.md
@@ -0,0 +1,65 @@
+# Provenance revocation impact
+
+This is a minimal fit reproducer for transitive software-provenance revocation.
+It persists input facts with Fold, then compares an intentionally incomplete
+one-hop negative control with a bounded recursive correctness oracle. The
+negative control is ordinary Rust, not a composition of Fold operators; its two
+unsafe approvals are prototype defects, not BogKit defects.
+
+The reviewed conclusion is no fit for the stated PostgreSQL-authoritative gate.
+The current public Fold surface does not supply joins or recursive reachability,
+and moving derived decisions into a local embedded store would add another
+authority and reconciliation boundary.
+
+## Reproduce
+
+Run from the repository root. All generated state and build output remain under
+`/private/tmp`.
+
+```sh
+export CARGO_TARGET_DIR=/private/tmp/provenance-revocation-target
+cargo fmt --manifest-path developer-simulation/Cargo.toml \
+  -p provenance-revocation-reproducer -- --check
+cargo test --manifest-path developer-simulation/Cargo.toml \
+  -p provenance-revocation-reproducer --offline --locked
+cargo clippy --manifest-path developer-simulation/Cargo.toml \
+  -p provenance-revocation-reproducer --all-targets --offline --locked -- -D warnings
+cargo build --manifest-path developer-simulation/Cargo.toml \
+  -p provenance-revocation-reproducer --release --offline --locked
+
+PROV_ROOT="$(mktemp -d /private/tmp/provenance-revocation.XXXXXX)"
+PROV_BIN="$CARGO_TARGET_DIR/release/provenance-revocation-reproducer"
+"$PROV_BIN" generate | "$PROV_BIN" run "$PROV_ROOT/negative-control" candidate
+"$PROV_BIN" generate | "$PROV_BIN" run "$PROV_ROOT/reference" reference
+```
+
+The negative control approves `transitive` and `cyclic`; the reference blocks
+them as `revoked` and `invalid_cycle`. Both block `unknown` as
+`missing_manifest`. This is a three-query failure reproducer, not a scale test.
+
+## Process-abort boundaries
+
+Build a separate abort-on-panic binary, then inject before and after the first
+Fold transaction commits:
+
+```sh
+export CARGO_TARGET_DIR=/private/tmp/provenance-revocation-abort-target
+export RUSTFLAGS='-C panic=abort'
+cargo build --manifest-path developer-simulation/Cargo.toml \
+  -p provenance-revocation-reproducer --release --offline --locked
+
+CRASH_ROOT="$(mktemp -d /private/tmp/provenance-revocation-abort.XXXXXX)"
+ABORT_BIN="$CARGO_TARGET_DIR/release/provenance-revocation-reproducer"
+printf '%s\n' '{"op":"artifact","id":"app"}' \
+  | PROVENANCE_CRASH=before_commit:1 "$ABORT_BIN" run "$CRASH_ROOT/before" reference
+printf '%s\n' '{"op":"artifact","id":"app"}' \
+  | PROVENANCE_CRASH=after_commit:1 "$ABORT_BIN" run "$CRASH_ROOT/after" reference
+```
+
+Each injected run exits by abort. Reopening the first store shows `app` absent;
+reopening the second shows it present. This covers two local process-abort
+boundaries only, not OS failure, power loss, PostgreSQL integration, versioned
+publication, concurrent ingestion, or the requested 500,000-artifact scale.
+
+See `TRIAL_REPORT.md` for the full blind-developer trail, skeptical corrections,
+decision audit, and exact limitations.
diff --git a/developer-simulation/runs/2026-08-03--provenance-revocation-impact/TRIAL_REPORT.md b/developer-simulation/runs/2026-08-03--provenance-revocation-impact/TRIAL_REPORT.md
new file mode 100644
index 0000000..27a8bfc
--- /dev/null
+++ b/developer-simulation/runs/2026-08-03--provenance-revocation-impact/TRIAL_REPORT.md
@@ -0,0 +1,391 @@
+# Blind trial report: provenance revocation impact
+
+## Outcome
+
+**Explicit no-fit for BogKit's current public components.** Fold's atomic writes,
+durable local state, retractions, and consistent read snapshots are useful
+building blocks, but its documented operators do not provide a join, recursive
+fixed point, or dynamic reachability primitive. Those are the center of this
+problem, not an incidental feature. A correct solution would require a custom
+graph engine plus deterministic witness and restart protocols, while also
+creating a second durable authority beside PostgreSQL.
+
+The runnable reproducer deliberately stops at the smallest useful boundary. It
+uses Fold to persist input facts, implements an intentionally incomplete one-hop
+negative control in ordinary Rust, and compares it with a slow deterministic
+graph reference. The negative control is not a composition of Fold operators and
+its defects are not BogKit defects. On the demonstration corpus, it disagrees
+with the reference on 2 of 3 release decisions: it approves both a transitively
+revoked release and a release containing a reachable cycle.
+
+This is a product-fit conclusion, not a claim that arbitrary Rust code cannot be
+written behind Fold's `Push` trait. It can. The problem is that doing so would be
+implementing the missing product.
+
+## Scope and finishing criteria
+
+I worked only in this assigned checkout and wrote only under `trial-output/`. I
+did not inspect prior simulations, reports, another checkout, GitHub, automation
+state, or internet resources. I did not commit or push.
+
+I considered the trial complete when all of the following were true:
+
+1. The existing PostgreSQL baseline had been evaluated before selecting any
+   BogKit component.
+2. The public README, examples, and relevant public Fold API were inspected.
+3. A minimal JSONL reproducer persisted state locally and exposed the key fit
+   failure against a deterministic reference.
+4. Duplicate edges, missing manifests, transitive revocation, cycles, fact-order
+   independence, and two transaction crash boundaries had evidence.
+5. Formatting, compilation, strict linting, tests, and the demonstration passed.
+6. Findings, limitations, commands, observed results, and the decision audit
+   were recorded without claiming unmeasured scale results.
+
+## Baseline evaluation before BogKit selection
+
+The PostgreSQL baseline already has two important properties: it is the named
+authority, and recursive queries can calculate the exact reachable set from a
+transactionally consistent database snapshot. Its problem is operational:
+nightly full recomputation gives unacceptable revocation latency, while a
+separate cached flag can represent a different generation than concurrently
+uploaded manifests.
+
+The real PostgreSQL implementation was evaluated conceptually, not reproduced.
+The runnable slow reference instead loads Fold facts into ordinary Rust
+collections and serves only as a bounded correctness oracle. The smallest
+direction that preserves the baseline's strengths is an
+incremental reverse-dependency index and a versioned decision generation that
+is published atomically in PostgreSQL. That could bound recomputation to nodes
+reachable from changed roots, keep ingestion and decisions tied to database
+versions, and publish explanations with the same generation. This trial did not
+build that system because the requested question was whether BogKit components
+fit the prototype boundary.
+
+Moving the derived decision set into Fold's embedded store would not, by itself,
+fix the authority boundary. It would add a PostgreSQL-to-local-store checkpoint
+and reconciliation problem. The prototype would need an explicit source offset,
+idempotent replay, generation publication, and recovery protocol before its
+decisions could safely gate deployment.
+
+## Public surface evaluated
+
+The root README presents Fold as an eager incremental programming framework and
+points new users at four examples. I read all four public examples:
+
+- `starter`: atomic insert/retract into a persistent count and bag.
+- `timeseries`: keying, filtering, and invertible per-key aggregation.
+- `chat`: one thread owns the Fold stream and publishes snapshots after each
+  committed write.
+- `search`: keyed upsert/retract fan-out into three independent indexes.
+
+These show a clear, useful model for one input delta flowing through a static
+pipeline. The public Fold module documents these transformation operators:
+`Map`, `Filter`, `FilterMap`, `FlatMap`, `Distinct`, `Aggregate`, `TopK`, and
+`Retain`, plus keying/scoring and terminal views. Tuples broadcast a delta into
+independent branches. There is no public join, recursion, feedback edge,
+fixed-point iteration, or graph reachability operator.
+
+The public `Push` trait does permit a custom stateful operator with low-level
+keyspaces and transaction hooks. For this workload, such an operator would need
+to implement all of the following itself:
+
+- forward and reverse adjacency with duplicate-edge set semantics;
+- incremental transitive invalidation and revalidation under deletions/updates;
+- well-founded behavior for malformed cycles and incomplete manifests;
+- a specified deterministic witness policy under every ingestion order;
+- source offsets, idempotent replay, versioned publication, and crash recovery;
+- storage compaction and memory controls at five million edges.
+
+That is the core application, so the custom-node escape hatch does not change
+the no-fit decision.
+
+## What the reproducer contains
+
+- `Cargo.toml`: standalone Rust crate with a local path dependency on Fold.
+- `src/main.rs`: one executable with two commands:
+  - `generate` writes a deterministic JSONL corpus.
+  - `run <state-directory> <candidate|reference>` consumes JSONL, stores facts
+    in a Fold `Bag`, and emits JSONL decisions for query commands.
+- `PROVENANCE_CRASH=before_commit:N` and
+  `PROVENANCE_CRASH=after_commit:N`: deterministic crash injection around the
+  Nth persistent fact.
+- Five unit fixtures: complete DAG, transitive revocation, transitive missing
+  manifest, reachable cycle, and order/duplicate-edge determinism.
+
+Supported JSONL operations are `artifact`, `edge`, `release`, `revoke`, and
+`query`. This intentionally does not claim full manifest update, attestation,
+unrevocation, or multi-process ingestion support. It is a failure reproducer,
+not a deployment-gate implementation.
+
+The `candidate` engine is an intentionally incomplete negative control that
+checks the release artifact and one dependency hop. It is not an implemented
+Fold pipeline and therefore cannot establish that a concrete Fold composition is
+incorrect. The `reference` engine scans the persisted facts,
+deduplicates edges with ordered sets, and performs deterministic depth-first
+reachability. Unknown manifests and cycles block. Sorted traversal makes its
+first witness path independent of fact ingestion order on the tested fixtures;
+global minimality is not established.
+
+## Ordered discovery and friction trail
+
+1. Read the root README and enumerated `examples/`. This established the intended
+   onboarding path and the advertised component set.
+2. Read `starter`, `timeseries`, `chat`, and `search`. Atomic snapshots and
+   retractions were immediately promising; no example correlated two changing
+   relations or fed results back to a fixed point.
+3. Searched the public Fold API for join/recursion/iteration/feedback/cycle and
+   inspected the operator and stream documentation. The operator list confirmed
+   the missing primitive. The transaction API confirmed that all terminal
+   updates in one `wtx` are atomic and restart from the last commit.
+4. Considered a custom `Push` node. It is technically possible, but it exposes
+   storage/transaction plumbing rather than a graph abstraction. Implementing it
+   would consume the whole prototype budget and still leave PostgreSQL
+   reconciliation outside the component.
+5. Built the minimal candidate/reference executable under `trial-output/`.
+6. The first validation command ran `cargo fmt --check`, which correctly showed
+   formatting differences. Because this new standalone crate had no lock file,
+   the subsequent non-offline Cargo commands attempted to update the crates.io
+   index and failed DNS resolution. No internet content was accessed. Running
+   `cargo fmt` and rerunning Cargo with `--offline` resolved dependencies from the
+   existing local cache and created the lock file.
+7. The first demo invocation looked for a normal binary after only `cargo check`
+   and `cargo test`; only the test harness existed. `cargo build --offline
+   --locked` produced the executable, after which the demo passed. This was local
+   build-command friction, not a BogKit defect.
+8. Ran the deterministic corpus through candidate and reference stores, then
+   injected crashes before and after a Fold commit and reopened each store.
+9. Attempted `/usr/bin/time -l` for peak resident memory. Wall time was reported,
+   but the sandbox denied the required `sysctl kern.clockrate`, so peak memory was
+   not available. I do not claim a memory result.
+
+## Exact validation commands and observed results
+
+Final commands ran from the repository root after this crate joined the nested
+`developer-simulation` workspace and resolved its shared locked dependencies.
+Generated state and build output stayed under `/private/tmp`.
+
+### Formatting, compilation, lint, and tests
+
+```console
+cargo fmt --manifest-path developer-simulation/Cargo.toml \
+  -p provenance-revocation-reproducer -- --check
+CARGO_TARGET_DIR=/private/tmp/bogkit-sim-final-target \
+  cargo test --manifest-path developer-simulation/Cargo.toml \
+  -p provenance-revocation-reproducer --offline --locked
+CARGO_TARGET_DIR=/private/tmp/bogkit-sim-final-target \
+  cargo clippy --manifest-path developer-simulation/Cargo.toml \
+  -p provenance-revocation-reproducer --all-targets --offline --locked -- -D warnings
+CARGO_TARGET_DIR=/private/tmp/bogkit-sim-final-target \
+  cargo build --manifest-path developer-simulation/Cargo.toml \
+  -p provenance-revocation-reproducer --release --offline --locked
+```
+
+Formatting, compilation, strict Clippy, and all 5 tests passed.
+
+### Deterministic demonstration
+
+```console
+PROV_ROOT="$(mktemp -d /private/tmp/provenance-final.XXXXXX)"
+PROV_BIN=/private/tmp/bogkit-sim-final-target/release/provenance-revocation-reproducer
+"$PROV_BIN" generate | "$PROV_BIN" run "$PROV_ROOT/candidate" candidate
+"$PROV_BIN" generate | "$PROV_BIN" run "$PROV_ROOT/reference" reference
+du -sk "$PROV_ROOT/candidate" "$PROV_ROOT/reference"
+```
+
+Corpus counts: 14 persistent facts and 3 queries. The facts include 5 declared
+artifacts, 5 edges (one exact duplicate), 3 releases, and 1 revocation.
+
+Candidate output:
+
+```jsonl
+{"engine":"one_hop_negative_control","release":"transitive","decision":"approved","reason":"complete","path":[]}
+{"engine":"one_hop_negative_control","release":"cyclic","decision":"approved","reason":"complete","path":[]}
+{"engine":"one_hop_negative_control","release":"unknown","decision":"blocked","reason":"missing_manifest","path":["missing-root"]}
+```
+
+Reference output:
+
+```jsonl
+{"engine":"slow_reference","release":"transitive","decision":"blocked","reason":"revoked","path":["app","middle","revoked-base"]}
+{"engine":"slow_reference","release":"cyclic","decision":"blocked","reason":"invalid_cycle","path":["cycle-a","cycle-b","cycle-a"]}
+{"engine":"slow_reference","release":"unknown","decision":"blocked","reason":"missing_manifest","path":["missing-root"]}
+```
+
+Observed decision match: 1 of 3. Observed mismatch: 2 of 3. Each tiny Fold state
+directory occupied 48 KiB. That size is dominated by fixed storage overhead and
+is not evidence for the 1.3x scale limit.
+
+### Crash boundaries
+
+The reviewer required process-abort, rather than only Rust-unwind, evidence. A
+separate release binary was used for both boundaries:
+
+```console
+RUSTFLAGS='-C panic=abort' \
+  CARGO_TARGET_DIR=/private/tmp/bogkit-sim-abort-target \
+  cargo build --manifest-path developer-simulation/Cargo.toml \
+  -p provenance-revocation-reproducer --release --offline --locked
+ABORT_BIN=/private/tmp/bogkit-sim-abort-target/release/provenance-revocation-reproducer
+CRASH_ROOT="$(mktemp -d /private/tmp/provenance-abort.XXXXXX)"
+```
+
+Before-commit injection:
+
+```console
+print -r -- '{"op":"artifact","id":"app"}' \
+  | PROVENANCE_CRASH=before_commit:1 "$ABORT_BIN" run "$CRASH_ROOT/before" reference
+```
+
+Observed exit 134 from the injected abort. After reopening and adding only the
+release, the query returned blocked/missing `app`, proving the interrupted fact
+was rolled back:
+
+```json
+{"engine":"slow_reference","release":"prod","decision":"blocked","reason":"missing_manifest","path":["app"]}
+```
+
+After-commit injection:
+
+```console
+print -r -- '{"op":"artifact","id":"app"}' \
+  | PROVENANCE_CRASH=after_commit:1 "$ABORT_BIN" run "$CRASH_ROOT/after" reference
+```
+
+Observed exit 134 from the injected abort. After reopening and adding the
+release, the query returned approved, proving the committed artifact survived:
+
+```json
+{"engine":"slow_reference","release":"prod","decision":"approved","reason":"complete","path":[]}
+```
+
+This validates Fold's local transaction boundary for the two tested process
+aborts. It does not cover OS failure, power loss, or every phase of a versioned
+derived-decision publication protocol, because the reproducer deliberately does
+not invent that absent protocol.
+
+## Acceptance evidence and exact limitations
+
+| Acceptance item | Evidence | Result |
+| --- | --- | --- |
+| Exact impacted-release match | Three-query candidate/reference demo | **Fail: 2/3 mismatches** |
+| 500k artifacts, 5m edges, 100 revocations under 60s | Not run after the correctness no-fit was established | **Unproven** |
+| Admission below 250 ms during 100 updates/s | No concurrent ingestion harness; reference rescans all facts per query | **Unproven and unsuitable design** |
+| Deterministic explanation path | Unit test reverses fact order and includes a duplicate edge | **Reference passes; candidate cannot explain transitive failures** |
+| Unknown provenance never approved | Missing-root demo and transitive-missing unit fixture | **Reference passes tested cases** |
+| Safe cycles | Reachable two-node cycle unit and demo | **Reference blocks; candidate incorrectly approves** |
+| Crash restart equals uninterrupted publication | Before/after one Fold transaction tested | **Local atomicity passes; full publication protocol absent** |
+| Peak memory below 512 MiB | Measurement unavailable; reference materializes the whole graph | **Unproven** |
+| Auxiliary state below 1.3x input | Tiny store is 48 KiB, not scale-representative | **Unproven** |
+
+The slow reference is recursive and materializes ordered strings and adjacency
+sets in memory on every query. It exists only as a correctness oracle on bounded
+fixtures. It is not claimed to meet the performance or memory acceptance
+criteria. A very deep malformed chain could also exhaust its call stack; that is
+another reason it is not a production candidate.
+
+## Categorized findings
+
+### F-01 — One-hop negative control approves unsafe releases
+
+- Category: **prototype correctness defect**
+- Severity: **blocker**
+- Confidence: **high**
+- Reproduction: run the generated corpus through both engines. `transitive` and
+  `cyclic` are approved by the negative control and blocked by the reference.
+- Smallest improvement: do not use one-hop logic as the gate. Keep computation
+  in the authoritative database or choose a proven recursive graph system.
+
+This is a deliberately exposed defect in the negative-control prototype, not a
+defect in Fold or evidence that an implemented Fold composition failed.
+
+### F-02 — No join or recursive fixed-point component
+
+- Category: **missing capability**
+- Severity: **blocker**
+- Confidence: **high**
+- Reproduction: inspect the public operator list in `fold/src/pipeline/mod.rs`
+  and the public examples; search the public source for join, recursion,
+  feedback, and fixed-point APIs.
+- Smallest improvement: document that joins and recursive reachability are not
+  supplied. A future durable recursive operator is only a one-trial observation,
+  not a threshold-qualified candidate.
+
+### F-03 — Embedded derived authority conflicts with PostgreSQL authority
+
+- Category: **poor product fit**
+- Severity: **blocker**
+- Confidence: **high**
+- Reproduction: compare the stated constraint that PostgreSQL remains
+  authoritative with Fold's local embedded store and process-owned stream.
+- Smallest improvement: offer a PostgreSQL-backed state/transaction adapter or
+  a documented exactly-once source-offset and generation-publication protocol.
+  Without that, keep computation and publication in PostgreSQL.
+
+### F-04 — Correct fallback repeats full-scan baseline behavior
+
+- Category: **performance problem**
+- Severity: **blocker**
+- Confidence: **high for asymptotic behavior; low for exact scale timing**
+- Reproduction: every reference query iterates the entire persisted fact bag and
+  rebuilds artifact, edge, release, and revocation collections before traversal.
+- Smallest improvement: maintain reverse reachability and a specified stable witness
+  incrementally by changed generation instead of scanning all facts per query.
+
+No 500k/5m benchmark was run, so this report makes no fabricated claim about
+seconds or peak memory.
+
+### F-05 — Custom operator path exposes low-level implementation burden
+
+- Category: **API friction**
+- Severity: **major**
+- Confidence: **high**
+- Reproduction: inspect `Push`, `PipelineInitCtx`, and `WriteTx`. A custom node
+  must manage named keyspaces, serialization, buffered deltas, repeated commit
+  calls, abort cleanup, and downstream readers. Public examples also use macros
+  when closure-containing pipeline types are difficult to name in helpers.
+- Smallest improvement: ship supported join/recursive operators and ergonomic
+  typed builders/readers rather than requiring application authors to construct
+  storage engines at the `Push` layer.
+
+### F-06 — Recovery and evolution guidance is insufficient for a gate
+
+- Category: **documentation gap**
+- Severity: **major**
+- Confidence: **high**
+- Reproduction: the public docs describe atomic `wtx`, snapshots, and
+  checkpointing, but the inspected public surface does not explain source offset
+  replay, schema/pipeline evolution, keyspace migration, crash points across
+  generations, or PostgreSQL reconciliation.
+- Smallest improvement: document and test an end-to-end versioned materialization
+  protocol, including compatibility checks on reopen and crash matrices.
+
+## Decision audit
+
+1. **Keep nightly PostgreSQL recomputation unchanged:** rejected because it does
+   not meet revocation latency and allows cached-generation disagreement.
+2. **Compose only documented Fold operators:** rejected by the runnable
+   correctness mismatch. The graph relation cannot be correlated to revocation
+   roots through arbitrary depth.
+3. **Write a custom recursive `Push` node:** technically possible, rejected as a
+   BogKit selection because it means implementing the dynamic reachability,
+   witness, cycle, storage, and recovery engine from scratch.
+4. **Use Fold only as a local approved/blocked cache:** rejected because it leaves
+   computation in PostgreSQL and adds a second publication/reconciliation
+   boundary without solving the core problem.
+5. **Use ANNy or ESE:** rejected as irrelevant; approximate search and embeddings
+   cannot safely decide exact provenance reachability.
+6. **Recommended direction:** preserve PostgreSQL authority and prototype an
+   incremental reverse-dependency/affected-generation design with atomic
+   generation publication and specified deterministic explanations. Revisit BogKit only after
+   it has a supported recursive dataflow/join facility and an authority-safe
+   PostgreSQL integration story.
+
+## Final uncertainty statement
+
+The trial proves that its deliberately incomplete one-hop negative control is
+unsafe and identifies no supported public join or recursive-reachability
+abstraction. It does not prove that a concrete Fold composition is incorrect or
+that a bespoke Rust graph engine built as a custom Fold node could never meet the
+numeric targets. It also does not measure the 500k/5m workload, concurrent update
+latency, peak memory, or durable-state ratio. Those tests would only be justified
+after selecting or building a correct incremental graph component.
diff --git a/developer-simulation/runs/2026-08-03--provenance-revocation-impact/src/main.rs b/developer-simulation/runs/2026-08-03--provenance-revocation-impact/src/main.rs
new file mode 100644
index 0000000..884968c
--- /dev/null
+++ b/developer-simulation/runs/2026-08-03--provenance-revocation-impact/src/main.rs
@@ -0,0 +1,484 @@
+use std::collections::{BTreeMap, BTreeSet};
+use std::io::{self, BufRead, Write};
+use std::path::Path;
+
+use fold::pipeline::terminal;
+use fold::stream::Stream;
+use serde::{Deserialize, Serialize};
+
+#[derive(Clone, Debug, Deserialize)]
+#[serde(tag = "op", rename_all = "snake_case")]
+enum Command {
+    Artifact {
+        id: String,
+    },
+    Edge {
+        artifact: String,
+        dependency: String,
+    },
+    Release {
+        id: String,
+        artifact: String,
+    },
+    Revoke {
+        id: String,
+    },
+    Query {
+        release: String,
+    },
+}
+
+#[derive(Clone, Debug, Deserialize, Serialize)]
+enum Fact {
+    Artifact {
+        id: String,
+    },
+    Edge {
+        artifact: String,
+        dependency: String,
+    },
+    Release {
+        id: String,
+        artifact: String,
+    },
+    Revoke {
+        id: String,
+    },
+}
+
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+enum Engine {
+    Candidate,
+    Reference,
+}
+
+impl Engine {
+    fn parse(value: &str) -> Result<Self, String> {
+        match value {
+            "candidate" => Ok(Self::Candidate),
+            "reference" => Ok(Self::Reference),
+            _ => Err(format!(
+                "unknown engine {value:?}; use candidate or reference"
+            )),
+        }
+    }
+
+    fn name(self) -> &'static str {
+        match self {
+            Self::Candidate => "one_hop_negative_control",
+            Self::Reference => "slow_reference",
+        }
+    }
+}
+
+#[derive(Clone, Debug, Eq, PartialEq, Serialize)]
+struct Decision {
+    decision: &'static str,
+    reason: &'static str,
+    path: Vec<String>,
+}
+
+impl Decision {
+    fn approved() -> Self {
+        Self {
+            decision: "approved",
+            reason: "complete",
+            path: Vec::new(),
+        }
+    }
+
+    fn blocked(reason: &'static str, path: Vec<String>) -> Self {
+        Self {
+            decision: "blocked",
+            reason,
+            path,
+        }
+    }
+}
+
+#[derive(Debug, Serialize)]
+struct Output<'a> {
+    engine: &'static str,
+    release: &'a str,
+    #[serde(flatten)]
+    decision: Decision,
+}
+
+#[derive(Default)]
+struct Model {
+    artifacts: BTreeSet<String>,
+    edges: BTreeMap<String, BTreeSet<String>>,
+    releases: BTreeMap<String, String>,
+    revoked: BTreeSet<String>,
+}
+
+impl Model {
+    fn add(&mut self, fact: Fact) {
+        match fact {
+            Fact::Artifact { id } => {
+                self.artifacts.insert(id);
+            }
+            Fact::Edge {
+                artifact,
+                dependency,
+            } => {
+                self.edges.entry(artifact).or_default().insert(dependency);
+            }
+            Fact::Release { id, artifact } => {
+                self.releases.insert(id, artifact);
+            }
+            Fact::Revoke { id } => {
+                self.revoked.insert(id);
+            }
+        }
+    }
+
+    /// A deliberately narrow model of what the documented built-ins can
+    /// express without a cross-stream join or recursive fixed point. It
+    /// checks the release artifact and one edge hop only.
+    fn candidate_decision(&self, release: &str) -> Decision {
+        let Some(root) = self.releases.get(release) else {
+            return Decision::blocked("missing_release", vec![release.to_string()]);
+        };
+        if !self.artifacts.contains(root) {
+            return Decision::blocked("missing_manifest", vec![root.clone()]);
+        }
+        if self.revoked.contains(root) {
+            return Decision::blocked("revoked", vec![root.clone()]);
+        }
+
+        for dependency in self.edges.get(root).into_iter().flatten() {
+            if dependency == root {
+                return Decision::blocked("invalid_cycle", vec![root.clone(), dependency.clone()]);
+            }
+            if !self.artifacts.contains(dependency) {
+                return Decision::blocked(
+                    "missing_manifest",
+                    vec![root.clone(), dependency.clone()],
+                );
+            }
+            if self.revoked.contains(dependency) {
+                return Decision::blocked("revoked", vec![root.clone(), dependency.clone()]);
+            }
+        }
+
+        Decision::approved()
+    }
+
+    fn reference_decision(&self, release: &str) -> Decision {
+        let Some(root) = self.releases.get(release) else {
+            return Decision::blocked("missing_release", vec![release.to_string()]);
+        };
+        let mut stack = Vec::new();
+        let mut complete = BTreeSet::new();
+        self.visit(root, &mut stack, &mut complete)
+            .unwrap_or_else(Decision::approved)
+    }
+
+    fn visit(
+        &self,
+        artifact: &str,
+        stack: &mut Vec<String>,
+        complete: &mut BTreeSet<String>,
+    ) -> Option<Decision> {
+        if let Some(position) = stack.iter().position(|item| item == artifact) {
+            let mut path = stack.clone();
+            path.push(artifact.to_string());
+            debug_assert!(position < path.len());
+            return Some(Decision::blocked("invalid_cycle", path));
+        }
+        if complete.contains(artifact) {
+            return None;
+        }
+
+        stack.push(artifact.to_string());
+        if !self.artifacts.contains(artifact) {
+            return Some(Decision::blocked("missing_manifest", stack.clone()));
+        }
+        if self.revoked.contains(artifact) {
+            return Some(Decision::blocked("revoked", stack.clone()));
+        }
+
+        for dependency in self.edges.get(artifact).into_iter().flatten() {
+            if let Some(decision) = self.visit(dependency, stack, complete) {
+                return Some(decision);
+            }
+        }
+        let removed = stack.pop();
+        debug_assert_eq!(removed.as_deref(), Some(artifact));
+        complete.insert(artifact.to_string());
+        None
+    }
+}
+
+fn fact_from_command(command: Command) -> Result<Fact, String> {
+    match command {
+        Command::Artifact { id } => Ok(Fact::Artifact { id }),
+        Command::Edge {
+            artifact,
+            dependency,
+        } => Ok(Fact::Edge {
+            artifact,
+            dependency,
+        }),
+        Command::Release { id, artifact } => Ok(Fact::Release { id, artifact }),
+        Command::Revoke { id } => Ok(Fact::Revoke { id }),
+        Command::Query { .. } => Err("query is not a persistent fact".to_string()),
+    }
+}
+
+fn load_model(stream: &Stream<Fact, terminal::Bag<Fact>>) -> Model {
+    stream.rtx(|facts| {
+        let mut model = Model::default();
+        for (fact, multiplicity) in facts.iter() {
+            if multiplicity > 0 {
+                model.add(fact);
+            }
+        }
+        model
+    })
+}
+
+fn crash_spec() -> Option<(String, usize)> {
+    let value = std::env::var("PROVENANCE_CRASH").ok()?;
+    let (phase, number) = value.split_once(':')?;
+    let number = number.parse().ok()?;
+    Some((phase.to_string(), number))
+}
+
+fn run(state_path: &Path, engine: Engine) -> Result<(), String> {
+    let mut stream = Stream::new(state_path, terminal::Bag::<Fact>::new("facts"));
+    let stdin = io::stdin();
+    let mut stdout = io::BufWriter::new(io::stdout().lock());
+    let crash = crash_spec();
+    let mut fact_number = 0usize;
+
+    for (line_number, line) in stdin.lock().lines().enumerate() {
+        let line = line.map_err(|error| format!("read line {}: {error}", line_number + 1))?;
+        if line.trim().is_empty() {
+            continue;
+        }
+        let command: Command = serde_json::from_str(&line)
+            .map_err(|error| format!("parse line {}: {error}", line_number + 1))?;
+        match command {
+            Command::Query { release } => {
+                let model = load_model(&stream);
+                let decision = match engine {
+                    Engine::Candidate => model.candidate_decision(&release),
+                    Engine::Reference => model.reference_decision(&release),
+                };
+                serde_json::to_writer(
+                    &mut stdout,
+                    &Output {
+                        engine: engine.name(),
+                        release: &release,
+                        decision,
+                    },
+                )
+                .map_err(|error| format!("write decision: {error}"))?;
+                writeln!(stdout).map_err(|error| format!("write newline: {error}"))?;
+                stdout
+                    .flush()
+                    .map_err(|error| format!("flush output: {error}"))?;
+            }
+            persistent => {
+                fact_number += 1;
+                let fact = fact_from_command(persistent)?;
+                stream.wtx(|tx| {
+                    tx.insert(&fact);
+                    if crash.as_ref() == Some(&("before_commit".to_string(), fact_number)) {
+                        panic!("injected crash before commit at fact {fact_number}");
+                    }
+                });
+                if crash.as_ref() == Some(&("after_commit".to_string(), fact_number)) {
+                    panic!("injected crash after commit at fact {fact_number}");
+                }
+            }
+        }
+    }
+    Ok(())
+}
+
+fn generate() -> Result<(), String> {
+    const CORPUS: &[&str] = &[
+        r#"{"op":"artifact","id":"app"}"#,
+        r#"{"op":"artifact","id":"middle"}"#,
+        r#"{"op":"artifact","id":"revoked-base"}"#,
+        r#"{"op":"artifact","id":"cycle-a"}"#,
+        r#"{"op":"artifact","id":"cycle-b"}"#,
+        r#"{"op":"edge","artifact":"app","dependency":"middle"}"#,
+        r#"{"op":"edge","artifact":"app","dependency":"middle"}"#,
+        r#"{"op":"edge","artifact":"middle","dependency":"revoked-base"}"#,
+        r#"{"op":"edge","artifact":"cycle-a","dependency":"cycle-b"}"#,
+        r#"{"op":"edge","artifact":"cycle-b","dependency":"cycle-a"}"#,
+        r#"{"op":"release","id":"transitive","artifact":"app"}"#,
+        r#"{"op":"release","id":"cyclic","artifact":"cycle-a"}"#,
+        r#"{"op":"release","id":"unknown","artifact":"missing-root"}"#,
+        r#"{"op":"revoke","id":"revoked-base"}"#,
+        r#"{"op":"query","release":"transitive"}"#,
+        r#"{"op":"query","release":"cyclic"}"#,
+        r#"{"op":"query","release":"unknown"}"#,
+    ];
+    let mut stdout = io::BufWriter::new(io::stdout().lock());
+    for line in CORPUS {
+        writeln!(stdout, "{line}").map_err(|error| format!("write corpus: {error}"))?;
+    }
+    Ok(())
+}
+
+fn usage(program: &str) -> String {
+    format!("usage:\n  {program} generate\n  {program} run <state-directory> <candidate|reference>")
+}
+
+fn main() {
+    let args: Vec<String> = std::env::args().collect();
+    let result = match args.as_slice() {
+        [_, command] if command == "generate" => generate(),
+        [_, command, path, engine] if command == "run" => {
+            Engine::parse(engine).and_then(|engine| run(Path::new(path), engine))
+        }
+        [program, ..] => Err(usage(program)),
+        [] => Err("missing program name".to_string()),
+    };
+    if let Err(error) = result {
+        eprintln!("{error}");
+        std::process::exit(2);
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn model(facts: &[Fact]) -> Model {
+        let mut model = Model::default();
+        for fact in facts {
+            model.add(fact.clone());
+        }
+        model
+    }
+
+    fn artifact(id: &str) -> Fact {
+        Fact::Artifact { id: id.to_string() }
+    }
+
+    fn edge(artifact: &str, dependency: &str) -> Fact {
+        Fact::Edge {
+            artifact: artifact.to_string(),
+            dependency: dependency.to_string(),
+        }
+    }
+
+    fn release(id: &str, artifact: &str) -> Fact {
+        Fact::Release {
+            id: id.to_string(),
+            artifact: artifact.to_string(),
+        }
+    }
+
+    fn revoke(id: &str) -> Fact {
+        Fact::Revoke { id: id.to_string() }
+    }
+
+    #[test]
+    fn one_hop_candidate_misses_transitive_revocation() {
+        let fixture = model(&[
+            artifact("app"),
+            artifact("middle"),
+            artifact("base"),
+            edge("app", "middle"),
+            edge("middle", "base"),
+            release("prod", "app"),
+            revoke("base"),
+        ]);
+        assert_eq!(fixture.candidate_decision("prod"), Decision::approved());
+        assert_eq!(
+            fixture.reference_decision("prod"),
+            Decision::blocked(
+                "revoked",
+                vec!["app".to_string(), "middle".to_string(), "base".to_string()]
+            )
+        );
+    }
+
+    #[test]
+    fn reference_blocks_missing_transitive_manifest() {
+        let fixture = model(&[
+            artifact("app"),
+            artifact("middle"),
+            edge("app", "middle"),
+            edge("middle", "absent"),
+            release("prod", "app"),
+        ]);
+        assert_eq!(
+            fixture.reference_decision("prod"),
+            Decision::blocked(
+                "missing_manifest",
+                vec![
+                    "app".to_string(),
+                    "middle".to_string(),
+                    "absent".to_string()
+                ]
+            )
+        );
+    }
+
+    #[test]
+    fn reference_blocks_cycle_and_reports_stable_path() {
+        let fixture = model(&[
+            artifact("app"),
+            artifact("a"),
+            artifact("b"),
+            edge("app", "a"),
+            edge("a", "b"),
+            edge("b", "a"),
+            release("prod", "app"),
+        ]);
+        assert_eq!(
+            fixture.reference_decision("prod"),
+            Decision::blocked(
+                "invalid_cycle",
+                vec![
+                    "app".to_string(),
+                    "a".to_string(),
+                    "b".to_string(),
+                    "a".to_string()
+                ]
+            )
+        );
+    }
+
+    #[test]
+    fn reference_is_independent_of_fact_order_and_duplicate_edges() {
+        let mut facts = vec![
+            artifact("app"),
+            artifact("a"),
+            artifact("z"),
+            edge("app", "z"),
+            edge("app", "a"),
+            edge("app", "a"),
+            release("prod", "app"),
+            revoke("a"),
+            revoke("z"),
+        ];
+        let forward = model(&facts).reference_decision("prod");
+        facts.reverse();
+        let reverse = model(&facts).reference_decision("prod");
+        assert_eq!(forward, reverse);
+        assert_eq!(
+            forward,
+            Decision::blocked("revoked", vec!["app".to_string(), "a".to_string()])
+        );
+    }
+
+    #[test]
+    fn reference_approves_complete_acyclic_graph() {
+        let fixture = model(&[
+            artifact("app"),
+            artifact("base"),
+            edge("app", "base"),
+            release("prod", "app"),
+        ]);
+        assert_eq!(fixture.reference_decision("prod"), Decision::approved());
+    }
+}
diff --git a/developer-simulation/runs/2026-08-04--mixed-version-contract-gate/Cargo.toml b/developer-simulation/runs/2026-08-04--mixed-version-contract-gate/Cargo.toml
new file mode 100644
index 0000000..7b04afc
--- /dev/null
+++ b/developer-simulation/runs/2026-08-04--mixed-version-contract-gate/Cargo.toml
@@ -0,0 +1,17 @@
+[package]
+name = "mixed-version-contract-gate"
+version = "0.1.0"
+edition = "2024"
+publish = false
+
+[dependencies]
+serde = { version = "1", features = ["derive"] }
+serde_json = "1"
+
+[[bin]]
+name = "contract-gate"
+path = "src/main.rs"
+
+[[bin]]
+name = "generate"
+path = "src/bin/generate.rs"
diff --git a/developer-simulation/runs/2026-08-04--mixed-version-contract-gate/README.md b/developer-simulation/runs/2026-08-04--mixed-version-contract-gate/README.md
new file mode 100644
index 0000000..35f9d27
--- /dev/null
+++ b/developer-simulation/runs/2026-08-04--mixed-version-contract-gate/README.md
@@ -0,0 +1,92 @@
+# Mixed-version contract gate trial
+
+This standalone Rust CLI checks every producer-version × consumer-version pair
+per permitted topology relationship. It implements only this deliberately small
+contract language:
+
+- `type`: `string`, `integer`, `array`, or `object`
+- string `enum`
+- integer `minimum` and `maximum` (inclusive, signed 64-bit)
+- array `items`
+- object `properties`, `required`, and boolean `additionalProperties`
+- `default` on any supported schema; a required property with a valid default
+  may be absent because the receiver materializes that default
+
+Anything else is `review-required`, with a source and semantic JSON-pointer
+location. Defaults do not otherwise assert application semantics.
+
+## Input files
+
+`contracts.json` and `candidate.json` contain:
+
+```json
+{"contracts":[{"service":"api","topic":"orders","version":3,"schema":{"type":"object","properties":{},"required":[],"additionalProperties":false}}]}
+```
+
+Candidate entries replace a base contract with the same service, topic, and
+version. Identical duplicate entries are ignored; conflicting duplicates need
+review.
+
+`topology.json` contains:
+
+```json
+{"relationships":[{"topic":"orders","producer":"api","consumer":"worker"}]}
+```
+
+`fleet.json` contains the complete permitted version set for each service:
+
+```json
+{"services":{"api":[1,2,3],"worker":[1,2,3]}}
+```
+
+## Run
+
+Run from the BogKit repository root. Generated inputs and build output stay
+outside the archive.
+
+```console
+export CARGO_TARGET_DIR=/private/tmp/mixed-version-contract-target
+DEMO_DIR="$(mktemp -d /private/tmp/mixed-version-contract-demo.XXXXXX)"
+cargo run --offline --locked --manifest-path developer-simulation/Cargo.toml \
+  -p mixed-version-contract-gate --bin generate -- demo "$DEMO_DIR"
+cargo run --offline --locked --manifest-path developer-simulation/Cargo.toml \
+  -p mixed-version-contract-gate --bin contract-gate -- \
+  "$DEMO_DIR/contracts.json" \
+  "$DEMO_DIR/topology.json" \
+  "$DEMO_DIR/fleet.json" \
+  "$DEMO_DIR/candidate.json"
+```
+
+Exit status is 0 for `allow`, 1 for `block`, and 2 for `review-required` or
+input/usage errors. JSON output is deterministic. A witness is ranked first by
+JSON structural size, then encoded byte length, then canonical JSON bytes.
+
+The CLI uses an incremental path: it reuses the base result for unaffected
+pairs and reevaluates every pair touched by a candidate key. Tests compare that
+result exactly with a fresh full evaluation.
+
+## Verification
+
+```console
+export CARGO_TARGET_DIR=/private/tmp/mixed-version-contract-target
+cargo fmt --manifest-path developer-simulation/Cargo.toml \
+  -p mixed-version-contract-gate -- --check
+cargo clippy --offline --locked --manifest-path developer-simulation/Cargo.toml \
+  -p mixed-version-contract-gate --all-targets -- -D warnings
+cargo test --offline --locked --manifest-path developer-simulation/Cargo.toml \
+  -p mixed-version-contract-gate
+python3 developer-simulation/runs/2026-08-04--mixed-version-contract-gate/oracle.py \
+  developer-simulation/runs/2026-08-04--mixed-version-contract-gate/fixtures/semantic_cases.json
+```
+
+Generate the stated workload with:
+
+```console
+WORKLOAD_DIR="$(mktemp -d /private/tmp/mixed-version-contract-workload.XXXXXX)"
+cargo run --release --offline --locked \
+  --manifest-path developer-simulation/Cargo.toml \
+  -p mixed-version-contract-gate --bin generate -- workload "$WORKLOAD_DIR"
+```
+
+It contains exactly 300 services, 120 topics, 1,800 contracts, 12,000 unique
+relationships, three permitted versions per service, and 25 candidate entries.
diff --git a/developer-simulation/runs/2026-08-04--mixed-version-contract-gate/TRIAL_REPORT.md b/developer-simulation/runs/2026-08-04--mixed-version-contract-gate/TRIAL_REPORT.md
new file mode 100644
index 0000000..9b4a39d
--- /dev/null
+++ b/developer-simulation/runs/2026-08-04--mixed-version-contract-gate/TRIAL_REPORT.md
@@ -0,0 +1,273 @@
+# Trial notes — mixed-version contract gate
+
+## Skeptical review and coordinator correction
+
+The independent reviewer reproduced the demo, 64-case oracle agreement, and
+full 108,000-pair workload, but found a high-severity parser defect before
+archival: duplicate raw JSON member names used last-value-wins parsing and could
+turn `{"type":"string","type":"integer"}` into a false allow. The
+coordinator replaced that path with duplicate-rejecting parsing at every JSON
+nesting level and added regressions for root objects, contract records, schemas,
+topology, fleet, and candidates. All 8 corrected tests and strict lint pass.
+
+The reviewer also ran the previously missing full-scale reversed/identical-
+duplicate input and a two-direction cyclic relationship. Both passed with
+byte-identical or structurally bounded results. The final nested-workspace
+workload again evaluated 108,000 pairs with 237 issues and no review issues in
+0.52 seconds, using 119,144,448 bytes maximum RSS on this host. These are
+workload-specific results, not a formal proof, portability guarantee, or
+comparison with a runnable existing-system contract gate. Earlier corrected
+standalone and reviewer runs completed in 0.24-0.25 seconds with materially
+similar memory. The no-fit conclusion remains; no BogKit defect was
+demonstrated.
+
+The remainder preserves the blind developer's trail. This reviewed correction
+controls where an initial claim differs.
+
+Date: 2026-08-04
+Persona: deployment-platform developer; production Go, intermediate Rust
+Checkout: sanitized detached current-main checkout at `/private/tmp/bogkit-sim-2026-08-04-a`
+Trial: `/private/tmp/bogkit-sim-2026-08-04-a/trial`
+
+## Finishing criteria used
+
+The trial was considered complete only if it had a runnable four-input Rust CLI,
+deterministic mixed-version evaluation and witnesses, strict review behavior for
+unsupported/malformed input, a generator, at least 60 fixed semantic cases, an
+independent checker, shuffle/duplicate and incremental/full checks, a verified
+demo, formatting/lint/test passes, and an actually measured stated workload.
+
+## Exact discovery order and first-use friction
+
+No prior report, simulation directory, other temporary checkout, or other
+developer's work was inspected.
+
+1. `README.md`, via `pwd && sed -n '1,240p' README.md`.
+   - Learned that the recommended start is `./scripts/new-project.sh`, and that
+     the four public examples are starter, timeseries, chat, and search.
+2. `examples/starter/src/main.rs` and its file list, via
+   `rg --files examples/starter | sort` and `sed -n '1,240p' ...`.
+3. `examples/timeseries/src/main.rs`, using the same bounded file-list/read
+   pattern.
+4. `examples/chat/src/main.rs`, using the same bounded pattern.
+5. `examples/search/src/main.rs`, using the same bounded pattern.
+6. Runnable baseline attempt: `cargo run -p starter --offline`.
+   - Failed after 6.2 seconds while the `ese` build script attempted to download
+     `model.safetensors`; DNS was unavailable. This happened even though starter
+     does not use ESE in its source.
+7. Baseline retry with network: `cargo run -p starter`.
+   - Passed. Build finished in 6.88 seconds and the demo printed three entries,
+     then two after retracting `peat`.
+8. Root `Cargo.toml`, `examples/starter/Cargo.toml`, and a bounded Fold file list.
+   - Confirmed starter directly declares `anny`, `ese`, and `fold`, and the
+     workspace uses `examples/*` members.
+9. `fold/src/lib.rs`, `fold/src/stream/mod.rs`, and
+   `fold/src/pipeline/mod.rs`.
+10. `scripts/new-project.sh`, `fold/src/stream/unkeyed.rs`, and
+    `fold/src/pipeline/terminal/table.rs`.
+    - Confirmed the generator always adds all three local dependencies and Fold
+      provides persistent delta streams/materialized sinks, not schema-language
+      parsing or inclusion.
+
+The public README was useful for reaching a runnable example quickly. The main
+friction was that the advertised smallest example and generated-project template
+pull in the heavyweight ESE build artifact regardless of use.
+
+## Fit decision
+
+Decision: **do not use a BogKit component in this prototype**.
+
+The required work is a bounded, pure, order-independent language-inclusion pass
+over immutable manifests. Fold's value is durable incremental materialization of
+runtime deltas. Using it here would add a persistent store, transaction lifecycle,
+serialization constraints, and the observed workspace/model setup cost without
+removing the hard parts: strict parsing, recursive inclusion, minimal witnesses,
+and exact diagnostics. Candidate incrementality is cheaper and clearer as a
+sorted in-memory pair-result map that selectively reevaluates changed keys.
+
+This is a poor product fit, not evidence of a Fold correctness defect. No Anny or
+ESE capability relates to the problem.
+
+## Prototype delivered
+
+- Standalone Rust 2024 crate with only `serde` and `serde_json`.
+- CLI: `contract-gate <contracts.json> <topology.json> <fleet.json> <candidate.json>`.
+- Supported schema subset: required/optional object properties, strings, finite
+  string enums, bounded/unbounded signed integers, defaults, arrays, and
+  open/closed objects.
+- Every unique topology relationship expands to the full cross product of the
+  producer's and consumer's permitted fleet versions.
+- Candidate entries replace matching immutable base keys. The implementation
+  reuses unaffected base pair results and reevaluates every touched pair.
+- Unsupported keywords/types and malformed structures return `review-required`.
+  Contract diagnostics use a stable semantic identity pointer such as
+  `/contracts/service=a/topic=t/version=1/schema/pattern`; malformed JSON uses
+  parser line and column.
+- Conflicting contract-array duplicates and all duplicate JSON members require
+  review. Identical contracts, duplicate
+  relationships, and duplicate fleet versions are normalized.
+- Block issues are sorted by topic/service/version pair. Per-pair witness choice
+  is deterministic: fewest JSON nodes, shortest canonical encoding, canonical
+  byte order, then rule/path.
+- Generator modes:
+  - `demo`: six contracts, one relationship, nine version pairs, one seeded
+    required-field change.
+  - `workload`: exactly 300 services, 120 live topics, 1,800 immutable contracts,
+    12,000 unique relationships, three versions per service, and 25 candidates.
+- Fixed 64-case fixture catalog plus a structurally independent Python oracle.
+
+Default semantics are explicit and deliberately narrow: a valid default permits
+a receiver to materialize an absent required property. Different default values
+are not treated as breakage because arbitrary application semantics are a stated
+non-goal.
+
+## Commands and observed results
+
+Build and checks:
+
+- `cargo check --all-targets --offline`
+  - Initial compile exposed one Rust borrow error in the prototype; fixed.
+  - Final run passed.
+- `cargo fmt --all -- --check`
+  - Passed after formatting.
+- `cargo clippy --all-targets --offline -- -D warnings`
+  - Initial run found five library style warnings, then one generator loop
+    warning. All were fixed; final run passed with warnings denied.
+- `cargo test --offline`
+  - Final reviewed result: 8 tests passed, 0 failed.
+  - Includes 64 semantic fixture cases, exact diagnostic locations,
+    producer-accepted/consumer-rejected witness validation, malformed default,
+    unsupported construct behavior, shuffle/identical-duplicate stability, and
+    incremental/full equality.
+- `python3 oracle.py fixtures/semantic_cases.json`
+  - `independent oracle verified 64 semantic cases`.
+
+Demo:
+
+- `cargo run --offline --bin generate -- demo generated/demo`
+  - Generated all four inputs.
+- `cargo run --offline --bin contract-gate -- generated/demo/contracts.json generated/demo/topology.json generated/demo/fleet.json generated/demo/candidate.json`
+  - Exit 1 (`block`), evaluated all 9 pairs, returned exactly 3 issues: producer
+    versions 1, 2, and 3 against consumer version 3. Each rule was
+    `required-field-missing` at `/region`, witness `{"id":0}`.
+
+Generated workload validation:
+
+- Generator assertions and `jq` checks confirmed 300 services, 120 contract and
+  topology topics, 1,800 contracts, 12,000 relationships, every fleet entry with
+  3 versions, and 25 candidates.
+- Release build: `cargo build --release --offline --bins` passed.
+- Timed run (outside the restricted process-accounting sandbox):
+  `/usr/bin/time -l target/release/contract-gate ...`
+  - Exit 1 (`block`), as seeded.
+  - 0.24 seconds real, 0.23 seconds user.
+  - 118,784,000 bytes maximum resident set size = about 113.3 MiB.
+  - 99,697,048 bytes reported as peak memory footprint.
+  - Both goals passed: under 5 seconds and under 128 MiB in one process.
+  - 108,000 pairs evaluated (`12,000 × 3 × 3`).
+  - 237 issues, all the expected incoming producer-version combinations against
+    the one narrowed consumer contract; 0 review issues.
+- A repeat run produced the identical SHA-256
+  `d5cbec30584c237b56d03a507292ffb4772234c34be1f47a5ebbb3436e4fd5d7`.
+- The 25-candidate incremental result was normalized and diffed against a full
+  evaluation of the merged 1,800-contract manifest; `diff` exited 0.
+
+## Categorized findings
+
+### Documentation gap — moderate severity, high confidence
+
+The README calls starter the smallest Fold database and recommends the project
+script, but neither explains that the generated manifest unconditionally adds
+ANNy and ESE or that ESE's build downloads a model. Reproduction:
+`cargo run -p starter --offline` in a clean target directory. Smallest plausible
+improvement: make new-project dependencies opt-in and remove unused Anny/ESE
+dependencies from starter; document the optional ESE artifact.
+
+### Performance/setup problem — moderate severity, high confidence
+
+The smallest baseline compiled ESE and required its model despite no ESE use in
+starter source. This is baseline packaging/build behavior, not a contract-gate
+defect and not evidence about Fold runtime performance. Smallest improvement:
+remove the unused direct dependencies from the starter manifest.
+
+### Poor product fit — informational severity, high confidence
+
+Fold's persistent delta/materialized-view abstraction does not supply schema
+language inclusion and adds state that this read-only bounded gate does not need.
+Reproduction path: compare the documented `Stream`/`Push`/terminal interface to
+the four immutable inputs and deterministic batch output. Smallest improvement is
+documentation showing when a plain in-memory pass is preferable; no new Fold API
+is justified by this trial.
+
+### Missing capability — informational severity, high confidence
+
+No inspected BogKit component parses this schema subset, proves producer-language
+inclusion, or constructs counterexamples. This is outside the currently described
+BogKit scope, so it is not classified as a defect. The smallest plausible product
+change would be a separate contract-analysis crate only if this use case becomes
+intentional product scope.
+
+### API friction — low severity, medium confidence
+
+Public examples note that closure-containing pipeline types are hard to name and
+therefore use macros for snapshot helpers. This did not block the baseline and was
+not exercised in the prototype. A named/boxed pipeline-reader ergonomics example
+could help, but there is insufficient evidence here to recommend an API change.
+
+### Prototype correctness defects found and fixed
+
+- One internal borrow conflict prevented the first compile.
+- One fixture initially expected the typed-open-object rule while its consumer was
+  closed; the smaller valid witness correctly exercised the closed-object rule.
+  The fixture was corrected to isolate the intended open-object case.
+- Clippy findings were mechanical and fixed. No known defect remained after the
+  final verification set.
+
+## Consequential-choice decision audit
+
+1. **Use Fold or stay standalone?** Chose standalone after running the baseline
+   and reading Fold's public stream/pipeline interfaces. Consequence: minimal
+   dependencies and no persistence; the trial does not evaluate whether Fold
+   could cache results across separate CI jobs.
+2. **What does `default` mean?** Chose receiver materialization only. Consequence:
+   adding a required field with a valid receiver default is allowed, while
+   removing that protection can block. Default-value semantic changes remain out
+   of scope.
+3. **Fail open or require review?** Chose review for every unsupported keyword,
+   unsupported type, invalid bound/default, missing active contract, conflicting
+   duplicate, or malformed input. No unsupported construct can produce allow.
+4. **One issue or all issues?** Chose one smallest deterministic witness per
+   breaking version pair, while returning every breaking pair. Consequence: output
+   identifies rollout combinations without multiplying redundant rules per pair.
+5. **Incremental representation?** Chose an ordered pair-result cache and touched
+   key reevaluation. Consequence: simple exact equivalence with full evaluation;
+   no durable cross-run cache.
+6. **Output order?** Chose sorted semantic identities rather than source offsets.
+   Consequence: shuffle/duplicate stability while diagnostics retain stable exact
+   contract/schema pointers.
+
+## Unresolved uncertainty and limits
+
+- The 64 fixed cases and independent oracle are broad, but not an exhaustive
+  formal proof of the recursive schema inclusion implementation.
+- Minimality is exact under the documented ranking for the supported mismatch
+  constructors; no separate exhaustive witness enumerator was built for arbitrary
+  deeply nested schemas.
+- Shuffle/duplicate stability was executed in the test fixture; skeptical review
+  also reversed and identically duplicated the full input and received
+  byte-identical output.
+- Cyclic relationships are structurally bounded because relationships are expanded
+  independently with no graph traversal. Skeptical review added the reverse
+  relationship and observed 18 evaluated pairs with the same three issues; this
+  is not evidence of graph-level cyclic semantics.
+- Peak RSS passed by about 14.7 MiB. Only the recorded full-size process-accounting
+  run is claimed; no multi-run memory distribution was measured.
+- JSON numbers outside signed 64-bit integer bounds require review by design.
+
+## Separation of claims
+
+The ESE download and unused-dependency friction belongs to the documented BogKit
+starter/new-project baseline. Compile issues and fixture correction belonged only
+to this prototype and were fixed. The measured timing/memory and semantic results
+apply only to the generated workload and this machine/run; they are not general
+BogKit performance claims.
diff --git a/developer-simulation/runs/2026-08-04--mixed-version-contract-gate/fixtures/semantic_cases.json b/developer-simulation/runs/2026-08-04--mixed-version-contract-gate/fixtures/semantic_cases.json
new file mode 100644
index 0000000..6f351fd
--- /dev/null
+++ b/developer-simulation/runs/2026-08-04--mixed-version-contract-gate/fixtures/semantic_cases.json
@@ -0,0 +1,104 @@
+{
+  "schemas": {
+    "s": {"type":"string"},
+    "ea": {"type":"string","enum":["a"]},
+    "eab": {"type":"string","enum":["a","b"]},
+    "ebc": {"type":"string","enum":["b","c"]},
+    "i": {"type":"integer"},
+    "i0_10": {"type":"integer","minimum":0,"maximum":10},
+    "i1_9": {"type":"integer","minimum":1,"maximum":9},
+    "in10_n1": {"type":"integer","minimum":-10,"maximum":-1},
+    "in5_5": {"type":"integer","minimum":-5,"maximum":5},
+    "i10_20": {"type":"integer","minimum":10,"maximum":20},
+    "i0": {"type":"integer","minimum":0,"maximum":0},
+    "a_s": {"type":"array","items":{"type":"string"}},
+    "a_ea": {"type":"array","items":{"type":"string","enum":["a"]}},
+    "a_eab": {"type":"array","items":{"type":"string","enum":["a","b"]}},
+    "a_i": {"type":"array","items":{"type":"integer"}},
+    "a_i0_10": {"type":"array","items":{"type":"integer","minimum":0,"maximum":10}},
+    "a_i1_9": {"type":"array","items":{"type":"integer","minimum":1,"maximum":9}},
+    "o_closed": {"type":"object","properties":{},"required":[],"additionalProperties":false},
+    "o_open": {"type":"object","properties":{},"required":[],"additionalProperties":true},
+    "o_x_req_s": {"type":"object","properties":{"x":{"type":"string"}},"required":["x"],"additionalProperties":false},
+    "o_x_opt_s": {"type":"object","properties":{"x":{"type":"string"}},"required":[],"additionalProperties":false},
+    "o_x_opt_s_open": {"type":"object","properties":{"x":{"type":"string"}},"required":[],"additionalProperties":true},
+    "o_x_req_s_def": {"type":"object","properties":{"x":{"type":"string","default":""}},"required":["x"],"additionalProperties":false},
+    "o_x_req_ea": {"type":"object","properties":{"x":{"type":"string","enum":["a"]}},"required":["x"],"additionalProperties":false},
+    "o_x_req_eab": {"type":"object","properties":{"x":{"type":"string","enum":["a","b"]}},"required":["x"],"additionalProperties":false},
+    "o_x_req_i": {"type":"object","properties":{"x":{"type":"integer"}},"required":["x"],"additionalProperties":false},
+    "o_x_req_i_def0": {"type":"object","properties":{"x":{"type":"integer","default":0}},"required":["x"],"additionalProperties":false},
+    "o_x_req_i0_10": {"type":"object","properties":{"x":{"type":"integer","minimum":0,"maximum":10}},"required":["x"],"additionalProperties":false},
+    "o_x_req_i1_9": {"type":"object","properties":{"x":{"type":"integer","minimum":1,"maximum":9}},"required":["x"],"additionalProperties":false},
+    "nested_open": {"type":"object","properties":{"x":{"type":"object","properties":{},"required":[],"additionalProperties":true}},"required":["x"],"additionalProperties":false},
+    "nested_closed": {"type":"object","properties":{"x":{"type":"object","properties":{},"required":[],"additionalProperties":false}},"required":["x"],"additionalProperties":false},
+    "o_x_req_y_opt": {"type":"object","properties":{"x":{"type":"string"},"y":{"type":"string"}},"required":["x"],"additionalProperties":false},
+    "o_xy_req": {"type":"object","properties":{"x":{"type":"string"},"y":{"type":"string"}},"required":["x","y"],"additionalProperties":false},
+    "o_xy_req_y_def": {"type":"object","properties":{"x":{"type":"string"},"y":{"type":"string","default":""}},"required":["x","y"],"additionalProperties":false}
+  },
+  "cases": [
+    {"name":"01 unconstrained strings","producer":"s","consumer":"s","expected":"allow"},
+    {"name":"02 enum into string","producer":"ea","consumer":"s","expected":"allow"},
+    {"name":"03 equal one-value enum","producer":"ea","consumer":"ea","expected":"allow"},
+    {"name":"04 narrower producer enum","producer":"ea","consumer":"eab","expected":"allow"},
+    {"name":"05 wider producer enum","producer":"eab","consumer":"ea","expected":"block","rule":"enum-value-rejected"},
+    {"name":"06 unconstrained into enum","producer":"s","consumer":"eab","expected":"block","rule":"enum-value-rejected"},
+    {"name":"07 overlapping enum right","producer":"ebc","consumer":"eab","expected":"block","rule":"enum-value-rejected"},
+    {"name":"08 overlapping enum left","producer":"eab","consumer":"ebc","expected":"block","rule":"enum-value-rejected"},
+    {"name":"09 unconstrained integers","producer":"i","consumer":"i","expected":"allow"},
+    {"name":"10 bounded into integer","producer":"i0_10","consumer":"i","expected":"allow"},
+    {"name":"11 equal bounds","producer":"i0_10","consumer":"i0_10","expected":"allow"},
+    {"name":"12 narrower bounds","producer":"i1_9","consumer":"i0_10","expected":"allow"},
+    {"name":"13 narrower both sides","producer":"i0_10","consumer":"i1_9","expected":"block","rule":"integer-below-minimum"},
+    {"name":"14 raised minimum","producer":"i0_10","consumer":"i1_9","expected":"block","rule":"integer-below-minimum"},
+    {"name":"15 lowered maximum","producer":"i0_10","consumer":"i0","expected":"block","rule":"integer-above-maximum"},
+    {"name":"16 unconstrained into bounds","producer":"i","consumer":"i0_10","expected":"block","rule":"integer-below-minimum"},
+    {"name":"17 negative lower narrowing","producer":"in10_n1","consumer":"in5_5","expected":"block","rule":"integer-below-minimum"},
+    {"name":"18 negative upper narrowing","producer":"in5_5","consumer":"in10_n1","expected":"block","rule":"integer-above-maximum"},
+    {"name":"19 disjoint high producer","producer":"i10_20","consumer":"i0_10","expected":"block","rule":"integer-above-maximum"},
+    {"name":"20 zero below consumer","producer":"i0","consumer":"i1_9","expected":"block","rule":"integer-below-minimum"},
+    {"name":"21 positive above zero","producer":"i1_9","consumer":"i0","expected":"block","rule":"integer-above-maximum"},
+    {"name":"22 negative range into integer","producer":"in10_n1","consumer":"i","expected":"allow"},
+    {"name":"23 string versus integer","producer":"s","consumer":"i","expected":"block","rule":"type-mismatch"},
+    {"name":"24 integer versus string","producer":"i","consumer":"s","expected":"block","rule":"type-mismatch"},
+    {"name":"25 array versus object","producer":"a_s","consumer":"o_open","expected":"block","rule":"type-mismatch"},
+    {"name":"26 object versus array","producer":"o_closed","consumer":"a_s","expected":"block","rule":"type-mismatch"},
+    {"name":"27 string versus array","producer":"s","consumer":"a_s","expected":"block","rule":"type-mismatch"},
+    {"name":"28 array versus string","producer":"a_s","consumer":"s","expected":"block","rule":"type-mismatch"},
+    {"name":"29 object versus string","producer":"o_closed","consumer":"s","expected":"block","rule":"type-mismatch"},
+    {"name":"30 integer versus object","producer":"i","consumer":"o_open","expected":"block","rule":"type-mismatch"},
+    {"name":"31 object versus integer","producer":"o_closed","consumer":"i","expected":"block","rule":"type-mismatch"},
+    {"name":"32 array item integer versus string","producer":"a_i","consumer":"a_s","expected":"block","rule":"type-mismatch"},
+    {"name":"33 array item string versus integer","producer":"a_s","consumer":"a_i","expected":"block","rule":"type-mismatch"},
+    {"name":"34 equal closed objects","producer":"o_closed","consumer":"o_closed","expected":"allow"},
+    {"name":"35 closed producer open consumer","producer":"o_closed","consumer":"o_open","expected":"allow"},
+    {"name":"36 equal open objects","producer":"o_open","consumer":"o_open","expected":"allow"},
+    {"name":"37 open producer closed consumer","producer":"o_open","consumer":"o_closed","expected":"block","rule":"closed-object-rejects-property"},
+    {"name":"38 equal required field","producer":"o_x_req_s","consumer":"o_x_req_s","expected":"allow"},
+    {"name":"39 required into optional","producer":"o_x_req_s","consumer":"o_x_opt_s","expected":"allow"},
+    {"name":"40 optional into required","producer":"o_x_opt_s","consumer":"o_x_req_s","expected":"block","rule":"required-field-missing"},
+    {"name":"41 optional into defaulted required","producer":"o_x_opt_s","consumer":"o_x_req_s_def","expected":"allow"},
+    {"name":"42 producer can omit defaulted required","producer":"o_x_req_s_def","consumer":"o_x_req_s","expected":"block","rule":"required-field-missing"},
+    {"name":"43 required extra into closed","producer":"o_x_req_s","consumer":"o_closed","expected":"block","rule":"closed-object-rejects-property"},
+    {"name":"44 optional extra into closed","producer":"o_x_opt_s","consumer":"o_closed","expected":"block","rule":"closed-object-rejects-property"},
+    {"name":"45 optional extra into open","producer":"o_x_opt_s","consumer":"o_open","expected":"allow"},
+    {"name":"46 open producer can violate typed optional","producer":"o_open","consumer":"o_x_opt_s_open","expected":"block","rule":"open-object-property-unconstrained"},
+    {"name":"47 open producer can omit required","producer":"o_open","consumer":"o_x_req_s","expected":"block","rule":"required-field-missing"},
+    {"name":"48 nested narrow enum","producer":"o_x_req_ea","consumer":"o_x_req_eab","expected":"allow"},
+    {"name":"49 nested wider enum","producer":"o_x_req_eab","consumer":"o_x_req_ea","expected":"block","rule":"enum-value-rejected"},
+    {"name":"50 nested raised minimum","producer":"o_x_req_i0_10","consumer":"o_x_req_i1_9","expected":"block","rule":"integer-below-minimum"},
+    {"name":"51 nested narrower integer","producer":"o_x_req_i1_9","consumer":"o_x_req_i0_10","expected":"allow"},
+    {"name":"52 empty object missing required","producer":"o_closed","consumer":"o_x_req_s","expected":"block","rule":"required-field-missing"},
+    {"name":"53 empty object uses default","producer":"o_closed","consumer":"o_x_req_s_def","expected":"allow"},
+    {"name":"54 equal string arrays","producer":"a_s","consumer":"a_s","expected":"allow"},
+    {"name":"55 narrow enum array","producer":"a_ea","consumer":"a_eab","expected":"allow"},
+    {"name":"56 wide enum array","producer":"a_eab","consumer":"a_ea","expected":"block","rule":"enum-value-rejected"},
+    {"name":"57 array raised minimum","producer":"a_i0_10","consumer":"a_i1_9","expected":"block","rule":"integer-below-minimum"},
+    {"name":"58 array narrower range","producer":"a_i1_9","consumer":"a_i0_10","expected":"allow"},
+    {"name":"59 unconstrained string array into enum","producer":"a_s","consumer":"a_eab","expected":"block","rule":"enum-value-rejected"},
+    {"name":"60 nested open into closed","producer":"nested_open","consumer":"nested_closed","expected":"block","rule":"closed-object-rejects-property"},
+    {"name":"61 nested closed into open","producer":"nested_closed","consumer":"nested_open","expected":"allow"},
+    {"name":"62 newly required second field","producer":"o_x_req_y_opt","consumer":"o_xy_req","expected":"block","rule":"required-field-missing"},
+    {"name":"63 defaulted second field","producer":"o_x_req_y_opt","consumer":"o_xy_req_y_def","expected":"allow"},
+    {"name":"64 consumer optional field accepts subset","producer":"o_x_req_s","consumer":"o_x_req_y_opt","expected":"allow"}
+  ]
+}
diff --git a/developer-simulation/runs/2026-08-04--mixed-version-contract-gate/oracle.py b/developer-simulation/runs/2026-08-04--mixed-version-contract-gate/oracle.py
new file mode 100644
index 0000000..94c6e34
--- /dev/null
+++ b/developer-simulation/runs/2026-08-04--mixed-version-contract-gate/oracle.py
@@ -0,0 +1,99 @@
+#!/usr/bin/env python3
+"""Independent, deliberately small semantic oracle for the fixture catalog.
+
+This does not invoke, import, or reproduce the Rust parser. It reasons over
+already-valid fixture schemas and checks language inclusion by structural rules.
+"""
+
+import json
+import sys
+from pathlib import Path
+
+
+def first_break(producer, consumer):
+    if producer["type"] != consumer["type"]:
+        return "type-mismatch"
+
+    kind = producer["type"]
+    if kind == "string":
+        consumer_enum = consumer.get("enum")
+        if consumer_enum is None:
+            return None
+        producer_enum = producer.get("enum")
+        if producer_enum is None or not set(producer_enum).issubset(consumer_enum):
+            return "enum-value-rejected"
+        return None
+
+    if kind == "integer":
+        producer_min = producer.get("minimum")
+        producer_max = producer.get("maximum")
+        consumer_min = consumer.get("minimum")
+        consumer_max = consumer.get("maximum")
+        if consumer_min is not None and (producer_min is None or producer_min < consumer_min):
+            return "integer-below-minimum"
+        if consumer_max is not None and (producer_max is None or producer_max > consumer_max):
+            return "integer-above-maximum"
+        return None
+
+    if kind == "array":
+        return first_break(producer["items"], consumer["items"])
+
+    if kind == "object":
+        producer_properties = producer.get("properties", {})
+        consumer_properties = consumer.get("properties", {})
+        producer_required = set(producer.get("required", []))
+        consumer_required = set(consumer.get("required", []))
+
+        for name in sorted(consumer_required):
+            consumer_has_default = "default" in consumer_properties[name]
+            producer_always_has = (
+                name in producer_required
+                and name in producer_properties
+                and "default" not in producer_properties[name]
+            )
+            if not consumer_has_default and not producer_always_has:
+                return "required-field-missing"
+
+        for name in sorted(producer_properties):
+            if name in consumer_properties:
+                nested = first_break(producer_properties[name], consumer_properties[name])
+                if nested:
+                    return nested
+            elif not consumer.get("additionalProperties", True):
+                return "closed-object-rejects-property"
+
+        if producer.get("additionalProperties", True):
+            if not consumer.get("additionalProperties", True):
+                return "closed-object-rejects-property"
+            if any(name not in producer_properties for name in consumer_properties):
+                return "open-object-property-unconstrained"
+        return None
+
+    raise AssertionError(f"fixture uses unsupported type {kind!r}")
+
+
+def main():
+    if len(sys.argv) != 2:
+        raise SystemExit("usage: oracle.py <semantic_cases.json>")
+    fixture = json.loads(Path(sys.argv[1]).read_text())
+    schemas = fixture["schemas"]
+    cases = fixture["cases"]
+    if len(cases) < 60:
+        raise AssertionError(f"fixture regression: only {len(cases)} cases")
+
+    failures = []
+    for case in cases:
+        rule = first_break(schemas[case["producer"]], schemas[case["consumer"]])
+        actual = "allow" if rule is None else "block"
+        if actual != case["expected"] or (rule is not None and rule != case["rule"]):
+            failures.append(
+                f'{case["name"]}: expected {case["expected"]}/{case.get("rule")}, '
+                f"oracle got {actual}/{rule}"
+            )
+    if failures:
+        raise AssertionError("\n".join(failures))
+    print(f"independent oracle verified {len(cases)} semantic cases")
+
+
+if __name__ == "__main__":
+    main()
diff --git a/developer-simulation/runs/2026-08-04--mixed-version-contract-gate/src/bin/generate.rs b/developer-simulation/runs/2026-08-04--mixed-version-contract-gate/src/bin/generate.rs
new file mode 100644
index 0000000..0830791
--- /dev/null
+++ b/developer-simulation/runs/2026-08-04--mixed-version-contract-gate/src/bin/generate.rs
@@ -0,0 +1,183 @@
+use std::collections::BTreeSet;
+use std::env;
+use std::fs;
+use std::path::Path;
+use std::process::ExitCode;
+
+use serde_json::{Value, json};
+
+fn main() -> ExitCode {
+    let args: Vec<String> = env::args().skip(1).collect();
+    if args.len() != 2 || !matches!(args[0].as_str(), "demo" | "workload") {
+        eprintln!("usage: generate <demo|workload> <output-directory>");
+        return ExitCode::from(2);
+    }
+    let output = Path::new(&args[1]);
+    if let Err(error) = fs::create_dir_all(output) {
+        eprintln!("cannot create {}: {error}", output.display());
+        return ExitCode::from(2);
+    }
+    let files = if args[0] == "demo" {
+        demo_files()
+    } else {
+        workload_files()
+    };
+    for (name, value) in files {
+        let path = output.join(name);
+        let data = serde_json::to_vec_pretty(&value).expect("generated JSON is serializable");
+        if let Err(error) = fs::write(&path, data) {
+            eprintln!("cannot write {}: {error}", path.display());
+            return ExitCode::from(2);
+        }
+    }
+    println!("generated {} data in {}", args[0], output.display());
+    ExitCode::SUCCESS
+}
+
+fn demo_files() -> Vec<(&'static str, Value)> {
+    let producer = object_schema(false, false);
+    let consumer = object_schema(false, false);
+    let candidate = object_schema(true, false);
+    let mut contracts = Vec::new();
+    for version in 1..=3 {
+        contracts.push(contract("producer", "orders", version, producer.clone()));
+        contracts.push(contract("consumer", "orders", version, consumer.clone()));
+    }
+    vec![
+        ("contracts.json", json!({"contracts": contracts})),
+        (
+            "topology.json",
+            json!({"relationships":[{"topic":"orders","producer":"producer","consumer":"consumer"}]}),
+        ),
+        (
+            "fleet.json",
+            json!({"services":{"producer":[1,2,3],"consumer":[1,2,3]}}),
+        ),
+        (
+            "candidate.json",
+            json!({"contracts":[contract("consumer", "orders", 3, candidate)]}),
+        ),
+    ]
+}
+
+fn workload_files() -> Vec<(&'static str, Value)> {
+    let mut memberships = vec![BTreeSet::<usize>::new(); 300];
+    for topics in memberships.iter_mut().take(150) {
+        topics.insert(0);
+    }
+    for (service, topics) in memberships.iter_mut().enumerate() {
+        topics.insert(1 + service % 119);
+    }
+    for (service, topics) in memberships.iter_mut().enumerate().take(150) {
+        topics.insert(1 + (service + 37) % 119);
+    }
+    assert_eq!(memberships.iter().map(BTreeSet::len).sum::<usize>(), 600);
+
+    let base_schema = object_schema(false, true);
+    let mut contracts = Vec::with_capacity(1_800);
+    for (service, topics) in memberships.iter().enumerate() {
+        for topic in topics {
+            for version in 1..=3 {
+                contracts.push(contract(
+                    &format!("svc{service:03}"),
+                    &format!("topic{topic:03}"),
+                    version,
+                    base_schema.clone(),
+                ));
+            }
+        }
+    }
+    assert_eq!(contracts.len(), 1_800);
+
+    let mut relationships = Vec::with_capacity(12_000);
+    // Put every declared topic into the live topology, then fill the remaining
+    // relationship budget from the deliberately dense topic000 cohort.
+    for topic in 1..120 {
+        let members = memberships
+            .iter()
+            .enumerate()
+            .filter_map(|(service, topics)| topics.contains(&topic).then_some(service))
+            .take(2)
+            .collect::<Vec<_>>();
+        assert_eq!(members.len(), 2);
+        relationships.push(json!({
+            "topic":format!("topic{topic:03}"),
+            "producer":format!("svc{:03}", members[0]),
+            "consumer":format!("svc{:03}", members[1])
+        }));
+    }
+    'outer: for producer in 0..150 {
+        for consumer in 0..150 {
+            if producer == consumer {
+                continue;
+            }
+            relationships.push(json!({
+                "topic":"topic000",
+                "producer":format!("svc{producer:03}"),
+                "consumer":format!("svc{consumer:03}")
+            }));
+            if relationships.len() == 12_000 {
+                break 'outer;
+            }
+        }
+    }
+    assert_eq!(relationships.len(), 12_000);
+
+    let services = (0..300)
+        .map(|service| (format!("svc{service:03}"), json!([1, 2, 3])))
+        .collect::<serde_json::Map<_, _>>();
+
+    let mut candidates = vec![contract("svc000", "topic000", 3, object_schema(true, true))];
+    for (service, topics) in memberships.iter().enumerate().take(174).skip(150) {
+        let topic = *topics.iter().next().expect("service has a topic");
+        candidates.push(contract(
+            &format!("svc{service:03}"),
+            &format!("topic{topic:03}"),
+            3,
+            base_schema.clone(),
+        ));
+    }
+    assert_eq!(candidates.len(), 25);
+
+    vec![
+        ("contracts.json", json!({"contracts": contracts})),
+        ("topology.json", json!({"relationships": relationships})),
+        ("fleet.json", json!({"services": services})),
+        ("candidate.json", json!({"contracts": candidates})),
+    ]
+}
+
+fn contract(service: &str, topic: &str, version: u32, schema: Value) -> Value {
+    json!({
+        "service":service,
+        "topic":topic,
+        "version":version,
+        "schema":schema
+    })
+}
+
+fn object_schema(require_region: bool, include_payload: bool) -> Value {
+    let mut properties = serde_json::Map::new();
+    properties.insert(
+        "id".to_string(),
+        json!({"type":"integer","minimum":0,"maximum":1_000_000}),
+    );
+    properties.insert(
+        "region".to_string(),
+        json!({"type":"string","enum":["eu","us"]}),
+    );
+    if include_payload {
+        properties.insert("payload".to_string(), json!({"type":"string"}));
+    }
+    let required = if require_region {
+        json!(["id", "region"])
+    } else {
+        json!(["id"])
+    };
+    json!({
+        "type":"object",
+        "properties":properties,
+        "required":required,
+        "additionalProperties":false
+    })
+}
diff --git a/developer-simulation/runs/2026-08-04--mixed-version-contract-gate/src/lib.rs b/developer-simulation/runs/2026-08-04--mixed-version-contract-gate/src/lib.rs
new file mode 100644
index 0000000..188c934
--- /dev/null
+++ b/developer-simulation/runs/2026-08-04--mixed-version-contract-gate/src/lib.rs
@@ -0,0 +1,1369 @@
+use std::cmp::Ordering;
+use std::collections::{BTreeMap, BTreeSet};
+use std::fs;
+
+use serde::de::{self, DeserializeSeed, MapAccess, SeqAccess, Visitor};
+use serde::{Deserialize, Serialize};
+use serde_json::{Map, Number, Value, json};
+
+struct StrictValueSeed;
+
+impl<'de> DeserializeSeed<'de> for StrictValueSeed {
+    type Value = Value;
+
+    fn deserialize<D>(self, deserializer: D) -> Result<Self::Value, D::Error>
+    where
+        D: serde::Deserializer<'de>,
+    {
+        deserializer.deserialize_any(StrictValueVisitor)
+    }
+}
+
+struct StrictValueVisitor;
+
+impl<'de> Visitor<'de> for StrictValueVisitor {
+    type Value = Value;
+
+    fn expecting(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        formatter.write_str("a JSON value without duplicate object members")
+    }
+
+    fn visit_bool<E>(self, value: bool) -> Result<Self::Value, E> {
+        Ok(Value::Bool(value))
+    }
+
+    fn visit_i64<E>(self, value: i64) -> Result<Self::Value, E> {
+        Ok(Value::Number(Number::from(value)))
+    }
+
+    fn visit_u64<E>(self, value: u64) -> Result<Self::Value, E> {
+        Ok(Value::Number(Number::from(value)))
+    }
+
+    fn visit_f64<E>(self, value: f64) -> Result<Self::Value, E>
+    where
+        E: de::Error,
+    {
+        Number::from_f64(value)
+            .map(Value::Number)
+            .ok_or_else(|| E::custom("non-finite JSON number"))
+    }
+
+    fn visit_str<E>(self, value: &str) -> Result<Self::Value, E> {
+        Ok(Value::String(value.to_owned()))
+    }
+
+    fn visit_string<E>(self, value: String) -> Result<Self::Value, E> {
+        Ok(Value::String(value))
+    }
+
+    fn visit_none<E>(self) -> Result<Self::Value, E> {
+        Ok(Value::Null)
+    }
+
+    fn visit_unit<E>(self) -> Result<Self::Value, E> {
+        Ok(Value::Null)
+    }
+
+    fn visit_seq<A>(self, mut sequence: A) -> Result<Self::Value, A::Error>
+    where
+        A: SeqAccess<'de>,
+    {
+        let mut values = Vec::new();
+        while let Some(value) = sequence.next_element_seed(StrictValueSeed)? {
+            values.push(value);
+        }
+        Ok(Value::Array(values))
+    }
+
+    fn visit_map<A>(self, mut object: A) -> Result<Self::Value, A::Error>
+    where
+        A: MapAccess<'de>,
+    {
+        let mut values = Map::new();
+        while let Some(key) = object.next_key::<String>()? {
+            if values.contains_key(&key) {
+                return Err(de::Error::custom(format!(
+                    "duplicate object member `{key}`"
+                )));
+            }
+            values.insert(key, object.next_value_seed(StrictValueSeed)?);
+        }
+        Ok(Value::Object(values))
+    }
+}
+
+fn parse_json_strict(text: &str) -> Result<Value, serde_json::Error> {
+    let mut deserializer = serde_json::Deserializer::from_str(text);
+    let value = StrictValueSeed.deserialize(&mut deserializer)?;
+    deserializer.end()?;
+    Ok(value)
+}
+
+#[derive(Clone, Debug, Eq, PartialEq)]
+pub struct Schema {
+    kind: Kind,
+    default: Option<Value>,
+}
+
+#[derive(Clone, Debug, Eq, PartialEq)]
+enum Kind {
+    String {
+        values: Option<BTreeSet<String>>,
+    },
+    Integer {
+        minimum: Option<i64>,
+        maximum: Option<i64>,
+    },
+    Array {
+        items: Box<Schema>,
+    },
+    Object {
+        properties: BTreeMap<String, Schema>,
+        required: BTreeSet<String>,
+        open: bool,
+    },
+}
+
+#[derive(Clone, Debug, Eq, PartialEq, Ord, PartialOrd)]
+struct ContractKey {
+    service: String,
+    topic: String,
+    version: u32,
+}
+
+#[derive(Clone, Debug, Eq, PartialEq, Ord, PartialOrd)]
+struct Relationship {
+    topic: String,
+    producer: String,
+    consumer: String,
+}
+
+#[derive(Clone, Debug, Eq, PartialEq, Ord, PartialOrd)]
+struct PairKey {
+    topic: String,
+    producer_service: String,
+    producer_version: u32,
+    consumer_service: String,
+    consumer_version: u32,
+}
+
+#[derive(Clone, Debug, Eq, PartialEq)]
+struct Violation {
+    rule: String,
+    path: String,
+    witness: Value,
+}
+
+#[derive(Clone, Debug, Eq, PartialEq, Serialize, Deserialize)]
+pub struct BlockIssue {
+    pub topic: String,
+    pub producer_service: String,
+    pub producer_version: u32,
+    pub consumer_service: String,
+    pub consumer_version: u32,
+    pub rule: String,
+    pub path: String,
+    pub witness: Value,
+}
+
+#[derive(Clone, Debug, Eq, PartialEq, Ord, PartialOrd, Serialize, Deserialize)]
+pub struct ReviewIssue {
+    pub source: String,
+    pub path: String,
+    pub message: String,
+}
+
+#[derive(Clone, Copy, Debug, Eq, PartialEq, Serialize, Deserialize)]
+#[serde(rename_all = "kebab-case")]
+pub enum GateStatus {
+    Allow,
+    Block,
+    ReviewRequired,
+}
+
+#[derive(Clone, Debug, Eq, PartialEq, Serialize, Deserialize)]
+pub struct GateResult {
+    pub status: GateStatus,
+    pub evaluated_pairs: usize,
+    pub contract_count: usize,
+    pub candidate_count: usize,
+    pub issues: Vec<BlockIssue>,
+    pub review: Vec<ReviewIssue>,
+}
+
+#[derive(Default)]
+struct ParsedInput {
+    contracts: BTreeMap<ContractKey, Schema>,
+    relationships: BTreeSet<Relationship>,
+    fleet: BTreeMap<String, BTreeSet<u32>>,
+    review: BTreeSet<ReviewIssue>,
+}
+
+pub fn run_files(contracts: &str, topology: &str, fleet: &str, candidate: &str) -> GateResult {
+    let mut parsed = ParsedInput::default();
+    let base_value = read_json(contracts, "contracts.json", &mut parsed.review);
+    let topology_value = read_json(topology, "topology.json", &mut parsed.review);
+    let fleet_value = read_json(fleet, "fleet.json", &mut parsed.review);
+    let candidate_value = read_json(candidate, "candidate.json", &mut parsed.review);
+
+    if let Some(value) = base_value {
+        parsed.contracts = parse_contract_file(value, "contracts.json", &mut parsed.review);
+    }
+    if let Some(value) = topology_value {
+        parsed.relationships = parse_topology(value, &mut parsed.review);
+    }
+    if let Some(value) = fleet_value {
+        parsed.fleet = parse_fleet(value, &mut parsed.review);
+    }
+    let candidates = candidate_value.map_or_else(BTreeMap::new, |value| {
+        parse_contract_file(value, "candidate.json", &mut parsed.review)
+    });
+
+    if !parsed.review.is_empty() {
+        return GateResult {
+            status: GateStatus::ReviewRequired,
+            evaluated_pairs: 0,
+            contract_count: parsed.contracts.len(),
+            candidate_count: candidates.len(),
+            issues: Vec::new(),
+            review: parsed.review.into_iter().collect(),
+        };
+    }
+
+    let mut reference_review = BTreeSet::new();
+    validate_references(&parsed, &candidates, &mut reference_review);
+    parsed.review.extend(reference_review);
+    if !parsed.review.is_empty() {
+        return GateResult {
+            status: GateStatus::ReviewRequired,
+            evaluated_pairs: 0,
+            contract_count: parsed.contracts.len(),
+            candidate_count: candidates.len(),
+            issues: Vec::new(),
+            review: parsed.review.into_iter().collect(),
+        };
+    }
+
+    let base_pairs = evaluate_map(&parsed.contracts, &parsed.relationships, &parsed.fleet);
+    let evaluated_pairs = base_pairs.len();
+    let final_pairs = evaluate_incremental(
+        base_pairs,
+        &parsed.contracts,
+        &candidates,
+        &parsed.relationships,
+        &parsed.fleet,
+    );
+    let issues = final_pairs.into_values().flatten().collect::<Vec<_>>();
+    GateResult {
+        status: if issues.is_empty() {
+            GateStatus::Allow
+        } else {
+            GateStatus::Block
+        },
+        evaluated_pairs,
+        contract_count: parsed.contracts.len(),
+        candidate_count: candidates.len(),
+        issues,
+        review: Vec::new(),
+    }
+}
+
+fn read_json(path: &str, source: &str, review: &mut BTreeSet<ReviewIssue>) -> Option<Value> {
+    match fs::read_to_string(path) {
+        Ok(text) => match parse_json_strict(&text) {
+            Ok(value) => Some(value),
+            Err(error) => {
+                review.insert(ReviewIssue {
+                    source: source.to_string(),
+                    path: format!("line {}, column {}", error.line(), error.column()),
+                    message: format!("malformed JSON: {error}"),
+                });
+                None
+            }
+        },
+        Err(error) => {
+            review.insert(ReviewIssue {
+                source: source.to_string(),
+                path: "$".to_string(),
+                message: format!("cannot read input: {error}"),
+            });
+            None
+        }
+    }
+}
+
+fn review_issue(review: &mut BTreeSet<ReviewIssue>, source: &str, path: &str, message: &str) {
+    review.insert(ReviewIssue {
+        source: source.to_string(),
+        path: path.to_string(),
+        message: message.to_string(),
+    });
+}
+
+fn object_at<'a>(
+    value: &'a Value,
+    source: &str,
+    path: &str,
+    review: &mut BTreeSet<ReviewIssue>,
+) -> Option<&'a Map<String, Value>> {
+    match value.as_object() {
+        Some(object) => Some(object),
+        None => {
+            review_issue(review, source, path, "expected an object");
+            None
+        }
+    }
+}
+
+fn allowed_keys(
+    object: &Map<String, Value>,
+    allowed: &[&str],
+    source: &str,
+    path: &str,
+    review: &mut BTreeSet<ReviewIssue>,
+) {
+    for key in object.keys() {
+        if !allowed.contains(&key.as_str()) {
+            review_issue(
+                review,
+                source,
+                &format!("{path}/{}", pointer(key)),
+                &format!("unsupported field or schema keyword `{key}`"),
+            );
+        }
+    }
+}
+
+fn parse_contract_file(
+    value: Value,
+    source: &str,
+    review: &mut BTreeSet<ReviewIssue>,
+) -> BTreeMap<ContractKey, Schema> {
+    let mut out = BTreeMap::new();
+    let Some(root) = object_at(&value, source, "$", review) else {
+        return out;
+    };
+    allowed_keys(root, &["contracts"], source, "$", review);
+    let Some(entries) = root.get("contracts").and_then(Value::as_array) else {
+        review_issue(review, source, "/contracts", "expected an array");
+        return out;
+    };
+
+    for (index, entry) in entries.iter().enumerate() {
+        let fallback = format!("/contracts/{index}");
+        let Some(object) = object_at(entry, source, &fallback, review) else {
+            continue;
+        };
+        allowed_keys(
+            object,
+            &["service", "topic", "version", "schema"],
+            source,
+            &fallback,
+            review,
+        );
+        let service = required_string(object, "service", source, &fallback, review);
+        let topic = required_string(object, "topic", source, &fallback, review);
+        let version = required_u32(object, "version", source, &fallback, review);
+        let (Some(service), Some(topic), Some(version)) = (service, topic, version) else {
+            continue;
+        };
+        let key = ContractKey {
+            service,
+            topic,
+            version,
+        };
+        let identity = contract_path(&key);
+        let Some(schema_value) = object.get("schema") else {
+            review_issue(
+                review,
+                source,
+                &format!("{identity}/schema"),
+                "missing schema",
+            );
+            continue;
+        };
+        let Some(schema) =
+            parse_schema(schema_value, source, &format!("{identity}/schema"), review)
+        else {
+            continue;
+        };
+        match out.get(&key) {
+            None => {
+                out.insert(key, schema);
+            }
+            Some(existing) if existing == &schema => {}
+            Some(_) => review_issue(
+                review,
+                source,
+                &identity,
+                "conflicting duplicate contract identity",
+            ),
+        }
+    }
+    out
+}
+
+fn parse_topology(value: Value, review: &mut BTreeSet<ReviewIssue>) -> BTreeSet<Relationship> {
+    let source = "topology.json";
+    let mut out = BTreeSet::new();
+    let Some(root) = object_at(&value, source, "$", review) else {
+        return out;
+    };
+    allowed_keys(root, &["relationships"], source, "$", review);
+    let Some(entries) = root.get("relationships").and_then(Value::as_array) else {
+        review_issue(review, source, "/relationships", "expected an array");
+        return out;
+    };
+    for (index, entry) in entries.iter().enumerate() {
+        let path = format!("/relationships/{index}");
+        let Some(object) = object_at(entry, source, &path, review) else {
+            continue;
+        };
+        allowed_keys(
+            object,
+            &["topic", "producer", "consumer"],
+            source,
+            &path,
+            review,
+        );
+        let topic = required_string(object, "topic", source, &path, review);
+        let producer = required_string(object, "producer", source, &path, review);
+        let consumer = required_string(object, "consumer", source, &path, review);
+        if let (Some(topic), Some(producer), Some(consumer)) = (topic, producer, consumer) {
+            out.insert(Relationship {
+                topic,
+                producer,
+                consumer,
+            });
+        }
+    }
+    out
+}
+
+fn parse_fleet(
+    value: Value,
+    review: &mut BTreeSet<ReviewIssue>,
+) -> BTreeMap<String, BTreeSet<u32>> {
+    let source = "fleet.json";
+    let mut out = BTreeMap::new();
+    let Some(root) = object_at(&value, source, "$", review) else {
+        return out;
+    };
+    allowed_keys(root, &["services"], source, "$", review);
+    let Some(services) = root.get("services").and_then(Value::as_object) else {
+        review_issue(review, source, "/services", "expected an object");
+        return out;
+    };
+    for (service, versions) in services {
+        let path = format!("/services/{}", pointer(service));
+        let Some(array) = versions.as_array() else {
+            review_issue(review, source, &path, "expected an array of versions");
+            continue;
+        };
+        let mut version_set = BTreeSet::new();
+        for (index, version) in array.iter().enumerate() {
+            match version.as_u64().and_then(|n| u32::try_from(n).ok()) {
+                Some(version) if version > 0 => {
+                    version_set.insert(version);
+                }
+                _ => review_issue(
+                    review,
+                    source,
+                    &format!("{path}/{index}"),
+                    "version must be a positive 32-bit integer",
+                ),
+            }
+        }
+        if version_set.is_empty() {
+            review_issue(
+                review,
+                source,
+                &path,
+                "service must permit at least one version",
+            );
+        }
+        out.insert(service.clone(), version_set);
+    }
+    out
+}
+
+fn required_string(
+    object: &Map<String, Value>,
+    key: &str,
+    source: &str,
+    path: &str,
+    review: &mut BTreeSet<ReviewIssue>,
+) -> Option<String> {
+    match object.get(key).and_then(Value::as_str) {
+        Some(value) if !value.is_empty() => Some(value.to_string()),
+        _ => {
+            review_issue(
+                review,
+                source,
+                &format!("{path}/{}", pointer(key)),
+                "expected a non-empty string",
+            );
+            None
+        }
+    }
+}
+
+fn required_u32(
+    object: &Map<String, Value>,
+    key: &str,
+    source: &str,
+    path: &str,
+    review: &mut BTreeSet<ReviewIssue>,
+) -> Option<u32> {
+    match object
+        .get(key)
+        .and_then(Value::as_u64)
+        .and_then(|n| u32::try_from(n).ok())
+    {
+        Some(value) if value > 0 => Some(value),
+        _ => {
+            review_issue(
+                review,
+                source,
+                &format!("{path}/{}", pointer(key)),
+                "expected a positive 32-bit integer",
+            );
+            None
+        }
+    }
+}
+
+fn parse_schema(
+    value: &Value,
+    source: &str,
+    path: &str,
+    review: &mut BTreeSet<ReviewIssue>,
+) -> Option<Schema> {
+    let object = object_at(value, source, path, review)?;
+    let Some(kind_name) = object.get("type").and_then(Value::as_str) else {
+        review_issue(
+            review,
+            source,
+            &format!("{path}/type"),
+            "missing or non-string type",
+        );
+        return None;
+    };
+    let default = object.get("default").cloned();
+    let kind = match kind_name {
+        "string" => {
+            allowed_keys(object, &["type", "enum", "default"], source, path, review);
+            let values = match object.get("enum") {
+                None => None,
+                Some(value) => {
+                    let Some(array) = value.as_array() else {
+                        review_issue(review, source, &format!("{path}/enum"), "expected an array");
+                        return None;
+                    };
+                    let mut values = BTreeSet::new();
+                    for (index, value) in array.iter().enumerate() {
+                        let Some(value) = value.as_str() else {
+                            review_issue(
+                                review,
+                                source,
+                                &format!("{path}/enum/{index}"),
+                                "enum members must be strings",
+                            );
+                            continue;
+                        };
+                        if !values.insert(value.to_string()) {
+                            review_issue(
+                                review,
+                                source,
+                                &format!("{path}/enum/{index}"),
+                                "duplicate enum member",
+                            );
+                        }
+                    }
+                    if values.is_empty() {
+                        review_issue(
+                            review,
+                            source,
+                            &format!("{path}/enum"),
+                            "enum must contain at least one string",
+                        );
+                    }
+                    Some(values)
+                }
+            };
+            Kind::String { values }
+        }
+        "integer" => {
+            allowed_keys(
+                object,
+                &["type", "minimum", "maximum", "default"],
+                source,
+                path,
+                review,
+            );
+            let minimum = optional_i64(object, "minimum", source, path, review);
+            let maximum = optional_i64(object, "maximum", source, path, review);
+            if let (Some(minimum), Some(maximum)) = (minimum, maximum)
+                && minimum > maximum
+            {
+                review_issue(review, source, path, "minimum must not exceed maximum");
+            }
+            Kind::Integer { minimum, maximum }
+        }
+        "array" => {
+            allowed_keys(object, &["type", "items", "default"], source, path, review);
+            let Some(items) = object.get("items") else {
+                review_issue(
+                    review,
+                    source,
+                    &format!("{path}/items"),
+                    "missing items schema",
+                );
+                return None;
+            };
+            Kind::Array {
+                items: Box::new(parse_schema(
+                    items,
+                    source,
+                    &format!("{path}/items"),
+                    review,
+                )?),
+            }
+        }
+        "object" => {
+            allowed_keys(
+                object,
+                &[
+                    "type",
+                    "properties",
+                    "required",
+                    "additionalProperties",
+                    "default",
+                ],
+                source,
+                path,
+                review,
+            );
+            let Some(properties_value) = object.get("properties") else {
+                review_issue(
+                    review,
+                    source,
+                    &format!("{path}/properties"),
+                    "missing properties object",
+                );
+                return None;
+            };
+            let Some(properties_object) = properties_value.as_object() else {
+                review_issue(
+                    review,
+                    source,
+                    &format!("{path}/properties"),
+                    "expected an object",
+                );
+                return None;
+            };
+            let mut properties = BTreeMap::new();
+            for (name, property) in properties_object {
+                if let Some(schema) = parse_schema(
+                    property,
+                    source,
+                    &format!("{path}/properties/{}", pointer(name)),
+                    review,
+                ) {
+                    properties.insert(name.clone(), schema);
+                }
+            }
+            let mut required = BTreeSet::new();
+            match object.get("required") {
+                None => {}
+                Some(value) => {
+                    let Some(array) = value.as_array() else {
+                        review_issue(
+                            review,
+                            source,
+                            &format!("{path}/required"),
+                            "expected an array",
+                        );
+                        return None;
+                    };
+                    for (index, value) in array.iter().enumerate() {
+                        let Some(name) = value.as_str() else {
+                            review_issue(
+                                review,
+                                source,
+                                &format!("{path}/required/{index}"),
+                                "required member must be a string",
+                            );
+                            continue;
+                        };
+                        if !properties.contains_key(name) {
+                            review_issue(
+                                review,
+                                source,
+                                &format!("{path}/required/{index}"),
+                                "required member must name a declared property",
+                            );
+                        }
+                        if !required.insert(name.to_string()) {
+                            review_issue(
+                                review,
+                                source,
+                                &format!("{path}/required/{index}"),
+                                "duplicate required member",
+                            );
+                        }
+                    }
+                }
+            }
+            let open = match object.get("additionalProperties") {
+                None => true,
+                Some(value) => match value.as_bool() {
+                    Some(value) => value,
+                    None => {
+                        review_issue(
+                            review,
+                            source,
+                            &format!("{path}/additionalProperties"),
+                            "only boolean additionalProperties is supported",
+                        );
+                        return None;
+                    }
+                },
+            };
+            Kind::Object {
+                properties,
+                required,
+                open,
+            }
+        }
+        other => {
+            review_issue(
+                review,
+                source,
+                &format!("{path}/type"),
+                &format!("unsupported schema type `{other}`"),
+            );
+            return None;
+        }
+    };
+    let schema = Schema { kind, default };
+    if let Some(default) = &schema.default
+        && !accepts(&schema, default)
+    {
+        review_issue(
+            review,
+            source,
+            &format!("{path}/default"),
+            "default does not satisfy its schema",
+        );
+    }
+    Some(schema)
+}
+
+fn optional_i64(
+    object: &Map<String, Value>,
+    key: &str,
+    source: &str,
+    path: &str,
+    review: &mut BTreeSet<ReviewIssue>,
+) -> Option<i64> {
+    let value = object.get(key)?;
+    match value.as_i64() {
+        Some(value) => Some(value),
+        None => {
+            review_issue(
+                review,
+                source,
+                &format!("{path}/{}", pointer(key)),
+                "expected a signed 64-bit integer",
+            );
+            None
+        }
+    }
+}
+
+fn validate_references(
+    parsed: &ParsedInput,
+    candidates: &BTreeMap<ContractKey, Schema>,
+    review: &mut BTreeSet<ReviewIssue>,
+) {
+    let mut merged = parsed.contracts.clone();
+    merged.extend(candidates.clone());
+    for relationship in &parsed.relationships {
+        let identity = format!(
+            "/relationships/topic={}/producer={}/consumer={}",
+            pointer(&relationship.topic),
+            pointer(&relationship.producer),
+            pointer(&relationship.consumer)
+        );
+        for service in [&relationship.producer, &relationship.consumer] {
+            let Some(versions) = parsed.fleet.get(service) else {
+                review_issue(
+                    review,
+                    "fleet.json",
+                    &format!("/services/{}", pointer(service)),
+                    "relationship service has no fleet entry",
+                );
+                continue;
+            };
+            for version in versions {
+                let key = ContractKey {
+                    service: service.clone(),
+                    topic: relationship.topic.clone(),
+                    version: *version,
+                };
+                if !merged.contains_key(&key) {
+                    review_issue(
+                        review,
+                        "topology.json",
+                        &identity,
+                        &format!(
+                            "missing contract for service `{service}`, topic `{}`, version {version}",
+                            relationship.topic
+                        ),
+                    );
+                }
+            }
+        }
+    }
+}
+
+fn evaluate_incremental(
+    mut base: BTreeMap<PairKey, Option<BlockIssue>>,
+    base_contracts: &BTreeMap<ContractKey, Schema>,
+    candidates: &BTreeMap<ContractKey, Schema>,
+    relationships: &BTreeSet<Relationship>,
+    fleet: &BTreeMap<String, BTreeSet<u32>>,
+) -> BTreeMap<PairKey, Option<BlockIssue>> {
+    if candidates.is_empty() {
+        return base;
+    }
+    let mut merged = base_contracts.clone();
+    merged.extend(candidates.clone());
+    for (pair, issue) in &mut base {
+        let producer_key = ContractKey {
+            service: pair.producer_service.clone(),
+            topic: pair.topic.clone(),
+            version: pair.producer_version,
+        };
+        let consumer_key = ContractKey {
+            service: pair.consumer_service.clone(),
+            topic: pair.topic.clone(),
+            version: pair.consumer_version,
+        };
+        if candidates.contains_key(&producer_key) || candidates.contains_key(&consumer_key) {
+            *issue = evaluate_pair(pair, &merged);
+        }
+    }
+    // Candidate-only keys may become active if a base contract was absent, although
+    // normal reference validation ensures all active keys already existed.
+    let full_pair_keys = pair_keys(relationships, fleet);
+    for pair in full_pair_keys {
+        base.entry(pair.clone())
+            .or_insert_with(|| evaluate_pair(&pair, &merged));
+    }
+    base
+}
+
+fn evaluate_map(
+    contracts: &BTreeMap<ContractKey, Schema>,
+    relationships: &BTreeSet<Relationship>,
+    fleet: &BTreeMap<String, BTreeSet<u32>>,
+) -> BTreeMap<PairKey, Option<BlockIssue>> {
+    pair_keys(relationships, fleet)
+        .into_iter()
+        .map(|pair| {
+            let issue = evaluate_pair(&pair, contracts);
+            (pair, issue)
+        })
+        .collect()
+}
+
+fn pair_keys(
+    relationships: &BTreeSet<Relationship>,
+    fleet: &BTreeMap<String, BTreeSet<u32>>,
+) -> BTreeSet<PairKey> {
+    let mut out = BTreeSet::new();
+    for relationship in relationships {
+        let Some(producer_versions) = fleet.get(&relationship.producer) else {
+            continue;
+        };
+        let Some(consumer_versions) = fleet.get(&relationship.consumer) else {
+            continue;
+        };
+        for producer_version in producer_versions {
+            for consumer_version in consumer_versions {
+                out.insert(PairKey {
+                    topic: relationship.topic.clone(),
+                    producer_service: relationship.producer.clone(),
+                    producer_version: *producer_version,
+                    consumer_service: relationship.consumer.clone(),
+                    consumer_version: *consumer_version,
+                });
+            }
+        }
+    }
+    out
+}
+
+fn evaluate_pair(pair: &PairKey, contracts: &BTreeMap<ContractKey, Schema>) -> Option<BlockIssue> {
+    let producer = contracts.get(&ContractKey {
+        service: pair.producer_service.clone(),
+        topic: pair.topic.clone(),
+        version: pair.producer_version,
+    })?;
+    let consumer = contracts.get(&ContractKey {
+        service: pair.consumer_service.clone(),
+        topic: pair.topic.clone(),
+        version: pair.consumer_version,
+    })?;
+    incompatibility(producer, consumer).map(|violation| BlockIssue {
+        topic: pair.topic.clone(),
+        producer_service: pair.producer_service.clone(),
+        producer_version: pair.producer_version,
+        consumer_service: pair.consumer_service.clone(),
+        consumer_version: pair.consumer_version,
+        rule: violation.rule,
+        path: violation.path,
+        witness: violation.witness,
+    })
+}
+
+pub fn check_schema_pair(
+    producer: &Value,
+    consumer: &Value,
+) -> Result<Option<(String, Value)>, Vec<ReviewIssue>> {
+    let mut review = BTreeSet::new();
+    let producer = parse_schema(producer, "producer", "/schema", &mut review);
+    let consumer = parse_schema(consumer, "consumer", "/schema", &mut review);
+    if !review.is_empty() {
+        return Err(review.into_iter().collect());
+    }
+    let violation = incompatibility(
+        producer.as_ref().expect("parsed producer"),
+        consumer.as_ref().expect("parsed consumer"),
+    );
+    Ok(violation.map(|violation| (violation.rule, violation.witness)))
+}
+
+fn incompatibility(producer: &Schema, consumer: &Schema) -> Option<Violation> {
+    let mut candidates = Vec::new();
+    compatibility_candidates(producer, consumer, "", &mut candidates);
+    candidates.retain(|candidate| {
+        accepts(producer, &candidate.witness) && !accepts(consumer, &candidate.witness)
+    });
+    candidates.into_iter().min_by(compare_violation)
+}
+
+fn compatibility_candidates(
+    producer: &Schema,
+    consumer: &Schema,
+    path: &str,
+    out: &mut Vec<Violation>,
+) {
+    match (&producer.kind, &consumer.kind) {
+        (Kind::String { values: producer }, Kind::String { values: consumer }) => {
+            if let Some(consumer) = consumer {
+                let witness = match producer {
+                    Some(producer) => producer
+                        .iter()
+                        .filter(|value| !consumer.contains(*value))
+                        .map(|value| Value::String(value.clone()))
+                        .min_by(compare_value),
+                    None => Some(Value::String(smallest_unlisted_string(consumer))),
+                };
+                if let Some(witness) = witness {
+                    out.push(Violation {
+                        rule: "enum-value-rejected".to_string(),
+                        path: path_or_root(path),
+                        witness,
+                    });
+                }
+            }
+        }
+        (
+            Kind::Integer {
+                minimum: producer_min,
+                maximum: producer_max,
+            },
+            Kind::Integer {
+                minimum: consumer_min,
+                maximum: consumer_max,
+            },
+        ) => {
+            if let Some(consumer_min) = consumer_min
+                && producer_min.is_none_or(|minimum| minimum < *consumer_min)
+            {
+                let low = producer_min.unwrap_or(i64::MIN);
+                let high = producer_max
+                    .unwrap_or(i64::MAX)
+                    .min(consumer_min.saturating_sub(1));
+                if low <= high {
+                    out.push(Violation {
+                        rule: "integer-below-minimum".to_string(),
+                        path: path_or_root(path),
+                        witness: json!(representative_integer(low, high)),
+                    });
+                }
+            }
+            if let Some(consumer_max) = consumer_max
+                && producer_max.is_none_or(|maximum| maximum > *consumer_max)
+            {
+                let low = producer_min
+                    .unwrap_or(i64::MIN)
+                    .max(consumer_max.saturating_add(1));
+                let high = producer_max.unwrap_or(i64::MAX);
+                if low <= high {
+                    out.push(Violation {
+                        rule: "integer-above-maximum".to_string(),
+                        path: path_or_root(path),
+                        witness: json!(representative_integer(low, high)),
+                    });
+                }
+            }
+        }
+        (Kind::Array { items: producer }, Kind::Array { items: consumer }) => {
+            let mut nested = Vec::new();
+            compatibility_candidates(producer, consumer, "/0", &mut nested);
+            for candidate in nested {
+                out.push(Violation {
+                    rule: candidate.rule,
+                    path: join_path(path, &candidate.path),
+                    witness: Value::Array(vec![candidate.witness]),
+                });
+            }
+        }
+        (
+            Kind::Object {
+                properties: producer_properties,
+                required: producer_required,
+                open: producer_open,
+            },
+            Kind::Object {
+                properties: consumer_properties,
+                required: consumer_required,
+                open: consumer_open,
+            },
+        ) => {
+            let base = minimum_object(producer);
+            for name in consumer_required {
+                let consumer_property = &consumer_properties[name];
+                let producer_must_emit = producer_required.contains(name)
+                    && producer_properties
+                        .get(name)
+                        .is_some_and(|schema| schema.default.is_none());
+                if consumer_property.default.is_none() && !producer_must_emit {
+                    let mut witness = base.clone();
+                    witness.remove(name);
+                    out.push(Violation {
+                        rule: "required-field-missing".to_string(),
+                        path: join_path(path, &format!("/{}", pointer(name))),
+                        witness: Value::Object(witness),
+                    });
+                }
+            }
+
+            for (name, producer_property) in producer_properties {
+                if let Some(consumer_property) = consumer_properties.get(name) {
+                    let mut nested = Vec::new();
+                    compatibility_candidates(
+                        producer_property,
+                        consumer_property,
+                        &format!("/{}", pointer(name)),
+                        &mut nested,
+                    );
+                    for candidate in nested {
+                        let mut witness = base.clone();
+                        witness.insert(name.clone(), candidate.witness);
+                        out.push(Violation {
+                            rule: candidate.rule,
+                            path: join_path(path, &candidate.path),
+                            witness: Value::Object(witness),
+                        });
+                    }
+                } else if !consumer_open {
+                    let mut witness = base.clone();
+                    witness.insert(name.clone(), minimum_value(producer_property));
+                    out.push(Violation {
+                        rule: "closed-object-rejects-property".to_string(),
+                        path: join_path(path, &format!("/{}", pointer(name))),
+                        witness: Value::Object(witness),
+                    });
+                }
+            }
+
+            if *producer_open {
+                if !consumer_open {
+                    let name = smallest_unknown_key(producer_properties, consumer_properties);
+                    let mut witness = base.clone();
+                    witness.insert(name.clone(), Value::Null);
+                    out.push(Violation {
+                        rule: "closed-object-rejects-property".to_string(),
+                        path: join_path(path, &format!("/{}", pointer(&name))),
+                        witness: Value::Object(witness),
+                    });
+                }
+                for name in consumer_properties.keys() {
+                    if !producer_properties.contains_key(name) {
+                        let mut witness = base.clone();
+                        witness.insert(name.clone(), Value::Null);
+                        out.push(Violation {
+                            rule: "open-object-property-unconstrained".to_string(),
+                            path: join_path(path, &format!("/{}", pointer(name))),
+                            witness: Value::Object(witness),
+                        });
+                    }
+                }
+            }
+        }
+        _ => out.push(Violation {
+            rule: "type-mismatch".to_string(),
+            path: path_or_root(path),
+            witness: minimum_value(producer),
+        }),
+    }
+}
+
+fn accepts(schema: &Schema, value: &Value) -> bool {
+    match &schema.kind {
+        Kind::String { values } => value
+            .as_str()
+            .is_some_and(|value| values.as_ref().is_none_or(|values| values.contains(value))),
+        Kind::Integer { minimum, maximum } => value.as_i64().is_some_and(|value| {
+            minimum.is_none_or(|minimum| value >= minimum)
+                && maximum.is_none_or(|maximum| value <= maximum)
+        }),
+        Kind::Array { items } => value
+            .as_array()
+            .is_some_and(|values| values.iter().all(|value| accepts(items, value))),
+        Kind::Object {
+            properties,
+            required,
+            open,
+        } => value.as_object().is_some_and(|object| {
+            required.iter().all(|name| {
+                object.contains_key(name)
+                    || properties
+                        .get(name)
+                        .is_some_and(|schema| schema.default.is_some())
+            }) && object.iter().all(|(name, value)| {
+                properties
+                    .get(name)
+                    .map_or(*open, |schema| accepts(schema, value))
+            })
+        }),
+    }
+}
+
+fn minimum_value(schema: &Schema) -> Value {
+    match &schema.kind {
+        Kind::String { values } => values.as_ref().map_or_else(
+            || Value::String(String::new()),
+            |values| {
+                values
+                    .iter()
+                    .map(|value| Value::String(value.clone()))
+                    .min_by(compare_value)
+                    .expect("validated non-empty enum")
+            },
+        ),
+        Kind::Integer { minimum, maximum } => json!(representative_integer(
+            minimum.unwrap_or(i64::MIN),
+            maximum.unwrap_or(i64::MAX)
+        )),
+        Kind::Array { .. } => Value::Array(Vec::new()),
+        Kind::Object { .. } => Value::Object(minimum_object(schema)),
+    }
+}
+
+fn minimum_object(schema: &Schema) -> Map<String, Value> {
+    let Kind::Object {
+        properties,
+        required,
+        ..
+    } = &schema.kind
+    else {
+        unreachable!()
+    };
+    required
+        .iter()
+        .filter_map(|name| {
+            let property = &properties[name];
+            property
+                .default
+                .is_none()
+                .then(|| (name.clone(), minimum_value(property)))
+        })
+        .collect()
+}
+
+fn representative_integer(low: i64, high: i64) -> i64 {
+    let mut candidates = vec![low, high];
+    if low <= 0 && high >= 0 {
+        candidates.push(0);
+    }
+    if low <= -1 && high >= -1 {
+        candidates.push(-1);
+    }
+    if low <= 1 && high >= 1 {
+        candidates.push(1);
+    }
+    candidates
+        .into_iter()
+        .min_by(|left, right| compare_value(&json!(left), &json!(right)))
+        .expect("non-empty integer interval")
+}
+
+fn smallest_unlisted_string(values: &BTreeSet<String>) -> String {
+    if !values.contains("") {
+        return String::new();
+    }
+    for length in 1.. {
+        let candidate = "a".repeat(length);
+        if !values.contains(&candidate) {
+            return candidate;
+        }
+    }
+    unreachable!()
+}
+
+fn smallest_unknown_key(
+    producer: &BTreeMap<String, Schema>,
+    consumer: &BTreeMap<String, Schema>,
+) -> String {
+    if !producer.contains_key("") && !consumer.contains_key("") {
+        return String::new();
+    }
+    for length in 1.. {
+        let candidate = "a".repeat(length);
+        if !producer.contains_key(&candidate) && !consumer.contains_key(&candidate) {
+            return candidate;
+        }
+    }
+    unreachable!()
+}
+
+fn compare_violation(left: &Violation, right: &Violation) -> Ordering {
+    compare_value(&left.witness, &right.witness)
+        .then_with(|| left.rule.cmp(&right.rule))
+        .then_with(|| left.path.cmp(&right.path))
+}
+
+fn compare_value(left: &Value, right: &Value) -> Ordering {
+    value_nodes(left)
+        .cmp(&value_nodes(right))
+        .then_with(|| canonical_json(left).len().cmp(&canonical_json(right).len()))
+        .then_with(|| canonical_json(left).cmp(&canonical_json(right)))
+}
+
+fn value_nodes(value: &Value) -> usize {
+    match value {
+        Value::Array(values) => 1 + values.iter().map(value_nodes).sum::<usize>(),
+        Value::Object(values) => 1 + values.values().map(value_nodes).sum::<usize>(),
+        _ => 1,
+    }
+}
+
+fn canonical_json(value: &Value) -> String {
+    match value {
+        Value::Object(object) => {
+            let body = object
+                .iter()
+                .map(|(key, value)| {
+                    format!(
+                        "{}:{}",
+                        serde_json::to_string(key).expect("string serialization"),
+                        canonical_json(value)
+                    )
+                })
+                .collect::<Vec<_>>()
+                .join(",");
+            format!("{{{body}}}")
+        }
+        Value::Array(values) => format!(
+            "[{}]",
+            values
+                .iter()
+                .map(canonical_json)
+                .collect::<Vec<_>>()
+                .join(",")
+        ),
+        _ => serde_json::to_string(value).expect("value serialization"),
+    }
+}
+
+fn path_or_root(path: &str) -> String {
+    if path.is_empty() {
+        "/".to_string()
+    } else {
+        path.to_string()
+    }
+}
+
+fn join_path(prefix: &str, suffix: &str) -> String {
+    if prefix.is_empty() {
+        path_or_root(suffix)
+    } else if suffix == "/" {
+        prefix.to_string()
+    } else {
+        format!("{prefix}{suffix}")
+    }
+}
+
+fn pointer(value: &str) -> String {
+    value.replace('~', "~0").replace('/', "~1")
+}
+
+fn contract_path(key: &ContractKey) -> String {
+    format!(
+        "/contracts/service={}/topic={}/version={}",
+        pointer(&key.service),
+        pointer(&key.topic),
+        key.version
+    )
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn unsupported_keyword_has_exact_semantic_location() {
+        let mut review = BTreeSet::new();
+        let input = json!({"contracts":[{
+            "service":"a", "topic":"t", "version":1,
+            "schema":{"type":"string", "pattern":"x"}
+        }]});
+        parse_contract_file(input, "contracts.json", &mut review);
+        let issue = review.into_iter().next().expect("review issue");
+        assert_eq!(
+            issue.path,
+            "/contracts/service=a/topic=t/version=1/schema/pattern"
+        );
+    }
+
+    #[test]
+    fn malformed_default_needs_review() {
+        let result = check_schema_pair(
+            &json!({"type":"integer", "minimum":1, "default":0}),
+            &json!({"type":"integer"}),
+        );
+        assert!(result.is_err());
+    }
+
+    #[test]
+    fn witness_is_accepted_only_by_producer() {
+        let producer = json!({"type":"object","properties":{"n":{"type":"integer","minimum":0,"maximum":10}},"required":["n"],"additionalProperties":false});
+        let consumer = json!({"type":"object","properties":{"n":{"type":"integer","minimum":1,"maximum":10}},"required":["n"],"additionalProperties":false});
+        let (rule, witness) = check_schema_pair(&producer, &consumer)
+            .expect("valid")
+            .expect("block");
+        assert_eq!(rule, "integer-below-minimum");
+        let mut review = BTreeSet::new();
+        let producer = parse_schema(&producer, "p", "/", &mut review).unwrap();
+        let consumer = parse_schema(&consumer, "c", "/", &mut review).unwrap();
+        assert!(accepts(&producer, &witness));
+        assert!(!accepts(&consumer, &witness));
+    }
+}
diff --git a/developer-simulation/runs/2026-08-04--mixed-version-contract-gate/src/main.rs b/developer-simulation/runs/2026-08-04--mixed-version-contract-gate/src/main.rs
new file mode 100644
index 0000000..0b6feac
--- /dev/null
+++ b/developer-simulation/runs/2026-08-04--mixed-version-contract-gate/src/main.rs
@@ -0,0 +1,25 @@
+use std::env;
+use std::process::ExitCode;
+
+use mixed_version_contract_gate::{GateStatus, run_files};
+
+fn main() -> ExitCode {
+    let args: Vec<String> = env::args().skip(1).collect();
+    if args.len() != 4 {
+        eprintln!(
+            "usage: contract-gate <contracts.json> <topology.json> <fleet.json> <candidate.json>"
+        );
+        return ExitCode::from(2);
+    }
+
+    let result = run_files(&args[0], &args[1], &args[2], &args[3]);
+    println!(
+        "{}",
+        serde_json::to_string_pretty(&result).expect("result is serializable")
+    );
+    match result.status {
+        GateStatus::Allow => ExitCode::SUCCESS,
+        GateStatus::Block => ExitCode::from(1),
+        GateStatus::ReviewRequired => ExitCode::from(2),
+    }
+}
diff --git a/developer-simulation/runs/2026-08-04--mixed-version-contract-gate/tests/semantic.rs b/developer-simulation/runs/2026-08-04--mixed-version-contract-gate/tests/semantic.rs
new file mode 100644
index 0000000..73191b2
--- /dev/null
+++ b/developer-simulation/runs/2026-08-04--mixed-version-contract-gate/tests/semantic.rs
@@ -0,0 +1,273 @@
+use std::fs;
+use std::path::{Path, PathBuf};
+use std::time::{SystemTime, UNIX_EPOCH};
+
+use mixed_version_contract_gate::{GateStatus, check_schema_pair, run_files};
+use serde_json::{Value, json};
+
+#[test]
+fn semantic_fixture_has_at_least_sixty_cases_and_matches() {
+    let fixture: Value = serde_json::from_str(include_str!("../fixtures/semantic_cases.json"))
+        .expect("valid fixture JSON");
+    let schemas = fixture["schemas"].as_object().expect("schema catalog");
+    let cases = fixture["cases"].as_array().expect("case array");
+    assert!(cases.len() >= 60, "semantic suite must retain >=60 cases");
+    for case in cases {
+        let name = case["name"].as_str().expect("case name");
+        let producer = &schemas[case["producer"].as_str().expect("producer ref")];
+        let consumer = &schemas[case["consumer"].as_str().expect("consumer ref")];
+        let outcome = check_schema_pair(producer, consumer)
+            .unwrap_or_else(|review| panic!("{name}: unexpected review: {review:?}"));
+        match case["expected"].as_str().expect("expected status") {
+            "allow" => assert!(outcome.is_none(), "{name}: expected allow, got {outcome:?}"),
+            "block" => {
+                let (rule, _) = outcome.unwrap_or_else(|| panic!("{name}: expected block"));
+                assert_eq!(
+                    rule,
+                    case["rule"].as_str().expect("expected rule"),
+                    "{name}"
+                );
+            }
+            other => panic!("{name}: unknown expected status {other}"),
+        }
+    }
+}
+
+#[test]
+fn incremental_candidate_exactly_matches_full_evaluation() {
+    let dir = temp_case_dir("parity");
+    let (base, topology, fleet, candidate, merged) = mixed_version_inputs();
+    write_json(&dir, "base.json", &base);
+    write_json(&dir, "topology.json", &topology);
+    write_json(&dir, "fleet.json", &fleet);
+    write_json(&dir, "candidate.json", &candidate);
+    write_json(&dir, "merged.json", &merged);
+    write_json(&dir, "empty.json", &json!({"contracts":[]}));
+
+    let incremental = run_case(&dir, "base.json", "candidate.json");
+    let full = run_case(&dir, "merged.json", "empty.json");
+    assert_eq!(incremental.status, full.status);
+    assert_eq!(incremental.evaluated_pairs, full.evaluated_pairs);
+    assert_eq!(incremental.issues, full.issues);
+    assert_eq!(incremental.review, full.review);
+    assert_eq!(incremental.evaluated_pairs, 9);
+    assert_eq!(incremental.issues.len(), 3);
+}
+
+#[test]
+fn shuffled_and_identical_duplicate_inputs_are_stable() {
+    let dir = temp_case_dir("shuffle");
+    let (base, topology, fleet, candidate, _) = mixed_version_inputs();
+    write_json(&dir, "base.json", &base);
+    write_json(&dir, "topology.json", &topology);
+    write_json(&dir, "fleet.json", &fleet);
+    write_json(&dir, "candidate.json", &candidate);
+    let expected = run_case(&dir, "base.json", "candidate.json");
+
+    let mut shuffled_contracts = base["contracts"].as_array().unwrap().clone();
+    shuffled_contracts.reverse();
+    shuffled_contracts.push(shuffled_contracts[0].clone());
+    let mut duplicate_relationships = topology["relationships"].as_array().unwrap().clone();
+    duplicate_relationships.push(duplicate_relationships[0].clone());
+    let mut duplicate_candidates = candidate["contracts"].as_array().unwrap().clone();
+    duplicate_candidates.push(duplicate_candidates[0].clone());
+    let shuffled_fleet = json!({"services":{"consumer":[3,2,1,3],"producer":[2,1,3,2]}});
+
+    write_json(
+        &dir,
+        "base-shuffled.json",
+        &json!({"contracts":shuffled_contracts}),
+    );
+    write_json(
+        &dir,
+        "topology.json",
+        &json!({"relationships":duplicate_relationships}),
+    );
+    write_json(&dir, "fleet.json", &shuffled_fleet);
+    write_json(
+        &dir,
+        "candidate-shuffled.json",
+        &json!({"contracts":duplicate_candidates}),
+    );
+    let actual = run_case(&dir, "base-shuffled.json", "candidate-shuffled.json");
+    assert_eq!(expected, actual);
+}
+
+#[test]
+fn unsupported_and_malformed_contracts_never_allow() {
+    let dir = temp_case_dir("review");
+    let base = json!({"contracts":[
+        {"service":"producer","topic":"orders","version":1,"schema":{"type":"string","pattern":"^[a-z]+$"}},
+        {"service":"consumer","topic":"orders","version":1,"schema":{"type":"integer","minimum":10,"maximum":1}}
+    ]});
+    write_json(&dir, "base.json", &base);
+    write_json(
+        &dir,
+        "topology.json",
+        &json!({"relationships":[{"topic":"orders","producer":"producer","consumer":"consumer"}]}),
+    );
+    write_json(
+        &dir,
+        "fleet.json",
+        &json!({"services":{"producer":[1],"consumer":[1]}}),
+    );
+    write_json(&dir, "candidate.json", &json!({"contracts":[]}));
+    let result = run_case(&dir, "base.json", "candidate.json");
+    assert_eq!(result.status, GateStatus::ReviewRequired);
+    assert!(
+        result
+            .review
+            .iter()
+            .any(|issue| issue.path.ends_with("/pattern"))
+    );
+    assert!(
+        result
+            .review
+            .iter()
+            .any(|issue| issue.message.contains("minimum must not exceed"))
+    );
+}
+
+#[test]
+fn duplicate_json_members_at_every_input_layer_require_review() {
+    let cases = [
+        ("root", "base.json", r#"{"contracts":[],"contracts":[]}"#),
+        (
+            "contract",
+            "base.json",
+            r#"{"contracts":[{"service":"producer","service":"other","topic":"orders","version":1,"schema":{"type":"string"}}]}"#,
+        ),
+        (
+            "schema",
+            "base.json",
+            r#"{"contracts":[{"service":"producer","topic":"orders","version":1,"schema":{"type":"string","type":"integer"}}]}"#,
+        ),
+        (
+            "topology",
+            "topology.json",
+            r#"{"relationships":[{"topic":"orders","producer":"producer","producer":"other","consumer":"consumer"}]}"#,
+        ),
+        (
+            "fleet",
+            "fleet.json",
+            r#"{"services":{"producer":[1],"producer":[1],"consumer":[1]}}"#,
+        ),
+        (
+            "candidate",
+            "candidate.json",
+            r#"{"contracts":[{"service":"consumer","topic":"orders","version":1,"schema":{"type":"string","type":"integer"}}]}"#,
+        ),
+    ];
+
+    for (label, filename, raw) in cases {
+        let dir = temp_case_dir(label);
+        write_json(
+            &dir,
+            "base.json",
+            &json!({"contracts":[
+                contract("producer", 1, json!({"type":"string"})),
+                contract("consumer", 1, json!({"type":"string"}))
+            ]}),
+        );
+        write_json(
+            &dir,
+            "topology.json",
+            &json!({"relationships":[{
+                "topic":"orders","producer":"producer","consumer":"consumer"
+            }]}),
+        );
+        write_json(
+            &dir,
+            "fleet.json",
+            &json!({"services":{"producer":[1],"consumer":[1]}}),
+        );
+        write_json(&dir, "candidate.json", &json!({"contracts":[]}));
+        fs::write(dir.join(filename), raw).expect("write raw duplicate-key JSON");
+
+        let result = run_case(&dir, "base.json", "candidate.json");
+        assert_eq!(result.status, GateStatus::ReviewRequired, "{label}");
+        assert!(
+            result
+                .review
+                .iter()
+                .any(|issue| issue.message.contains("duplicate object member")),
+            "{label}: {:?}",
+            result.review
+        );
+    }
+}
+
+fn mixed_version_inputs() -> (Value, Value, Value, Value, Value) {
+    let base_schema = schema(false);
+    let candidate_schema = schema(true);
+    let mut contracts = Vec::new();
+    for version in 1..=3 {
+        contracts.push(contract("producer", version, base_schema.clone()));
+        contracts.push(contract("consumer", version, base_schema.clone()));
+    }
+    let base = json!({"contracts":contracts});
+    let topology = json!({"relationships":[{
+        "topic":"orders","producer":"producer","consumer":"consumer"
+    }]});
+    let fleet = json!({"services":{"producer":[1,2,3],"consumer":[1,2,3]}});
+    let replacement = contract("consumer", 3, candidate_schema);
+    let candidate = json!({"contracts":[replacement.clone()]});
+    let mut merged_contracts = base["contracts"].as_array().unwrap().clone();
+    let index = merged_contracts
+        .iter()
+        .position(|entry| entry["service"] == "consumer" && entry["version"] == 3)
+        .unwrap();
+    merged_contracts[index] = replacement;
+    let merged = json!({"contracts":merged_contracts});
+    (base, topology, fleet, candidate, merged)
+}
+
+fn schema(require_region: bool) -> Value {
+    json!({
+        "type":"object",
+        "properties":{
+            "id":{"type":"integer","minimum":0,"maximum":100},
+            "region":{"type":"string","enum":["eu","us"]}
+        },
+        "required": if require_region { json!(["id","region"]) } else { json!(["id"]) },
+        "additionalProperties":false
+    })
+}
+
+fn contract(service: &str, version: u32, schema: Value) -> Value {
+    json!({"service":service,"topic":"orders","version":version,"schema":schema})
+}
+
+fn temp_case_dir(label: &str) -> PathBuf {
+    let nonce = SystemTime::now()
+        .duration_since(UNIX_EPOCH)
+        .expect("clock after epoch")
+        .as_nanos();
+    let path = std::env::temp_dir().join(format!(
+        "contract-gate-{label}-{}-{nonce}",
+        std::process::id()
+    ));
+    fs::create_dir_all(&path).expect("create temp case");
+    path
+}
+
+fn write_json(dir: &Path, name: &str, value: &Value) {
+    fs::write(
+        dir.join(name),
+        serde_json::to_vec(value).expect("serialize test input"),
+    )
+    .expect("write test input");
+}
+
+fn run_case(
+    dir: &Path,
+    contracts: &str,
+    candidate: &str,
+) -> mixed_version_contract_gate::GateResult {
+    run_files(
+        &dir.join(contracts).to_string_lossy(),
+        &dir.join("topology.json").to_string_lossy(),
+        &dir.join("fleet.json").to_string_lossy(),
+        &dir.join(candidate).to_string_lossy(),
+    )
+}
diff --git a/developer-simulation/runs/2026-08-04--ocr-redaction-remap/Cargo.toml b/developer-simulation/runs/2026-08-04--ocr-redaction-remap/Cargo.toml
new file mode 100644
index 0000000..e9fe8e8
--- /dev/null
+++ b/developer-simulation/runs/2026-08-04--ocr-redaction-remap/Cargo.toml
@@ -0,0 +1,12 @@
+[package]
+name = "ocr-redaction-remap"
+version = "0.1.0"
+edition = "2024"
+publish = false
+
+[dependencies]
+serde = { version = "1", features = ["derive"] }
+serde_json = "1"
+sha2 = "0.10"
+unicode-normalization = "0.1"
+unicode-segmentation = "1"
diff --git a/developer-simulation/runs/2026-08-04--ocr-redaction-remap/README.md b/developer-simulation/runs/2026-08-04--ocr-redaction-remap/README.md
new file mode 100644
index 0000000..64cb116
--- /dev/null
+++ b/developer-simulation/runs/2026-08-04--ocr-redaction-remap/README.md
@@ -0,0 +1,69 @@
+# OCR redaction remap trial
+
+This is a standalone Rust CLI for remapping human-reviewed UTF-8 spans from old OCR text to revised grapheme rectangles. It processes one JSON page at a time, emits no OCR text, validates all geometry before marking a page publishable, and checkpoints paired rectangle/audit streams for deterministic resume.
+
+It intentionally does **not** use a BogKit crate. Fold's durable incremental views solve a different problem from independent, authoritative page transformations; ESE and ANNy have no role in this mapping.
+
+## Input and output
+
+Each input JSONL line has:
+
+- `page_id`, `old_text`, and `revised_text`
+- `glyphs`: revised graphemes encoded as `[start_byte,end_byte,line,x,y,width,height]`; line-break graphemes have no rectangle
+- `spans`: reviewed old-text `{start,end,reason}` byte ranges
+
+Output JSONL contains only page IDs, status, rectangles, and a non-sensitive error code. The separate audit JSONL contains counts, allow-listed identifier-shaped reason codes, and decisions (`exact`, `removed`, `fallback_token`, or `fallback_line`), never source text or matched text.
+
+## Run the verified fixture demo
+
+Run from the BogKit repository root:
+
+```sh
+developer-simulation/runs/2026-08-04--ocr-redaction-remap/run_demo.sh
+```
+
+The script generates 240 systematic fixtures plus four hand cases; verifies
+exact rectangle identity and sentinel absence; checks reversed/duplicated spans
+for byte identity; and runs two interruption/resume comparisons. Generated
+files use a temporary directory under `/private/tmp` and are removed on exit;
+build output uses `/private/tmp/ocr-redaction-remap-target`.
+
+## Individual commands
+
+```sh
+export CARGO_TARGET_DIR=/private/tmp/ocr-redaction-remap-target
+DEMO_DIR="$(mktemp -d /private/tmp/ocr-redaction-remap-demo.XXXXXX)"
+cargo run --offline --locked --manifest-path developer-simulation/Cargo.toml \
+  -p ocr-redaction-remap -- generate --dir "$DEMO_DIR/fixtures" --pages 240
+cargo run --offline --locked --manifest-path developer-simulation/Cargo.toml \
+  -p ocr-redaction-remap -- remap \
+  --input "$DEMO_DIR/fixtures/pages.jsonl" \
+  --output "$DEMO_DIR/output.jsonl" \
+  --audit "$DEMO_DIR/audit.jsonl"
+cargo run --offline --locked --manifest-path developer-simulation/Cargo.toml \
+  -p ocr-redaction-remap -- check \
+  --input "$DEMO_DIR/fixtures/pages.jsonl" \
+  --output "$DEMO_DIR/output.jsonl" \
+  --audit "$DEMO_DIR/audit.jsonl" \
+  --expected "$DEMO_DIR/fixtures/expected.jsonl" \
+  --sentinels "$DEMO_DIR/fixtures/sentinels.json"
+```
+
+Use `--stop-after N` to simulate interruption and `--resume` to continue from
+the last paired checkpoint. A completed run writes `<output>.complete`; it binds
+the exact input, output, and audit paths, lengths, and SHA-256 values. Consumers
+should verify through `--resume` and reject any page whose status is `blocked`.
+This is controlled process-resume evidence, not a power-loss durability
+guarantee.
+
+Generate the exact acceptance workload with:
+
+```sh
+cargo run --release --offline --locked \
+  --manifest-path developer-simulation/Cargo.toml \
+  -p ocr-redaction-remap -- generate-workload \
+  --output "$DEMO_DIR/workload.jsonl" \
+  --pages 5000 --scalars-per-page 4000 --spans-per-page 30
+```
+
+The mapper caps non-trivial edit alignment at 256 edits per page. Pages over that limit are blocked rather than guessed.
diff --git a/developer-simulation/runs/2026-08-04--ocr-redaction-remap/TRIAL_REPORT.md b/developer-simulation/runs/2026-08-04--ocr-redaction-remap/TRIAL_REPORT.md
new file mode 100644
index 0000000..bd4af17
--- /dev/null
+++ b/developer-simulation/runs/2026-08-04--ocr-redaction-remap/TRIAL_REPORT.md
@@ -0,0 +1,255 @@
+# Trial notes — OCR redaction remapping
+
+## Skeptical review and coordinator correction
+
+The independent reviewer reproduced the fixture demo and no-fit decision, then
+found three serious prototype defects before archival. A unique literal match in
+the revised text could select the wrong repeated occurrence after an OCR change,
+leaving the reviewed occurrence uncovered. A completed-run marker trusted
+changed input or truncated output. A stale checkpoint could also extend a newly
+truncated partial file with NUL bytes and report success.
+
+The coordinator fixed all three classes. Literal candidates are now checked
+against the source-position edit mapping and disagreements are covered
+conservatively. Completion markers bind the exact input, output, and audit paths,
+lengths, and SHA-256 values. Fresh runs invalidate stale partial/checkpoint state;
+resume rejects short or changed partial prefixes instead of extending them.
+Seven corrected unit tests cover the reviewer's exact repeated-occurrence,
+changed-input, truncated-output, changed-audit, stale-checkpoint, and short-
+partial reproductions. The 244-page demo, formatting, strict lint, and both
+controlled resumes still pass.
+
+The corrected nested-workspace 5,000-page, 20-million-ASCII-scalar,
+150,000-span workload completed in 38.82 seconds with 5,947,392 bytes maximum
+RSS, produced 5,000
+output and audit lines, and matched a second full output byte-for-byte. This is
+controlled process-resume and workload-specific evidence, not a general Unicode,
+confidentiality, durability, crash, or power-loss guarantee. No BogKit defect was
+demonstrated.
+
+The remainder preserves the blind developer's trail. This reviewed correction
+controls where an initial claim differs.
+
+Run date: 2026-08-04 (America/New_York)
+
+Persona: public-records processing engineer; production Python experience; Rust beginner.
+
+## Outcome
+
+Built a standalone Rust CLI under `trial/` that streams one page-delimited JSON record at a time, remaps reviewed old-text spans to revised grapheme rectangles, emits a content-free audit, blocks pages with invalid spans or geometry, and resumes paired output/audit files after controlled process interruption. The trial uses no BogKit crate because none fits this independent deterministic transformation.
+
+Observed acceptance evidence:
+
+- 240 systematic pages plus four hand pages: 243 exact pages, one explicit conservative repeated-token page, zero blocked pages, zero rectangle mismatches, and zero sentinel leaks in rectangle/audit output.
+- Old/revised fixtures cover combining marks, multibyte text, compatibility ligatures, soft hyphens, line-break dehyphenation, whitespace normalization, an OCR character substitution, repeated phrases with and without distinguishing context, overlapping spans, duplicates, and deletion.
+- Reversing span order and adding duplicates produced byte-identical rectangle and audit files.
+- Two controlled interruptions after pages 73 and 191 resumed to byte-identical uninterrupted outputs. Broader crash and split-finalization claims were not retained as reviewed evidence.
+- Corrupt offsets, an offset inside a multibyte character, missing geometry, and contradictory geometry each returned exit 2 with a deterministic blocked page and zero rectangles. Two runs had identical SHA-256 values. Invalid raw UTF-8 returned exit 2 with only `error code=invalid_utf8 line=1`.
+- The final corrected nested-workspace workload of 5,000 pages, 20,000,000
+  ASCII scalar values, and 150,000 reviewed spans completed in 38.82 seconds.
+  macOS `/usr/bin/time -l` reported 5,947,392 bytes maximum resident set size, below
+  the 64 MiB limit. It emitted 5,000 output lines, 5,000 audit lines, 600,000
+  exact rectangles, zero blocked pages, and zero conservative pages. A second
+  completed workload output was byte-identical.
+- `cargo fmt -- --check`, seven unit tests, Clippy with warnings denied, a debug
+  build, a release build, and the end-to-end demo all passed.
+
+## Discovery order and friction
+
+I behaved as if I had no prior BogKit knowledge and did not inspect any prior simulation material.
+
+1. Ran `pwd`, `git status --short --branch`, `ls -la`, then read public `README.md`. The checkout was detached and clean. The README said the smallest start was `./scripts/new-project.sh`, described Fold, ESE, and ANNy, and listed examples in the order starter, timeseries, chat, search.
+2. Listed public example files and read their public source in README order: `examples/starter/src/main.rs`, `examples/timeseries/src/main.rs`, `examples/chat/src/main.rs`, then `examples/search/src/main.rs`.
+3. Tried to freeze the advertised smallest runnable BogKit baseline with:
+
+   ```sh
+   CARGO_TARGET_DIR=/private/tmp/bogkit-sim-2026-08-04-b/trial/.baseline-target cargo run -p starter
+   ```
+
+   It failed while building ESE. ESE attempted to download `model.safetensors`, then panicked after DNS resolution failed. This was before any trial design choice.
+4. Only after that failure, read root `Cargo.toml`, `examples/starter/Cargo.toml`, and `scripts/new-project.sh`. The starter manifest declares `anny`, `ese`, and `fold` even though its source uses only Fold. The scaffold script also adds all three and the README says they may not all be used. That explains why the unrelated model download blocks the advertised starter offline.
+5. Froze the existing-system baseline independently with `python3 trial/baseline_clamp.py`. It returned:
+
+   ```json
+   {"baseline": "stale_offset_clamp", "partial_exposure_reproduced": true}
+   ```
+
+   The reproducer asserts the exposure but prints no sensitive fixture text.
+
+## Fit decision
+
+No BogKit component was used.
+
+- Fold maintains durable views as inserts and retractions arrive. Here every page is an authoritative, independent old/revised pair and the required result is a deterministic append-only transformation. Fold would introduce durable mutable state and a second recovery model without improving alignment, geometry validation, or ambiguity handling.
+- ESE generates semantic embeddings; no semantic retrieval or similarity model is required.
+- ANNy indexes nearest neighbors; pages and reviewed spans must never be matched approximately across records.
+- The public surface inspected did not expose a Unicode sequence-alignment or glyph-geometry redaction primitive.
+
+This is a poor product fit, not a demonstrated defect in Fold, ESE, or ANNy correctness. The starter's unrelated ESE build coupling is a separate observed setup defect.
+
+## Prototype design
+
+- Input spans remain authoritative UTF-8 byte ranges. Out-of-range, empty/reversed, or non-boundary offsets block the page.
+- Unicode graphemes are preserved for rectangles. Matching tokens use NFKC, remove soft hyphens, collapse whitespace, expand compatibility ligatures, and remove line-break hyphenation only between alphanumeric characters.
+- A unique normalized occurrence maps exactly. Repeated occurrences use up to 32 tokens of surrounding context; a unique best context remains exact, while a tie redacts every smallest matching token occurrence.
+- When normalized text differs, a deterministic Myers edit script maps replacement blocks. Unique 4–8-token flanks make the local mapping exact. Without unique flanks, the mapper uses the implicated line as an explicit conservative fallback; if no safe line can be identified, it blocks publication.
+- Non-trivial edit distance is capped at 256 edits per page. Larger rewrites return `edit_distance_limit`; they are never guessed.
+- Every non-line-break revised grapheme must have exactly one positive-size rectangle. Missing, duplicate, extra, or contradictory geometry blocks the page and produces no rectangles.
+- Reviewed spans are sorted and deduplicated before processing. Rectangles and reason codes are sorted and deduplicated. No offsets, source text, revised text, or matched token is present in the audit.
+- Each checkpoint records completed input lines, paired lengths, rolling input/
+  output/audit prefix hashes, and blocked-page count. Resume rejects short or
+  changed partial prefixes, then truncates only uncheckpointed suffixes. A
+  completion marker binds the exact paths, lengths, and SHA-256 values of the
+  input and both final streams. Consumers must verify it and reject `blocked`
+  pages. Directory-sync and power-loss durability remain outside the evidence.
+
+## Exact verification commands and observed results
+
+All commands ran from `/private/tmp/bogkit-sim-2026-08-04-b`.
+
+### Formatting, tests, and lint
+
+```sh
+cargo fmt --manifest-path trial/Cargo.toml -- --check
+CARGO_TARGET_DIR=/private/tmp/bogkit-sim-2026-08-04-b/trial/.target cargo test --offline --manifest-path trial/Cargo.toml
+CARGO_TARGET_DIR=/private/tmp/bogkit-sim-2026-08-04-b/trial/.target cargo clippy --offline --all-targets --manifest-path trial/Cargo.toml -- -D warnings
+```
+
+Observed: formatting passed; four tests passed; Clippy finished with no warnings.
+
+### Complete demo
+
+```sh
+trial/run_demo.sh
+```
+
+Observed final lines:
+
+```text
+checked pages=244 exact=243 conservative=1 sentinel_leaks=0 rectangle_mismatches=0
+demo passed: exact rectangles, content-free output, duplicate identity, and two resumes
+```
+
+The script also compared normal versus reversed/duplicated spans and both resumed runs with `cmp`; every comparison returned 0.
+
+### Malformed input
+
+Representative command (repeated for all four structured malformed files):
+
+```sh
+trial/.target/debug/ocr-redaction-remap remap \
+  --input trial/generated/malformed/corrupt_offset.jsonl \
+  --output trial/generated/malformed/corrupt-output.jsonl \
+  --audit trial/generated/malformed/corrupt-audit.jsonl
+```
+
+Observed structured errors and exit status:
+
+| Case | Page error code | Exit | Rectangles |
+|---|---|---:|---:|
+| corrupt offset | `corrupt_offset` | 2 | 0 |
+| byte inside multibyte character | `invalid_utf8_boundary` | 2 | 0 |
+| missing rectangle | `missing_geometry` | 2 | 0 |
+| duplicate/contradictory rectangle | `contradictory_geometry` | 2 | 0 |
+
+Two-run SHA-256 values were unchanged:
+
+```text
+ad4fc132cfbe8b5db81cd98e49379be6d48078e8456bf9f16b81645ed05812ce  corrupt-output.jsonl
+a02c3c9790d1220b2f9320db89dd3312a333e187430e9796489bd2870f7e0165  boundary-output.jsonl
+4d0957a82e9b4db1cb620efb438fdbfd98702a5e76cdd541b716f6045c4c14ac  missing-output.jsonl
+a87492b1c5151e1b70ebada56778f302ee3b8f79a38331a834cd3064b952cbaa  contradictory-output.jsonl
+```
+
+Invalid raw UTF-8 was run twice. Both runs returned exit 2 and exactly:
+
+```text
+error code=invalid_utf8 line=1
+```
+
+### Full workload
+
+```sh
+trial/.target/release/ocr-redaction-remap generate-workload \
+  --output trial/.workload/pages.jsonl \
+  --pages 5000 --scalars-per-page 4000 --spans-per-page 30
+
+/usr/bin/time -l -o trial/.workload/time.txt \
+  trial/.target/release/ocr-redaction-remap remap \
+  --input trial/.workload/pages.jsonl \
+  --output trial/.workload/timed-output.jsonl \
+  --audit trial/.workload/timed-audit.jsonl
+```
+
+Observed:
+
+```text
+generated workload_pages=5000 scalars=20000000 spans=150000
+38.82 real  13.40 user  2.13 sys
+5947392 maximum resident set size
+5000 output lines; 5000 audit lines
+0 blocked; 0 conservative; 600000 rectangles
+```
+
+`cmp` confirmed the timed output and audit were byte-identical to the earlier uninterrupted workload run.
+
+## Findings
+
+### 1. Stale-offset clamp can expose sensitive text
+
+- Category: correctness defect in the existing Python baseline, not BogKit.
+- Severity: critical.
+- Confidence: high; deterministic assertion-backed reproducer.
+- Reproduction: `python3 trial/baseline_clamp.py`.
+- Smallest plausible improvement: stop clamping revised offsets; require a validated old-to-revised mapping and block publication on unresolved mapping or geometry.
+
+### 2. Advertised starter is coupled to an unrelated model download
+
+- Category: API friction and documentation gap in the current BogKit public starter.
+- Severity: medium for first-run/offline use.
+- Confidence: high for this detached current-main checkout; observed command and manifests explain the failure.
+- Reproduction: the `cargo run -p starter` command above in a fresh target directory.
+- Smallest plausible improvement: remove unused ESE/ANNy dependencies from `examples/starter/Cargo.toml`; make the scaffold add components on demand, or clearly disclose the ESE model download.
+
+### 3. BogKit is a poor fit for this mapper
+
+- Category: poor product fit; public-surface missing capability.
+- Severity: informational.
+- Confidence: high for Fold/ESE/ANNy roles described by the public README and examples; medium for the absence of any unpublished/internal primitive because this trial intentionally began and stayed on the public surface.
+- Reproduction: compare the page-local transformation requirements with the starter/timeseries/chat/search examples.
+- Smallest plausible improvement: none recommended for this task. A standalone streaming transformer is smaller and has a clearer recovery boundary.
+
+### 4. Broad rewrites are intentionally blocked
+
+- Category: prototype missing capability, not BogKit.
+- Severity: moderate availability limitation; safe for confidentiality.
+- Confidence: high; explicit `MAX_EDIT_DISTANCE = 256` behavior.
+- Reproduction: provide a page whose normalized old/revised edit distance exceeds 256.
+- Smallest plausible improvement: add a linear-space anchor partitioner with a separately tested memory bound before increasing the cap.
+
+### 5. Measured performance meets the stated bound
+
+- Category: performance result, no observed performance problem.
+- Severity: informational.
+- Confidence: high for the exact generated workload executed on this machine.
+- Reproduction: full-workload commands above.
+- Smallest plausible improvement: none required for the stated 64 MiB target; production inputs should still be profiled because geometry number formatting and page size can differ.
+
+## Consequential-choice audit
+
+| Choice | Decision | Evidence | Consequence / unresolved uncertainty |
+|---|---|---|---|
+| Use BogKit | No | Public components maintain views, embeddings, or nearest-neighbor indexes; none performs authoritative Unicode remapping. | Avoids unrelated state and model dependencies. Does not assess unpublished APIs. |
+| Offset model | Validate UTF-8 bytes, map normalized graphemes | Invalid boundaries blocked deterministically; Unicode fixtures exact. | A reviewed span that normalizes to no token blocks rather than guessing. |
+| Repeated sensitive text | Redact every tied smallest token candidate | Hand ambiguity case redacted both occurrences and nothing between them. | Can reduce utility but does not select an arbitrary occurrence. |
+| Changed text | Bounded deterministic diff plus unique flanks | OCR substitution and deletion fixtures mapped exactly. | More than 256 edits blocks the page. Production normalization rules may need additional explicit transforms. |
+| Geometry | Require complete one-to-one revised grapheme geometry | Missing and contradictory fixtures blocked with zero rectangles. | No bidirectional or arbitrary layout handling, consistent with non-goals. |
+| Duplicate spans | Sort/deduplicate before processing | Reversed and duplicated input was byte-identical. | Same offsets with different valid reason codes remain two audit decisions but one rectangle union. |
+| Recovery | Paired lengths and prefix hashes + SHA-256-bound completion marker | Two controlled resumes and the reviewer regressions pass. | This is process-resume evidence only; no exhaustive crash or power-loss injection was performed. |
+| Diagnostics | Static error codes and counts only | Leak checker found zero fixture sentinels; invalid UTF-8 error was content-free. | Page IDs and reason codes are required to be non-sensitive identifier-shaped metadata. |
+
+## Scope and cleanup
+
+No BogKit/core/example/root file was modified. There was no commit, GitHub write, automation write, PDF/OCR/database/network dependency in the prototype, or archive into another checkout. Network was used only once to resolve the trial's four small Rust library dependencies after the sandboxed index lookup failed; subsequent verification ran offline from `trial/Cargo.lock`.
+
+Generated build targets, demo outputs, and the 493 MiB workload were removed after recording the measurements. The retained handoff is source, lockfile, README, runnable demo/generators/checker, baseline reproducer, and these notes.
diff --git a/developer-simulation/runs/2026-08-04--ocr-redaction-remap/baseline_clamp.py b/developer-simulation/runs/2026-08-04--ocr-redaction-remap/baseline_clamp.py
new file mode 100644
index 0000000..716454c
--- /dev/null
+++ b/developer-simulation/runs/2026-08-04--ocr-redaction-remap/baseline_clamp.py
@@ -0,0 +1,22 @@
+#!/usr/bin/env python3
+"""Content-free reproducer for stale-offset clamping.
+
+The assertions model the existing policy; stdout intentionally contains no OCR text.
+"""
+
+import json
+
+
+old_text = "prefix extra account-12345 suffix"
+revised_text = "prefix account 12345 suffix"
+start = old_text.index("account-12345")
+end = start + len("account-12345")
+
+clamped_start = min(start, len(revised_text))
+clamped_end = min(end, len(revised_text))
+covered = revised_text[clamped_start:clamped_end]
+
+assert "account 12345" not in covered, "fixture must reproduce partial exposure"
+assert revised_text.index("account 12345") < clamped_start, "fixture must expose a sensitive prefix"
+
+print(json.dumps({"baseline": "stale_offset_clamp", "partial_exposure_reproduced": True}))
diff --git a/developer-simulation/runs/2026-08-04--ocr-redaction-remap/run_demo.sh b/developer-simulation/runs/2026-08-04--ocr-redaction-remap/run_demo.sh
new file mode 100755
index 0000000..ed0f603
--- /dev/null
+++ b/developer-simulation/runs/2026-08-04--ocr-redaction-remap/run_demo.sh
@@ -0,0 +1,40 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+here="$(cd "$(dirname "$0")" && pwd)"
+repo_root="$(cd "$here/../../.." && pwd)"
+demo="$(mktemp -d /private/tmp/ocr-redaction-remap-demo.XXXXXX)"
+target="/private/tmp/ocr-redaction-remap-target"
+binary="$target/debug/ocr-redaction-remap"
+trap 'rm -rf "$demo"' EXIT
+
+CARGO_TARGET_DIR="$target" cargo build --offline --locked \
+  --manifest-path "$repo_root/developer-simulation/Cargo.toml" \
+  -p ocr-redaction-remap
+"$binary" generate --dir "$demo/fixtures" --pages 240
+"$binary" remap --input "$demo/fixtures/pages.jsonl" --output "$demo/output.jsonl" --audit "$demo/audit.jsonl"
+"$binary" check --input "$demo/fixtures/pages.jsonl" --output "$demo/output.jsonl" --audit "$demo/audit.jsonl" --expected "$demo/fixtures/expected.jsonl" --sentinels "$demo/fixtures/sentinels.json"
+
+"$binary" remap --input "$demo/fixtures/pages_shuffled_duplicated.jsonl" --output "$demo/variant-output.jsonl" --audit "$demo/variant-audit.jsonl"
+cmp "$demo/output.jsonl" "$demo/variant-output.jsonl"
+cmp "$demo/audit.jsonl" "$demo/variant-audit.jsonl"
+
+set +e
+"$binary" remap --input "$demo/fixtures/pages.jsonl" --output "$demo/resume-a-output.jsonl" --audit "$demo/resume-a-audit.jsonl" --stop-after 73
+interrupted_a=$?
+set -e
+test "$interrupted_a" -eq 75
+"$binary" remap --input "$demo/fixtures/pages.jsonl" --output "$demo/resume-a-output.jsonl" --audit "$demo/resume-a-audit.jsonl" --resume
+cmp "$demo/output.jsonl" "$demo/resume-a-output.jsonl"
+cmp "$demo/audit.jsonl" "$demo/resume-a-audit.jsonl"
+
+set +e
+"$binary" remap --input "$demo/fixtures/pages.jsonl" --output "$demo/resume-b-output.jsonl" --audit "$demo/resume-b-audit.jsonl" --stop-after 191
+interrupted_b=$?
+set -e
+test "$interrupted_b" -eq 75
+"$binary" remap --input "$demo/fixtures/pages.jsonl" --output "$demo/resume-b-output.jsonl" --audit "$demo/resume-b-audit.jsonl" --resume
+cmp "$demo/output.jsonl" "$demo/resume-b-output.jsonl"
+cmp "$demo/audit.jsonl" "$demo/resume-b-audit.jsonl"
+
+echo "demo passed: exact rectangles, content-free output, duplicate identity, and two resumes"
diff --git a/developer-simulation/runs/2026-08-04--ocr-redaction-remap/src/lib.rs b/developer-simulation/runs/2026-08-04--ocr-redaction-remap/src/lib.rs
new file mode 100644
index 0000000..7a2e6e6
--- /dev/null
+++ b/developer-simulation/runs/2026-08-04--ocr-redaction-remap/src/lib.rs
@@ -0,0 +1,2125 @@
+use serde::{Deserialize, Serialize};
+use sha2::{Digest, Sha256};
+use std::collections::{BTreeMap, BTreeSet};
+use std::fs::{self, File, OpenOptions};
+use std::io::{BufRead, BufReader, BufWriter, Read, Seek, SeekFrom, Write};
+use std::path::{Path, PathBuf};
+use std::process::ExitCode;
+use unicode_normalization::UnicodeNormalization;
+use unicode_segmentation::UnicodeSegmentation;
+
+const MAX_EDIT_DISTANCE: usize = 256;
+const FNV_OFFSET: u64 = 0xcbf2_9ce4_8422_2325;
+const FNV_PRIME: u64 = 0x0000_0100_0000_01b3;
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+struct PageInput {
+    page_id: String,
+    old_text: String,
+    revised_text: String,
+    glyphs: Vec<Glyph>,
+    spans: Vec<ReviewedSpan>,
+}
+
+/// Compact JSON form: [start_byte, end_byte, line, x, y, width, height].
+#[derive(Debug, Clone, Copy, Serialize, Deserialize)]
+struct Glyph(usize, usize, u32, i32, i32, i32, i32);
+
+#[derive(Debug, Clone, PartialEq, Eq, PartialOrd, Ord, Serialize, Deserialize)]
+struct ReviewedSpan {
+    start: usize,
+    end: usize,
+    reason: String,
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, PartialOrd, Ord, Serialize, Deserialize)]
+struct Rect {
+    x: i32,
+    y: i32,
+    w: i32,
+    h: i32,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+struct PageOutput {
+    page_id: String,
+    status: String,
+    rectangles: Vec<Rect>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    error_code: Option<String>,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+struct PageAudit {
+    page_id: String,
+    status: String,
+    reviewed_spans: usize,
+    exact_spans: usize,
+    conservative_spans: usize,
+    removed_spans: usize,
+    rectangle_count: usize,
+    reason_codes: Vec<String>,
+    decisions: Vec<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    error_code: Option<String>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+struct Checkpoint {
+    completed_pages: usize,
+    output_len: u64,
+    audit_len: u64,
+    input_prefix_hash: u64,
+    output_prefix_hash: u64,
+    audit_prefix_hash: u64,
+    blocked_pages: usize,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+struct CompletionMarker {
+    version: u32,
+    input_path: String,
+    output_path: String,
+    audit_path: String,
+    input_len: u64,
+    output_len: u64,
+    audit_len: u64,
+    input_sha256: String,
+    output_sha256: String,
+    audit_sha256: String,
+    completed_pages: usize,
+    blocked_pages: usize,
+}
+
+#[derive(Debug)]
+struct SafeError {
+    code: &'static str,
+    line: Option<usize>,
+}
+
+impl SafeError {
+    const fn new(code: &'static str) -> Self {
+        Self { code, line: None }
+    }
+
+    const fn at_line(code: &'static str, line: usize) -> Self {
+        Self {
+            code,
+            line: Some(line),
+        }
+    }
+
+    fn print(&self) {
+        match self.line {
+            Some(line) => eprintln!("error code={} line={line}", self.code),
+            None => eprintln!("error code={}", self.code),
+        }
+    }
+}
+
+type SafeResult<T> = Result<T, SafeError>;
+
+#[derive(Debug)]
+struct RemapArgs {
+    input: PathBuf,
+    output: PathBuf,
+    audit: PathBuf,
+    resume: bool,
+    stop_after: Option<usize>,
+}
+
+#[derive(Debug, Serialize)]
+struct RunSummary {
+    pages: usize,
+    blocked_pages: usize,
+    resumed_from: usize,
+    interrupted: bool,
+}
+
+pub fn entry(args: Vec<String>) -> ExitCode {
+    let result = dispatch(&args);
+    match result {
+        Ok(CommandResult::Complete(summary)) => {
+            let _ = serde_json::to_writer(std::io::stdout().lock(), &summary);
+            println!();
+            if summary.blocked_pages == 0 {
+                ExitCode::SUCCESS
+            } else {
+                ExitCode::from(2)
+            }
+        }
+        Ok(CommandResult::Interrupted(summary)) => {
+            let _ = serde_json::to_writer(std::io::stdout().lock(), &summary);
+            println!();
+            ExitCode::from(75)
+        }
+        Ok(CommandResult::Generated(summary)) | Ok(CommandResult::Checked(summary)) => {
+            println!("{summary}");
+            ExitCode::SUCCESS
+        }
+        Err(error) => {
+            error.print();
+            ExitCode::from(2)
+        }
+    }
+}
+
+#[derive(Debug)]
+enum CommandResult {
+    Complete(RunSummary),
+    Interrupted(RunSummary),
+    Generated(String),
+    Checked(String),
+}
+
+fn dispatch(args: &[String]) -> SafeResult<CommandResult> {
+    let Some(command) = args.first().map(String::as_str) else {
+        return Err(SafeError::new("usage"));
+    };
+    match command {
+        "remap" => {
+            let parsed = parse_remap_args(&args[1..])?;
+            run_remap(&parsed)
+        }
+        "generate" => {
+            let dir = required_path_arg(&args[1..], "--dir")?;
+            let pages = optional_usize_arg(&args[1..], "--pages")?.unwrap_or(240);
+            generate_suite(&dir, pages)?;
+            Ok(CommandResult::Generated(format!(
+                "generated fixture_pages={} hand_pages=4",
+                pages
+            )))
+        }
+        "generate-workload" => {
+            let output = required_path_arg(&args[1..], "--output")?;
+            let pages = optional_usize_arg(&args[1..], "--pages")?.unwrap_or(5_000);
+            let scalars = optional_usize_arg(&args[1..], "--scalars-per-page")?.unwrap_or(4_000);
+            let spans = optional_usize_arg(&args[1..], "--spans-per-page")?.unwrap_or(30);
+            generate_workload(&output, pages, scalars, spans)?;
+            Ok(CommandResult::Generated(format!(
+                "generated workload_pages={pages} scalars={} spans={}",
+                pages.saturating_mul(scalars),
+                pages.saturating_mul(spans)
+            )))
+        }
+        "check" => {
+            let input = required_path_arg(&args[1..], "--input")?;
+            let output = required_path_arg(&args[1..], "--output")?;
+            let audit = required_path_arg(&args[1..], "--audit")?;
+            let expected = required_path_arg(&args[1..], "--expected")?;
+            let sentinels = required_path_arg(&args[1..], "--sentinels")?;
+            let diagnostics = optional_path_arg(&args[1..], "--diagnostics");
+            let summary = check_suite(
+                &input,
+                &output,
+                &audit,
+                &expected,
+                &sentinels,
+                diagnostics.as_deref(),
+            )?;
+            Ok(CommandResult::Checked(summary))
+        }
+        _ => Err(SafeError::new("usage")),
+    }
+}
+
+fn parse_remap_args(args: &[String]) -> SafeResult<RemapArgs> {
+    Ok(RemapArgs {
+        input: required_path_arg(args, "--input")?,
+        output: required_path_arg(args, "--output")?,
+        audit: required_path_arg(args, "--audit")?,
+        resume: args.iter().any(|arg| arg == "--resume"),
+        stop_after: optional_usize_arg(args, "--stop-after")?,
+    })
+}
+
+fn required_path_arg(args: &[String], name: &str) -> SafeResult<PathBuf> {
+    optional_path_arg(args, name).ok_or_else(|| SafeError::new("usage"))
+}
+
+fn optional_path_arg(args: &[String], name: &str) -> Option<PathBuf> {
+    args.windows(2)
+        .find(|pair| pair[0] == name)
+        .map(|pair| PathBuf::from(&pair[1]))
+}
+
+fn optional_usize_arg(args: &[String], name: &str) -> SafeResult<Option<usize>> {
+    let Some(raw) = args
+        .windows(2)
+        .find(|pair| pair[0] == name)
+        .map(|pair| pair[1].as_str())
+    else {
+        return Ok(None);
+    };
+    raw.parse::<usize>()
+        .map(Some)
+        .map_err(|_| SafeError::new("usage"))
+}
+
+fn run_remap(args: &RemapArgs) -> SafeResult<CommandResult> {
+    if args.output == args.audit || args.input == args.output || args.input == args.audit {
+        return Err(SafeError::new("path_conflict"));
+    }
+    let output_partial = suffixed(&args.output, ".partial");
+    let audit_partial = suffixed(&args.audit, ".partial");
+    let checkpoint_path = suffixed(&args.output, ".checkpoint");
+    let complete_path = suffixed(&args.output, ".complete");
+
+    if args.resume && complete_path.exists() {
+        let marker: CompletionMarker = read_json_file(&complete_path, "invalid_completion_marker")?;
+        verify_completion_marker(args, &marker)?;
+        return Ok(CommandResult::Complete(RunSummary {
+            pages: marker.completed_pages,
+            blocked_pages: marker.blocked_pages,
+            resumed_from: marker.completed_pages,
+            interrupted: false,
+        }));
+    }
+
+    let (mut checkpoint, resumed_from) = if args.resume && checkpoint_path.exists() {
+        let checkpoint: Checkpoint = read_json_file(&checkpoint_path, "invalid_checkpoint")?;
+        (checkpoint.clone(), checkpoint.completed_pages)
+    } else {
+        remove_if_exists(&complete_path)?;
+        remove_if_exists(&checkpoint_path)?;
+        remove_if_exists(&output_partial)?;
+        remove_if_exists(&audit_partial)?;
+        Checkpoint {
+            completed_pages: 0,
+            output_len: 0,
+            audit_len: 0,
+            input_prefix_hash: FNV_OFFSET,
+            output_prefix_hash: FNV_OFFSET,
+            audit_prefix_hash: FNV_OFFSET,
+            blocked_pages: 0,
+        }
+        .pipe(|checkpoint| (checkpoint, 0))
+    };
+
+    let input_file = File::open(&args.input).map_err(|_| SafeError::new("input_open"))?;
+    let mut reader = BufReader::new(input_file);
+    if resumed_from > 0 {
+        restore_partial_for_resume(&output_partial, &args.output)?;
+        restore_partial_for_resume(&audit_partial, &args.audit)?;
+        validate_partial(
+            &output_partial,
+            checkpoint.output_len,
+            checkpoint.output_prefix_hash,
+        )?;
+        validate_partial(
+            &audit_partial,
+            checkpoint.audit_len,
+            checkpoint.audit_prefix_hash,
+        )?;
+    }
+    let output_file = open_partial(&output_partial, resumed_from > 0, checkpoint.output_len)?;
+    let audit_file = open_partial(&audit_partial, resumed_from > 0, checkpoint.audit_len)?;
+
+    let mut raw = Vec::new();
+    let mut prefix_hash = FNV_OFFSET;
+    for line_index in 1..=checkpoint.completed_pages {
+        raw.clear();
+        if reader
+            .read_until(b'\n', &mut raw)
+            .map_err(|_| SafeError::at_line("input_read", line_index))?
+            == 0
+        {
+            return Err(SafeError::new("resume_input_shorter"));
+        }
+        prefix_hash = fnv_update(prefix_hash, &raw);
+    }
+    if prefix_hash != checkpoint.input_prefix_hash {
+        return Err(SafeError::new("resume_input_changed"));
+    }
+
+    let mut output_writer = BufWriter::new(output_file);
+    let mut audit_writer = BufWriter::new(audit_file);
+    let mut line_index = checkpoint.completed_pages;
+    loop {
+        raw.clear();
+        let bytes = reader
+            .read_until(b'\n', &mut raw)
+            .map_err(|_| SafeError::at_line("input_read", line_index + 1))?;
+        if bytes == 0 {
+            break;
+        }
+        line_index += 1;
+        let content = raw.strip_suffix(b"\n").unwrap_or(&raw);
+        let content = content.strip_suffix(b"\r").unwrap_or(content);
+        if content.is_empty() {
+            return Err(SafeError::at_line("blank_input_line", line_index));
+        }
+        std::str::from_utf8(content).map_err(|_| SafeError::at_line("invalid_utf8", line_index))?;
+        let page: PageInput = serde_json::from_slice(content)
+            .map_err(|_| SafeError::at_line("invalid_json", line_index))?;
+        let (output, audit) = process_page(page, line_index);
+        let mut output_record =
+            serde_json::to_vec(&output).map_err(|_| SafeError::new("output_write"))?;
+        output_record.push(b'\n');
+        output_writer
+            .write_all(&output_record)
+            .map_err(|_| SafeError::new("output_write"))?;
+        let mut audit_record =
+            serde_json::to_vec(&audit).map_err(|_| SafeError::new("audit_write"))?;
+        audit_record.push(b'\n');
+        audit_writer
+            .write_all(&audit_record)
+            .map_err(|_| SafeError::new("audit_write"))?;
+        output_writer
+            .flush()
+            .map_err(|_| SafeError::new("output_write"))?;
+        audit_writer
+            .flush()
+            .map_err(|_| SafeError::new("audit_write"))?;
+
+        checkpoint.completed_pages += 1;
+        checkpoint.output_len = output_writer
+            .stream_position()
+            .map_err(|_| SafeError::new("output_write"))?;
+        checkpoint.audit_len = audit_writer
+            .stream_position()
+            .map_err(|_| SafeError::new("audit_write"))?;
+        checkpoint.input_prefix_hash = fnv_update(checkpoint.input_prefix_hash, &raw);
+        checkpoint.output_prefix_hash = fnv_update(checkpoint.output_prefix_hash, &output_record);
+        checkpoint.audit_prefix_hash = fnv_update(checkpoint.audit_prefix_hash, &audit_record);
+        if output.status == "blocked" {
+            checkpoint.blocked_pages += 1;
+        }
+        write_checkpoint(&checkpoint_path, &checkpoint)?;
+
+        if args.stop_after == Some(checkpoint.completed_pages) {
+            return Ok(CommandResult::Interrupted(RunSummary {
+                pages: checkpoint.completed_pages,
+                blocked_pages: checkpoint.blocked_pages,
+                resumed_from,
+                interrupted: true,
+            }));
+        }
+    }
+
+    output_writer
+        .flush()
+        .map_err(|_| SafeError::new("output_write"))?;
+    audit_writer
+        .flush()
+        .map_err(|_| SafeError::new("audit_write"))?;
+    output_writer
+        .get_ref()
+        .sync_all()
+        .map_err(|_| SafeError::new("output_write"))?;
+    audit_writer
+        .get_ref()
+        .sync_all()
+        .map_err(|_| SafeError::new("audit_write"))?;
+    drop(output_writer);
+    drop(audit_writer);
+    replace_file(&output_partial, &args.output)?;
+    replace_file(&audit_partial, &args.audit)?;
+    let marker = completion_marker(args, &checkpoint)?;
+    write_checkpoint(&complete_path, &marker)?;
+    remove_if_exists(&checkpoint_path)?;
+
+    Ok(CommandResult::Complete(RunSummary {
+        pages: checkpoint.completed_pages,
+        blocked_pages: checkpoint.blocked_pages,
+        resumed_from,
+        interrupted: false,
+    }))
+}
+
+trait Pipe: Sized {
+    fn pipe<T>(self, f: impl FnOnce(Self) -> T) -> T {
+        f(self)
+    }
+}
+impl<T> Pipe for T {}
+
+fn suffixed(path: &Path, suffix: &str) -> PathBuf {
+    let mut value = path.as_os_str().to_os_string();
+    value.push(suffix);
+    PathBuf::from(value)
+}
+
+fn open_partial(path: &Path, resume: bool, len: u64) -> SafeResult<File> {
+    let mut options = OpenOptions::new();
+    options.read(true).write(true);
+    if resume {
+        let mut file = options
+            .open(path)
+            .map_err(|_| SafeError::new("partial_open"))?;
+        let actual_len = file
+            .metadata()
+            .map_err(|_| SafeError::new("partial_open"))?
+            .len();
+        if actual_len < len {
+            return Err(SafeError::new("partial_short"));
+        }
+        file.set_len(len)
+            .map_err(|_| SafeError::new("partial_write"))?;
+        file.seek(SeekFrom::Start(len))
+            .map_err(|_| SafeError::new("partial_write"))?;
+        Ok(file)
+    } else {
+        options
+            .create(true)
+            .truncate(true)
+            .open(path)
+            .map_err(|_| SafeError::new("partial_open"))
+    }
+}
+
+fn restore_partial_for_resume(partial: &Path, final_path: &Path) -> SafeResult<()> {
+    if partial.exists() {
+        return Ok(());
+    }
+    if final_path.exists() {
+        fs::rename(final_path, partial).map_err(|_| SafeError::new("resume_partial_restore"))
+    } else {
+        Err(SafeError::new("resume_partial_missing"))
+    }
+}
+
+fn fnv_update(mut hash: u64, bytes: &[u8]) -> u64 {
+    for byte in bytes {
+        hash ^= u64::from(*byte);
+        hash = hash.wrapping_mul(FNV_PRIME);
+    }
+    hash
+}
+
+fn validate_partial(path: &Path, expected_len: u64, expected_hash: u64) -> SafeResult<()> {
+    let file = File::open(path).map_err(|_| SafeError::new("partial_open"))?;
+    let actual_len = file
+        .metadata()
+        .map_err(|_| SafeError::new("partial_open"))?
+        .len();
+    if actual_len < expected_len {
+        return Err(SafeError::new("partial_short"));
+    }
+    let mut reader = file.take(expected_len);
+    let mut buffer = [0_u8; 8192];
+    let mut hash = FNV_OFFSET;
+    loop {
+        let read = reader
+            .read(&mut buffer)
+            .map_err(|_| SafeError::new("partial_read"))?;
+        if read == 0 {
+            break;
+        }
+        hash = fnv_update(hash, &buffer[..read]);
+    }
+    if hash != expected_hash {
+        return Err(SafeError::new("partial_changed"));
+    }
+    Ok(())
+}
+
+fn path_identity(path: &Path) -> String {
+    path.to_string_lossy().into_owned()
+}
+
+fn file_len(path: &Path) -> SafeResult<u64> {
+    fs::metadata(path)
+        .map(|metadata| metadata.len())
+        .map_err(|_| SafeError::new("completed_state_mismatch"))
+}
+
+fn sha256_file(path: &Path) -> SafeResult<String> {
+    let mut file = File::open(path).map_err(|_| SafeError::new("completed_state_mismatch"))?;
+    let mut hasher = Sha256::new();
+    let mut buffer = [0_u8; 64 * 1024];
+    loop {
+        let read = file
+            .read(&mut buffer)
+            .map_err(|_| SafeError::new("completed_state_mismatch"))?;
+        if read == 0 {
+            break;
+        }
+        hasher.update(&buffer[..read]);
+    }
+    Ok(format!("{:x}", hasher.finalize()))
+}
+
+fn completion_marker(args: &RemapArgs, checkpoint: &Checkpoint) -> SafeResult<CompletionMarker> {
+    Ok(CompletionMarker {
+        version: 1,
+        input_path: path_identity(&args.input),
+        output_path: path_identity(&args.output),
+        audit_path: path_identity(&args.audit),
+        input_len: file_len(&args.input)?,
+        output_len: file_len(&args.output)?,
+        audit_len: file_len(&args.audit)?,
+        input_sha256: sha256_file(&args.input)?,
+        output_sha256: sha256_file(&args.output)?,
+        audit_sha256: sha256_file(&args.audit)?,
+        completed_pages: checkpoint.completed_pages,
+        blocked_pages: checkpoint.blocked_pages,
+    })
+}
+
+fn verify_completion_marker(args: &RemapArgs, marker: &CompletionMarker) -> SafeResult<()> {
+    let paths_match = marker.version == 1
+        && marker.input_path == path_identity(&args.input)
+        && marker.output_path == path_identity(&args.output)
+        && marker.audit_path == path_identity(&args.audit);
+    let lengths_match = file_len(&args.input)? == marker.input_len
+        && file_len(&args.output)? == marker.output_len
+        && file_len(&args.audit)? == marker.audit_len;
+    let hashes_match = sha256_file(&args.input)? == marker.input_sha256
+        && sha256_file(&args.output)? == marker.output_sha256
+        && sha256_file(&args.audit)? == marker.audit_sha256;
+    if paths_match && lengths_match && hashes_match {
+        Ok(())
+    } else {
+        Err(SafeError::new("completed_state_mismatch"))
+    }
+}
+
+fn read_json_file<T: for<'de> Deserialize<'de>>(path: &Path, code: &'static str) -> SafeResult<T> {
+    let file = File::open(path).map_err(|_| SafeError::new(code))?;
+    serde_json::from_reader(BufReader::new(file)).map_err(|_| SafeError::new(code))
+}
+
+fn write_checkpoint<T: Serialize>(path: &Path, checkpoint: &T) -> SafeResult<()> {
+    let temp = suffixed(path, ".tmp");
+    let file = File::create(&temp).map_err(|_| SafeError::new("checkpoint_write"))?;
+    let mut writer = BufWriter::new(file);
+    serde_json::to_writer(&mut writer, checkpoint)
+        .map_err(|_| SafeError::new("checkpoint_write"))?;
+    writer
+        .write_all(b"\n")
+        .map_err(|_| SafeError::new("checkpoint_write"))?;
+    writer
+        .flush()
+        .map_err(|_| SafeError::new("checkpoint_write"))?;
+    writer
+        .get_ref()
+        .sync_all()
+        .map_err(|_| SafeError::new("checkpoint_write"))?;
+    replace_file(&temp, path)
+}
+
+fn replace_file(from: &Path, to: &Path) -> SafeResult<()> {
+    remove_if_exists(to)?;
+    fs::rename(from, to).map_err(|_| SafeError::new("atomic_rename"))
+}
+
+fn remove_if_exists(path: &Path) -> SafeResult<()> {
+    match fs::remove_file(path) {
+        Ok(()) => Ok(()),
+        Err(error) if error.kind() == std::io::ErrorKind::NotFound => Ok(()),
+        Err(_) => Err(SafeError::new("file_remove")),
+    }
+}
+
+#[derive(Debug, Clone)]
+struct GraphemeInfo {
+    start: usize,
+    end: usize,
+    is_line_break: bool,
+}
+
+#[derive(Debug, Clone)]
+struct Token {
+    ch: char,
+    grapheme_start: usize,
+    grapheme_end: usize,
+    had_newline: bool,
+}
+
+#[derive(Debug, Clone, Copy)]
+enum EditOp {
+    Equal(usize, usize),
+    Delete(usize),
+    Insert(usize),
+}
+
+#[derive(Debug)]
+enum SpanDecision {
+    Exact(BTreeSet<usize>),
+    ConservativeToken(BTreeSet<usize>),
+    ConservativeLine(BTreeSet<u32>),
+    Removed,
+    Blocked(&'static str),
+}
+
+fn process_page(page: PageInput, line_number: usize) -> (PageOutput, PageAudit) {
+    let safe_id = if valid_identifier(&page.page_id) {
+        page.page_id.clone()
+    } else {
+        format!("line-{line_number:08}")
+    };
+    if !valid_identifier(&page.page_id) {
+        return blocked_page(safe_id, "invalid_page_id");
+    }
+
+    let spans: Vec<ReviewedSpan> = page
+        .spans
+        .into_iter()
+        .collect::<BTreeSet<_>>()
+        .into_iter()
+        .collect();
+    if spans.iter().any(|span| !valid_identifier(&span.reason)) {
+        return blocked_page(safe_id, "invalid_reason_code");
+    }
+    if let Some(code) = validate_spans(&page.old_text, &spans) {
+        return blocked_page(safe_id, code);
+    }
+
+    let revised_graphemes = graphemes(&page.revised_text);
+    let glyphs = match validate_geometry(&page.revised_text, &revised_graphemes, &page.glyphs) {
+        Ok(glyphs) => glyphs,
+        Err(code) => return blocked_page(safe_id, code),
+    };
+    let old_graphemes = graphemes(&page.old_text);
+    let old_tokens = canonical_tokens(&page.old_text, &old_graphemes);
+    let revised_tokens = canonical_tokens(&page.revised_text, &revised_graphemes);
+    let old_chars: Vec<char> = old_tokens.iter().map(|token| token.ch).collect();
+    let revised_chars: Vec<char> = revised_tokens.iter().map(|token| token.ch).collect();
+    let mut edit_script: Option<Result<Vec<EditOp>, &'static str>> = None;
+
+    let mut rectangle_set = BTreeSet::new();
+    let mut reason_codes = BTreeSet::new();
+    let mut decisions = Vec::new();
+    let mut exact_spans = 0;
+    let mut conservative_spans = 0;
+    let mut removed_spans = 0;
+    let mut page_status = "exact";
+
+    for span in &spans {
+        reason_codes.insert(span.reason.clone());
+        let Some((token_start, token_end)) =
+            token_interval_for_bytes(&old_tokens, &old_graphemes, span.start, span.end)
+        else {
+            return blocked_page(safe_id, "empty_span_after_normalization");
+        };
+        let pattern = &old_chars[token_start..token_end];
+        let occurrences = find_occurrences(&revised_chars, pattern);
+        let decision = if !occurrences.is_empty() {
+            let literal_decision = if occurrences.len() == 1 {
+                SpanDecision::Exact(token_range_graphemes(
+                    &revised_tokens,
+                    occurrences[0],
+                    occurrences[0] + pattern.len(),
+                ))
+            } else {
+                let scored: Vec<(usize, usize)> = occurrences
+                    .iter()
+                    .map(|&candidate| {
+                        (
+                            candidate,
+                            context_score(
+                                &old_chars,
+                                token_start,
+                                token_end,
+                                &revised_chars,
+                                candidate,
+                                candidate + pattern.len(),
+                            ),
+                        )
+                    })
+                    .collect();
+                let best = scored.iter().map(|(_, score)| *score).max().unwrap_or(0);
+                let winners: Vec<usize> = scored
+                    .iter()
+                    .filter(|(_, score)| *score == best)
+                    .map(|(candidate, _)| *candidate)
+                    .collect();
+                if best > 0 && winners.len() == 1 {
+                    SpanDecision::Exact(token_range_graphemes(
+                        &revised_tokens,
+                        winners[0],
+                        winners[0] + pattern.len(),
+                    ))
+                } else {
+                    let mut all = BTreeSet::new();
+                    for candidate in occurrences {
+                        all.extend(token_range_graphemes(
+                            &revised_tokens,
+                            candidate,
+                            candidate + pattern.len(),
+                        ));
+                    }
+                    SpanDecision::ConservativeToken(all)
+                }
+            };
+
+            let script_result =
+                edit_script.get_or_insert_with(|| myers_diff(&old_chars, &revised_chars));
+            match (literal_decision, script_result) {
+                (SpanDecision::Exact(literal), Ok(script)) => {
+                    let mapped =
+                        map_span_through_edits(script, token_start, token_end, &revised_tokens);
+                    if mapped == literal {
+                        SpanDecision::Exact(literal)
+                    } else {
+                        let mut conservative = literal;
+                        conservative.extend(mapped);
+                        if conservative.is_empty() {
+                            SpanDecision::Blocked("ambiguous_mapping")
+                        } else {
+                            SpanDecision::ConservativeToken(conservative)
+                        }
+                    }
+                }
+                (SpanDecision::ConservativeToken(mut literal), Ok(script)) => {
+                    literal.extend(map_span_through_edits(
+                        script,
+                        token_start,
+                        token_end,
+                        &revised_tokens,
+                    ));
+                    if literal.is_empty() {
+                        SpanDecision::Blocked("ambiguous_mapping")
+                    } else {
+                        SpanDecision::ConservativeToken(literal)
+                    }
+                }
+                (_, Err(code)) => SpanDecision::Blocked(code),
+                _ => unreachable!("literal matching returns exact or conservative token"),
+            }
+        } else {
+            let script_result =
+                edit_script.get_or_insert_with(|| myers_diff(&old_chars, &revised_chars));
+            match script_result {
+                Ok(script) => {
+                    let mapped =
+                        map_span_through_edits(script, token_start, token_end, &revised_tokens);
+                    if unique_flanks(&old_chars, token_start, token_end, &revised_chars, &mapped) {
+                        if mapped.is_empty() {
+                            SpanDecision::Removed
+                        } else {
+                            SpanDecision::Exact(mapped)
+                        }
+                    } else {
+                        let lines = lines_for_graphemes(&mapped, &revised_graphemes, &glyphs);
+                        if lines.is_empty() {
+                            SpanDecision::Blocked("ambiguous_mapping")
+                        } else {
+                            SpanDecision::ConservativeLine(lines)
+                        }
+                    }
+                }
+                Err(code) => SpanDecision::Blocked(code),
+            }
+        };
+
+        match decision {
+            SpanDecision::Exact(indices) => {
+                exact_spans += 1;
+                decisions.push("exact".to_string());
+                add_glyph_rectangles(&mut rectangle_set, &indices, &glyphs);
+            }
+            SpanDecision::ConservativeToken(indices) => {
+                conservative_spans += 1;
+                page_status = "conservative";
+                decisions.push("fallback_token".to_string());
+                add_glyph_rectangles(&mut rectangle_set, &indices, &glyphs);
+            }
+            SpanDecision::ConservativeLine(lines) => {
+                conservative_spans += 1;
+                page_status = "conservative";
+                decisions.push("fallback_line".to_string());
+                for glyph in glyphs.values().filter(|glyph| lines.contains(&glyph.2)) {
+                    rectangle_set.insert(glyph_rect(*glyph));
+                }
+            }
+            SpanDecision::Removed => {
+                removed_spans += 1;
+                decisions.push("removed".to_string());
+            }
+            SpanDecision::Blocked(code) => return blocked_page(safe_id, code),
+        }
+    }
+
+    let mut rectangles: Vec<Rect> = rectangle_set.into_iter().collect();
+    rectangles.sort_by_key(|rect| (rect.y, rect.x, rect.w, rect.h));
+    let output = PageOutput {
+        page_id: safe_id.clone(),
+        status: page_status.to_string(),
+        rectangles,
+        error_code: None,
+    };
+    let audit = PageAudit {
+        page_id: safe_id,
+        status: page_status.to_string(),
+        reviewed_spans: spans.len(),
+        exact_spans,
+        conservative_spans,
+        removed_spans,
+        rectangle_count: output.rectangles.len(),
+        reason_codes: reason_codes.into_iter().collect(),
+        decisions,
+        error_code: None,
+    };
+    (output, audit)
+}
+
+fn blocked_page(page_id: String, code: &'static str) -> (PageOutput, PageAudit) {
+    (
+        PageOutput {
+            page_id: page_id.clone(),
+            status: "blocked".to_string(),
+            rectangles: Vec::new(),
+            error_code: Some(code.to_string()),
+        },
+        PageAudit {
+            page_id,
+            status: "blocked".to_string(),
+            reviewed_spans: 0,
+            exact_spans: 0,
+            conservative_spans: 0,
+            removed_spans: 0,
+            rectangle_count: 0,
+            reason_codes: Vec::new(),
+            decisions: Vec::new(),
+            error_code: Some(code.to_string()),
+        },
+    )
+}
+
+fn valid_identifier(value: &str) -> bool {
+    !value.is_empty()
+        && value.len() <= 64
+        && value
+            .bytes()
+            .all(|byte| byte.is_ascii_alphanumeric() || matches!(byte, b'_' | b'-' | b'.'))
+}
+
+fn validate_spans(text: &str, spans: &[ReviewedSpan]) -> Option<&'static str> {
+    for span in spans {
+        if span.start >= span.end || span.end > text.len() {
+            return Some("corrupt_offset");
+        }
+        if !text.is_char_boundary(span.start) || !text.is_char_boundary(span.end) {
+            return Some("invalid_utf8_boundary");
+        }
+    }
+    None
+}
+
+fn graphemes(text: &str) -> Vec<GraphemeInfo> {
+    let mut result = Vec::new();
+    for (start, grapheme) in text.grapheme_indices(true) {
+        result.push(GraphemeInfo {
+            start,
+            end: start + grapheme.len(),
+            is_line_break: grapheme.contains(['\n', '\r']),
+        });
+    }
+    result
+}
+
+fn canonical_tokens(text: &str, graphemes: &[GraphemeInfo]) -> Vec<Token> {
+    let mut raw = Vec::new();
+    for (index, grapheme) in graphemes.iter().enumerate() {
+        let value = &text[grapheme.start..grapheme.end];
+        for ch in value.nfkc() {
+            if ch == '\u{00ad}' {
+                continue;
+            }
+            let ch = if ch.is_whitespace() { ' ' } else { ch };
+            if ch == ' ' && raw.last().is_some_and(|token: &Token| token.ch == ' ') {
+                let previous = raw.last_mut().expect("last token exists");
+                previous.grapheme_end = index + 1;
+                previous.had_newline |= grapheme.is_line_break;
+            } else {
+                raw.push(Token {
+                    ch,
+                    grapheme_start: index,
+                    grapheme_end: index + 1,
+                    had_newline: grapheme.is_line_break,
+                });
+            }
+        }
+    }
+
+    let mut result = Vec::with_capacity(raw.len());
+    let mut index = 0;
+    while index < raw.len() {
+        let dehyphenated = index + 2 < raw.len()
+            && raw[index].ch == '-'
+            && raw[index + 1].ch == ' '
+            && raw[index + 1].had_newline
+            && result
+                .last()
+                .is_some_and(|token: &Token| token.ch.is_alphanumeric())
+            && raw[index + 2].ch.is_alphanumeric();
+        if dehyphenated {
+            index += 2;
+        } else {
+            result.push(raw[index].clone());
+            index += 1;
+        }
+    }
+    result
+}
+
+fn validate_geometry(
+    _text: &str,
+    graphemes: &[GraphemeInfo],
+    supplied: &[Glyph],
+) -> Result<BTreeMap<usize, Glyph>, &'static str> {
+    let mut by_range = BTreeMap::new();
+    for glyph in supplied {
+        if glyph.0 >= glyph.1 || glyph.5 <= 0 || glyph.6 <= 0 {
+            return Err("contradictory_geometry");
+        }
+        if by_range.insert((glyph.0, glyph.1), *glyph).is_some() {
+            return Err("contradictory_geometry");
+        }
+    }
+    let mut result = BTreeMap::new();
+    for (index, grapheme) in graphemes.iter().enumerate() {
+        if grapheme.is_line_break {
+            continue;
+        }
+        let Some(glyph) = by_range.remove(&(grapheme.start, grapheme.end)) else {
+            return Err("missing_geometry");
+        };
+        result.insert(index, glyph);
+    }
+    if by_range.is_empty() {
+        Ok(result)
+    } else {
+        Err("contradictory_geometry")
+    }
+}
+
+fn token_interval_for_bytes(
+    tokens: &[Token],
+    graphemes: &[GraphemeInfo],
+    start: usize,
+    end: usize,
+) -> Option<(usize, usize)> {
+    let mut first = None;
+    let mut last = None;
+    for (index, token) in tokens.iter().enumerate() {
+        let token_start = graphemes[token.grapheme_start].start;
+        let token_end = graphemes[token.grapheme_end - 1].end;
+        if token_start < end && token_end > start {
+            first.get_or_insert(index);
+            last = Some(index + 1);
+        }
+    }
+    first.zip(last)
+}
+
+fn find_occurrences(haystack: &[char], needle: &[char]) -> Vec<usize> {
+    if needle.is_empty() || needle.len() > haystack.len() {
+        return Vec::new();
+    }
+    let first = needle[0];
+    haystack
+        .windows(needle.len())
+        .enumerate()
+        .filter(|(_, window)| window[0] == first && *window == needle)
+        .map(|(index, _)| index)
+        .collect()
+}
+
+fn context_score(
+    old: &[char],
+    old_start: usize,
+    old_end: usize,
+    revised: &[char],
+    revised_start: usize,
+    revised_end: usize,
+) -> usize {
+    let mut score = 0;
+    for distance in 1..=32 {
+        if old_start < distance || revised_start < distance {
+            break;
+        }
+        if old[old_start - distance] != revised[revised_start - distance] {
+            break;
+        }
+        score += 1;
+    }
+    for distance in 0..32 {
+        if old_end + distance >= old.len() || revised_end + distance >= revised.len() {
+            break;
+        }
+        if old[old_end + distance] != revised[revised_end + distance] {
+            break;
+        }
+        score += 1;
+    }
+    score
+}
+
+fn token_range_graphemes(tokens: &[Token], start: usize, end: usize) -> BTreeSet<usize> {
+    let mut result = BTreeSet::new();
+    for token in &tokens[start..end] {
+        result.extend(token.grapheme_start..token.grapheme_end);
+    }
+    result
+}
+
+fn myers_diff(old: &[char], revised: &[char]) -> Result<Vec<EditOp>, &'static str> {
+    let max_distance = old
+        .len()
+        .saturating_add(revised.len())
+        .min(MAX_EDIT_DISTANCE);
+    let mut rows: Vec<Vec<i32>> = Vec::with_capacity(max_distance + 1);
+    for distance in 0..=max_distance {
+        let mut row = vec![-1_i32; distance.saturating_mul(2) + 1];
+        for diagonal in (-(distance as isize)..=distance as isize).step_by(2) {
+            let mut x = if distance == 0 {
+                0
+            } else if diagonal == -(distance as isize) {
+                row_get(&rows[distance - 1], distance - 1, diagonal + 1)
+            } else if diagonal == distance as isize {
+                row_get(&rows[distance - 1], distance - 1, diagonal - 1) + 1
+            } else {
+                let deletion = row_get(&rows[distance - 1], distance - 1, diagonal - 1) + 1;
+                let insertion = row_get(&rows[distance - 1], distance - 1, diagonal + 1);
+                if deletion >= insertion {
+                    deletion
+                } else {
+                    insertion
+                }
+            };
+            let mut y = x - i32::try_from(diagonal).expect("edit diagonal fits i32");
+            while x >= 0
+                && y >= 0
+                && (x as usize) < old.len()
+                && (y as usize) < revised.len()
+                && old[x as usize] == revised[y as usize]
+            {
+                x += 1;
+                y += 1;
+            }
+            row_set(&mut row, distance, diagonal, x);
+            if x as usize >= old.len() && y as usize >= revised.len() {
+                rows.push(row);
+                return Ok(backtrack_myers(&rows, old.len(), revised.len()));
+            }
+        }
+        rows.push(row);
+    }
+    Err("edit_distance_limit")
+}
+
+fn row_get(row: &[i32], distance: usize, diagonal: isize) -> i32 {
+    let index = diagonal + distance as isize;
+    if index < 0 || index as usize >= row.len() {
+        -1
+    } else {
+        row[index as usize]
+    }
+}
+
+fn row_set(row: &mut [i32], distance: usize, diagonal: isize, value: i32) {
+    let index = (diagonal + distance as isize) as usize;
+    row[index] = value;
+}
+
+fn backtrack_myers(rows: &[Vec<i32>], old_len: usize, revised_len: usize) -> Vec<EditOp> {
+    let mut x = old_len as isize;
+    let mut y = revised_len as isize;
+    let mut reverse = Vec::with_capacity(old_len.saturating_add(revised_len));
+    for distance in (1..rows.len()).rev() {
+        let diagonal = x - y;
+        let previous = &rows[distance - 1];
+        let previous_diagonal = if diagonal == -(distance as isize)
+            || (diagonal != distance as isize
+                && row_get(previous, distance - 1, diagonal - 1)
+                    < row_get(previous, distance - 1, diagonal + 1))
+        {
+            diagonal + 1
+        } else {
+            diagonal - 1
+        };
+        let previous_x = isize::try_from(row_get(previous, distance - 1, previous_diagonal))
+            .expect("stored edit coordinate fits isize");
+        let previous_y = previous_x - previous_diagonal;
+        while x > previous_x && y > previous_y {
+            reverse.push(EditOp::Equal((x - 1) as usize, (y - 1) as usize));
+            x -= 1;
+            y -= 1;
+        }
+        if x == previous_x {
+            reverse.push(EditOp::Insert((y - 1) as usize));
+            y -= 1;
+        } else {
+            reverse.push(EditOp::Delete((x - 1) as usize));
+            x -= 1;
+        }
+    }
+    while x > 0 && y > 0 {
+        reverse.push(EditOp::Equal((x - 1) as usize, (y - 1) as usize));
+        x -= 1;
+        y -= 1;
+    }
+    while x > 0 {
+        reverse.push(EditOp::Delete((x - 1) as usize));
+        x -= 1;
+    }
+    while y > 0 {
+        reverse.push(EditOp::Insert((y - 1) as usize));
+        y -= 1;
+    }
+    reverse.reverse();
+    reverse
+}
+
+fn map_span_through_edits(
+    script: &[EditOp],
+    span_start: usize,
+    span_end: usize,
+    revised_tokens: &[Token],
+) -> BTreeSet<usize> {
+    let mut revised_indices = BTreeSet::new();
+    let mut index = 0;
+    let mut old_cursor = 0;
+    while index < script.len() {
+        match script[index] {
+            EditOp::Equal(old_index, revised_index) => {
+                if (span_start..span_end).contains(&old_index) {
+                    revised_indices.insert(revised_index);
+                }
+                old_cursor = old_index + 1;
+                index += 1;
+            }
+            EditOp::Delete(_) | EditOp::Insert(_) => {
+                let insertion_point = old_cursor;
+                let mut deleted = Vec::new();
+                let mut inserted = Vec::new();
+                while index < script.len() {
+                    match script[index] {
+                        EditOp::Delete(old_index) => {
+                            deleted.push(old_index);
+                            old_cursor = old_index + 1;
+                        }
+                        EditOp::Insert(revised_index) => inserted.push(revised_index),
+                        EditOp::Equal(_, _) => break,
+                    }
+                    index += 1;
+                }
+                let touches_deleted = deleted
+                    .iter()
+                    .any(|old_index| (span_start..span_end).contains(old_index));
+                let inserted_inside = insertion_point > span_start && insertion_point < span_end;
+                if touches_deleted || inserted_inside {
+                    revised_indices.extend(inserted);
+                }
+            }
+        }
+    }
+    let mut grapheme_indices = BTreeSet::new();
+    for revised_index in revised_indices {
+        if let Some(token) = revised_tokens.get(revised_index) {
+            grapheme_indices.extend(token.grapheme_start..token.grapheme_end);
+        }
+    }
+    grapheme_indices
+}
+
+fn unique_flanks(
+    old: &[char],
+    span_start: usize,
+    span_end: usize,
+    revised: &[char],
+    mapped_graphemes: &BTreeSet<usize>,
+) -> bool {
+    let left = find_unique_left_flank(old, revised, span_start);
+    let right = find_unique_right_flank(old, revised, span_end);
+    let left_ok = span_start == 0 || left.is_some();
+    let right_ok = span_end == old.len() || right.is_some();
+    if !left_ok || !right_ok {
+        return false;
+    }
+    match (left, right) {
+        // A deleted token can cause the deterministic diff to assign one
+        // shared boundary whitespace to either flank.
+        (Some(left_end), Some(right_start)) => left_end <= right_start.saturating_add(1),
+        _ => !mapped_graphemes.is_empty() || old.is_empty() || revised.is_empty(),
+    }
+}
+
+fn find_unique_left_flank(old: &[char], revised: &[char], span_start: usize) -> Option<usize> {
+    for distance in 0..=64 {
+        let end = span_start.checked_sub(distance)?;
+        for width in (4..=8).rev() {
+            let Some(start) = end.checked_sub(width) else {
+                continue;
+            };
+            let needle = &old[start..end];
+            if find_occurrences(old, needle).len() == 1 {
+                let matches = find_occurrences(revised, needle);
+                if matches.len() == 1 {
+                    return Some(matches[0] + width);
+                }
+            }
+        }
+    }
+    None
+}
+
+fn find_unique_right_flank(old: &[char], revised: &[char], span_end: usize) -> Option<usize> {
+    for distance in 0..=64 {
+        let start = span_end.saturating_add(distance);
+        if start >= old.len() {
+            break;
+        }
+        for width in (4..=8).rev() {
+            let end = start.saturating_add(width);
+            if end > old.len() {
+                continue;
+            }
+            let needle = &old[start..end];
+            if find_occurrences(old, needle).len() == 1 {
+                let matches = find_occurrences(revised, needle);
+                if matches.len() == 1 {
+                    return Some(matches[0]);
+                }
+            }
+        }
+    }
+    None
+}
+
+fn lines_for_graphemes(
+    indices: &BTreeSet<usize>,
+    _graphemes: &[GraphemeInfo],
+    glyphs: &BTreeMap<usize, Glyph>,
+) -> BTreeSet<u32> {
+    indices
+        .iter()
+        .filter_map(|index| glyphs.get(index).map(|glyph| glyph.2))
+        .collect()
+}
+
+fn add_glyph_rectangles(
+    rectangles: &mut BTreeSet<Rect>,
+    indices: &BTreeSet<usize>,
+    glyphs: &BTreeMap<usize, Glyph>,
+) {
+    for index in indices {
+        if let Some(glyph) = glyphs.get(index) {
+            rectangles.insert(glyph_rect(*glyph));
+        }
+    }
+}
+
+const fn glyph_rect(glyph: Glyph) -> Rect {
+    Rect {
+        x: glyph.3,
+        y: glyph.4,
+        w: glyph.5,
+        h: glyph.6,
+    }
+}
+
+fn generate_suite(dir: &Path, generated_pages: usize) -> SafeResult<()> {
+    if generated_pages < 200 {
+        return Err(SafeError::new("fixture_count_below_acceptance"));
+    }
+    fs::create_dir_all(dir).map_err(|_| SafeError::new("generator_directory"))?;
+    let malformed_dir = dir.join("malformed");
+    fs::create_dir_all(&malformed_dir).map_err(|_| SafeError::new("generator_directory"))?;
+    let pages_path = dir.join("pages.jsonl");
+    let variant_path = dir.join("pages_shuffled_duplicated.jsonl");
+    let expected_path = dir.join("expected.jsonl");
+    let sentinel_path = dir.join("sentinels.json");
+    let mut pages_writer =
+        BufWriter::new(File::create(&pages_path).map_err(|_| SafeError::new("generator_write"))?);
+    let mut variant_writer =
+        BufWriter::new(File::create(&variant_path).map_err(|_| SafeError::new("generator_write"))?);
+    let mut expected_writer = BufWriter::new(
+        File::create(&expected_path).map_err(|_| SafeError::new("generator_write"))?,
+    );
+    let mut sentinels = Vec::new();
+
+    for index in 0..generated_pages {
+        let (page, expected, sentinel) = generated_case(index);
+        write_json_line(&mut pages_writer, &page)?;
+        let mut variant = page.clone();
+        variant.spans.reverse();
+        if let Some(first) = variant.spans.first().cloned() {
+            variant.spans.push(first);
+        }
+        write_json_line(&mut variant_writer, &variant)?;
+        write_json_line(&mut expected_writer, &expected)?;
+        sentinels.push(sentinel);
+    }
+    for hand in hand_cases() {
+        write_json_line(&mut pages_writer, &hand.page)?;
+        let mut variant = hand.page.clone();
+        variant.spans.reverse();
+        variant.spans.extend(variant.spans.clone());
+        write_json_line(&mut variant_writer, &variant)?;
+        write_json_line(&mut expected_writer, &hand.expected)?;
+        sentinels.extend(hand.sentinels);
+    }
+    pages_writer
+        .flush()
+        .map_err(|_| SafeError::new("generator_write"))?;
+    variant_writer
+        .flush()
+        .map_err(|_| SafeError::new("generator_write"))?;
+    expected_writer
+        .flush()
+        .map_err(|_| SafeError::new("generator_write"))?;
+    let sentinel_file =
+        File::create(sentinel_path).map_err(|_| SafeError::new("generator_write"))?;
+    serde_json::to_writer(BufWriter::new(sentinel_file), &sentinels)
+        .map_err(|_| SafeError::new("generator_write"))?;
+
+    write_malformed_cases(&malformed_dir)?;
+    Ok(())
+}
+
+#[derive(Debug)]
+struct HandCase {
+    page: PageInput,
+    expected: PageOutput,
+    sentinels: Vec<String>,
+}
+
+fn generated_case(index: usize) -> (PageInput, PageOutput, String) {
+    let serial = format!("{index:04}");
+    let (old_text, revised_text, old_needle, revised_needle, occurrence) = match index % 10 {
+        0 => {
+            let secret = format!("SECRET_ALPHA_{serial}");
+            (
+                format!("alpha {secret} omega"),
+                format!("alpha {secret} omega"),
+                secret.clone(),
+                secret,
+                0,
+            )
+        }
+        1 => {
+            let secret = format!("SECRET_SHIFT_{serial}");
+            (
+                format!("alpha removable words {secret} omega"),
+                format!("alpha {secret} omega"),
+                secret.clone(),
+                secret,
+                0,
+            )
+        }
+        2 => {
+            let old_secret = format!("SECRET_CAFE_{serial}_e\u{301}");
+            let revised_secret = format!("SECRET_CAFE_{serial}_é");
+            (
+                format!("alpha {old_secret} omega"),
+                format!("alpha {revised_secret} omega"),
+                old_secret,
+                revised_secret,
+                0,
+            )
+        }
+        3 => {
+            let old_secret = format!("SECRET_SOFT\u{ad}HYPHEN_{serial}");
+            let revised_secret = format!("SECRET_SOFTHYPHEN_{serial}");
+            (
+                format!("alpha {old_secret} omega"),
+                format!("alpha {revised_secret} omega"),
+                old_secret,
+                revised_secret,
+                0,
+            )
+        }
+        4 => {
+            let old_secret = format!("SECRET_INTER-\nNAL_{serial}");
+            let revised_secret = format!("SECRET_INTERNAL_{serial}");
+            (
+                format!("alpha {old_secret} omega"),
+                format!("alpha {revised_secret} omega"),
+                old_secret,
+                revised_secret,
+                0,
+            )
+        }
+        5 => {
+            let old_secret = format!("SECRET   WHITE   {serial}");
+            let revised_secret = format!("SECRET WHITE {serial}");
+            (
+                format!("alpha {old_secret} omega"),
+                format!("alpha {revised_secret} omega"),
+                old_secret,
+                revised_secret,
+                0,
+            )
+        }
+        6 => {
+            let old_secret = format!("SECRET_fiLE_{serial}");
+            let revised_secret = format!("SECRET_fiLE_{serial}");
+            (
+                format!("alpha {old_secret} omega"),
+                format!("alpha {revised_secret} omega"),
+                old_secret,
+                revised_secret,
+                0,
+            )
+        }
+        7 => {
+            let old_secret = format!("SECR3T_OCR_{serial}");
+            let revised_secret = format!("SECRET_OCR_{serial}");
+            (
+                format!("unique-left {old_secret} unique-right"),
+                format!("unique-left {revised_secret} unique-right"),
+                old_secret,
+                revised_secret,
+                0,
+            )
+        }
+        8 => {
+            let secret = format!("秘密_é_{serial}");
+            (
+                format!("alpha {secret} omega"),
+                format!("alpha {secret} omega"),
+                secret.clone(),
+                secret,
+                0,
+            )
+        }
+        _ => {
+            let secret = format!("SECRET_REPEAT_{serial}");
+            (
+                format!("alpha {secret} omega then beta {secret} gamma"),
+                format!("alpha {secret} omega then beta {secret} gamma"),
+                secret.clone(),
+                secret,
+                0,
+            )
+        }
+    };
+    let old_start = old_text
+        .find(&old_needle)
+        .expect("generated old needle exists");
+    let page_id = format!("fixture-{index:04}");
+    let glyphs = geometry(&revised_text);
+    let target_start = nth_find(&revised_text, &revised_needle, occurrence);
+    let rectangles = rectangles_for_ranges(
+        &glyphs,
+        &[(target_start, target_start + revised_needle.len())],
+    );
+    let page = PageInput {
+        page_id: page_id.clone(),
+        old_text,
+        revised_text,
+        glyphs,
+        spans: vec![ReviewedSpan {
+            start: old_start,
+            end: old_start + old_needle.len(),
+            reason: "PUBLIC_RECORDS_RULE".to_string(),
+        }],
+    };
+    let expected = PageOutput {
+        page_id,
+        status: "exact".to_string(),
+        rectangles,
+        error_code: None,
+    };
+    (page, expected, revised_needle)
+}
+
+fn hand_cases() -> Vec<HandCase> {
+    let mut cases = Vec::new();
+
+    let secret = "AMBIGUOUS_SECRET_X".to_string();
+    let old_text = format!("left {secret} right");
+    let revised_text = format!("{secret} gap {secret}");
+    let glyphs = geometry(&revised_text);
+    let first = nth_find(&revised_text, &secret, 0);
+    let second = nth_find(&revised_text, &secret, 1);
+    cases.push(HandCase {
+        page: PageInput {
+            page_id: "hand-ambiguous-token".to_string(),
+            old_text: old_text.clone(),
+            revised_text: revised_text.clone(),
+            glyphs: glyphs.clone(),
+            spans: vec![ReviewedSpan {
+                start: old_text.find(&secret).expect("needle exists"),
+                end: old_text.find(&secret).expect("needle exists") + secret.len(),
+                reason: "PERSON_ID".to_string(),
+            }],
+        },
+        expected: PageOutput {
+            page_id: "hand-ambiguous-token".to_string(),
+            status: "conservative".to_string(),
+            rectangles: rectangles_for_ranges(
+                &glyphs,
+                &[
+                    (first, first + secret.len()),
+                    (second, second + secret.len()),
+                ],
+            ),
+            error_code: None,
+        },
+        sentinels: vec![secret],
+    });
+
+    let secret = "OVERLAPPING_SECRET_Y".to_string();
+    let text = format!("head {secret} tail");
+    let secret_start = text.find(&secret).expect("needle exists");
+    let glyphs = geometry(&text);
+    cases.push(HandCase {
+        page: PageInput {
+            page_id: "hand-overlap-duplicate".to_string(),
+            old_text: text.clone(),
+            revised_text: text.clone(),
+            glyphs: glyphs.clone(),
+            spans: vec![
+                ReviewedSpan {
+                    start: secret_start,
+                    end: secret_start + secret.len(),
+                    reason: "ACCOUNT_NUMBER".to_string(),
+                },
+                ReviewedSpan {
+                    start: secret_start + 4,
+                    end: secret_start + secret.len(),
+                    reason: "ACCOUNT_NUMBER".to_string(),
+                },
+            ],
+        },
+        expected: PageOutput {
+            page_id: "hand-overlap-duplicate".to_string(),
+            status: "exact".to_string(),
+            rectangles: rectangles_for_ranges(
+                &glyphs,
+                &[(secret_start, secret_start + secret.len())],
+            ),
+            error_code: None,
+        },
+        sentinels: vec![secret],
+    });
+
+    let secret = "DELETED_SECRET_Z".to_string();
+    let old_text = format!("unique-left {secret} unique-right");
+    let revised_text = "unique-left unique-right".to_string();
+    cases.push(HandCase {
+        page: PageInput {
+            page_id: "hand-deleted".to_string(),
+            old_text: old_text.clone(),
+            revised_text: revised_text.clone(),
+            glyphs: geometry(&revised_text),
+            spans: vec![ReviewedSpan {
+                start: old_text.find(&secret).expect("needle exists"),
+                end: old_text.find(&secret).expect("needle exists") + secret.len(),
+                reason: "PERSON_ID".to_string(),
+            }],
+        },
+        expected: PageOutput {
+            page_id: "hand-deleted".to_string(),
+            status: "exact".to_string(),
+            rectangles: Vec::new(),
+            error_code: None,
+        },
+        sentinels: vec![secret],
+    });
+
+    let secret = "BOUNDARY_SECRET_Q".to_string();
+    let glyphs = geometry(&secret);
+    cases.push(HandCase {
+        page: PageInput {
+            page_id: "hand-whole-page".to_string(),
+            old_text: secret.clone(),
+            revised_text: secret.clone(),
+            glyphs: glyphs.clone(),
+            spans: vec![ReviewedSpan {
+                start: 0,
+                end: secret.len(),
+                reason: "SEALED_RECORD".to_string(),
+            }],
+        },
+        expected: PageOutput {
+            page_id: "hand-whole-page".to_string(),
+            status: "exact".to_string(),
+            rectangles: rectangles_for_ranges(&glyphs, &[(0, secret.len())]),
+            error_code: None,
+        },
+        sentinels: vec![secret],
+    });
+    cases
+}
+
+fn nth_find(haystack: &str, needle: &str, occurrence: usize) -> usize {
+    haystack
+        .match_indices(needle)
+        .nth(occurrence)
+        .map(|(index, _)| index)
+        .expect("generated revised needle exists")
+}
+
+fn geometry(text: &str) -> Vec<Glyph> {
+    let mut result = Vec::new();
+    let mut line = 0_u32;
+    let mut column = 0_i32;
+    for (start, value) in text.grapheme_indices(true) {
+        if value.contains(['\n', '\r']) {
+            line += 1;
+            column = 0;
+            continue;
+        }
+        result.push(Glyph(
+            start,
+            start + value.len(),
+            line,
+            column * 10,
+            i32::try_from(line).expect("fixture line fits i32") * 20,
+            9,
+            12,
+        ));
+        column += 1;
+    }
+    result
+}
+
+fn rectangles_for_ranges(glyphs: &[Glyph], ranges: &[(usize, usize)]) -> Vec<Rect> {
+    let mut result = BTreeSet::new();
+    for glyph in glyphs {
+        if ranges
+            .iter()
+            .any(|(start, end)| glyph.0 < *end && glyph.1 > *start)
+        {
+            result.insert(glyph_rect(*glyph));
+        }
+    }
+    let mut result: Vec<_> = result.into_iter().collect();
+    result.sort_by_key(|rect| (rect.y, rect.x, rect.w, rect.h));
+    result
+}
+
+fn write_json_line(writer: &mut impl Write, value: &impl Serialize) -> SafeResult<()> {
+    serde_json::to_writer(&mut *writer, value).map_err(|_| SafeError::new("generator_write"))?;
+    writer
+        .write_all(b"\n")
+        .map_err(|_| SafeError::new("generator_write"))
+}
+
+fn write_malformed_cases(dir: &Path) -> SafeResult<()> {
+    let text = "prefix 秘密 suffix".to_string();
+    let start = text.find("秘密").expect("needle exists");
+    let base = PageInput {
+        page_id: "malformed".to_string(),
+        old_text: text.clone(),
+        revised_text: text.clone(),
+        glyphs: geometry(&text),
+        spans: vec![ReviewedSpan {
+            start,
+            end: start + "秘密".len(),
+            reason: "PERSON_ID".to_string(),
+        }],
+    };
+    write_single_page(&dir.join("valid.jsonl"), &base)?;
+
+    let mut corrupt = base.clone();
+    corrupt.page_id = "corrupt-offset".to_string();
+    corrupt.spans[0].end = corrupt.old_text.len() + 1;
+    write_single_page(&dir.join("corrupt_offset.jsonl"), &corrupt)?;
+
+    let mut boundary = base.clone();
+    boundary.page_id = "invalid-boundary".to_string();
+    boundary.spans[0].start = start + 1;
+    write_single_page(&dir.join("invalid_utf8_boundary.jsonl"), &boundary)?;
+
+    let mut missing = base.clone();
+    missing.page_id = "missing-geometry".to_string();
+    missing.glyphs.pop();
+    write_single_page(&dir.join("missing_geometry.jsonl"), &missing)?;
+
+    let mut contradictory = base;
+    contradictory.page_id = "contradictory-geometry".to_string();
+    contradictory.glyphs.push(contradictory.glyphs[0]);
+    write_single_page(&dir.join("contradictory_geometry.jsonl"), &contradictory)?;
+
+    let invalid_path = dir.join("invalid_utf8.jsonl");
+    let mut invalid = File::create(invalid_path).map_err(|_| SafeError::new("generator_write"))?;
+    invalid
+        .write_all(b"{\"page_id\":\"invalid-utf8\",\"old_text\":\"")
+        .map_err(|_| SafeError::new("generator_write"))?;
+    invalid
+        .write_all(&[0xff])
+        .map_err(|_| SafeError::new("generator_write"))?;
+    invalid
+        .write_all(b"\"}\n")
+        .map_err(|_| SafeError::new("generator_write"))?;
+    Ok(())
+}
+
+fn write_single_page(path: &Path, page: &PageInput) -> SafeResult<()> {
+    let file = File::create(path).map_err(|_| SafeError::new("generator_write"))?;
+    let mut writer = BufWriter::new(file);
+    write_json_line(&mut writer, page)?;
+    writer
+        .flush()
+        .map_err(|_| SafeError::new("generator_write"))
+}
+
+fn generate_workload(path: &Path, pages: usize, scalars: usize, spans: usize) -> SafeResult<()> {
+    if scalars < spans.saturating_mul(8) || spans > 100 {
+        return Err(SafeError::new("invalid_workload_shape"));
+    }
+    let file = File::create(path).map_err(|_| SafeError::new("generator_write"))?;
+    let mut writer = BufWriter::new(file);
+    for page_index in 0..pages {
+        let mut bytes = vec![b'a'; scalars];
+        let mut reviewed = Vec::with_capacity(spans);
+        let stride = scalars / spans;
+        for span_index in 0..spans {
+            let token = format!("Q{span_index:02}Z");
+            let start = span_index * stride + 2;
+            bytes[start..start + token.len()].copy_from_slice(token.as_bytes());
+            reviewed.push(ReviewedSpan {
+                start,
+                end: start + token.len(),
+                reason: "PUBLIC_RECORDS_RULE".to_string(),
+            });
+        }
+        let text = String::from_utf8(bytes).expect("ASCII fixture is UTF-8");
+        let glyphs = (0..scalars)
+            .map(|index| {
+                Glyph(
+                    index,
+                    index + 1,
+                    0,
+                    i32::try_from(index % 200).expect("workload column fits i32"),
+                    i32::try_from(index / 200).expect("workload row fits i32"),
+                    1,
+                    1,
+                )
+            })
+            .collect();
+        let page = PageInput {
+            page_id: format!("workload-{page_index:05}"),
+            old_text: text.clone(),
+            revised_text: text,
+            glyphs,
+            spans: reviewed,
+        };
+        write_json_line(&mut writer, &page)?;
+    }
+    writer
+        .flush()
+        .map_err(|_| SafeError::new("generator_write"))
+}
+
+fn check_suite(
+    input_path: &Path,
+    output_path: &Path,
+    audit_path: &Path,
+    expected_path: &Path,
+    sentinel_path: &Path,
+    diagnostics_path: Option<&Path>,
+) -> SafeResult<String> {
+    let expected: Vec<PageOutput> = read_json_lines(expected_path, "checker_expected")?;
+    let actual: Vec<PageOutput> = read_json_lines(output_path, "checker_output")?;
+    let audit: Vec<PageAudit> = read_json_lines(audit_path, "checker_audit")?;
+    let input: Vec<PageInput> = read_json_lines(input_path, "checker_input")?;
+    if actual != expected {
+        return Err(SafeError::new("rectangle_mismatch"));
+    }
+    if actual.len() != audit.len() || actual.len() != input.len() || actual.len() < 200 {
+        return Err(SafeError::new("coverage_count"));
+    }
+    for (page, audit_page) in actual.iter().zip(&audit) {
+        if page.page_id != audit_page.page_id
+            || page.status != audit_page.status
+            || page.rectangles.len() != audit_page.rectangle_count
+        {
+            return Err(SafeError::new("audit_mismatch"));
+        }
+    }
+    let sentinels: Vec<String> = read_json_file(sentinel_path, "checker_sentinels")?;
+    if sentinels.len() != input.len() {
+        return Err(SafeError::new("sentinel_coverage_count"));
+    }
+    let mut public_bytes = Vec::new();
+    File::open(output_path)
+        .and_then(|mut file| file.read_to_end(&mut public_bytes))
+        .map_err(|_| SafeError::new("checker_output"))?;
+    File::open(audit_path)
+        .and_then(|mut file| file.read_to_end(&mut public_bytes))
+        .map_err(|_| SafeError::new("checker_audit"))?;
+    if let Some(path) = diagnostics_path {
+        File::open(path)
+            .and_then(|mut file| file.read_to_end(&mut public_bytes))
+            .map_err(|_| SafeError::new("checker_diagnostics"))?;
+    }
+    for sentinel in &sentinels {
+        if contains_bytes(&public_bytes, sentinel.as_bytes()) {
+            return Err(SafeError::new("sentinel_leak"));
+        }
+    }
+
+    let conservative = actual
+        .iter()
+        .filter(|page| page.status == "conservative")
+        .count();
+    let exact = actual.iter().filter(|page| page.status == "exact").count();
+    Ok(format!(
+        "checked pages={} exact={} conservative={} sentinel_leaks=0 rectangle_mismatches=0",
+        actual.len(),
+        exact,
+        conservative
+    ))
+}
+
+fn read_json_lines<T: for<'de> Deserialize<'de>>(
+    path: &Path,
+    code: &'static str,
+) -> SafeResult<Vec<T>> {
+    let file = File::open(path).map_err(|_| SafeError::new(code))?;
+    let mut result = Vec::new();
+    for line in BufReader::new(file).split(b'\n') {
+        let line = line.map_err(|_| SafeError::new(code))?;
+        if line.is_empty() {
+            continue;
+        }
+        let value = serde_json::from_slice(&line).map_err(|_| SafeError::new(code))?;
+        result.push(value);
+    }
+    Ok(result)
+}
+
+fn contains_bytes(haystack: &[u8], needle: &[u8]) -> bool {
+    !needle.is_empty()
+        && haystack
+            .windows(needle.len())
+            .any(|window| window == needle)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::time::{SystemTime, UNIX_EPOCH};
+
+    #[test]
+    fn myers_script_reconstructs_revised_sequence() {
+        let cases = [
+            ("", ""),
+            ("abc", "abc"),
+            ("abc", "axc"),
+            ("kitten", "sitting"),
+            ("repeat repeat", "repeat gap repeat"),
+            ("秘密", "秘X密"),
+        ];
+        for (old, revised) in cases {
+            let old: Vec<char> = old.chars().collect();
+            let revised: Vec<char> = revised.chars().collect();
+            let script = myers_diff(&old, &revised).expect("small edit should align");
+            let reconstructed: String = script
+                .iter()
+                .filter_map(|operation| match operation {
+                    EditOp::Equal(_, revised_index) | EditOp::Insert(revised_index) => {
+                        Some(revised[*revised_index])
+                    }
+                    EditOp::Delete(_) => None,
+                })
+                .collect();
+            assert_eq!(reconstructed, revised.iter().collect::<String>());
+        }
+    }
+
+    #[test]
+    fn normalization_handles_required_cleanup_shapes() {
+        let pairs = [
+            ("e\u{301}", "é"),
+            ("file", "file"),
+            ("soft\u{ad}hyphen", "softhyphen"),
+            ("inter-\nnal", "internal"),
+            ("a   b", "a b"),
+        ];
+        for (old, revised) in pairs {
+            let old_tokens = canonical_tokens(old, &graphemes(old));
+            let revised_tokens = canonical_tokens(revised, &graphemes(revised));
+            assert_eq!(
+                old_tokens.iter().map(|token| token.ch).collect::<String>(),
+                revised_tokens
+                    .iter()
+                    .map(|token| token.ch)
+                    .collect::<String>()
+            );
+        }
+    }
+
+    #[test]
+    fn duplicate_and_ordered_spans_have_identical_records() {
+        let (page, _, _) = generated_case(7);
+        let (output, audit) = process_page(page.clone(), 1);
+        let mut variant = page;
+        variant.spans.extend(variant.spans.clone());
+        variant.spans.reverse();
+        let (variant_output, variant_audit) = process_page(variant, 1);
+        assert_eq!(output, variant_output);
+        assert_eq!(audit, variant_audit);
+    }
+
+    #[test]
+    fn malformed_geometry_blocks_publication() {
+        let (mut page, _, _) = generated_case(0);
+        page.glyphs.pop();
+        let (output, audit) = process_page(page, 1);
+        assert_eq!(output.status, "blocked");
+        assert_eq!(output.error_code.as_deref(), Some("missing_geometry"));
+        assert!(output.rectangles.is_empty());
+        assert_eq!(audit.status, "blocked");
+    }
+
+    #[test]
+    fn changed_first_repeated_occurrence_is_never_mapped_only_to_the_second() {
+        let secret = "AMBIGUOUS_SECRET_X";
+        let old = format!("{secret} gap {secret}");
+        let revised = format!("AMBIGUOUS_SECR3T_X gap {secret}");
+        let page = page_with_span("repeat-shift", &old, &revised, 0, secret.len());
+        let (output, audit) = process_page(page, 1);
+
+        assert_ne!(output.status, "blocked");
+        assert_eq!(audit.status, "conservative");
+        assert!(
+            output
+                .rectangles
+                .iter()
+                .any(|rectangle| rectangle.x < i32::try_from(secret.len() * 10).unwrap()),
+            "changed first occurrence must be covered: {:?}",
+            output.rectangles
+        );
+    }
+
+    #[test]
+    fn completed_resume_binds_input_output_and_audit() {
+        let dir = temp_test_dir("completed");
+        let input = dir.join("pages.jsonl");
+        let output = dir.join("output.jsonl");
+        let audit = dir.join("audit.jsonl");
+        let page = generated_case(0).0;
+        write_test_pages(&input, std::slice::from_ref(&page));
+        run_remap(&remap_args(&input, &output, &audit, false, None)).expect("complete run");
+
+        write_test_pages(&input, &[page.clone(), page.clone()]);
+        let changed_input = run_remap(&remap_args(&input, &output, &audit, true, None))
+            .expect_err("changed completed input must fail");
+        assert_eq!(changed_input.code, "completed_state_mismatch");
+
+        write_test_pages(&input, std::slice::from_ref(&page));
+        fs::write(&output, b"").expect("truncate completed output");
+        let truncated_output = run_remap(&remap_args(&input, &output, &audit, true, None))
+            .expect_err("truncated completed output must fail");
+        assert_eq!(truncated_output.code, "completed_state_mismatch");
+
+        run_remap(&remap_args(&input, &output, &audit, false, None))
+            .expect("restore completed run");
+        let other_audit = dir.join("other-audit.jsonl");
+        fs::copy(&audit, &other_audit).expect("copy audit");
+        let changed_audit = run_remap(&remap_args(&input, &output, &other_audit, true, None))
+            .expect_err("changed audit path must fail");
+        assert_eq!(changed_audit.code, "completed_state_mismatch");
+    }
+
+    #[test]
+    fn stale_or_short_partial_state_never_completes_corrupted_output() {
+        let dir = temp_test_dir("stale");
+        let input = dir.join("pages.jsonl");
+        let invalid = dir.join("invalid.jsonl");
+        let output = dir.join("output.jsonl");
+        let audit = dir.join("audit.jsonl");
+        let pages = [generated_case(0).0, generated_case(1).0];
+        write_test_pages(&input, &pages);
+        fs::write(&invalid, b"{\"page_id\":\"").expect("write invalid UTF-8 prefix");
+        let mut invalid_bytes = fs::read(&invalid).expect("read invalid prefix");
+        invalid_bytes.push(0xff);
+        fs::write(&invalid, invalid_bytes).expect("write invalid UTF-8");
+
+        let interrupted = run_remap(&remap_args(&input, &output, &audit, false, Some(1)))
+            .expect("controlled interruption");
+        assert!(matches!(interrupted, CommandResult::Interrupted(_)));
+        let invalid_run = run_remap(&remap_args(&invalid, &output, &audit, false, None))
+            .expect_err("invalid fresh run must fail");
+        assert_eq!(invalid_run.code, "invalid_utf8");
+        assert!(!suffixed(&output, ".checkpoint").exists());
+
+        let restarted = run_remap(&remap_args(&input, &output, &audit, true, None))
+            .expect("resume without a checkpoint safely restarts");
+        assert!(matches!(restarted, CommandResult::Complete(_)));
+        let bytes = fs::read(&output).expect("read restarted output");
+        assert!(!bytes.starts_with(&[0]));
+        assert_eq!(bytes.iter().filter(|byte| **byte == b'\n').count(), 2);
+        assert!(suffixed(&output, ".complete").exists());
+
+        run_remap(&remap_args(&input, &output, &audit, false, Some(1)))
+            .expect("second controlled interruption");
+        fs::write(suffixed(&output, ".partial"), b"").expect("truncate partial output");
+        let short = run_remap(&remap_args(&input, &output, &audit, true, None))
+            .expect_err("short partial must fail");
+        assert_eq!(short.code, "partial_short");
+        assert!(!suffixed(&output, ".complete").exists());
+    }
+
+    fn page_with_span(
+        page_id: &str,
+        old_text: &str,
+        revised_text: &str,
+        start: usize,
+        end: usize,
+    ) -> PageInput {
+        let glyphs = graphemes(revised_text)
+            .into_iter()
+            .enumerate()
+            .map(|(index, grapheme)| {
+                Glyph(
+                    grapheme.start,
+                    grapheme.end,
+                    0,
+                    i32::try_from(index * 10).unwrap(),
+                    0,
+                    10,
+                    10,
+                )
+            })
+            .collect();
+        PageInput {
+            page_id: page_id.to_string(),
+            old_text: old_text.to_string(),
+            revised_text: revised_text.to_string(),
+            glyphs,
+            spans: vec![ReviewedSpan {
+                start,
+                end,
+                reason: "PERSON_ID".to_string(),
+            }],
+        }
+    }
+
+    fn temp_test_dir(label: &str) -> PathBuf {
+        let nonce = SystemTime::now()
+            .duration_since(UNIX_EPOCH)
+            .expect("clock after epoch")
+            .as_nanos();
+        let dir = std::env::temp_dir().join(format!(
+            "ocr-redaction-{label}-{}-{nonce}",
+            std::process::id()
+        ));
+        fs::create_dir_all(&dir).expect("create test directory");
+        dir
+    }
+
+    fn write_test_pages(path: &Path, pages: &[PageInput]) {
+        let mut bytes = Vec::new();
+        for page in pages {
+            serde_json::to_writer(&mut bytes, page).expect("serialize test page");
+            bytes.push(b'\n');
+        }
+        fs::write(path, bytes).expect("write test pages");
+    }
+
+    fn remap_args(
+        input: &Path,
+        output: &Path,
+        audit: &Path,
+        resume: bool,
+        stop_after: Option<usize>,
+    ) -> RemapArgs {
+        RemapArgs {
+            input: input.to_path_buf(),
+            output: output.to_path_buf(),
+            audit: audit.to_path_buf(),
+            resume,
+            stop_after,
+        }
+    }
+}
diff --git a/developer-simulation/runs/2026-08-04--ocr-redaction-remap/src/main.rs b/developer-simulation/runs/2026-08-04--ocr-redaction-remap/src/main.rs
new file mode 100644
index 0000000..a1fd71c
--- /dev/null
+++ b/developer-simulation/runs/2026-08-04--ocr-redaction-remap/src/main.rs
@@ -0,0 +1,5 @@
+use std::process::ExitCode;
+
+fn main() -> ExitCode {
+    ocr_redaction_remap::entry(std::env::args().skip(1).collect())
+}
diff --git a/developer-simulation/runs/2026-08-05--fastq-barcode-spill/.gitignore b/developer-simulation/runs/2026-08-05--fastq-barcode-spill/.gitignore
new file mode 100644
index 0000000..b83d222
--- /dev/null
+++ b/developer-simulation/runs/2026-08-05--fastq-barcode-spill/.gitignore
@@ -0,0 +1 @@
+/target/
diff --git a/developer-simulation/runs/2026-08-05--fastq-barcode-spill/Cargo.toml b/developer-simulation/runs/2026-08-05--fastq-barcode-spill/Cargo.toml
new file mode 100644
index 0000000..3b9ecbd
--- /dev/null
+++ b/developer-simulation/runs/2026-08-05--fastq-barcode-spill/Cargo.toml
@@ -0,0 +1,7 @@
+[package]
+name = "fastq-barcode-spill"
+version = "0.1.0"
+edition = "2024"
+publish = false
+
+[dependencies]
diff --git a/developer-simulation/runs/2026-08-05--fastq-barcode-spill/README.md b/developer-simulation/runs/2026-08-05--fastq-barcode-spill/README.md
new file mode 100644
index 0000000..39c92e8
--- /dev/null
+++ b/developer-simulation/runs/2026-08-05--fastq-barcode-spill/README.md
@@ -0,0 +1,92 @@
+# FASTQ barcode spill trial
+
+This is a dependency-free Rust prototype for demultiplexing interleaved paired-end FASTQ from
+standard input. It exact-matches the first 10 read-1 bases, corrects only a unique barcode at
+Hamming distance one, sends ties to `ambiguous.fastq`, and sends other misses to
+`unmatched.fastq`. Per-sample order is preserved.
+
+It creates all sample files but keeps at most 24 FASTQ output writers open. Small per-destination
+buffers avoid reopening a file for every pair when hundreds of samples are interleaved. A
+deterministic `manifest.json` is atomically published only after all input and output validation
+succeeds.
+
+## Run the focused verification
+
+From the BogKit repository root:
+
+```console
+export CARGO_TARGET_DIR=/private/tmp/fastq-barcode-spill-target
+developer-simulation/runs/2026-08-05--fastq-barcode-spill/scripts/verify.sh
+```
+
+## Run the demo directly
+
+```console
+export CARGO_TARGET_DIR=/private/tmp/fastq-barcode-spill-target
+cargo build --release --offline --locked --manifest-path developer-simulation/Cargo.toml \
+  -p fastq-barcode-spill
+demo_dir="$(mktemp -d /private/tmp/fastq-barcode-spill-demo-XXXXXX)"
+CARGO_TARGET_DIR=/private/tmp/fastq-barcode-spill-target
+/private/tmp/fastq-barcode-spill-target/release/fastq-barcode-spill \
+  --barcodes fixtures/barcodes.tsv \
+  --out "$demo_dir/output" \
+  < fixtures/mixed.fastq
+python3 -m json.tool "$demo_dir/output/manifest.json"
+```
+
+The TSV has exactly `10-base-barcode<TAB>safe-sample-name` per non-comment line. The output
+directory must be new or empty. Existing data is never overwritten. Sample output names must be
+unique under ASCII case folding and may not alias the reserved `ambiguous` or `unmatched` names;
+this is checked before the output directory is created.
+
+The supported paired identifiers are a non-empty printable first token with matching cores and
+either `/1` plus `/2`, matching Illumina/CASAVA whitespace roles, or no explicit role. Conflicting
+dual conventions and control bytes are rejected without echoing identifier content.
+
+## Reproduce the clean Python-baseline comparison
+
+```console
+comparison_dir="$(mktemp -d /private/tmp/fastq-comparison-XXXXXX)"
+trial=developer-simulation/runs/2026-08-05--fastq-barcode-spill
+python3 "$trial/baseline.py" --barcodes "$trial/fixtures/barcodes.tsv" \
+  --out "$comparison_dir/baseline" < "$trial/fixtures/clean.fastq"
+/private/tmp/fastq-barcode-spill-target/release/fastq-barcode-spill \
+  --barcodes "$trial/fixtures/barcodes.tsv" --out "$comparison_dir/rust" \
+  < "$trial/fixtures/clean.fastq"
+for f in alpha.fastq beta.fastq gamma.fastq delta.fastq unmatched.fastq; do
+  cmp "$comparison_dir/baseline/$f" "$comparison_dir/rust/$f"
+done
+```
+
+The baseline intentionally exact-matches only and opens all sample destinations. The comparison
+therefore covers clean per-sample and unmatched FASTQ bytes, not the Rust-only ambiguity output
+or completion manifest.
+
+## Generate a numeric workload
+
+This preserves non-seekable stdin by piping the generated data directly:
+
+```console
+trial=developer-simulation/runs/2026-08-05--fastq-barcode-spill
+python3 "$trial/fixtures/generate.py" --samples 384 --pairs 0 --well-spaced \
+  --barcodes /private/tmp/fastq-384.tsv
+workload_dir="$(mktemp -d /private/tmp/fastq-million-XXXXXX)"
+python3 "$trial/fixtures/generate.py" --samples 384 --pairs 1000000 --well-spaced --mixed --emit-only \
+  --barcodes /private/tmp/fastq-384.tsv |
+  /usr/bin/time -l /private/tmp/fastq-barcode-spill-target/release/fastq-barcode-spill \
+    --barcodes /private/tmp/fastq-384.tsv --out "$workload_dir/output"
+```
+
+Use a new/empty output directory for every run. `TRIAL_REPORT.md` records the measurements made
+on the test host and does not generalize them to other hosts or record sizes.
+
+To independently observe the output descriptors with `lsof` during a throttled 200,000-pair
+pipe (after the release build):
+
+```console
+FASTQ_BINARY=/private/tmp/fastq-barcode-spill-target/release/fastq-barcode-spill \
+  python3 "$trial/scripts/measure_open_files.py"
+```
+
+The observer exits nonzero if `lsof` produces no successful positive sample; its result is
+supporting evidence for the implementation's structural 24-writer bound.
diff --git a/developer-simulation/runs/2026-08-05--fastq-barcode-spill/TRIAL_REPORT.md b/developer-simulation/runs/2026-08-05--fastq-barcode-spill/TRIAL_REPORT.md
new file mode 100644
index 0000000..70363ff
--- /dev/null
+++ b/developer-simulation/runs/2026-08-05--fastq-barcode-spill/TRIAL_REPORT.md
@@ -0,0 +1,362 @@
+# Trial report: fastq-barcode-spill
+
+Run date: 2026-08-05 (America/New_York)
+
+Sanitized checkout: `/private/tmp/bogkit-2026-08-05-fastq-CjPkDm`
+
+Starting commit: `80fd3c9a023e877fff2e5d127accca386d437af0`
+
+Trial directory: `trial-fastq-barcode-spill`
+
+## Outcome
+
+The reviewed prototype is a standalone, dependency-free Rust CLI. No BogKit component
+fits this workload. Fold maintains durable views for later reads; ANNy and ESE are approximate
+search and embedding tools. This problem is instead a bounded, one-pass byte router with no
+database read path. Using any of those components would add persistence and state without
+solving parsing, Hamming classification, or file-descriptor pressure.
+
+The prototype meets the requested acceptance checks on this test host for the supplied and
+generated record shape. The final corrected run streamed 1,000,000 pairs through a pipe
+across 384 sample destinations with an even four-way mix of exact matches, unique one-base
+corrections, ambiguous ties, and unmatched reads. It completed in 1.93 seconds, used 63,750,144
+bytes maximum resident memory (60.8 MiB), and kept at most 24 FASTQ output files open. Two full
+runs produced the same output-tree checksum.
+
+The timing and memory result is host- and fixture-specific. The parser currently has no maximum
+FASTQ line length, so the 128 MiB claim is not extended to adversarially huge individual records.
+
+## What was built
+
+- `src/main.rs`: validated eight-line paired FASTQ reader for the documented identifier subset,
+  absolute line-number errors, paired-ID validation, sequence/quality length validation,
+  fixed-length hash-map lookup for exact and unique-Hamming-1
+  lookup, bounded LRU append writers, per-destination buffers, counters, and final manifest.
+- `baseline.py`: a minimal model of the stated existing Python behavior: exact matching and one
+  simultaneously open handle per sample.
+- `fixtures/`: small clean, mixed, truncated, unequal-length, and mismatched-ID fixtures, plus a
+  deterministic workload generator.
+- `tests/integration.py`: baseline comparison, seeded mutation, tie, unmatched, malformed,
+  privacy, writer-bound, count, and repeat-checksum checks.
+- `scripts/measure_open_files.py`: an independent `lsof` observer for the open-output bound.
+- `scripts/verify.sh`: the focused local verification and demo.
+
+All implementation and evidence instructions are confined to this trial directory. No BogKit
+core file or public example was changed. No dependency download, GitHub use, commit, or push was
+performed.
+
+## Acceptance result
+
+| Requirement | Result | Evidence |
+| --- | --- | --- |
+| Clean output byte-identical to baseline | Pass | All four sample files and `unmatched.fastq` compared equal byte-for-byte; hashes recorded below. |
+| Seeded one-substitution correct | Pass | Seed `20260805` produced a one-base mutation routed to the expected sample; integration test also verifies output bytes. |
+| Hamming-distance-one ties ambiguous | Pass | `GAAAAAAAAA` is one base from each of two whitelist entries and is written to `ambiguous.fastq`. |
+| Counts cover complete pairs | Pass | Mixed million-pair manifest classifications sum to 1,000,000; sample counts sum to the 500,000 exact plus corrected pairs. |
+| Truncation error, no manifest | Pass | Exit 1, `line 8`, and no `manifest.json`. |
+| Unequal sequence/quality error, no manifest | Pass | Exit 1, `line 4`, and no `manifest.json`. |
+| Mismatched pair IDs error, no manifest | Pass | Exit 1, `line 5`, and no `manifest.json`. |
+| At most 24 sample files open | Pass | Internal maximum 24; corrected `lsof` sampling observed 24 across 45 successful polls. |
+| 1M pairs, 384 samples, under 30s | Pass on this host | Final corrected run: 1.93 seconds real time, streamed through a pipe. |
+| Under 128 MiB | Pass on this host and fixture | Final corrected run: 63,750,144-byte maximum resident set (60.8 MiB). |
+| Repeated output and manifest checksums identical | Pass | Both corrected 387-file output trees hashed to `88e0f8be6e3f5622b19d4cf530c1af20a2f69ce8ece18c3bf347a466e22cd644`. |
+| No read/sample data in logs | Pass for exercised errors | Integration asserts that IDs, sequence, quality, and a sample name do not occur in malformed-run stderr. Normal stdout contains counts only. |
+| Completion manifest only after validation | Pass | Malformed runs leave partial FASTQ outputs but no completion manifest; valid runs atomically rename the completed manifest after writer flush and count checks. |
+| Output filename uniqueness | Pass after review fix | ASCII-case-folded sample aliases and `Ambiguous`/`Unmatched` reserved aliases fail before output creation. |
+| Supported identifier validation | Pass after review fix | Empty/control-byte identifiers and contradictory slash/CASAVA roles fail; ordinary CASAVA and CRLF inputs pass. |
+
+## Ordered discovery and friction trail
+
+1. Read the public root `README.md`. Its normal path is `./scripts/new-project.sh`, which creates
+   an example crate and adds Fold, ANNy, ESE, and Serde dependencies.
+2. Read public examples in the README's order: `starter`, `timeseries`, `chat`, then `search`.
+   `starter` shows durable count/bag views; `timeseries` keyed aggregates; `chat` a durable source
+   of truth with snapshot broadcasting; `search` BM25/HNSW indexes. None has a role in a
+   single-pass FASTQ byte router.
+3. Read `scripts/new-project.sh`. It always creates under `examples/` with all three local BogKit
+   dependencies. The brief requires a unique top-level directory and says not to change public
+   examples, so the trial was created manually and opted out of the parent Cargo workspace.
+4. Searched this sanitized checkout for `fastq`, `barcode`, `demultip`, `fixture generator`, and
+   `python cli`; there was no existing FASTQ baseline artifact. Built the smallest reference
+   baseline described by the brief before selecting a BogKit component.
+5. Reproduced the trial-created baseline model's file-descriptor failure at 384 samples with a
+   64-file process limit. This illustrates the brief's stated design but does not verify the
+   unavailable production baseline and is not a BogKit defect.
+6. The first clean fixture accidentally ended with an extra blank line. The baseline treated it
+   as the start of a truncated pair. Removed the blank line and added exact line-count fixtures.
+   This was a trial-fixture defect caught before making comparison claims.
+7. The first parser version reported record-relative lines for malformed pairs after the first.
+   Absolute-line tests exposed the risk; the parser now carries the pair's starting line into all
+   validations. This was a prototype defect fixed before final measurement.
+8. A naive correction path scanned all whitelist entries for every non-exact barcode. It was
+   functionally correct but an unnecessary scaling risk. Replaced it with a precomputed map of
+   every A/C/G/T/N one-base neighbor, where collisions are marked ambiguous.
+9. Raw bounded LRU writers would reopen a file on nearly every pair under round-robin sample
+   input. Added 64 KiB per-destination buffers before the 24-entry LRU; the final million-pair
+   mixed run needed 1,952 file-open events rather than one per pair while preserving order.
+10. The first piped benchmark tried to create and consume the barcode map concurrently, so the
+    consumer exited before input. Added the generator's `--emit-only` mode and made map creation
+    an explicit prior command. This was benchmark-fixture friction, not a prototype result.
+11. Sandboxed `/usr/bin/time -l` could report elapsed time but could not read the macOS kernel RSS
+    counter (`sysctl kern.clockrate: Operation not permitted`). Re-ran the same bounded command
+    with permission to read resource counters. This was test-environment friction.
+12. Ran the mixed million-pair measurement twice, reconciled manifest counts, and hashed every
+    output filename and byte. The tree checksums matched.
+13. Skeptical review reproduced all headline results but found that `Alpha`/`alpha` and
+    `Ambiguous`/`ambiguous.fastq` could alias on the host filesystem, allowing a complete manifest
+    to describe mixed output classes. The loader now rejects ASCII-case-folded filename
+    collisions before creating the output directory, with exact integration regressions.
+14. Review also showed accepted empty/control-byte identifiers and contradictory slash/CASAVA
+    roles, plus an `lsof` observer that false-passed when every observation failed. The parser now
+    rejects those identifiers without echoing them, and the observer requires a successful,
+    positive sample. A forced-failure observer regression and the real 45-poll check both pass.
+15. The corrected suite, real descriptor measurement, and two million-pair runs were rerun. The
+    final resource observation and repeat checksum are the values reported here.
+
+## Commands and observed results
+
+Commands below were run from `trial-fastq-barcode-spill` unless stated otherwise.
+
+### Focused Rust checks
+
+```console
+$ cargo test
+running 5 tests
+test tests::exact_unique_one_error_and_tie_are_distinct ... ok
+test tests::malformed_inputs_report_expected_line ... ok
+test tests::pair_reader_preserves_original_bytes ... ok
+test result: ok. 5 passed; 0 failed
+
+$ cargo fmt --check
+# exit 0, no output
+
+$ cargo clippy --all-targets -- -D warnings
+Finished `dev` profile ...
+
+$ cargo build --release
+Finished `release` profile ...
+
+$ python3 tests/integration.py target/release/fastq-barcode-spill
+integration checks passed
+```
+
+The integration command exercises the Python comparison, seeded correction, barcode-level
+ambiguity (including same-sample barcode ties), unmatched routing, malformed content and
+identifier cases, case-folded filename collisions, no-manifest behavior, privacy assertions, a
+30-sample writer cap of 3, and repeat checksums.
+
+### Demo
+
+```console
+$ target/release/fastq-barcode-spill --barcodes fixtures/barcodes.tsv \
+    --out /private/tmp/fastq-spill-evidence-cUbEIn/demo-final \
+    < fixtures/mixed.fastq
+processed 4 read pairs: exact 1, corrected 1, ambiguous 1, unmatched 1; max open output writers 3
+```
+
+The manifest reported `total_pairs: 4`, one pair in each classification, two pairs for the
+`gamma` destination, `max_open_writers: 3`, and `complete: true`.
+
+### Baseline behavior and clean comparison
+
+The descriptor-limit reproduction was:
+
+```console
+$ python3 fixtures/generate.py --samples 384 --pairs 0 \
+    --barcodes /private/tmp/fastq-spill-evidence-cUbEIn/barcodes-384.tsv
+$ ulimit -n 64
+$ python3 baseline.py \
+    --barcodes /private/tmp/fastq-spill-evidence-cUbEIn/barcodes-384.tsv \
+    --out /private/tmp/fastq-spill-evidence-cUbEIn/baseline-384
+error: could not open all output files
+# exit 1
+```
+
+Clean comparison commands:
+
+```console
+$ python3 baseline.py --barcodes fixtures/barcodes.tsv \
+    --out /private/tmp/fastq-spill-evidence-cUbEIn/baseline-clean-final \
+    < fixtures/clean.fastq
+$ target/release/fastq-barcode-spill --barcodes fixtures/barcodes.tsv \
+    --out /private/tmp/fastq-spill-evidence-cUbEIn/rust-clean-final \
+    < fixtures/clean.fastq
+processed 2 read pairs: exact 2, corrected 0, ambiguous 0, unmatched 0; max open output writers 2
+```
+
+| Compared file | Equal | SHA-256 |
+| --- | --- | --- |
+| `alpha.fastq` | yes | `c3c28d466dfecbddcf0e6abca023b5608bd21968ef055529e35a95eb88d3f98a` |
+| `beta.fastq` | yes | `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` |
+| `gamma.fastq` | yes | `f53385669a88200f5cff6b896154e366f64b8e0c714d2b35d59b2ab547363493` |
+| `delta.fastq` | yes | `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` |
+| `unmatched.fastq` | yes | `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` |
+
+The baseline has no ambiguity output or completion manifest, so those Rust-only artifacts are
+not part of the clean byte comparison.
+
+### Malformed input
+
+```console
+$ target/release/fastq-barcode-spill --barcodes fixtures/barcodes.tsv \
+    --out /private/tmp/fastq-spill-evidence-cUbEIn/bad-truncated \
+    < fixtures/truncated.fastq
+error: line 8: truncated interleaved FASTQ pair
+# exit 1
+
+$ target/release/fastq-barcode-spill --barcodes fixtures/barcodes.tsv \
+    --out /private/tmp/fastq-spill-evidence-cUbEIn/bad-unequal \
+    < fixtures/unequal.fastq
+error: line 4: sequence and quality lengths differ
+# exit 1
+
+$ target/release/fastq-barcode-spill --barcodes fixtures/barcodes.tsv \
+    --out /private/tmp/fastq-spill-evidence-cUbEIn/bad-mismatched \
+    < fixtures/mismatched.fastq
+error: line 5: paired read identifiers do not match
+# exit 1
+
+$ find /private/tmp/fastq-spill-evidence-cUbEIn/bad-truncated \
+    /private/tmp/fastq-spill-evidence-cUbEIn/bad-unequal \
+    /private/tmp/fastq-spill-evidence-cUbEIn/bad-mismatched \
+    -name manifest.json -print
+# no output
+```
+
+### Independent output-handle observation
+
+```console
+$ python3 scripts/measure_open_files.py
+observed_max_open_fastq_files=24 manifest_max_open_writers=24 polls=45 successful_polls=45
+```
+
+This used a throttled 200,000-pair non-seekable pipe and counted only `.fastq` descriptors under
+that run's output directory. The code also structurally refuses a `--max-open` value above 24.
+
+### Full numeric workload
+
+The generated whitelist has 384 entries. Two entries are Hamming distance two to provide a known
+tie midpoint; every other entry is at least distance three from all others. The mixed input cycles
+exact, unique one-substitution, tie, and unmatched cases.
+
+```console
+$ python3 fixtures/generate.py --samples 384 --pairs 0 --well-spaced \
+    --barcodes /private/tmp/fastq-spill-evidence-cUbEIn/mixed-barcodes.tsv
+
+$ python3 fixtures/generate.py --samples 384 --pairs 1000000 --well-spaced \
+    --mixed --emit-only \
+    --barcodes /private/tmp/fastq-spill-evidence-cUbEIn/mixed-barcodes.tsv |
+  /usr/bin/time -l target/release/fastq-barcode-spill \
+    --barcodes /private/tmp/fastq-spill-evidence-cUbEIn/mixed-barcodes.tsv \
+    --out /private/tmp/fastq-spill-evidence-cUbEIn/million-mixed-a
+processed 1000000 read pairs: exact 250000, corrected 250000, ambiguous 250000, unmatched 250000; max open output writers 24
+        1.93 real         0.44 user         0.10 sys
+            63750144  maximum resident set size
+```
+
+`/usr/bin/time` wrapped only the Rust consumer. Its real time includes any wait for the separate
+Python producer, so the 1.93-second result is conservative for this generated pipe. The output
+tree occupied 198,692 KiB on disk.
+
+The same generator and CLI command was repeated to `million-mixed-b`. A streaming SHA-256 over
+each sorted filename and file contents produced:
+
+```text
+million-mixed-a: 387 files, 88e0f8be6e3f5622b19d4cf530c1af20a2f69ce8ece18c3bf347a466e22cd644
+million-mixed-b: 387 files, 88e0f8be6e3f5622b19d4cf530c1af20a2f69ce8ece18c3bf347a466e22cd644
+```
+
+Each manifest reported 1,000,000 classified pairs, 500,000 sample-routed pairs, 1,952 output-file
+open events, and a maximum of 24 open writers.
+
+## Findings by source
+
+| Source | Finding | Severity | Confidence | Reproduction | Smallest improvement |
+| --- | --- | --- | --- | --- | --- |
+| Modeled Python baseline | The trial-created all-open model fails under a lower descriptor limit at 384 samples. This illustrates the stated design; it does not verify the unavailable production artifact. | High | High for the model | Set `ulimit -n 64` and launch the local model with the 384-sample map. | Use a bounded writer pool; buffering destinations avoids reopen-per-record cost. |
+| Modeled Python baseline | The trial-created exact-only model sends a one-substitution sequencing error to unmatched. | High | High for the model | The seeded integration pair differs by one base from exactly one whitelist barcode. | Precompute exact and unique one-error lookup tables. |
+| BogKit fit | Fold, ANNy, and ESE do not address this streaming transformation. This is a valid no-fit, not a defect. | Informational | High | Compare the public examples' durable view/search paths with the no-read-path brief. | No component change. Keep the CLI standalone. |
+| BogKit onboarding | `new-project.sh` always creates under `examples/` and adds all three local components, even when none fit. | Low | High | Read or run the script with a disposable name. It has one fixed template. | Document a standalone/no-component route or add opt-in dependency flags. |
+| Trial prototype | The measured acceptance workload passes, including all four classification paths. | Informational | High | Run `scripts/verify.sh`, the workload command, and the open-file observer. | None for the one-day boundary. |
+| Trial prototype | A single pathological FASTQ line can grow memory beyond the measured fixture envelope because line length is not capped. | Medium | High | Feed an extremely long line and observe allocation before validation. Not run because it would not alter the stated fixture result. | Add a bounded line reader and a documented maximum record length. |
+| Trial prototype | Malformed input leaves partial FASTQ files, deliberately without a completion manifest. Consumers must use the manifest as the completion sentinel. | Low | High | Run any malformed fixture and inspect its output directory. | Document the sentinel contract; optionally clean failed run directories when the caller explicitly permits deletion. |
+| Trial prototype | Output files are flushed before manifest publication but are not individually `fsync`ed, so power-loss durability is not proven. | Medium | High | Requires filesystem fault/power-loss injection; not run. | Sync each touched output and the output directory before publishing the manifest if crash durability is required. |
+| Trial prototype | Sample names are deliberately limited to safe ASCII filename characters and 120 bytes. Truly arbitrary sample labels are not accepted. | Low | High | Put whitespace or a path separator in column two of the map. | Separate opaque sample labels from sanitized output IDs if such labels are required. |
+| Trial prototype | Case-insensitive output aliases could mix samples or the reserved ambiguity stream while the manifest claimed separation. Fixed after review. | High | High | Use `Alpha` and `alpha`, or sample `Ambiguous`, on this host. | Reject ASCII-case-folded collisions before output creation; retain regressions. |
+| Trial prototype | Empty/control-byte IDs and contradictory slash/CASAVA roles were accepted. Fixed after review. | Medium | High | Use the archived integration cases. | Validate the supported identifier token and reconcile both role conventions. |
+| Evidence script | A failing `lsof` command produced zero observations but exited successfully. Fixed after review. | Medium | High | Set `LSOF_COMMAND=/usr/bin/false`; the corrected script exits nonzero. | Require at least one successful, positive observation. |
+| Trial fixtures | Extra trailing blank line and map-creation race initially invalidated test commands; both were fixed before final evidence. | Informational | High | Described in the ordered trail; current integration and piped commands pass. | Retain exact fixtures and `--emit-only` separation. |
+| Test environment | Sandboxed `time -l` could not read kernel RSS counters. This was not a product failure. | Informational | High | Run the first timing command without resource-counter permission on this host. | Grant read access to the timer counters or use another process RSS observer. |
+
+## Decision audit
+
+1. **No BogKit runtime dependency.** The deciding evidence was the public examples plus the
+   baseline's actual failure mode. No component provides FASTQ framing or bounded fan-out.
+2. **Dependency-free Rust.** The standard library covers buffered stdin, file append, maps, JSON
+   emission, and atomic rename. This avoids downloads and keeps the trial reproducible.
+3. **Precomputed correction index.** Each whitelist barcode contributes every one-base A/C/G/T/N
+   neighbor. First insert is unique; any second barcode marks the neighbor ambiguous, even if both
+   barcodes name the same sample. Exact lookup takes precedence. This directly encodes the
+   barcode-level tie rule.
+4. **64 KiB destination buffers plus 24-entry LRU.** LRU alone bounds handles but performs poorly
+   for round-robin 384-sample data. Buffers reduce churn while using roughly 24 MiB at 384
+   destinations, inside the measured memory budget.
+5. **Sequential, single-threaded processing.** It naturally preserves within-sample order and was
+   already far under the timing target. Parallel classification would add ordering machinery.
+6. **New-or-empty output directory.** Refusing existing contents prevents accidental append or
+   truncation and makes repeated checks unambiguous. Case-folded output aliases are rejected
+   before the directory is created.
+7. **Completion manifest last.** All parser checks, writer flushes, and count invariants finish
+   before a temporary manifest is synced and renamed to `manifest.json`.
+8. **Original bytes retained.** Lines include their input line endings in output buffers, while
+   validation uses newline-stripped slices. A CRLF unit test confirms preservation.
+
+## Rejected choices
+
+- **Fold as a spool or counter store:** rejected because it introduces durable state and a second
+  representation of data without eliminating output FASTQ files; an uncompressed input spool is
+  explicitly out of scope.
+- **ANNy or ESE for matching:** rejected because ten-base Hamming distance is exact discrete
+  matching, not semantic or approximate vector search.
+- **All sample files open:** reproduces the baseline failure.
+- **LRU append with no destination buffering:** bounded but risks nearly one open/close per pair
+  for round-robin samples.
+- **One uncompressed temporary input copy:** violates the single-pass constraint.
+- **Compressed outputs or a shared container:** would change baseline bytes and is a non-goal.
+- **Third-party argument, JSON, LRU, or FASTQ crates:** unnecessary for the one-day prototype and
+  could require uncached downloads.
+- **Deleting partial outputs automatically on malformed input:** not required by acceptance and
+  is a consequential behavior; the manifest is the explicit success boundary instead.
+
+## Unresolved uncertainty and narrowed claims
+
+- The largest run was the required 1,000,000-pair numeric workload, not the maximum stated
+  10,000,000-pair stream. No ten-million-pair time, disk, or RSS claim is made.
+- The 128 MiB result applies to the generated 40-base read 1 and 40-base read 2 records. Without a
+  line-length cap, it does not cover adversarially large individual FASTQ records.
+- Corrected `lsof` sampling can miss short transients, but its 45 successful polls and observed
+  maximum agree with the
+  writer-pool invariant: opening entry 25 always flushes and drops the least-recently-used entry
+  first.
+- The maximum applies to FASTQ output files. Standard input, stdout/stderr, and short-lived map or
+  manifest descriptors are outside the "sample files open" requirement.
+- The manifest's atomic rename and file flush behavior was tested normally, not under disk-full,
+  I/O-fault, process-kill, or power-loss injection.
+- Optional FASTQ conventions beyond the exercised `/1` and `/2` and matching Illumina whitespace
+  role forms may need broader production fixtures. Conflicting dual roles are rejected.
+- Filenames expose safe sample names by design, as the existing per-sample convention implies.
+  The program does not print them, but filesystem metadata and the manifest contain them.
+
+## Coordinator rerun
+
+The disposable `/private/tmp/fastq-spill-evidence-cUbEIn` outputs may not survive. The durable
+reproduction entry points are in this trial directory:
+
+```console
+./scripts/verify.sh
+python3 scripts/measure_open_files.py
+```
+
+For the full numeric run, use the exact two generator commands and timed pipeline in the README.
+On a sandboxed macOS runner, `/usr/bin/time -l` may need permission to read kernel resource
+counters; the functional command itself does not.
diff --git a/developer-simulation/runs/2026-08-05--fastq-barcode-spill/baseline.py b/developer-simulation/runs/2026-08-05--fastq-barcode-spill/baseline.py
new file mode 100755
index 0000000..8aae7ca
--- /dev/null
+++ b/developer-simulation/runs/2026-08-05--fastq-barcode-spill/baseline.py
@@ -0,0 +1,55 @@
+#!/usr/bin/env python3
+"""Small reference implementation of the stated existing exact-match behavior."""
+
+import argparse
+import pathlib
+import sys
+
+
+def load_map(path: pathlib.Path) -> dict[str, str]:
+    result: dict[str, str] = {}
+    for line in path.read_text(encoding="ascii").splitlines():
+        if line and not line.startswith("#"):
+            barcode, sample = line.split("\t")
+            result[barcode.upper()] = sample
+    return result
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser()
+    parser.add_argument("--barcodes", type=pathlib.Path, required=True)
+    parser.add_argument("--out", type=pathlib.Path, required=True)
+    args = parser.parse_args()
+
+    mapping = load_map(args.barcodes)
+    args.out.mkdir(parents=True)
+    # This intentionally models the original limitation: every destination is open.
+    handles = {}
+    try:
+        for sample in dict.fromkeys(mapping.values()):
+            handles[sample] = (args.out / f"{sample}.fastq").open("wb")
+        handles["__unmatched__"] = (args.out / "unmatched.fastq").open("wb")
+    except OSError:
+        for handle in handles.values():
+            handle.close()
+        print("error: could not open all output files", file=sys.stderr)
+        return 1
+    try:
+        stream = sys.stdin.buffer
+        while True:
+            lines = [stream.readline() for _ in range(8)]
+            if not lines[0]:
+                break
+            if any(not line for line in lines):
+                raise ValueError("truncated FASTQ pair")
+            barcode = lines[1].rstrip(b"\r\n")[:10].decode("ascii").upper()
+            destination = mapping.get(barcode, "__unmatched__")
+            handles[destination].writelines(lines)
+    finally:
+        for handle in handles.values():
+            handle.close()
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())
diff --git a/developer-simulation/runs/2026-08-05--fastq-barcode-spill/fixtures/barcodes.tsv b/developer-simulation/runs/2026-08-05--fastq-barcode-spill/fixtures/barcodes.tsv
new file mode 100644
index 0000000..5806b50
--- /dev/null
+++ b/developer-simulation/runs/2026-08-05--fastq-barcode-spill/fixtures/barcodes.tsv
@@ -0,0 +1,4 @@
+AAAAAAAAAA	alpha
+CAAAAAAAAA	beta
+CCCCCCCCCC	gamma
+GGGGGGGGGG	delta
diff --git a/developer-simulation/runs/2026-08-05--fastq-barcode-spill/fixtures/clean.fastq b/developer-simulation/runs/2026-08-05--fastq-barcode-spill/fixtures/clean.fastq
new file mode 100644
index 0000000..e1dc69b
--- /dev/null
+++ b/developer-simulation/runs/2026-08-05--fastq-barcode-spill/fixtures/clean.fastq
@@ -0,0 +1,16 @@
+@clean-a/1
+AAAAAAAAAATGCA
++
+IIIIIIIIIIIIII
+@clean-a/2
+TGCATGCA
++
+IIIIIIII
+@clean-c/1
+CCCCCCCCCCACGT
++
+IIIIIIIIIIIIII
+@clean-c/2
+ACGTACGT
++
+IIIIIIII
diff --git a/developer-simulation/runs/2026-08-05--fastq-barcode-spill/fixtures/generate.py b/developer-simulation/runs/2026-08-05--fastq-barcode-spill/fixtures/generate.py
new file mode 100755
index 0000000..c3c0759
--- /dev/null
+++ b/developer-simulation/runs/2026-08-05--fastq-barcode-spill/fixtures/generate.py
@@ -0,0 +1,103 @@
+#!/usr/bin/env python3
+"""Deterministic interleaved FASTQ and barcode-map generator."""
+
+import argparse
+import pathlib
+import sys
+import time
+
+BASES = "ACGT"
+
+
+def barcode_for(index: int) -> str:
+    chars = ["A"] * 10
+    for position in range(9, -1, -1):
+        chars[position] = BASES[index & 3]
+        index >>= 2
+    return "".join(chars)
+
+
+def barcode_set(samples: int, well_spaced: bool) -> list[str]:
+    if not well_spaced:
+        return [barcode_for(index) for index in range(samples)]
+
+    selected = ["AAAAAAAAAA", "CCAAAAAAAA"][:samples]
+    if len(selected) == samples:
+        return selected
+    for candidate_index in range(4**10):
+        candidate = barcode_for(candidate_index)
+        if all(sum(a != b for a, b in zip(candidate, chosen)) >= 3 for chosen in selected):
+            selected.append(candidate)
+            if len(selected) == samples:
+                return selected
+    raise ValueError("could not construct requested well-spaced barcode set")
+
+
+def write_map(path: pathlib.Path, barcodes: list[str]) -> None:
+    with path.open("w", encoding="ascii", newline="\n") as output:
+        for index, barcode in enumerate(barcodes):
+            output.write(f"{barcode}\ts{index:03d}\n")
+
+
+def mutate_once(barcode: str, pair_index: int) -> str:
+    position = pair_index % len(barcode)
+    replacement = BASES[(BASES.index(barcode[position]) + 1) % len(BASES)]
+    return barcode[:position] + replacement + barcode[position + 1 :]
+
+
+def emit(pairs: int, barcodes: list[str], pause_ms: float, mixed: bool) -> None:
+    output = sys.stdout
+    r2_sequence = "TGCATGCATGCATGCATGCATGCATGCATGCATGCATGCA"
+    r2_quality = "I" * len(r2_sequence)
+    chunk: list[str] = []
+    for pair_index in range(pairs):
+        if not mixed or pair_index % 4 == 0:
+            barcode = barcodes[pair_index % len(barcodes)]
+        elif pair_index % 4 == 1:
+            sample_index = 2 + ((pair_index // 4) % (len(barcodes) - 2))
+            barcode = mutate_once(barcodes[sample_index], pair_index)
+        elif pair_index % 4 == 2:
+            barcode = "CAAAAAAAAA"  # one base from each of the first two whitelist entries
+        else:
+            barcode = "NNNNNNNNNN"  # more than one mismatch from every whitelist entry
+        r1_sequence = barcode + "ACGTACGTACGTACGTACGTACGTACGTAC"
+        r1_quality = "I" * len(r1_sequence)
+        chunk.append(
+            f"@read{pair_index:09d}/1\n{r1_sequence}\n+\n{r1_quality}\n"
+            f"@read{pair_index:09d}/2\n{r2_sequence}\n+\n{r2_quality}\n"
+        )
+        if len(chunk) == 4096:
+            output.write("".join(chunk))
+            output.flush()
+            chunk.clear()
+            if pause_ms:
+                time.sleep(pause_ms / 1000)
+    if chunk:
+        output.write("".join(chunk))
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser()
+    parser.add_argument("--samples", type=int, default=12)
+    parser.add_argument("--pairs", type=int, default=0)
+    parser.add_argument("--barcodes", type=pathlib.Path, required=True)
+    parser.add_argument("--pause-ms", type=float, default=0)
+    parser.add_argument("--emit-only", action="store_true")
+    parser.add_argument("--well-spaced", action="store_true")
+    parser.add_argument("--mixed", action="store_true")
+    args = parser.parse_args()
+    if not 1 <= args.samples <= 4**10:
+        parser.error("samples must be between 1 and 1,048,576")
+    if args.pairs < 0:
+        parser.error("pairs cannot be negative")
+    if args.mixed and (not args.well_spaced or args.samples < 3):
+        parser.error("--mixed requires --well-spaced and at least 3 samples")
+    barcodes = barcode_set(args.samples, args.well_spaced)
+    if not args.emit_only:
+        write_map(args.barcodes, barcodes)
+    emit(args.pairs, barcodes, args.pause_ms, args.mixed)
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())
diff --git a/developer-simulation/runs/2026-08-05--fastq-barcode-spill/fixtures/mismatched.fastq b/developer-simulation/runs/2026-08-05--fastq-barcode-spill/fixtures/mismatched.fastq
new file mode 100644
index 0000000..969698f
--- /dev/null
+++ b/developer-simulation/runs/2026-08-05--fastq-barcode-spill/fixtures/mismatched.fastq
@@ -0,0 +1,8 @@
+@left/1
+AAAAAAAAAA
++
+IIIIIIIIII
+@right/2
+ACGT
++
+IIII
diff --git a/developer-simulation/runs/2026-08-05--fastq-barcode-spill/fixtures/mixed.fastq b/developer-simulation/runs/2026-08-05--fastq-barcode-spill/fixtures/mixed.fastq
new file mode 100644
index 0000000..9838413
--- /dev/null
+++ b/developer-simulation/runs/2026-08-05--fastq-barcode-spill/fixtures/mixed.fastq
@@ -0,0 +1,32 @@
+@exact/1
+CCCCCCCCCCACGT
++
+IIIIIIIIIIIIII
+@exact/2
+ACGTACGT
++
+IIIIIIII
+@corrected/1
+TCCCCCCCCCACGT
++
+IIIIIIIIIIIIII
+@corrected/2
+ACGTACGT
++
+IIIIIIII
+@tie/1
+GAAAAAAAAAACGT
++
+IIIIIIIIIIIIII
+@tie/2
+ACGTACGT
++
+IIIIIIII
+@unmatched/1
+TTTTTTTTTTACGT
++
+IIIIIIIIIIIIII
+@unmatched/2
+ACGTACGT
++
+IIIIIIII
diff --git a/developer-simulation/runs/2026-08-05--fastq-barcode-spill/fixtures/truncated.fastq b/developer-simulation/runs/2026-08-05--fastq-barcode-spill/fixtures/truncated.fastq
new file mode 100644
index 0000000..724a6dc
--- /dev/null
+++ b/developer-simulation/runs/2026-08-05--fastq-barcode-spill/fixtures/truncated.fastq
@@ -0,0 +1,7 @@
+@short/1
+AAAAAAAAAA
++
+IIIIIIIIII
+@short/2
+ACGT
++
diff --git a/developer-simulation/runs/2026-08-05--fastq-barcode-spill/fixtures/unequal.fastq b/developer-simulation/runs/2026-08-05--fastq-barcode-spill/fixtures/unequal.fastq
new file mode 100644
index 0000000..2ee242a
--- /dev/null
+++ b/developer-simulation/runs/2026-08-05--fastq-barcode-spill/fixtures/unequal.fastq
@@ -0,0 +1,8 @@
+@bad/1
+AAAAAAAAAA
++
+III
+@bad/2
+ACGT
++
+IIII
diff --git a/developer-simulation/runs/2026-08-05--fastq-barcode-spill/scripts/measure_open_files.py b/developer-simulation/runs/2026-08-05--fastq-barcode-spill/scripts/measure_open_files.py
new file mode 100755
index 0000000..b0af8e9
--- /dev/null
+++ b/developer-simulation/runs/2026-08-05--fastq-barcode-spill/scripts/measure_open_files.py
@@ -0,0 +1,117 @@
+#!/usr/bin/env python3
+"""Observe the release process with lsof during a throttled streamed run."""
+
+import json
+import os
+import pathlib
+import subprocess
+import sys
+import tempfile
+import time
+
+
+def main() -> int:
+    root = pathlib.Path(__file__).resolve().parents[1]
+    default_binary = root.parents[1] / "target" / "release" / "fastq-barcode-spill"
+    binary = pathlib.Path(os.environ.get("FASTQ_BINARY", default_binary)).resolve()
+    generator = root / "fixtures" / "generate.py"
+    lsof_command = os.environ.get("LSOF_COMMAND", "lsof")
+    pair_count = int(os.environ.get("FASTQ_MEASURE_PAIRS", "200000"))
+
+    with tempfile.TemporaryDirectory(prefix="fastq-open-files-", dir="/private/tmp") as temporary:
+        temp = pathlib.Path(temporary)
+        barcode_map = temp / "barcodes.tsv"
+        output = temp / "output"
+        subprocess.run(
+            [
+                sys.executable,
+                generator,
+                "--samples",
+                "384",
+                "--pairs",
+                "0",
+                "--well-spaced",
+                "--barcodes",
+                barcode_map,
+            ],
+            check=True,
+        )
+        producer = subprocess.Popen(
+            [
+                sys.executable,
+                generator,
+                "--samples",
+                "384",
+                "--pairs",
+                str(pair_count),
+                "--pause-ms",
+                "20",
+                "--barcodes",
+                barcode_map,
+                "--well-spaced",
+                "--mixed",
+                "--emit-only",
+            ],
+            stdout=subprocess.PIPE,
+            stderr=subprocess.PIPE,
+        )
+        assert producer.stdout is not None
+        consumer = subprocess.Popen(
+            [binary, "--barcodes", barcode_map, "--out", output, "--max-open", "24"],
+            stdin=producer.stdout,
+            stdout=subprocess.PIPE,
+            stderr=subprocess.PIPE,
+        )
+        producer.stdout.close()
+
+        observed_max = 0
+        polls = 0
+        successful_polls = 0
+        prefix = f"n{output}/"
+        while consumer.poll() is None:
+            observation = subprocess.run(
+                [lsof_command, "-a", "-p", str(consumer.pid), "-Fn"],
+                stdout=subprocess.PIPE,
+                stderr=subprocess.DEVNULL,
+                text=True,
+                check=False,
+            )
+            if observation.returncode == 0:
+                successful_polls += 1
+            open_fastq = sum(
+                1
+                for line in observation.stdout.splitlines()
+                if line.startswith(prefix) and line.endswith(".fastq")
+            )
+            observed_max = max(observed_max, open_fastq)
+            polls += 1
+            time.sleep(0.01)
+
+        consumer_stdout, consumer_stderr = consumer.communicate()
+        producer_stderr = producer.communicate()[1]
+        if producer.returncode != 0 or consumer.returncode != 0:
+            print("measurement workload failed", file=sys.stderr)
+            if producer_stderr:
+                print(producer_stderr.decode("utf-8", "replace"), file=sys.stderr)
+            if consumer_stderr:
+                print(consumer_stderr.decode("utf-8", "replace"), file=sys.stderr)
+            return 1
+
+        manifest = json.loads((output / "manifest.json").read_text())
+        print(
+            f"observed_max_open_fastq_files={observed_max} "
+            f"manifest_max_open_writers={manifest['max_open_writers']} polls={polls} "
+            f"successful_polls={successful_polls}"
+        )
+        if successful_polls == 0 or observed_max == 0:
+            print("no valid positive lsof observation", file=sys.stderr)
+            return 1
+        if observed_max > 24 or manifest["max_open_writers"] > 24:
+            return 1
+        if f"processed {pair_count} read pairs".encode() not in consumer_stdout:
+            return 1
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())
diff --git a/developer-simulation/runs/2026-08-05--fastq-barcode-spill/scripts/verify.sh b/developer-simulation/runs/2026-08-05--fastq-barcode-spill/scripts/verify.sh
new file mode 100755
index 0000000..8c9e58a
--- /dev/null
+++ b/developer-simulation/runs/2026-08-05--fastq-barcode-spill/scripts/verify.sh
@@ -0,0 +1,29 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+root="$(cd "$(dirname "$0")/.." && pwd)"
+cd "$root"
+workspace_manifest="$(cd "$root/../.." && pwd)/Cargo.toml"
+export CARGO_TARGET_DIR="${CARGO_TARGET_DIR:-/private/tmp/fastq-barcode-spill-target}"
+
+cargo test --offline --locked --manifest-path "$workspace_manifest" -p fastq-barcode-spill
+cargo fmt --manifest-path "$workspace_manifest" -p fastq-barcode-spill -- --check
+cargo clippy --offline --locked --manifest-path "$workspace_manifest" \
+  -p fastq-barcode-spill --all-targets -- -D warnings
+cargo build --release --offline --locked --manifest-path "$workspace_manifest" \
+  -p fastq-barcode-spill
+python3 tests/integration.py "$CARGO_TARGET_DIR/release/fastq-barcode-spill"
+
+if FASTQ_BINARY="$CARGO_TARGET_DIR/release/fastq-barcode-spill" \
+  FASTQ_MEASURE_PAIRS=2000 LSOF_COMMAND=/usr/bin/false \
+  python3 scripts/measure_open_files.py; then
+  echo "failed lsof observer was accepted" >&2
+  exit 1
+fi
+
+demo_dir="$(mktemp -d "${TMPDIR:-/tmp}/fastq-barcode-spill-demo-XXXXXX")"
+"$CARGO_TARGET_DIR/release/fastq-barcode-spill" \
+  --barcodes fixtures/barcodes.tsv \
+  --out "$demo_dir" \
+  < fixtures/mixed.fastq
+python3 -m json.tool "$demo_dir/manifest.json"
diff --git a/developer-simulation/runs/2026-08-05--fastq-barcode-spill/src/main.rs b/developer-simulation/runs/2026-08-05--fastq-barcode-spill/src/main.rs
new file mode 100644
index 0000000..abb688e
--- /dev/null
+++ b/developer-simulation/runs/2026-08-05--fastq-barcode-spill/src/main.rs
@@ -0,0 +1,820 @@
+use std::collections::{BTreeMap, HashMap};
+use std::env;
+use std::fs::{self, File, OpenOptions};
+use std::io::{self, BufRead, BufReader, BufWriter, Write};
+use std::path::{Path, PathBuf};
+
+const BARCODE_LEN: usize = 10;
+const BUFFER_LIMIT: usize = 64 * 1024;
+const AMBIGUOUS_FILE: &str = "ambiguous.fastq";
+const UNMATCHED_FILE: &str = "unmatched.fastq";
+const MANIFEST_FILE: &str = "manifest.json";
+
+fn main() {
+    match Config::parse().and_then(run) {
+        Ok(summary) => {
+            println!(
+                "processed {} read pairs: exact {}, corrected {}, ambiguous {}, unmatched {}; max open output writers {}",
+                summary.total_pairs,
+                summary.exact_pairs,
+                summary.corrected_pairs,
+                summary.ambiguous_pairs,
+                summary.unmatched_pairs,
+                summary.max_open_writers
+            );
+        }
+        Err(message) => {
+            eprintln!("error: {message}");
+            std::process::exit(1);
+        }
+    }
+}
+
+#[derive(Debug)]
+struct Config {
+    barcode_path: PathBuf,
+    output_dir: PathBuf,
+    max_open: usize,
+}
+
+impl Config {
+    fn parse() -> Result<Self, String> {
+        let mut barcode_path = None;
+        let mut output_dir = None;
+        let mut max_open = 24_usize;
+        let mut args = env::args().skip(1);
+
+        while let Some(arg) = args.next() {
+            match arg.as_str() {
+                "--barcodes" => {
+                    barcode_path = Some(PathBuf::from(
+                        args.next()
+                            .ok_or_else(|| "--barcodes requires a path".to_string())?,
+                    ));
+                }
+                "--out" => {
+                    output_dir = Some(PathBuf::from(
+                        args.next()
+                            .ok_or_else(|| "--out requires a directory".to_string())?,
+                    ));
+                }
+                "--max-open" => {
+                    let value = args
+                        .next()
+                        .ok_or_else(|| "--max-open requires a number".to_string())?;
+                    max_open = value
+                        .parse::<usize>()
+                        .map_err(|_| "--max-open must be a positive integer".to_string())?;
+                    if max_open == 0 || max_open > 24 {
+                        return Err("--max-open must be between 1 and 24".to_string());
+                    }
+                }
+                "-h" | "--help" => {
+                    println!(
+                        "usage: fastq-barcode-spill --barcodes MAP.tsv --out DIRECTORY [--max-open 24]\n\
+                         reads interleaved paired-end FASTQ from standard input"
+                    );
+                    std::process::exit(0);
+                }
+                _ => return Err("unknown argument; use --help for usage".to_string()),
+            }
+        }
+
+        Ok(Self {
+            barcode_path: barcode_path
+                .ok_or_else(|| "missing required --barcodes path".to_string())?,
+            output_dir: output_dir.ok_or_else(|| "missing required --out directory".to_string())?,
+            max_open,
+        })
+    }
+}
+
+#[derive(Clone, Copy, Debug, Eq, Hash, PartialEq)]
+struct Barcode([u8; BARCODE_LEN]);
+
+#[derive(Debug)]
+struct BarcodeMap {
+    exact: HashMap<Barcode, usize>,
+    corrections: HashMap<Barcode, Correction>,
+    samples: Vec<String>,
+}
+
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+enum Correction {
+    Unique(usize),
+    Ambiguous,
+}
+
+impl BarcodeMap {
+    fn load(path: &Path) -> Result<Self, String> {
+        let file = File::open(path).map_err(|_| "could not open barcode map".to_string())?;
+        let reader = BufReader::new(file);
+        let mut barcodes = Vec::new();
+        let mut exact = HashMap::new();
+        let mut samples = Vec::new();
+        let mut sample_indexes = HashMap::new();
+        let mut folded_sample_names = HashMap::new();
+
+        for (offset, line_result) in reader.lines().enumerate() {
+            let line_number = offset + 1;
+            let line = line_result
+                .map_err(|_| format!("barcode map line {line_number}: could not read line"))?;
+            if line.is_empty() || line.starts_with('#') {
+                continue;
+            }
+            let mut fields = line.split('\t');
+            let barcode_text = fields.next().unwrap_or_default();
+            let sample = fields.next().ok_or_else(|| {
+                format!("barcode map line {line_number}: expected barcode and sample")
+            })?;
+            if fields.next().is_some() || barcode_text.is_empty() || sample.is_empty() {
+                return Err(format!(
+                    "barcode map line {line_number}: expected exactly two non-empty fields"
+                ));
+            }
+
+            let barcode = parse_barcode(barcode_text.as_bytes())
+                .map_err(|message| format!("barcode map line {line_number}: {message}"))?;
+            validate_sample_name(sample)
+                .map_err(|message| format!("barcode map line {line_number}: {message}"))?;
+            if exact.contains_key(&barcode) {
+                return Err(format!("barcode map line {line_number}: duplicate barcode"));
+            }
+
+            let folded_sample = sample.to_ascii_lowercase();
+            if let Some(existing) = folded_sample_names.get(&folded_sample) {
+                if existing != sample {
+                    return Err(format!(
+                        "barcode map line {line_number}: sample output name collides case-insensitively"
+                    ));
+                }
+            } else {
+                folded_sample_names.insert(folded_sample, sample.to_string());
+            }
+
+            let sample_index = match sample_indexes.get(sample) {
+                Some(index) => *index,
+                None => {
+                    let index = samples.len();
+                    samples.push(sample.to_string());
+                    sample_indexes.insert(sample.to_string(), index);
+                    index
+                }
+            };
+            exact.insert(barcode, sample_index);
+            barcodes.push((barcode, sample_index));
+        }
+
+        if barcodes.is_empty() {
+            return Err("barcode map contains no barcodes".to_string());
+        }
+
+        let corrections = build_correction_index(&barcodes);
+        Ok(Self {
+            exact,
+            corrections,
+            samples,
+        })
+    }
+
+    fn classify(&self, observed: &[u8]) -> Classification {
+        let Ok(barcode) = parse_observed_barcode(observed) else {
+            return Classification::Unmatched;
+        };
+        if let Some(sample_index) = self.exact.get(&barcode) {
+            return Classification::Exact(*sample_index);
+        }
+
+        match self.corrections.get(&barcode) {
+            Some(Correction::Unique(sample_index)) => Classification::Corrected(*sample_index),
+            Some(Correction::Ambiguous) => Classification::Ambiguous,
+            None => Classification::Unmatched,
+        }
+    }
+}
+
+fn build_correction_index(barcodes: &[(Barcode, usize)]) -> HashMap<Barcode, Correction> {
+    let mut corrections = HashMap::with_capacity(barcodes.len() * BARCODE_LEN * 4);
+    for (barcode, sample_index) in barcodes {
+        for position in 0..BARCODE_LEN {
+            for replacement in b"ACGTN" {
+                if *replacement == barcode.0[position] {
+                    continue;
+                }
+                let mut neighbor = barcode.0;
+                neighbor[position] = *replacement;
+                corrections
+                    .entry(Barcode(neighbor))
+                    .and_modify(|entry| *entry = Correction::Ambiguous)
+                    .or_insert(Correction::Unique(*sample_index));
+            }
+        }
+    }
+    corrections
+}
+
+fn parse_barcode(bytes: &[u8]) -> Result<Barcode, String> {
+    if bytes.len() != BARCODE_LEN {
+        return Err(format!("barcode must contain exactly {BARCODE_LEN} bases"));
+    }
+    let mut barcode = [0; BARCODE_LEN];
+    for (index, base) in bytes.iter().copied().enumerate() {
+        let normalized = base.to_ascii_uppercase();
+        if !matches!(normalized, b'A' | b'C' | b'G' | b'T') {
+            return Err("barcode contains a non-ACGT base".to_string());
+        }
+        barcode[index] = normalized;
+    }
+    Ok(Barcode(barcode))
+}
+
+fn parse_observed_barcode(bytes: &[u8]) -> Result<Barcode, ()> {
+    if bytes.len() < BARCODE_LEN {
+        return Err(());
+    }
+    let mut barcode = [0; BARCODE_LEN];
+    for (index, base) in bytes[..BARCODE_LEN].iter().copied().enumerate() {
+        let normalized = base.to_ascii_uppercase();
+        if !matches!(normalized, b'A' | b'C' | b'G' | b'T' | b'N') {
+            return Err(());
+        }
+        barcode[index] = normalized;
+    }
+    Ok(Barcode(barcode))
+}
+
+fn validate_sample_name(sample: &str) -> Result<(), String> {
+    if sample.len() > 120 {
+        return Err("sample name is too long".to_string());
+    }
+    let folded = sample.to_ascii_lowercase();
+    if sample == "."
+        || sample == ".."
+        || folded == "ambiguous"
+        || folded == "unmatched"
+        || !sample
+            .bytes()
+            .all(|byte| byte.is_ascii_alphanumeric() || matches!(byte, b'.' | b'_' | b'-'))
+    {
+        return Err("sample name is not a safe output name".to_string());
+    }
+    Ok(())
+}
+
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+enum Classification {
+    Exact(usize),
+    Corrected(usize),
+    Ambiguous,
+    Unmatched,
+}
+
+#[derive(Debug)]
+struct FastqPair {
+    lines: [Vec<u8>; 8],
+}
+
+impl FastqPair {
+    fn write_to(&self, destination: &mut Vec<u8>) {
+        for line in &self.lines {
+            destination.extend_from_slice(line);
+        }
+    }
+
+    fn read_one_barcode(&self) -> &[u8] {
+        line_content(&self.lines[1])
+    }
+}
+
+struct PairReader<R: BufRead> {
+    input: R,
+    line_number: usize,
+}
+
+impl<R: BufRead> PairReader<R> {
+    fn new(input: R) -> Self {
+        Self {
+            input,
+            line_number: 0,
+        }
+    }
+
+    fn next_pair(&mut self) -> Result<Option<FastqPair>, String> {
+        let mut lines: [Vec<u8>; 8] = std::array::from_fn(|_| Vec::new());
+        let first_line = self.line_number + 1;
+        if !self.read_line(&mut lines[0])? {
+            return Ok(None);
+        }
+        for line in &mut lines[1..] {
+            if !self.read_line(line)? {
+                return Err(format!(
+                    "line {}: truncated interleaved FASTQ pair",
+                    self.line_number + 1
+                ));
+            }
+        }
+        validate_record(&lines[0..4], first_line)?;
+        validate_record(&lines[4..8], first_line + 4)?;
+        if line_content(&lines[1]).len() < BARCODE_LEN {
+            return Err(format!(
+                "line {}: read 1 is shorter than the barcode length",
+                first_line + 1
+            ));
+        }
+        validate_pair_ids(&lines[0], &lines[4], first_line, first_line + 4)?;
+        Ok(Some(FastqPair { lines }))
+    }
+
+    fn read_line(&mut self, destination: &mut Vec<u8>) -> Result<bool, String> {
+        self.line_number += 1;
+        match self.input.read_until(b'\n', destination) {
+            Ok(0) => {
+                self.line_number -= 1;
+                Ok(false)
+            }
+            Ok(_) => Ok(true),
+            Err(_) => Err(format!("line {}: could not read input", self.line_number)),
+        }
+    }
+}
+
+fn line_content(line: &[u8]) -> &[u8] {
+    let without_lf = line.strip_suffix(b"\n").unwrap_or(line);
+    without_lf.strip_suffix(b"\r").unwrap_or(without_lf)
+}
+
+fn validate_record(lines: &[Vec<u8>], first_line: usize) -> Result<(), String> {
+    let header = line_content(&lines[0]);
+    let sequence = line_content(&lines[1]);
+    let separator = line_content(&lines[2]);
+    let quality = line_content(&lines[3]);
+
+    if header.first() != Some(&b'@') || header.len() == 1 {
+        return Err(format!(
+            "line {first_line}: FASTQ header must start with @ and contain an identifier"
+        ));
+    }
+    if sequence.is_empty() || sequence.iter().any(|byte| !byte.is_ascii_alphabetic()) {
+        return Err(format!(
+            "line {}: FASTQ sequence must contain only base letters",
+            first_line + 1
+        ));
+    }
+    if separator.first() != Some(&b'+') {
+        return Err(format!(
+            "line {}: FASTQ separator must start with +",
+            first_line + 2
+        ));
+    }
+    if !separator[1..].is_empty() {
+        let repeated = first_token(&separator[1..]);
+        if repeated != first_token(&header[1..]) {
+            return Err(format!(
+                "line {}: FASTQ separator identifier does not match header",
+                first_line + 2
+            ));
+        }
+    }
+    if sequence.len() != quality.len() {
+        return Err(format!(
+            "line {}: sequence and quality lengths differ",
+            first_line + 3
+        ));
+    }
+    if quality.iter().any(|byte| !(33..=126).contains(byte)) {
+        return Err(format!(
+            "line {}: FASTQ quality contains a non-printable value",
+            first_line + 3
+        ));
+    }
+    Ok(())
+}
+
+fn first_token(value: &[u8]) -> &[u8] {
+    let end = value
+        .iter()
+        .position(|byte| byte.is_ascii_whitespace())
+        .unwrap_or(value.len());
+    &value[..end]
+}
+
+fn read_id(header_line: &[u8]) -> Result<(&[u8], Option<u8>), ()> {
+    let header = line_content(header_line);
+    let without_at = &header[1..];
+    let token = first_token(without_at);
+    if token.is_empty() || token.iter().any(|byte| !(33..=126).contains(byte)) {
+        return Err(());
+    }
+    let (core, slash_role) = if token.ends_with(b"/1") {
+        (&token[..token.len() - 2], Some(1))
+    } else if token.ends_with(b"/2") {
+        (&token[..token.len() - 2], Some(2))
+    } else {
+        (token, None)
+    };
+    if core.is_empty() {
+        return Err(());
+    }
+
+    let rest = &without_at[token.len()..];
+    let second = first_token(rest.trim_ascii_start());
+    let role = match second.first() {
+        Some(b'1') if second.get(1) == Some(&b':') => Some(1),
+        Some(b'2') if second.get(1) == Some(&b':') => Some(2),
+        _ => None,
+    };
+    if slash_role.is_some() && role.is_some() && slash_role != role {
+        return Err(());
+    }
+    Ok((core, slash_role.or(role)))
+}
+
+fn validate_pair_ids(
+    read_one_header: &[u8],
+    read_two_header: &[u8],
+    read_one_line: usize,
+    read_two_line: usize,
+) -> Result<(), String> {
+    let (read_one_id, read_one_role) = read_id(read_one_header)
+        .map_err(|_| format!("line {read_one_line}: unsupported FASTQ identifier"))?;
+    let (read_two_id, read_two_role) = read_id(read_two_header)
+        .map_err(|_| format!("line {read_two_line}: unsupported FASTQ identifier"))?;
+    if read_one_role.is_some_and(|role| role != 1) {
+        return Err(format!("line {read_one_line}: first record is not read 1"));
+    }
+    if read_two_role.is_some_and(|role| role != 2) {
+        return Err(format!("line {read_two_line}: second record is not read 2"));
+    }
+    if read_one_id != read_two_id {
+        return Err(format!(
+            "line {read_two_line}: paired read identifiers do not match"
+        ));
+    }
+    Ok(())
+}
+
+struct OpenWriter {
+    writer: BufWriter<File>,
+    last_used: u64,
+}
+
+struct WriterPool {
+    paths: Vec<PathBuf>,
+    open: BTreeMap<usize, OpenWriter>,
+    capacity: usize,
+    clock: u64,
+    max_observed: usize,
+    open_events: u64,
+}
+
+impl WriterPool {
+    fn new(paths: Vec<PathBuf>, capacity: usize) -> Self {
+        Self {
+            paths,
+            open: BTreeMap::new(),
+            capacity,
+            clock: 0,
+            max_observed: 0,
+            open_events: 0,
+        }
+    }
+
+    fn write(&mut self, destination: usize, bytes: &[u8]) -> Result<(), String> {
+        self.clock += 1;
+        if !self.open.contains_key(&destination) {
+            self.open_writer(destination)?;
+        }
+        let open_writer = self
+            .open
+            .get_mut(&destination)
+            .ok_or_else(|| "internal writer-pool error".to_string())?;
+        open_writer.last_used = self.clock;
+        open_writer
+            .writer
+            .write_all(bytes)
+            .map_err(|_| "could not write an output file".to_string())
+    }
+
+    fn open_writer(&mut self, destination: usize) -> Result<(), String> {
+        if self.open.len() == self.capacity {
+            let evict = self
+                .open
+                .iter()
+                .min_by_key(|(_, writer)| writer.last_used)
+                .map(|(index, _)| *index)
+                .ok_or_else(|| "internal writer-pool error".to_string())?;
+            let mut writer = self
+                .open
+                .remove(&evict)
+                .ok_or_else(|| "internal writer-pool error".to_string())?;
+            writer
+                .writer
+                .flush()
+                .map_err(|_| "could not flush an output file".to_string())?;
+        }
+
+        let file = OpenOptions::new()
+            .append(true)
+            .open(&self.paths[destination])
+            .map_err(|_| "could not open an output file".to_string())?;
+        self.open.insert(
+            destination,
+            OpenWriter {
+                writer: BufWriter::new(file),
+                last_used: self.clock,
+            },
+        );
+        self.open_events += 1;
+        self.max_observed = self.max_observed.max(self.open.len());
+        Ok(())
+    }
+
+    fn finish(mut self) -> Result<(usize, u64), String> {
+        for writer in self.open.values_mut() {
+            writer
+                .writer
+                .flush()
+                .map_err(|_| "could not flush an output file".to_string())?;
+        }
+        Ok((self.max_observed, self.open_events))
+    }
+}
+
+#[derive(Debug)]
+struct Summary {
+    total_pairs: u64,
+    exact_pairs: u64,
+    corrected_pairs: u64,
+    ambiguous_pairs: u64,
+    unmatched_pairs: u64,
+    sample_pairs: Vec<u64>,
+    max_open_writers: usize,
+    open_events: u64,
+}
+
+fn run(config: Config) -> Result<Summary, String> {
+    let barcode_map = BarcodeMap::load(&config.barcode_path)?;
+    let paths = prepare_output_directory(&config.output_dir, &barcode_map.samples)?;
+    let ambiguous_index = barcode_map.samples.len();
+    let unmatched_index = ambiguous_index + 1;
+    let mut buffers: Vec<Vec<u8>> = (0..paths.len()).map(|_| Vec::new()).collect();
+    let mut writers = WriterPool::new(paths, config.max_open);
+    let stdin = io::stdin();
+    let mut pairs = PairReader::new(stdin.lock());
+    let mut summary = Summary {
+        total_pairs: 0,
+        exact_pairs: 0,
+        corrected_pairs: 0,
+        ambiguous_pairs: 0,
+        unmatched_pairs: 0,
+        sample_pairs: vec![0; barcode_map.samples.len()],
+        max_open_writers: 0,
+        open_events: 0,
+    };
+
+    while let Some(pair) = pairs.next_pair()? {
+        let destination = match barcode_map.classify(pair.read_one_barcode()) {
+            Classification::Exact(sample_index) => {
+                summary.exact_pairs += 1;
+                summary.sample_pairs[sample_index] += 1;
+                sample_index
+            }
+            Classification::Corrected(sample_index) => {
+                summary.corrected_pairs += 1;
+                summary.sample_pairs[sample_index] += 1;
+                sample_index
+            }
+            Classification::Ambiguous => {
+                summary.ambiguous_pairs += 1;
+                ambiguous_index
+            }
+            Classification::Unmatched => {
+                summary.unmatched_pairs += 1;
+                unmatched_index
+            }
+        };
+        summary.total_pairs += 1;
+        pair.write_to(&mut buffers[destination]);
+        if buffers[destination].len() >= BUFFER_LIMIT {
+            writers.write(destination, &buffers[destination])?;
+            buffers[destination].clear();
+        }
+    }
+
+    for (destination, buffer) in buffers.iter().enumerate() {
+        if !buffer.is_empty() {
+            writers.write(destination, buffer)?;
+        }
+    }
+    let (max_observed, open_events) = writers.finish()?;
+    summary.max_open_writers = max_observed;
+    summary.open_events = open_events;
+
+    let classified = summary.exact_pairs
+        + summary.corrected_pairs
+        + summary.ambiguous_pairs
+        + summary.unmatched_pairs;
+    if classified != summary.total_pairs {
+        return Err("internal count validation failed".to_string());
+    }
+    if summary.sample_pairs.iter().sum::<u64>() != summary.exact_pairs + summary.corrected_pairs {
+        return Err("internal sample-count validation failed".to_string());
+    }
+
+    write_manifest(&config.output_dir, &barcode_map.samples, &summary)?;
+    Ok(summary)
+}
+
+fn prepare_output_directory(output_dir: &Path, samples: &[String]) -> Result<Vec<PathBuf>, String> {
+    if output_dir.exists() {
+        if !output_dir.is_dir() {
+            return Err("output path is not a directory".to_string());
+        }
+        if output_dir
+            .read_dir()
+            .map_err(|_| "could not inspect output directory".to_string())?
+            .next()
+            .is_some()
+        {
+            return Err("output directory must be empty".to_string());
+        }
+    } else {
+        fs::create_dir_all(output_dir)
+            .map_err(|_| "could not create output directory".to_string())?;
+    }
+
+    let mut paths: Vec<PathBuf> = samples
+        .iter()
+        .map(|sample| output_dir.join(format!("{sample}.fastq")))
+        .collect();
+    paths.push(output_dir.join(AMBIGUOUS_FILE));
+    paths.push(output_dir.join(UNMATCHED_FILE));
+    for path in &paths {
+        File::create(path).map_err(|_| "could not create an output file".to_string())?;
+    }
+    Ok(paths)
+}
+
+fn write_manifest(output_dir: &Path, samples: &[String], summary: &Summary) -> Result<(), String> {
+    let temporary = output_dir.join(".manifest.json.tmp");
+    let final_path = output_dir.join(MANIFEST_FILE);
+    let file = File::create(&temporary).map_err(|_| "could not create manifest".to_string())?;
+    let mut writer = BufWriter::new(file);
+    writeln!(writer, "{{").map_err(|_| "could not write manifest".to_string())?;
+    writeln!(writer, "  \"complete\": true,")
+        .map_err(|_| "could not write manifest".to_string())?;
+    writeln!(writer, "  \"total_pairs\": {},", summary.total_pairs)
+        .map_err(|_| "could not write manifest".to_string())?;
+    writeln!(writer, "  \"exact_pairs\": {},", summary.exact_pairs)
+        .map_err(|_| "could not write manifest".to_string())?;
+    writeln!(
+        writer,
+        "  \"corrected_pairs\": {},",
+        summary.corrected_pairs
+    )
+    .map_err(|_| "could not write manifest".to_string())?;
+    writeln!(
+        writer,
+        "  \"ambiguous_pairs\": {},",
+        summary.ambiguous_pairs
+    )
+    .map_err(|_| "could not write manifest".to_string())?;
+    writeln!(
+        writer,
+        "  \"unmatched_pairs\": {},",
+        summary.unmatched_pairs
+    )
+    .map_err(|_| "could not write manifest".to_string())?;
+    writeln!(
+        writer,
+        "  \"max_open_writers\": {},",
+        summary.max_open_writers
+    )
+    .map_err(|_| "could not write manifest".to_string())?;
+    writeln!(writer, "  \"open_events\": {},", summary.open_events)
+        .map_err(|_| "could not write manifest".to_string())?;
+    writeln!(writer, "  \"samples\": [").map_err(|_| "could not write manifest".to_string())?;
+    for (index, (sample, count)) in samples.iter().zip(summary.sample_pairs.iter()).enumerate() {
+        let comma = if index + 1 == samples.len() { "" } else { "," };
+        writeln!(
+            writer,
+            "    {{\"sample\": \"{sample}\", \"file\": \"{sample}.fastq\", \"pairs\": {count}}}{comma}"
+        )
+        .map_err(|_| "could not write manifest".to_string())?;
+    }
+    writeln!(writer, "  ]").map_err(|_| "could not write manifest".to_string())?;
+    writeln!(writer, "}}").map_err(|_| "could not write manifest".to_string())?;
+    writer
+        .flush()
+        .map_err(|_| "could not flush manifest".to_string())?;
+    let file = writer
+        .into_inner()
+        .map_err(|_| "could not finish manifest".to_string())?;
+    file.sync_all()
+        .map_err(|_| "could not sync manifest".to_string())?;
+    fs::rename(&temporary, &final_path)
+        .map_err(|_| "could not publish completion manifest".to_string())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::io::Cursor;
+
+    fn map() -> BarcodeMap {
+        let barcodes = [("AAAAAAAAAA", 0), ("CAAAAAAAAA", 1), ("CCCCCCCCCC", 2)];
+        let parsed = barcodes
+            .iter()
+            .map(|(barcode, sample_index)| {
+                (parse_barcode(barcode.as_bytes()).unwrap(), *sample_index)
+            })
+            .collect::<Vec<_>>();
+        let exact = parsed.iter().copied().collect();
+        BarcodeMap {
+            exact,
+            corrections: build_correction_index(&parsed),
+            samples: vec!["a".into(), "b".into(), "c".into()],
+        }
+    }
+
+    #[test]
+    fn exact_unique_one_error_and_tie_are_distinct() {
+        let map = map();
+        assert_eq!(map.classify(b"AAAAAAAAAATTT"), Classification::Exact(0));
+        assert_eq!(map.classify(b"TCCCCCCCCCTTT"), Classification::Corrected(2));
+        assert_eq!(map.classify(b"GAAAAAAAAATTT"), Classification::Ambiguous);
+        assert_eq!(map.classify(b"TTTTTTTTTTTTT"), Classification::Unmatched);
+    }
+
+    #[test]
+    fn same_sample_barcode_tie_remains_ambiguous() {
+        let parsed = [
+            (parse_barcode(b"AAAAAAAAAA").unwrap(), 0),
+            (parse_barcode(b"CAAAAAAAAA").unwrap(), 0),
+        ];
+        let map = BarcodeMap {
+            exact: parsed.iter().copied().collect(),
+            corrections: build_correction_index(&parsed),
+            samples: vec!["sample".into()],
+        };
+        assert_eq!(map.classify(b"GAAAAAAAAA"), Classification::Ambiguous);
+    }
+
+    #[test]
+    fn pair_reader_preserves_original_bytes() {
+        let input = b"@x/1\r\nAAAAAAAAAATG\r\n+\r\nIIIIIIIIIIII\r\n@x/2\r\nACGT\r\n+\r\nIIII\r\n";
+        let mut reader = PairReader::new(Cursor::new(input));
+        let pair = reader.next_pair().unwrap().unwrap();
+        let mut output = Vec::new();
+        pair.write_to(&mut output);
+        assert_eq!(output, input);
+        assert!(reader.next_pair().unwrap().is_none());
+    }
+
+    #[test]
+    fn identifier_validation_rejects_empty_control_and_conflicting_roles() {
+        let cases: [&[u8]; 3] = [
+            b"@ /1\nAAAAAAAAAA\n+\nIIIIIIIIII\n@ /2\nACGT\n+\nIIII\n",
+            b"@bad\0/1\nAAAAAAAAAA\n+\nIIIIIIIIII\n@bad\0/2\nACGT\n+\nIIII\n",
+            b"@x/1 2:N:0:1\nAAAAAAAAAA\n+\nIIIIIIIIII\n@x/2 2:N:0:1\nACGT\n+\nIIII\n",
+        ];
+        for input in cases {
+            assert!(PairReader::new(Cursor::new(input)).next_pair().is_err());
+        }
+
+        let casava = b"@machine:1:flow:2:3:4:5 1:N:0:ACGT\nAAAAAAAAAA\n+\nIIIIIIIIII\n@machine:1:flow:2:3:4:5 2:N:0:ACGT\nACGT\n+\nIIII\n";
+        assert!(
+            PairReader::new(Cursor::new(casava))
+                .next_pair()
+                .unwrap()
+                .is_some()
+        );
+    }
+
+    #[test]
+    fn malformed_inputs_report_expected_line() {
+        let truncated = b"@x/1\nAAAAAAAAAA\n+\nIIIIIIIIII\n@x/2\nACGT\n+\n";
+        let mut reader = PairReader::new(Cursor::new(truncated));
+        assert_eq!(
+            reader.next_pair().unwrap_err(),
+            "line 8: truncated interleaved FASTQ pair"
+        );
+
+        let mismatch = b"@x/1\nAAAAAAAAAA\n+\nIIIIIIIIII\n@y/2\nACGT\n+\nIIII\n";
+        let mut reader = PairReader::new(Cursor::new(mismatch));
+        assert_eq!(
+            reader.next_pair().unwrap_err(),
+            "line 5: paired read identifiers do not match"
+        );
+
+        let first = b"@ok/1\nAAAAAAAAAA\n+\nIIIIIIIIII\n@ok/2\nACGT\n+\nIIII\n";
+        let second = b"@left/1\nAAAAAAAAAA\n+\nIIIIIIIIII\n@right/2\nACGT\n+\nIIII\n";
+        let joined = [first.as_slice(), second.as_slice()].concat();
+        let mut reader = PairReader::new(Cursor::new(joined));
+        assert!(reader.next_pair().unwrap().is_some());
+        assert_eq!(
+            reader.next_pair().unwrap_err(),
+            "line 13: paired read identifiers do not match"
+        );
+    }
+}
diff --git a/developer-simulation/runs/2026-08-05--fastq-barcode-spill/tests/integration.py b/developer-simulation/runs/2026-08-05--fastq-barcode-spill/tests/integration.py
new file mode 100755
index 0000000..fcaa118
--- /dev/null
+++ b/developer-simulation/runs/2026-08-05--fastq-barcode-spill/tests/integration.py
@@ -0,0 +1,200 @@
+#!/usr/bin/env python3
+"""End-to-end acceptance checks without third-party Python packages."""
+
+import hashlib
+import json
+import pathlib
+import random
+import subprocess
+import sys
+import tempfile
+
+ROOT = pathlib.Path(__file__).resolve().parents[1]
+BARCODES = ROOT / "fixtures" / "barcodes.tsv"
+
+
+def run(binary: pathlib.Path, data: bytes, output: pathlib.Path, *, max_open: int = 24):
+    return run_with_map(binary, BARCODES, data, output, max_open=max_open)
+
+
+def run_with_map(
+    binary: pathlib.Path,
+    barcode_map: pathlib.Path,
+    data: bytes,
+    output: pathlib.Path,
+    *,
+    max_open: int = 24,
+):
+    return subprocess.run(
+        [
+            binary,
+            "--barcodes",
+            barcode_map,
+            "--out",
+            output,
+            "--max-open",
+            str(max_open),
+        ],
+        input=data,
+        stdout=subprocess.PIPE,
+        stderr=subprocess.PIPE,
+        check=False,
+    )
+
+
+def checksums(directory: pathlib.Path) -> dict[str, str]:
+    return {
+        path.name: hashlib.sha256(path.read_bytes()).hexdigest()
+        for path in sorted(directory.iterdir())
+        if path.is_file()
+    }
+
+
+def pair(name: str, r1: str, r2: str = "ACGT") -> bytes:
+    return (
+        f"@{name}/1\n{r1}\n+\n{'I' * len(r1)}\n"
+        f"@{name}/2\n{r2}\n+\n{'I' * len(r2)}\n"
+    ).encode("ascii")
+
+
+def main() -> int:
+    binary = pathlib.Path(sys.argv[1]).resolve()
+    clean = (ROOT / "fixtures" / "clean.fastq").read_bytes()
+    mixed = (ROOT / "fixtures" / "mixed.fastq").read_bytes()
+
+    with tempfile.TemporaryDirectory(prefix="fastq-spill-test-") as temp_text:
+        temp = pathlib.Path(temp_text)
+        baseline_out = temp / "baseline"
+        baseline = subprocess.run(
+            [sys.executable, ROOT / "baseline.py", "--barcodes", BARCODES, "--out", baseline_out],
+            input=clean,
+            stdout=subprocess.PIPE,
+            stderr=subprocess.PIPE,
+            check=False,
+        )
+        assert baseline.returncode == 0, baseline.stderr
+
+        rust_out = temp / "rust-clean"
+        result = run(binary, clean, rust_out)
+        assert result.returncode == 0, result.stderr
+        for filename in ["alpha.fastq", "beta.fastq", "gamma.fastq", "delta.fastq", "unmatched.fastq"]:
+            assert (rust_out / filename).read_bytes() == (baseline_out / filename).read_bytes(), filename
+
+        mixed_out = temp / "mixed"
+        result = run(binary, mixed, mixed_out)
+        assert result.returncode == 0, result.stderr
+        manifest = json.loads((mixed_out / "manifest.json").read_text())
+        assert manifest["total_pairs"] == 4
+        assert manifest["exact_pairs"] == 1
+        assert manifest["corrected_pairs"] == 1
+        assert manifest["ambiguous_pairs"] == 1
+        assert manifest["unmatched_pairs"] == 1
+        assert sum(item["pairs"] for item in manifest["samples"]) == 2
+        assert b"@corrected/1" in (mixed_out / "gamma.fastq").read_bytes()
+        assert b"@tie/1" in (mixed_out / "ambiguous.fastq").read_bytes()
+
+        rng = random.Random(20260805)
+        mutated = list("CCCCCCCCCC")
+        position = rng.randrange(10)
+        mutated[position] = rng.choice([base for base in "ACGT" if base != mutated[position]])
+        seeded_out = temp / "seeded-mutation"
+        seeded_data = pair("seeded", "".join(mutated) + "ACGT")
+        result = run(binary, seeded_data, seeded_out)
+        assert result.returncode == 0, result.stderr
+        seeded_manifest = json.loads((seeded_out / "manifest.json").read_text())
+        assert seeded_manifest["corrected_pairs"] == 1
+        assert (seeded_out / "gamma.fastq").read_bytes() == seeded_data
+
+        malformed = {
+            "truncated": (
+                (ROOT / "fixtures" / "truncated.fastq").read_bytes(),
+                b"line 8:",
+            ),
+            "length": (
+                (ROOT / "fixtures" / "unequal.fastq").read_bytes(),
+                b"line 4:",
+            ),
+            "pair-id": (
+                (ROOT / "fixtures" / "mismatched.fastq").read_bytes(),
+                b"line 5:",
+            ),
+        }
+        for name, (data, line_marker) in malformed.items():
+            output = temp / f"bad-{name}"
+            result = run(binary, data, output)
+            assert result.returncode != 0, name
+            assert line_marker in result.stderr, (name, result.stderr)
+            assert not (output / "manifest.json").exists(), name
+            for secret in (b"left", b"right", b"AAAAAAAAAA", b"IIII", b"alpha"):
+                assert secret not in result.stderr, (name, secret, result.stderr)
+
+        identifier_cases = {
+            "empty-id": b"@ /1\nAAAAAAAAAA\n+\nIIIIIIIIII\n@ /2\nACGT\n+\nIIII\n",
+            "control-id": b"@hidden\0/1\nAAAAAAAAAA\n+\nIIIIIIIIII\n@hidden\0/2\nACGT\n+\nIIII\n",
+            "conflicting-role": (
+                b"@dual/1 2:N:0:1\nAAAAAAAAAA\n+\nIIIIIIIIII\n"
+                b"@dual/2 2:N:0:1\nACGT\n+\nIIII\n"
+            ),
+        }
+        for name, data in identifier_cases.items():
+            output = temp / f"bad-{name}"
+            result = run(binary, data, output)
+            assert result.returncode != 0, name
+            assert b"unsupported FASTQ identifier" in result.stderr, (name, result.stderr)
+            assert not (output / "manifest.json").exists(), name
+            for secret in (b"hidden", b"dual", b"AAAAAAAAAA", b"IIII", b"alpha"):
+                assert secret not in result.stderr, (name, secret, result.stderr)
+
+        collision_maps = {
+            "case": "AAAAAAAAAA\tAlpha\nCCCCCCCCCC\talpha\n",
+            "ambiguous": "AAAAAAAAAA\tAmbiguous\n",
+            "unmatched": "AAAAAAAAAA\tUnmatched\n",
+        }
+        for name, contents in collision_maps.items():
+            barcode_map = temp / f"collision-{name}.tsv"
+            barcode_map.write_text(contents)
+            output = temp / f"collision-{name}"
+            result = run_with_map(binary, barcode_map, b"", output)
+            assert result.returncode != 0, name
+            assert not output.exists(), name
+            assert b"Alpha" not in result.stderr and b"Ambiguous" not in result.stderr, result.stderr
+
+        first = temp / "repeat-a"
+        second = temp / "repeat-b"
+        assert run(binary, mixed, first, max_open=2).returncode == 0
+        assert run(binary, mixed, second, max_open=2).returncode == 0
+        assert checksums(first) == checksums(second)
+
+        many_map = temp / "many.tsv"
+        generator = ROOT / "fixtures" / "generate.py"
+        subprocess.run(
+            [sys.executable, generator, "--samples", "30", "--pairs", "0", "--barcodes", many_map],
+            check=True,
+        )
+        many_input = b"".join(pair(f"p{index}", _barcode(index)) for index in range(30))
+        many_out = temp / "many"
+        result = subprocess.run(
+            [binary, "--barcodes", many_map, "--out", many_out, "--max-open", "3"],
+            input=many_input,
+            stdout=subprocess.PIPE,
+            stderr=subprocess.PIPE,
+            check=False,
+        )
+        assert result.returncode == 0, result.stderr
+        assert json.loads((many_out / "manifest.json").read_text())["max_open_writers"] == 3
+
+    print("integration checks passed")
+    return 0
+
+
+def _barcode(index: int) -> str:
+    bases = "ACGT"
+    chars = ["A"] * 10
+    for position in range(9, -1, -1):
+        chars[position] = bases[index & 3]
+        index >>= 2
+    return "".join(chars)
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())
diff --git a/developer-simulation/runs/2026-08-05--parcel-delta-tiles/Cargo.toml b/developer-simulation/runs/2026-08-05--parcel-delta-tiles/Cargo.toml
new file mode 100644
index 0000000..5b61c66
--- /dev/null
+++ b/developer-simulation/runs/2026-08-05--parcel-delta-tiles/Cargo.toml
@@ -0,0 +1,9 @@
+[package]
+name = "parcel-delta-tiles"
+version = "0.1.0"
+edition = "2024"
+publish = false
+
+[dependencies]
+serde = "1"
+serde_json = "1.0.150"
diff --git a/developer-simulation/runs/2026-08-05--parcel-delta-tiles/README.md b/developer-simulation/runs/2026-08-05--parcel-delta-tiles/README.md
new file mode 100644
index 0000000..dea261a
--- /dev/null
+++ b/developer-simulation/runs/2026-08-05--parcel-delta-tiles/README.md
@@ -0,0 +1,68 @@
+# Parcel delta tile planner trial
+
+This is a stateless Rust command that reads parcel edits as NDJSON and prints the
+unique Web Mercator tiles at zooms 12 through 16 touched by an old or new filled
+geometry. It plans only: it does not read parcel state or render, publish, or
+delete tiles.
+
+No BogKit component is used. The root README and examples describe Fold as a
+durable incremental-state engine. This input is already the authoritative delta,
+and the command is forbidden from maintaining or consulting state, so Fold would
+add persistence and retraction machinery without removing the geometry work.
+ESE and ANNy do not address geometry.
+
+## Input and output
+
+Each nonblank input line has this shape:
+
+```json
+{"id":"parcel-42","old":null,"new":{"type":"Polygon","coordinates":[[[0,0],[1,0],[1,1],[0,0]]]}}
+```
+
+`id` is a non-empty string. `old` and `new` are optional or null, but at least
+one must be a GeoJSON `Polygon` or `MultiPolygon`. Positions must contain exactly
+longitude and latitude. Rings must contain at least four positions and be
+closed. Longitudes must be in `[-180, 180]`; latitudes must be within Web
+Mercator's limits. Duplicate JSON members are rejected recursively. Rings must
+have nonzero area and no self-intersection; holes must be strictly contained and
+non-overlapping; MultiPolygon exteriors may not overlap or nest.
+Antimeridian-crossing geometry is explicitly rejected.
+
+Output is one `z/x/y` tile per line, sorted lexicographically by that rendered
+tile ID. A tile counts when its closed rectangle intersects the
+filled polygon, including boundary-only contact. A tile wholly inside a hole is
+excluded; hole boundaries count as contact.
+
+The command validates the complete stream before writing any plan, so an error
+names the input line on stderr and leaves stdout empty.
+
+## Reproduce
+
+Run from the BogKit repository root:
+
+```console
+export CARGO_TARGET_DIR=/private/tmp/parcel-delta-tiles-target
+trial=developer-simulation/runs/2026-08-05--parcel-delta-tiles
+cargo test --offline --locked --manifest-path developer-simulation/Cargo.toml \
+  -p parcel-delta-tiles
+cargo fmt --manifest-path developer-simulation/Cargo.toml -p parcel-delta-tiles -- --check
+cargo clippy --offline --locked --manifest-path developer-simulation/Cargo.toml \
+  -p parcel-delta-tiles --all-targets -- -D warnings
+cargo build --release --offline --locked --manifest-path developer-simulation/Cargo.toml \
+  -p parcel-delta-tiles
+/private/tmp/parcel-delta-tiles-target/release/parcel-delta-tiles "$trial/fixtures/demo.ndjson"
+node "$trial/scripts/reference.ts" "$trial/fixtures/demo.ndjson"
+node "$trial/scripts/verify.ts" /private/tmp/parcel-delta-tiles-target/release/parcel-delta-tiles
+node "$trial/scripts/generate-workload.ts" /private/tmp/parcel-delta-tiles-2026-08-05-diverse.ndjson
+/usr/bin/time -l /private/tmp/parcel-delta-tiles-target/release/parcel-delta-tiles \
+  /private/tmp/parcel-delta-tiles-2026-08-05-diverse.ndjson > /dev/null
+```
+
+`scripts/reference.ts` deliberately scans every candidate tile across the
+complete edited county extent and then scans edit geometries for that tile. It
+is a slow full-scan enumeration mirror, not an independent geometry oracle or a
+production algorithm: it shares the Rust planner's planar intersection design.
+The verifier separately checks 500 axis-aligned rectangles against an analytical
+tile-range construction.
+
+See `TRIAL_REPORT.md` for observed results and limitations.
diff --git a/developer-simulation/runs/2026-08-05--parcel-delta-tiles/TRIAL_REPORT.md b/developer-simulation/runs/2026-08-05--parcel-delta-tiles/TRIAL_REPORT.md
new file mode 100644
index 0000000..87c9ecd
--- /dev/null
+++ b/developer-simulation/runs/2026-08-05--parcel-delta-tiles/TRIAL_REPORT.md
@@ -0,0 +1,401 @@
+# Trial report: `parcel-delta-tiles`
+
+Date: 2026-08-05 (America/New_York)
+
+Checkout: sanitized detached `80fd3c9a023e877fff2e5d127accca386d437af0`
+
+## Outcome
+
+The prototype is a successful, bounded implementation of the requested planner,
+but the BogKit fit decision is **no fit**. Fold's value is durable incremental
+state derived from inserts and retractions. This command is required to be a
+stateless, plan-only transformation whose old and new geometries are already the
+authoritative delta, and it must not read or write a parcel store. ESE and ANNy
+solve embedding and nearest-neighbor problems, not polygon/tile intersection.
+
+The corrected Rust command streams NDJSON one line at a time, rejects duplicate
+JSON members and invalid simple topology before emitting anything, enumerates
+only geometry-bounding candidate tiles, tests
+closed tile rectangles against polygon fill and hole boundaries, deduplicates,
+and renders lexicographically sorted `z/x/y` IDs. It uses only `serde` and
+`serde_json`; it does not depend on or change BogKit core.
+
+## Finishing criteria used
+
+- One runnable Rust NDJSON CLI in the required top-level directory.
+- Old and new `Polygon`/`MultiPolygon` geometry handled without parcel state.
+- Exact agreement with a runnable TypeScript full-scan mirror on the named cases
+  and a 10,000-edit seeded batch, plus an analytical 500-rectangle check that
+  does not share the polygon predicate.
+- A tile wholly inside a hole excluded; boundary-only contact included.
+- Ten input permutations produce byte-identical output.
+- Malformed coordinate, open ring, nonfinite number, unsupported geometry,
+  duplicate JSON members, zero-area/self-intersecting rings, outside holes, and
+  overlapping holes fail deterministically with the input line and empty stdout.
+- A 1,000-edit, 200-distinct-vertex workload stays below 5 seconds and 256 MiB.
+- Unit tests, format check, lint with warnings denied, release build, demo, and
+  workload comparison pass.
+- Only `trial-parcel-delta-tiles` is added; no public example or core file changes.
+
+All criteria passed for the supplied synthetic scope.
+
+## Ordered discovery and friction trail
+
+1. Read the root `README.md` first. It introduces Fold, ESE, ANNy, then lists
+   examples in this order: `starter`, `timeseries`, `chat`, `search`.
+2. Read each listed example in that order, including its manifest and complete
+   public `main.rs`.
+   - `starter` showed persistent `Count`/`Bag` views and retraction.
+   - `timeseries` showed keyed aggregation maintained from mutations.
+   - `chat` showed Fold as durable source of truth.
+   - `search` showed keyed upsert/remove driving three maintained indexes.
+3. Compared those public contracts with the stated baseline: the input already
+   carries authoritative old/new geometry, planning is one-shot, and state access
+   is prohibited. This ruled out Fold before implementation; ESE and ANNy were
+   plainly unrelated.
+4. Inspected the public scaffold. `scripts/new-project.sh` creates under
+   `examples/` and unconditionally adds local Fold, ESE, and ANNy dependencies.
+   The task required a unique top-level directory and no example changes, so the
+   scaffold was not run.
+5. No runnable TypeScript parcel baseline or parcel fixture existed in this
+   sanitized checkout. To make the stated reference behavior executable, added
+   `scripts/reference.ts`. It deliberately scans every candidate tile across the
+   complete edited extent, then scans old/new geometries for that tile.
+6. Ran the TypeScript mirror on `fixtures/demo.ndjson` before compiling Rust. It
+   exited 0 and produced a deterministic plan. The final aligned demo contains
+   72 tiles.
+7. Implemented the Rust parser and intersection planner. The first normal
+   `cargo test` attempted to update crates.io and failed after three DNS retries.
+   This was restricted-network environment friction, not a source or BogKit
+   failure. `cargo test --offline` used cached dependencies and passed.
+8. The first `cargo fmt --check` reported formatting diffs. Ran `cargo fmt`; all
+   subsequent format checks passed. No behavior changed.
+9. The first sandboxed `/usr/bin/time -l` run completed the planner in 0.05 s,
+   but `time` itself exited 1 because sandboxed `sysctl kern.clockrate` was
+   denied. Re-running the exact command with host permission produced valid
+   timing and peak-RSS evidence.
+10. Literal “lexicographically sorted” output was made explicit by sorting the
+    rendered `z/x/y` strings. A focused unit test covers differing digit widths.
+11. The performance generator was corrected to use 200 distinct vertices plus
+    the required repeated ring closure (201 coordinate positions), rather than
+    counting the closure as a vertex. All final evidence below uses the corrected
+    7,910,712-byte workload.
+12. Skeptical review reproduced the declared checks but showed that duplicate
+    JSON members were last-member-wins accepted by both implementations and that
+    self-intersecting, zero-area, and invalid-hole geometry was silently planned.
+    Recursive strict JSON parsing and explicit simple-ring, containment, and
+    non-overlap validation now reject those inputs with no stdout.
+13. Review also rejected calling the TypeScript implementation an independent
+    geometry oracle because it shares the same planar predicate and tolerance.
+    It is now labeled a mirror/enumeration cross-check. The verifier adds 500
+    worldwide axis-aligned rectangles checked against an analytical tile-range
+    construction, plus exact corner and horizontal/vertical boundary cases.
+14. The final workload was diversified across inserts, deletes, replacements,
+    concave polygons, holes, MultiPolygons, four extents, and a wider synthetic
+    county. It has 1,000 lines, 200 distinct vertices per line, 2,922 output
+    tiles, and is 7,977,879 bytes. The corrected Rust result matched the mirror,
+    then completed in 0.14 seconds with 2,670,592 bytes maximum RSS. The mirror
+    took 11.99 seconds and 169,312,256 bytes RSS on the same host-specific input.
+
+## Implementation boundary
+
+Durable files are all under this directory:
+
+- `src/lib.rs`: strict per-line parsing, simple-topology validation, Web Mercator conversion, candidate
+  enumeration, rectangle/polygon intersection, hole handling, set construction,
+  and output formatting.
+- `src/main.rs`: stdin/file CLI and delayed output.
+- `scripts/reference.ts`: slow TypeScript full-scan mirror with independent
+  enumeration but shared planar geometry rules.
+- `scripts/verify.ts`: named mirror comparisons, 10,000 seeded edits, 500
+  analytical rectangles, ten permutations, and deterministic malformed checks.
+- `scripts/generate-workload.ts`: deterministic diverse 1,000 × 200-vertex workload.
+- `fixtures/`: demo and four malformed cases.
+- `README.md`: exact input contract and reproduction commands.
+
+Generated workload data is disposable at
+`/private/tmp/parcel-delta-tiles-2026-08-05-diverse.ndjson`; it is not part of the trial.
+
+## Exact verification and observed results
+
+Commands were run from `trial-parcel-delta-tiles` unless noted.
+
+### Focused tests, formatting, lint, release
+
+```console
+$ cargo test --offline
+```
+
+Exit 0. Eight unit tests passed, including exact edge and four-way corner
+touches, a tile wholly inside a hole, recursive duplicate rejection, invalid
+topology rejection, line-specific malformed input, and lexicographic ordering.
+
+```console
+$ cargo fmt --check
+```
+
+Exit 0 after applying the formatter once.
+
+```console
+$ cargo clippy --offline --all-targets -- -D warnings
+```
+
+Exit 0, no warnings.
+
+```console
+$ cargo build --release --offline
+```
+
+Exit 0. Final incremental release build completed in 0.48 s.
+
+### Demo and baseline comparison
+
+```console
+$ target/release/parcel-delta-tiles fixtures/demo.ndjson | wc -l
+      72
+$ cmp <(target/release/parcel-delta-tiles fixtures/demo.ndjson) \
+      <(node scripts/reference.ts fixtures/demo.ndjson)
+```
+
+`cmp` exited 0: the 72-line plans were byte-identical.
+
+### Mirror, analytical, permutation, and malformed cases
+
+```console
+$ node scripts/verify.ts target/release/parcel-delta-tiles
+```
+
+Exit 0 with:
+
+```text
+mirror insertion: exact (17 tiles)
+mirror deletion: exact (17 tiles)
+mirror translation: exact (19 tiles)
+mirror concavity: exact (37 tiles)
+mirror holes: exact (69 tiles)
+mirror multipolygon: exact (8 tiles)
+mirror boundary-touch: exact (6 tiles)
+mirror seeded-10000: exact (11 tiles)
+analytical rectangles: 500 edits exact (34650 tiles)
+permutations: 10/10 byte-identical
+malformed open-ring: deterministic line 2, empty stdout
+malformed coordinate: deterministic line 1, empty stdout
+malformed nonfinite: deterministic line 1, empty stdout
+malformed unsupported-type: deterministic line 1, empty stdout
+malformed duplicate-edit: deterministic line 2, empty stdout
+malformed duplicate-geometry: deterministic line 1, empty stdout
+malformed duplicate-nested: deterministic line 1, empty stdout
+malformed self-intersection: deterministic line 1, empty stdout
+malformed zero-area: deterministic line 1, empty stdout
+malformed hole-outside: deterministic line 1, empty stdout
+malformed hole-overlap: deterministic line 1, empty stdout
+verification complete
+```
+
+Each malformed case was run twice by the verifier. Diagnostics identify the
+input line and a static structural reason without partial stdout. The duplicate
+edit regression deliberately places valid line 1 before invalid line 2.
+
+```text
+input line 1: new.coordinates[0][1][0] longitude is outside [-180, 180]
+input line 1: invalid JSON: number out of range at line 1 column 70
+input line 1: new.type "LineString" is unsupported
+input line 2: invalid JSON: duplicate object member `new` ...
+input line 1: new.coordinates[0] self-intersects
+input line 1: new.coordinates[0] has zero area
+input line 1: new.coordinates[1] must be strictly inside the exterior ring
+input line 1: new.coordinates[1] and new.coordinates[2] overlap or nest
+```
+
+All eleven malformed cases had status 1 and zero stdout.
+
+### Full numeric workload and resource evidence
+
+```console
+$ node scripts/generate-workload.ts /private/tmp/parcel-delta-tiles-2026-08-05-diverse.ndjson
+wrote 1000 mixed-operation edits with 200 distinct vertices per line to /private/tmp/parcel-delta-tiles-2026-08-05-diverse.ndjson
+$ wc -l -c /private/tmp/parcel-delta-tiles-2026-08-05-diverse.ndjson
+    1000 7977879 /private/tmp/parcel-delta-tiles-2026-08-05-diverse.ndjson
+```
+
+The final generator mixes inserts, deletes, and replacements; concave polygons,
+polygons with holes, and MultiPolygons; four feature extents; and varied locations
+across a wider synthetic county. Every line contains exactly 200 distinct vertices
+across its old/new geometry, plus required repeated closures.
+
+```console
+$ cmp <(target/release/parcel-delta-tiles /private/tmp/parcel-delta-tiles-2026-08-05-diverse.ndjson) \
+      <(node scripts/reference.ts /private/tmp/parcel-delta-tiles-2026-08-05-diverse.ndjson)
+$ target/release/parcel-delta-tiles /private/tmp/parcel-delta-tiles-2026-08-05-diverse.ndjson | wc -l
+    2922
+```
+
+`cmp` exited 0: the full diverse 1,000 × 200 workload matched the mirror exactly.
+
+Final host-permitted measurement:
+
+```console
+$ /usr/bin/time -l target/release/parcel-delta-tiles \
+    /private/tmp/parcel-delta-tiles-2026-08-05-diverse.ndjson > /dev/null
+```
+
+The corrected diverse run observed 0.14 s real and 2,670,592 bytes maximum RSS.
+This one-host input-specific result is far below 5 s and 256 MiB.
+
+For a bounded same-input comparison only:
+
+```console
+$ /usr/bin/time -l node scripts/reference.ts \
+    /private/tmp/parcel-delta-tiles-2026-08-05-diverse.ndjson > /dev/null
+```
+
+Observed 11.99 s real and 169,312,256 bytes maximum RSS. This is one run of the
+trial-created mirror, not evidence for or against the brief's reported roughly
+40-minute production baseline.
+
+## Acceptance audit
+
+| Requirement | Result | Evidence |
+| --- | --- | --- |
+| Insertion/deletion/replacement | Pass | named mirror cases and mixed final workload |
+| Concavity | Pass | named case and mixed final workload |
+| Holes | Pass | mirror case, wholly-inside-hole assertion, and mixed workload |
+| Multipolygons | Pass | mirror case and mixed workload |
+| Boundary touches | Pass | vertical edge, four-way corner, hole boundary, and reviewer probes |
+| 10,000 seeded valid edits | Pass | byte-exact mirror comparison |
+| 500 analytical rectangles | Pass | 34,650 tiles matched independent range construction |
+| Ten permutations | Pass | 10/10 byte-identical |
+| 1,000 × 200 under 5 s/256 MiB | Pass | diverse run: 0.14 s, 2,670,592-byte RSS |
+| Malformed line/no partial plan | Pass | eleven deterministic cases, empty stdout |
+| Plan only | Pass | CLI has no rendering, publishing, deletion, or parcel-store path |
+
+## Categorized findings
+
+### 1. No BogKit component fits the authoritative-delta planner
+
+- Category: fit decision, not a defect
+- Severity: informational
+- Confidence: high
+- Reproduction: read the public examples, then compare their durable stream/view
+  contracts with the prohibited-state, authoritative-old/new brief.
+- Smallest improvement: a short “when not to use Fold” paragraph in the root
+  README would help new Rust users reach this conclusion quickly.
+
+### 2. The prototype meets the bounded functional and numeric acceptance checks
+
+- Category: prototype result
+- Severity: success
+- Confidence: high for the generated and named fixtures; medium for arbitrary
+  production cadastral data
+- Reproduction: `node scripts/verify.ts target/release/parcel-delta-tiles` and
+  the full-workload commands above.
+- Smallest improvement: before production adoption, replay a captured county
+  corpus against the actual existing TypeScript reference.
+
+### 3. The stated runnable TypeScript baseline was absent from the sanitized checkout
+
+- Category: trial-input/baseline gap, not a BogKit defect
+- Severity: medium because exact production equivalence cannot be established
+- Confidence: high
+- Reproduction: the initial public file inventory contained only BogKit root,
+  crates, scripts, and examples; no parcel baseline or county fixture.
+- Smallest improvement: supply the baseline command, fixture/schema, expected
+  checksum, and host description with the brief.
+
+### 4. The public project generator installs all three local components
+
+- Category: BogKit onboarding friction, not a core correctness defect
+- Severity: low
+- Confidence: high
+- Reproduction: inspect `scripts/new-project.sh`; it always adds `fold`, `ese`,
+  and `anny`, while the README notes they may not all be used.
+- Smallest improvement: add a dependency-free/minimal mode or prompt for only
+  the components selected after fit evaluation.
+
+### 5. Duplicate members and invalid topology were false-accepted, fixed
+
+- Category: prototype correctness defects, not BogKit defects
+- Severity: high
+- Confidence: high
+- Reproduction: review showed last-member-wins duplicate `new`, a bow-tie ring,
+  a zero-area ring, a hole outside its exterior, and overlapping holes all
+  produced plans. The corrected verifier preserves each minimal case.
+- Smallest improvement completed: reject duplicate object members recursively;
+  reject zero-length/zero-area/self-intersecting rings, non-contained holes,
+  overlapping/nested holes, and overlapping/nested MultiPolygon exteriors.
+
+### 6. The TypeScript comparison is a mirror, not an independent geometry oracle
+
+- Category: evidence limitation
+- Severity: medium for a production go/no-go decision
+- Confidence: high
+- Reproduction: Rust and TypeScript use different enumeration strategies but
+  share parsing rules, tolerance, clipping, point-in-ring, and hole logic.
+- Smallest improvement completed: relabel it as an enumeration mirror and add a
+  500-rectangle analytical range check. Production adoption still needs the real
+  county reference or a genuinely independent geometry engine.
+
+### 7. The normal Cargo path attempted network access despite cached dependencies
+
+- Category: environment/onboarding friction, not a BogKit defect
+- Severity: low
+- Confidence: high
+- Reproduction: `cargo test` failed with `Could not resolve host:
+  index.crates.io`; `cargo test --offline` immediately resolved cached crates and
+  passed.
+- Smallest improvement: document `--offline` for sanitized lab runs or pre-create
+  the trial lockfile before the first build.
+
+### 8. Evidence remains scoped to a planar, synthetic contract
+
+- Category: evidence limitation
+- Severity: medium for a production go/no-go decision
+- Confidence: high
+- Reproduction: compare the local straight-longitude/latitude predicate and
+  synthetic workload with the absent production convention and county corpus.
+- Smallest improvement: replay captured production data against the supplied
+  production reference and independently chosen geometry library.
+
+## Decision audit
+
+| Choice | Decision | Reason |
+| --- | --- | --- |
+| Fold | Reject | Requires durable mutation-derived state; this input is already the delta and state access is forbidden. |
+| ESE | Reject | Embeddings do not contribute to spatial tile planning. |
+| ANNy | Reject | Approximate nearest-neighbor indexing does not answer exact polygon/tile intersection. |
+| Stateless Rust + strict `serde`/`serde_json` parsing | Select | Meets the bounded streaming, deterministic, and reviewed simple-topology contract. |
+| External geometry crate | Reject for one-day prototype | Cached availability was unverified. The corrected simple-topology validator covers the named boundary, but a proven library should be reconsidered for production validity. |
+| Emit as each line parses | Reject | Would violate no-partial-plan behavior on a later malformed line. |
+| Buffer all parsed edits | Reject | Unnecessary; parse and accumulate tiles per line to keep memory bounded by one edit plus the result set. |
+| Scan all world/county tiles in Rust | Reject | Repeats baseline pain; enumerate each polygon's closed bounding tile range instead. |
+| Use the public scaffold | Reject | It would modify `examples/`, violate the requested top-level layout, and add unrelated dependencies. |
+
+## Unresolved uncertainty
+
+- The real TypeScript baseline, real synthetic-county fixture, and reported
+  40-minute environment were unavailable, so production equivalence and speedup
+  are unverified.
+- The corrected validator covers recursive duplicates, simple nonzero rings,
+  hole containment/non-overlap, and MultiPolygon exterior non-overlap. It is not
+  a formal implementation of every GeoJSON validity recommendation.
+- The implementation treats GeoJSON edges as straight longitude/latitude
+  segments and tile rectangles as closed. That matches the local reference, but
+  the production reference's geodesic/planar convention was not supplied.
+- Boundary decisions use a small floating-point tolerance. Exact vertical edge,
+  four-way corner, hole boundary, horizontal edge, and maximum-Mercator probes
+  passed, but a production corpus should add many generated boundary cases.
+- The resource evidence is host-specific. The final workload is more diverse
+  than the initial 16-tile fixture but still synthetic.
+  Very large polygons generate proportionally more candidate tiles and a very
+  large final plan necessarily consumes more memory.
+- Output order is lexicographic over rendered `z/x/y` strings. If the consumer
+  intended numeric tuple order instead, the schema must say so explicitly.
+
+## Scope and defect attribution
+
+No BogKit core defect was found because no BogKit runtime component fits this
+workload and none is used. The unconditional scaffold dependencies are a small
+onboarding issue. Missing production baseline evidence belongs to the trial
+setup. Geometry-validity and evidence limits belong to this prototype. Git status
+at handoff showed detached HEAD with only `?? trial-parcel-delta-tiles/`; no core
+or public example was modified.
diff --git a/developer-simulation/runs/2026-08-05--parcel-delta-tiles/fixtures/demo.ndjson b/developer-simulation/runs/2026-08-05--parcel-delta-tiles/fixtures/demo.ndjson
new file mode 100644
index 0000000..64ff421
--- /dev/null
+++ b/developer-simulation/runs/2026-08-05--parcel-delta-tiles/fixtures/demo.ndjson
@@ -0,0 +1,3 @@
+{"id":"insert","new":{"type":"Polygon","coordinates":[[[-73.990,40.720],[-73.980,40.720],[-73.980,40.730],[-73.990,40.730],[-73.990,40.720]]]}}
+{"id":"replace","old":{"type":"Polygon","coordinates":[[[-73.975,40.721],[-73.970,40.721],[-73.970,40.726],[-73.975,40.726],[-73.975,40.721]]]},"new":{"type":"Polygon","coordinates":[[[-73.974,40.722],[-73.969,40.722],[-73.969,40.727],[-73.974,40.727],[-73.974,40.722]]]}}
+{"id":"hole","old":{"type":"Polygon","coordinates":[[[-74.010,40.710],[-73.995,40.710],[-73.995,40.735],[-74.010,40.735],[-74.010,40.710]],[[-74.005,40.715],[-74.000,40.715],[-74.000,40.725],[-74.005,40.725],[-74.005,40.715]]]}}
diff --git a/developer-simulation/runs/2026-08-05--parcel-delta-tiles/fixtures/malformed-coordinate.ndjson b/developer-simulation/runs/2026-08-05--parcel-delta-tiles/fixtures/malformed-coordinate.ndjson
new file mode 100644
index 0000000..c75a003
--- /dev/null
+++ b/developer-simulation/runs/2026-08-05--parcel-delta-tiles/fixtures/malformed-coordinate.ndjson
@@ -0,0 +1 @@
+{"id":"bad-coordinate","new":{"type":"Polygon","coordinates":[[[0,0],[181,0],[1,1],[0,0]]]}}
diff --git a/developer-simulation/runs/2026-08-05--parcel-delta-tiles/fixtures/malformed-nonfinite.ndjson b/developer-simulation/runs/2026-08-05--parcel-delta-tiles/fixtures/malformed-nonfinite.ndjson
new file mode 100644
index 0000000..748725a
--- /dev/null
+++ b/developer-simulation/runs/2026-08-05--parcel-delta-tiles/fixtures/malformed-nonfinite.ndjson
@@ -0,0 +1 @@
+{"id":"nonfinite","new":{"type":"Polygon","coordinates":[[[0,0],[1e400,0],[1,1],[0,0]]]}}
diff --git a/developer-simulation/runs/2026-08-05--parcel-delta-tiles/fixtures/malformed-open-ring.ndjson b/developer-simulation/runs/2026-08-05--parcel-delta-tiles/fixtures/malformed-open-ring.ndjson
new file mode 100644
index 0000000..04068c2
--- /dev/null
+++ b/developer-simulation/runs/2026-08-05--parcel-delta-tiles/fixtures/malformed-open-ring.ndjson
@@ -0,0 +1,2 @@
+{"id":"ok","new":{"type":"Polygon","coordinates":[[[-73.99,40.72],[-73.98,40.72],[-73.98,40.73],[-73.99,40.72]]]}}
+{"id":"bad","new":{"type":"Polygon","coordinates":[[[0,0],[1,0],[1,1],[0,1]]]}}
diff --git a/developer-simulation/runs/2026-08-05--parcel-delta-tiles/fixtures/malformed-type.ndjson b/developer-simulation/runs/2026-08-05--parcel-delta-tiles/fixtures/malformed-type.ndjson
new file mode 100644
index 0000000..67a22d3
--- /dev/null
+++ b/developer-simulation/runs/2026-08-05--parcel-delta-tiles/fixtures/malformed-type.ndjson
@@ -0,0 +1 @@
+{"id":"bad-type","new":{"type":"LineString","coordinates":[[0,0],[1,1]]}}
diff --git a/developer-simulation/runs/2026-08-05--parcel-delta-tiles/scripts/generate-workload.ts b/developer-simulation/runs/2026-08-05--parcel-delta-tiles/scripts/generate-workload.ts
new file mode 100644
index 0000000..c75ebfe
--- /dev/null
+++ b/developer-simulation/runs/2026-08-05--parcel-delta-tiles/scripts/generate-workload.ts
@@ -0,0 +1,97 @@
+#!/usr/bin/env node
+import { writeFileSync } from "node:fs";
+
+const output = process.argv[2];
+if (!output) {
+  process.stderr.write("usage: node scripts/generate-workload.ts OUTPUT.ndjson\n");
+  process.exit(2);
+}
+
+function seeded(seed: number): () => number {
+  let state = seed >>> 0;
+  return () => {
+    state = (Math.imul(state, 1664525) + 1013904223) >>> 0;
+    return state / 2 ** 32;
+  };
+}
+
+const random = seeded(0x200faced);
+const lines: string[] = [];
+
+type Position = [number, number];
+type Geometry = { type: "Polygon" | "MultiPolygon"; coordinates: unknown };
+
+function ring(
+  centerX: number,
+  centerY: number,
+  vertices: number,
+  radius: number,
+  alternating = true,
+): Position[] {
+  const positions: Position[] = [];
+  for (let vertex = 0; vertex < vertices; vertex += 1) {
+    const angle = (vertex / vertices) * Math.PI * 2;
+    const localRadius = alternating && vertex % 2 === 1 ? radius * 0.72 : radius;
+    positions.push([
+      centerX + Math.cos(angle) * localRadius,
+      centerY + Math.sin(angle) * localRadius,
+    ]);
+  }
+  positions.push(positions[0]);
+  return positions;
+}
+
+function geometry(
+  mode: number,
+  centerX: number,
+  centerY: number,
+  vertices: number,
+  radius: number,
+): Geometry {
+  if (mode === 1) {
+    const holeVertices = Math.max(4, Math.floor(vertices / 4));
+    const outerVertices = vertices - holeVertices;
+    return {
+      type: "Polygon",
+      coordinates: [
+        ring(centerX, centerY, outerVertices, radius),
+        ring(centerX, centerY, holeVertices, radius * 0.24, false),
+      ],
+    };
+  }
+  if (mode === 2) {
+    const firstVertices = Math.floor(vertices / 2);
+    const secondVertices = vertices - firstVertices;
+    return {
+      type: "MultiPolygon",
+      coordinates: [
+        [ring(centerX - radius * 1.6, centerY, firstVertices, radius)],
+        [ring(centerX + radius * 1.6, centerY, secondVertices, radius)],
+      ],
+    };
+  }
+  return { type: "Polygon", coordinates: [ring(centerX, centerY, vertices, radius)] };
+}
+
+for (let edit = 0; edit < 1_000; edit += 1) {
+  const centerX = -74.10 + random() * 0.20;
+  const centerY = 40.65 + random() * 0.20;
+  const radii = [0.0002, 0.001, 0.004, 0.01];
+  const radius = radii[edit % radii.length];
+  const mode = Math.floor(edit / 3) % 3;
+  const operation = edit % 3;
+  const entry: Record<string, unknown> = { id: `load-${edit}` };
+  if (operation === 0) {
+    entry.new = geometry(mode, centerX, centerY, 200, radius);
+  } else if (operation === 1) {
+    entry.old = geometry(mode, centerX, centerY, 200, radius);
+  } else {
+    entry.old = geometry(mode, centerX, centerY, 100, radius);
+    entry.new = geometry(mode, centerX + radius * 0.3, centerY - radius * 0.2, 100, radius);
+  }
+  lines.push(JSON.stringify(entry));
+}
+writeFileSync(output, `${lines.join("\n")}\n`);
+process.stdout.write(
+  `wrote 1000 mixed-operation edits with 200 distinct vertices per line to ${output}\n`,
+);
diff --git a/developer-simulation/runs/2026-08-05--parcel-delta-tiles/scripts/reference.ts b/developer-simulation/runs/2026-08-05--parcel-delta-tiles/scripts/reference.ts
new file mode 100644
index 0000000..803e2d5
--- /dev/null
+++ b/developer-simulation/runs/2026-08-05--parcel-delta-tiles/scripts/reference.ts
@@ -0,0 +1,278 @@
+#!/usr/bin/env node
+import { readFileSync } from "node:fs";
+import { pathToFileURL } from "node:url";
+
+type Point = [number, number];
+type Ring = Point[];
+type Polygon = Ring[];
+type MultiPolygon = Polygon[];
+type Rect = { minX: number; minY: number; maxX: number; maxY: number };
+
+const MIN_ZOOM = 12;
+const MAX_ZOOM = 16;
+const MAX_MERCATOR_LAT = 85.0511287798066;
+const EPS = 1e-12;
+
+function fail(message: string): never {
+  throw new Error(message);
+}
+
+function parsePosition(value: unknown, path: string): Point {
+  if (!Array.isArray(value) || value.length !== 2) {
+    fail(`${path} must contain exactly longitude and latitude`);
+  }
+  const [longitude, latitude] = value as unknown[];
+  if (typeof longitude !== "number" || !Number.isFinite(longitude)) {
+    fail(`${path}[0] must be a finite number`);
+  }
+  if (typeof latitude !== "number" || !Number.isFinite(latitude)) {
+    fail(`${path}[1] must be a finite number`);
+  }
+  if (longitude < -180 || longitude > 180) {
+    fail(`${path}[0] longitude is outside [-180, 180]`);
+  }
+  if (latitude < -MAX_MERCATOR_LAT || latitude > MAX_MERCATOR_LAT) {
+    fail(`${path}[1] latitude is outside Web Mercator limits`);
+  }
+  return [longitude, latitude];
+}
+
+function parseRing(value: unknown, path: string): Ring {
+  if (!Array.isArray(value) || value.length < 4) {
+    fail(`${path} must contain at least four positions`);
+  }
+  const ring = value.map((position, index) => parsePosition(position, `${path}[${index}]`));
+  const first = ring[0];
+  const last = ring[ring.length - 1];
+  if (first[0] !== last[0] || first[1] !== last[1]) {
+    fail(`${path} is open; first and last positions must match`);
+  }
+  return ring;
+}
+
+function parsePolygon(value: unknown, path: string): Polygon {
+  if (!Array.isArray(value) || value.length === 0) {
+    fail(`${path} must contain an exterior ring`);
+  }
+  return value.map((ring, index) => parseRing(ring, `${path}[${index}]`));
+}
+
+function parseGeometry(value: unknown, field: string): MultiPolygon {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) {
+    fail(`${field} geometry must be an object`);
+  }
+  const object = value as Record<string, unknown>;
+  let polygons: MultiPolygon;
+  if (object.type === "Polygon") {
+    polygons = [parsePolygon(object.coordinates, `${field}.coordinates`)];
+  } else if (object.type === "MultiPolygon") {
+    if (!Array.isArray(object.coordinates) || object.coordinates.length === 0) {
+      fail(`${field}.coordinates must contain at least one polygon`);
+    }
+    polygons = object.coordinates.map((polygon, index) =>
+      parsePolygon(polygon, `${field}.coordinates[${index}]`),
+    );
+  } else {
+    fail(`${field}.type ${JSON.stringify(object.type)} is unsupported`);
+  }
+  const longitudes = polygons.flat(2).map((point) => point[0]);
+  if (Math.max(...longitudes) - Math.min(...longitudes) > 180) {
+    fail(`${field} crosses the antimeridian, which this prototype does not support`);
+  }
+  return polygons;
+}
+
+export function parseNdjson(text: string): MultiPolygon[] {
+  const lines = text.split(/\r?\n/);
+  if (lines.at(-1) === "") lines.pop();
+  const geometries: MultiPolygon[] = [];
+  for (const [index, line] of lines.entries()) {
+    const lineNumber = index + 1;
+    if (line.trim() === "") fail(`input line ${lineNumber}: blank line`);
+    try {
+      const value: unknown = JSON.parse(line);
+      if (value === null || typeof value !== "object" || Array.isArray(value)) {
+        fail("edit must be a JSON object");
+      }
+      const edit = value as Record<string, unknown>;
+      if (typeof edit.id !== "string" || edit.id.length === 0) {
+        fail("id must be a non-empty string");
+      }
+      let count = 0;
+      for (const field of ["old", "new"] as const) {
+        if (edit[field] !== undefined && edit[field] !== null) {
+          geometries.push(parseGeometry(edit[field], field));
+          count += 1;
+        }
+      }
+      if (count === 0) fail("at least one of old or new must contain a geometry");
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      if (message.startsWith("input line ")) throw error;
+      fail(`input line ${lineNumber}: ${message}`);
+    }
+  }
+  return geometries;
+}
+
+function bounds(polygon: Polygon): Rect {
+  const points = polygon.flat();
+  return {
+    minX: Math.min(...points.map(([x]) => x)),
+    minY: Math.min(...points.map(([, y]) => y)),
+    maxX: Math.max(...points.map(([x]) => x)),
+    maxY: Math.max(...points.map(([, y]) => y)),
+  };
+}
+
+function lonToWorldX(longitude: number, n: number): number {
+  return ((longitude + 180) / 360) * n;
+}
+
+function latToWorldY(latitude: number, n: number): number {
+  const radians = (latitude * Math.PI) / 180;
+  return ((1 - Math.asinh(Math.tan(radians)) / Math.PI) / 2) * n;
+}
+
+function touchingRange(min: number, max: number, n: number): [number, number] {
+  const nearInteger = (value: number) => Math.abs(value - Math.round(value)) <= 1e-10;
+  const lower = nearInteger(min) ? Math.round(min) - 1 : Math.floor(min);
+  const upper = nearInteger(max) ? Math.round(max) : Math.floor(max);
+  return [Math.max(0, lower), Math.min(n - 1, upper)];
+}
+
+function worldYToLatitude(y: number, n: number): number {
+  return (Math.atan(Math.sinh(Math.PI * (1 - (2 * y) / n))) * 180) / Math.PI;
+}
+
+function tileRect(z: number, x: number, y: number): Rect {
+  const n = 2 ** z;
+  return {
+    minX: (x / n) * 360 - 180,
+    maxX: ((x + 1) / n) * 360 - 180,
+    minY: worldYToLatitude(y + 1, n),
+    maxY: worldYToLatitude(y, n),
+  };
+}
+
+function segmentIntersectsRect([ax, ay]: Point, [bx, by]: Point, rect: Rect): boolean {
+  const dx = bx - ax;
+  const dy = by - ay;
+  let tMin = 0;
+  let tMax = 1;
+  const clips: [number, number][] = [
+    [-dx, ax - rect.minX],
+    [dx, rect.maxX - ax],
+    [-dy, ay - rect.minY],
+    [dy, rect.maxY - ay],
+  ];
+  for (const [p, q] of clips) {
+    if (Math.abs(p) <= EPS) {
+      if (q < -EPS) return false;
+    } else {
+      const ratio = q / p;
+      if (p < 0) tMin = Math.max(tMin, ratio);
+      else tMax = Math.min(tMax, ratio);
+      if (tMin - tMax > EPS) return false;
+    }
+  }
+  return true;
+}
+
+type Location = "outside" | "inside" | "boundary";
+
+function pointOnSegment([px, py]: Point, [ax, ay]: Point, [bx, by]: Point): boolean {
+  const cross = (bx - ax) * (py - ay) - (by - ay) * (px - ax);
+  const scale = Math.abs(bx - ax) + Math.abs(by - ay) + 1;
+  return (
+    Math.abs(cross) <= EPS * scale &&
+    px >= Math.min(ax, bx) - EPS &&
+    px <= Math.max(ax, bx) + EPS &&
+    py >= Math.min(ay, by) - EPS &&
+    py <= Math.max(ay, by) + EPS
+  );
+}
+
+function pointInRing(point: Point, ring: Ring): Location {
+  let inside = false;
+  for (let index = 0; index + 1 < ring.length; index += 1) {
+    const a = ring[index];
+    const b = ring[index + 1];
+    if (pointOnSegment(point, a, b)) return "boundary";
+    if ((a[1] > point[1]) !== (b[1] > point[1])) {
+      const crossingX = ((b[0] - a[0]) * (point[1] - a[1])) / (b[1] - a[1]) + a[0];
+      if (crossingX > point[0]) inside = !inside;
+    }
+  }
+  return inside ? "inside" : "outside";
+}
+
+function pointInFilledPolygon(point: Point, polygon: Polygon): boolean {
+  const exterior = pointInRing(point, polygon[0]);
+  if (exterior === "outside") return false;
+  if (exterior === "boundary") return true;
+  return !polygon.slice(1).some((hole) => pointInRing(point, hole) === "inside");
+}
+
+function polygonIntersectsRect(polygon: Polygon, rect: Rect): boolean {
+  for (const ring of polygon) {
+    for (let index = 0; index + 1 < ring.length; index += 1) {
+      if (segmentIntersectsRect(ring[index], ring[index + 1], rect)) return true;
+    }
+  }
+  const corners: Point[] = [
+    [rect.minX, rect.minY],
+    [rect.minX, rect.maxY],
+    [rect.maxX, rect.minY],
+    [rect.maxX, rect.maxY],
+  ];
+  return corners.some((corner) => pointInFilledPolygon(corner, polygon));
+}
+
+export function fullScanPlan(geometries: MultiPolygon[]): string[] {
+  const polygons = geometries.flat();
+  const countyBounds = polygons.map(bounds).reduce((a, b) => ({
+    minX: Math.min(a.minX, b.minX),
+    minY: Math.min(a.minY, b.minY),
+    maxX: Math.max(a.maxX, b.maxX),
+    maxY: Math.max(a.maxY, b.maxY),
+  }));
+  const output: string[] = [];
+  for (let z = MIN_ZOOM; z <= MAX_ZOOM; z += 1) {
+    const n = 2 ** z;
+    const [xStart, xEnd] = touchingRange(
+      lonToWorldX(countyBounds.minX, n),
+      lonToWorldX(countyBounds.maxX, n),
+      n,
+    );
+    const yA = latToWorldY(countyBounds.minY, n);
+    const yB = latToWorldY(countyBounds.maxY, n);
+    const [yStart, yEnd] = touchingRange(Math.min(yA, yB), Math.max(yA, yB), n);
+    for (let x = xStart; x <= xEnd; x += 1) {
+      for (let y = yStart; y <= yEnd; y += 1) {
+        const rect = tileRect(z, x, y);
+        if (polygons.some((polygon) => polygonIntersectsRect(polygon, rect))) {
+          output.push(`${z}/${x}/${y}`);
+        }
+      }
+    }
+  }
+  return output.sort();
+}
+
+function main(): void {
+  const path = process.argv[2] ?? "-";
+  const text = path === "-" ? readFileSync(0, "utf8") : readFileSync(path, "utf8");
+  const output = fullScanPlan(parseNdjson(text));
+  if (output.length > 0) process.stdout.write(`${output.join("\n")}\n`);
+}
+
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
+  try {
+    main();
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    process.stderr.write(`${message}\n`);
+    process.exitCode = 1;
+  }
+}
diff --git a/developer-simulation/runs/2026-08-05--parcel-delta-tiles/scripts/verify.ts b/developer-simulation/runs/2026-08-05--parcel-delta-tiles/scripts/verify.ts
new file mode 100644
index 0000000..0088f89
--- /dev/null
+++ b/developer-simulation/runs/2026-08-05--parcel-delta-tiles/scripts/verify.ts
@@ -0,0 +1,321 @@
+#!/usr/bin/env node
+import { mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join, resolve } from "node:path";
+import { spawnSync } from "node:child_process";
+import { fileURLToPath } from "node:url";
+
+type Position = [number, number];
+type Geometry = { type: "Polygon" | "MultiPolygon"; coordinates: unknown };
+type Edit = { id: string; old?: Geometry | null; new?: Geometry | null };
+
+const binary = resolve(process.argv[2] ?? "target/release/parcel-delta-tiles");
+const root = resolve(fileURLToPath(new URL("..", import.meta.url)));
+const reference = join(root, "scripts/reference.ts");
+const work = mkdtempSync(join(tmpdir(), "parcel-delta-verify-"));
+
+function rectangle(minX: number, minY: number, maxX: number, maxY: number): Geometry {
+  return {
+    type: "Polygon",
+    coordinates: [[
+      [minX, minY],
+      [maxX, minY],
+      [maxX, maxY],
+      [minX, maxY],
+      [minX, minY],
+    ]],
+  };
+}
+
+function ndjson(edits: Edit[]): string {
+  return `${edits.map((edit) => JSON.stringify(edit)).join("\n")}\n`;
+}
+
+function run(command: string, args: string[]) {
+  return spawnSync(command, args, { encoding: "utf8", maxBuffer: 64 * 1024 * 1024 });
+}
+
+function compare(label: string, edits: Edit[]): string {
+  const path = join(work, `${label}.ndjson`);
+  writeFileSync(path, ndjson(edits));
+  const actual = run(binary, [path]);
+  const expected = run(process.execPath, [reference, path]);
+  if (actual.status !== 0) throw new Error(`${label}: Rust failed: ${actual.stderr}`);
+  if (expected.status !== 0) throw new Error(`${label}: reference failed: ${expected.stderr}`);
+  if (actual.stdout !== expected.stdout) {
+    const actualLines = actual.stdout.trim().split("\n");
+    const expectedLines = expected.stdout.trim().split("\n");
+    throw new Error(
+      `${label}: mismatch; Rust=${actualLines.length} tiles reference=${expectedLines.length} tiles`,
+    );
+  }
+  const count = actual.stdout === "" ? 0 : actual.stdout.trim().split("\n").length;
+  console.log(`mirror ${label}: exact (${count} tiles)`);
+  return actual.stdout;
+}
+
+function tileLongitude(x: number, z: number): number {
+  return (x / 2 ** z) * 360 - 180;
+}
+
+function tileLatitude(y: number, z: number): number {
+  return (Math.atan(Math.sinh(Math.PI * (1 - (2 * y) / 2 ** z))) * 180) / Math.PI;
+}
+
+function seeded(seed: number): () => number {
+  let state = seed >>> 0;
+  return () => {
+    state = (Math.imul(state, 1664525) + 1013904223) >>> 0;
+    return state / 2 ** 32;
+  };
+}
+
+function seededEdits(count: number, seed: number): Edit[] {
+  const random = seeded(seed);
+  const edits: Edit[] = [];
+  for (let index = 0; index < count; index += 1) {
+    const x = -73.991 + random() * 0.008;
+    const y = 40.721 + random() * 0.008;
+    const width = 0.00003 + random() * 0.00008;
+    const height = 0.00003 + random() * 0.00008;
+    const shape = rectangle(x, y, x + width, y + height);
+    if (index % 3 === 0) edits.push({ id: `seed-${index}`, new: shape });
+    else if (index % 3 === 1) edits.push({ id: `seed-${index}`, old: shape });
+    else {
+      edits.push({
+        id: `seed-${index}`,
+        old: shape,
+        new: rectangle(x + 0.00002, y - 0.00001, x + width + 0.00002, y + height - 0.00001),
+      });
+    }
+  }
+  return edits;
+}
+
+function shuffle<T>(input: T[], seed: number): T[] {
+  const output = [...input];
+  const random = seeded(seed);
+  for (let index = output.length - 1; index > 0; index -= 1) {
+    const other = Math.floor(random() * (index + 1));
+    [output[index], output[other]] = [output[other], output[index]];
+  }
+  return output;
+}
+
+function requireMalformed(label: string, fixture: string, line: number, fragment: string): void {
+  requireMalformedText(label, readFileSync(join(root, fixture), "utf8"), line, fragment);
+}
+
+function requireMalformedText(label: string, contents: string, line: number, fragment: string): void {
+  const path = join(work, `malformed-${label}.ndjson`);
+  writeFileSync(path, contents.endsWith("\n") ? contents : `${contents}\n`);
+  const first = run(binary, [path]);
+  const second = run(binary, [path]);
+  if (first.status === 0 || first.stdout !== "") {
+    throw new Error(`${label}: expected nonzero status and empty stdout`);
+  }
+  if (!first.stderr.includes(`input line ${line}:`) || !first.stderr.includes(fragment)) {
+    throw new Error(`${label}: unexpected diagnostic: ${first.stderr}`);
+  }
+  if (first.status !== second.status || first.stdout !== second.stdout || first.stderr !== second.stderr) {
+    throw new Error(`${label}: failure was not deterministic`);
+  }
+  console.log(`malformed ${label}: deterministic line ${line}, empty stdout`);
+}
+
+function rectangleTileSet(edits: Edit[]): string {
+  const tiles = new Set<string>();
+  for (const edit of edits) {
+    for (const geometry of [edit.old, edit.new]) {
+      if (!geometry || geometry.type !== "Polygon") continue;
+      const ring = geometry.coordinates as Position[][];
+      const xs = ring[0].map(([x]) => x);
+      const ys = ring[0].map(([, y]) => y);
+      const minX = Math.min(...xs);
+      const maxX = Math.max(...xs);
+      const minY = Math.min(...ys);
+      const maxY = Math.max(...ys);
+      for (let z = 12; z <= 16; z += 1) {
+        const n = 2 ** z;
+        const xWorld = (longitude: number) => ((longitude + 180) / 360) * n;
+        const yWorld = (latitude: number) => {
+          const radians = (latitude * Math.PI) / 180;
+          return ((1 - Math.asinh(Math.tan(radians)) / Math.PI) / 2) * n;
+        };
+        const touching = (min: number, max: number): [number, number] => {
+          const near = (value: number) => Math.abs(value - Math.round(value)) <= 1e-10;
+          const lower = near(min) ? Math.round(min) - 1 : Math.floor(min);
+          const upper = near(max) ? Math.round(max) : Math.floor(max);
+          return [Math.max(0, lower), Math.min(n - 1, upper)];
+        };
+        const [xStart, xEnd] = touching(xWorld(minX), xWorld(maxX));
+        const yA = yWorld(minY);
+        const yB = yWorld(maxY);
+        const [yStart, yEnd] = touching(Math.min(yA, yB), Math.max(yA, yB));
+        for (let x = xStart; x <= xEnd; x += 1) {
+          for (let y = yStart; y <= yEnd; y += 1) tiles.add(`${z}/${x}/${y}`);
+        }
+      }
+    }
+  }
+  const sorted = [...tiles].sort();
+  return sorted.length === 0 ? "" : `${sorted.join("\n")}\n`;
+}
+
+function verifyAnalyticalRectangles(): void {
+  const random = seeded(0xdecafbad);
+  const edits: Edit[] = [];
+  for (let index = 0; index < 500; index += 1) {
+    const x = -170 + random() * 340;
+    const y = -70 + random() * 140;
+    const width = 0.001 + random() * 0.05;
+    const height = 0.001 + random() * 0.05;
+    edits.push({ id: `analytic-${index}`, new: rectangle(x, y, x + width, y + height) });
+  }
+  const path = join(work, "analytic-rectangles.ndjson");
+  writeFileSync(path, ndjson(edits));
+  const actual = run(binary, [path]);
+  if (actual.status !== 0) throw new Error(`analytical rectangles failed: ${actual.stderr}`);
+  const expected = rectangleTileSet(edits);
+  if (actual.stdout !== expected) throw new Error("analytical rectangle tile set differs");
+  console.log(`analytical rectangles: 500 edits exact (${expected.trim().split("\n").length} tiles)`);
+}
+
+try {
+  const insertion = { id: "insertion", new: rectangle(-73.99, 40.72, -73.98, 40.73) };
+  compare("insertion", [insertion]);
+  compare("deletion", [{ id: "deletion", old: insertion.new }]);
+  compare("translation", [{
+    id: "translation",
+    old: rectangle(-73.99, 40.72, -73.985, 40.725),
+    new: rectangle(-73.98, 40.73, -73.975, 40.735),
+  }]);
+  compare("concavity", [{
+    id: "concavity",
+    new: {
+      type: "Polygon",
+      coordinates: [[
+        [-74.00, 40.71], [-73.98, 40.71], [-73.98, 40.72], [-73.99, 40.72],
+        [-73.99, 40.73], [-74.00, 40.73], [-74.00, 40.71],
+      ]],
+    },
+  }]);
+
+  const holeTile = { z: 16, x: 19301, y: 24640 };
+  const left = tileLongitude(holeTile.x, holeTile.z);
+  const right = tileLongitude(holeTile.x + 1, holeTile.z);
+  const top = tileLatitude(holeTile.y, holeTile.z);
+  const bottom = tileLatitude(holeTile.y + 1, holeTile.z);
+  const dx = right - left;
+  const dy = top - bottom;
+  const hole: Position[] = [
+    [left - dx / 4, bottom - dy / 4], [right + dx / 4, bottom - dy / 4],
+    [right + dx / 4, top + dy / 4], [left - dx / 4, top + dy / 4],
+    [left - dx / 4, bottom - dy / 4],
+  ];
+  const outer: Position[] = [
+    [left - dx * 2, bottom - dy * 2], [right + dx * 2, bottom - dy * 2],
+    [right + dx * 2, top + dy * 2], [left - dx * 2, top + dy * 2],
+    [left - dx * 2, bottom - dy * 2],
+  ];
+  const holeOutput = compare("holes", [{
+    id: "holes",
+    new: { type: "Polygon", coordinates: [outer, hole] },
+  }]);
+  if (holeOutput.split("\n").includes(`${holeTile.z}/${holeTile.x}/${holeTile.y}`)) {
+    throw new Error("holes: tile wholly inside the hole was included");
+  }
+
+  compare("multipolygon", [{
+    id: "multipolygon",
+    new: {
+      type: "MultiPolygon",
+      coordinates: [
+        rectangle(-73.995, 40.715, -73.993, 40.717).coordinates,
+        rectangle(-73.975, 40.732, -73.972, 40.734).coordinates,
+      ],
+    },
+  }]);
+
+  const boundary = tileLongitude(19301, 16);
+  const boundaryOutput = compare("boundary-touch", [{
+    id: "boundary-touch",
+    new: rectangle(boundary, 40.72, boundary + 0.0002, 40.721),
+  }]);
+  const boundaryXs = new Set(
+    boundaryOutput.trim().split("\n").filter((tile) => tile.startsWith("16/")).map((tile) => tile.split("/")[1]),
+  );
+  if (!boundaryXs.has("19300") || !boundaryXs.has("19301")) {
+    throw new Error("boundary-touch: did not include both tiles sharing the touched edge");
+  }
+
+  const tenThousand = seededEdits(10_000, 0x5eed1234);
+  compare("seeded-10000", tenThousand);
+  verifyAnalyticalRectangles();
+
+  const permutationEdits = seededEdits(200, 0xc0ffee);
+  const basePath = join(work, "permutation-base.ndjson");
+  writeFileSync(basePath, ndjson(permutationEdits));
+  const base = run(binary, [basePath]);
+  if (base.status !== 0) throw new Error(`permutation base failed: ${base.stderr}`);
+  for (let index = 0; index < 10; index += 1) {
+    const path = join(work, `permutation-${index}.ndjson`);
+    writeFileSync(path, ndjson(shuffle(permutationEdits, 1000 + index)));
+    const result = run(binary, [path]);
+    if (result.status !== 0 || result.stdout !== base.stdout) {
+      throw new Error(`permutation ${index + 1}: output differs`);
+    }
+  }
+  console.log("permutations: 10/10 byte-identical");
+
+  requireMalformed("open-ring", "fixtures/malformed-open-ring.ndjson", 2, "is open");
+  requireMalformed("coordinate", "fixtures/malformed-coordinate.ndjson", 1, "longitude");
+  requireMalformed("nonfinite", "fixtures/malformed-nonfinite.ndjson", 1, "number out of range");
+  requireMalformed("unsupported-type", "fixtures/malformed-type.ndjson", 1, "unsupported");
+  const valid = ndjson([{ id: "valid", new: rectangle(-73.99, 40.72, -73.98, 40.73) }]);
+  requireMalformedText(
+    "duplicate-edit",
+    `${valid.trim()}\n{"id":"dup","new":null,"new":{"type":"Polygon","coordinates":[[[0,0],[1,0],[1,1],[0,0]]]}}\n`,
+    2,
+    "duplicate object member",
+  );
+  requireMalformedText(
+    "duplicate-geometry",
+    '{"id":"dup","new":{"type":"LineString","type":"Polygon","coordinates":[[[0,0],[1,0],[1,1],[0,0]]]}}\n',
+    1,
+    "duplicate object member",
+  );
+  requireMalformedText(
+    "duplicate-nested",
+    '{"id":"dup","meta":{"value":1,"value":2},"new":{"type":"Polygon","coordinates":[[[0,0],[1,0],[1,1],[0,0]]]}}\n',
+    1,
+    "duplicate object member",
+  );
+  requireMalformedText(
+    "self-intersection",
+    '{"id":"bow","new":{"type":"Polygon","coordinates":[[[0,0],[2,2],[0,2],[2,0],[0,0]]]}}\n',
+    1,
+    "self-intersects",
+  );
+  requireMalformedText(
+    "zero-area",
+    '{"id":"zero","new":{"type":"Polygon","coordinates":[[[0,0],[1,1],[2,2],[0,0]]]}}\n',
+    1,
+    "zero area",
+  );
+  requireMalformedText(
+    "hole-outside",
+    '{"id":"hole","new":{"type":"Polygon","coordinates":[[[0,0],[2,0],[2,2],[0,2],[0,0]],[[3,3],[4,3],[4,4],[3,4],[3,3]]]}}\n',
+    1,
+    "strictly inside",
+  );
+  requireMalformedText(
+    "hole-overlap",
+    '{"id":"holes","new":{"type":"Polygon","coordinates":[[[0,0],[5,0],[5,5],[0,5],[0,0]],[[1,1],[3,1],[3,3],[1,3],[1,1]],[[2,2],[4,2],[4,4],[2,4],[2,2]]]}}\n',
+    1,
+    "overlap or nest",
+  );
+  console.log("verification complete");
+} finally {
+  rmSync(work, { recursive: true, force: true });
+}
diff --git a/developer-simulation/runs/2026-08-05--parcel-delta-tiles/src/lib.rs b/developer-simulation/runs/2026-08-05--parcel-delta-tiles/src/lib.rs
new file mode 100644
index 0000000..5b9a873
--- /dev/null
+++ b/developer-simulation/runs/2026-08-05--parcel-delta-tiles/src/lib.rs
@@ -0,0 +1,779 @@
+use std::collections::BTreeSet;
+use std::f64::consts::PI;
+use std::io::BufRead;
+
+use serde::de::{self, DeserializeSeed, MapAccess, SeqAccess, Visitor};
+use serde_json::{Map, Number, Value};
+
+const MIN_ZOOM: u8 = 12;
+const MAX_ZOOM: u8 = 16;
+const MAX_MERCATOR_LAT: f64 = 85.051_128_779_806_6;
+const EPS: f64 = 1e-12;
+
+#[derive(Clone, Copy, Debug, Eq, Ord, PartialEq, PartialOrd)]
+pub struct Tile {
+    pub z: u8,
+    pub x: u32,
+    pub y: u32,
+}
+
+#[derive(Clone, Copy, Debug, PartialEq)]
+struct Point {
+    x: f64,
+    y: f64,
+}
+
+type Ring = Vec<Point>;
+type Polygon = Vec<Ring>;
+type MultiPolygon = Vec<Polygon>;
+
+#[derive(Debug)]
+struct Edit {
+    geometries: Vec<MultiPolygon>,
+}
+
+#[derive(Clone, Copy, Debug)]
+struct Rect {
+    min_x: f64,
+    min_y: f64,
+    max_x: f64,
+    max_y: f64,
+}
+
+struct StrictValueSeed;
+
+impl<'de> DeserializeSeed<'de> for StrictValueSeed {
+    type Value = Value;
+
+    fn deserialize<D>(self, deserializer: D) -> Result<Self::Value, D::Error>
+    where
+        D: serde::Deserializer<'de>,
+    {
+        deserializer.deserialize_any(StrictValueVisitor)
+    }
+}
+
+struct StrictValueVisitor;
+
+impl<'de> Visitor<'de> for StrictValueVisitor {
+    type Value = Value;
+
+    fn expecting(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        formatter.write_str("a JSON value without duplicate object members")
+    }
+
+    fn visit_bool<E>(self, value: bool) -> Result<Self::Value, E> {
+        Ok(Value::Bool(value))
+    }
+
+    fn visit_i64<E>(self, value: i64) -> Result<Self::Value, E> {
+        Ok(Value::Number(Number::from(value)))
+    }
+
+    fn visit_u64<E>(self, value: u64) -> Result<Self::Value, E> {
+        Ok(Value::Number(Number::from(value)))
+    }
+
+    fn visit_f64<E>(self, value: f64) -> Result<Self::Value, E>
+    where
+        E: de::Error,
+    {
+        Number::from_f64(value)
+            .map(Value::Number)
+            .ok_or_else(|| E::custom("non-finite JSON number"))
+    }
+
+    fn visit_str<E>(self, value: &str) -> Result<Self::Value, E> {
+        Ok(Value::String(value.to_owned()))
+    }
+
+    fn visit_string<E>(self, value: String) -> Result<Self::Value, E> {
+        Ok(Value::String(value))
+    }
+
+    fn visit_none<E>(self) -> Result<Self::Value, E> {
+        Ok(Value::Null)
+    }
+
+    fn visit_unit<E>(self) -> Result<Self::Value, E> {
+        Ok(Value::Null)
+    }
+
+    fn visit_seq<A>(self, mut sequence: A) -> Result<Self::Value, A::Error>
+    where
+        A: SeqAccess<'de>,
+    {
+        let mut values = Vec::new();
+        while let Some(value) = sequence.next_element_seed(StrictValueSeed)? {
+            values.push(value);
+        }
+        Ok(Value::Array(values))
+    }
+
+    fn visit_map<A>(self, mut object: A) -> Result<Self::Value, A::Error>
+    where
+        A: MapAccess<'de>,
+    {
+        let mut values = Map::new();
+        while let Some(key) = object.next_key::<String>()? {
+            if values.contains_key(&key) {
+                return Err(de::Error::custom(format!(
+                    "duplicate object member `{key}`"
+                )));
+            }
+            values.insert(key, object.next_value_seed(StrictValueSeed)?);
+        }
+        Ok(Value::Object(values))
+    }
+}
+
+fn parse_json_strict(text: &str) -> Result<Value, serde_json::Error> {
+    let mut deserializer = serde_json::Deserializer::from_str(text);
+    let value = StrictValueSeed.deserialize(&mut deserializer)?;
+    deserializer.end()?;
+    Ok(value)
+}
+
+pub fn plan(reader: impl BufRead) -> Result<BTreeSet<Tile>, String> {
+    let mut tiles = BTreeSet::new();
+    for (index, line_result) in reader.lines().enumerate() {
+        let line_number = index + 1;
+        let line = line_result.map_err(|error| format!("input line {line_number}: {error}"))?;
+        if line.trim().is_empty() {
+            return Err(format!("input line {line_number}: blank line"));
+        }
+        let value = parse_json_strict(&line)
+            .map_err(|error| format!("input line {line_number}: invalid JSON: {error}"))?;
+        let edit =
+            parse_edit(&value).map_err(|error| format!("input line {line_number}: {error}"))?;
+        for geometry in &edit.geometries {
+            collect_geometry_tiles(geometry, &mut tiles);
+        }
+    }
+    Ok(tiles)
+}
+
+pub fn format_plan(tiles: &BTreeSet<Tile>) -> Vec<String> {
+    let mut lines: Vec<_> = tiles
+        .iter()
+        .map(|tile| format!("{}/{}/{}", tile.z, tile.x, tile.y))
+        .collect();
+    lines.sort_unstable();
+    lines
+}
+
+fn parse_edit(value: &Value) -> Result<Edit, String> {
+    let object = value
+        .as_object()
+        .ok_or_else(|| "edit must be a JSON object".to_string())?;
+    match object.get("id") {
+        Some(Value::String(id)) if !id.is_empty() => {}
+        _ => return Err("id must be a non-empty string".to_string()),
+    }
+
+    let mut geometries = Vec::with_capacity(2);
+    for field in ["old", "new"] {
+        match object.get(field) {
+            None | Some(Value::Null) => {}
+            Some(geometry) => geometries.push(parse_geometry(geometry, field)?),
+        }
+    }
+    if geometries.is_empty() {
+        return Err("at least one of old or new must contain a geometry".to_string());
+    }
+    Ok(Edit { geometries })
+}
+
+fn parse_geometry(value: &Value, field: &str) -> Result<MultiPolygon, String> {
+    let object = value
+        .as_object()
+        .ok_or_else(|| format!("{field} geometry must be an object"))?;
+    let geometry_type = required_string(object, "type", field)?;
+    let coordinates = object
+        .get("coordinates")
+        .ok_or_else(|| format!("{field}.coordinates is required"))?;
+    let polygons = match geometry_type {
+        "Polygon" => vec![parse_polygon(coordinates, &format!("{field}.coordinates"))?],
+        "MultiPolygon" => parse_multipolygon(coordinates, &format!("{field}.coordinates"))?,
+        other => return Err(format!("{field}.type {other:?} is unsupported")),
+    };
+
+    let (min_lon, max_lon) = longitude_extent(&polygons);
+    if max_lon - min_lon > 180.0 {
+        return Err(format!(
+            "{field} crosses the antimeridian, which this prototype does not support"
+        ));
+    }
+    Ok(polygons)
+}
+
+fn required_string<'a>(
+    object: &'a Map<String, Value>,
+    key: &str,
+    context: &str,
+) -> Result<&'a str, String> {
+    object
+        .get(key)
+        .and_then(Value::as_str)
+        .ok_or_else(|| format!("{context}.{key} must be a string"))
+}
+
+fn parse_multipolygon(value: &Value, path: &str) -> Result<MultiPolygon, String> {
+    let values = value
+        .as_array()
+        .ok_or_else(|| format!("{path} must be an array"))?;
+    if values.is_empty() {
+        return Err(format!("{path} must contain at least one polygon"));
+    }
+    let polygons: MultiPolygon = values
+        .iter()
+        .enumerate()
+        .map(|(index, polygon)| parse_polygon(polygon, &format!("{path}[{index}]")))
+        .collect::<Result<_, _>>()?;
+    validate_multipolygon(&polygons, path)?;
+    Ok(polygons)
+}
+
+fn parse_polygon(value: &Value, path: &str) -> Result<Polygon, String> {
+    let values = value
+        .as_array()
+        .ok_or_else(|| format!("{path} must be an array"))?;
+    if values.is_empty() {
+        return Err(format!("{path} must contain an exterior ring"));
+    }
+    let polygon: Polygon = values
+        .iter()
+        .enumerate()
+        .map(|(index, ring)| parse_ring(ring, &format!("{path}[{index}]")))
+        .collect::<Result<_, _>>()?;
+    validate_polygon(&polygon, path)?;
+    Ok(polygon)
+}
+
+fn parse_ring(value: &Value, path: &str) -> Result<Ring, String> {
+    let values = value
+        .as_array()
+        .ok_or_else(|| format!("{path} must be an array"))?;
+    if values.len() < 4 {
+        return Err(format!("{path} must contain at least four positions"));
+    }
+    let points: Ring = values
+        .iter()
+        .enumerate()
+        .map(|(index, position)| parse_position(position, &format!("{path}[{index}]")))
+        .collect::<Result<_, _>>()?;
+    if points.first() != points.last() {
+        return Err(format!(
+            "{path} is open; first and last positions must match"
+        ));
+    }
+    if points.windows(2).any(|segment| segment[0] == segment[1]) {
+        return Err(format!("{path} contains a zero-length edge"));
+    }
+    let segment_count = points.len() - 1;
+    for first in 0..segment_count {
+        for second in (first + 1)..segment_count {
+            let adjacent = second == first + 1 || (first == 0 && second + 1 == segment_count);
+            if !adjacent
+                && segments_intersect(
+                    points[first],
+                    points[first + 1],
+                    points[second],
+                    points[second + 1],
+                )
+            {
+                return Err(format!("{path} self-intersects"));
+            }
+        }
+    }
+    if signed_twice_area(&points).abs() <= EPS {
+        return Err(format!("{path} has zero area"));
+    }
+    Ok(points)
+}
+
+fn signed_twice_area(ring: &Ring) -> f64 {
+    ring.windows(2)
+        .map(|segment| segment[0].x * segment[1].y - segment[1].x * segment[0].y)
+        .sum()
+}
+
+fn validate_polygon(polygon: &Polygon, path: &str) -> Result<(), String> {
+    let exterior = &polygon[0];
+    for (hole_index, hole) in polygon[1..].iter().enumerate() {
+        let hole_path = format!("{path}[{}]", hole_index + 1);
+        if point_in_ring(hole[0], exterior) != Location::Inside || rings_intersect(exterior, hole) {
+            return Err(format!(
+                "{hole_path} must be strictly inside the exterior ring"
+            ));
+        }
+    }
+
+    for first in 1..polygon.len() {
+        for second in (first + 1)..polygon.len() {
+            if rings_intersect(&polygon[first], &polygon[second])
+                || point_in_ring(polygon[first][0], &polygon[second]) != Location::Outside
+                || point_in_ring(polygon[second][0], &polygon[first]) != Location::Outside
+            {
+                return Err(format!(
+                    "{path}[{first}] and {path}[{second}] overlap or nest"
+                ));
+            }
+        }
+    }
+    Ok(())
+}
+
+fn validate_multipolygon(polygons: &MultiPolygon, path: &str) -> Result<(), String> {
+    for first in 0..polygons.len() {
+        for second in (first + 1)..polygons.len() {
+            let first_exterior = &polygons[first][0];
+            let second_exterior = &polygons[second][0];
+            if rings_intersect(first_exterior, second_exterior)
+                || point_in_ring(first_exterior[0], second_exterior) != Location::Outside
+                || point_in_ring(second_exterior[0], first_exterior) != Location::Outside
+            {
+                return Err(format!(
+                    "{path}[{first}] and {path}[{second}] overlap or nest"
+                ));
+            }
+        }
+    }
+    Ok(())
+}
+
+fn rings_intersect(first: &Ring, second: &Ring) -> bool {
+    first.windows(2).any(|a| {
+        second
+            .windows(2)
+            .any(|b| segments_intersect(a[0], a[1], b[0], b[1]))
+    })
+}
+
+fn segments_intersect(a: Point, b: Point, c: Point, d: Point) -> bool {
+    let orientation = |first: Point, second: Point, third: Point| {
+        (second.x - first.x) * (third.y - first.y) - (second.y - first.y) * (third.x - first.x)
+    };
+    let ab_c = orientation(a, b, c);
+    let ab_d = orientation(a, b, d);
+    let cd_a = orientation(c, d, a);
+    let cd_b = orientation(c, d, b);
+
+    if ((ab_c > EPS && ab_d < -EPS) || (ab_c < -EPS && ab_d > EPS))
+        && ((cd_a > EPS && cd_b < -EPS) || (cd_a < -EPS && cd_b > EPS))
+    {
+        return true;
+    }
+    (ab_c.abs() <= EPS && point_on_segment(c, a, b))
+        || (ab_d.abs() <= EPS && point_on_segment(d, a, b))
+        || (cd_a.abs() <= EPS && point_on_segment(a, c, d))
+        || (cd_b.abs() <= EPS && point_on_segment(b, c, d))
+}
+
+fn parse_position(value: &Value, path: &str) -> Result<Point, String> {
+    let values = value
+        .as_array()
+        .ok_or_else(|| format!("{path} must be a two-number position"))?;
+    if values.len() != 2 {
+        return Err(format!(
+            "{path} must contain exactly longitude and latitude"
+        ));
+    }
+    let x = finite_number(&values[0], &format!("{path}[0]"))?;
+    let y = finite_number(&values[1], &format!("{path}[1]"))?;
+    if !(-180.0..=180.0).contains(&x) {
+        return Err(format!("{path}[0] longitude is outside [-180, 180]"));
+    }
+    if !(-MAX_MERCATOR_LAT..=MAX_MERCATOR_LAT).contains(&y) {
+        return Err(format!("{path}[1] latitude is outside Web Mercator limits"));
+    }
+    Ok(Point { x, y })
+}
+
+fn finite_number(value: &Value, path: &str) -> Result<f64, String> {
+    let number = value
+        .as_f64()
+        .ok_or_else(|| format!("{path} must be a finite number"))?;
+    if !number.is_finite() {
+        return Err(format!("{path} must be a finite number"));
+    }
+    Ok(number)
+}
+
+fn longitude_extent(polygons: &MultiPolygon) -> (f64, f64) {
+    polygons
+        .iter()
+        .flat_map(|polygon| polygon.iter())
+        .flat_map(|ring| ring.iter())
+        .fold((f64::INFINITY, f64::NEG_INFINITY), |(min, max), point| {
+            (min.min(point.x), max.max(point.x))
+        })
+}
+
+fn collect_geometry_tiles(geometry: &MultiPolygon, tiles: &mut BTreeSet<Tile>) {
+    for polygon in geometry {
+        let bounds = polygon_bounds(polygon);
+        for z in MIN_ZOOM..=MAX_ZOOM {
+            let n = 1_u32 << z;
+            let x_min_world = longitude_to_world_x(bounds.min_x, n);
+            let x_max_world = longitude_to_world_x(bounds.max_x, n);
+            let y_a = latitude_to_world_y(bounds.min_y, n);
+            let y_b = latitude_to_world_y(bounds.max_y, n);
+            let (x_start, x_end) = touching_index_range(x_min_world, x_max_world, n);
+            let (y_start, y_end) = touching_index_range(y_a.min(y_b), y_a.max(y_b), n);
+            for x in x_start..=x_end {
+                for y in y_start..=y_end {
+                    if polygon_intersects_rect(polygon, tile_rect(z, x, y)) {
+                        tiles.insert(Tile { z, x, y });
+                    }
+                }
+            }
+        }
+    }
+}
+
+fn polygon_bounds(polygon: &Polygon) -> Rect {
+    polygon.iter().flat_map(|ring| ring.iter()).fold(
+        Rect {
+            min_x: f64::INFINITY,
+            min_y: f64::INFINITY,
+            max_x: f64::NEG_INFINITY,
+            max_y: f64::NEG_INFINITY,
+        },
+        |bounds, point| Rect {
+            min_x: bounds.min_x.min(point.x),
+            min_y: bounds.min_y.min(point.y),
+            max_x: bounds.max_x.max(point.x),
+            max_y: bounds.max_y.max(point.y),
+        },
+    )
+}
+
+fn longitude_to_world_x(longitude: f64, n: u32) -> f64 {
+    (longitude + 180.0) / 360.0 * f64::from(n)
+}
+
+fn latitude_to_world_y(latitude: f64, n: u32) -> f64 {
+    let radians = latitude.to_radians();
+    (1.0 - radians.tan().asinh() / PI) / 2.0 * f64::from(n)
+}
+
+fn touching_index_range(min: f64, max: f64, n: u32) -> (u32, u32) {
+    let lower = if near_integer(min) {
+        min.round() as i64 - 1
+    } else {
+        min.floor() as i64
+    };
+    let upper = if near_integer(max) {
+        max.round() as i64
+    } else {
+        max.floor() as i64
+    };
+    let last = i64::from(n) - 1;
+    (lower.clamp(0, last) as u32, upper.clamp(0, last) as u32)
+}
+
+fn near_integer(value: f64) -> bool {
+    (value - value.round()).abs() <= 1e-10
+}
+
+fn tile_rect(z: u8, x: u32, y: u32) -> Rect {
+    let n = f64::from(1_u32 << z);
+    Rect {
+        min_x: f64::from(x) / n * 360.0 - 180.0,
+        max_x: f64::from(x + 1) / n * 360.0 - 180.0,
+        min_y: world_y_to_latitude(f64::from(y + 1), n),
+        max_y: world_y_to_latitude(f64::from(y), n),
+    }
+}
+
+fn world_y_to_latitude(y: f64, n: f64) -> f64 {
+    (PI * (1.0 - 2.0 * y / n)).sinh().atan().to_degrees()
+}
+
+fn polygon_intersects_rect(polygon: &Polygon, rect: Rect) -> bool {
+    if polygon.iter().any(|ring| {
+        ring.windows(2)
+            .any(|segment| segment_intersects_rect(segment[0], segment[1], rect))
+    }) {
+        return true;
+    }
+
+    let corners = [
+        Point {
+            x: rect.min_x,
+            y: rect.min_y,
+        },
+        Point {
+            x: rect.min_x,
+            y: rect.max_y,
+        },
+        Point {
+            x: rect.max_x,
+            y: rect.min_y,
+        },
+        Point {
+            x: rect.max_x,
+            y: rect.max_y,
+        },
+    ];
+    corners
+        .into_iter()
+        .any(|corner| point_in_filled_polygon(corner, polygon))
+}
+
+fn segment_intersects_rect(a: Point, b: Point, rect: Rect) -> bool {
+    let dx = b.x - a.x;
+    let dy = b.y - a.y;
+    let mut t_min: f64 = 0.0;
+    let mut t_max: f64 = 1.0;
+    for (p, q) in [
+        (-dx, a.x - rect.min_x),
+        (dx, rect.max_x - a.x),
+        (-dy, a.y - rect.min_y),
+        (dy, rect.max_y - a.y),
+    ] {
+        if p.abs() <= EPS {
+            if q < -EPS {
+                return false;
+            }
+        } else {
+            let ratio = q / p;
+            if p < 0.0 {
+                t_min = t_min.max(ratio);
+            } else {
+                t_max = t_max.min(ratio);
+            }
+            if t_min - t_max > EPS {
+                return false;
+            }
+        }
+    }
+    true
+}
+
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+enum Location {
+    Outside,
+    Inside,
+    Boundary,
+}
+
+fn point_in_filled_polygon(point: Point, polygon: &Polygon) -> bool {
+    match point_in_ring(point, &polygon[0]) {
+        Location::Outside => false,
+        Location::Boundary => true,
+        Location::Inside => !polygon[1..]
+            .iter()
+            .any(|hole| point_in_ring(point, hole) == Location::Inside),
+    }
+}
+
+fn point_in_ring(point: Point, ring: &Ring) -> Location {
+    let mut inside = false;
+    for segment in ring.windows(2) {
+        let a = segment[0];
+        let b = segment[1];
+        if point_on_segment(point, a, b) {
+            return Location::Boundary;
+        }
+        if (a.y > point.y) != (b.y > point.y) {
+            let crossing_x = (b.x - a.x) * (point.y - a.y) / (b.y - a.y) + a.x;
+            if crossing_x > point.x {
+                inside = !inside;
+            }
+        }
+    }
+    if inside {
+        Location::Inside
+    } else {
+        Location::Outside
+    }
+}
+
+fn point_on_segment(point: Point, a: Point, b: Point) -> bool {
+    let cross = (b.x - a.x) * (point.y - a.y) - (b.y - a.y) * (point.x - a.x);
+    let scale = (b.x - a.x).abs() + (b.y - a.y).abs() + 1.0;
+    if cross.abs() > EPS * scale {
+        return false;
+    }
+    point.x >= a.x.min(b.x) - EPS
+        && point.x <= a.x.max(b.x) + EPS
+        && point.y >= a.y.min(b.y) - EPS
+        && point.y <= a.y.max(b.y) + EPS
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::io::Cursor;
+
+    fn plan_text(input: &str) -> Result<BTreeSet<Tile>, String> {
+        plan(Cursor::new(input))
+    }
+
+    #[test]
+    fn insertion_and_deletion_have_the_same_plan() {
+        let geometry = r#"{"type":"Polygon","coordinates":[[[-73.99,40.72],[-73.98,40.72],[-73.98,40.73],[-73.99,40.73],[-73.99,40.72]]]}"#;
+        let inserted = plan_text(&format!(r#"{{"id":"p","new":{geometry}}}"#)).unwrap();
+        let deleted = plan_text(&format!(r#"{{"id":"p","old":{geometry}}}"#)).unwrap();
+        assert_eq!(inserted, deleted);
+        assert!(!inserted.is_empty());
+    }
+
+    #[test]
+    fn exact_tile_boundary_touches_both_sides() {
+        let boundary = f64::from(19_301_u32) / f64::from(1_u32 << 16) * 360.0 - 180.0;
+        let input = format!(
+            r#"{{"id":"edge","new":{{"type":"Polygon","coordinates":[[[{boundary},40.7],[{},40.7],[{},40.72],[{boundary},40.72],[{boundary},40.7]]]}}}}"#,
+            boundary + 0.0002,
+            boundary + 0.0002,
+        );
+        let tiles = plan_text(&input).unwrap();
+        let xs: BTreeSet<_> = tiles
+            .iter()
+            .filter(|tile| tile.z == 16)
+            .map(|tile| tile.x)
+            .collect();
+        assert!(xs.contains(&19_300));
+        assert!(xs.contains(&19_301));
+    }
+
+    #[test]
+    fn exact_tile_corner_touches_all_four_neighbors() {
+        let z = 16;
+        let x = 19_301;
+        let y = 24_641;
+        let corner_x = longitude_to_world_x(tile_rect(z, x, y).min_x, 1_u32 << z);
+        let corner_y = latitude_to_world_y(tile_rect(z, x, y).max_y, 1_u32 << z);
+        assert!(near_integer(corner_x));
+        assert!(near_integer(corner_y));
+        let corner = tile_rect(z, x, y);
+        let input = format!(
+            r#"{{"id":"corner","new":{{"type":"Polygon","coordinates":[[[{},{}],[{},{}],[{},{}],[{},{}]]]}}}}"#,
+            corner.min_x,
+            corner.max_y,
+            corner.min_x + 0.0002,
+            corner.max_y,
+            corner.min_x,
+            corner.max_y - 0.0002,
+            corner.min_x,
+            corner.max_y,
+        );
+        let tiles = plan_text(&input).unwrap();
+        for expected in [
+            Tile {
+                z,
+                x: x - 1,
+                y: y - 1,
+            },
+            Tile { z, x, y: y - 1 },
+            Tile { z, x: x - 1, y },
+            Tile { z, x, y },
+        ] {
+            assert!(tiles.contains(&expected), "missing {expected:?}");
+        }
+    }
+
+    #[test]
+    fn tile_wholly_inside_hole_is_excluded() {
+        let z = 16;
+        let x = 19_301;
+        let y = 24_641;
+        let tile = tile_rect(z, x, y);
+        let pad_x = tile.max_x - tile.min_x;
+        let pad_y = tile.max_y - tile.min_y;
+        let outer = vec![
+            Point {
+                x: tile.min_x - pad_x,
+                y: tile.min_y - pad_y,
+            },
+            Point {
+                x: tile.max_x + pad_x,
+                y: tile.min_y - pad_y,
+            },
+            Point {
+                x: tile.max_x + pad_x,
+                y: tile.max_y + pad_y,
+            },
+            Point {
+                x: tile.min_x - pad_x,
+                y: tile.max_y + pad_y,
+            },
+            Point {
+                x: tile.min_x - pad_x,
+                y: tile.min_y - pad_y,
+            },
+        ];
+        let hole = vec![
+            Point {
+                x: tile.min_x - pad_x / 4.0,
+                y: tile.min_y - pad_y / 4.0,
+            },
+            Point {
+                x: tile.max_x + pad_x / 4.0,
+                y: tile.min_y - pad_y / 4.0,
+            },
+            Point {
+                x: tile.max_x + pad_x / 4.0,
+                y: tile.max_y + pad_y / 4.0,
+            },
+            Point {
+                x: tile.min_x - pad_x / 4.0,
+                y: tile.max_y + pad_y / 4.0,
+            },
+            Point {
+                x: tile.min_x - pad_x / 4.0,
+                y: tile.min_y - pad_y / 4.0,
+            },
+        ];
+        assert!(!polygon_intersects_rect(&vec![outer, hole], tile));
+    }
+
+    #[test]
+    fn malformed_line_reports_line_and_returns_no_plan() {
+        let valid =
+            r#"{"id":"ok","new":{"type":"Polygon","coordinates":[[[0,0],[1,0],[1,1],[0,0]]]}}"#;
+        let open =
+            r#"{"id":"bad","new":{"type":"Polygon","coordinates":[[[0,0],[1,0],[1,1],[0,1]]]}}"#;
+        let error = plan_text(&format!("{valid}\n{open}\n")).unwrap_err();
+        assert!(error.starts_with("input line 2:"));
+        assert!(error.contains("is open"));
+    }
+
+    #[test]
+    fn duplicate_members_are_rejected_recursively() {
+        let cases = [
+            r#"{"id":"dup","new":null,"new":{"type":"Polygon","coordinates":[[[0,0],[1,0],[1,1],[0,0]]]}}"#,
+            r#"{"id":"dup","new":{"type":"LineString","type":"Polygon","coordinates":[[[0,0],[1,0],[1,1],[0,0]]]}}"#,
+            r#"{"id":"dup","meta":{"value":1,"value":2},"new":{"type":"Polygon","coordinates":[[[0,0],[1,0],[1,1],[0,0]]]}}"#,
+        ];
+        for input in cases {
+            let error = plan_text(input).unwrap_err();
+            assert!(error.contains("duplicate object member"), "{error}");
+        }
+    }
+
+    #[test]
+    fn invalid_topology_is_rejected() {
+        let cases = [
+            r#"{"id":"bow","new":{"type":"Polygon","coordinates":[[[0,0],[2,2],[0,2],[2,0],[0,0]]]}}"#,
+            r#"{"id":"zero","new":{"type":"Polygon","coordinates":[[[0,0],[0,0],[0,0],[0,0]]]}}"#,
+            r#"{"id":"outside-hole","new":{"type":"Polygon","coordinates":[[[0,0],[2,0],[2,2],[0,2],[0,0]],[[3,3],[4,3],[4,4],[3,4],[3,3]]]}}"#,
+            r#"{"id":"overlap-hole","new":{"type":"Polygon","coordinates":[[[0,0],[5,0],[5,5],[0,5],[0,0]],[[1,1],[3,1],[3,3],[1,3],[1,1]],[[2,2],[4,2],[4,4],[2,4],[2,2]]]}}"#,
+        ];
+        for input in cases {
+            assert!(plan_text(input).is_err(), "accepted {input}");
+        }
+    }
+
+    #[test]
+    fn output_is_lexicographic_by_rendered_tile_id() {
+        let tiles = BTreeSet::from([
+            Tile { z: 12, x: 20, y: 3 },
+            Tile { z: 12, x: 3, y: 10 },
+            Tile { z: 12, x: 3, y: 2 },
+        ]);
+        assert_eq!(format_plan(&tiles), ["12/20/3", "12/3/10", "12/3/2"]);
+    }
+}
diff --git a/developer-simulation/runs/2026-08-05--parcel-delta-tiles/src/main.rs b/developer-simulation/runs/2026-08-05--parcel-delta-tiles/src/main.rs
new file mode 100644
index 0000000..75e6824
--- /dev/null
+++ b/developer-simulation/runs/2026-08-05--parcel-delta-tiles/src/main.rs
@@ -0,0 +1,37 @@
+use std::fs::File;
+use std::io::{self, BufReader, Write};
+use std::process::ExitCode;
+
+fn main() -> ExitCode {
+    match run() {
+        Ok(()) => ExitCode::SUCCESS,
+        Err(message) => {
+            eprintln!("{message}");
+            ExitCode::FAILURE
+        }
+    }
+}
+
+fn run() -> Result<(), String> {
+    let mut args = std::env::args().skip(1);
+    let input = args.next().unwrap_or_else(|| "-".to_string());
+    if args.next().is_some() {
+        return Err("usage: parcel-delta-tiles [INPUT.ndjson|-]".to_string());
+    }
+
+    let tiles = if input == "-" {
+        let stdin = io::stdin();
+        parcel_delta_tiles::plan(BufReader::new(stdin.lock()))?
+    } else {
+        let file = File::open(&input).map_err(|error| format!("cannot open {input}: {error}"))?;
+        parcel_delta_tiles::plan(BufReader::new(file))?
+    };
+
+    // Nothing is written until the entire input has parsed and validated.
+    let stdout = io::stdout();
+    let mut output = stdout.lock();
+    for line in parcel_delta_tiles::format_plan(&tiles) {
+        writeln!(output, "{line}").map_err(|error| format!("cannot write plan: {error}"))?;
+    }
+    Ok(())
+}
diff --git a/developer-simulation/runs/2026-08-06--caldav-recurrence/BASELINE.md b/developer-simulation/runs/2026-08-06--caldav-recurrence/BASELINE.md
new file mode 100644
index 0000000..c80e581
--- /dev/null
+++ b/developer-simulation/runs/2026-08-06--caldav-recurrence/BASELINE.md
@@ -0,0 +1,69 @@
+# CalDAV recurrence baseline model
+
+This is the baseline supplied by the scenario, written before selecting a
+BogKit component or designing the prototype.
+
+## Current data and write path
+
+- SQLite is authoritative.
+- An event row contains a UID, start and end, a TZID, a recurrence rule,
+  exclusions, and occurrence overrides.
+- The HTTP/CalDAV layer is already working and is outside this trial.
+- The current expander walks daily, weekly, and monthly rules in local wall
+  time, then converts each result to UTC.
+- An edit replaces the whole event row.
+- Output rows are emitted in insertion order.
+
+## Baseline behavior versus the acceptance criteria
+
+The baseline has no explicit occurrence identity, no canonical distinction
+between a local date and a local date-time, no documented policy for a DST gap
+or fold, no ordered publication key, and no materialization checkpoint. It
+therefore cannot establish the required guarantees by inspection:
+
+| Required guarantee | Baseline risk |
+| --- | --- |
+| Oracle agreement across DST gaps/folds | Local wall-time expansion is underspecified at nonexistent and repeated times. |
+| All-day events keep their date | Treating an all-day date as local midnight before UTC conversion can move it to the prior or next UTC date. |
+| Exclusions, cancellations, and overrides are stable | Whole-row replacement and UTC-only identity can lose the distinction between a deleted original occurrence and its replacement. |
+| No duplicate `(UID, occurrence)` records | Insertion-order rows have no enforced unique occurrence key. |
+| Replacement occurrences remain | An override needs the original recurrence identity plus its replacement payload; a row replacement alone does not provide that identity. |
+| Reordered input and host-time-zone independence | Insertion order and implicit host conversion make output order and possibly values depend on input or process environment. |
+| Single-event edit isolation | Replacing a whole row gives no dependency boundary for rebuilding only one UID. |
+| Interruption recovery | There is no durable per-event/materialization state or atomic publish marker in the baseline. |
+| No partial publication on invalid input | Validation and publication are not described as separate phases. |
+| 128 MiB / five-second workload | The baseline gives no bounded-memory plan and has no measured implementation to benchmark. |
+
+## Minimal corrected model for the prototype
+
+The trial will represent an occurrence by `(uid, recurrence_id)` where the
+recurrence ID is a local date for all-day events and a local wall-time value
+for timed events. A replacement keeps that recurrence ID and changes only the
+occurrence payload. A cancellation keeps the identity but emits no row.
+
+Expansion will happen in the event's declared zone using only the supplied
+transition table. Floating times will use the supplied fixed transition table
+named `FLOATING` (and never the host zone); UTC values will bypass local
+conversion. All-day values will remain civil dates and will not be converted to
+UTC.
+
+The output key will be `(uid, occurrence_kind, recurrence_id, start_utc_or_date)`
+with a stable serialized sort order. Input validation will complete before the
+temporary output is renamed into place. A per-UID state file will make a
+single-event edit and an interrupted materialization resumable.
+
+## Component fit decision, before implementation
+
+Fold's `KeyedStream` is a good fit for one narrow boundary: keyed upsert and
+remove semantics for event masters, with an atomic transaction and durable
+retraction. Its `Table` sink also demonstrates the last-writer-wins behavior
+needed by an occurrence key. Fold does not supply iCalendar recurrence rules,
+civil-date arithmetic, DST gap/fold policy, supplied transition-table parsing,
+SQLite authority, or atomic publication of a JSONL artifact. The trial will
+therefore keep calendar semantics and publication in ordinary Rust and use a
+small keyed Fold materialization only where that behavior is directly useful.
+
+This is a prototype fit assessment, not a claim about the unavailable
+production service. The supplied 5,000-case oracle and reference machine are
+not present in this checkout, so those acceptance points can only be exercised
+with the local deterministic fixture and measured as a bounded demonstration.
diff --git a/developer-simulation/runs/2026-08-06--caldav-recurrence/Cargo.toml b/developer-simulation/runs/2026-08-06--caldav-recurrence/Cargo.toml
new file mode 100644
index 0000000..27c8f9a
--- /dev/null
+++ b/developer-simulation/runs/2026-08-06--caldav-recurrence/Cargo.toml
@@ -0,0 +1,13 @@
+[package]
+name = "caldav-recurrence-prototype"
+version = "0.1.0"
+edition = "2024"
+publish = false
+
+[dependencies]
+chrono = { version = "0.4.45", default-features = false, features = ["std"] }
+fold = { path = "../../../fold" }
+libc = "0.2"
+serde = { version = "1", features = ["derive"] }
+serde_json = "1"
+sha2 = "0.10"
diff --git a/developer-simulation/runs/2026-08-06--caldav-recurrence/README.md b/developer-simulation/runs/2026-08-06--caldav-recurrence/README.md
new file mode 100644
index 0000000..0a14dfc
--- /dev/null
+++ b/developer-simulation/runs/2026-08-06--caldav-recurrence/README.md
@@ -0,0 +1,49 @@
+# CalDAV recurrence prototype
+
+This standalone CLI evaluates a deliberately small, deterministic calendar
+occurrence model. It is a prototype for the August 6 developer-simulation
+trial, not a CalDAV server or a replacement for an existing SQLite service.
+
+## Supported input
+
+Events are JSONL records with `uid`, `kind` (`timed` or `all_day`), `start`,
+`end`, optional `tzid`, one `DAILY`, `WEEKLY`, or `MONTHLY` `rrule`, `exdate`,
+and confirmed or cancelled occurrence overrides. Timed values use
+`YYYY-MM-DDTHH:MM:SS`; UTC values may use RFC3339 offsets. All-day values are
+civil dates. Transition JSON supplies the complete fixed offset history for
+each named zone and a `FLOATING` zone.
+
+The model chooses the earlier UTC instant for a fall-back fold and shifts a
+nonexistent spring-forward wall time forward by the gap. It rejects unsupported
+rules, malformed values, duplicate canonical occurrence identities, overrides
+that do not belong to the generated recurrence set, and invalid expansions.
+All-day query intersection uses half-open civil dates: an endpoint exactly at
+midnight excludes that date, while a partial-day endpoint includes the date it
+touches.
+
+## Reproduce
+
+From this directory, with the checked-in lockfile and cached dependencies:
+
+```text
+cargo test --offline --locked --all-targets
+cargo fmt -- --check
+cargo clippy --offline --locked --all-targets -- -D warnings
+cargo run --offline --bin caldav-recurrence-prototype -- \
+  --events fixtures/smoke-events.jsonl \
+  --transitions fixtures/smoke-zones.json \
+  --from 2026-03-07T00:00:00Z --to 2026-03-12T00:00:00Z \
+  --output /private/tmp/caldav-smoke-output.jsonl \
+  --state-dir /private/tmp/caldav-smoke-state
+```
+
+The full reviewed workload is generated and run from the trial checkout with
+the archived generator, then compared under `TZ=UTC` and
+`TZ=Pacific/Honolulu`. The exact commands and observed results are in
+`evidence/REPORT.md`.
+
+Fold is used only for the event-master keyed upsert/remove boundary. Recurrence
+semantics, civil-time conversion, SQLite authority, shard integrity, and
+filesystem publication remain outside BogKit. The controlled interruption hook
+tests preservation of the previous published output; it is not a claim about
+process-crash, filesystem, power-loss, or directory-sync durability.
diff --git a/developer-simulation/runs/2026-08-06--caldav-recurrence/evidence/REPORT.md b/developer-simulation/runs/2026-08-06--caldav-recurrence/evidence/REPORT.md
new file mode 100644
index 0000000..d1fa70e
--- /dev/null
+++ b/developer-simulation/runs/2026-08-06--caldav-recurrence/evidence/REPORT.md
@@ -0,0 +1,363 @@
+# BogKit daily-lab trial report
+
+Date: 2026-08-06
+
+Scenario: CalDAV recurrence and time-zone correctness
+
+Scope: only `/private/tmp/bogkit-sim-2026-08-06-one-rEQ2PZ`. No other checkout,
+prior lab report, developer-simulation directory, or GitHub surface was
+inspected or changed.
+
+## Result in one paragraph
+
+The stated baseline is not sufficient for the required correctness or
+determinism guarantees. A standalone prototype was built under `developer-simulation/runs/2026-08-06--caldav-recurrence/`. It
+uses Fold only for the event-master upsert/remove boundary; calendar rules,
+civil-time conversion, per-UID shards, and publication stay outside Fold. The
+local test suite passes. A fresh release run over 5,000 masters and 2,000,000
+candidate occurrences, with 100 supplied transition tables, completed in 3.85
+seconds wall time and reported 17,547,264 bytes peak RSS on this host. A
+second run reused all 5,000 fingerprinted shards in 2.93 seconds and produced
+byte-identical output. The supplied
+5,000-case oracle and production SQLite service are not present in this
+checkout, so neither production correctness nor oracle agreement is claimed.
+
+## Ordered discovery and friction trail
+
+The commands below are in the order used for onboarding and inspection.
+
+1. `sed -n '1,260p' README.md`
+
+   Observed the public onboarding path: run `scripts/new-project.sh`, then the
+   examples in the order `starter`, `timeseries`, `chat`, `search`. The README
+   describes Fold as a persistent, incrementally maintained dataflow engine;
+   it does not describe recurrence or time-zone primitives.
+
+2. `rg --files examples/starter | sort`
+
+   Observed only `Cargo.toml` and `src/main.rs`. Reading both showed the
+   smallest Fold shape: `Stream`, `wtx`, `rtx`, `Count`, and `Bag`. The public
+   `starter` manifest also declares unused `anny` and `ese` dependencies.
+
+3. `cargo run -p starter`
+
+   Observed a build failure in `ese` while its build script attempted to
+   download `target/ese-cache/model.safetensors`; name resolution was
+   unavailable. This is onboarding friction in the example dependency graph,
+   not a recurrence finding.
+
+4. `rg --files examples/timeseries | sort`, followed by reading its manifest
+   and `src/main.rs`
+
+   Observed `KeyBy` + `Aggregate` + `Table`, explicit snapshot sorting, and
+   retraction-safe aggregates.
+
+5. `cargo run -p timeseries`
+
+   Observed a successful run: six readings were materialized, hourly and daily
+   views were printed, one rainy reading was retracted, and the updated totals
+   were correct. This was the first public example that ran end to end in this
+   environment.
+
+6. `rg --files examples/chat | sort`, followed by reading its manifest and
+   `src/main.rs`
+
+   Observed the documented single-ingest-thread pattern, transactional writes,
+   watch snapshots, and explicit sorting of client-facing state.
+
+7. `cargo run -p chat`
+
+   Observed successful compilation and startup text, followed by a bind panic:
+   `Operation not permitted` at the listener bind. This is a sandbox network
+   restriction, not a BogKit dataflow defect.
+
+8. `rg --files examples/search | sort`, followed by reading its manifest and
+   `src/main.rs`
+
+   Observed `KeyedStream`, `upsert`, remove-by-key, BM25, HNSW, and hybrid
+   search. The example is unrelated to calendar semantics but reinforced the
+   keyed replacement model.
+
+9. `cargo run -p search`
+
+   Observed the same ESE model download/name-resolution failure as `starter`.
+
+10. Read the public Fold source documentation for `Stream`, `KeyedStream`,
+    `KeyedTx::upsert`, `KeyedTx::remove`, `Table`, `Aggregate`, and the public
+    tests for keyed transactions.
+
+    Observed that keyed upserts retract the old record before inserting the new
+    record, transactions are atomic, reads use one snapshot, and reopening the
+    same path resumes state. Also observed that Fold has no recurrence, civil
+    time, transition-table, SQLite, or JSONL publication abstraction.
+
+11. Wrote [`BASELINE.md`](../BASELINE.md) before selecting a component.
+
+12. Added the standalone prototype, fixtures, tests, and this report under
+    `developer-simulation/runs/2026-08-06--caldav-recurrence/`; no root Cargo file, Fold source, or existing example was changed.
+
+13. The first fresh release workload attempt measured 30.09 seconds. Inspection
+    identified 5,000 per-shard fsyncs plus a second full read of all shards to
+    assemble the output. The publication path was changed to stream one sorted
+    atomic output pass while still retaining per-UID shards for recovery.
+
+14. The corrected fresh release workload measured 3.85 seconds wall time and
+    17,547,264 bytes peak RSS. A second run reused all 5,000 shards after
+    verifying their byte lengths and SHA-256 fingerprints. Separate `TZ=UTC`
+    and `TZ=Pacific/Honolulu` runs produced byte-identical output.
+
+## Prototype model and boundaries
+
+The CLI is:
+
+```text
+caldav-recurrence-prototype \
+  --events EVENTS.jsonl \
+  --transitions ZONES.json \
+  --from RFC3339 --to RFC3339 \
+  --output OCCURRENCES.jsonl \
+  --state-dir STATE [--edits EDITS.jsonl]
+```
+
+The input format is deliberately small and documented in the CLI help and
+fixtures. It supports timed and all-day events, one `DAILY`, `WEEKLY`, or
+`MONTHLY` rule, interval/count/until, weekly `BYDAY`, monthly `BYMONTHDAY`,
+EXDATE values, and confirmed or cancelled occurrence overrides.
+
+The prototype gives each occurrence a stable `(UID, recurrence_id)` identity.
+All-day values remain civil dates. UTC values bypass local conversion. Local
+and floating times use only the supplied transition table. The chosen policy is
+explicit and deterministic: a fall-back fold chooses the earlier UTC instant;
+a spring-forward gap shifts the nonexistent wall time forward by the gap.
+Output is sorted by UID and recurrence ID and contains no summary, location, or
+event text.
+
+Fold's `KeyedStream<String, Event, Table<String, Event>>` is used for the
+event-master cache. A full validated input snapshot and optional edits are
+applied as one keyed transaction; absent UIDs are removed, replacements retract
+the old master, and the store is checkpointed. Each UID has a JSONL shard and
+SHA-256/length fingerprint. A changed or tampered UID rebuilds only its shard.
+All desired events are expanded and validated before the Fold event-store
+transaction; the final output is written to a temporary file, synced, and
+renamed only after all input and expansion work succeeds. An interrupted run
+leaves the previous published output intact; the next run ignores any
+unreferenced shard and rebuilds from the manifest.
+
+This is not a SQLite adapter and it is not a CalDAV server. JSONL stands in for
+a validated export at the prototype boundary. The production integration must
+keep SQLite authoritative and must connect the existing HTTP/CalDAV layer to
+the same occurrence identity and publication rules.
+
+## Verification commands and observed results
+
+All Rust commands below were run with `--offline` after the public onboarding
+attempts showed that network access was unavailable.
+
+```text
+cargo fmt --manifest-path developer-simulation/runs/2026-08-06--caldav-recurrence/Cargo.toml -- --check
+```
+
+Final result: passed. One intermediate check correctly reported formatting
+differences after the 100-zone fixture generator was added; `cargo fmt` fixed
+them and the final check passed.
+
+```text
+cargo test --manifest-path developer-simulation/runs/2026-08-06--caldav-recurrence/Cargo.toml --offline --all-targets
+```
+
+Final result: 10 integration tests passed. They cover DST gap/fold conversion,
+all-day and floating times, partial-day query intersection, daily/weekly/monthly
+rules, exclusions, canonical and unseen override rejection, stable ordering,
+host `TZ` independence, tampered-shard rebuilds, preflight store integrity,
+single-UID rebuilds, interruption recovery, and no publication after malformed
+input.
+
+```text
+cargo clippy --manifest-path developer-simulation/runs/2026-08-06--caldav-recurrence/Cargo.toml --offline --all-targets -- -D warnings
+```
+
+Final result: passed with warnings denied.
+
+```text
+developer-simulation/runs/2026-08-06--caldav-recurrence/target/debug/caldav-recurrence-prototype --help
+```
+
+Final result: passed; the usage text contains no stray help-marker character.
+
+```text
+cargo run --manifest-path developer-simulation/runs/2026-08-06--caldav-recurrence/Cargo.toml --offline --bin generate_fixture -- developer-simulation/runs/2026-08-06--caldav-recurrence/evidence/workload-100zones
+```
+
+Observed: `generated 5000 masters and 2000000 candidate occurrences`. The
+generated transition file contains 100 fixed transition tables plus
+`FLOATING`.
+
+```text
+cargo build --manifest-path developer-simulation/runs/2026-08-06--caldav-recurrence/Cargo.toml --offline --release --bin caldav-recurrence-prototype
+```
+
+Observed: release build passed.
+
+```text
+/usr/bin/time -p developer-simulation/runs/2026-08-06--caldav-recurrence/target/release/caldav-recurrence-prototype \
+  --events developer-simulation/runs/2026-08-06--caldav-recurrence/evidence/workload-100zones/workload-events.jsonl \
+  --transitions developer-simulation/runs/2026-08-06--caldav-recurrence/evidence/workload-100zones/workload-zones.json \
+  --from 2026-01-01T00:00:00Z --to 2027-06-01T00:00:00Z \
+  --output developer-simulation/runs/2026-08-06--caldav-recurrence/evidence/workload-100zones-output-rerun.jsonl \
+  --state-dir developer-simulation/runs/2026-08-06--caldav-recurrence/evidence/workload-100zones-state-rerun
+```
+
+Observed diagnostics:
+
+```json
+{"events":5000,"occurrences":2000000,"rebuilt_uids":5000,"reused_uids":0,"removed_uids":0,"resumed":false,"elapsed_ms":3585,"peak_rss_bytes":17547264,"publication":"atomic-rename"}
+```
+
+Observed `/usr/bin/time -p`: `real 3.85` on this host.
+
+The output contained 2,000,000 lines. A second run with the same inputs reported
+`rebuilt_uids:0`, `reused_uids:5000`, and `elapsed_ms:2923`; `cmp` found no byte
+difference between the two rerun output files. Separate CLI runs under
+`TZ=UTC` and `TZ=Pacific/Honolulu` also passed `cmp` with identical output.
+
+## Findings
+
+### F1 — Baseline has no stable occurrence identity or explicit local-time policy
+
+- Severity: high
+- Confidence: high
+- Category: baseline design defect, not a BogKit defect
+- Reproduction: the baseline expands local wall time, converts to UTC, replaces
+  whole rows, and emits insertion order; it has no recurrence ID, fold/gap
+  policy, all-day type distinction, or unique output key.
+- Smallest improvement: retain a civil recurrence identity, model all-day dates
+  separately, define supplied-table gap/fold rules, and publish by a stable key.
+
+### F2 — Fold fits keyed event replacement, but not calendar semantics
+
+- Severity: medium
+- Confidence: high
+- Category: component-fit finding, not a core defect
+- Reproduction: public APIs provide keyed upsert/remove, snapshots, and
+  retraction, but no RRULE parser, civil-date arithmetic, transition lookup,
+  SQLite adapter, or artifact publisher.
+- Smallest improvement: keep a narrow external calendar adapter and use
+  `KeyedStream` for event-master replacement/materialization only. Do not force
+  recurrence expansion into `Aggregate` or use `Bag` as a uniqueness index.
+
+### F3 — Public `starter` and `search` examples require an unavailable ESE model
+
+- Severity: low for this scenario; medium for onboarding
+- Confidence: high
+- Category: existing-example friction, not a prototype defect
+- Reproduction: `cargo run -p starter` and `cargo run -p search` both fail in
+  ESE's model download build step when DNS/network access is unavailable;
+  `starter` also declares ESE even though its source does not use it.
+- Smallest improvement: remove unused ESE/ANNy dependencies from `starter` and
+  make model-dependent examples fail with a clearer opt-in setup message.
+
+### F4 — Public `chat` cannot bind its demo listener in this sandbox
+
+- Severity: low
+- Confidence: high
+- Category: environment restriction, not a BogKit defect
+- Reproduction: `cargo run -p chat` compiles, prints its startup URL, then
+  panics with `Operation not permitted` at `TcpListener::bind`.
+- Smallest improvement: document a network-enabled run requirement or provide a
+  non-listening smoke mode.
+
+### F5 — Prototype does not yet preserve SQLite as the authoritative store
+
+- Severity: high for production acceptance; low for the standalone prototype
+  boundary
+- Confidence: high
+- Category: intentional prototype limitation, not a BogKit defect
+- Reproduction: the CLI consumes event JSONL and stores its cache in Fold's
+  local fjall state; no SQLite dependency is present in `developer-simulation/runs/2026-08-06--caldav-recurrence/Cargo.toml`.
+- Smallest improvement: add a read/transaction adapter over the existing SQLite
+  rows, keep Fold as a derived cache, and verify source-version plus publication
+  atomicity against the production schema.
+
+### F6 — External oracle and reference machine are absent
+
+- Severity: high unresolved acceptance risk
+- Confidence: high
+- Category: missing evidence, not a BogKit defect
+- Reproduction: the assigned checkout contains no supplied 5,000-case oracle and
+  no reference-machine specification.
+- Smallest improvement: run the prototype and the production candidate against
+  the supplied oracle, especially its exact gap/fold, override, and all-day
+  policies, then repeat the workload on the named reference machine.
+
+### F7 — Prototype intentionally covers a bounded recurrence subset
+
+- Severity: medium
+- Confidence: high
+- Category: prototype boundary
+- Reproduction: unsupported RRULE fields, multiple rules, RDATE, ordinal
+  BYDAY, and time-zone-changing overrides are rejected. This is deliberate
+  validation, not silent approximation.
+- Smallest improvement: add only the constructs present in the supplied oracle,
+  one at a time, with a differential test for each.
+
+## Skeptical review and final corrections
+
+The separate skeptical reviewer reproduced the DST, all-day, override, ordering,
+incremental, tampered-shard, preflight, host-time-zone, and full-workload
+claims. The review initially found five prototype correctness blockers: a
+partial-day all-day omission, equivalent timed override IDs overwriting one
+another, unseen overrides creating phantom occurrences, tampered shards being
+trusted, and invalid expansion mutating the durable event store before
+publication. It also found an incomplete trial README and a stray `+` in CLI
+help.
+
+The coordinator fixed all six issues before archival:
+
+- all-day intersection now uses a half-open date range that includes a date
+  touched by a partial-day query endpoint;
+- timed and all-day overrides are canonicalized before duplicate detection;
+- overrides must correspond to a generated recurrence identity;
+- every reusable shard carries and verifies byte length plus a SHA-256 digest;
+- all desired events are expanded before the Fold event-store transaction;
+- the trial README documents the supported schema, policies, commands, and
+  explicit durability boundary, and the help text was corrected.
+
+The corrected 10-test suite, strict formatting and Clippy, fresh release
+workload, fingerprinted shard reuse, tamper regression, and independent host
+time-zone comparisons all passed in the coordinator's reruns. The oracle,
+production SQLite integration, standards completeness, and
+filesystem or power-loss durability remain explicitly unverified. No BogKit
+correctness defect was demonstrated; Fold remains a narrow event-master fit,
+not a calendar-semantics or publication solution.
+
+## Decision audit
+
+1. The baseline was modeled before choosing a component. The problem is
+   primarily identity, local-time semantics, deterministic ordering, and
+   publication—not a generic aggregation problem.
+2. `KeyedStream` was selected because its documented upsert retracts the old
+   value and its transaction/reopen behavior matches event-master edits.
+3. `Table` was selected as the keyed sink because the event master has one value
+   per UID. A `Bag` was rejected because multiplicity is not occurrence
+   uniqueness. `Aggregate` was rejected because recurrence expansion is not an
+   invertible scalar accumulation. ANNy and ESE have no fit.
+4. Calendar semantics remain outside Fold because no public BogKit component
+   covers the required rules or supplied transition tables.
+5. The output is sharded and streamed so the 2-million-candidate fixture stays
+   within the measured memory budget while still allowing a one-UID rebuild.
+6. No BogKit core, existing example, GitHub, or automation state was changed.
+
+## Unresolved uncertainty
+
+- The local gap/fold policy is explicit, but oracle agreement is unknown until
+  the supplied oracle is available.
+- SQLite authority and integration with the deployed HTTP/CalDAV layer remain
+  untested by this standalone CLI.
+- The workload and RSS numbers are from this environment, not the unavailable
+  named reference machine.
+- Process interruption recovery was tested with the CLI's simulated interruption
+  hook. Full OS/power-loss durability of the parent-directory rename metadata
+  still needs a platform-specific verification.
+- The prototype rejects malformed or unsupported input before publication, but
+  the complete production iCalendar parsing surface is intentionally outside
+  the prototype boundary.
diff --git a/developer-simulation/runs/2026-08-06--caldav-recurrence/fixtures/smoke-events.jsonl b/developer-simulation/runs/2026-08-06--caldav-recurrence/fixtures/smoke-events.jsonl
new file mode 100644
index 0000000..8838085
--- /dev/null
+++ b/developer-simulation/runs/2026-08-06--caldav-recurrence/fixtures/smoke-events.jsonl
@@ -0,0 +1,3 @@
+{"uid":"dst-meeting","kind":"timed","start":"2026-03-07T09:00:00","end":"2026-03-07T10:00:00","tzid":"America/New_York","rrule":"FREQ=DAILY;COUNT=4","exdate":["2026-03-09T09:00:00"],"overrides":[{"recurrence_id":"2026-03-08T09:00:00","start":"2026-03-08T11:00:00","end":"2026-03-08T12:00:00"},{"recurrence_id":"2026-03-10T09:00:00","status":"cancelled"}]}
+{"uid":"all-day","kind":"all_day","start":"2026-03-08","end":"2026-03-09"}
+{"uid":"floating","kind":"timed","start":"2026-03-08T09:00:00","end":"2026-03-08T10:00:00"}
diff --git a/developer-simulation/runs/2026-08-06--caldav-recurrence/fixtures/smoke-zones.json b/developer-simulation/runs/2026-08-06--caldav-recurrence/fixtures/smoke-zones.json
new file mode 100644
index 0000000..388e79b
--- /dev/null
+++ b/developer-simulation/runs/2026-08-06--caldav-recurrence/fixtures/smoke-zones.json
@@ -0,0 +1,15 @@
+{
+  "zones": {
+    "America/New_York": {
+      "initial_offset_seconds": -18000,
+      "transitions": [
+        {"at_utc":"2026-03-08T07:00:00Z","offset_after_seconds":-14400},
+        {"at_utc":"2026-11-01T06:00:00Z","offset_after_seconds":-18000}
+      ]
+    },
+    "FLOATING": {
+      "initial_offset_seconds": 0,
+      "transitions": []
+    }
+  }
+}
diff --git a/developer-simulation/runs/2026-08-06--caldav-recurrence/src/bin/generate_fixture.rs b/developer-simulation/runs/2026-08-06--caldav-recurrence/src/bin/generate_fixture.rs
new file mode 100644
index 0000000..134b6e4
--- /dev/null
+++ b/developer-simulation/runs/2026-08-06--caldav-recurrence/src/bin/generate_fixture.rs
@@ -0,0 +1,50 @@
+use std::fmt::Write as _;
+use std::fs::{self, File};
+use std::io::{BufWriter, Write};
+use std::path::PathBuf;
+
+use caldav_recurrence_prototype::Event;
+
+fn main() {
+    let output_dir = std::env::args()
+        .nth(1)
+        .map(PathBuf::from)
+        .unwrap_or_else(|| PathBuf::from("fixtures/generated"));
+    fs::create_dir_all(&output_dir).expect("create fixture directory");
+
+    let events_path = output_dir.join("workload-events.jsonl");
+    let file = File::create(&events_path).expect("create workload events");
+    let mut writer = BufWriter::new(file);
+    for index in 0..5_000 {
+        let event = Event {
+            uid: format!("workload-{index:04}"),
+            kind: "timed".to_string(),
+            start: "2026-01-01T09:00:00Z".to_string(),
+            end: "2026-01-01T10:00:00Z".to_string(),
+            tzid: Some("UTC".to_string()),
+            rrule: Some("FREQ=DAILY;COUNT=400".to_string()),
+            exdate: Vec::new(),
+            overrides: Vec::new(),
+        };
+        serde_json::to_writer(&mut writer, &event).expect("encode workload event");
+        writer.write_all(b"\n").expect("write workload event");
+    }
+    writer.flush().expect("flush workload events");
+
+    let mut zones = String::from("{\n  \"zones\": {\n");
+    for index in 0..100 {
+        if index > 0 {
+            zones.push_str(",\n");
+        }
+        write!(
+            zones,
+            "    \"Fixture/Zone{index:03}\": {{\"initial_offset_seconds\":0,\"transitions\":[]}}"
+        )
+        .expect("format fixture zone");
+    }
+    zones.push_str(
+        ",\n    \"FLOATING\": {\"initial_offset_seconds\":0,\"transitions\":[]}\n  }\n}\n",
+    );
+    fs::write(output_dir.join("workload-zones.json"), zones).expect("write workload zones");
+    println!("generated 5000 masters and 2000000 candidate occurrences");
+}
diff --git a/developer-simulation/runs/2026-08-06--caldav-recurrence/src/lib.rs b/developer-simulation/runs/2026-08-06--caldav-recurrence/src/lib.rs
new file mode 100644
index 0000000..e8bf746
--- /dev/null
+++ b/developer-simulation/runs/2026-08-06--caldav-recurrence/src/lib.rs
@@ -0,0 +1,1594 @@
+use std::collections::{BTreeMap, BTreeSet};
+use std::fs::{self, File, OpenOptions};
+use std::io::{BufRead, BufReader, BufWriter, Read, Write};
+use std::path::{Path, PathBuf};
+use std::time::Instant;
+
+use chrono::{
+    DateTime, Datelike, Days, Duration, FixedOffset, NaiveDate, NaiveDateTime, SecondsFormat, Utc,
+    Weekday,
+};
+use fold::pipeline::terminal;
+use fold::stream::KeyedStream;
+use serde::{Deserialize, Serialize, de::DeserializeOwned};
+use sha2::{Digest, Sha256};
+
+pub type EventStore = KeyedStream<String, Event, terminal::Table<String, Event>>;
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct Event {
+    pub uid: String,
+    pub kind: String,
+    pub start: String,
+    pub end: String,
+    #[serde(default)]
+    pub tzid: Option<String>,
+    #[serde(default)]
+    pub rrule: Option<String>,
+    #[serde(default)]
+    pub exdate: Vec<String>,
+    #[serde(default)]
+    pub overrides: Vec<Override>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct Override {
+    pub recurrence_id: String,
+    #[serde(default)]
+    pub status: Option<String>,
+    #[serde(default)]
+    pub start: Option<String>,
+    #[serde(default)]
+    pub end: Option<String>,
+    #[serde(default)]
+    pub tzid: Option<String>,
+}
+
+#[derive(Debug, Clone, Deserialize)]
+pub struct Edit {
+    pub uid: String,
+    #[serde(default)]
+    pub delete: bool,
+    #[serde(default)]
+    pub event: Option<Event>,
+}
+
+#[derive(Debug, Clone, Deserialize)]
+struct TransitionFile {
+    zones: BTreeMap<String, ZoneInput>,
+}
+
+#[derive(Debug, Clone, Deserialize)]
+struct ZoneInput {
+    initial_offset_seconds: i32,
+    #[serde(default)]
+    transitions: Vec<TransitionInput>,
+}
+
+#[derive(Debug, Clone, Deserialize)]
+struct TransitionInput {
+    at_utc: String,
+    offset_after_seconds: i32,
+}
+
+#[derive(Debug, Clone)]
+struct Transition {
+    at_utc: i64,
+    offset_before: i32,
+    offset_after: i32,
+}
+
+#[derive(Debug, Clone)]
+struct Zone {
+    initial_offset: i32,
+    transitions: Vec<Transition>,
+}
+
+#[derive(Debug, Clone)]
+struct ZoneBook {
+    zones: BTreeMap<String, Zone>,
+}
+
+impl ZoneBook {
+    fn parse(raw: &[u8]) -> Result<Self, String> {
+        let input: TransitionFile = serde_json::from_slice(raw)
+            .map_err(|_| "transition file is not valid JSON".to_string())?;
+        if input.zones.is_empty() {
+            return Err("transition file has no zones".to_string());
+        }
+
+        let mut zones = BTreeMap::new();
+        for (name, zone_input) in input.zones {
+            if name.is_empty() || name.len() > 128 {
+                return Err("transition file has an invalid zone name".to_string());
+            }
+            validate_offset(zone_input.initial_offset_seconds)?;
+            let mut transitions = Vec::with_capacity(zone_input.transitions.len());
+            let mut previous_at = None;
+            let mut previous_offset = zone_input.initial_offset_seconds;
+            for transition in zone_input.transitions {
+                let at_utc = parse_utc_seconds(&transition.at_utc)
+                    .map_err(|_| "transition file has an invalid transition instant".to_string())?;
+                validate_offset(transition.offset_after_seconds)?;
+                if previous_at.is_some_and(|value| at_utc <= value) {
+                    return Err("transition table is not strictly ordered".to_string());
+                }
+                transitions.push(Transition {
+                    at_utc,
+                    offset_before: previous_offset,
+                    offset_after: transition.offset_after_seconds,
+                });
+                previous_at = Some(at_utc);
+                previous_offset = transition.offset_after_seconds;
+            }
+            zones.insert(
+                name,
+                Zone {
+                    initial_offset: zone_input.initial_offset_seconds,
+                    transitions,
+                },
+            );
+        }
+        Ok(ZoneBook { zones })
+    }
+
+    fn require(&self, name: &str) -> Result<&Zone, String> {
+        if name == "UTC" {
+            return Err(
+                "UTC is implicit and must not be supplied as a transition zone".to_string(),
+            );
+        }
+        self.zones
+            .get(name)
+            .ok_or_else(|| "event references a zone absent from the transition file".to_string())
+    }
+}
+
+impl Zone {
+    fn offset_at(&self, utc_seconds: i64) -> i32 {
+        let mut low = 0usize;
+        let mut high = self.transitions.len();
+        while low < high {
+            let middle = (low + high) / 2;
+            if self.transitions[middle].at_utc <= utc_seconds {
+                low = middle + 1;
+            } else {
+                high = middle;
+            }
+        }
+        if low == 0 {
+            self.initial_offset
+        } else {
+            self.transitions[low - 1].offset_after
+        }
+    }
+
+    fn local_to_utc(&self, local: NaiveDateTime) -> Result<i64, String> {
+        let local_seconds = local.and_utc().timestamp();
+        let mut offsets = Vec::with_capacity(6);
+        push_unique(&mut offsets, self.initial_offset);
+        push_unique(&mut offsets, self.offset_at(local_seconds));
+
+        // Only transitions near the local wall time can create a gap or fold.
+        // This keeps expansion independent of the number of historical rows in
+        // a supplied table while still considering both sides of a transition.
+        let lower = local_seconds.saturating_sub(172_800);
+        let upper = local_seconds.saturating_add(172_800);
+        let mut index = self.first_transition_at_or_after(lower);
+        if index > 0 {
+            let transition = &self.transitions[index - 1];
+            push_unique(&mut offsets, transition.offset_before);
+            push_unique(&mut offsets, transition.offset_after);
+        }
+        while index < self.transitions.len() && self.transitions[index].at_utc <= upper {
+            let transition = &self.transitions[index];
+            push_unique(&mut offsets, transition.offset_before);
+            push_unique(&mut offsets, transition.offset_after);
+            index += 1;
+        }
+
+        let mut candidates = Vec::new();
+        for offset in offsets {
+            let candidate = local_seconds - i64::from(offset);
+            if self.offset_at(candidate) == offset {
+                candidates.push(candidate);
+            }
+        }
+        candidates.sort_unstable();
+        candidates.dedup();
+        if let Some(earliest) = candidates.first() {
+            // A fold has two valid instants. Choosing the earlier one is
+            // deterministic and corresponds to the pre-transition side.
+            return Ok(*earliest);
+        }
+
+        for transition in &self.transitions {
+            if transition.offset_after > transition.offset_before {
+                let gap_start = transition.at_utc + i64::from(transition.offset_before);
+                let gap_end = transition.at_utc + i64::from(transition.offset_after);
+                if (gap_start..gap_end).contains(&local_seconds) {
+                    // Shift a nonexistent wall time forward by the gap.
+                    return Ok(local_seconds - i64::from(transition.offset_before));
+                }
+            }
+        }
+        Err("local time is not representable by the supplied transition table".to_string())
+    }
+
+    fn first_transition_at_or_after(&self, value: i64) -> usize {
+        let mut low = 0usize;
+        let mut high = self.transitions.len();
+        while low < high {
+            let middle = (low + high) / 2;
+            if self.transitions[middle].at_utc < value {
+                low = middle + 1;
+            } else {
+                high = middle;
+            }
+        }
+        low
+    }
+}
+
+fn push_unique(values: &mut Vec<i32>, value: i32) {
+    if !values.contains(&value) {
+        values.push(value);
+    }
+}
+
+fn validate_offset(value: i32) -> Result<(), String> {
+    if !(-86_400..=86_400).contains(&value) {
+        Err("transition table contains an invalid UTC offset".to_string())
+    } else {
+        Ok(())
+    }
+}
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+enum TimeMode {
+    Utc,
+    Zone(String),
+}
+
+#[derive(Debug, Clone)]
+enum EventPlan {
+    Timed {
+        uid: String,
+        start: NaiveDateTime,
+        end: NaiveDateTime,
+        mode: TimeMode,
+        rule: Option<Rule>,
+        exdates: BTreeSet<String>,
+        overrides: BTreeMap<String, OverridePlan>,
+    },
+    AllDay {
+        uid: String,
+        start: NaiveDate,
+        end: NaiveDate,
+        rule: Option<Rule>,
+        exdates: BTreeSet<String>,
+        overrides: BTreeMap<String, OverridePlan>,
+    },
+}
+
+#[derive(Debug, Clone)]
+struct OverridePlan {
+    cancelled: bool,
+    timed_start: Option<NaiveDateTime>,
+    timed_end: Option<NaiveDateTime>,
+    all_day_start: Option<NaiveDate>,
+    all_day_end: Option<NaiveDate>,
+}
+
+#[derive(Debug, Clone)]
+struct Rule {
+    frequency: Frequency,
+    interval: i64,
+    count: Option<u64>,
+    until: Option<Until>,
+    byday: Vec<Weekday>,
+    bymonthday: Vec<i32>,
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+enum Frequency {
+    Daily,
+    Weekly,
+    Monthly,
+}
+
+#[derive(Debug, Clone)]
+enum Until {
+    Date(NaiveDate),
+    DateTime(NaiveDateTime),
+}
+
+#[derive(Debug, Clone)]
+struct Window {
+    from_utc: i64,
+    to_utc: i64,
+    from_date: NaiveDate,
+    to_date_exclusive: NaiveDate,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct Occurrence {
+    pub uid: String,
+    pub recurrence_id: String,
+    pub kind: String,
+    pub start: String,
+    pub end: String,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+struct Manifest {
+    version: u32,
+    context_hash: u64,
+    shards: BTreeMap<String, ShardMeta>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+struct ShardMeta {
+    event_hash: u64,
+    shard: String,
+    #[serde(default)]
+    byte_length: u64,
+    #[serde(default)]
+    content_hash: String,
+}
+
+#[derive(Debug, Clone)]
+pub struct Config {
+    pub events: PathBuf,
+    pub transitions: PathBuf,
+    pub from: String,
+    pub to: String,
+    pub output: PathBuf,
+    pub state_dir: PathBuf,
+    pub edits: Option<PathBuf>,
+    pub crash_after_uid: Option<String>,
+}
+
+#[derive(Debug, Clone, Serialize)]
+pub struct RunResult {
+    pub events: usize,
+    pub occurrences: usize,
+    pub rebuilt_uids: usize,
+    pub reused_uids: usize,
+    pub removed_uids: usize,
+    pub resumed: bool,
+    pub elapsed_ms: u128,
+    pub peak_rss_bytes: Option<u64>,
+    pub publication: &'static str,
+}
+
+pub fn run(config: &Config) -> Result<RunResult, String> {
+    let started = Instant::now();
+    let event_values = read_jsonl::<Event>(&config.events, "events")?;
+    let transition_raw =
+        fs::read(&config.transitions).map_err(|_| "could not read transition file".to_string())?;
+    let zones = ZoneBook::parse(&transition_raw)?;
+    let window = parse_window(&config.from, &config.to)?;
+
+    let mut desired = BTreeMap::new();
+    for event in event_values {
+        if desired.insert(event.uid.clone(), event).is_some() {
+            return Err("events contain a duplicate UID".to_string());
+        }
+    }
+    if let Some(edits_path) = &config.edits {
+        let edits = read_jsonl::<Edit>(edits_path, "edits")?;
+        let mut edit_uids = BTreeSet::new();
+        for edit in edits {
+            if edit.uid.is_empty() || !edit_uids.insert(edit.uid.clone()) {
+                return Err("edits contain an invalid or duplicate UID".to_string());
+            }
+            if edit.delete == edit.event.is_some() {
+                return Err("each edit must be exactly one of delete or replacement".to_string());
+            }
+            if let Some(event) = edit.event {
+                if event.uid != edit.uid {
+                    return Err("edit UID does not match replacement event".to_string());
+                }
+                build_plan(&event, &zones)?;
+                desired.insert(edit.uid, event);
+            } else {
+                desired.remove(&edit.uid);
+            }
+        }
+    }
+
+    // Validate expansion before touching the durable event store. If a
+    // recurrence cannot be expanded, the previous authoritative snapshot and
+    // published output remain unchanged.
+    for event in desired.values() {
+        let plan = build_plan(event, &zones)?;
+        expand_plan(&plan, &window, &zones)?;
+    }
+
+    fs::create_dir_all(&config.state_dir)
+        .map_err(|_| "could not create state directory".to_string())?;
+    if let Some(parent) = config.output.parent() {
+        fs::create_dir_all(parent).map_err(|_| "could not create output directory".to_string())?;
+    }
+    let shard_dir = config.state_dir.join("shards");
+    fs::create_dir_all(&shard_dir).map_err(|_| "could not create shard directory".to_string())?;
+
+    let store_path = config.state_dir.join("event-store");
+    let mut store = EventStore::new(&store_path, terminal::Table::new("events"));
+    let existing_uids = store.rtx(|table| table.iter().map(|(uid, _)| uid).collect::<Vec<_>>());
+    let mut removed_uids = 0;
+    store.wtx(|tx| {
+        for uid in &existing_uids {
+            if !desired.contains_key(uid) {
+                tx.remove(uid);
+                removed_uids += 1;
+            }
+        }
+        for (uid, event) in &desired {
+            tx.upsert(uid, event);
+        }
+    });
+    store.checkpoint();
+
+    let mut current_events = store.rtx(|table| table.iter().collect::<Vec<(String, Event)>>());
+    current_events.sort_by(|a, b| a.0.cmp(&b.0));
+
+    let manifest_path = config.state_dir.join("manifest.json");
+    let previous_manifest = read_manifest(&manifest_path)?;
+    let context_hash = hash_context(&transition_raw, &config.from, &config.to);
+    let resumed = previous_manifest.is_some();
+    let mut next_manifest = Manifest {
+        version: 1,
+        context_hash,
+        shards: BTreeMap::new(),
+    };
+    let mut publication = PublicationWriter::new(&config.output)?;
+    let mut rebuilt_uids = 0;
+    let mut reused_uids = 0;
+    let mut occurrence_count = 0;
+
+    for (uid, event) in &current_events {
+        let event_hash = hash_bytes(&serde_json::to_vec(event).unwrap_or_default());
+        let shard_name = format!("{}.jsonl", hex(uid.as_bytes()));
+        let shard_path = shard_dir.join(&shard_name);
+        let reusable = previous_manifest.as_ref().is_some_and(|manifest| {
+            manifest.version == 1
+                && manifest.context_hash == context_hash
+                && manifest.shards.get(uid).is_some_and(|meta| {
+                    meta.event_hash == event_hash && verify_shard_metadata(&shard_path, meta)
+                })
+        });
+
+        let occurrences = if reusable {
+            reused_uids += 1;
+            let occurrences = read_occurrences(&shard_path)?;
+            validate_shard(&occurrences, uid)?;
+            publication.append_shard(&shard_path)?;
+            occurrences
+        } else {
+            rebuilt_uids += 1;
+            let plan = build_plan(event, &zones)?;
+            let occurrences = expand_plan(&plan, &window, &zones)?;
+            validate_shard(&occurrences, uid)?;
+            write_shard_and_append(&shard_path, &occurrences, &mut publication)?;
+            if config.crash_after_uid.as_deref() == Some(uid.as_str()) {
+                return Err("simulated interruption after one shard commit".to_string());
+            }
+            occurrences
+        };
+
+        let (byte_length, content_hash) = fingerprint_file(&shard_path)?;
+
+        next_manifest.shards.insert(
+            uid.clone(),
+            ShardMeta {
+                event_hash,
+                shard: shard_name,
+                byte_length,
+                content_hash,
+            },
+        );
+        occurrence_count += occurrences.len();
+    }
+
+    publication.finish()?;
+    atomic_write_json(&manifest_path, &next_manifest)?;
+
+    Ok(RunResult {
+        events: current_events.len(),
+        occurrences: occurrence_count,
+        rebuilt_uids,
+        reused_uids,
+        removed_uids,
+        resumed,
+        elapsed_ms: started.elapsed().as_millis(),
+        peak_rss_bytes: process_max_rss_bytes(),
+        publication: "atomic-rename",
+    })
+}
+
+#[cfg(unix)]
+fn process_max_rss_bytes() -> Option<u64> {
+    let mut usage = std::mem::MaybeUninit::<libc::rusage>::zeroed();
+    // SAFETY: getrusage initializes the rusage structure when it returns 0.
+    let result = unsafe { libc::getrusage(libc::RUSAGE_SELF, usage.as_mut_ptr()) };
+    if result != 0 {
+        return None;
+    }
+    // macOS reports bytes; Linux and the other Unix targets report KiB.
+    let raw = u64::try_from(unsafe { usage.assume_init() }.ru_maxrss).ok()?;
+    #[cfg(target_os = "linux")]
+    {
+        raw.checked_mul(1024)
+    }
+    #[cfg(not(target_os = "linux"))]
+    {
+        Some(raw)
+    }
+}
+
+#[cfg(not(unix))]
+fn process_max_rss_bytes() -> Option<u64> {
+    None
+}
+
+fn read_jsonl<T: DeserializeOwned>(path: &Path, label: &str) -> Result<Vec<T>, String> {
+    let file = File::open(path).map_err(|_| format!("could not read {label} input"))?;
+    let reader = BufReader::new(file);
+    let mut values = Vec::new();
+    for (line_number, line) in reader.lines().enumerate() {
+        let line = line.map_err(|_| format!("could not read {label} input"))?;
+        if line.trim().is_empty() {
+            continue;
+        }
+        values.push(serde_json::from_str(&line).map_err(|_| {
+            format!(
+                "{label} input has malformed JSON at line {}",
+                line_number + 1
+            )
+        })?);
+    }
+    Ok(values)
+}
+
+fn parse_window(from: &str, to: &str) -> Result<Window, String> {
+    let from_utc =
+        parse_utc_seconds(from).map_err(|_| "query start is not RFC3339 UTC".to_string())?;
+    let to_utc = parse_utc_seconds(to).map_err(|_| "query end is not RFC3339 UTC".to_string())?;
+    if from_utc >= to_utc {
+        return Err("query window must have a positive duration".to_string());
+    }
+    let from_date = DateTime::<Utc>::from_timestamp(from_utc, 0)
+        .ok_or_else(|| "query start is out of range".to_string())?
+        .date_naive();
+    let to_date = DateTime::<Utc>::from_timestamp(to_utc, 0)
+        .ok_or_else(|| "query end is out of range".to_string())?
+        .date_naive();
+    let to_date_exclusive = if to_utc.rem_euclid(86_400) == 0 {
+        to_date
+    } else {
+        to_date
+            .checked_add_days(Days::new(1))
+            .ok_or_else(|| "query end date is out of range".to_string())?
+    };
+    Ok(Window {
+        from_utc,
+        to_utc,
+        from_date,
+        to_date_exclusive,
+    })
+}
+
+fn build_plan(event: &Event, zones: &ZoneBook) -> Result<EventPlan, String> {
+    if event.uid.is_empty() || event.uid.len() > 512 || event.uid.chars().any(char::is_control) {
+        return Err("event has an invalid UID".to_string());
+    }
+    let rule = event.rrule.as_deref().map(parse_rule).transpose()?;
+    match event.kind.as_str() {
+        "timed" => build_timed_plan(event, zones, rule),
+        "all_day" => build_all_day_plan(event, rule),
+        _ => Err("event kind is unsupported".to_string()),
+    }
+}
+
+fn build_timed_plan(
+    event: &Event,
+    zones: &ZoneBook,
+    rule: Option<Rule>,
+) -> Result<EventPlan, String> {
+    let mode = match event.tzid.as_deref() {
+        Some("UTC") => TimeMode::Utc,
+        Some(name) => {
+            zones.require(name)?;
+            TimeMode::Zone(name.to_string())
+        }
+        None => {
+            zones.require("FLOATING")?;
+            TimeMode::Zone("FLOATING".to_string())
+        }
+    };
+    let start = parse_timed_for_mode(&event.start, &mode)?;
+    let end = parse_timed_for_mode(&event.end, &mode)?;
+    if start >= end {
+        return Err("timed event end must be after start".to_string());
+    }
+
+    let mut exdates = BTreeSet::new();
+    for value in &event.exdate {
+        let parsed = parse_timed_for_mode(value, &mode)?;
+        exdates.insert(format_recurrence_id(parsed, &mode));
+    }
+    let mut overrides = BTreeMap::new();
+    for value in &event.overrides {
+        let recurrence_id = canonical_timed_id(&value.recurrence_id, &mode)?;
+        if overrides.contains_key(&recurrence_id) {
+            return Err("event has duplicate occurrence overrides".to_string());
+        }
+        let status = value.status.as_deref().unwrap_or("confirmed");
+        if status != "confirmed" && status != "cancelled" {
+            return Err("occurrence override status is unsupported".to_string());
+        }
+        if value.tzid.as_deref().is_some_and(|tzid| {
+            Some(tzid)
+                != match &mode {
+                    TimeMode::Utc => Some("UTC"),
+                    TimeMode::Zone(name) => Some(name.as_str()),
+                }
+        }) {
+            return Err("occurrence override changes time zone".to_string());
+        }
+        if status == "cancelled" {
+            if value.start.is_some() || value.end.is_some() {
+                return Err("cancelled override must not have start or end".to_string());
+            }
+            overrides.insert(
+                recurrence_id,
+                OverridePlan {
+                    cancelled: true,
+                    timed_start: None,
+                    timed_end: None,
+                    all_day_start: None,
+                    all_day_end: None,
+                },
+            );
+        } else {
+            let start_value = value
+                .start
+                .as_deref()
+                .ok_or_else(|| "replacement override is missing start".to_string())?;
+            let end_value = value
+                .end
+                .as_deref()
+                .ok_or_else(|| "replacement override is missing end".to_string())?;
+            let start_value = parse_timed_for_mode(start_value, &mode)?;
+            let end_value = parse_timed_for_mode(end_value, &mode)?;
+            if start_value >= end_value {
+                return Err("replacement override end must be after start".to_string());
+            }
+            overrides.insert(
+                recurrence_id,
+                OverridePlan {
+                    cancelled: false,
+                    timed_start: Some(start_value),
+                    timed_end: Some(end_value),
+                    all_day_start: None,
+                    all_day_end: None,
+                },
+            );
+        }
+    }
+    Ok(EventPlan::Timed {
+        uid: event.uid.clone(),
+        start,
+        end,
+        mode,
+        rule,
+        exdates,
+        overrides,
+    })
+}
+
+fn build_all_day_plan(event: &Event, rule: Option<Rule>) -> Result<EventPlan, String> {
+    if event.tzid.is_some() {
+        return Err("all-day event must not carry a TZID".to_string());
+    }
+    let start = parse_date(&event.start)?;
+    let end = parse_date(&event.end)?;
+    if start >= end {
+        return Err("all-day event end must be after start".to_string());
+    }
+    let mut exdates = BTreeSet::new();
+    for value in &event.exdate {
+        exdates.insert(parse_date(value)?.format("%Y-%m-%d").to_string());
+    }
+    let mut overrides = BTreeMap::new();
+    for value in &event.overrides {
+        let recurrence_id = parse_date(&value.recurrence_id)?
+            .format("%Y-%m-%d")
+            .to_string();
+        if overrides.contains_key(&recurrence_id) {
+            return Err("event has duplicate occurrence overrides".to_string());
+        }
+        let status = value.status.as_deref().unwrap_or("confirmed");
+        if status != "confirmed" && status != "cancelled" {
+            return Err("occurrence override status is unsupported".to_string());
+        }
+        if value.tzid.is_some() {
+            return Err("all-day occurrence override must not carry a TZID".to_string());
+        }
+        if status == "cancelled" {
+            if value.start.is_some() || value.end.is_some() {
+                return Err("cancelled override must not have start or end".to_string());
+            }
+            overrides.insert(
+                recurrence_id,
+                OverridePlan {
+                    cancelled: true,
+                    timed_start: None,
+                    timed_end: None,
+                    all_day_start: None,
+                    all_day_end: None,
+                },
+            );
+        } else {
+            let replacement_start = parse_date(
+                value
+                    .start
+                    .as_deref()
+                    .ok_or_else(|| "replacement override is missing start".to_string())?,
+            )?;
+            let replacement_end = parse_date(
+                value
+                    .end
+                    .as_deref()
+                    .ok_or_else(|| "replacement override is missing end".to_string())?,
+            )?;
+            if replacement_start >= replacement_end {
+                return Err("replacement override end must be after start".to_string());
+            }
+            overrides.insert(
+                recurrence_id,
+                OverridePlan {
+                    cancelled: false,
+                    timed_start: None,
+                    timed_end: None,
+                    all_day_start: Some(replacement_start),
+                    all_day_end: Some(replacement_end),
+                },
+            );
+        }
+    }
+    Ok(EventPlan::AllDay {
+        uid: event.uid.clone(),
+        start,
+        end,
+        rule,
+        exdates,
+        overrides,
+    })
+}
+
+fn parse_rule(raw: &str) -> Result<Rule, String> {
+    if raw.is_empty() {
+        return Err("recurrence rule is empty".to_string());
+    }
+    let mut fields = BTreeMap::new();
+    for part in raw.split(';') {
+        let (key, value) = part
+            .split_once('=')
+            .ok_or_else(|| "recurrence rule has a malformed field".to_string())?;
+        let key = key.to_ascii_uppercase();
+        if fields.insert(key, value.to_string()).is_some() {
+            return Err("recurrence rule has a duplicate field".to_string());
+        }
+    }
+    let frequency = match fields.remove("FREQ").as_deref() {
+        Some("DAILY") => Frequency::Daily,
+        Some("WEEKLY") => Frequency::Weekly,
+        Some("MONTHLY") => Frequency::Monthly,
+        _ => return Err("recurrence frequency is unsupported or missing".to_string()),
+    };
+    let interval = fields.remove("INTERVAL").map_or(Ok(1), |value| {
+        value
+            .parse::<i64>()
+            .map_err(|_| "recurrence interval is invalid".to_string())
+    })?;
+    if interval <= 0 {
+        return Err("recurrence interval must be positive".to_string());
+    }
+    let count = fields
+        .remove("COUNT")
+        .map(|value| {
+            value
+                .parse::<u64>()
+                .map_err(|_| "recurrence count is invalid".to_string())
+        })
+        .transpose()?;
+    if count == Some(0) {
+        return Err("recurrence count must be positive".to_string());
+    }
+    let until = fields
+        .remove("UNTIL")
+        .map(|value| parse_until(&value))
+        .transpose()?;
+    let byday = fields
+        .remove("BYDAY")
+        .map(|value| parse_byday(&value))
+        .transpose()?
+        .unwrap_or_default();
+    let bymonthday = fields
+        .remove("BYMONTHDAY")
+        .map(|value| parse_bymonthday(&value))
+        .transpose()?
+        .unwrap_or_default();
+    if !fields.is_empty() {
+        return Err("recurrence rule contains an unsupported field".to_string());
+    }
+    if frequency != Frequency::Weekly && !byday.is_empty() {
+        return Err("BYDAY is supported only for weekly rules".to_string());
+    }
+    if frequency != Frequency::Monthly && !bymonthday.is_empty() {
+        return Err("BYMONTHDAY is supported only for monthly rules".to_string());
+    }
+    Ok(Rule {
+        frequency,
+        interval,
+        count,
+        until,
+        byday,
+        bymonthday,
+    })
+}
+
+fn parse_until(value: &str) -> Result<Until, String> {
+    if let Ok(date) = NaiveDate::parse_from_str(value, "%Y%m%d") {
+        return Ok(Until::Date(date));
+    }
+    if let Ok(date) = NaiveDate::parse_from_str(value, "%Y-%m-%d") {
+        return Ok(Until::Date(date));
+    }
+    let value = value.trim_end_matches('Z');
+    let datetime = NaiveDateTime::parse_from_str(value, "%Y%m%dT%H%M%S")
+        .or_else(|_| NaiveDateTime::parse_from_str(value, "%Y-%m-%dT%H:%M:%S"))
+        .map_err(|_| "recurrence UNTIL is invalid".to_string())?;
+    Ok(Until::DateTime(datetime))
+}
+
+fn parse_byday(value: &str) -> Result<Vec<Weekday>, String> {
+    let mut days = Vec::new();
+    for token in value.split(',') {
+        let day = match token {
+            "MO" => Weekday::Mon,
+            "TU" => Weekday::Tue,
+            "WE" => Weekday::Wed,
+            "TH" => Weekday::Thu,
+            "FR" => Weekday::Fri,
+            "SA" => Weekday::Sat,
+            "SU" => Weekday::Sun,
+            _ => return Err("recurrence BYDAY is invalid".to_string()),
+        };
+        if days.contains(&day) {
+            return Err("recurrence BYDAY has a duplicate day".to_string());
+        }
+        days.push(day);
+    }
+    days.sort_by_key(|day| day.num_days_from_monday());
+    Ok(days)
+}
+
+fn parse_bymonthday(value: &str) -> Result<Vec<i32>, String> {
+    let mut days = Vec::new();
+    for token in value.split(',') {
+        let day = token
+            .parse::<i32>()
+            .map_err(|_| "recurrence BYMONTHDAY is invalid".to_string())?;
+        if day == 0 || !(-31..=31).contains(&day) {
+            return Err("recurrence BYMONTHDAY is out of range".to_string());
+        }
+        if days.contains(&day) {
+            return Err("recurrence BYMONTHDAY has a duplicate day".to_string());
+        }
+        days.push(day);
+    }
+    days.sort_unstable();
+    Ok(days)
+}
+
+fn parse_date(value: &str) -> Result<NaiveDate, String> {
+    NaiveDate::parse_from_str(value, "%Y-%m-%d")
+        .or_else(|_| NaiveDate::parse_from_str(value, "%Y%m%d"))
+        .map_err(|_| "date value is invalid".to_string())
+}
+
+fn parse_timed_for_mode(value: &str, mode: &TimeMode) -> Result<NaiveDateTime, String> {
+    let absolute = DateTime::parse_from_rfc3339(value).ok();
+    match (mode, absolute) {
+        (TimeMode::Utc, Some(value)) => Ok(value.with_timezone(&Utc).naive_utc()),
+        (TimeMode::Utc, None) => NaiveDateTime::parse_from_str(value, "%Y-%m-%dT%H:%M:%S")
+            .map_err(|_| "UTC time value is invalid".to_string()),
+        (TimeMode::Zone(_), Some(_)) => {
+            Err("zoned time must not carry a numeric UTC offset".to_string())
+        }
+        (TimeMode::Zone(_), None) => NaiveDateTime::parse_from_str(value, "%Y-%m-%dT%H:%M:%S")
+            .map_err(|_| "local time value is invalid".to_string()),
+    }
+}
+
+fn canonical_timed_id(value: &str, mode: &TimeMode) -> Result<String, String> {
+    let parsed = parse_timed_for_mode(value, mode)?;
+    Ok(format_recurrence_id(parsed, mode))
+}
+
+fn format_recurrence_id(value: NaiveDateTime, mode: &TimeMode) -> String {
+    let base = value.format("%Y-%m-%dT%H:%M:%S").to_string();
+    if *mode == TimeMode::Utc {
+        format!("{base}Z")
+    } else {
+        base
+    }
+}
+
+fn parse_utc_seconds(value: &str) -> Result<i64, ()> {
+    let parsed: DateTime<FixedOffset> = DateTime::parse_from_rfc3339(value).map_err(|_| ())?;
+    Ok(parsed.with_timezone(&Utc).timestamp())
+}
+
+fn expand_plan(
+    plan: &EventPlan,
+    window: &Window,
+    zones: &ZoneBook,
+) -> Result<Vec<Occurrence>, String> {
+    match plan {
+        EventPlan::Timed {
+            uid,
+            start,
+            end,
+            mode,
+            rule,
+            exdates,
+            overrides,
+        } => {
+            let candidates =
+                timed_candidates(*start, *end, mode, rule.as_ref(), window, overrides)?;
+            let mut output = Vec::new();
+            let mut seen = BTreeSet::new();
+            for (recurrence_id, candidate_start, candidate_end) in candidates {
+                if !seen.insert(recurrence_id.clone()) {
+                    return Err(
+                        "recurrence rule produced a duplicate occurrence identity".to_string()
+                    );
+                }
+                if exdates.contains(&recurrence_id) {
+                    continue;
+                }
+                let (candidate_start, candidate_end) = match overrides.get(&recurrence_id) {
+                    Some(override_plan) if override_plan.cancelled => continue,
+                    Some(override_plan) => (
+                        override_plan
+                            .timed_start
+                            .ok_or_else(|| "timed replacement is incomplete".to_string())?,
+                        override_plan
+                            .timed_end
+                            .ok_or_else(|| "timed replacement is incomplete".to_string())?,
+                    ),
+                    None => (candidate_start, candidate_end),
+                };
+                let start_utc = to_utc(candidate_start, mode, zones)?;
+                let end_utc = to_utc(candidate_end, mode, zones)?;
+                if end_utc <= start_utc {
+                    return Err(
+                        "occurrence end is not after start after time-zone conversion".to_string(),
+                    );
+                }
+                if start_utc < window.to_utc && end_utc > window.from_utc {
+                    output.push(Occurrence {
+                        uid: uid.clone(),
+                        recurrence_id,
+                        kind: "timed".to_string(),
+                        start: format_utc(start_utc)?,
+                        end: format_utc(end_utc)?,
+                    });
+                }
+            }
+            validate_override_identities(&seen, overrides)?;
+            output.sort_by(|a, b| a.recurrence_id.cmp(&b.recurrence_id));
+            Ok(output)
+        }
+        EventPlan::AllDay {
+            uid,
+            start,
+            end,
+            rule,
+            exdates,
+            overrides,
+        } => {
+            let candidates = all_day_candidates(*start, *end, rule.as_ref(), window, overrides)?;
+            let mut output = Vec::new();
+            let mut seen = BTreeSet::new();
+            for (recurrence_id, candidate_start, candidate_end) in candidates {
+                if !seen.insert(recurrence_id.clone()) {
+                    return Err(
+                        "recurrence rule produced a duplicate occurrence identity".to_string()
+                    );
+                }
+                if exdates.contains(&recurrence_id) {
+                    continue;
+                }
+                let (candidate_start, candidate_end) = match overrides.get(&recurrence_id) {
+                    Some(override_plan) if override_plan.cancelled => continue,
+                    Some(override_plan) => (
+                        override_plan
+                            .all_day_start
+                            .ok_or_else(|| "all-day replacement is incomplete".to_string())?,
+                        override_plan
+                            .all_day_end
+                            .ok_or_else(|| "all-day replacement is incomplete".to_string())?,
+                    ),
+                    None => (candidate_start, candidate_end),
+                };
+                if candidate_start < window.to_date_exclusive && candidate_end > window.from_date {
+                    output.push(Occurrence {
+                        uid: uid.clone(),
+                        recurrence_id,
+                        kind: "all_day".to_string(),
+                        start: candidate_start.format("%Y-%m-%d").to_string(),
+                        end: candidate_end.format("%Y-%m-%d").to_string(),
+                    });
+                }
+            }
+            validate_override_identities(&seen, overrides)?;
+            output.sort_by(|a, b| a.recurrence_id.cmp(&b.recurrence_id));
+            Ok(output)
+        }
+    }
+}
+
+fn timed_candidates(
+    start: NaiveDateTime,
+    end: NaiveDateTime,
+    mode: &TimeMode,
+    rule: Option<&Rule>,
+    window: &Window,
+    overrides: &BTreeMap<String, OverridePlan>,
+) -> Result<Vec<(String, NaiveDateTime, NaiveDateTime)>, String> {
+    let Some(rule) = rule else {
+        return Ok(vec![(format_recurrence_id(start, mode), start, end)]);
+    };
+    let duration = end - start;
+    let mut hard_stop = window.to_utc.saturating_add(172_800);
+    for id in overrides.keys() {
+        let value = parse_timed_for_mode(id, mode)?;
+        hard_stop = hard_stop.max(value.and_utc().timestamp().saturating_add(172_800));
+    }
+    match rule.frequency {
+        Frequency::Daily => {
+            let mut output = Vec::new();
+            let mut date = start.date();
+            let mut accepted = 0u64;
+            loop {
+                let candidate = date.and_time(start.time());
+                if candidate.and_utc().timestamp() > hard_stop {
+                    break;
+                }
+                if until_exceeded(rule.until.as_ref(), candidate, false) {
+                    break;
+                }
+                if rule.byday.is_empty() || rule.byday.contains(&candidate.weekday()) {
+                    accepted += 1;
+                    output.push((
+                        format_recurrence_id(candidate, mode),
+                        candidate,
+                        candidate + duration,
+                    ));
+                    if rule.count.is_some_and(|count| accepted >= count) {
+                        break;
+                    }
+                }
+                date = add_days(date, rule.interval)?;
+            }
+            Ok(output)
+        }
+        Frequency::Weekly => {
+            let first_monday = add_days(
+                start.date(),
+                -(i64::from(start.date().weekday().num_days_from_monday())),
+            )?;
+            let weekdays = if rule.byday.is_empty() {
+                vec![start.date().weekday()]
+            } else {
+                rule.byday.clone()
+            };
+            let mut output = Vec::new();
+            let mut week_index = 0i64;
+            let mut accepted = 0u64;
+            loop {
+                let week_start = add_days(first_monday, week_index.saturating_mul(7))?;
+                for weekday in &weekdays {
+                    let candidate_date =
+                        add_days(week_start, i64::from(weekday.num_days_from_monday()))?;
+                    let candidate = candidate_date.and_time(start.time());
+                    if candidate < start {
+                        continue;
+                    }
+                    if candidate.and_utc().timestamp() > hard_stop {
+                        return Ok(output);
+                    }
+                    if until_exceeded(rule.until.as_ref(), candidate, false) {
+                        return Ok(output);
+                    }
+                    accepted += 1;
+                    output.push((
+                        format_recurrence_id(candidate, mode),
+                        candidate,
+                        candidate + duration,
+                    ));
+                    if rule.count.is_some_and(|count| accepted >= count) {
+                        return Ok(output);
+                    }
+                }
+                week_index = week_index
+                    .checked_add(rule.interval)
+                    .ok_or_else(|| "recurrence is too large".to_string())?;
+            }
+        }
+        Frequency::Monthly => {
+            let mut month_index = 0i64;
+            let mut output = Vec::new();
+            let mut accepted = 0u64;
+            loop {
+                let (year, month) = add_months(start.year(), start.month(), month_index)?;
+                let days = if rule.bymonthday.is_empty() {
+                    vec![i32::try_from(start.day()).unwrap_or(0)]
+                } else {
+                    rule.bymonthday.clone()
+                };
+                for day in days {
+                    let Some(candidate_date) = month_day(year, month, day) else {
+                        continue;
+                    };
+                    let candidate = candidate_date.and_time(start.time());
+                    if candidate < start {
+                        continue;
+                    }
+                    if candidate.and_utc().timestamp() > hard_stop {
+                        return Ok(output);
+                    }
+                    if until_exceeded(rule.until.as_ref(), candidate, false) {
+                        return Ok(output);
+                    }
+                    accepted += 1;
+                    output.push((
+                        format_recurrence_id(candidate, mode),
+                        candidate,
+                        candidate + duration,
+                    ));
+                    if rule.count.is_some_and(|count| accepted >= count) {
+                        return Ok(output);
+                    }
+                }
+                month_index = month_index
+                    .checked_add(rule.interval)
+                    .ok_or_else(|| "recurrence is too large".to_string())?;
+            }
+        }
+    }
+}
+
+fn all_day_candidates(
+    start: NaiveDate,
+    end: NaiveDate,
+    rule: Option<&Rule>,
+    window: &Window,
+    overrides: &BTreeMap<String, OverridePlan>,
+) -> Result<Vec<(String, NaiveDate, NaiveDate)>, String> {
+    let Some(rule) = rule else {
+        return Ok(vec![(start.format("%Y-%m-%d").to_string(), start, end)]);
+    };
+    let duration = end - start;
+    let mut hard_stop = window.to_date_exclusive;
+    for id in overrides.keys() {
+        hard_stop = hard_stop.max(parse_date(id)?);
+    }
+    let mut output = Vec::new();
+    let mut accepted = 0u64;
+    match rule.frequency {
+        Frequency::Daily => {
+            let mut date = start;
+            loop {
+                if date > hard_stop {
+                    break;
+                }
+                if until_exceeded(
+                    rule.until.as_ref(),
+                    date.and_time(chrono::NaiveTime::MIN),
+                    true,
+                ) {
+                    break;
+                }
+                if rule.byday.is_empty() || rule.byday.contains(&date.weekday()) {
+                    accepted += 1;
+                    output.push((
+                        date.format("%Y-%m-%d").to_string(),
+                        date,
+                        date.checked_add_signed(duration)
+                            .ok_or_else(|| "date range is too large".to_string())?,
+                    ));
+                    if rule.count.is_some_and(|count| accepted >= count) {
+                        break;
+                    }
+                }
+                date = add_days(date, rule.interval)?;
+            }
+        }
+        Frequency::Weekly => {
+            let first_monday =
+                add_days(start, -(i64::from(start.weekday().num_days_from_monday())))?;
+            let weekdays = if rule.byday.is_empty() {
+                vec![start.weekday()]
+            } else {
+                rule.byday.clone()
+            };
+            let mut week_index = 0i64;
+            'weeks: loop {
+                let week_start = add_days(first_monday, week_index.saturating_mul(7))?;
+                for weekday in &weekdays {
+                    let date = add_days(week_start, i64::from(weekday.num_days_from_monday()))?;
+                    if date < start {
+                        continue;
+                    }
+                    if date > hard_stop {
+                        break 'weeks;
+                    }
+                    if until_exceeded(
+                        rule.until.as_ref(),
+                        date.and_time(chrono::NaiveTime::MIN),
+                        true,
+                    ) {
+                        break 'weeks;
+                    }
+                    accepted += 1;
+                    output.push((
+                        date.format("%Y-%m-%d").to_string(),
+                        date,
+                        date.checked_add_signed(duration)
+                            .ok_or_else(|| "date range is too large".to_string())?,
+                    ));
+                    if rule.count.is_some_and(|count| accepted >= count) {
+                        break 'weeks;
+                    }
+                }
+                week_index = week_index
+                    .checked_add(rule.interval)
+                    .ok_or_else(|| "recurrence is too large".to_string())?;
+            }
+        }
+        Frequency::Monthly => {
+            let mut month_index = 0i64;
+            loop {
+                let (year, month) = add_months(start.year(), start.month(), month_index)?;
+                let days = if rule.bymonthday.is_empty() {
+                    vec![i32::try_from(start.day()).unwrap_or(0)]
+                } else {
+                    rule.bymonthday.clone()
+                };
+                for day in days {
+                    let Some(date) = month_day(year, month, day) else {
+                        continue;
+                    };
+                    if date < start {
+                        continue;
+                    }
+                    if date > hard_stop {
+                        return Ok(output);
+                    }
+                    if until_exceeded(
+                        rule.until.as_ref(),
+                        date.and_time(chrono::NaiveTime::MIN),
+                        true,
+                    ) {
+                        return Ok(output);
+                    }
+                    accepted += 1;
+                    output.push((
+                        date.format("%Y-%m-%d").to_string(),
+                        date,
+                        date.checked_add_signed(duration)
+                            .ok_or_else(|| "date range is too large".to_string())?,
+                    ));
+                    if rule.count.is_some_and(|count| accepted >= count) {
+                        return Ok(output);
+                    }
+                }
+                month_index = month_index
+                    .checked_add(rule.interval)
+                    .ok_or_else(|| "recurrence is too large".to_string())?;
+            }
+        }
+    }
+    Ok(output)
+}
+
+fn validate_override_identities(
+    seen: &BTreeSet<String>,
+    overrides: &BTreeMap<String, OverridePlan>,
+) -> Result<(), String> {
+    if overrides
+        .keys()
+        .any(|recurrence_id| !seen.contains(recurrence_id))
+    {
+        return Err("occurrence override does not match a generated recurrence".to_string());
+    }
+    Ok(())
+}
+
+fn until_exceeded(until: Option<&Until>, candidate: NaiveDateTime, _all_day: bool) -> bool {
+    match until {
+        Some(Until::Date(date)) => candidate.date() > *date,
+        Some(Until::DateTime(value)) => candidate > *value,
+        None => false,
+    }
+}
+
+fn to_utc(value: NaiveDateTime, mode: &TimeMode, zones: &ZoneBook) -> Result<i64, String> {
+    match mode {
+        TimeMode::Utc => Ok(value.and_utc().timestamp()),
+        TimeMode::Zone(name) => zones.require(name)?.local_to_utc(value),
+    }
+}
+
+fn format_utc(seconds: i64) -> Result<String, String> {
+    DateTime::<Utc>::from_timestamp(seconds, 0)
+        .map(|value| value.to_rfc3339_opts(SecondsFormat::Secs, true))
+        .ok_or_else(|| "UTC occurrence is out of range".to_string())
+}
+
+fn add_days(date: NaiveDate, days: i64) -> Result<NaiveDate, String> {
+    if days >= 0 {
+        date.checked_add_days(Days::new(days as u64))
+    } else {
+        date.checked_sub_days(Days::new(days.unsigned_abs()))
+    }
+    .ok_or_else(|| "recurrence date is out of range".to_string())
+}
+
+fn add_months(year: i32, month: u32, delta: i64) -> Result<(i32, u32), String> {
+    let base = i64::from(year)
+        .checked_mul(12)
+        .and_then(|value| value.checked_add(i64::from(month) - 1))
+        .and_then(|value| value.checked_add(delta))
+        .ok_or_else(|| "recurrence month is out of range".to_string())?;
+    let year = base.div_euclid(12);
+    let month = base.rem_euclid(12) + 1;
+    Ok((
+        i32::try_from(year).map_err(|_| "recurrence year is out of range".to_string())?,
+        u32::try_from(month).map_err(|_| "recurrence month is out of range".to_string())?,
+    ))
+}
+
+fn month_day(year: i32, month: u32, requested: i32) -> Option<NaiveDate> {
+    let first = NaiveDate::from_ymd_opt(year, month, 1)?;
+    let next = if month == 12 {
+        NaiveDate::from_ymd_opt(year + 1, 1, 1)?
+    } else {
+        NaiveDate::from_ymd_opt(year, month + 1, 1)?
+    };
+    let last_day = i32::try_from((next - Duration::days(1)).day()).ok()?;
+    let day = if requested > 0 {
+        requested
+    } else {
+        last_day + requested + 1
+    };
+    if !(1..=last_day).contains(&day) {
+        None
+    } else {
+        first.with_day(u32::try_from(day).ok()?)
+    }
+}
+
+fn read_occurrences(path: &Path) -> Result<Vec<Occurrence>, String> {
+    read_jsonl(path, "state shard")
+}
+
+fn verify_shard_metadata(path: &Path, metadata: &ShardMeta) -> bool {
+    fingerprint_file(path)
+        .map(|(byte_length, content_hash)| {
+            byte_length == metadata.byte_length && content_hash == metadata.content_hash
+        })
+        .unwrap_or(false)
+}
+
+fn fingerprint_file(path: &Path) -> Result<(u64, String), String> {
+    let mut file = File::open(path).map_err(|_| "could not read state shard".to_string())?;
+    let mut hasher = Sha256::new();
+    let mut buffer = [0u8; 16 * 1024];
+    let mut byte_length = 0u64;
+    loop {
+        let count = file
+            .read(&mut buffer)
+            .map_err(|_| "could not read state shard".to_string())?;
+        if count == 0 {
+            break;
+        }
+        byte_length = byte_length
+            .checked_add(u64::try_from(count).map_err(|_| "state shard is too large".to_string())?)
+            .ok_or_else(|| "state shard is too large".to_string())?;
+        hasher.update(&buffer[..count]);
+    }
+    Ok((byte_length, hex(&hasher.finalize())))
+}
+
+fn validate_shard(occurrences: &[Occurrence], uid: &str) -> Result<(), String> {
+    let mut identities = BTreeSet::new();
+    for occurrence in occurrences {
+        if occurrence.uid != uid || !identities.insert(occurrence.recurrence_id.clone()) {
+            return Err("state contains a duplicate or unexpected occurrence identity".to_string());
+        }
+    }
+    Ok(())
+}
+
+fn read_manifest(path: &Path) -> Result<Option<Manifest>, String> {
+    if !path.exists() {
+        return Ok(None);
+    }
+    let bytes =
+        fs::read(path).map_err(|_| "could not read materialization manifest".to_string())?;
+    match serde_json::from_slice(&bytes) {
+        Ok(manifest) => Ok(Some(manifest)),
+        Err(_) => Ok(None),
+    }
+}
+
+struct PublicationWriter {
+    final_path: PathBuf,
+    temp_path: PathBuf,
+    writer: BufWriter<File>,
+}
+
+impl PublicationWriter {
+    fn new(final_path: &Path) -> Result<Self, String> {
+        let temp_path = temp_path(final_path);
+        remove_stale_temp(&temp_path)?;
+        let file = OpenOptions::new()
+            .write(true)
+            .create_new(true)
+            .open(&temp_path)
+            .map_err(|_| "could not create temporary publication".to_string())?;
+        Ok(Self {
+            final_path: final_path.to_path_buf(),
+            temp_path,
+            writer: BufWriter::new(file),
+        })
+    }
+
+    fn append_shard(&mut self, path: &Path) -> Result<(), String> {
+        let shard =
+            File::open(path).map_err(|_| "could not read materialization shard".to_string())?;
+        for line in BufReader::new(shard).lines() {
+            let line = line.map_err(|_| "could not read materialization shard".to_string())?;
+            self.writer
+                .write_all(line.as_bytes())
+                .and_then(|_| self.writer.write_all(b"\n"))
+                .map_err(|_| "could not write JSONL publication".to_string())?;
+        }
+        Ok(())
+    }
+
+    fn finish(self) -> Result<(), String> {
+        let mut writer = self.writer;
+        writer
+            .flush()
+            .map_err(|_| "could not flush JSONL publication".to_string())?;
+        writer
+            .into_inner()
+            .map_err(|_| "could not finalize JSONL publication".to_string())?
+            .sync_all()
+            .map_err(|_| "could not sync JSONL publication".to_string())?;
+        fs::rename(&self.temp_path, &self.final_path)
+            .map_err(|_| "could not atomically publish JSONL output".to_string())
+    }
+}
+
+fn write_shard_and_append(
+    path: &Path,
+    occurrences: &[Occurrence],
+    publication: &mut PublicationWriter,
+) -> Result<(), String> {
+    let temp = temp_path(path);
+    remove_stale_temp(&temp)?;
+    let file = OpenOptions::new()
+        .write(true)
+        .create_new(true)
+        .open(&temp)
+        .map_err(|_| "could not create temporary materialization shard".to_string())?;
+    let mut writer = BufWriter::new(file);
+    for occurrence in occurrences {
+        let encoded = serde_json::to_vec(occurrence)
+            .map_err(|_| "could not encode materialization shard".to_string())?;
+        writer
+            .write_all(&encoded)
+            .and_then(|_| writer.write_all(b"\n"))
+            .map_err(|_| "could not write materialization shard".to_string())?;
+        publication
+            .writer
+            .write_all(&encoded)
+            .and_then(|_| publication.writer.write_all(b"\n"))
+            .map_err(|_| "could not write JSONL publication".to_string())?;
+    }
+    writer
+        .flush()
+        .map_err(|_| "could not flush materialization shard".to_string())?;
+    fs::rename(&temp, path).map_err(|_| "could not publish materialization shard".to_string())
+}
+
+fn atomic_write_json<T: Serialize>(path: &Path, value: &T) -> Result<(), String> {
+    let temp = temp_path(path);
+    remove_stale_temp(&temp)?;
+    let file = OpenOptions::new()
+        .write(true)
+        .create_new(true)
+        .open(&temp)
+        .map_err(|_| "could not create temporary manifest".to_string())?;
+    let mut writer = BufWriter::new(file);
+    serde_json::to_writer_pretty(&mut writer, value)
+        .map_err(|_| "could not encode materialization manifest".to_string())?;
+    writer
+        .write_all(b"\n")
+        .map_err(|_| "could not write materialization manifest".to_string())?;
+    writer
+        .flush()
+        .map_err(|_| "could not flush materialization manifest".to_string())?;
+    writer
+        .into_inner()
+        .map_err(|_| "could not finalize materialization manifest".to_string())?
+        .sync_all()
+        .map_err(|_| "could not sync materialization manifest".to_string())?;
+    fs::rename(&temp, path)
+        .map_err(|_| "could not atomically publish materialization manifest".to_string())
+}
+
+fn remove_stale_temp(path: &Path) -> Result<(), String> {
+    if path.exists() {
+        fs::remove_file(path)
+            .map_err(|_| "could not remove a stale temporary publication".to_string())?;
+    }
+    Ok(())
+}
+
+fn temp_path(path: &Path) -> PathBuf {
+    PathBuf::from(format!("{}.tmp-{}", path.display(), std::process::id()))
+}
+
+fn hash_context(transitions: &[u8], from: &str, to: &str) -> u64 {
+    let mut data = Vec::with_capacity(transitions.len() + from.len() + to.len() + 2);
+    data.extend_from_slice(transitions);
+    data.push(0);
+    data.extend_from_slice(from.as_bytes());
+    data.push(0);
+    data.extend_from_slice(to.as_bytes());
+    hash_bytes(&data)
+}
+
+fn hash_bytes(bytes: &[u8]) -> u64 {
+    let mut hash = 0xcbf29ce484222325u64;
+    for byte in bytes {
+        hash ^= u64::from(*byte);
+        hash = hash.wrapping_mul(0x100000001b3);
+    }
+    hash
+}
+
+fn hex(bytes: &[u8]) -> String {
+    const DIGITS: &[u8; 16] = b"0123456789abcdef";
+    let mut output = String::with_capacity(bytes.len() * 2);
+    for byte in bytes {
+        output.push(char::from(DIGITS[usize::from(byte >> 4)]));
+        output.push(char::from(DIGITS[usize::from(byte & 0x0f)]));
+    }
+    output
+}
+
+pub fn format_diagnostics(result: &RunResult) -> String {
+    serde_json::to_string(result).unwrap_or_else(|_| "{\"publication\":\"failed\"}".to_string())
+}
diff --git a/developer-simulation/runs/2026-08-06--caldav-recurrence/src/main.rs b/developer-simulation/runs/2026-08-06--caldav-recurrence/src/main.rs
new file mode 100644
index 0000000..580bd7d
--- /dev/null
+++ b/developer-simulation/runs/2026-08-06--caldav-recurrence/src/main.rs
@@ -0,0 +1,91 @@
+use std::path::PathBuf;
+
+use caldav_recurrence_prototype::{Config, format_diagnostics, run};
+
+fn main() {
+    let args: Vec<String> = std::env::args().collect();
+    if args.iter().any(|arg| arg == "--help" || arg == "-h") {
+        print_help();
+        return;
+    }
+    let config = match parse_args(&args[1..]) {
+        Ok(config) => config,
+        Err(error) => {
+            eprintln!("error: {error}");
+            std::process::exit(2);
+        }
+    };
+    match run(&config) {
+        Ok(result) => println!("{}", format_diagnostics(&result)),
+        Err(error) => {
+            eprintln!("error: {error}");
+            std::process::exit(1);
+        }
+    }
+}
+
+fn parse_args(args: &[String]) -> Result<Config, String> {
+    let mut events = None;
+    let mut transitions = None;
+    let mut from = None;
+    let mut to = None;
+    let mut output = None;
+    let mut state_dir = None;
+    let mut edits = None;
+    let mut crash_after_uid = None;
+
+    let mut index = 0;
+    while index < args.len() {
+        let name = &args[index];
+        let value = args
+            .get(index + 1)
+            .ok_or_else(|| format!("missing value for {name}"))?;
+        let slot = match name.as_str() {
+            "--events" => &mut events,
+            "--transitions" => &mut transitions,
+            "--from" => &mut from,
+            "--to" => &mut to,
+            "--output" => &mut output,
+            "--state-dir" => &mut state_dir,
+            "--edits" => &mut edits,
+            "--crash-after" => &mut crash_after_uid,
+            _ => return Err(format!("unknown argument {name}")),
+        };
+        if slot.is_some() {
+            return Err(format!("argument {name} was supplied twice"));
+        }
+        *slot = Some(value.clone());
+        index += 2;
+    }
+
+    Ok(Config {
+        events: required_path(events, "--events")?,
+        transitions: required_path(transitions, "--transitions")?,
+        from: required_string(from, "--from")?,
+        to: required_string(to, "--to")?,
+        output: required_path(output, "--output")?,
+        state_dir: required_path(state_dir, "--state-dir")?,
+        edits: edits.map(PathBuf::from),
+        crash_after_uid,
+    })
+}
+
+fn required_path(value: Option<String>, name: &str) -> Result<PathBuf, String> {
+    value
+        .map(PathBuf::from)
+        .ok_or_else(|| format!("missing required argument {name}"))
+}
+
+fn required_string(value: Option<String>, name: &str) -> Result<String, String> {
+    value.ok_or_else(|| format!("missing required argument {name}"))
+}
+
+fn print_help() {
+    println!(
+        "caldav-recurrence-prototype\n\n\
+         Usage:\n  caldav-recurrence-prototype --events EVENTS.jsonl --transitions ZONES.json \\\n         --from RFC3339 --to RFC3339 --output OCCURRENCES.jsonl --state-dir STATE [--edits EDITS.jsonl]\n\n\
+         Event JSONL supports timed and all_day events, DAILY/WEEKLY/MONTHLY\n\
+         rules, EXDATE values, and confirmed/cancelled occurrence overrides.\n\
+         Diagnostics are emitted as one non-sensitive JSON object on stdout."
+    );
+}
diff --git a/developer-simulation/runs/2026-08-06--caldav-recurrence/tests/behavior.rs b/developer-simulation/runs/2026-08-06--caldav-recurrence/tests/behavior.rs
new file mode 100644
index 0000000..917a896
--- /dev/null
+++ b/developer-simulation/runs/2026-08-06--caldav-recurrence/tests/behavior.rs
@@ -0,0 +1,507 @@
+use std::fs;
+use std::path::{Path, PathBuf};
+use std::time::{SystemTime, UNIX_EPOCH};
+
+use caldav_recurrence_prototype::{Config, Event, Occurrence, Override, run};
+use fold::pipeline::terminal;
+
+struct FixtureDir(PathBuf);
+
+impl FixtureDir {
+    fn new(label: &str) -> Self {
+        let stamp = SystemTime::now()
+            .duration_since(UNIX_EPOCH)
+            .expect("clock")
+            .as_nanos();
+        let path = std::env::temp_dir().join(format!(
+            "bogkit-caldav-{label}-{}-{stamp}",
+            std::process::id()
+        ));
+        fs::create_dir_all(&path).expect("fixture directory");
+        Self(path)
+    }
+
+    fn path(&self, name: &str) -> PathBuf {
+        self.0.join(name)
+    }
+
+    fn write_events(&self, name: &str, events: &[Event]) -> PathBuf {
+        let path = self.path(name);
+        let body = events
+            .iter()
+            .map(|event| serde_json::to_string(event).expect("event JSON"))
+            .collect::<Vec<_>>()
+            .join("\n");
+        fs::write(&path, format!("{body}\n")).expect("events");
+        path
+    }
+
+    fn write_edits(&self, name: &str, edits: &[serde_json::Value]) -> PathBuf {
+        let path = self.path(name);
+        let body = edits
+            .iter()
+            .map(|edit| serde_json::to_string(edit).expect("edit JSON"))
+            .collect::<Vec<_>>()
+            .join("\n");
+        fs::write(&path, format!("{body}\n")).expect("edits");
+        path
+    }
+
+    fn zones(&self) -> PathBuf {
+        let path = self.path("zones.json");
+        fs::write(
+            &path,
+            r#"{
+  "zones": {
+    "America/New_York": {
+      "initial_offset_seconds": -18000,
+      "transitions": [
+        {"at_utc":"2026-03-08T07:00:00Z","offset_after_seconds":-14400},
+        {"at_utc":"2026-11-01T06:00:00Z","offset_after_seconds":-18000}
+      ]
+    },
+    "FLOATING": {
+      "initial_offset_seconds": 0,
+      "transitions": []
+    }
+  }
+}
+"#,
+        )
+        .expect("zones");
+        path
+    }
+
+    fn config(&self, events: &Path, output: &str, state: &str) -> Config {
+        Config {
+            events: events.to_path_buf(),
+            transitions: self.zones(),
+            from: "2026-03-07T00:00:00Z".to_string(),
+            to: "2026-03-12T00:00:00Z".to_string(),
+            output: self.path(output),
+            state_dir: self.path(state),
+            edits: None,
+            crash_after_uid: None,
+        }
+    }
+}
+
+impl Drop for FixtureDir {
+    fn drop(&mut self) {
+        let _ = fs::remove_dir_all(&self.0);
+    }
+}
+
+fn timed(uid: &str, start: &str, end: &str, tzid: Option<&str>, rrule: Option<&str>) -> Event {
+    Event {
+        uid: uid.to_string(),
+        kind: "timed".to_string(),
+        start: start.to_string(),
+        end: end.to_string(),
+        tzid: tzid.map(str::to_string),
+        rrule: rrule.map(str::to_string),
+        exdate: Vec::new(),
+        overrides: Vec::new(),
+    }
+}
+
+#[test]
+fn dst_exceptions_all_day_and_floating_times_are_deterministic() {
+    let fixture = FixtureDir::new("semantics");
+    let mut recurring = timed(
+        "meeting",
+        "2026-03-07T09:00:00",
+        "2026-03-07T10:00:00",
+        Some("America/New_York"),
+        Some("FREQ=DAILY;COUNT=4"),
+    );
+    recurring.exdate.push("2026-03-09T09:00:00".to_string());
+    recurring.overrides.push(Override {
+        recurrence_id: "2026-03-08T09:00:00".to_string(),
+        status: None,
+        start: Some("2026-03-08T11:00:00".to_string()),
+        end: Some("2026-03-08T12:00:00".to_string()),
+        tzid: None,
+    });
+    recurring.overrides.push(Override {
+        recurrence_id: "2026-03-10T09:00:00".to_string(),
+        status: Some("cancelled".to_string()),
+        start: None,
+        end: None,
+        tzid: None,
+    });
+
+    let gap = timed(
+        "gap",
+        "2026-03-08T02:30:00",
+        "2026-03-08T04:00:00",
+        Some("America/New_York"),
+        None,
+    );
+    let fold = timed(
+        "fold",
+        "2026-11-01T01:30:00",
+        "2026-11-01T02:30:00",
+        Some("America/New_York"),
+        None,
+    );
+    let all_day = Event {
+        uid: "all-day".to_string(),
+        kind: "all_day".to_string(),
+        start: "2026-03-08".to_string(),
+        end: "2026-03-09".to_string(),
+        tzid: None,
+        rrule: None,
+        exdate: Vec::new(),
+        overrides: Vec::new(),
+    };
+    let floating = timed(
+        "floating",
+        "2026-03-08T09:00:00",
+        "2026-03-08T10:00:00",
+        None,
+        None,
+    );
+    let events = vec![recurring, gap, fold, all_day, floating];
+    let events_path = fixture.write_events("events.jsonl", &events);
+    let mut config = fixture.config(&events_path, "out.jsonl", "state");
+    config.to = "2026-11-02T00:00:00Z".to_string();
+    let result = run(&config).expect("prototype run");
+    assert_eq!(result.events, 5);
+
+    let lines = fs::read_to_string(&config.output)
+        .expect("output")
+        .lines()
+        .map(|line| serde_json::from_str::<Occurrence>(line).expect("occurrence JSON"))
+        .collect::<Vec<_>>();
+    let find = |uid: &str, recurrence_id: &str| {
+        lines
+            .iter()
+            .find(|occurrence| occurrence.uid == uid && occurrence.recurrence_id == recurrence_id)
+            .expect("occurrence")
+    };
+    assert_eq!(
+        find("gap", "2026-03-08T02:30:00").start,
+        "2026-03-08T07:30:00Z"
+    );
+    assert_eq!(
+        find("fold", "2026-11-01T01:30:00").start,
+        "2026-11-01T05:30:00Z"
+    );
+    assert_eq!(find("all-day", "2026-03-08").start, "2026-03-08");
+    assert_eq!(
+        find("floating", "2026-03-08T09:00:00").start,
+        "2026-03-08T09:00:00Z"
+    );
+    assert!(lines.iter().all(|occurrence| {
+        !(occurrence.uid == "meeting" && occurrence.recurrence_id == "2026-03-09T09:00:00")
+    }));
+    assert!(lines.iter().all(|occurrence| {
+        !(occurrence.uid == "meeting" && occurrence.recurrence_id == "2026-03-10T09:00:00")
+    }));
+    assert!(lines.windows(2).all(|pair| {
+        (pair[0].uid.as_str(), pair[0].recurrence_id.as_str())
+            < (pair[1].uid.as_str(), pair[1].recurrence_id.as_str())
+    }));
+}
+
+#[test]
+fn input_order_and_host_environment_do_not_change_output() {
+    let fixture = FixtureDir::new("ordering");
+    let events = vec![
+        timed(
+            "z",
+            "2026-03-07T09:00:00Z",
+            "2026-03-07T10:00:00Z",
+            Some("UTC"),
+            Some("FREQ=DAILY;COUNT=2"),
+        ),
+        timed(
+            "a",
+            "2026-03-07T11:00:00Z",
+            "2026-03-07T12:00:00Z",
+            Some("UTC"),
+            Some("FREQ=DAILY;COUNT=2"),
+        ),
+    ];
+    let first_path = fixture.write_events("first.jsonl", &events);
+    let reversed = vec![events[1].clone(), events[0].clone()];
+    let second_path = fixture.write_events("second.jsonl", &reversed);
+    let first = fixture.config(&first_path, "first.out", "first.state");
+    let second = fixture.config(&second_path, "second.out", "second.state");
+    run(&first).expect("first run");
+    run(&second).expect("second run");
+    assert_eq!(
+        fs::read(&first.output).expect("first output"),
+        fs::read(&second.output).expect("second output")
+    );
+}
+
+#[test]
+fn one_event_edit_rebuilds_one_shard_and_resume_recovers_after_interruption() {
+    let fixture = FixtureDir::new("incremental");
+    let events = vec![
+        timed(
+            "keep",
+            "2026-03-07T09:00:00Z",
+            "2026-03-07T10:00:00Z",
+            Some("UTC"),
+            Some("FREQ=DAILY;COUNT=2"),
+        ),
+        timed(
+            "change",
+            "2026-03-07T11:00:00Z",
+            "2026-03-07T12:00:00Z",
+            Some("UTC"),
+            Some("FREQ=DAILY;COUNT=2"),
+        ),
+    ];
+    let events_path = fixture.write_events("events.jsonl", &events);
+    let edits_path = fixture.write_edits(
+        "edits.jsonl",
+        &[serde_json::json!({
+            "uid":"change",
+            "event": timed("change", "2026-03-07T15:00:00Z", "2026-03-07T16:00:00Z", Some("UTC"), Some("FREQ=DAILY;COUNT=2"))
+        })],
+    );
+    let mut config = fixture.config(&events_path, "out.jsonl", "state");
+    run(&config).expect("initial run");
+    let keep_shard = fs::read_dir(config.state_dir.join("shards"))
+        .expect("shards")
+        .map(|entry| entry.expect("entry").path())
+        .find(|path| {
+            fs::read_to_string(path)
+                .expect("shard")
+                .contains("\"keep\"")
+        })
+        .expect("keep shard");
+    let keep_before = fs::read(&keep_shard).expect("keep before");
+    let old_output = fs::read(&config.output).expect("old output");
+
+    config.edits = Some(edits_path.clone());
+    config.crash_after_uid = Some("change".to_string());
+    assert!(run(&config).is_err());
+    assert_eq!(
+        fs::read(&config.output).expect("output after crash"),
+        old_output
+    );
+
+    config.crash_after_uid = None;
+    let result = run(&config).expect("resumed run");
+    assert_eq!(result.rebuilt_uids, 1);
+    assert_eq!(result.reused_uids, 1);
+    assert_eq!(fs::read(&keep_shard).expect("keep after"), keep_before);
+    assert!(
+        fs::read_to_string(&config.output)
+            .expect("new output")
+            .contains("2026-03-07T15:00:00Z")
+    );
+}
+
+#[test]
+fn malformed_input_does_not_publish_or_modify_existing_output() {
+    let fixture = FixtureDir::new("validation");
+    let valid = fixture.write_events(
+        "valid.jsonl",
+        &[timed(
+            "one",
+            "2026-03-07T09:00:00Z",
+            "2026-03-07T10:00:00Z",
+            Some("UTC"),
+            None,
+        )],
+    );
+    let mut config = fixture.config(&valid, "out.jsonl", "state");
+    run(&config).expect("valid run");
+    let before = fs::read(&config.output).expect("before");
+
+    let invalid = fixture.path("invalid.jsonl");
+    fs::write(&invalid, "{\"uid\":\"broken\",\"kind\":\"timed\"}\n").expect("invalid input");
+    config.events = invalid;
+    assert!(run(&config).is_err());
+    assert_eq!(fs::read(&config.output).expect("after"), before);
+}
+
+#[test]
+fn weekly_and_monthly_rules_use_calendar_steps() {
+    let fixture = FixtureDir::new("calendar-steps");
+    let weekly = timed(
+        "weekly",
+        "2026-03-02T09:00:00",
+        "2026-03-02T10:00:00",
+        Some("America/New_York"),
+        Some("FREQ=WEEKLY;BYDAY=MO,WE;COUNT=4"),
+    );
+    let monthly = timed(
+        "monthly",
+        "2026-01-15T09:00:00Z",
+        "2026-01-15T10:00:00Z",
+        Some("UTC"),
+        Some("FREQ=MONTHLY;BYMONTHDAY=15;COUNT=3"),
+    );
+    let events = fixture.write_events("events.jsonl", &[weekly, monthly]);
+    let mut config = fixture.config(&events, "out.jsonl", "state");
+    config.from = "2026-01-01T00:00:00Z".to_string();
+    config.to = "2026-04-01T00:00:00Z".to_string();
+    let result = run(&config).expect("calendar run");
+    assert_eq!(result.occurrences, 7);
+    let output = fs::read_to_string(&config.output).expect("output");
+    assert!(output.contains("2026-03-09T13:00:00Z"));
+    assert!(output.contains("2026-03-11T13:00:00Z"));
+    assert!(output.contains("2026-01-15T09:00:00Z"));
+    assert!(output.contains("2026-02-15T09:00:00Z"));
+    assert!(output.contains("2026-03-15T09:00:00Z"));
+}
+
+#[test]
+fn partial_day_query_includes_the_touched_all_day_date() {
+    let fixture = FixtureDir::new("all-day-window");
+    let events = fixture.write_events(
+        "events.jsonl",
+        &[Event {
+            uid: "day".to_string(),
+            kind: "all_day".to_string(),
+            start: "2026-03-08".to_string(),
+            end: "2026-03-09".to_string(),
+            tzid: None,
+            rrule: None,
+            exdate: Vec::new(),
+            overrides: Vec::new(),
+        }],
+    );
+    let mut config = fixture.config(&events, "out.jsonl", "state");
+    config.from = "2026-03-08T00:00:00Z".to_string();
+    config.to = "2026-03-08T12:00:00Z".to_string();
+    let result = run(&config).expect("partial-day query");
+    assert_eq!(result.occurrences, 1);
+    assert!(
+        fs::read_to_string(&config.output)
+            .expect("output")
+            .contains("\"recurrence_id\":\"2026-03-08\"")
+    );
+}
+
+#[test]
+fn duplicate_canonical_override_ids_are_rejected() {
+    let fixture = FixtureDir::new("canonical-overrides");
+    let mut event = timed(
+        "duplicate",
+        "2026-03-08T09:00:00Z",
+        "2026-03-08T10:00:00Z",
+        Some("UTC"),
+        Some("FREQ=DAILY;COUNT=2"),
+    );
+    event.overrides = vec![
+        Override {
+            recurrence_id: "2026-03-08T09:00:00Z".to_string(),
+            status: None,
+            start: Some("2026-03-08T11:00:00Z".to_string()),
+            end: Some("2026-03-08T12:00:00Z".to_string()),
+            tzid: None,
+        },
+        Override {
+            recurrence_id: "2026-03-08T09:00:00+00:00".to_string(),
+            status: None,
+            start: Some("2026-03-08T13:00:00Z".to_string()),
+            end: Some("2026-03-08T14:00:00Z".to_string()),
+            tzid: None,
+        },
+    ];
+    let events = fixture.write_events("events.jsonl", &[event]);
+    let config = fixture.config(&events, "out.jsonl", "state");
+    assert!(run(&config).is_err());
+}
+
+#[test]
+fn override_for_an_unseen_recurrence_is_rejected() {
+    let fixture = FixtureDir::new("unseen-override");
+    let mut event = timed(
+        "unseen",
+        "2026-03-08T09:00:00Z",
+        "2026-03-08T10:00:00Z",
+        Some("UTC"),
+        None,
+    );
+    event.overrides.push(Override {
+        recurrence_id: "2026-03-09T09:00:00Z".to_string(),
+        status: None,
+        start: Some("2026-03-09T11:00:00Z".to_string()),
+        end: Some("2026-03-09T12:00:00Z".to_string()),
+        tzid: None,
+    });
+    let events = fixture.write_events("events.jsonl", &[event]);
+    let config = fixture.config(&events, "out.jsonl", "state");
+    assert!(run(&config).is_err());
+}
+
+#[test]
+fn tampered_shards_are_rebuilt_before_reuse() {
+    let fixture = FixtureDir::new("shard-integrity");
+    let event = timed(
+        "tamper",
+        "2026-03-08T09:00:00Z",
+        "2026-03-08T10:00:00Z",
+        Some("UTC"),
+        None,
+    );
+    let events = fixture.write_events("events.jsonl", &[event]);
+    let config = fixture.config(&events, "out.jsonl", "state");
+    run(&config).expect("initial run");
+    let shard = fs::read_dir(config.state_dir.join("shards"))
+        .expect("shards")
+        .map(|entry| entry.expect("entry").path())
+        .next()
+        .expect("one shard");
+    fs::write(
+        &shard,
+        br#"{"uid":"tamper","recurrence_id":"2026-03-08T09:00:00Z","kind":"timed","start":"2030-01-01T00:00:00Z","end":"2030-01-01T01:00:00Z"}
+"#,
+    )
+    .expect("tampered shard");
+    let result = run(&config).expect("rebuild run");
+    assert_eq!(result.rebuilt_uids, 1);
+    assert_eq!(result.reused_uids, 0);
+    assert!(
+        fs::read_to_string(&config.output)
+            .expect("output")
+            .contains("2026-03-08T09:00:00Z")
+    );
+}
+
+#[test]
+fn failed_expansion_does_not_mutate_the_durable_event_store() {
+    let fixture = FixtureDir::new("preflight-store");
+    let valid_event = timed(
+        "stable",
+        "2026-03-08T09:00:00",
+        "2026-03-08T10:00:00",
+        Some("America/New_York"),
+        None,
+    );
+    let valid = fixture.write_events("valid.jsonl", std::slice::from_ref(&valid_event));
+    let mut config = fixture.config(&valid, "out.jsonl", "state");
+    run(&config).expect("valid run");
+
+    let invalid_event = timed(
+        "stable",
+        "2026-03-08T02:30:00",
+        "2026-03-08T03:00:00",
+        Some("America/New_York"),
+        None,
+    );
+    let invalid = fixture.write_events("invalid.jsonl", &[invalid_event]);
+    config.events = invalid;
+    assert!(run(&config).is_err());
+
+    let store = caldav_recurrence_prototype::EventStore::new(
+        config.state_dir.join("event-store"),
+        terminal::Table::new("events"),
+    );
+    let stored_start = store.rtx(|table| {
+        table
+            .iter()
+            .find(|(uid, _)| uid == "stable")
+            .map(|(_, event)| event.start)
+    });
+    assert_eq!(stored_start.as_deref(), Some("2026-03-08T09:00:00"));
+}
diff --git a/developer-simulation/runs/2026-08-06--http-cache-revalidation/Cargo.toml b/developer-simulation/runs/2026-08-06--http-cache-revalidation/Cargo.toml
new file mode 100644
index 0000000..2950c8a
--- /dev/null
+++ b/developer-simulation/runs/2026-08-06--http-cache-revalidation/Cargo.toml
@@ -0,0 +1,5 @@
+[package]
+name = "http-cache-revalidation"
+version = "0.1.0"
+edition = "2024"
+publish = false
diff --git a/developer-simulation/runs/2026-08-06--http-cache-revalidation/README.md b/developer-simulation/runs/2026-08-06--http-cache-revalidation/README.md
new file mode 100644
index 0000000..88ec931
--- /dev/null
+++ b/developer-simulation/runs/2026-08-06--http-cache-revalidation/README.md
@@ -0,0 +1,125 @@
+# HTTP cache revalidation trial
+
+This is a standalone, dependency-free state-machine prototype for the assigned
+cache scenario. It is intentionally not an HTTP parser, proxy, origin client,
+distributed cache, CDN API, or production performance claim.
+
+## Decision
+
+The BogKit fit is partial but not sufficient for the acceptance-critical
+prototype, so this trial uses no BogKit component at runtime.
+
+The public examples and Fold source show useful building blocks:
+
+- `Stream`/`KeyedStream` and `Table` provide durable, single-writer,
+  incrementally maintained records.
+- `InvertedIndex` can maintain tag postings.
+- `Ranked` can order records for a ranking-based eviction helper.
+- `Retain` is a processing-time window based on a wall clock, not a logical
+  trace-time freshness/stale-if-error policy.
+- The chat example's ingest thread makes the single-owner write model explicit;
+  it does not provide 32-worker per-key leases.
+
+None of those public surfaces atomically commits a Fold/fjall metadata
+transaction together with a separate content-addressed body file. They also do
+not supply per-key single-flight leases or tenant sequence-aware purge
+semantics. Adding a custom BogKit node for those rules would make the trial a
+new cache implementation rather than an evaluation of an existing component.
+
+## Baseline model
+
+The baseline is modeled first in `baseline_reproduction()` and is deliberately
+limited to the stated behavior:
+
+| Baseline behavior | Reproduced consequence | Reference-model correction |
+| --- | --- | --- |
+| Key is method plus URL | Vary variants and tenants collide | Tenant, normalized method/URL, and Vary fingerprint form the key |
+| Exact-URL invalidation | A tag purge leaves a tagged response servable | Tenant-scoped tag postings invalidate matching entries immediately |
+| No per-key lease | Concurrent expiry starts two revalidations | One active lease per canonical key; later workers wait |
+| Metadata/body writes are separate | A crash can expose an unverified body or delete an old referenced body | Journal phases are `Prepared`, `BodyCommitted`, and `MetadataCommitted`; the in-memory model rolls back or retains references |
+
+The baseline output is a failure reproducer, not a statement about an
+unavailable production gateway.
+
+## Reference model
+
+The reference engine covers only the requested boundary:
+
+- canonical key normalization, including tenant and Vary fingerprint;
+- fresh, expired, stale-if-error, miss, and revalidation decisions using
+  logical trace time;
+- one active lease per key in a single-process serialized model and explicit
+  completion events; lease expiry, worker loss, and distributed concurrency are
+  outside the model;
+- tenant tag indexes, duplicate purges, reordered purges, and purge fencing of
+  older revalidation results;
+- digest/size/verification labels and modeled body/metadata commit points;
+- in-memory reachability cleanup and deterministic LRU eviction under a byte
+  quota; no body bytes, filesystem deletion, SQLite transaction, fsync, or
+  process-restart behavior;
+- SHA-256 identifiers and stable reason codes in output.
+
+The body is represented by a digest, size, and verification bit. No body bytes
+are read, generated, or emitted, so the model cannot prove body-file deletion
+safety. Origin responses are supplied by `origin` trace records.
+
+## Running it
+
+From the repository root:
+
+```console
+cargo fmt --manifest-path developer-simulation/runs/2026-08-06--http-cache-revalidation/Cargo.toml -- --check
+cargo test --manifest-path developer-simulation/runs/2026-08-06--http-cache-revalidation/Cargo.toml
+cargo clippy --manifest-path developer-simulation/runs/2026-08-06--http-cache-revalidation/Cargo.toml --all-targets -- -D warnings
+cargo run --manifest-path developer-simulation/runs/2026-08-06--http-cache-revalidation/Cargo.toml -- demo
+cargo run --manifest-path developer-simulation/runs/2026-08-06--http-cache-revalidation/Cargo.toml -- run developer-simulation/runs/2026-08-06--http-cache-revalidation/demo.trace
+```
+
+The compact shape workload defaults to the stated 2,000,000 objects,
+1,000,000 requests, and 100,000 purges:
+
+```console
+cargo build --release --manifest-path developer-simulation/runs/2026-08-06--http-cache-revalidation/Cargo.toml
+/usr/bin/time -l developer-simulation/target/release/http-cache-revalidation workload
+```
+
+The workload stores compact logical records and does not allocate URLs, body
+bytes, tag postings, leases, or one output record per request. It is only a
+memory/quota shape check; it is not semantic evidence for 2 million objects,
+1 million requests, or 100,000 purge events. The semantic tests and trace demo
+are the correctness evidence.
+
+## Trace format
+
+The parser is intentionally small and whitespace-delimited:
+
+```text
+quota <bytes>
+blob <digest-label> <size> verified|unverified
+entry <tenant> <method> <url> <vary> <fresh-until> <stale-until> <digest> <size> <last-access> <tags-or-> <validator>
+origin <id> error <code>
+origin <id> not_modified <fresh-for> <stale-for> <validator>
+origin <id> modified <digest> <size> <fresh-for> <stale-for> <tags-or-> <validator> verified|unverified
+request <id> <time> <worker> <tenant> <method> <url> <vary> allow|deny <origin-id>
+complete <request-id> <time> none|after_prepare|after_body|after_metadata
+purge <time> <tenant> <sequence> <tag>
+recover <time>
+```
+
+The command output never prints URLs, bodies, tenant names, tags, or raw
+labels. Dynamic identifiers are SHA-256 hashes; reason codes are fixed strings.
+Trace lines with surplus fields and records containing more than 16 distinct
+tags are rejected rather than silently truncated.
+
+## Finishing criteria
+
+- [x] Baseline reproduced before component selection.
+- [x] Reference decisions, modeled leases, purges, quota, and recovery modeled.
+- [x] Unit tests cover every requested semantic area and all modeled crash
+  points.
+- [x] Formatting and linting are clean with warnings denied.
+- [x] A deterministic demo and the stated-count compact workload run without
+  network access.
+- [x] Production-scale latency/throughput is intentionally not claimed; the
+  actual gateway, SQLite, filesystem, body bytes, lease expiry, distributed
+  workers, and process restart are outside this prototype.
diff --git a/developer-simulation/runs/2026-08-06--http-cache-revalidation/demo.trace b/developer-simulation/runs/2026-08-06--http-cache-revalidation/demo.trace
new file mode 100644
index 0000000..d5b2e63
--- /dev/null
+++ b/developer-simulation/runs/2026-08-06--http-cache-revalidation/demo.trace
@@ -0,0 +1,30 @@
+# Synthetic labels and URLs are input only; the CLI output hashes them.
+quota 1000000
+blob body-a 10 verified
+blob body-d 10 verified
+blob body-e 10 verified
+entry tenant-a GET https://cache.test/item en 10 30 body-a 10 0 article etag-a
+entry tenant-b GET https://cache.test/profile en 5 15 body-d 10 0 profile etag-d
+entry tenant-c GET https://cache.test/crash en 1 100 body-e 10 0 crash etag-e
+origin replace modified body-b 11 100 200 article etag-b verified
+origin replace-new modified body-c 11 100 200 article etag-c verified
+origin origin-error error origin_down
+origin crash modified body-f 11 100 200 crash etag-f verified
+origin bad modified body-g 11 100 200 crash etag-g unverified
+request r1 10 worker-1 tenant-a GET https://cache.test/item EN allow replace
+request r2 10 worker-2 tenant-a GET https://cache.test/item en allow replace
+purge 11 tenant-a 2 article
+complete r1 12 none
+purge 13 tenant-a 1 article
+purge 14 tenant-a 2 article
+request r3 15 worker-3 tenant-a GET https://cache.test/item en allow replace-new
+complete r3 16 none
+request r4 20 worker-4 tenant-a GET https://cache.test/item en allow replace-new
+request r5 10 worker-5 tenant-b GET https://cache.test/profile en allow origin-error
+complete r5 11 none
+request r6 16 worker-6 tenant-b GET https://cache.test/profile en allow origin-error
+complete r6 17 none
+request r7 2 worker-7 tenant-c GET https://cache.test/crash en allow crash
+complete r7 3 after_metadata
+request r8 4 worker-8 tenant-d GET https://cache.test/unverified en allow bad
+complete r8 5 after_body
diff --git a/developer-simulation/runs/2026-08-06--http-cache-revalidation/evidence/EVIDENCE.md b/developer-simulation/runs/2026-08-06--http-cache-revalidation/evidence/EVIDENCE.md
new file mode 100644
index 0000000..b0bb66e
--- /dev/null
+++ b/developer-simulation/runs/2026-08-06--http-cache-revalidation/evidence/EVIDENCE.md
@@ -0,0 +1,341 @@
+# Trial evidence
+
+Date: 2026-08-06
+Checkout: `/private/tmp/bogkit-sim-2026-08-06-two-50bEAG`
+Scope: this checkout only; no GitHub, other worktree, prior lab report, developer-simulation directory, or automation state was inspected or changed.
+
+## Ordered discovery and friction trail
+
+1. Confirmed the assigned checkout and located the public README:
+
+   ```console
+   $ pwd && rg --files -g 'README*' -g '!**/target/**' -g '!**/.git/**' | sort
+   /private/tmp/bogkit-sim-2026-08-06-two-50bEAG
+   README.md
+   ```
+
+   ```console
+   $ sed -n '1,260p' README.md
+   ```
+
+   Observed: the documented entry point is `scripts/new-project.sh`; the
+   workspace describes Fold, ESE, ANNy, and examples in the order `starter`,
+   `timeseries`, `chat`, `search`.
+
+2. Read each public example in that order with:
+
+   ```console
+   $ rg --files examples/<example> -g '!**/target/**' -g '!**/.git/**' | sort
+   $ for f in $(rg --files examples/<example> -g '!**/target/**' -g '!**/.git/**' | sort); do case "$f" in *.rs|*/Cargo.toml|*.md|*.html|*.js|*.css|*.txt|*.json) echo "--- $f"; sed -n '1,420p' "$f";; esac; done
+   ```
+
+   Observed in order:
+
+   - `starter`: one `Stream`, transactional writes, consistent reads, and
+     `Count`/`Bag` materialized views.
+   - `timeseries`: `KeyBy`, `Aggregate`, `Filter`, retraction, and custom
+     accumulators over persisted views.
+   - `chat`: a single ingest thread owns Fold and republishes snapshots; this
+     is an explicit single-owner model, not a 32-worker lease model.
+   - `search`: `KeyedStream` upsert/remove semantics and retraction-safe
+     indexes, with ESE/ANNy as optional search support.
+
+3. Confirmed the repository was clean before trial files:
+
+   ```console
+   $ git status --short
+   ```
+
+   Observed: no output.
+
+4. Inspected only the public workspace manifest and Fold source after the
+   onboarding examples:
+
+   ```console
+   $ sed -n '1,260p' Cargo.toml
+   $ rg --files fold/src -g '*.rs' | sort
+   $ rg -n "pub (struct|enum|fn|trait)|pub mod|struct Stream|struct KeyedStream|wtx|rtx|transaction|checkpoint|recover|retract|KeyBy|Aggregate|Table|Bag|Count" fold/src -g '*.rs' | head -n 320
+   ```
+
+   Observed: Fold has durable single-writer `wtx`, consistent `rtx`,
+   `KeyedStream`, `Table`, `InvertedIndex`, `Ranked`, and `Retain`; `Retain`
+   stamps records with a wall-clock processing time. No public API covered the
+   separate body store, per-key lease, or purge sequence protocol.
+
+5. Selected a no-fit runtime decision and created only a new trial crate:
+
+   ```console
+   $ mkdir -p developer-simulation/runs/2026-08-06--http-cache-revalidation/src
+   ```
+
+   The new crate has no dependency on BogKit. Existing core crates and examples
+   were not modified.
+
+6. Onboarding compilation checks, still in README order:
+
+   ```console
+   $ cargo check --locked -p starter
+   ```
+
+   Observed: failed in ESE's build script while trying to download
+   `target/ese-cache/model.safetensors`; DNS lookup was unavailable.
+
+   ```console
+   $ cargo check --locked -p timeseries
+   ```
+
+   Observed: passed.
+
+   ```console
+   $ cargo check --locked -p chat
+   ```
+
+   Observed: passed.
+
+   ```console
+   $ cargo check --locked -p search
+   ```
+
+   Observed: failed at the same ESE model download/DNS step as `starter`.
+
+7. First prototype validation pass:
+
+   ```console
+   $ cargo fmt --manifest-path developer-simulation/runs/2026-08-06--http-cache-revalidation/Cargo.toml
+   $ cargo test --manifest-path developer-simulation/runs/2026-08-06--http-cache-revalidation/Cargo.toml
+   ```
+
+   Observed: the first compile caught a format-string arity error and Rust
+   borrow-checker errors in mutable entry reads. After those were corrected,
+   the first test run had two semantic failures: the baseline purge fixture
+   used the expiration boundary incorrectly, and the quota fixture was too
+   small to force eviction. Both were corrected and retested.
+
+8. First warnings-denied lint pass:
+
+   ```console
+   $ cargo clippy --manifest-path developer-simulation/runs/2026-08-06--http-cache-revalidation/Cargo.toml --all-targets -- -D warnings
+   ```
+
+   Observed: Clippy first reported the SHA-256 padding modulo idiom, helper
+   argument count, and an identical test branch. Those were corrected without
+   weakening the lint command; the final run passed.
+
+9. First end-to-end demo pass:
+
+   ```console
+   $ cargo run --quiet --manifest-path developer-simulation/runs/2026-08-06--http-cache-revalidation/Cargo.toml -- demo
+   ```
+
+   Observed: the first fixture attempt failed with `completion has no active
+   lease` because its second crash request hit a newly fresh entry. The fixture
+   was changed to use a separate key, then the demo passed.
+
+10. Public Fold regression check:
+
+    ```console
+    $ cargo test --locked -p fold
+    ```
+
+    Observed: 18 unit tests and 9 doctests passed.
+
+11. Workspace formatting check, intentionally read-only:
+
+    ```console
+    $ cargo fmt --all -- --check
+    ```
+
+    Observed: it reported pre-existing formatting differences in
+    `examples/search/src/main.rs`. That existing example was not changed.
+    Trial-only formatting passed separately.
+
+## Final commands and observed results
+
+```console
+$ cargo fmt --manifest-path developer-simulation/runs/2026-08-06--http-cache-revalidation/Cargo.toml -- --check
+```
+
+Passed.
+
+```console
+$ cargo test --manifest-path developer-simulation/runs/2026-08-06--http-cache-revalidation/Cargo.toml
+```
+
+Passed: 12 unit tests, 0 failures; the binary and doctest targets also passed.
+
+```console
+$ cargo clippy --manifest-path developer-simulation/runs/2026-08-06--http-cache-revalidation/Cargo.toml --all-targets -- -D warnings
+```
+
+Passed with warnings denied.
+
+```console
+$ cargo run --quiet --manifest-path developer-simulation/runs/2026-08-06--http-cache-revalidation/Cargo.toml -- demo | rg '^(mode=baseline|summary |demo=)'
+mode=baseline wrong_variant=true cross_tenant_collision=true duplicate_revalidations=2 purge_left_servable=true unverified_body_after_crash=true missing_body_after_crash=true
+summary requests=8 fresh_hits=1 stale_responses=1 misses=3 revalidation_starts=6 revalidation_waits=1 purges_applied=1 purges_ignored=2 recovery_rollbacks=1 recovery_commits=2 quota_evictions=0 unsafe_body_serves=0 committed_usage_bytes=722 quota_bytes=1000000
+demo=PASS modeled_invariants=true
+```
+
+```console
+$ cargo run --quiet --manifest-path developer-simulation/runs/2026-08-06--http-cache-revalidation/Cargo.toml -- run developer-simulation/runs/2026-08-06--http-cache-revalidation/demo.trace | tail -n 6
+```
+
+Observed: the file-driven trace produced the same three final entries and the
+same recovery/purge behavior as the embedded demo; output contained only
+hashed dynamic identifiers.
+
+```console
+$ cargo run --quiet --manifest-path developer-simulation/runs/2026-08-06--http-cache-revalidation/Cargo.toml -- run developer-simulation/runs/2026-08-06--http-cache-revalidation/quota.trace | rg 'QUOTA_EVICT|summary|final_entry'
+at=11 event=eviction reason=QUOTA_EVICT_LRU tenant_id=80a707af7dc77ee1228f9127180f3964835e5beb4c4ab0d812f0fe7593579b3a key_id=1acec891bd9223876cfe7ef8542648e84c28ae4ecab6c15562bbb6fc4fe58526 actor_id=- lease_id=- body_id=b8f5d4d2194b24418d533e3297074d2c453117f78ec56db4da20f93973a039c committed_usage_bytes=0
+summary requests=1 fresh_hits=0 stale_responses=0 misses=0 revalidation_starts=1 revalidation_waits=0 purges_applied=0 purges_ignored=0 recovery_rollbacks=0 recovery_commits=1 quota_evictions=1 unsafe_body_serves=0 committed_usage_bytes=0 quota_bytes=300
+```
+
+```console
+$ cargo build --release --manifest-path developer-simulation/runs/2026-08-06--http-cache-revalidation/Cargo.toml
+```
+
+Passed.
+
+```console
+$ developer-simulation/runs/2026-08-06--http-cache-revalidation/target/release/http-cache-revalidation workload
+workload objects=2000000 requests=1000000 purges=100000 request_hits=0 request_misses=1000000 committed_usage_bytes=8640000000 quota_bytes=68719476736 within_quota=true max_rss_bytes=65634304 memory_limit_bytes=268435456 within_memory=true
+```
+
+Observed: the compact harness completed in about 0.19 seconds on this run,
+used a logical 8.64 GB committed footprint under the 64 GiB quota, and measured
+65,634,304 bytes maximum resident set size under the 256 MiB limit. This is a
+shape check, not a production benchmark: it does not allocate body bytes or
+store the full semantic trace.
+
+The requested external command was also tried:
+
+```console
+$ /usr/bin/time -l developer-simulation/runs/2026-08-06--http-cache-revalidation/target/release/http-cache-revalidation workload
+```
+
+Observed: the workload result matched the line above; the sandboxed `/usr/bin/time`
+could not query `kern.clockrate`, so the prototype's macOS `getrusage` value is
+the recorded memory measurement.
+
+```console
+$ if cargo run --quiet --manifest-path developer-simulation/runs/2026-08-06--http-cache-revalidation/Cargo.toml -- demo | rg -n 'cache\.test|tenant-[a-z]|body-[a-z]|worker-[0-9]|article|profile|origin_down|etag-[a-z]'; then exit 1; else echo privacy_check=PASS_no_raw_fixture_identifiers; fi
+privacy_check=PASS_no_raw_fixture_identifiers
+```
+
+The demo's stable reason-code extraction was:
+
+```text
+FRESH_HIT
+MISS_ORIGIN_ERROR
+MISS_REVALIDATION_STARTED
+PURGE_APPLIED
+PURGE_DUPLICATE_IGNORED
+PURGE_REORDERED_IGNORED
+RECOVERY_RETAIN_COMMITTED
+RECOVERY_ROLLBACK_UNCOMMITTED
+REVALIDATION_COMMITTED_200
+REVALIDATION_REJECTED_PURGE
+REVALIDATION_STARTED
+REVALIDATION_WAIT
+STALE_IF_ERROR
+```
+
+## Skeptical review fixes
+
+The reviewer reproduced the compact semantic claims and found one correctness
+bug plus evidence-scope problems. Before archival, the prototype was corrected
+and all affected checks were rerun:
+
+- A delayed purge with sequence 1 is now ignored after sequence 2 has been
+  accepted, even if the entry was repopulated in between. The regression keeps
+  the repopulated entry and distinguishes `PURGE_REORDERED_IGNORED` from a
+  duplicate purge.
+- The trace parser now rejects surplus fields and more than 16 distinct tags;
+  it no longer silently truncates invalid trace input.
+- The 32-worker lease result is described as sequential serialized calls in one
+  process. There is no lease expiry, worker-loss recovery, distributed
+  concurrency, or fencing proof.
+- Body safety is described as an in-memory digest/size/reference model only.
+  No body bytes, file deletion, SQLite transaction, fsync, rename, or process
+  restart is tested, so the prototype does not claim body-file deletion safety.
+- The 2M/1M/100K run is explicitly a compact memory/quota shape harness. It
+  does not model the semantic object, tag-posting, lease, body, or purge state
+  at that scale.
+
+The corrected prototype remains a no-fit result for the acceptance-critical
+cache boundary. No BogKit defect was demonstrated.
+
+## Categorized findings
+
+| Finding | Severity | Confidence | Reproduction | Smallest improvement |
+| --- | --- | --- | --- | --- |
+| Method+URL key collides across Vary variants and tenants | High | High | `demo` baseline line reports `wrong_variant=true` and `cross_tenant_collision=true` | Include tenant, normalized method/URL, and Vary fingerprint in the canonical key |
+| Expired requests stampede origin revalidation | High | High | The baseline model starts two revalidations; the reference model serializes 32 calls in one process, with one start and 31 waits | A production implementation still needs a durable/coordinated lease with expiry, fencing, and an explicit completion/failure path |
+| Exact-URL invalidation cannot make tag-purged data unservable | High | High | `demo` baseline reports `purge_left_servable=true` | Maintain tenant-scoped tag postings and invalidate before processing later requests |
+| Separate metadata/body commits can expose an unverified body or delete a referenced body | Critical | High | `baseline_reproduction` reports both modeled crash failures; reference tests cover `after_prepare`, `after_body`, and `after_metadata` in memory only | Use a durable journal, verify actual body bytes before metadata publication, then coordinate filesystem reachability-GC |
+| No public BogKit component spans the acceptance-critical cache boundary | High design blocker | High | README/examples plus Fold source and 18 passing Fold tests; see decision audit | Add a first-class cross-store transaction protocol and lease/purge primitives, which is beyond this trial's scope |
+| ESE-backed public examples require an unavailable model download | Medium | High | `cargo check --locked -p starter` and `-p search` fail in `ese/build.rs` on DNS | Vendor the model or provide an explicitly offline fixture/feature |
+| Existing search example is not rustfmt-clean | Low | High | `cargo fmt --all -- --check` reports only `examples/search/src/main.rs` | Apply rustfmt in a separate, approved example-only change |
+
+## Decision audit
+
+1. The baseline was written down and reproduced before selecting a runtime
+   component.
+2. Fold was considered for metadata and tag indexes because its public
+   `KeyedStream`, `Table`, and `InvertedIndex` surfaces are real fits for those
+   isolated views.
+3. Fold was rejected as the runtime for this prototype because the body is a
+   separate content-addressed file store, `Retain` uses wall-clock processing
+   time, and the public API does not provide per-key leases or sequence-aware
+   purge fencing.
+4. A custom Fold node was also rejected: implementing the missing cross-store
+   journal and concurrency protocol inside the trial would be a new BogKit
+   cache component, not a meaningful evaluation of an existing one.
+5. The dependency-free model was kept in a new `trials/` subtree. No BogKit
+   core file, existing example, root workspace manifest, GitHub state, or
+   automation state changed.
+6. The model makes no production latency, throughput, SQLite, filesystem, or
+   crash-durability claim. It is a deterministic correctness model with a
+   compact allocation/quota shape check.
+
+## Acceptance mapping
+
+| Acceptance criterion | Evidence |
+| --- | --- |
+| 1. Correct request decision | Logical-time unit tests plus the file-driven demo emit fresh hit, miss/revalidation, stale-if-error, wait, and completion reason codes |
+| 2. Modeled single-flight behavior | 32 sequential calls in one process produce one start and 31 waits; lease expiry, worker loss, and distributed concurrency are not tested |
+| 3. Purge visibility and convergence | Tag-index unit test applies sequence 2, repopulates the entry, then applies reordered 1 and duplicate 2; the repopulated entry survives and both later purges are ignored |
+| 4. Modeled crash recovery | Three in-memory crash points; pre-metadata phases roll back, post-metadata phase retains verified labels, and every final entry has a matching modeled manifest |
+| 5. Quota and shape memory | Quota trace evicts under 300 bytes; the compact shape harness reports 8.64 GB logical usage under 64 GiB and 65,634,304 bytes RSS under 256 MiB. This is not semantic-scale evidence |
+| 6. Stable private output | SHA-256 test, stable reason-code extraction, and privacy grep pass |
+
+## Prototype defects and limitations
+
+These are limitations of the trial, not findings against BogKit:
+
+- It does not parse HTTP, normalize percent-encoding, evaluate real `Vary`
+  headers, or implement all HTTP cache directives.
+- The trace parser expects blob manifests before their initial entries and is
+  intentionally whitespace-delimited.
+- Body verification is represented by a supplied bit and size/digest labels;
+  no bytes, body-file deletion, fsync, rename, SQLite transaction, process
+  restart, or power-loss behavior is run.
+- The semantic engine is in-memory. The stated-count workload is a compact
+  shape harness, not a two-million-entry semantic run and not a semantic purge
+  workload.
+- Lease calls are sequential within one process; there is no expiry or worker
+  loss path.
+- RSS measurement is implemented for macOS with `getrusage`; other platforms
+  report an unavailable measurement rather than guessing.
+- Purge identity is `(tenant, sequence, tag)`. A production contract should
+  define what happens if one sequence is reused for different tags.
+- The reference model conservatively fences a whole tenant's active
+  revalidation when any accepted purge changes that tenant epoch.
+
+## Prototype defects versus BogKit defects
+
+The missing lease, sequence-aware purge, and cross-store journal are not
+reported as bugs in BogKit: the public README and APIs do not claim to provide
+those cache features. The only repository-level friction observed was the
+network-dependent ESE build and the existing search-example formatting diff;
+both were left unchanged.
diff --git a/developer-simulation/runs/2026-08-06--http-cache-revalidation/quota.trace b/developer-simulation/runs/2026-08-06--http-cache-revalidation/quota.trace
new file mode 100644
index 0000000..9bbf845
--- /dev/null
+++ b/developer-simulation/runs/2026-08-06--http-cache-revalidation/quota.trace
@@ -0,0 +1,6 @@
+quota 300
+blob body-a 10 verified
+entry tenant-a GET https://cache.test/quota en 10 20 body-a 10 0 quota etag-a
+origin replace modified body-b 200 100 200 - etag-b verified
+request r1 10 worker-1 tenant-a GET https://cache.test/quota en allow replace
+complete r1 11 none
diff --git a/developer-simulation/runs/2026-08-06--http-cache-revalidation/src/lib.rs b/developer-simulation/runs/2026-08-06--http-cache-revalidation/src/lib.rs
new file mode 100644
index 0000000..5e6053a
--- /dev/null
+++ b/developer-simulation/runs/2026-08-06--http-cache-revalidation/src/lib.rs
@@ -0,0 +1,1984 @@
+//! A dependency-free reference model for the cache-revalidation scenario.
+//!
+//! This is deliberately a state-machine model, not an HTTP implementation.
+//! It consumes normalized trace records, fake origin outcomes, and explicit
+//! commit-point crash injections. The model is also used by the CLI demo and
+//! unit tests so the evidence does not depend on network access or a running
+//! proxy.
+
+use std::collections::{BTreeSet, HashMap, HashSet};
+use std::fmt;
+use std::fs;
+use std::path::Path;
+
+const SHA256_K: [u32; 64] = [
+    0x428a_2f98,
+    0x7137_4491,
+    0xb5c0_fbcf,
+    0xe9b5_dba5,
+    0x3956_c25b,
+    0x59f1_11f1,
+    0x923f_82a4,
+    0xab1c_5ed5,
+    0xd807_aa98,
+    0x1283_5b01,
+    0x2431_85be,
+    0x550c_7dc3,
+    0x72be_5d74,
+    0x80de_b1fe,
+    0x9bdc_06a7,
+    0xc19b_f174,
+    0xe49b_69c1,
+    0xefbe_4786,
+    0x0fc1_9dc6,
+    0x240c_a1cc,
+    0x2de9_2c6f,
+    0x4a74_84aa,
+    0x5cb0_a9dc,
+    0x76f9_88da,
+    0x983e_5152,
+    0xa831_c66d,
+    0xb003_27c8,
+    0xbf59_7fc7,
+    0xc6e0_0bf3,
+    0xd5a7_9147,
+    0x06ca_6351,
+    0x1429_2967,
+    0x27b7_0a85,
+    0x2e1b_2138,
+    0x4d2c_6dfc,
+    0x5338_0d13,
+    0x650a_7354,
+    0x766a_0abb,
+    0x81c2_c92e,
+    0x9272_2c85,
+    0xa2bf_e8a1,
+    0xa81a_664b,
+    0xc24b_8b70,
+    0xc76c_51a3,
+    0xd192_e819,
+    0xd699_0624,
+    0xf40e_3585,
+    0x106a_a070,
+    0x19a4_c116,
+    0x1e37_6c08,
+    0x2748_774c,
+    0x34b0_bcb5,
+    0x391c_0cb3,
+    0x4ed8_aa4a,
+    0x5b9c_ca4f,
+    0x682e_6ff3,
+    0x748f_82ee,
+    0x78a5_636f,
+    0x84c8_7814,
+    0x8cc7_0208,
+    0x90be_fffa,
+    0xa450_6ceb,
+    0xbef9_a3f7,
+    0xc671_78f2,
+];
+
+const SHA256_H0: [u32; 8] = [
+    0x6a09_e667,
+    0xbb67_ae85,
+    0x3c6e_f372,
+    0xa54f_f53a,
+    0x510e_527f,
+    0x9b05_688c,
+    0x1f83_d9ab,
+    0x5be0_cd19,
+];
+
+/// Stable SHA-256 identifier used in all emitted evidence.
+pub fn hash_id(value: &str) -> String {
+    let digest = sha256(value.as_bytes());
+    digest.iter().map(|byte| format!("{byte:02x}")).collect()
+}
+
+fn sha256(input: &[u8]) -> [u8; 32] {
+    let bit_len = (input.len() as u64) * 8;
+    let mut message = input.to_vec();
+    message.push(0x80);
+    while !(message.len() + 8).is_multiple_of(64) {
+        message.push(0);
+    }
+    message.extend_from_slice(&bit_len.to_be_bytes());
+
+    let mut state = SHA256_H0;
+    for chunk in message.chunks_exact(64) {
+        let mut words = [0u32; 64];
+        for (i, word) in words.iter_mut().take(16).enumerate() {
+            let start = i * 4;
+            *word = u32::from_be_bytes([
+                chunk[start],
+                chunk[start + 1],
+                chunk[start + 2],
+                chunk[start + 3],
+            ]);
+        }
+        for i in 16..64 {
+            let s0 = words[i - 15].rotate_right(7)
+                ^ words[i - 15].rotate_right(18)
+                ^ (words[i - 15] >> 3);
+            let s1 = words[i - 2].rotate_right(17)
+                ^ words[i - 2].rotate_right(19)
+                ^ (words[i - 2] >> 10);
+            words[i] = words[i - 16]
+                .wrapping_add(s0)
+                .wrapping_add(words[i - 7])
+                .wrapping_add(s1);
+        }
+
+        let [mut a, mut b, mut c, mut d, mut e, mut f, mut g, mut h] = state;
+        for i in 0..64 {
+            let s1 = e.rotate_right(6) ^ e.rotate_right(11) ^ e.rotate_right(25);
+            let ch = (e & f) ^ ((!e) & g);
+            let temp1 = h
+                .wrapping_add(s1)
+                .wrapping_add(ch)
+                .wrapping_add(SHA256_K[i])
+                .wrapping_add(words[i]);
+            let s0 = a.rotate_right(2) ^ a.rotate_right(13) ^ a.rotate_right(22);
+            let maj = (a & b) ^ (a & c) ^ (b & c);
+            let temp2 = s0.wrapping_add(maj);
+
+            h = g;
+            g = f;
+            f = e;
+            e = d.wrapping_add(temp1);
+            d = c;
+            c = b;
+            b = a;
+            a = temp1.wrapping_add(temp2);
+        }
+
+        state[0] = state[0].wrapping_add(a);
+        state[1] = state[1].wrapping_add(b);
+        state[2] = state[2].wrapping_add(c);
+        state[3] = state[3].wrapping_add(d);
+        state[4] = state[4].wrapping_add(e);
+        state[5] = state[5].wrapping_add(f);
+        state[6] = state[6].wrapping_add(g);
+        state[7] = state[7].wrapping_add(h);
+    }
+
+    let mut output = [0u8; 32];
+    for (i, word) in state.iter().enumerate() {
+        output[i * 4..i * 4 + 4].copy_from_slice(&word.to_be_bytes());
+    }
+    output
+}
+
+/// The cache key includes tenant and the supplied Vary fingerprint. URL
+/// parsing is intentionally out of scope; the model only trims whitespace and
+/// removes a fragment, which is not sent in an HTTP request.
+#[derive(Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
+pub struct CacheKey {
+    pub tenant: String,
+    pub method: String,
+    pub url: String,
+    pub vary: String,
+}
+
+impl CacheKey {
+    pub fn new(tenant: &str, method: &str, url: &str, vary: &str) -> Self {
+        let mut normalized_url = url.trim().to_string();
+        if let Some(fragment) = normalized_url.find('#') {
+            normalized_url.truncate(fragment);
+        }
+        Self {
+            tenant: tenant.trim().to_string(),
+            method: method.trim().to_ascii_uppercase(),
+            url: normalized_url,
+            vary: vary.trim().to_ascii_lowercase(),
+        }
+    }
+
+    pub fn id(&self) -> String {
+        hash_id(&format!(
+            "tenant:{}:{}\0method:{}:{}\0url:{}:{}\0vary:{}:{}",
+            self.tenant.len(),
+            self.tenant,
+            self.method.len(),
+            self.method,
+            self.url.len(),
+            self.url,
+            self.vary.len(),
+            self.vary
+        ))
+    }
+}
+
+fn normalize_tags(tags: &[String]) -> Vec<String> {
+    let mut result: Vec<String> = tags
+        .iter()
+        .flat_map(|tag| tag.split(','))
+        .map(str::trim)
+        .filter(|tag| !tag.is_empty() && *tag != "-")
+        .map(str::to_ascii_lowercase)
+        .collect();
+    result.sort();
+    result.dedup();
+    result.truncate(16);
+    result
+}
+
+fn parse_tags(raw: &str) -> Result<Vec<String>, String> {
+    if raw == "-" {
+        Ok(Vec::new())
+    } else {
+        let mut result: Vec<String> = raw
+            .split(',')
+            .map(str::trim)
+            .filter(|tag| !tag.is_empty() && *tag != "-")
+            .map(str::to_ascii_lowercase)
+            .collect();
+        result.sort();
+        result.dedup();
+        if result.len() > 16 {
+            return Err("trace contains more than 16 tags".to_string());
+        }
+        Ok(result)
+    }
+}
+
+#[derive(Clone, Debug, Eq, PartialEq)]
+pub struct Entry {
+    pub fresh_until: u64,
+    pub stale_until: u64,
+    pub validator: String,
+    pub body_digest: String,
+    pub body_size: u64,
+    pub tags: Vec<String>,
+    pub last_access: u64,
+}
+
+#[derive(Clone, Debug, Eq, PartialEq)]
+pub struct BlobManifest {
+    pub digest: String,
+    pub size: u64,
+    pub verified: bool,
+}
+
+#[derive(Clone, Debug, Eq, PartialEq)]
+pub enum OriginOutcome {
+    Error {
+        code: String,
+    },
+    NotModified {
+        fresh_for: u64,
+        stale_for: u64,
+        validator: String,
+    },
+    Modified {
+        digest: String,
+        size: u64,
+        fresh_for: u64,
+        stale_for: u64,
+        tags: Vec<String>,
+        validator: String,
+        verified: bool,
+    },
+}
+
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+pub enum CrashPoint {
+    None,
+    AfterPrepare,
+    AfterBodyCommit,
+    AfterMetadataCommit,
+}
+
+impl CrashPoint {
+    pub fn parse(value: &str) -> Result<Self, String> {
+        match value {
+            "none" => Ok(Self::None),
+            "after_prepare" => Ok(Self::AfterPrepare),
+            "after_body" => Ok(Self::AfterBodyCommit),
+            "after_metadata" => Ok(Self::AfterMetadataCommit),
+            _ => Err(format!("unknown crash point: {value}")),
+        }
+    }
+}
+
+#[derive(Clone, Debug, Eq, PartialEq)]
+enum CommitPhase {
+    Prepared,
+    BodyCommitted,
+    MetadataCommitted,
+}
+
+#[derive(Clone, Debug)]
+struct Blob {
+    size: u64,
+    verified: bool,
+    refs: u64,
+}
+
+#[derive(Clone, Debug)]
+struct Journal {
+    request_id: String,
+    key: CacheKey,
+    digest: String,
+    phase: CommitPhase,
+}
+
+#[derive(Clone, Debug)]
+struct Lease {
+    request_id: String,
+    key: CacheKey,
+    started_at: u64,
+    tenant_epoch: u64,
+    origin_id: String,
+    allow_stale_if_error: bool,
+    worker: String,
+}
+
+#[derive(Clone, Debug, Default, Eq, PartialEq)]
+pub struct Metrics {
+    pub requests: u64,
+    pub fresh_hits: u64,
+    pub stale_responses: u64,
+    pub misses: u64,
+    pub revalidation_starts: u64,
+    pub revalidation_waits: u64,
+    pub purges_applied: u64,
+    pub purges_ignored: u64,
+    pub recovery_rollbacks: u64,
+    pub recovery_commits: u64,
+    pub quota_evictions: u64,
+    pub unsafe_body_serves: u64,
+}
+
+#[derive(Clone, Debug, Eq, PartialEq)]
+pub struct Decision {
+    pub at: u64,
+    pub event: &'static str,
+    pub reason: &'static str,
+    pub tenant_id: Option<String>,
+    pub key_id: Option<String>,
+    pub actor_id: Option<String>,
+    pub lease_id: Option<String>,
+    pub body_id: Option<String>,
+    pub committed_usage_bytes: u64,
+}
+
+impl Decision {
+    pub fn line(&self) -> String {
+        let tenant = self.tenant_id.as_deref().unwrap_or("-");
+        let key = self.key_id.as_deref().unwrap_or("-");
+        let actor = self.actor_id.as_deref().unwrap_or("-");
+        let lease = self.lease_id.as_deref().unwrap_or("-");
+        let body = self.body_id.as_deref().unwrap_or("-");
+        format!(
+            "at={} event={} reason={} tenant_id={} key_id={} actor_id={} lease_id={} body_id={} committed_usage_bytes={}",
+            self.at,
+            self.event,
+            self.reason,
+            tenant,
+            key,
+            actor,
+            lease,
+            body,
+            self.committed_usage_bytes
+        )
+    }
+}
+
+#[derive(Clone, Debug, Default)]
+struct State {
+    entries: HashMap<CacheKey, Entry>,
+    blobs: HashMap<String, Blob>,
+    tag_index: HashMap<(String, String), BTreeSet<CacheKey>>,
+}
+
+impl State {
+    fn add_tag_postings(&mut self, key: &CacheKey, tags: &[String]) {
+        for tag in tags {
+            self.tag_index
+                .entry((key.tenant.clone(), tag.clone()))
+                .or_default()
+                .insert(key.clone());
+        }
+    }
+
+    fn remove_tag_postings(&mut self, key: &CacheKey, tags: &[String]) {
+        for tag in tags {
+            let index_key = (key.tenant.clone(), tag.clone());
+            if let Some(postings) = self.tag_index.get_mut(&index_key) {
+                postings.remove(key);
+                if postings.is_empty() {
+                    self.tag_index.remove(&index_key);
+                }
+            }
+        }
+    }
+
+    fn attach(&mut self, key: CacheKey, entry: Entry) {
+        if let Some(old) = self.detach(&key) {
+            debug_assert!(self.blobs.contains_key(&old.body_digest));
+        }
+        let blob = self
+            .blobs
+            .get_mut(&entry.body_digest)
+            .expect("attach requires a manifest");
+        blob.refs += 1;
+        self.add_tag_postings(&key, &entry.tags);
+        self.entries.insert(key, entry);
+    }
+
+    fn detach(&mut self, key: &CacheKey) -> Option<Entry> {
+        let entry = self.entries.remove(key)?;
+        self.remove_tag_postings(key, &entry.tags);
+        let blob = self
+            .blobs
+            .get_mut(&entry.body_digest)
+            .expect("entry body must have a manifest");
+        debug_assert!(blob.refs > 0);
+        blob.refs = blob.refs.saturating_sub(1);
+        Some(entry)
+    }
+
+    fn body_is_servable(&self, entry: &Entry) -> bool {
+        self.blobs
+            .get(&entry.body_digest)
+            .is_some_and(|blob| blob.verified && blob.size == entry.body_size)
+    }
+
+    fn rebuild_refs(&mut self) {
+        for blob in self.blobs.values_mut() {
+            blob.refs = 0;
+        }
+        self.tag_index.clear();
+        let entries: Vec<(CacheKey, Entry)> = self
+            .entries
+            .iter()
+            .map(|(key, entry)| (key.clone(), entry.clone()))
+            .collect();
+        for (key, entry) in entries {
+            if let Some(blob) = self.blobs.get_mut(&entry.body_digest) {
+                blob.refs += 1;
+            }
+            self.add_tag_postings(&key, &entry.tags);
+        }
+    }
+
+    fn garbage_collect(&mut self) -> u64 {
+        let before = self.blobs.len();
+        self.blobs.retain(|_, blob| blob.refs > 0);
+        (before - self.blobs.len()) as u64
+    }
+
+    fn metadata_bytes(&self) -> u64 {
+        self.entries
+            .values()
+            .map(|entry| 192 + (entry.tags.len() as u64 * 32) + entry.validator.len() as u64)
+            .sum()
+    }
+
+    fn committed_usage_bytes(&self) -> u64 {
+        let bodies = self
+            .blobs
+            .values()
+            .filter(|blob| blob.refs > 0 && blob.verified)
+            .map(|blob| blob.size)
+            .sum::<u64>();
+        bodies.saturating_add(self.metadata_bytes())
+    }
+}
+
+/// The acceptance-oriented reference model.
+pub struct ReferenceEngine {
+    state: State,
+    quota_bytes: u64,
+    origins: HashMap<String, OriginOutcome>,
+    leases: HashMap<CacheKey, Lease>,
+    journal: Option<Journal>,
+    seen_purges: HashSet<(String, u64, String)>,
+    tag_versions: HashMap<(String, String), u64>,
+    tenant_epochs: HashMap<String, u64>,
+    decisions: Vec<Decision>,
+    pub metrics: Metrics,
+}
+
+impl ReferenceEngine {
+    pub fn new(quota_bytes: u64) -> Self {
+        Self {
+            state: State::default(),
+            quota_bytes,
+            origins: HashMap::new(),
+            leases: HashMap::new(),
+            journal: None,
+            seen_purges: HashSet::new(),
+            tag_versions: HashMap::new(),
+            tenant_epochs: HashMap::new(),
+            decisions: Vec::new(),
+            metrics: Metrics::default(),
+        }
+    }
+
+    pub fn add_blob(&mut self, manifest: BlobManifest) {
+        self.state.blobs.insert(
+            manifest.digest,
+            Blob {
+                size: manifest.size,
+                verified: manifest.verified,
+                refs: 0,
+            },
+        );
+    }
+
+    pub fn add_initial_entry(&mut self, key: CacheKey, mut entry: Entry, at: u64) {
+        entry.tags = normalize_tags(&entry.tags);
+        let valid = self
+            .state
+            .blobs
+            .get(&entry.body_digest)
+            .is_some_and(|blob| blob.verified && blob.size == entry.body_size);
+        if valid {
+            self.state.attach(key, entry);
+        } else {
+            self.emit(
+                at,
+                "recovery",
+                "RECOVERY_DROP_UNVERIFIED_INITIAL",
+                None,
+                None,
+                None,
+                None,
+                None,
+            );
+        }
+    }
+
+    /// Finish loading the initial index and manifest before processing runtime
+    /// events. This keeps manifests declared before their entries alive while
+    /// still applying the quota to an already-populated cache.
+    pub fn finalize_initial(&mut self, at: u64) {
+        self.state.garbage_collect();
+        self.enforce_quota(at);
+    }
+
+    pub fn add_origin(&mut self, id: String, outcome: OriginOutcome) {
+        self.origins.insert(id, outcome);
+    }
+
+    pub fn request(
+        &mut self,
+        request_id: String,
+        at: u64,
+        worker: String,
+        key: CacheKey,
+        allow_stale_if_error: bool,
+        origin_id: String,
+    ) {
+        self.metrics.requests += 1;
+        if let Some(snapshot) = self.state.entries.get(&key).cloned() {
+            if !self.state.body_is_servable(&snapshot) {
+                self.metrics.unsafe_body_serves += 1;
+                let _ = self.state.detach(&key);
+                self.emit(
+                    at,
+                    "request",
+                    "MISS_UNVERIFIED_BODY",
+                    Some(&key),
+                    Some(&worker),
+                    None,
+                    None,
+                    None,
+                );
+            } else if at < snapshot.fresh_until {
+                if let Some(entry) = self.state.entries.get_mut(&key) {
+                    entry.last_access = at;
+                }
+                self.metrics.fresh_hits += 1;
+                self.emit(
+                    at,
+                    "request",
+                    "FRESH_HIT",
+                    Some(&key),
+                    Some(&worker),
+                    None,
+                    None,
+                    None,
+                );
+                return;
+            }
+        }
+
+        if let Some(lease_request_id) = self.leases.get(&key).map(|lease| lease.request_id.clone())
+        {
+            self.metrics.revalidation_waits += 1;
+            self.emit(
+                at,
+                "request",
+                "REVALIDATION_WAIT",
+                Some(&key),
+                Some(&worker),
+                Some(&lease_request_id),
+                None,
+                None,
+            );
+            return;
+        }
+
+        let tenant_epoch = self.tenant_epochs.get(&key.tenant).copied().unwrap_or(0);
+        self.leases.insert(
+            key.clone(),
+            Lease {
+                request_id: request_id.clone(),
+                key: key.clone(),
+                started_at: at,
+                tenant_epoch,
+                origin_id,
+                allow_stale_if_error,
+                worker: worker.clone(),
+            },
+        );
+        self.metrics.revalidation_starts += 1;
+        let reason = if self.state.entries.contains_key(&key) {
+            "REVALIDATION_STARTED"
+        } else {
+            self.metrics.misses += 1;
+            "MISS_REVALIDATION_STARTED"
+        };
+        self.emit(
+            at,
+            "request",
+            reason,
+            Some(&key),
+            Some(&worker),
+            Some(&request_id),
+            None,
+            None,
+        );
+    }
+
+    pub fn complete(&mut self, request_id: &str, at: u64, crash: CrashPoint) -> Result<(), String> {
+        let key = self
+            .leases
+            .iter()
+            .find_map(|(key, lease)| (lease.request_id == request_id).then(|| key.clone()))
+            .ok_or_else(|| "completion has no active lease".to_string())?;
+        let lease = self
+            .leases
+            .remove(&key)
+            .expect("lease found immediately before removal");
+
+        if at < lease.started_at {
+            return Err("completion precedes request time".to_string());
+        }
+        let current_epoch = self.tenant_epochs.get(&key.tenant).copied().unwrap_or(0);
+        if current_epoch != lease.tenant_epoch {
+            self.emit(
+                at,
+                "revalidation",
+                "REVALIDATION_REJECTED_PURGE",
+                Some(&key),
+                Some(&lease.worker),
+                Some(request_id),
+                None,
+                None,
+            );
+            return Ok(());
+        }
+
+        let outcome = self
+            .origins
+            .get(&lease.origin_id)
+            .cloned()
+            .ok_or_else(|| "completion references unknown origin outcome".to_string())?;
+        match outcome {
+            OriginOutcome::Error { .. } => {
+                let stale_servable = self.state.entries.get(&key).is_some_and(|entry| {
+                    lease.allow_stale_if_error
+                        && at < entry.stale_until
+                        && self.state.body_is_servable(entry)
+                });
+                if stale_servable {
+                    if let Some(entry) = self.state.entries.get_mut(&key) {
+                        entry.last_access = at;
+                    }
+                    self.metrics.stale_responses += 1;
+                    self.emit(
+                        at,
+                        "revalidation",
+                        "STALE_IF_ERROR",
+                        Some(&key),
+                        Some(&lease.worker),
+                        Some(request_id),
+                        None,
+                        None,
+                    );
+                } else {
+                    self.metrics.misses += 1;
+                    self.emit(
+                        at,
+                        "revalidation",
+                        "MISS_ORIGIN_ERROR",
+                        Some(&key),
+                        Some(&lease.worker),
+                        Some(request_id),
+                        None,
+                        None,
+                    );
+                }
+            }
+            OriginOutcome::NotModified {
+                fresh_for,
+                stale_for,
+                validator,
+            } => {
+                let servable = self
+                    .state
+                    .entries
+                    .get(&key)
+                    .is_some_and(|entry| self.state.body_is_servable(entry));
+                if servable {
+                    if let Some(entry) = self.state.entries.get_mut(&key) {
+                        entry.fresh_until = at.saturating_add(fresh_for);
+                        entry.stale_until = at.saturating_add(stale_for);
+                        entry.validator = validator;
+                        entry.last_access = at;
+                    }
+                    self.metrics.recovery_commits += 1;
+                    self.emit(
+                        at,
+                        "revalidation",
+                        "REVALIDATION_COMMITTED_304",
+                        Some(&key),
+                        Some(&lease.worker),
+                        Some(request_id),
+                        None,
+                        None,
+                    );
+                } else {
+                    self.metrics.unsafe_body_serves += 1;
+                    self.emit(
+                        at,
+                        "revalidation",
+                        "REVALIDATION_REJECTED_UNVERIFIED",
+                        Some(&key),
+                        Some(&lease.worker),
+                        Some(request_id),
+                        None,
+                        None,
+                    );
+                }
+            }
+            outcome @ OriginOutcome::Modified { .. } => {
+                self.commit_modified(lease, at, outcome, crash);
+            }
+        }
+        Ok(())
+    }
+
+    fn commit_modified(
+        &mut self,
+        lease: Lease,
+        at: u64,
+        outcome: OriginOutcome,
+        crash: CrashPoint,
+    ) {
+        let OriginOutcome::Modified {
+            digest,
+            size,
+            fresh_for,
+            stale_for,
+            tags,
+            validator,
+            verified,
+        } = outcome
+        else {
+            unreachable!("commit_modified only accepts modified outcomes");
+        };
+        let key = lease.key.clone();
+        self.journal = Some(Journal {
+            request_id: lease.request_id.clone(),
+            key: key.clone(),
+            digest: digest.clone(),
+            phase: CommitPhase::Prepared,
+        });
+
+        let manifest_matches = self
+            .state
+            .blobs
+            .get(&digest)
+            .is_none_or(|blob| blob.size == size);
+        if !manifest_matches {
+            self.journal = None;
+            self.emit(
+                at,
+                "revalidation",
+                "REVALIDATION_REJECTED_BODY_SIZE",
+                Some(&key),
+                Some(&lease.worker),
+                Some(&lease.request_id),
+                Some(&digest),
+                None,
+            );
+            return;
+        }
+        self.state.blobs.entry(digest.clone()).or_insert(Blob {
+            size,
+            verified: false,
+            refs: 0,
+        });
+        if crash == CrashPoint::AfterPrepare {
+            self.recover(at);
+            return;
+        }
+
+        let already_verified = self
+            .state
+            .blobs
+            .get(&digest)
+            .is_some_and(|blob| blob.verified && blob.size == size);
+        if !already_verified && let Some(blob) = self.state.blobs.get_mut(&digest) {
+            blob.verified = verified;
+        }
+        if let Some(journal) = self.journal.as_mut() {
+            journal.phase = CommitPhase::BodyCommitted;
+        }
+        if crash == CrashPoint::AfterBodyCommit {
+            self.recover(at);
+            return;
+        }
+
+        if !verified {
+            self.journal = None;
+            self.state.garbage_collect();
+            self.metrics.unsafe_body_serves += 1;
+            self.emit(
+                at,
+                "revalidation",
+                "REVALIDATION_REJECTED_UNVERIFIED",
+                Some(&key),
+                Some(&lease.worker),
+                Some(&lease.request_id),
+                Some(&digest),
+                None,
+            );
+            return;
+        }
+
+        let entry = Entry {
+            fresh_until: at.saturating_add(fresh_for),
+            stale_until: at.saturating_add(stale_for),
+            validator,
+            body_digest: digest.clone(),
+            body_size: size,
+            tags: normalize_tags(&tags),
+            last_access: at,
+        };
+        self.state.attach(key.clone(), entry);
+        if let Some(journal) = self.journal.as_mut() {
+            journal.phase = CommitPhase::MetadataCommitted;
+        }
+        if crash == CrashPoint::AfterMetadataCommit {
+            self.recover(at);
+            return;
+        }
+
+        self.journal = None;
+        self.state.garbage_collect();
+        self.enforce_quota(at);
+        self.metrics.recovery_commits += 1;
+        self.emit(
+            at,
+            "revalidation",
+            "REVALIDATION_COMMITTED_200",
+            Some(&key),
+            Some(&lease.worker),
+            Some(&lease.request_id),
+            Some(&digest),
+            None,
+        );
+    }
+
+    pub fn purge(&mut self, at: u64, tenant: String, seq: u64, tag: String) {
+        let normalized_tag = tag.trim().to_ascii_lowercase();
+        let purge_key = (tenant.clone(), seq, normalized_tag.clone());
+        if !self.seen_purges.insert(purge_key) {
+            self.metrics.purges_ignored += 1;
+            self.emit(
+                at,
+                "purge",
+                "PURGE_DUPLICATE_IGNORED",
+                None,
+                None,
+                None,
+                None,
+                None,
+            );
+            return;
+        }
+
+        let previous = self
+            .tag_versions
+            .get(&(tenant.clone(), normalized_tag.clone()))
+            .copied()
+            .unwrap_or(0);
+        if seq < previous {
+            self.metrics.purges_ignored += 1;
+            self.emit(
+                at,
+                "purge",
+                "PURGE_REORDERED_IGNORED",
+                None,
+                None,
+                None,
+                None,
+                None,
+            );
+            return;
+        }
+        if seq > previous {
+            self.tag_versions
+                .insert((tenant.clone(), normalized_tag.clone()), seq);
+        }
+        let epoch = self.tenant_epochs.entry(tenant.clone()).or_default();
+        *epoch += 1;
+
+        let index_key = (tenant.clone(), normalized_tag.clone());
+        let victims: Vec<CacheKey> = self
+            .state
+            .tag_index
+            .get(&index_key)
+            .map(|keys| keys.iter().cloned().collect())
+            .unwrap_or_default();
+        for key in &victims {
+            let _ = self.state.detach(key);
+        }
+        self.state.garbage_collect();
+        self.metrics.purges_applied += 1;
+        self.emit(at, "purge", "PURGE_APPLIED", None, None, None, None, None);
+    }
+
+    pub fn recover(&mut self, at: u64) {
+        let Some(journal) = self.journal.take() else {
+            self.audit_references(at);
+            return;
+        };
+        match journal.phase {
+            CommitPhase::Prepared | CommitPhase::BodyCommitted => {
+                if self
+                    .state
+                    .blobs
+                    .get(&journal.digest)
+                    .is_some_and(|blob| blob.refs == 0)
+                {
+                    self.state.blobs.remove(&journal.digest);
+                }
+                self.state.rebuild_refs();
+                self.metrics.recovery_rollbacks += 1;
+                self.emit(
+                    at,
+                    "recovery",
+                    "RECOVERY_ROLLBACK_UNCOMMITTED",
+                    Some(&journal.key),
+                    None,
+                    Some(&journal.request_id),
+                    Some(&journal.digest),
+                    None,
+                );
+            }
+            CommitPhase::MetadataCommitted => {
+                self.audit_references(at);
+                self.metrics.recovery_commits += 1;
+                self.emit(
+                    at,
+                    "recovery",
+                    "RECOVERY_RETAIN_COMMITTED",
+                    Some(&journal.key),
+                    None,
+                    Some(&journal.request_id),
+                    Some(&journal.digest),
+                    None,
+                );
+            }
+        }
+        self.state.garbage_collect();
+        self.enforce_quota(at);
+    }
+
+    fn audit_references(&mut self, at: u64) {
+        let invalid: Vec<CacheKey> = self
+            .state
+            .entries
+            .iter()
+            .filter_map(|(key, entry)| (!self.state.body_is_servable(entry)).then_some(key.clone()))
+            .collect();
+        for key in invalid {
+            let _ = self.state.detach(&key);
+            self.metrics.unsafe_body_serves += 1;
+            self.emit(
+                at,
+                "recovery",
+                "RECOVERY_DROP_UNVERIFIED",
+                Some(&key),
+                None,
+                None,
+                None,
+                None,
+            );
+        }
+        self.state.rebuild_refs();
+    }
+
+    fn enforce_quota(&mut self, at: u64) {
+        self.state.garbage_collect();
+        while self.state.committed_usage_bytes() > self.quota_bytes {
+            let Some(victim) = self
+                .state
+                .entries
+                .iter()
+                .min_by_key(|(key, entry)| (entry.last_access, key.id()))
+                .map(|(key, _)| key.clone())
+            else {
+                break;
+            };
+            let body = self
+                .state
+                .entries
+                .get(&victim)
+                .map(|entry| entry.body_digest.clone());
+            let _ = self.state.detach(&victim);
+            self.state.garbage_collect();
+            self.metrics.quota_evictions += 1;
+            self.emit(
+                at,
+                "eviction",
+                "QUOTA_EVICT_LRU",
+                Some(&victim),
+                None,
+                None,
+                body.as_deref(),
+                None,
+            );
+        }
+    }
+
+    pub fn drain_decisions(&mut self) -> Vec<Decision> {
+        std::mem::take(&mut self.decisions)
+    }
+
+    pub fn final_index(&self) -> Vec<FinalEntry> {
+        let mut result: Vec<FinalEntry> = self
+            .state
+            .entries
+            .iter()
+            .map(|(key, entry)| FinalEntry {
+                tenant_id: hash_id(&key.tenant),
+                key_id: key.id(),
+                body_id: hash_id(&entry.body_digest),
+                fresh_until: entry.fresh_until,
+                stale_until: entry.stale_until,
+                body_size: entry.body_size,
+                tags: entry.tags.iter().map(|tag| hash_id(tag)).collect(),
+            })
+            .collect();
+        result.sort_by(|a, b| a.key_id.cmp(&b.key_id));
+        result
+    }
+
+    pub fn committed_usage_bytes(&self) -> u64 {
+        self.state.committed_usage_bytes()
+    }
+
+    pub fn quota_bytes(&self) -> u64 {
+        self.quota_bytes
+    }
+
+    pub fn active_lease_count(&self) -> usize {
+        self.leases.len()
+    }
+
+    pub fn modeled_reference_integrity_holds(&self) -> bool {
+        self.state
+            .entries
+            .values()
+            .all(|entry| self.state.body_is_servable(entry))
+    }
+
+    #[allow(clippy::too_many_arguments)]
+    fn emit(
+        &mut self,
+        at: u64,
+        event: &'static str,
+        reason: &'static str,
+        key: Option<&CacheKey>,
+        actor: Option<&str>,
+        lease: Option<&str>,
+        body: Option<&str>,
+        _tag: Option<&str>,
+    ) {
+        self.decisions.push(Decision {
+            at,
+            event,
+            reason,
+            tenant_id: key.map(|key| hash_id(&key.tenant)),
+            key_id: key.map(CacheKey::id),
+            actor_id: actor.map(hash_id),
+            lease_id: lease.map(hash_id),
+            body_id: body.map(hash_id),
+            committed_usage_bytes: self.state.committed_usage_bytes(),
+        });
+    }
+}
+
+#[derive(Clone, Debug, Eq, PartialEq)]
+pub struct FinalEntry {
+    pub tenant_id: String,
+    pub key_id: String,
+    pub body_id: String,
+    pub fresh_until: u64,
+    pub stale_until: u64,
+    pub body_size: u64,
+    pub tags: Vec<String>,
+}
+
+/// A deliberately small model of the stated baseline. It is only used to
+/// reproduce the four known failure classes; it is not a claim about the
+/// unavailable production gateway.
+#[derive(Clone, Debug, Default)]
+pub struct BaselineReport {
+    pub wrong_variant_served: bool,
+    pub cross_tenant_collision: bool,
+    pub duplicate_revalidations: u64,
+    pub purge_left_entry_servable: bool,
+    pub unverified_body_served_after_crash: bool,
+    pub missing_body_served_after_crash: bool,
+}
+
+#[derive(Clone, Debug)]
+struct BaselineEntry {
+    tenant: String,
+    vary: String,
+    fresh_until: u64,
+    digest: String,
+    size: u64,
+    tags: Vec<String>,
+}
+
+#[derive(Clone, Debug, Eq, Hash, PartialEq)]
+struct BaselineKey {
+    method: String,
+    url: String,
+}
+
+impl BaselineKey {
+    fn new(method: &str, url: &str) -> Self {
+        Self {
+            method: method.trim().to_ascii_uppercase(),
+            url: url.trim().to_string(),
+        }
+    }
+}
+
+/// Replays the baseline's independent failure modes without pretending they
+/// are one coherent implementation.
+pub fn baseline_reproduction() -> BaselineReport {
+    let mut report = BaselineReport::default();
+    let key = BaselineKey::new("GET", "https://cache.test/item");
+    let mut entries = HashMap::new();
+    entries.insert(
+        key.clone(),
+        BaselineEntry {
+            tenant: "tenant-a".to_string(),
+            vary: "en".to_string(),
+            fresh_until: 100,
+            digest: "body-en".to_string(),
+            size: 10,
+            tags: vec!["article".to_string()],
+        },
+    );
+    entries.insert(
+        key.clone(),
+        BaselineEntry {
+            tenant: "tenant-b".to_string(),
+            vary: "fr".to_string(),
+            fresh_until: 100,
+            digest: "body-fr".to_string(),
+            size: 10,
+            tags: vec!["article".to_string()],
+        },
+    );
+    report.cross_tenant_collision = entries
+        .get(&key)
+        .is_some_and(|entry| entry.tenant == "tenant-b");
+    report.wrong_variant_served = entries.get(&key).is_some_and(|entry| entry.vary != "en");
+
+    let mut active_revalidations = 0u64;
+    for _ in 0..2 {
+        if entries
+            .get(&key)
+            .is_some_and(|entry| entry.fresh_until <= 100)
+        {
+            active_revalidations += 1;
+        }
+    }
+    report.duplicate_revalidations = active_revalidations;
+
+    // The baseline only knows exact URLs. A tag purge cannot find this row.
+    report.purge_left_entry_servable = entries.get(&key).is_some_and(|entry| {
+        entry.tags.iter().any(|tag| tag == "article") && entry.fresh_until > 50
+    });
+
+    // Split commit failure A: metadata points at a body before verification.
+    let mut bodies = HashMap::from([(String::from("body-fr"), true)]);
+    let mut metadata = entries.remove(&key).expect("baseline fixture entry");
+    metadata.digest = "body-new".to_string();
+    metadata.size = 11;
+    bodies.insert("body-new".to_string(), false);
+    report.unverified_body_served_after_crash =
+        !bodies.get(&metadata.digest).copied().unwrap_or(false);
+
+    // Split commit failure B: old body is removed before metadata switches.
+    let old_digest = String::from("body-old");
+    let mut old_bodies = HashSet::from([old_digest.clone()]);
+    old_bodies.remove(&old_digest);
+    report.missing_body_served_after_crash = !old_bodies.contains(&old_digest);
+    report
+}
+
+#[derive(Clone, Debug)]
+pub enum Event {
+    Blob(BlobManifest),
+    Entry {
+        at: u64,
+        key: CacheKey,
+        entry: Entry,
+    },
+    Origin {
+        id: String,
+        outcome: OriginOutcome,
+    },
+    Request {
+        id: String,
+        at: u64,
+        worker: String,
+        key: CacheKey,
+        allow_stale_if_error: bool,
+        origin_id: String,
+    },
+    Complete {
+        request_id: String,
+        at: u64,
+        crash: CrashPoint,
+    },
+    Purge {
+        at: u64,
+        tenant: String,
+        seq: u64,
+        tag: String,
+    },
+    Recover {
+        at: u64,
+    },
+}
+
+#[derive(Debug)]
+pub struct ParseError {
+    pub line: usize,
+    pub message: String,
+}
+
+impl fmt::Display for ParseError {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        write!(f, "trace line {}: {}", self.line, self.message)
+    }
+}
+
+impl std::error::Error for ParseError {}
+
+fn token<'a>(
+    tokens: &'a [&str],
+    index: usize,
+    line: usize,
+    name: &str,
+) -> Result<&'a str, ParseError> {
+    tokens.get(index).copied().ok_or_else(|| ParseError {
+        line,
+        message: format!("missing {name}"),
+    })
+}
+
+fn parse_u64(value: &str, line: usize, name: &str) -> Result<u64, ParseError> {
+    value.parse().map_err(|_| ParseError {
+        line,
+        message: format!("invalid {name}"),
+    })
+}
+
+fn parse_bool(value: &str, line: usize, name: &str) -> Result<bool, ParseError> {
+    match value {
+        "allow" | "verified" => Ok(true),
+        "deny" | "unverified" => Ok(false),
+        _ => Err(ParseError {
+            line,
+            message: format!("invalid {name}"),
+        }),
+    }
+}
+
+/// Parse the line-oriented trace format documented in the trial README.
+pub fn parse_trace(input: &str) -> Result<(u64, Vec<Event>), ParseError> {
+    let mut quota_bytes = 64 * 1024 * 1024 * 1024;
+    let mut events = Vec::new();
+    for (line_index, raw_line) in input.lines().enumerate() {
+        let line = line_index + 1;
+        let content = raw_line
+            .split_once('#')
+            .map_or(raw_line, |(head, _)| head)
+            .trim();
+        if content.is_empty() {
+            continue;
+        }
+        let tokens: Vec<&str> = content.split_whitespace().collect();
+        let expected_tokens = match tokens.first().copied() {
+            Some("quota") => Some(2),
+            Some("blob") => Some(4),
+            Some("entry") => Some(12),
+            Some("origin") => match tokens.get(2).copied() {
+                Some("error") => Some(4),
+                Some("not_modified") => Some(6),
+                Some("modified") => Some(10),
+                _ => None,
+            },
+            Some("request") => Some(10),
+            Some("complete") => Some(4),
+            Some("purge") => Some(5),
+            Some("recover") => Some(2),
+            _ => None,
+        };
+        if let Some(expected_tokens) = expected_tokens
+            && tokens.len() != expected_tokens
+        {
+            return Err(ParseError {
+                line,
+                message: format!(
+                    "event has {} fields, expected {expected_tokens}",
+                    tokens.len()
+                ),
+            });
+        }
+        match token(&tokens, 0, line, "event")? {
+            "quota" => {
+                quota_bytes = parse_u64(token(&tokens, 1, line, "quota")?, line, "quota")?;
+            }
+            "blob" => {
+                let digest = token(&tokens, 1, line, "digest")?.to_string();
+                let size = parse_u64(token(&tokens, 2, line, "size")?, line, "size")?;
+                let verified = parse_bool(
+                    token(&tokens, 3, line, "verification")?,
+                    line,
+                    "verification",
+                )?;
+                events.push(Event::Blob(BlobManifest {
+                    digest,
+                    size,
+                    verified,
+                }));
+            }
+            "entry" => {
+                let tenant = token(&tokens, 1, line, "tenant")?;
+                let method = token(&tokens, 2, line, "method")?;
+                let url = token(&tokens, 3, line, "url")?;
+                let vary = token(&tokens, 4, line, "vary")?;
+                let fresh_until =
+                    parse_u64(token(&tokens, 5, line, "fresh_until")?, line, "fresh_until")?;
+                let stale_until =
+                    parse_u64(token(&tokens, 6, line, "stale_until")?, line, "stale_until")?;
+                let digest = token(&tokens, 7, line, "digest")?.to_string();
+                let body_size =
+                    parse_u64(token(&tokens, 8, line, "body_size")?, line, "body_size")?;
+                let last_access =
+                    parse_u64(token(&tokens, 9, line, "last_access")?, line, "last_access")?;
+                let tags = parse_tags(token(&tokens, 10, line, "tags")?)
+                    .map_err(|message| ParseError { line, message })?;
+                let validator = token(&tokens, 11, line, "validator")?.to_string();
+                events.push(Event::Entry {
+                    at: 0,
+                    key: CacheKey::new(tenant, method, url, vary),
+                    entry: Entry {
+                        fresh_until,
+                        stale_until,
+                        validator,
+                        body_digest: digest,
+                        body_size,
+                        tags,
+                        last_access,
+                    },
+                });
+            }
+            "origin" => {
+                let id = token(&tokens, 1, line, "origin id")?.to_string();
+                let status = token(&tokens, 2, line, "origin status")?;
+                let outcome = match status {
+                    "error" => OriginOutcome::Error {
+                        code: token(&tokens, 3, line, "origin error")?.to_string(),
+                    },
+                    "not_modified" => OriginOutcome::NotModified {
+                        fresh_for: parse_u64(
+                            token(&tokens, 3, line, "fresh_for")?,
+                            line,
+                            "fresh_for",
+                        )?,
+                        stale_for: parse_u64(
+                            token(&tokens, 4, line, "stale_for")?,
+                            line,
+                            "stale_for",
+                        )?,
+                        validator: token(&tokens, 5, line, "validator")?.to_string(),
+                    },
+                    "modified" => OriginOutcome::Modified {
+                        digest: token(&tokens, 3, line, "digest")?.to_string(),
+                        size: parse_u64(token(&tokens, 4, line, "size")?, line, "size")?,
+                        fresh_for: parse_u64(
+                            token(&tokens, 5, line, "fresh_for")?,
+                            line,
+                            "fresh_for",
+                        )?,
+                        stale_for: parse_u64(
+                            token(&tokens, 6, line, "stale_for")?,
+                            line,
+                            "stale_for",
+                        )?,
+                        tags: parse_tags(token(&tokens, 7, line, "tags")?)
+                            .map_err(|message| ParseError { line, message })?,
+                        validator: token(&tokens, 8, line, "validator")?.to_string(),
+                        verified: parse_bool(
+                            token(&tokens, 9, line, "verification")?,
+                            line,
+                            "verification",
+                        )?,
+                    },
+                    _ => {
+                        return Err(ParseError {
+                            line,
+                            message: "unknown origin status".to_string(),
+                        });
+                    }
+                };
+                events.push(Event::Origin { id, outcome });
+            }
+            "request" => {
+                let id = token(&tokens, 1, line, "request id")?.to_string();
+                let at = parse_u64(
+                    token(&tokens, 2, line, "request time")?,
+                    line,
+                    "request time",
+                )?;
+                let worker = token(&tokens, 3, line, "worker")?.to_string();
+                let tenant = token(&tokens, 4, line, "tenant")?;
+                let method = token(&tokens, 5, line, "method")?;
+                let url = token(&tokens, 6, line, "url")?;
+                let vary = token(&tokens, 7, line, "vary")?;
+                let allow_stale_if_error = parse_bool(
+                    token(&tokens, 8, line, "stale policy")?,
+                    line,
+                    "stale policy",
+                )?;
+                let origin_id = token(&tokens, 9, line, "origin id")?.to_string();
+                events.push(Event::Request {
+                    id,
+                    at,
+                    worker,
+                    key: CacheKey::new(tenant, method, url, vary),
+                    allow_stale_if_error,
+                    origin_id,
+                });
+            }
+            "complete" => {
+                events.push(Event::Complete {
+                    request_id: token(&tokens, 1, line, "request id")?.to_string(),
+                    at: parse_u64(
+                        token(&tokens, 2, line, "completion time")?,
+                        line,
+                        "completion time",
+                    )?,
+                    crash: CrashPoint::parse(token(&tokens, 3, line, "crash point")?)
+                        .map_err(|message| ParseError { line, message })?,
+                });
+            }
+            "purge" => {
+                events.push(Event::Purge {
+                    at: parse_u64(token(&tokens, 1, line, "purge time")?, line, "purge time")?,
+                    tenant: token(&tokens, 2, line, "tenant")?.to_string(),
+                    seq: parse_u64(token(&tokens, 3, line, "sequence")?, line, "sequence")?,
+                    tag: token(&tokens, 4, line, "tag")?.to_string(),
+                });
+            }
+            "recover" => events.push(Event::Recover {
+                at: parse_u64(
+                    token(&tokens, 1, line, "recovery time")?,
+                    line,
+                    "recovery time",
+                )?,
+            }),
+            _ => {
+                return Err(ParseError {
+                    line,
+                    message: "unknown event".to_string(),
+                });
+            }
+        }
+    }
+    Ok((quota_bytes, events))
+}
+
+/// Apply a parsed trace to the reference model. Decision records remain
+/// buffered until the caller drains them, allowing the CLI to stream output.
+pub fn apply_events(engine: &mut ReferenceEngine, events: &[Event]) -> Result<(), String> {
+    let mut finalized_initial = false;
+    for event in events {
+        if !finalized_initial
+            && matches!(
+                event,
+                Event::Request { .. }
+                    | Event::Complete { .. }
+                    | Event::Purge { .. }
+                    | Event::Recover { .. }
+            )
+        {
+            engine.finalize_initial(0);
+            finalized_initial = true;
+        }
+        match event {
+            Event::Blob(blob) => engine.add_blob(blob.clone()),
+            Event::Entry { at, key, entry } => {
+                engine.add_initial_entry(key.clone(), entry.clone(), *at)
+            }
+            Event::Origin { id, outcome } => engine.add_origin(id.clone(), outcome.clone()),
+            Event::Request {
+                id,
+                at,
+                worker,
+                key,
+                allow_stale_if_error,
+                origin_id,
+            } => engine.request(
+                id.clone(),
+                *at,
+                worker.clone(),
+                key.clone(),
+                *allow_stale_if_error,
+                origin_id.clone(),
+            ),
+            Event::Complete {
+                request_id,
+                at,
+                crash,
+            } => engine.complete(request_id, *at, *crash)?,
+            Event::Purge {
+                at,
+                tenant,
+                seq,
+                tag,
+            } => engine.purge(*at, tenant.clone(), *seq, tag.clone()),
+            Event::Recover { at } => engine.recover(*at),
+        }
+    }
+    if !finalized_initial {
+        engine.finalize_initial(0);
+    }
+    Ok(())
+}
+
+/// Run a line-oriented trace file, returning the model and the original
+/// parsed events for reporting.
+pub fn run_trace_file(path: &Path) -> Result<(ReferenceEngine, Vec<Event>), String> {
+    let input = fs::read_to_string(path).map_err(|_| "could not read trace file".to_string())?;
+    let (quota, events) = parse_trace(&input).map_err(|error| error.to_string())?;
+    let mut engine = ReferenceEngine::new(quota);
+    apply_events(&mut engine, &events)?;
+    Ok((engine, events))
+}
+
+/// A compact allocation-limited shape harness. It does not replace semantic
+/// tests; it exercises the stated object/request/purge counts without storing
+/// URLs, bodies, or a million output records in memory.
+#[derive(Clone, Copy)]
+struct CompactEntry {
+    body_size: u32,
+    fresh_until: u64,
+    stale_until: u64,
+    last_access: u32,
+    tag_mask: u16,
+    alive: bool,
+}
+
+#[derive(Clone, Debug, Eq, PartialEq)]
+pub struct WorkloadReport {
+    pub objects: usize,
+    pub requests: usize,
+    pub purges: usize,
+    pub request_hits: u64,
+    pub request_misses: u64,
+    pub committed_usage_bytes: u64,
+    pub quota_bytes: u64,
+}
+
+pub fn run_shape_workload(objects: usize, requests: usize, purges: usize) -> WorkloadReport {
+    let quota_bytes = 64 * 1024 * 1024 * 1024;
+    let mut entries = Vec::with_capacity(objects);
+    for index in 0..objects {
+        entries.push(CompactEntry {
+            body_size: 4 * 1024,
+            fresh_until: 100,
+            stale_until: 200,
+            last_access: 0,
+            tag_mask: 1u16 << (index % 16),
+            alive: true,
+        });
+    }
+
+    let mut purged_tags = 0u16;
+    for index in 0..purges {
+        purged_tags |= 1u16 << (index % 16);
+    }
+
+    let mut request_hits = 0u64;
+    let mut request_misses = 0u64;
+    if objects != 0 {
+        for request in 0..requests {
+            let index = request.wrapping_mul(1_103_515_245).wrapping_add(12_345) % objects;
+            let entry = &mut entries[index];
+            if entry.alive
+                && (entry.tag_mask & purged_tags) == 0
+                && request as u64 % 257 < entry.fresh_until
+            {
+                entry.last_access = request as u32;
+                request_hits += 1;
+            } else {
+                request_misses += 1;
+                if request as u64 >= entry.stale_until {
+                    entry.fresh_until = request as u64 + 100;
+                    entry.stale_until = request as u64 + 200;
+                }
+            }
+        }
+    }
+
+    let live_objects = entries.iter().filter(|entry| entry.alive).count() as u64;
+    let body_bytes = entries
+        .iter()
+        .filter(|entry| entry.alive)
+        .map(|entry| u64::from(entry.body_size))
+        .sum::<u64>();
+    let metadata_bytes = live_objects * 224;
+    WorkloadReport {
+        objects,
+        requests,
+        purges,
+        request_hits,
+        request_misses,
+        committed_usage_bytes: body_bytes + metadata_bytes,
+        quota_bytes,
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn key(tenant: &str, vary: &str) -> CacheKey {
+        CacheKey::new(tenant, "get", "https://cache.test/item#ignored", vary)
+    }
+
+    fn seed_engine(quota: u64) -> ReferenceEngine {
+        let mut engine = ReferenceEngine::new(quota);
+        engine.add_blob(BlobManifest {
+            digest: "body-a".to_string(),
+            size: 10,
+            verified: true,
+        });
+        engine.add_initial_entry(
+            key("tenant-a", "en"),
+            Entry {
+                fresh_until: 10,
+                stale_until: 30,
+                validator: "etag-a".to_string(),
+                body_digest: "body-a".to_string(),
+                body_size: 10,
+                tags: vec!["article".to_string()],
+                last_access: 0,
+            },
+            0,
+        );
+        engine
+    }
+
+    #[test]
+    fn sha256_identifier_is_stable() {
+        assert_eq!(
+            hash_id("abc"),
+            "ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad"
+        );
+    }
+
+    #[test]
+    fn key_normalization_includes_tenant_and_vary() {
+        let a = CacheKey::new("tenant-a", "get", " https://x.test/a#fragment", "EN");
+        let b = CacheKey::new("tenant-a", "GET", "https://x.test/a", "en");
+        let c = CacheKey::new("tenant-b", "GET", "https://x.test/a", "en");
+        assert_eq!(a, b);
+        assert_ne!(a, c);
+        assert_ne!(
+            a.id(),
+            CacheKey::new("tenant-a", "GET", "https://x.test/a", "fr").id()
+        );
+    }
+
+    #[test]
+    fn concurrent_expiry_has_one_active_lease() {
+        let mut engine = seed_engine(1_000_000);
+        engine.add_origin(
+            "slow".to_string(),
+            OriginOutcome::NotModified {
+                fresh_for: 100,
+                stale_for: 200,
+                validator: "etag-b".to_string(),
+            },
+        );
+        let cache_key = key("tenant-a", "en");
+        engine.request(
+            "r1".to_string(),
+            10,
+            "worker-1".to_string(),
+            cache_key.clone(),
+            true,
+            "slow".to_string(),
+        );
+        for worker in 2..=32 {
+            engine.request(
+                format!("r{worker}"),
+                10,
+                format!("worker-{worker}"),
+                cache_key.clone(),
+                true,
+                "slow".to_string(),
+            );
+        }
+        assert_eq!(engine.active_lease_count(), 1);
+        assert_eq!(engine.metrics.revalidation_starts, 1);
+        assert_eq!(engine.metrics.revalidation_waits, 31);
+    }
+
+    #[test]
+    fn purge_is_tagged_sequence_aware_and_reordered_events_converge() {
+        let mut engine = seed_engine(1_000_000);
+        let cache_key = key("tenant-a", "en");
+        engine.purge(10, "tenant-a".to_string(), 2, "article".to_string());
+        engine.add_blob(BlobManifest {
+            digest: "body-a".to_string(),
+            size: 10,
+            verified: true,
+        });
+        engine.add_initial_entry(
+            cache_key.clone(),
+            Entry {
+                fresh_until: 100,
+                stale_until: 200,
+                validator: "etag-new".to_string(),
+                body_digest: "body-a".to_string(),
+                body_size: 10,
+                tags: vec!["article".to_string()],
+                last_access: 10,
+            },
+            10,
+        );
+        engine.purge(11, "tenant-a".to_string(), 1, "article".to_string());
+        engine.purge(12, "tenant-a".to_string(), 2, "article".to_string());
+        assert_eq!(engine.final_index().len(), 1);
+        assert_eq!(engine.metrics.purges_ignored, 2);
+        assert_eq!(engine.metrics.purges_applied, 1);
+        assert!(
+            engine
+                .final_index()
+                .iter()
+                .any(|entry| entry.key_id == cache_key.id())
+        );
+    }
+
+    #[test]
+    fn purge_rejects_an_old_revalidation_result() {
+        let mut engine = seed_engine(1_000_000);
+        engine.add_origin(
+            "modified".to_string(),
+            OriginOutcome::Modified {
+                digest: "body-b".to_string(),
+                size: 11,
+                fresh_for: 100,
+                stale_for: 200,
+                tags: vec!["article".to_string()],
+                validator: "etag-b".to_string(),
+                verified: true,
+            },
+        );
+        let cache_key = key("tenant-a", "en");
+        engine.request(
+            "r".to_string(),
+            10,
+            "worker".to_string(),
+            cache_key.clone(),
+            true,
+            "modified".to_string(),
+        );
+        engine.purge(11, "tenant-a".to_string(), 1, "article".to_string());
+        engine.complete("r", 12, CrashPoint::None).unwrap();
+        assert!(engine.final_index().is_empty());
+        assert!(
+            engine
+                .drain_decisions()
+                .iter()
+                .any(|decision| decision.reason == "REVALIDATION_REJECTED_PURGE")
+        );
+    }
+
+    #[test]
+    fn stale_if_error_is_only_served_inside_window_and_policy() {
+        let mut engine = seed_engine(1_000_000);
+        engine.add_origin(
+            "error".to_string(),
+            OriginOutcome::Error {
+                code: "origin-down".to_string(),
+            },
+        );
+        let cache_key = key("tenant-a", "en");
+        engine.request(
+            "r1".to_string(),
+            20,
+            "worker".to_string(),
+            cache_key.clone(),
+            true,
+            "error".to_string(),
+        );
+        engine.complete("r1", 21, CrashPoint::None).unwrap();
+        engine.request(
+            "r2".to_string(),
+            31,
+            "worker".to_string(),
+            cache_key,
+            true,
+            "error".to_string(),
+        );
+        engine.complete("r2", 32, CrashPoint::None).unwrap();
+        assert_eq!(engine.metrics.stale_responses, 1);
+        assert_eq!(engine.metrics.misses, 1);
+    }
+
+    #[test]
+    fn every_crash_point_recovers_without_an_unverified_body() {
+        for crash in [
+            CrashPoint::AfterPrepare,
+            CrashPoint::AfterBodyCommit,
+            CrashPoint::AfterMetadataCommit,
+        ] {
+            let mut engine = seed_engine(1_000_000);
+            engine.add_origin(
+                "modified".to_string(),
+                OriginOutcome::Modified {
+                    digest: format!("body-{crash:?}"),
+                    size: 11,
+                    fresh_for: 100,
+                    stale_for: 200,
+                    tags: vec!["article".to_string()],
+                    validator: "etag-new".to_string(),
+                    verified: true,
+                },
+            );
+            let cache_key = key("tenant-a", "en");
+            engine.request(
+                "r".to_string(),
+                10,
+                "worker".to_string(),
+                cache_key.clone(),
+                true,
+                "modified".to_string(),
+            );
+            engine.complete("r", 11, crash).unwrap();
+            assert!(
+                engine.modeled_reference_integrity_holds(),
+                "crash point {crash:?}"
+            );
+            assert_eq!(engine.final_index().len(), 1);
+        }
+    }
+
+    #[test]
+    fn quota_eviction_keeps_usage_bounded() {
+        let mut engine = seed_engine(300);
+        engine.add_origin(
+            "modified".to_string(),
+            OriginOutcome::Modified {
+                digest: "body-b".to_string(),
+                size: 200,
+                fresh_for: 100,
+                stale_for: 200,
+                tags: Vec::new(),
+                validator: "etag-b".to_string(),
+                verified: true,
+            },
+        );
+        let cache_key = key("tenant-a", "en");
+        engine.request(
+            "r".to_string(),
+            10,
+            "worker".to_string(),
+            cache_key,
+            true,
+            "modified".to_string(),
+        );
+        engine.complete("r", 11, CrashPoint::None).unwrap();
+        assert!(engine.committed_usage_bytes() <= engine.quota_bytes());
+        assert!(engine.metrics.quota_evictions > 0);
+    }
+
+    #[test]
+    fn baseline_reproduction_exposes_expected_failures() {
+        let report = baseline_reproduction();
+        assert!(report.wrong_variant_served);
+        assert!(report.cross_tenant_collision);
+        assert_eq!(report.duplicate_revalidations, 2);
+        assert!(report.purge_left_entry_servable);
+        assert!(report.unverified_body_served_after_crash);
+        assert!(report.missing_body_served_after_crash);
+    }
+
+    #[test]
+    fn trace_parser_rejects_trailing_fields_and_excess_tags() {
+        assert!(parse_trace("quota 100 extra\n").is_err());
+        let tags = (0..17)
+            .map(|index| format!("tag{index}"))
+            .collect::<Vec<_>>()
+            .join(",");
+        let trace = format!(
+            "blob body 10 verified\nentry tenant-a GET https://x.test/a en 10 20 body 10 0 {tags} etag\n"
+        );
+        assert!(parse_trace(&trace).is_err());
+    }
+
+    #[test]
+    fn trace_parser_accepts_the_small_format() {
+        let input = "\
+quota 1000000\n\
+blob body-a 10 verified\n\
+entry tenant-a GET https://cache.test/item en 10 30 body-a 10 0 article etag-a\n\
+origin ok not_modified 100 200 etag-b\n\
+request r1 10 worker-1 tenant-a GET https://cache.test/item EN allow ok\n\
+complete r1 11 none\n";
+        let (quota, events) = parse_trace(input).unwrap();
+        assert_eq!(quota, 1_000_000);
+        assert_eq!(events.len(), 5);
+    }
+
+    #[test]
+    fn shape_workload_reports_logical_usage() {
+        let report = run_shape_workload(1_000, 10_000, 100);
+        assert_eq!(report.objects, 1_000);
+        assert_eq!(report.requests, 10_000);
+        assert!(report.committed_usage_bytes < report.quota_bytes);
+    }
+}
diff --git a/developer-simulation/runs/2026-08-06--http-cache-revalidation/src/main.rs b/developer-simulation/runs/2026-08-06--http-cache-revalidation/src/main.rs
new file mode 100644
index 0000000..d82dabb
--- /dev/null
+++ b/developer-simulation/runs/2026-08-06--http-cache-revalidation/src/main.rs
@@ -0,0 +1,318 @@
+use std::env;
+use std::fs;
+use std::path::Path;
+use std::process::ExitCode;
+
+use http_cache_revalidation::{
+    Event, ReferenceEngine, WorkloadReport, baseline_reproduction, parse_trace, run_shape_workload,
+};
+
+const MEMORY_LIMIT_BYTES: u64 = 256 * 1024 * 1024;
+
+#[cfg(target_os = "macos")]
+#[repr(C)]
+#[derive(Default)]
+struct TimeVal {
+    seconds: i64,
+    microseconds: i32,
+    padding: i32,
+}
+
+#[cfg(target_os = "macos")]
+#[repr(C)]
+#[derive(Default)]
+struct Usage {
+    user_time: TimeVal,
+    system_time: TimeVal,
+    max_rss: i64,
+    integral_shared_memory: i64,
+    integral_unshared_data: i64,
+    integral_unshared_stack: i64,
+    page_reclaims: i64,
+    page_faults: i64,
+    swaps: i64,
+    block_input: i64,
+    block_output: i64,
+    messages_sent: i64,
+    messages_received: i64,
+    signals_received: i64,
+    voluntary_context_switches: i64,
+    involuntary_context_switches: i64,
+}
+
+#[cfg(target_os = "macos")]
+unsafe extern "C" {
+    fn getrusage(who: i32, usage: *mut Usage) -> i32;
+}
+
+#[cfg(target_os = "macos")]
+fn max_rss_bytes() -> Option<u64> {
+    let mut usage = Usage::default();
+    let result = unsafe { getrusage(0, &mut usage) };
+    (result == 0).then_some(usage.max_rss as u64)
+}
+
+#[cfg(not(target_os = "macos"))]
+fn max_rss_bytes() -> Option<u64> {
+    None
+}
+
+fn main() -> ExitCode {
+    let mut args = env::args().skip(1);
+    match args.next().as_deref() {
+        Some("demo") | None => match run_demo() {
+            Ok(()) => ExitCode::SUCCESS,
+            Err(message) => {
+                eprintln!("error: {message}");
+                ExitCode::from(1)
+            }
+        },
+        Some("run") => match args.next() {
+            Some(path) => match run_file(Path::new(&path)) {
+                Ok(()) => ExitCode::SUCCESS,
+                Err(message) => {
+                    eprintln!("error: {message}");
+                    ExitCode::from(1)
+                }
+            },
+            None => {
+                eprintln!("error: run requires a trace path");
+                ExitCode::from(2)
+            }
+        },
+        Some("workload") => match parse_workload_args(args.collect()) {
+            Ok((objects, requests, purges)) => {
+                let report = run_shape_workload(objects, requests, purges);
+                print_workload(&report, max_rss_bytes());
+                ExitCode::SUCCESS
+            }
+            Err(message) => {
+                eprintln!("error: {message}");
+                ExitCode::from(2)
+            }
+        },
+        Some("help") | Some("--help") | Some("-h") => {
+            print_help();
+            ExitCode::SUCCESS
+        }
+        Some(_) => {
+            eprintln!("error: unknown command; use help");
+            ExitCode::from(2)
+        }
+    }
+}
+
+fn print_help() {
+    println!("http-cache-revalidation demo");
+    println!("  demo                         run the baseline comparison and reference trace");
+    println!("  run <trace>                  run a line-oriented reference trace");
+    println!("  workload [objects requests purges]  run the compact shape workload");
+}
+
+fn run_demo() -> Result<(), String> {
+    let baseline = baseline_reproduction();
+    println!(
+        "mode=baseline wrong_variant={} cross_tenant_collision={} duplicate_revalidations={} purge_left_servable={} unverified_body_after_crash={} missing_body_after_crash={}",
+        baseline.wrong_variant_served,
+        baseline.cross_tenant_collision,
+        baseline.duplicate_revalidations,
+        baseline.purge_left_entry_servable,
+        baseline.unverified_body_served_after_crash,
+        baseline.missing_body_served_after_crash
+    );
+    let (quota, events) = parse_trace(demo_trace()).map_err(|error| error.to_string())?;
+    let mut engine = ReferenceEngine::new(quota);
+    run_events(&mut engine, &events)?;
+    print_summary(&engine);
+    if engine.active_lease_count() != 0 {
+        return Err("demo ended with an active lease".to_string());
+    }
+    if engine.committed_usage_bytes() > engine.quota_bytes() {
+        return Err("demo exceeded quota".to_string());
+    }
+    if !engine.modeled_reference_integrity_holds() {
+        return Err("demo recovery invariant failed".to_string());
+    }
+    println!("demo=PASS modeled_invariants=true");
+    Ok(())
+}
+
+fn run_file(path: &Path) -> Result<(), String> {
+    let input = fs::read_to_string(path).map_err(|_| "could not read trace file".to_string())?;
+    let (quota, events) = parse_trace(&input).map_err(|error| error.to_string())?;
+    let mut engine = ReferenceEngine::new(quota);
+    run_events(&mut engine, &events)?;
+    print_summary(&engine);
+    Ok(())
+}
+
+fn run_events(engine: &mut ReferenceEngine, events: &[Event]) -> Result<(), String> {
+    let mut finalized_initial = false;
+    for event in events {
+        if !finalized_initial
+            && matches!(
+                event,
+                Event::Request { .. }
+                    | Event::Complete { .. }
+                    | Event::Purge { .. }
+                    | Event::Recover { .. }
+            )
+        {
+            engine.finalize_initial(0);
+            finalized_initial = true;
+            for decision in engine.drain_decisions() {
+                println!("{}", decision.line());
+            }
+        }
+        apply_one(engine, event)?;
+        for decision in engine.drain_decisions() {
+            println!("{}", decision.line());
+        }
+    }
+    if !finalized_initial {
+        engine.finalize_initial(0);
+        for decision in engine.drain_decisions() {
+            println!("{}", decision.line());
+        }
+    }
+    Ok(())
+}
+
+fn apply_one(engine: &mut ReferenceEngine, event: &Event) -> Result<(), String> {
+    match event {
+        Event::Blob(blob) => engine.add_blob(blob.clone()),
+        Event::Entry { at, key, entry } => {
+            engine.add_initial_entry(key.clone(), entry.clone(), *at)
+        }
+        Event::Origin { id, outcome } => engine.add_origin(id.clone(), outcome.clone()),
+        Event::Request {
+            id,
+            at,
+            worker,
+            key,
+            allow_stale_if_error,
+            origin_id,
+        } => engine.request(
+            id.clone(),
+            *at,
+            worker.clone(),
+            key.clone(),
+            *allow_stale_if_error,
+            origin_id.clone(),
+        ),
+        Event::Complete {
+            request_id,
+            at,
+            crash,
+        } => engine.complete(request_id, *at, *crash)?,
+        Event::Purge {
+            at,
+            tenant,
+            seq,
+            tag,
+        } => engine.purge(*at, tenant.clone(), *seq, tag.clone()),
+        Event::Recover { at } => engine.recover(*at),
+    }
+    Ok(())
+}
+
+fn print_summary(engine: &ReferenceEngine) {
+    let metrics = &engine.metrics;
+    println!(
+        "summary requests={} fresh_hits={} stale_responses={} misses={} revalidation_starts={} revalidation_waits={} purges_applied={} purges_ignored={} recovery_rollbacks={} recovery_commits={} quota_evictions={} unsafe_body_serves={} committed_usage_bytes={} quota_bytes={}",
+        metrics.requests,
+        metrics.fresh_hits,
+        metrics.stale_responses,
+        metrics.misses,
+        metrics.revalidation_starts,
+        metrics.revalidation_waits,
+        metrics.purges_applied,
+        metrics.purges_ignored,
+        metrics.recovery_rollbacks,
+        metrics.recovery_commits,
+        metrics.quota_evictions,
+        metrics.unsafe_body_serves,
+        engine.committed_usage_bytes(),
+        engine.quota_bytes()
+    );
+    for entry in engine.final_index() {
+        println!(
+            "event=final_entry tenant_id={} key_id={} body_id={} fresh_until={} stale_until={} body_size={} tag_count={}",
+            entry.tenant_id,
+            entry.key_id,
+            entry.body_id,
+            entry.fresh_until,
+            entry.stale_until,
+            entry.body_size,
+            entry.tags.len()
+        );
+    }
+}
+
+fn parse_workload_args(args: Vec<String>) -> Result<(usize, usize, usize), String> {
+    if args.len() > 3 {
+        return Err("workload accepts at most three numbers".to_string());
+    }
+    let defaults = [2_000_000usize, 1_000_000usize, 100_000usize];
+    let mut values = defaults;
+    for (index, value) in args.iter().enumerate() {
+        values[index] = value
+            .parse()
+            .map_err(|_| "invalid workload number".to_string())?;
+    }
+    Ok((values[0], values[1], values[2]))
+}
+
+fn print_workload(report: &WorkloadReport, max_rss: Option<u64>) {
+    let max_rss_text = max_rss.map_or_else(|| "-".to_string(), |bytes| bytes.to_string());
+    let within_memory = max_rss.is_some_and(|bytes| bytes <= MEMORY_LIMIT_BYTES);
+    println!(
+        "workload objects={} requests={} purges={} request_hits={} request_misses={} committed_usage_bytes={} quota_bytes={} within_quota={} max_rss_bytes={} memory_limit_bytes={} within_memory={}",
+        report.objects,
+        report.requests,
+        report.purges,
+        report.request_hits,
+        report.request_misses,
+        report.committed_usage_bytes,
+        report.quota_bytes,
+        report.committed_usage_bytes <= report.quota_bytes,
+        max_rss_text,
+        MEMORY_LIMIT_BYTES,
+        within_memory
+    );
+}
+
+fn demo_trace() -> &'static str {
+    r#"
+# The fixture contains labels and URLs, but the CLI output emits only hashes.
+quota 1000000
+blob body-a 10 verified
+blob body-d 10 verified
+blob body-e 10 verified
+entry tenant-a GET https://cache.test/item en 10 30 body-a 10 0 article etag-a
+entry tenant-b GET https://cache.test/profile en 5 15 body-d 10 0 profile etag-d
+entry tenant-c GET https://cache.test/crash en 1 100 body-e 10 0 crash etag-e
+origin replace modified body-b 11 100 200 article etag-b verified
+origin replace-new modified body-c 11 100 200 article etag-c verified
+origin origin-error error origin_down
+origin crash modified body-f 11 100 200 crash etag-f verified
+origin bad modified body-g 11 100 200 crash etag-g unverified
+request r1 10 worker-1 tenant-a GET https://cache.test/item EN allow replace
+request r2 10 worker-2 tenant-a GET https://cache.test/item en allow replace
+purge 11 tenant-a 2 article
+complete r1 12 none
+purge 13 tenant-a 1 article
+purge 14 tenant-a 2 article
+request r3 15 worker-3 tenant-a GET https://cache.test/item en allow replace-new
+complete r3 16 none
+request r4 20 worker-4 tenant-a GET https://cache.test/item en allow replace-new
+request r5 10 worker-5 tenant-b GET https://cache.test/profile en allow origin-error
+complete r5 11 none
+request r6 16 worker-6 tenant-b GET https://cache.test/profile en allow origin-error
+complete r6 17 none
+request r7 2 worker-7 tenant-c GET https://cache.test/crash en allow crash
+complete r7 3 after_metadata
+request r8 4 worker-8 tenant-d GET https://cache.test/unverified en allow bad
+complete r8 5 after_body
+"#
+}
diff --git a/developer-simulation/runs/2026-08-07--localization-catalog-compiler/Cargo.toml b/developer-simulation/runs/2026-08-07--localization-catalog-compiler/Cargo.toml
new file mode 100644
index 0000000..1d86174
--- /dev/null
+++ b/developer-simulation/runs/2026-08-07--localization-catalog-compiler/Cargo.toml
@@ -0,0 +1,15 @@
+[package]
+name = "catalog-compiler-prototype"
+version = "0.1.0"
+edition = "2024"
+publish = false
+
+[lib]
+name = "catalog_compiler"
+path = "src/lib.rs"
+
+[[bin]]
+name = "catalogc"
+path = "src/main.rs"
+
+[dependencies]
diff --git a/developer-simulation/runs/2026-08-07--localization-catalog-compiler/README.md b/developer-simulation/runs/2026-08-07--localization-catalog-compiler/README.md
new file mode 100644
index 0000000..32c35b7
--- /dev/null
+++ b/developer-simulation/runs/2026-08-07--localization-catalog-compiler/README.md
@@ -0,0 +1,24 @@
+# Localization catalog compiler
+
+This is a dependency-free prototype for validating structured localization
+catalogs and emitting deterministic runtime tables. It is a partial fit for
+the narrow validation boundary only; it is not a production ICU/CLDR compiler
+and it does not use a BogKit component.
+
+Run these commands from `developer-simulation/`:
+
+```console
+cargo test --offline --locked --manifest-path Cargo.toml -p catalog-compiler-prototype
+cargo fmt --manifest-path Cargo.toml -p catalog-compiler-prototype -- --check
+cargo clippy --offline --locked --manifest-path Cargo.toml -p catalog-compiler-prototype --all-targets -- -D warnings
+cargo build --offline --locked --release --manifest-path Cargo.toml -p catalog-compiler-prototype
+mkdir -p scratch/catalog-stress
+cargo run --offline --locked --release --manifest-path Cargo.toml -p catalog-compiler-prototype -- compile runs/2026-08-07--localization-catalog-compiler/fixtures/valid scratch/catalog-runtime.table
+cargo run --offline --locked --release --manifest-path Cargo.toml -p catalog-compiler-prototype -- lookup runs/2026-08-07--localization-catalog-compiler/fixtures/valid de nested
+cargo run --offline --locked --release --manifest-path Cargo.toml -p catalog-compiler-prototype -- lookup-table scratch/catalog-runtime.table de nested
+cargo run --offline --locked --release --manifest-path Cargo.toml -p catalog-compiler-prototype -- generate-stress scratch/catalog-stress 100000 18
+```
+
+The exact trial evidence, limitations, reviewer correction, and decision audit
+are in [`evidence/REPORT.md`](evidence/REPORT.md). Generated stress fixtures
+and output tables are intentionally not archived.
diff --git a/developer-simulation/runs/2026-08-07--localization-catalog-compiler/evidence/REPORT.md b/developer-simulation/runs/2026-08-07--localization-catalog-compiler/evidence/REPORT.md
new file mode 100644
index 0000000..2ca37d1
--- /dev/null
+++ b/developer-simulation/runs/2026-08-07--localization-catalog-compiler/evidence/REPORT.md
@@ -0,0 +1,191 @@
+# Localization catalog compiler simulation report
+
+Date: 2026-08-07
+
+Scope: this isolated checkout only. No prior simulation archive, report,
+coverage ledger, other trial, GitHub state, or automation state was inspected
+or changed.
+
+## Ordered discovery and friction trail
+
+1. The public root README describes one Cargo workspace and points new
+   projects at Fold, ANNy, and ESE. Its examples are database demonstrations,
+   not localization tooling.
+2. The public examples were inspected in order: starter (persistent count and
+   bag), timeseries (incremental aggregates), chat (transactional snapshots),
+   and search (BM25/HNSW/embedding search). None contains a catalog format,
+   validator, fallback compiler, or runtime-table generator.
+3. A public-source symbol search found Fold stream/pipeline sinks, ESE
+   embedding APIs, and ANNy search APIs, but no catalog/compiler component.
+4. The stated baseline was evaluated before selecting a component. The
+   workspace-wide test command failed offline because ESE tried to download
+   model.safetensors and DNS was unavailable. This is a baseline build
+   friction, not a prototype failure.
+5. The dependency-local baseline test, cargo test -p fold --quiet, passed
+   18 unit tests and 9 doctests. The existing workspace formatting check also
+   reports pre-existing formatting differences in examples/search.
+6. Decision: use no BogKit component. Fold's durable incremental views do not
+   address batch catalog parsing and whole-input diagnostics; ESE and ANNy are
+   unrelated to catalog correctness and add offline/build surface.
+
+## Prototype boundary
+
+The standard-library-only crate in this directory implements:
+
+- line-oriented representative catalogs with text, plural, select, and nested
+  locale/message references;
+- all-diagnostic validation for duplicate IDs, fallback references and cycles,
+  branch shape, and placeholder sets against en-US;
+- sorted locale/message/branch emission into a normalized runtime-table file;
+- a lookup harness for source catalogs and emitted tables;
+- a deterministic stress-fixture generator.
+
+This is not a production ICU/CLDR implementation. It intentionally does not
+claim complete plural rules, rich ICU syntax, translation quality, or a
+production catalog-format migration.
+
+## Reproduction commands and observed results
+
+Run from the checkout root:
+
+~~~text
+cargo test --offline -p catalog-compiler-prototype --quiet
+~~~
+
+Result: 4 library tests passed; binary tests had 0 tests. The same tests pass
+without --offline.
+
+~~~text
+cargo fmt -p catalog-compiler-prototype -- --check
+cargo clippy -p catalog-compiler-prototype --all-targets -- -D warnings
+cargo build --release -p catalog-compiler-prototype
+~~~
+
+Result: all passed.
+
+~~~text
+target/release/catalogc compile runs/2026-08-07--localization-catalog-compiler/fixtures/valid runs/2026-08-07--localization-catalog-compiler/evidence-valid.table
+target/release/catalogc lookup runs/2026-08-07--localization-catalog-compiler/fixtures/valid de nested
+target/release/catalogc lookup-table runs/2026-08-07--localization-catalog-compiler/evidence-valid.table de nested
+~~~
+
+Results:
+
+~~~text
+compiled runs/2026-08-07--localization-catalog-compiler/fixtures/valid into runs/2026-08-07--localization-catalog-compiler/evidence-valid.table
+Shared message for Ada
+Shared message for Ada
+~~~
+
+The two lookup results are the same, including the nested fallback reference.
+
+~~~text
+target/release/catalogc compile runs/2026-08-07--localization-catalog-compiler/fixtures/invalid runs/2026-08-07--localization-catalog-compiler/evidence/invalid.table
+~~~
+
+Expected exit status: 1. It reports 6 diagnostics rather than stopping at the
+first:
+
+~~~text
+error catalog=en-US message=duplicate branch=- source=runs/2026-08-07--localization-catalog-compiler/fixtures/invalid/en-US.cat:17: duplicate message identifier
+error catalog=fr message=- branch=- source=runs/2026-08-07--localization-catalog-compiler/fixtures/invalid/fr.cat:2: fallback locale missing-locale does not exist
+error catalog=fr message=bad-ref branch=- source=runs/2026-08-07--localization-catalog-compiler/fixtures/invalid/fr.cat:14: fallback reference targets missing locale missing-locale
+error catalog=fr message=apples branch=count=other source=runs/2026-08-07--localization-catalog-compiler/fixtures/invalid/fr.cat:5: missing branch
+error catalog=fr message=bad-ref branch=- source=runs/2026-08-07--localization-catalog-compiler/fixtures/invalid/fr.cat:13: message identifier is not present in en-US
+error catalog=fr message=greeting branch=- source=runs/2026-08-07--localization-catalog-compiler/fixtures/invalid/fr.cat:11: placeholder mismatch: expected {"name"}, found {"username"}
+6 diagnostic(s)
+~~~
+
+Stress fixture and repeated release runs:
+
+~~~text
+target/release/catalogc generate-stress runs/2026-08-07--localization-catalog-compiler/evidence/stress 100000 18
+CATALOG_MEMORY_REPORT=1 /usr/bin/time -p target/release/catalogc compile runs/2026-08-07--localization-catalog-compiler/evidence/stress runs/2026-08-07--localization-catalog-compiler/evidence/stress-a.table
+CATALOG_MEMORY_REPORT=1 /usr/bin/time -p target/release/catalogc compile runs/2026-08-07--localization-catalog-compiler/evidence/stress runs/2026-08-07--localization-catalog-compiler/evidence/stress-b.table
+cmp -s runs/2026-08-07--localization-catalog-compiler/evidence/stress-a.table runs/2026-08-07--localization-catalog-compiler/evidence/stress-b.table
+shasum -a 256 runs/2026-08-07--localization-catalog-compiler/evidence/stress-a.table runs/2026-08-07--localization-catalog-compiler/evidence/stress-b.table
+~~~
+
+Results: exactly 100,000 records across 18 locales; each compile took 0.05
+seconds real time in release mode. Both runs reported
+27,010,299 peak live allocated bytes (about 25.8 MiB). Both output hashes were
+f4d5206bc4dd975da35221f78153ab4897ba9bdf0f3c65620e4bbdee36d5e31a.
+The output is 4,386,105 bytes and 200,037 lines. The allocator figure is
+live heap allocation, not full process RSS; OS RSS sampling was unavailable in
+this restricted environment because ps and time -l were denied.
+
+## Categorized findings
+
+| Category | Severity | Confidence | Reproduction | Smallest improvement |
+| --- | --- | --- | --- | --- |
+| Offline baseline build | High | High | cargo test --workspace --quiet attempts the ESE model download and fails DNS | Vendor/cache the model or make ESE fixtures fully offline |
+| BogKit component fit | Medium | High | README/examples/source inspection shows no catalog API | Add a purpose-built catalog compiler crate rather than adapting Fold/ESE/ANNy |
+| Seeded defect coverage | High | High | Invalid fixture reports missing branch, placeholder mismatch, invalid fallback locale/reference, and duplicate ID | Add production-format parsing and equivalent fixture coverage |
+| Complete diagnostics | High | High | Invalid run reports 6 diagnostics with locale, message, branch, file, and line | Preserve source spans through the production parser |
+| Valid lookup preservation | High | High for this fixture | Source lookup and emitted-table lookup both return Shared message for Ada | Differential-test against the real runtime library on production catalogs |
+| Reproducibility | High | High for repeated runs; medium cross-machine | Two release outputs have the same SHA-256; BTreeMap ordering is explicit | Run the same corpus on at least two clean machines/toolchains |
+| Resource budget | High | Medium | Release run reports 27,010,299 peak live bytes and 0.05 seconds; RSS unavailable | Add CI RSS measurement and streaming/arena parsing if production data exceeds this shape |
+| Production semantics | High | Low-to-medium | Prototype supports only its documented small grammar | Confirm ICU/CLDR plural rules, escaping, rich placeholders, and reference semantics before adoption |
+| Fallback traversal | High | High for the prototype grammar | Skeptical review found a comma-separated fallback list stopped after the first locale | Try every fallback locale before returning not-found and validate all fallback edges |
+
+## Decision audit
+
+Decision: **PARTIAL**.
+
+The narrow validation and deterministic-normalization idea is promising: all
+seeded defect categories were detected, valid fixtures were clean, diagnostics
+were accumulated, lookup behavior was preserved for the representative
+fixture, repeated release output was byte-identical, and the measured live
+allocation was far below 512 MiB. The result is not evidence to adopt an
+existing BogKit component or replace the production compiler.
+
+Choices made:
+
+- Chose a dependency-free batch prototype to respect offline CI and isolate
+  catalog semantics from unrelated BogKit subsystems.
+- Chose en-US as the structural baseline while preserving whole-message
+  fallback for missing localized messages.
+- Chose ordered maps and normalized textual runtime tables to make output
+  reproducible and inspectable.
+- Added an emitted-table loader so the lookup harness tests the generated
+  artifact, not only the source representation.
+
+Alternatives rejected:
+
+- Fold: useful for incremental persistent views, but it would add state and
+  lifecycle complexity to a batch validator and does not provide catalog
+  parsing or diagnostic semantics.
+- ESE: embedding compiler/runtime, unrelated to catalogs, and its public build
+  currently violates the offline constraint without a model cache.
+- ANNy: nearest-neighbor indexing, unrelated to validation or table emission.
+- Production-format redesign or release packaging: outside the prototype
+  boundary.
+
+Uncertainty that blocks a full adoption decision:
+
+- The real baseline compiler/runtime and production catalog corpus are not
+  present in this isolated checkout, so there is no fair 100,000-message
+  baseline comparison.
+- The prototype's one/other plural rule and placeholder syntax are
+  representative only, not a claim about the application's actual format.
+- The memory number is peak live allocator bytes, not a kernel-measured RSS.
+- Cross-machine reproducibility was reasoned from canonical ordering and
+  repeated locally, not executed on a second machine.
+
+## Skeptical review correction
+
+The reviewer reproduced a real fallback-list defect: when `xx` existed but did
+not contain `hello`, a catalog with `fallback xx,en-US` stopped at `xx` instead
+of continuing to `en-US`. The coordinator corrected lookup to try every
+fallback and changed cycle validation to traverse every fallback edge. A new
+regression covers the missing-first/found-second case. The corrected prototype
+now passes 4 library tests; formatting, strict Clippy, release build, valid and
+invalid fixture runs, and both repeated 100,000-record release compiles were
+rerun. The corrected stress outputs remain byte-identical with
+27,010,299 peak live allocated bytes and 0.05 seconds per compile. The
+`PARTIAL` decision remains unchanged.
+
+Smallest next experiment: bring one real, sanitized production-format slice
+and the baseline executable into an offline test harness, then differential
+test lookup results, diagnostics, output hashes, RSS, and 100,000-message
+runtime under the same three-minute/512-MiB budget.
diff --git a/developer-simulation/runs/2026-08-07--localization-catalog-compiler/fixtures/README.md b/developer-simulation/runs/2026-08-07--localization-catalog-compiler/fixtures/README.md
new file mode 100644
index 0000000..80a87ae
--- /dev/null
+++ b/developer-simulation/runs/2026-08-07--localization-catalog-compiler/fixtures/README.md
@@ -0,0 +1,24 @@
+# Catalog compiler prototype fixtures
+
+The format is deliberately small and dependency-free:
+
+~~~text
+locale fr
+fallback en-US
+message apples
+plural count
+branch one
+text Une pomme pour {name}
+branch other
+text {count} pommes pour {name}
+end
+~~~
+
+"text" supports "{variable}" placeholders. "plural" selects "one" for the
+value 1 and "other" otherwise. "select" chooses an exact branch and then
+"other". "ref <locale> <message-id>" is a nested fallback reference.
+
+The prototype validates localized message shapes against en-US, while a
+missing whole message continues to use the catalog's fallback chain. The
+emitted runtime table is the same grammar, normalized by locale, message ID,
+and branch name, which makes repeated output byte-identical.
diff --git a/developer-simulation/runs/2026-08-07--localization-catalog-compiler/fixtures/invalid/en-US.cat b/developer-simulation/runs/2026-08-07--localization-catalog-compiler/fixtures/invalid/en-US.cat
new file mode 100644
index 0000000..6a679cd
--- /dev/null
+++ b/developer-simulation/runs/2026-08-07--localization-catalog-compiler/fixtures/invalid/en-US.cat
@@ -0,0 +1,21 @@
+locale en-US
+fallback -
+
+message apples
+plural count
+branch one
+text One apple
+branch other
+text {count} apples
+end
+
+message greeting
+text Hello {name}
+
+message duplicate
+text first
+message duplicate
+text second
+
+message existing
+text Existing
diff --git a/developer-simulation/runs/2026-08-07--localization-catalog-compiler/fixtures/invalid/fr.cat b/developer-simulation/runs/2026-08-07--localization-catalog-compiler/fixtures/invalid/fr.cat
new file mode 100644
index 0000000..17ced21
--- /dev/null
+++ b/developer-simulation/runs/2026-08-07--localization-catalog-compiler/fixtures/invalid/fr.cat
@@ -0,0 +1,14 @@
+locale fr
+fallback missing-locale,en-US
+
+message apples
+plural count
+branch one
+text Une pomme
+end
+
+message greeting
+text Bonjour {username}
+
+message bad-ref
+ref missing-locale absent
diff --git a/developer-simulation/runs/2026-08-07--localization-catalog-compiler/fixtures/valid/de.cat b/developer-simulation/runs/2026-08-07--localization-catalog-compiler/fixtures/valid/de.cat
new file mode 100644
index 0000000..3b877ee
--- /dev/null
+++ b/developer-simulation/runs/2026-08-07--localization-catalog-compiler/fixtures/valid/de.cat
@@ -0,0 +1,13 @@
+locale de
+fallback fr,en-US
+
+message greeting
+select gender
+branch male
+text Er sagt hallo zu {name}
+branch other
+text Sie sagen hallo zu {name}
+end
+
+message nested
+ref en-US shared
diff --git a/developer-simulation/runs/2026-08-07--localization-catalog-compiler/fixtures/valid/en-US.cat b/developer-simulation/runs/2026-08-07--localization-catalog-compiler/fixtures/valid/en-US.cat
new file mode 100644
index 0000000..062ab45
--- /dev/null
+++ b/developer-simulation/runs/2026-08-07--localization-catalog-compiler/fixtures/valid/en-US.cat
@@ -0,0 +1,24 @@
+locale en-US
+fallback -
+
+message apples
+plural count
+branch one
+text One apple for {name}
+branch other
+text {count} apples for {name}
+end
+
+message greeting
+select gender
+branch male
+text He says hi to {name}
+branch other
+text They say hi to {name}
+end
+
+message nested
+ref en-US shared
+
+message shared
+text Shared message for {name}
diff --git a/developer-simulation/runs/2026-08-07--localization-catalog-compiler/fixtures/valid/fr.cat b/developer-simulation/runs/2026-08-07--localization-catalog-compiler/fixtures/valid/fr.cat
new file mode 100644
index 0000000..65f698e
--- /dev/null
+++ b/developer-simulation/runs/2026-08-07--localization-catalog-compiler/fixtures/valid/fr.cat
@@ -0,0 +1,21 @@
+locale fr
+fallback en-US
+
+message apples
+plural count
+branch one
+text Une pomme pour {name}
+branch other
+text {count} pommes pour {name}
+end
+
+message greeting
+select gender
+branch male
+text Il dit bonjour a {name}
+branch other
+text Iel dit bonjour a {name}
+end
+
+message nested
+ref en-US shared
diff --git a/developer-simulation/runs/2026-08-07--localization-catalog-compiler/src/lib.rs b/developer-simulation/runs/2026-08-07--localization-catalog-compiler/src/lib.rs
new file mode 100644
index 0000000..ba63ff5
--- /dev/null
+++ b/developer-simulation/runs/2026-08-07--localization-catalog-compiler/src/lib.rs
@@ -0,0 +1,1156 @@
+use std::collections::btree_map::Entry;
+use std::collections::{BTreeMap, BTreeSet, HashMap, HashSet};
+use std::fmt::Write as _;
+use std::fs;
+use std::path::{Path, PathBuf};
+
+pub const DEFAULT_LOCALE: &str = "en-US";
+
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct CatalogSet {
+    pub catalogs: BTreeMap<String, Catalog>,
+}
+
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct Catalog {
+    pub path: PathBuf,
+    pub locale: String,
+    pub fallbacks: Vec<String>,
+    pub fallback_line: usize,
+    pub messages: BTreeMap<String, Message>,
+}
+
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct Message {
+    pub node: Node,
+    pub line: usize,
+}
+
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct Node {
+    pub line: usize,
+    pub kind: NodeKind,
+}
+
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub enum NodeKind {
+    Text(String),
+    Ref {
+        locale: String,
+        id: String,
+    },
+    Plural {
+        selector: String,
+        branches: BTreeMap<String, Node>,
+    },
+    Select {
+        selector: String,
+        branches: BTreeMap<String, Node>,
+    },
+}
+
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct Diagnostic {
+    pub path: PathBuf,
+    pub locale: Option<String>,
+    pub message_id: Option<String>,
+    pub branch: Option<String>,
+    pub line: usize,
+    pub text: String,
+}
+
+impl Diagnostic {
+    fn new(
+        path: &Path,
+        locale: Option<&str>,
+        message_id: Option<&str>,
+        branch: Option<String>,
+        line: usize,
+        text: impl Into<String>,
+    ) -> Self {
+        Self {
+            path: path.to_path_buf(),
+            locale: locale.map(str::to_owned),
+            message_id: message_id.map(str::to_owned),
+            branch,
+            line,
+            text: text.into(),
+        }
+    }
+
+    pub fn render(&self) -> String {
+        let locale = self.locale.as_deref().unwrap_or("-");
+        let id = self.message_id.as_deref().unwrap_or("-");
+        let branch = self.branch.as_deref().unwrap_or("-");
+        format!(
+            "error catalog={} message={} branch={} source={}:{}: {}",
+            locale,
+            id,
+            branch,
+            self.path.display(),
+            self.line,
+            self.text
+        )
+    }
+}
+
+pub fn load_dir(dir: &Path) -> Result<CatalogSet, Vec<Diagnostic>> {
+    let mut paths = fs::read_dir(dir)
+        .map_err(|error| {
+            vec![Diagnostic::new(
+                dir,
+                None,
+                None,
+                None,
+                0,
+                format!("cannot read catalog directory: {error}"),
+            )]
+        })?
+        .filter_map(Result::ok)
+        .map(|entry| entry.path())
+        .filter(|path| path.extension().is_some_and(|ext| ext == "cat"))
+        .collect::<Vec<_>>();
+    paths.sort();
+
+    let mut catalogs = BTreeMap::new();
+    let mut diagnostics = Vec::new();
+    for path in paths {
+        match parse_catalog(&path) {
+            Ok((catalog, mut parse_diagnostics)) => {
+                diagnostics.append(&mut parse_diagnostics);
+                if catalogs.insert(catalog.locale.clone(), catalog).is_some() {
+                    diagnostics.push(Diagnostic::new(
+                        &path,
+                        None,
+                        None,
+                        None,
+                        1,
+                        "duplicate locale catalog",
+                    ));
+                }
+            }
+            Err(mut parse_diagnostics) => diagnostics.append(&mut parse_diagnostics),
+        }
+    }
+    if catalogs.is_empty() && diagnostics.is_empty() {
+        diagnostics.push(Diagnostic::new(
+            dir,
+            None,
+            None,
+            None,
+            0,
+            "catalog directory contains no .cat files",
+        ));
+    }
+    let set = CatalogSet { catalogs };
+    diagnostics.extend(set.validate());
+    if diagnostics.is_empty() {
+        Ok(set)
+    } else {
+        Err(diagnostics)
+    }
+}
+
+pub fn load_table(path: &Path) -> Result<CatalogSet, Vec<Diagnostic>> {
+    let source = fs::read_to_string(path).map_err(|error| {
+        vec![Diagnostic::new(
+            path,
+            None,
+            None,
+            None,
+            0,
+            format!("cannot read runtime table: {error}"),
+        )]
+    })?;
+    let mut blocks = Vec::new();
+    let mut current = String::new();
+    for line in source.lines() {
+        if line.trim_start().starts_with("locale ")
+            && current
+                .lines()
+                .any(|line| line.trim_start().starts_with("locale "))
+        {
+            blocks.push(std::mem::take(&mut current));
+        }
+        current.push_str(line);
+        current.push('\n');
+    }
+    if !current.trim().is_empty() {
+        blocks.push(current);
+    }
+
+    let mut catalogs = BTreeMap::new();
+    let mut diagnostics = Vec::new();
+    for block in blocks {
+        match parse_catalog_source(path, &block) {
+            Ok((catalog, mut parse_diagnostics)) => {
+                diagnostics.append(&mut parse_diagnostics);
+                if catalogs.insert(catalog.locale.clone(), catalog).is_some() {
+                    diagnostics.push(Diagnostic::new(
+                        path,
+                        None,
+                        None,
+                        None,
+                        0,
+                        "duplicate locale in runtime table",
+                    ));
+                }
+            }
+            Err(mut parse_diagnostics) => diagnostics.append(&mut parse_diagnostics),
+        }
+    }
+    let set = CatalogSet { catalogs };
+    diagnostics.extend(set.validate());
+    if diagnostics.is_empty() {
+        Ok(set)
+    } else {
+        Err(diagnostics)
+    }
+}
+
+fn parse_catalog(path: &Path) -> Result<(Catalog, Vec<Diagnostic>), Vec<Diagnostic>> {
+    let source = fs::read_to_string(path).map_err(|error| {
+        vec![Diagnostic::new(
+            path,
+            None,
+            None,
+            None,
+            0,
+            format!("cannot read catalog: {error}"),
+        )]
+    })?;
+    parse_catalog_source(path, &source)
+}
+
+fn parse_catalog_source(
+    path: &Path,
+    source: &str,
+) -> Result<(Catalog, Vec<Diagnostic>), Vec<Diagnostic>> {
+    let lines = source.lines().collect::<Vec<_>>();
+    let mut diagnostics = Vec::new();
+    let mut locale = None;
+    let mut fallbacks = Vec::new();
+    let mut fallback_line = 0;
+    let mut messages = BTreeMap::new();
+    let mut index = 0;
+
+    while index < lines.len() {
+        let line_number = index + 1;
+        let line = lines[index].trim();
+        index += 1;
+        if line.is_empty() || line.starts_with('#') {
+            continue;
+        }
+        let mut words = line.split_whitespace();
+        match words.next() {
+            Some("locale") => {
+                let value = words.next().unwrap_or("");
+                if value.is_empty() || words.next().is_some() {
+                    diagnostics.push(Diagnostic::new(
+                        path,
+                        None,
+                        None,
+                        None,
+                        line_number,
+                        "locale expects exactly one value",
+                    ));
+                } else if locale.replace(value.to_owned()).is_some() {
+                    diagnostics.push(Diagnostic::new(
+                        path,
+                        Some(value),
+                        None,
+                        None,
+                        line_number,
+                        "duplicate locale header",
+                    ));
+                }
+            }
+            Some("fallback") => {
+                let value = words.next().unwrap_or("");
+                if words.next().is_some() {
+                    diagnostics.push(Diagnostic::new(
+                        path,
+                        locale.as_deref(),
+                        None,
+                        None,
+                        line_number,
+                        "fallback values must be comma-separated",
+                    ));
+                } else if value != "-" {
+                    fallbacks = value.split(',').map(str::to_owned).collect();
+                }
+                fallback_line = line_number;
+            }
+            Some("message") => {
+                let id = words.next().unwrap_or("").to_owned();
+                if id.is_empty() || words.next().is_some() {
+                    diagnostics.push(Diagnostic::new(
+                        path,
+                        locale.as_deref(),
+                        None,
+                        None,
+                        line_number,
+                        "message expects exactly one identifier",
+                    ));
+                    continue;
+                }
+                let Some(node) = parse_node(
+                    &lines,
+                    &mut index,
+                    path,
+                    locale.as_deref(),
+                    Some(&id),
+                    &mut diagnostics,
+                ) else {
+                    continue;
+                };
+                match messages.entry(id) {
+                    Entry::Occupied(entry) => diagnostics.push(Diagnostic::new(
+                        path,
+                        locale.as_deref(),
+                        Some(entry.key()),
+                        None,
+                        line_number,
+                        "duplicate message identifier",
+                    )),
+                    Entry::Vacant(entry) => {
+                        entry.insert(Message {
+                            line: line_number,
+                            node,
+                        });
+                    }
+                }
+            }
+            Some(keyword) => diagnostics.push(Diagnostic::new(
+                path,
+                locale.as_deref(),
+                None,
+                None,
+                line_number,
+                format!("unknown directive {keyword}"),
+            )),
+            None => {}
+        }
+    }
+
+    let Some(locale) = locale else {
+        diagnostics.push(Diagnostic::new(
+            path,
+            None,
+            None,
+            None,
+            0,
+            "catalog has no locale header",
+        ));
+        return Err(diagnostics);
+    };
+    Ok((
+        Catalog {
+            path: path.to_path_buf(),
+            locale,
+            fallbacks,
+            fallback_line,
+            messages,
+        },
+        diagnostics,
+    ))
+}
+
+fn parse_node(
+    lines: &[&str],
+    index: &mut usize,
+    path: &Path,
+    locale: Option<&str>,
+    message_id: Option<&str>,
+    diagnostics: &mut Vec<Diagnostic>,
+) -> Option<Node> {
+    if *index >= lines.len() {
+        diagnostics.push(Diagnostic::new(
+            path,
+            locale,
+            message_id,
+            None,
+            lines.len(),
+            "message has no value",
+        ));
+        return None;
+    }
+    let line_number = *index + 1;
+    let line = lines[*index].trim();
+    *index += 1;
+    let mut words = line.split_whitespace();
+    match words.next() {
+        Some("text") => Some(Node {
+            line: line_number,
+            kind: NodeKind::Text(
+                line.strip_prefix("text")
+                    .unwrap_or("")
+                    .trim_start()
+                    .to_owned(),
+            ),
+        }),
+        Some("ref") => {
+            let target_locale = words.next().unwrap_or("");
+            let target_id = words.next().unwrap_or("");
+            if target_locale.is_empty() || target_id.is_empty() || words.next().is_some() {
+                diagnostics.push(Diagnostic::new(
+                    path,
+                    locale,
+                    message_id,
+                    None,
+                    line_number,
+                    "ref expects a locale and message identifier",
+                ));
+                None
+            } else {
+                Some(Node {
+                    line: line_number,
+                    kind: NodeKind::Ref {
+                        locale: target_locale.to_owned(),
+                        id: target_id.to_owned(),
+                    },
+                })
+            }
+        }
+        Some(kind @ ("plural" | "select")) => {
+            let selector = words.next().unwrap_or("");
+            if selector.is_empty() || words.next().is_some() {
+                diagnostics.push(Diagnostic::new(
+                    path,
+                    locale,
+                    message_id,
+                    None,
+                    line_number,
+                    format!("{kind} expects exactly one selector"),
+                ));
+                return None;
+            }
+            let mut branches = BTreeMap::new();
+            loop {
+                if *index >= lines.len() {
+                    diagnostics.push(Diagnostic::new(
+                        path,
+                        locale,
+                        message_id,
+                        None,
+                        line_number,
+                        format!("unterminated {kind} block"),
+                    ));
+                    break;
+                }
+                let branch_line_number = *index + 1;
+                let branch_line = lines[*index].trim();
+                if branch_line == "end" {
+                    *index += 1;
+                    break;
+                }
+                let mut branch_words = branch_line.split_whitespace();
+                if branch_words.next() != Some("branch") {
+                    diagnostics.push(Diagnostic::new(
+                        path,
+                        locale,
+                        message_id,
+                        None,
+                        branch_line_number,
+                        format!("{kind} expects branch <name> or end"),
+                    ));
+                    *index += 1;
+                    continue;
+                }
+                let branch_name = branch_words.next().unwrap_or("").to_owned();
+                *index += 1;
+                if branch_name.is_empty() || branch_words.next().is_some() {
+                    diagnostics.push(Diagnostic::new(
+                        path,
+                        locale,
+                        message_id,
+                        None,
+                        branch_line_number,
+                        "branch expects exactly one name",
+                    ));
+                    continue;
+                }
+                let Some(node) = parse_node(lines, index, path, locale, message_id, diagnostics)
+                else {
+                    continue;
+                };
+                if branches.insert(branch_name.clone(), node).is_some() {
+                    diagnostics.push(Diagnostic::new(
+                        path,
+                        locale,
+                        message_id,
+                        Some(format!("{kind}/{branch_name}")),
+                        branch_line_number,
+                        "duplicate branch",
+                    ));
+                }
+            }
+            let kind = if kind == "plural" {
+                NodeKind::Plural {
+                    selector: selector.to_owned(),
+                    branches,
+                }
+            } else {
+                NodeKind::Select {
+                    selector: selector.to_owned(),
+                    branches,
+                }
+            };
+            Some(Node {
+                line: line_number,
+                kind,
+            })
+        }
+        Some("end") | Some("branch") | Some(_) | None => {
+            diagnostics.push(Diagnostic::new(
+                path,
+                locale,
+                message_id,
+                None,
+                line_number,
+                "expected text, ref, plural, or select",
+            ));
+            None
+        }
+    }
+}
+
+impl CatalogSet {
+    pub fn validate(&self) -> Vec<Diagnostic> {
+        let mut diagnostics = Vec::new();
+        let Some(default) = self.catalogs.get(DEFAULT_LOCALE) else {
+            diagnostics.push(Diagnostic::new(
+                Path::new("<catalog-set>"),
+                None,
+                None,
+                None,
+                0,
+                "missing en-US baseline catalog",
+            ));
+            return diagnostics;
+        };
+
+        for catalog in self.catalogs.values() {
+            for fallback in &catalog.fallbacks {
+                if !self.catalogs.contains_key(fallback) {
+                    diagnostics.push(Diagnostic::new(
+                        &catalog.path,
+                        Some(&catalog.locale),
+                        None,
+                        None,
+                        catalog.fallback_line,
+                        format!("fallback locale {fallback} does not exist"),
+                    ));
+                }
+                if fallback == &catalog.locale {
+                    diagnostics.push(Diagnostic::new(
+                        &catalog.path,
+                        Some(&catalog.locale),
+                        None,
+                        None,
+                        catalog.fallback_line,
+                        "fallback chain references itself",
+                    ));
+                }
+            }
+            if let Some(cycle) = self.fallback_cycle(&catalog.locale) {
+                diagnostics.push(Diagnostic::new(
+                    &catalog.path,
+                    Some(&catalog.locale),
+                    None,
+                    None,
+                    catalog.fallback_line,
+                    format!("fallback chain contains a cycle: {}", cycle.join(" -> ")),
+                ));
+            }
+            for (id, message) in &catalog.messages {
+                self.validate_refs(
+                    &catalog.path,
+                    &catalog.locale,
+                    id,
+                    &message.node,
+                    &mut diagnostics,
+                );
+                self.validate_internal_shape(
+                    &catalog.path,
+                    &catalog.locale,
+                    id,
+                    &message.node,
+                    None,
+                    &mut diagnostics,
+                );
+            }
+        }
+
+        for catalog in self.catalogs.values() {
+            if catalog.locale == DEFAULT_LOCALE {
+                continue;
+            }
+            for (id, message) in &catalog.messages {
+                let Some(base) = default.messages.get(id) else {
+                    diagnostics.push(Diagnostic::new(
+                        &catalog.path,
+                        Some(&catalog.locale),
+                        Some(id),
+                        None,
+                        message.line,
+                        "message identifier is not present in en-US",
+                    ));
+                    continue;
+                };
+                self.compare_nodes(
+                    &catalog.path,
+                    &catalog.locale,
+                    id,
+                    &message.node,
+                    &base.node,
+                    None,
+                    &mut diagnostics,
+                );
+            }
+        }
+        diagnostics
+    }
+
+    fn validate_internal_shape(
+        &self,
+        path: &Path,
+        locale: &str,
+        id: &str,
+        node: &Node,
+        branch: Option<String>,
+        diagnostics: &mut Vec<Diagnostic>,
+    ) {
+        match &node.kind {
+            NodeKind::Text(text) => {
+                if let Err(error) = placeholders(text) {
+                    diagnostics.push(Diagnostic::new(
+                        path,
+                        Some(locale),
+                        Some(id),
+                        branch,
+                        node.line,
+                        error,
+                    ));
+                }
+            }
+            NodeKind::Ref { .. } => {}
+            NodeKind::Plural { selector, branches } | NodeKind::Select { selector, branches } => {
+                if selector.is_empty() || branches.is_empty() {
+                    diagnostics.push(Diagnostic::new(
+                        path,
+                        Some(locale),
+                        Some(id),
+                        branch.clone(),
+                        node.line,
+                        "branching message must have a selector and at least one branch",
+                    ));
+                }
+                for (name, child) in branches {
+                    self.validate_internal_shape(
+                        path,
+                        locale,
+                        id,
+                        child,
+                        Some(join_branch(branch.as_deref(), selector, name)),
+                        diagnostics,
+                    );
+                }
+            }
+        }
+    }
+
+    #[allow(clippy::too_many_arguments)]
+    fn compare_nodes(
+        &self,
+        path: &Path,
+        locale: &str,
+        id: &str,
+        actual: &Node,
+        expected: &Node,
+        branch: Option<String>,
+        diagnostics: &mut Vec<Diagnostic>,
+    ) {
+        match (&actual.kind, &expected.kind) {
+            (NodeKind::Text(actual_text), NodeKind::Text(expected_text)) => {
+                let actual_set = placeholders(actual_text).unwrap_or_default();
+                let expected_set = placeholders(expected_text).unwrap_or_default();
+                if actual_set != expected_set {
+                    diagnostics.push(Diagnostic::new(
+                        path,
+                        Some(locale),
+                        Some(id),
+                        branch,
+                        actual.line,
+                        format!(
+                            "placeholder mismatch: expected {:?}, found {:?}",
+                            expected_set, actual_set
+                        ),
+                    ));
+                }
+            }
+            (NodeKind::Ref { .. }, NodeKind::Ref { .. }) => {}
+            (
+                NodeKind::Plural {
+                    selector: actual_selector,
+                    branches: actual_branches,
+                },
+                NodeKind::Plural {
+                    selector: expected_selector,
+                    branches: expected_branches,
+                },
+            )
+            | (
+                NodeKind::Select {
+                    selector: actual_selector,
+                    branches: actual_branches,
+                },
+                NodeKind::Select {
+                    selector: expected_selector,
+                    branches: expected_branches,
+                },
+            ) => {
+                if actual_selector != expected_selector {
+                    diagnostics.push(Diagnostic::new(
+                        path,
+                        Some(locale),
+                        Some(id),
+                        branch.clone(),
+                        actual.line,
+                        format!(
+                            "selector mismatch: expected {expected_selector}, found {actual_selector}"
+                        ),
+                    ));
+                }
+                for (name, expected_child) in expected_branches {
+                    let child_branch = Some(join_branch(branch.as_deref(), actual_selector, name));
+                    match actual_branches.get(name) {
+                        Some(actual_child) => self.compare_nodes(
+                            path,
+                            locale,
+                            id,
+                            actual_child,
+                            expected_child,
+                            child_branch,
+                            diagnostics,
+                        ),
+                        None => diagnostics.push(Diagnostic::new(
+                            path,
+                            Some(locale),
+                            Some(id),
+                            child_branch,
+                            actual.line,
+                            "missing branch",
+                        )),
+                    }
+                }
+                for name in actual_branches
+                    .keys()
+                    .filter(|name| !expected_branches.contains_key(*name))
+                {
+                    diagnostics.push(Diagnostic::new(
+                        path,
+                        Some(locale),
+                        Some(id),
+                        Some(join_branch(branch.as_deref(), actual_selector, name)),
+                        actual.line,
+                        "unexpected branch",
+                    ));
+                }
+            }
+            _ => diagnostics.push(Diagnostic::new(
+                path,
+                Some(locale),
+                Some(id),
+                branch,
+                actual.line,
+                "message shape differs from en-US",
+            )),
+        }
+    }
+
+    fn validate_refs(
+        &self,
+        path: &Path,
+        locale: &str,
+        id: &str,
+        node: &Node,
+        diagnostics: &mut Vec<Diagnostic>,
+    ) {
+        match &node.kind {
+            NodeKind::Ref {
+                locale: target_locale,
+                id: target_id,
+            } => {
+                if !self.catalogs.contains_key(target_locale) {
+                    diagnostics.push(Diagnostic::new(
+                        path,
+                        Some(locale),
+                        Some(id),
+                        None,
+                        node.line,
+                        format!("fallback reference targets missing locale {target_locale}"),
+                    ));
+                } else if !self.catalogs[target_locale]
+                    .messages
+                    .contains_key(target_id)
+                {
+                    diagnostics.push(Diagnostic::new(
+                        path,
+                        Some(locale),
+                        Some(id),
+                        None,
+                        node.line,
+                        format!(
+                            "fallback reference targets missing message {target_locale}/{target_id}"
+                        ),
+                    ));
+                }
+            }
+            NodeKind::Text(_) => {}
+            NodeKind::Plural { branches, .. } | NodeKind::Select { branches, .. } => {
+                for child in branches.values() {
+                    self.validate_refs(path, locale, id, child, diagnostics);
+                }
+            }
+        }
+    }
+
+    fn fallback_cycle(&self, start: &str) -> Option<Vec<String>> {
+        fn visit(
+            catalogs: &BTreeMap<String, Catalog>,
+            current: &str,
+            path: &mut Vec<String>,
+            active: &mut HashMap<String, usize>,
+            finished: &mut HashSet<String>,
+        ) -> Option<Vec<String>> {
+            if let Some(&at) = active.get(current) {
+                return Some(path[at..].to_vec());
+            }
+            if finished.contains(current) {
+                return None;
+            }
+            let catalog = catalogs.get(current)?;
+            active.insert(current.to_owned(), path.len());
+            path.push(current.to_owned());
+            for fallback in &catalog.fallbacks {
+                if catalogs.contains_key(fallback)
+                    && let Some(cycle) = visit(catalogs, fallback, path, active, finished)
+                {
+                    return Some(cycle);
+                }
+            }
+            path.pop();
+            active.remove(current);
+            finished.insert(current.to_owned());
+            None
+        }
+
+        visit(
+            &self.catalogs,
+            start,
+            &mut Vec::new(),
+            &mut HashMap::new(),
+            &mut HashSet::new(),
+        )
+    }
+
+    pub fn emit_table(&self) -> String {
+        let mut out = String::new();
+        out.push_str("# catalog-compiler-prototype runtime table v1\n");
+        for catalog in self.catalogs.values() {
+            let fallbacks = if catalog.fallbacks.is_empty() {
+                "-".to_owned()
+            } else {
+                catalog.fallbacks.join(",")
+            };
+            writeln!(out, "locale {}\nfallback {}", catalog.locale, fallbacks).unwrap();
+            for (id, message) in &catalog.messages {
+                writeln!(out, "message {id}").unwrap();
+                emit_node(&mut out, &message.node, 0);
+            }
+        }
+        out
+    }
+
+    pub fn lookup(
+        &self,
+        locale: &str,
+        id: &str,
+        vars: &HashMap<String, String>,
+    ) -> Result<String, String> {
+        let mut locale_seen = HashSet::new();
+        self.lookup_locale(locale, id, vars, &mut locale_seen, &mut Vec::new())
+    }
+
+    fn lookup_locale(
+        &self,
+        locale: &str,
+        id: &str,
+        vars: &HashMap<String, String>,
+        locale_seen: &mut HashSet<String>,
+        refs_seen: &mut Vec<(String, String)>,
+    ) -> Result<String, String> {
+        if !locale_seen.insert(locale.to_owned()) {
+            return Err(format!("fallback cycle while looking up {locale}/{id}"));
+        }
+        let result = if let Some(catalog) = self.catalogs.get(locale) {
+            if let Some(message) = catalog.messages.get(id) {
+                self.render_node(locale, id, &message.node, vars, locale_seen, refs_seen)
+            } else if !catalog.fallbacks.is_empty() {
+                let mut result = Err(format!("message not found: {locale}/{id}"));
+                for fallback in &catalog.fallbacks {
+                    match self.lookup_locale(fallback, id, vars, locale_seen, refs_seen) {
+                        Ok(value) => {
+                            result = Ok(value);
+                            break;
+                        }
+                        Err(error) => result = Err(error),
+                    }
+                }
+                result
+            } else {
+                Err(format!("message not found: {locale}/{id}"))
+            }
+        } else {
+            Err(format!("locale not found: {locale}"))
+        };
+        locale_seen.remove(locale);
+        result
+    }
+
+    fn render_node(
+        &self,
+        _locale: &str,
+        _id: &str,
+        node: &Node,
+        vars: &HashMap<String, String>,
+        locale_seen: &mut HashSet<String>,
+        refs_seen: &mut Vec<(String, String)>,
+    ) -> Result<String, String> {
+        match &node.kind {
+            NodeKind::Text(text) => substitute(text, vars),
+            NodeKind::Ref {
+                locale: target_locale,
+                id: target_id,
+            } => {
+                let key = (target_locale.clone(), target_id.clone());
+                if refs_seen.contains(&key) {
+                    return Err(format!(
+                        "fallback reference cycle at {target_locale}/{target_id}"
+                    ));
+                }
+                refs_seen.push(key);
+                let result =
+                    self.lookup_locale(target_locale, target_id, vars, locale_seen, refs_seen);
+                refs_seen.pop();
+                result
+            }
+            NodeKind::Plural { selector, branches } => {
+                let value = vars
+                    .get(selector)
+                    .ok_or_else(|| format!("missing variable {selector}"))?;
+                let branch = if value == "1" { "one" } else { "other" };
+                let child = branches
+                    .get(branch)
+                    .or_else(|| branches.get("other"))
+                    .ok_or_else(|| format!("plural has no {branch} or other branch"))?;
+                self.render_node("", "", child, vars, locale_seen, refs_seen)
+            }
+            NodeKind::Select { selector, branches } => {
+                let value = vars
+                    .get(selector)
+                    .ok_or_else(|| format!("missing variable {selector}"))?;
+                let child = branches
+                    .get(value)
+                    .or_else(|| branches.get("other"))
+                    .ok_or_else(|| format!("select has no {value} or other branch"))?;
+                self.render_node("", "", child, vars, locale_seen, refs_seen)
+            }
+        }
+    }
+}
+
+fn join_branch(parent: Option<&str>, selector: &str, name: &str) -> String {
+    match parent {
+        Some(parent) => format!("{parent}/{selector}={name}"),
+        None => format!("{selector}={name}"),
+    }
+}
+
+fn placeholders(text: &str) -> Result<BTreeSet<String>, String> {
+    let mut names = BTreeSet::new();
+    let mut rest = text;
+    while let Some(start) = rest.find('{') {
+        let after = &rest[start + 1..];
+        let Some(end) = after.find('}') else {
+            return Err("unclosed placeholder".to_owned());
+        };
+        let name = &after[..end];
+        if name.is_empty()
+            || name.contains(['{', '}', ','])
+            || name.chars().any(char::is_whitespace)
+        {
+            return Err(format!("invalid placeholder {{{name}}}"));
+        }
+        names.insert(name.to_owned());
+        rest = &after[end + 1..];
+    }
+    Ok(names)
+}
+
+fn emit_node(out: &mut String, node: &Node, depth: usize) {
+    let indent = "  ".repeat(depth);
+    match &node.kind {
+        NodeKind::Text(text) => {
+            writeln!(out, "{indent}text {text}").unwrap();
+        }
+        NodeKind::Ref { locale, id } => {
+            writeln!(out, "{indent}ref {locale} {id}").unwrap();
+        }
+        NodeKind::Plural { selector, branches } => {
+            writeln!(out, "{indent}plural {selector}").unwrap();
+            for (name, child) in branches {
+                writeln!(out, "{indent}branch {name}").unwrap();
+                emit_node(out, child, depth + 1);
+            }
+            writeln!(out, "{indent}end").unwrap();
+        }
+        NodeKind::Select { selector, branches } => {
+            writeln!(out, "{indent}select {selector}").unwrap();
+            for (name, child) in branches {
+                writeln!(out, "{indent}branch {name}").unwrap();
+                emit_node(out, child, depth + 1);
+            }
+            writeln!(out, "{indent}end").unwrap();
+        }
+    }
+}
+
+fn substitute(text: &str, vars: &HashMap<String, String>) -> Result<String, String> {
+    let mut result = String::new();
+    let mut rest = text;
+    while let Some(start) = rest.find('{') {
+        result.push_str(&rest[..start]);
+        let after = &rest[start + 1..];
+        let Some(end) = after.find('}') else {
+            return Err("unclosed placeholder".to_owned());
+        };
+        let name = &after[..end];
+        let value = vars
+            .get(name)
+            .ok_or_else(|| format!("missing variable {name}"))?;
+        result.push_str(value);
+        rest = &after[end + 1..];
+    }
+    result.push_str(rest);
+    Ok(result)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::time::{SystemTime, UNIX_EPOCH};
+
+    fn temp_dir(name: &str) -> PathBuf {
+        let stamp = SystemTime::now()
+            .duration_since(UNIX_EPOCH)
+            .unwrap()
+            .as_nanos();
+        let path = std::env::temp_dir().join(format!("catalog-prototype-{name}-{stamp}"));
+        fs::create_dir_all(&path).unwrap();
+        path
+    }
+
+    fn write(path: &Path, body: &str) {
+        fs::write(path, body).unwrap();
+    }
+
+    #[test]
+    fn valid_fixture_has_zero_diagnostics_and_preserves_fallback_lookup() {
+        let dir = temp_dir("valid");
+        write(
+            &dir.join("en-US.cat"),
+            "locale en-US\nfallback -\nmessage hello\ntext Hello {name}\nmessage shared\ntext Shared {name}\nmessage apples\nplural count\nbranch one\ntext One apple for {name}\nbranch other\ntext {count} apples for {name}\nend\nmessage nested\nref en-US shared\n",
+        );
+        write(
+            &dir.join("fr.cat"),
+            "locale fr\nfallback en-US\nmessage hello\ntext Bonjour {name}\nmessage apples\nplural count\nbranch one\ntext Une pomme pour {name}\nbranch other\ntext {count} pommes pour {name}\nend\nmessage nested\nref en-US shared\n",
+        );
+        let catalogs = load_dir(&dir).unwrap();
+        let vars = HashMap::from([
+            (String::from("name"), String::from("Ada")),
+            (String::from("count"), String::from("2")),
+        ]);
+        assert_eq!(
+            catalogs.lookup("fr", "hello", &vars).unwrap(),
+            "Bonjour Ada"
+        );
+        assert_eq!(
+            catalogs.lookup("fr", "shared", &vars).unwrap(),
+            "Shared Ada"
+        );
+        assert_eq!(
+            catalogs.lookup("fr", "apples", &vars).unwrap(),
+            "2 pommes pour Ada"
+        );
+        let table_path = dir.join("runtime.table");
+        fs::write(&table_path, catalogs.emit_table()).unwrap();
+        let runtime = load_table(&table_path).unwrap();
+        assert_eq!(runtime.lookup("fr", "shared", &vars).unwrap(), "Shared Ada");
+    }
+
+    #[test]
+    fn invalid_fixture_reports_all_seeded_categories() {
+        let dir = temp_dir("invalid");
+        write(
+            &dir.join("en-US.cat"),
+            "locale en-US\nfallback -\nmessage apples\nplural count\nbranch one\ntext One apple\nbranch other\ntext {count} apples\nend\nmessage greeting\ntext Hello {name}\nmessage duplicate\ntext first\nmessage duplicate\ntext second\nmessage existing\ntext Existing\n",
+        );
+        write(
+            &dir.join("fr.cat"),
+            "locale fr\nfallback missing-locale,en-US\nmessage apples\nplural count\nbranch one\ntext Une pomme\nend\nmessage greeting\ntext Bonjour {username}\nmessage bad-ref\nref missing-locale absent\n",
+        );
+        let diagnostics = load_dir(&dir).unwrap_err();
+        let output = diagnostics
+            .iter()
+            .map(Diagnostic::render)
+            .collect::<Vec<_>>()
+            .join("\n");
+        assert!(output.contains("missing branch"));
+        assert!(output.contains("placeholder mismatch"));
+        assert!(output.contains("fallback locale missing-locale does not exist"));
+        assert!(output.contains("duplicate message identifier"));
+        assert!(output.contains("fallback reference targets missing locale"));
+    }
+
+    #[test]
+    fn emission_is_canonical() {
+        let dir = temp_dir("order");
+        write(
+            &dir.join("z.cat"),
+            "locale z\nfallback en-US\nmessage z\ntext z\nmessage a\ntext a\n",
+        );
+        write(
+            &dir.join("en-US.cat"),
+            "locale en-US\nfallback -\nmessage z\ntext z\nmessage a\ntext a\n",
+        );
+        let catalogs = load_dir(&dir).unwrap();
+        let table = catalogs.emit_table();
+        assert!(table.find("message a").unwrap() < table.find("message z").unwrap());
+    }
+
+    #[test]
+    fn lookup_tries_each_fallback_before_failing() {
+        let dir = temp_dir("fallback-list");
+        write(
+            &dir.join("en-US.cat"),
+            "locale en-US\nfallback -\nmessage hello\ntext Hello {name}\n",
+        );
+        write(&dir.join("xx.cat"), "locale xx\nfallback -\n");
+        write(&dir.join("fr.cat"), "locale fr\nfallback xx,en-US\n");
+        let catalogs = load_dir(&dir).unwrap();
+        let vars = HashMap::from([(String::from("name"), String::from("Ada"))]);
+        assert_eq!(catalogs.lookup("fr", "hello", &vars).unwrap(), "Hello Ada");
+    }
+}
diff --git a/developer-simulation/runs/2026-08-07--localization-catalog-compiler/src/main.rs b/developer-simulation/runs/2026-08-07--localization-catalog-compiler/src/main.rs
new file mode 100644
index 0000000..a91c264
--- /dev/null
+++ b/developer-simulation/runs/2026-08-07--localization-catalog-compiler/src/main.rs
@@ -0,0 +1,229 @@
+use catalog_compiler::Diagnostic;
+use std::alloc::{GlobalAlloc, Layout, System};
+use std::collections::HashMap;
+use std::env;
+use std::fs;
+use std::path::Path;
+use std::process::ExitCode;
+use std::sync::atomic::{AtomicUsize, Ordering};
+
+struct TrackingAllocator;
+
+static LIVE_ALLOCATED: AtomicUsize = AtomicUsize::new(0);
+static PEAK_ALLOCATED: AtomicUsize = AtomicUsize::new(0);
+
+#[global_allocator]
+static ALLOCATOR: TrackingAllocator = TrackingAllocator;
+
+impl TrackingAllocator {
+    fn add(size: usize) {
+        let live = LIVE_ALLOCATED.fetch_add(size, Ordering::Relaxed) + size;
+        let mut peak = PEAK_ALLOCATED.load(Ordering::Relaxed);
+        while live > peak {
+            match PEAK_ALLOCATED.compare_exchange_weak(
+                peak,
+                live,
+                Ordering::Relaxed,
+                Ordering::Relaxed,
+            ) {
+                Ok(_) => break,
+                Err(previous) => peak = previous,
+            }
+        }
+    }
+
+    fn subtract(size: usize) {
+        LIVE_ALLOCATED.fetch_sub(size, Ordering::Relaxed);
+    }
+}
+
+unsafe impl GlobalAlloc for TrackingAllocator {
+    unsafe fn alloc(&self, layout: Layout) -> *mut u8 {
+        let pointer = unsafe { System.alloc(layout) };
+        if !pointer.is_null() {
+            Self::add(layout.size());
+        }
+        pointer
+    }
+
+    unsafe fn dealloc(&self, pointer: *mut u8, layout: Layout) {
+        unsafe { System.dealloc(pointer, layout) };
+        Self::subtract(layout.size());
+    }
+
+    unsafe fn realloc(&self, pointer: *mut u8, layout: Layout, new_size: usize) -> *mut u8 {
+        let new_pointer = unsafe { System.realloc(pointer, layout, new_size) };
+        if !new_pointer.is_null() {
+            if new_size >= layout.size() {
+                Self::add(new_size - layout.size());
+            } else {
+                Self::subtract(layout.size() - new_size);
+            }
+        }
+        new_pointer
+    }
+}
+
+fn main() -> ExitCode {
+    let mut args = env::args().skip(1);
+    let code = match args.next().as_deref() {
+        Some("compile") => {
+            let Some(input) = args.next() else {
+                return usage();
+            };
+            let Some(output) = args.next() else {
+                return usage();
+            };
+            compile(Path::new(&input), Path::new(&output))
+        }
+        Some("generate-stress") => {
+            let Some(output) = args.next() else {
+                return usage();
+            };
+            let messages = args.next().and_then(|n| n.parse().ok()).unwrap_or(100_000);
+            let locales = args.next().and_then(|n| n.parse().ok()).unwrap_or(18);
+            generate_stress(Path::new(&output), messages, locales)
+        }
+        Some("lookup") => {
+            let Some(input) = args.next() else {
+                return usage();
+            };
+            let Some(locale) = args.next() else {
+                return usage();
+            };
+            let Some(id) = args.next() else {
+                return usage();
+            };
+            lookup(Path::new(&input), &locale, &id)
+        }
+        Some("lookup-table") => {
+            let Some(input) = args.next() else {
+                return usage();
+            };
+            let Some(locale) = args.next() else {
+                return usage();
+            };
+            let Some(id) = args.next() else {
+                return usage();
+            };
+            lookup_table(Path::new(&input), &locale, &id)
+        }
+        _ => usage(),
+    };
+    if env::var_os("CATALOG_MEMORY_REPORT").is_some() {
+        eprintln!(
+            "peak_live_allocated_bytes={}",
+            PEAK_ALLOCATED.load(Ordering::Relaxed)
+        );
+    }
+    code
+}
+
+fn compile(input: &Path, output: &Path) -> ExitCode {
+    match catalog_compiler::load_dir(input) {
+        Ok(catalogs) => {
+            if let Err(error) = fs::write(output, catalogs.emit_table()) {
+                eprintln!("error: cannot write {}: {error}", output.display());
+                ExitCode::from(1)
+            } else {
+                println!("compiled {} into {}", input.display(), output.display());
+                ExitCode::SUCCESS
+            }
+        }
+        Err(diagnostics) => report(diagnostics),
+    }
+}
+
+fn lookup(input: &Path, locale: &str, id: &str) -> ExitCode {
+    match catalog_compiler::load_dir(input) {
+        Ok(catalogs) => render_lookup(catalogs, locale, id),
+        Err(diagnostics) => report(diagnostics),
+    }
+}
+
+fn lookup_table(input: &Path, locale: &str, id: &str) -> ExitCode {
+    match catalog_compiler::load_table(input) {
+        Ok(catalogs) => render_lookup(catalogs, locale, id),
+        Err(diagnostics) => report(diagnostics),
+    }
+}
+
+fn render_lookup(catalogs: catalog_compiler::CatalogSet, locale: &str, id: &str) -> ExitCode {
+    let vars = HashMap::from([
+        (String::from("name"), String::from("Ada")),
+        (String::from("count"), String::from("2")),
+        (String::from("gender"), String::from("other")),
+    ]);
+    match catalogs.lookup(locale, id, &vars) {
+        Ok(value) => {
+            println!("{value}");
+            ExitCode::SUCCESS
+        }
+        Err(error) => {
+            eprintln!("error: {error}");
+            ExitCode::from(1)
+        }
+    }
+}
+
+fn report(diagnostics: Vec<Diagnostic>) -> ExitCode {
+    let count = diagnostics.len();
+    for diagnostic in diagnostics {
+        eprintln!("{}", diagnostic.render());
+    }
+    eprintln!("{count} diagnostic(s)");
+    ExitCode::from(1)
+}
+
+fn generate_stress(output: &Path, message_count: usize, locale_count: usize) -> ExitCode {
+    if message_count == 0 || locale_count == 0 || locale_count > 26 {
+        eprintln!("error: message count must be positive and locale count must be 1..=26");
+        return ExitCode::from(2);
+    }
+    if let Err(error) = fs::create_dir_all(output) {
+        eprintln!("error: cannot create {}: {error}", output.display());
+        return ExitCode::from(1);
+    }
+    let locales = (0..locale_count)
+        .map(|index| {
+            if index == 0 {
+                "en-US".to_owned()
+            } else {
+                format!("x-{index:02}")
+            }
+        })
+        .collect::<Vec<_>>();
+    let per_locale = message_count / locale_count;
+    let remainder = message_count % locale_count;
+    for (locale_index, locale) in locales.iter().enumerate() {
+        let count = per_locale + usize::from(locale_index < remainder);
+        let mut text = format!(
+            "locale {locale}\nfallback {}\n",
+            if locale_index == 0 { "-" } else { "en-US" }
+        );
+        for message_id in 0..count {
+            text.push_str(&format!(
+                "message msg{message_id:06}\ntext {locale} {message_id} for {{name}}\n"
+            ));
+        }
+        if let Err(error) = fs::write(output.join(format!("{locale}.cat")), text) {
+            eprintln!("error: cannot write stress fixture: {error}");
+            return ExitCode::from(1);
+        }
+    }
+    println!(
+        "generated {message_count} messages across {locale_count} locales in {}",
+        output.display()
+    );
+    ExitCode::SUCCESS
+}
+
+fn usage() -> ExitCode {
+    eprintln!(
+        "usage: catalogc compile <catalog-dir> <table-file>\n\
+         catalogc lookup <catalog-dir> <locale> <message-id>\n\
+         catalogc lookup-table <table-file> <locale> <message-id>\n\
+         catalogc generate-stress <dir> [messages] [locales]"
+    );
+    ExitCode::from(2)
+}
diff --git a/developer-simulation/runs/2026-08-07--webhook-scheduler/Cargo.toml b/developer-simulation/runs/2026-08-07--webhook-scheduler/Cargo.toml
new file mode 100644
index 0000000..fef58f5
--- /dev/null
+++ b/developer-simulation/runs/2026-08-07--webhook-scheduler/Cargo.toml
@@ -0,0 +1,12 @@
+[package]
+name = "webhook-scheduler"
+version = "0.1.0"
+edition = "2024"
+
+[lib]
+name = "webhook_scheduler"
+path = "src/lib.rs"
+
+[[bin]]
+name = "webhook-scheduler"
+path = "src/main.rs"
diff --git a/developer-simulation/runs/2026-08-07--webhook-scheduler/README.md b/developer-simulation/runs/2026-08-07--webhook-scheduler/README.md
new file mode 100644
index 0000000..e07bd5b
--- /dev/null
+++ b/developer-simulation/runs/2026-08-07--webhook-scheduler/README.md
@@ -0,0 +1,22 @@
+# Webhook scheduler prototype
+
+This is a deterministic in-memory state machine for the multi-tenant webhook
+delivery scenario. It does not make HTTP requests, connect to PostgreSQL, or
+claim production throughput. Inputs are timestamped enqueue, availability,
+outcome, crash, restart, and clock-advance events. Outputs include durable send
+decisions, retry deadlines, status transitions, queue occupancy, and fairness
+latencies.
+
+Run the focused checks from the `developer-simulation/` nested workspace root:
+
+```console
+cargo fmt --package webhook-scheduler -- --check
+cargo clippy -p webhook-scheduler --all-targets -- -D warnings
+cargo test -p webhook-scheduler
+cargo test --release -p webhook-scheduler
+cargo run --release -p webhook-scheduler -- --repeat 1000
+```
+
+The demo compares the stated fixed-queue baseline with the scheduler, holds an
+endpoint unavailable for one simulated hour, exercises deterministic retry
+deadlines and recovery, and simulates a crash before acknowledgement.
diff --git a/developer-simulation/runs/2026-08-07--webhook-scheduler/evidence/decision-audit.md b/developer-simulation/runs/2026-08-07--webhook-scheduler/evidence/decision-audit.md
new file mode 100644
index 0000000..6f0d2f2
--- /dev/null
+++ b/developer-simulation/runs/2026-08-07--webhook-scheduler/evidence/decision-audit.md
@@ -0,0 +1,62 @@
+# Decision audit
+
+## Decision
+
+Retain the corrected scheduler as an exploratory follow-up only, not as
+production behavior or a promoted dashboard candidate. Do not adopt a BogKit
+Fold component as the core delivery loop in this trial: the public component
+surface is a poor fit for timer deadlines, external HTTP acknowledgement, and
+lease recovery. This is a component-level no-fit; the standalone algorithm
+still needs real integration evidence.
+
+## Choices made
+
+- Kept the endpoint head in the queue while in flight, which makes ordering
+  observable and prevents a later event from bypassing it.
+- Limited each endpoint to one in-flight attempt and bounded its queue.
+- Used round-robin tenant admission, with independent tenant and endpoint
+  minimum intervals.
+- Persisted the state machine's in-flight lease before emitting a send decision.
+- Requeued persisted leases on restart; ignored old attempt outcomes after a
+  crash to preserve at-least-once semantics without claiming exactly-once.
+- Used capped exponential retry with stable event/attempt-derived jitter rather
+  than a random source.
+- Kept the implementation in the standard library so the scheduling evidence
+  is not confounded by HTTP, PostgreSQL, or a new dependency.
+
+## Rejected alternatives
+
+- **Fold as the dispatch loop:** rejected for this boundary because the public
+  examples document incremental materialized views, not external side-effect
+  leases or timer ownership. Fold may still be useful for reporting after an
+  adapter boundary is designed.
+- **Global FIFO:** rejected because a noisy endpoint can remain ahead of
+  unrelated tenants.
+- **Random retry jitter:** rejected because replay and operations require stable
+  decisions for identical traces.
+- **Multiple concurrent sends per endpoint:** rejected because it weakens the
+  stated ordering guarantee and makes crash duplicate analysis harder.
+- **Real HTTP/PostgreSQL in this trial:** rejected because they exceed the
+  prototype boundary and would obscure the scheduler invariants.
+
+## Uncertainty and gates before production
+
+- The baseline comparison is a declared four-worker slow-endpoint fixture, not
+  a measurement of a deployed worker.
+- The durable snapshot is an in-memory clone; it proves restart transitions,
+  not disk or PostgreSQL durability.
+- The fairness traces are small; no claim is made for the stated traffic shape.
+- Payload sizes are carried as metadata but not allocated, streamed, or
+  measured.
+- Production adoption requires PostgreSQL lease/ack integration, HTTP outcome
+  taxonomy, load/recovery tests at 200,000 events/hour, and operational metrics.
+
+## Skeptical review correction
+
+The reviewer reproduced retry jitter exceeding the configured hard cap: a
+1,000 ms cap produced a 1,056 ms deadline. The coordinator applied the cap
+after jitter and added a regression covering 1,024 deterministic event IDs.
+Debug and release suites now pass 8 tests each, and the repeated release demo
+still completes 1,000 repetitions. The reviewer also narrowed the baseline,
+outage, durability, and performance claims to the small in-memory model. No
+recurring BogKit finding or candidate improvement was promoted.
diff --git a/developer-simulation/runs/2026-08-07--webhook-scheduler/evidence/discovery.md b/developer-simulation/runs/2026-08-07--webhook-scheduler/evidence/discovery.md
new file mode 100644
index 0000000..bb45ba9
--- /dev/null
+++ b/developer-simulation/runs/2026-08-07--webhook-scheduler/evidence/discovery.md
@@ -0,0 +1,45 @@
+# Ordered discovery and friction trail
+
+This trial was run in a sanitized current-main checkout on 2026-08-07.
+
+1. `rg --files -g 'README*' -g 'examples/**' | sort`
+   - Found the public root README and four public examples: `starter`,
+     `timeseries`, `chat`, and `search`.
+2. `sed -n '1,260p' README.md` and the four example source files.
+   - The README describes Fold as an incremental, persistent dataflow runtime
+     and points to `Stream::new`, `wtx`, and `rtx` patterns.
+   - `starter` shows atomic writes and durable materialized views.
+   - `timeseries` shows deterministic keying and incremental aggregates.
+   - `chat` shows one ingest owner and snapshot publication.
+   - `search` shows keyed upsert/retraction and persistent indexes.
+3. Workspace metadata was inspected only after the public surface:
+   `Cargo.toml`, relevant `fold/src` API references, and the current checkout
+   status. The checkout was detached at its starting `origin/main` commit and
+   had no local changes.
+
+## Friction observed
+
+- No public example models a clock, delayed work, leases, worker crashes, HTTP
+  outcomes, rate limits, or fair dispatch.
+- Fold's persistence and transactional views are relevant to queue state, but
+  the scheduler needs external side effects and timer decisions whose
+  acknowledgement protocol is outside the shown dataflow API.
+- The prototype therefore uses only the Rust standard library. This keeps the
+  evidence runnable and tests the scheduling decision independently of a
+  storage or networking choice.
+
+## Baseline evaluation before component choice
+
+The stated baseline is fixed per-endpoint queues with exponential retries and
+dead-lettering. For a reproducible tail-latency comparison, this trial uses a
+conservative fixture of four workers, four queued deliveries from one slow
+endpoint, and a 60,000 ms response timeout. In that fixture the fixed queue
+worker model can occupy all workers before a healthy tenant is admitted. It is
+an explicit comparison model, not a claim that every production baseline has
+the same timeout or endpoint concurrency.
+
+The candidate scheduler's smallest meaningful change is strict one-at-a-time
+endpoint dispatch plus tenant round-robin admission, endpoint queue budgets,
+deterministic capped exponential retry, and durable in-flight leases. No
+BogKit component is selected for the core decision loop because the public
+surface does not supply the timer/lease/side-effect boundary needed here.
diff --git a/developer-simulation/runs/2026-08-07--webhook-scheduler/evidence/findings.md b/developer-simulation/runs/2026-08-07--webhook-scheduler/evidence/findings.md
new file mode 100644
index 0000000..a47a313
--- /dev/null
+++ b/developer-simulation/runs/2026-08-07--webhook-scheduler/evidence/findings.md
@@ -0,0 +1,19 @@
+# Categorized findings
+
+Severity uses the consequence if this prototype's behavior were mistakenly
+treated as production-ready. Confidence describes how directly the local
+tests and demo support the finding.
+
+| Category | Finding | Severity | Confidence | Reproduction | Smallest improvement |
+| --- | --- | --- | --- | --- | --- |
+| Ordering | The endpoint queue retains its in-flight head; later events cannot be selected until that head reaches a terminal status. | Low | High | `cargo test -p webhook-scheduler endpoint_order_is_preserved_across_retry` | Add a persisted sequence number and contract test against the production delivery table. |
+| Retry classification | Retryable, non-retryable, expired, and maximum-attempt dead-letter states are distinct and tested. | Low | High | `cargo test -p webhook-scheduler failure_classes_are_distinct` | Map real HTTP/database error classes and clock source into this enum. |
+| Crash delivery | A lease is persisted before a send decision; restart requeues it and stale outcomes are ignored, yielding at-least-once behavior. | Medium | High within the model | `cargo test -p webhook-scheduler crash_requeues_unacknowledged_lease_and_old_outcome_is_ignored` | Replace the clone snapshot with an atomic PostgreSQL lease/ack transaction and crash-injection tests. |
+| Noisy endpoint bounds | One endpoint is limited to one in-flight head and an eight-item queue budget; its occupancy reaches but does not exceed the configured budget. | Low | High | `cargo test -p webhook-scheduler noisy_endpoint_is_bounded_and_healthy_tenant_is_admitted` | Decide the production overflow policy and expose it to operations. |
+| Outage recovery | During a continuous simulated one-hour unavailability, no retry is sent early; one overdue head is admitted on recovery. | Low | High within the model | `cargo test -p webhook-scheduler one_hour_outage_has_no_retry_storm_and_recovers_one_head` | Add multi-endpoint recovery traces and a real scheduler-clock integration test. |
+| Fairness/rate limits | Tenant round-robin plus tenant and endpoint spacing admits a healthy tenant while another tenant is rate-limited. | Medium | Medium-high; synthetic traces only | `cargo test -p webhook-scheduler tenant_rate_limit_does_not_starve_another_tenant` | Run generated traces at the stated 10,000-tenant/500-endpoint shape and record tail percentiles. |
+| Determinism | Identical timestamp/outcome traces produce identical observations and stable jitter deadlines. | Low | High | `cargo test -p webhook-scheduler identical_trace_is_deterministic` | Add a serialized trace corpus and cross-process replay comparison. |
+| Tail latency | The stated four-worker fixture improves the healthy tenant from 60,000 ms modeled baseline tail latency to 0 ms. | Medium | High for the fixture, low for production | `cargo run --release -p webhook-scheduler -- --repeat 1000` | Benchmark a faithful baseline implementation and production-shaped traces in release mode. |
+| Retry cap | Reviewer reproduced jitter exceeding the configured retry cap; coordinator fixed the hard-cap calculation and added a regression. | High before fix; low after fix | High | `cargo test -p webhook-scheduler retry_jitter_respects_hard_cap` | Keep the post-jitter hard-cap regression and define the cap in the production contract. |
+| BogKit fit | Public Fold examples show durable incremental views, but not timer/lease/side-effect scheduling. | Medium | High from public discovery | See `discovery.md` and the ordered commands there. | Revisit only after a storage adapter and external-effect acknowledgment boundary are specified. |
+| Production boundary | No HTTP, PostgreSQL, process-level durability, payload memory pressure, auth, or 200,000 events/hour load was exercised. | High | High | The package README and this record state the boundary. | Build a separate integration trial before production adoption. |
diff --git a/developer-simulation/runs/2026-08-07--webhook-scheduler/evidence/verification.md b/developer-simulation/runs/2026-08-07--webhook-scheduler/evidence/verification.md
new file mode 100644
index 0000000..9ff9cef
--- /dev/null
+++ b/developer-simulation/runs/2026-08-07--webhook-scheduler/evidence/verification.md
@@ -0,0 +1,31 @@
+# Verification record
+
+All commands below were run from the sanitized current-main checkout after the
+prototype was written. The workspace's pre-existing `examples/search` source
+is not formatted by this trial; package-scoped formatting was used so the
+trial did not rewrite unrelated files.
+
+## Checks
+
+| Check | Command | Observed result |
+| --- | --- | --- |
+| Focused formatting | `cargo fmt --package webhook-scheduler -- --check` | exit 0 |
+| Strict lint | `cargo clippy -p webhook-scheduler --all-targets -- -D warnings` | exit 0, no warnings |
+| Debug tests | `cargo test -p webhook-scheduler` | 8 passed, 0 failed |
+| Release tests | `cargo test --release -p webhook-scheduler` | 8 passed, 0 failed |
+| Repeated release demo | `cargo run --release -p webhook-scheduler -- --repeat 1000` | completed; 1,000 repetitions |
+
+## Demonstration output
+
+The final release demonstration reported:
+
+```text
+baseline_healthy_p99_ms=60000 prototype_healthy_p99_ms=0 improvement_ms=60000
+noisy_endpoint_occupancy_max=8 budget=8 healthy_status=Delivered
+outage_attempts_before_recovery=1 retry_times_ms=[0] retry_deadlines_ms=[1071] first_retry_at_ms=1071 recovery_send_at_ms=3600000 recovered_active=1 final_status=Delivered
+crash_old_attempt=1 crash_retry_attempt=2 attempts=2 final_status=Delivered ignored_old_outcome=1
+repeat_count=1000 elapsed_us=15193 mode=release-recommended
+```
+
+The elapsed time is a harness repeat time, not a throughput claim. Payload
+bytes are represented in the event contract but are not allocated or sent.
diff --git a/developer-simulation/runs/2026-08-07--webhook-scheduler/src/lib.rs b/developer-simulation/runs/2026-08-07--webhook-scheduler/src/lib.rs
new file mode 100644
index 0000000..f426277
--- /dev/null
+++ b/developer-simulation/runs/2026-08-07--webhook-scheduler/src/lib.rs
@@ -0,0 +1,1040 @@
+//! A deterministic, in-memory webhook delivery scheduler prototype.
+//!
+//! This is a scheduler state machine, not an HTTP client or a database
+//! adapter. A caller supplies timestamped inputs and HTTP outcomes; the
+//! scheduler returns durable send decisions, retry deadlines, statuses, and
+//! metrics. The durable snapshot is cloned in memory so crash/restart behavior
+//! can be exercised without pretending that this is PostgreSQL persistence.
+
+use std::collections::{BTreeMap, VecDeque};
+
+pub type EventId = u64;
+pub type TenantId = u16;
+pub type EndpointId = u16;
+pub type AttemptId = u64;
+pub type TimestampMs = u64;
+
+#[derive(Clone, Debug, Eq, PartialEq)]
+pub struct Event {
+    pub id: EventId,
+    pub tenant_id: TenantId,
+    pub endpoint_id: EndpointId,
+    pub created_at_ms: TimestampMs,
+    pub ttl_ms: TimestampMs,
+    pub payload_bytes: usize,
+    pub retryable: bool,
+}
+
+impl Event {
+    pub fn expires_at_ms(&self) -> TimestampMs {
+        self.created_at_ms.saturating_add(self.ttl_ms)
+    }
+}
+
+#[derive(Clone, Copy, Debug, Eq, Ord, PartialEq, PartialOrd)]
+pub enum DeliveryStatus {
+    Pending,
+    InFlight,
+    RetryScheduled,
+    Delivered,
+    NonRetryableFailed,
+    Expired,
+    DeadLettered,
+}
+
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+pub enum HttpOutcome {
+    Success,
+    RetryableFailure,
+    NonRetryableFailure,
+}
+
+#[derive(Clone, Debug, Eq, PartialEq)]
+pub struct Delivery {
+    pub event: Event,
+    pub status: DeliveryStatus,
+    pub attempt_count: u32,
+    pub retry_at_ms: Option<TimestampMs>,
+    pub delivered_at_ms: Option<TimestampMs>,
+}
+
+#[derive(Clone, Debug, Eq, PartialEq)]
+pub struct SchedulerConfig {
+    pub worker_limit: usize,
+    pub per_endpoint_in_flight_limit: usize,
+    pub per_tenant_in_flight_limit: usize,
+    pub endpoint_min_interval_ms: TimestampMs,
+    pub tenant_min_interval_ms: TimestampMs,
+    pub retry_base_ms: TimestampMs,
+    pub retry_cap_ms: TimestampMs,
+    pub max_attempts: u32,
+    pub endpoint_queue_budget: usize,
+}
+
+impl Default for SchedulerConfig {
+    fn default() -> Self {
+        Self {
+            worker_limit: 32,
+            per_endpoint_in_flight_limit: 1,
+            per_tenant_in_flight_limit: 2,
+            endpoint_min_interval_ms: 100,
+            tenant_min_interval_ms: 100,
+            retry_base_ms: 1_000,
+            retry_cap_ms: 300_000,
+            max_attempts: 20,
+            endpoint_queue_budget: 64,
+        }
+    }
+}
+
+#[derive(Clone, Debug, Eq, PartialEq)]
+pub enum EnqueueResult {
+    Queued,
+    DeadLetteredQueueBudget,
+    RejectedDuplicate,
+    RejectedUnknownEndpoint,
+}
+
+#[derive(Clone, Debug, Eq, PartialEq)]
+pub enum Observation {
+    SendDecision {
+        attempt_id: AttemptId,
+        event_id: EventId,
+        tenant_id: TenantId,
+        endpoint_id: EndpointId,
+        attempt: u32,
+        at_ms: TimestampMs,
+    },
+    RetryScheduled {
+        event_id: EventId,
+        attempt: u32,
+        at_ms: TimestampMs,
+        retry_at_ms: TimestampMs,
+    },
+    StatusChanged {
+        event_id: EventId,
+        status: DeliveryStatus,
+        at_ms: TimestampMs,
+    },
+    IgnoredOutcome {
+        attempt_id: AttemptId,
+        at_ms: TimestampMs,
+    },
+}
+
+#[derive(Clone, Debug, Eq, PartialEq)]
+pub enum TraceEvent {
+    Enqueue {
+        at_ms: TimestampMs,
+        event: Event,
+    },
+    Advance {
+        at_ms: TimestampMs,
+    },
+    EndpointAvailability {
+        at_ms: TimestampMs,
+        endpoint_id: EndpointId,
+        available: bool,
+    },
+    HttpOutcome {
+        at_ms: TimestampMs,
+        attempt_id: AttemptId,
+        outcome: HttpOutcome,
+    },
+    WorkerCrash {
+        at_ms: TimestampMs,
+    },
+    WorkerRestart {
+        at_ms: TimestampMs,
+    },
+}
+
+#[derive(Clone, Debug, Default, Eq, PartialEq)]
+pub struct Metrics {
+    pub sends: usize,
+    pub delivered: usize,
+    pub requeued_after_crash: usize,
+    pub ignored_outcomes: usize,
+    pub max_endpoint_occupancy: BTreeMap<EndpointId, usize>,
+    pub delivery_latency_ms: BTreeMap<TenantId, Vec<TimestampMs>>,
+    pub current_status_counts: BTreeMap<DeliveryStatus, usize>,
+}
+
+impl Metrics {
+    pub fn p99_latency_ms(&self, tenant_id: TenantId) -> Option<TimestampMs> {
+        let values = self.delivery_latency_ms.get(&tenant_id)?;
+        if values.is_empty() {
+            return None;
+        }
+        let mut sorted = values.clone();
+        sorted.sort_unstable();
+        let index = (sorted.len() * 99).div_ceil(100).saturating_sub(1);
+        sorted.get(index).copied()
+    }
+}
+
+#[derive(Clone, Debug)]
+struct EndpointState {
+    available: bool,
+    next_send_at_ms: TimestampMs,
+    in_flight: usize,
+    queue: VecDeque<EventId>,
+}
+
+impl Default for EndpointState {
+    fn default() -> Self {
+        Self {
+            available: true,
+            next_send_at_ms: 0,
+            in_flight: 0,
+            queue: VecDeque::new(),
+        }
+    }
+}
+
+#[derive(Clone, Debug, Default)]
+struct TenantState {
+    next_send_at_ms: TimestampMs,
+    in_flight: usize,
+}
+
+#[derive(Clone, Debug)]
+struct InFlight {
+    event_id: EventId,
+    tenant_id: TenantId,
+    endpoint_id: EndpointId,
+}
+
+#[derive(Clone, Debug)]
+struct DurableState {
+    now_ms: TimestampMs,
+    deliveries: BTreeMap<EventId, Delivery>,
+    endpoints: BTreeMap<EndpointId, EndpointState>,
+    tenants: BTreeMap<TenantId, TenantState>,
+    in_flight: BTreeMap<AttemptId, InFlight>,
+    next_attempt_id: AttemptId,
+    rr_cursor: usize,
+}
+
+#[derive(Clone, Debug)]
+pub struct Scheduler {
+    config: SchedulerConfig,
+    now_ms: TimestampMs,
+    worker_running: bool,
+    deliveries: BTreeMap<EventId, Delivery>,
+    endpoints: BTreeMap<EndpointId, EndpointState>,
+    tenants: BTreeMap<TenantId, TenantState>,
+    in_flight: BTreeMap<AttemptId, InFlight>,
+    next_attempt_id: AttemptId,
+    rr_cursor: usize,
+    durable: DurableState,
+    observations: Vec<Observation>,
+    metrics: Metrics,
+}
+
+impl Scheduler {
+    pub fn new(
+        config: SchedulerConfig,
+        tenant_ids: impl IntoIterator<Item = TenantId>,
+        endpoint_ids: impl IntoIterator<Item = EndpointId>,
+    ) -> Self {
+        let tenants = tenant_ids
+            .into_iter()
+            .map(|id| (id, TenantState::default()))
+            .collect();
+        let endpoints = endpoint_ids
+            .into_iter()
+            .map(|id| (id, EndpointState::default()))
+            .collect();
+        let mut scheduler = Self {
+            config,
+            now_ms: 0,
+            worker_running: true,
+            deliveries: BTreeMap::new(),
+            endpoints,
+            tenants,
+            in_flight: BTreeMap::new(),
+            next_attempt_id: 1,
+            rr_cursor: 0,
+            durable: DurableState {
+                now_ms: 0,
+                deliveries: BTreeMap::new(),
+                endpoints: BTreeMap::new(),
+                tenants: BTreeMap::new(),
+                in_flight: BTreeMap::new(),
+                next_attempt_id: 1,
+                rr_cursor: 0,
+            },
+            observations: Vec::new(),
+            metrics: Metrics::default(),
+        };
+        scheduler.persist();
+        scheduler
+    }
+
+    pub fn now_ms(&self) -> TimestampMs {
+        self.now_ms
+    }
+
+    pub fn metrics(&self) -> &Metrics {
+        &self.metrics
+    }
+
+    pub fn delivery(&self, event_id: EventId) -> Option<&Delivery> {
+        self.deliveries.get(&event_id)
+    }
+
+    pub fn queue_depth(&self, endpoint_id: EndpointId) -> usize {
+        self.endpoints
+            .get(&endpoint_id)
+            // The queue retains its head while that event is in flight. This
+            // makes the ordering invariant directly inspectable and counts a
+            // leased head exactly once for the endpoint budget.
+            .map_or(0, |endpoint| endpoint.queue.len())
+    }
+
+    pub fn active_attempt_ids(&self) -> Vec<AttemptId> {
+        self.in_flight.keys().copied().collect()
+    }
+
+    pub fn take_observations(&mut self) -> Vec<Observation> {
+        std::mem::take(&mut self.observations)
+    }
+
+    pub fn enqueue(&mut self, event: Event) -> EnqueueResult {
+        self.assert_event_time(&event);
+        self.expire_queued();
+        if !self.endpoints.contains_key(&event.endpoint_id) {
+            return EnqueueResult::RejectedUnknownEndpoint;
+        }
+        if self.deliveries.contains_key(&event.id) {
+            return EnqueueResult::RejectedDuplicate;
+        }
+
+        let delivery = Delivery {
+            event: event.clone(),
+            status: DeliveryStatus::Pending,
+            attempt_count: 0,
+            retry_at_ms: None,
+            delivered_at_ms: None,
+        };
+        self.deliveries.insert(event.id, delivery);
+        self.increment_status(DeliveryStatus::Pending);
+
+        let occupancy = self.queue_depth(event.endpoint_id);
+        if occupancy >= self.config.endpoint_queue_budget {
+            self.transition(event.id, DeliveryStatus::DeadLettered);
+            self.persist();
+            return EnqueueResult::DeadLetteredQueueBudget;
+        }
+
+        self.endpoints
+            .get_mut(&event.endpoint_id)
+            .expect("endpoint checked above")
+            .queue
+            .push_back(event.id);
+        self.record_occupancy(event.endpoint_id);
+        self.observations.push(Observation::StatusChanged {
+            event_id: event.id,
+            status: DeliveryStatus::Pending,
+            at_ms: self.now_ms,
+        });
+        self.persist();
+        self.dispatch();
+        EnqueueResult::Queued
+    }
+
+    pub fn advance_to(&mut self, at_ms: TimestampMs) {
+        assert!(
+            at_ms >= self.now_ms,
+            "timestamps must be non-decreasing: {} then {}",
+            self.now_ms,
+            at_ms
+        );
+        self.now_ms = at_ms;
+        self.expire_queued();
+        self.dispatch();
+    }
+
+    pub fn set_endpoint_available(&mut self, endpoint_id: EndpointId, available: bool) {
+        if let Some(endpoint) = self.endpoints.get_mut(&endpoint_id) {
+            endpoint.available = available;
+            self.persist();
+            self.dispatch();
+        }
+    }
+
+    pub fn on_outcome(&mut self, attempt_id: AttemptId, outcome: HttpOutcome) {
+        let Some(attempt) = self.in_flight.remove(&attempt_id) else {
+            self.metrics.ignored_outcomes += 1;
+            self.observations.push(Observation::IgnoredOutcome {
+                attempt_id,
+                at_ms: self.now_ms,
+            });
+            return;
+        };
+
+        if let Some(endpoint) = self.endpoints.get_mut(&attempt.endpoint_id) {
+            endpoint.in_flight = endpoint.in_flight.saturating_sub(1);
+        }
+        if let Some(tenant) = self.tenants.get_mut(&attempt.tenant_id) {
+            tenant.in_flight = tenant.in_flight.saturating_sub(1);
+        }
+
+        let event = self
+            .deliveries
+            .get(&attempt.event_id)
+            .expect("in-flight attempt has a delivery")
+            .event
+            .clone();
+        let status = match outcome {
+            HttpOutcome::Success => DeliveryStatus::Delivered,
+            HttpOutcome::NonRetryableFailure => DeliveryStatus::NonRetryableFailed,
+            HttpOutcome::RetryableFailure if !event.retryable => DeliveryStatus::NonRetryableFailed,
+            HttpOutcome::RetryableFailure if self.now_ms >= event.expires_at_ms() => {
+                DeliveryStatus::Expired
+            }
+            HttpOutcome::RetryableFailure => {
+                let attempt_count = self
+                    .deliveries
+                    .get(&attempt.event_id)
+                    .expect("delivery still exists")
+                    .attempt_count;
+                if attempt_count >= self.config.max_attempts {
+                    DeliveryStatus::DeadLettered
+                } else {
+                    let retry_at_ms = self
+                        .now_ms
+                        .saturating_add(self.retry_delay_ms(event.id, attempt_count));
+                    if let Some(delivery) = self.deliveries.get_mut(&event.id) {
+                        delivery.retry_at_ms = Some(retry_at_ms);
+                    }
+                    self.transition(event.id, DeliveryStatus::RetryScheduled);
+                    self.observations.push(Observation::RetryScheduled {
+                        event_id: event.id,
+                        attempt: attempt_count,
+                        at_ms: self.now_ms,
+                        retry_at_ms,
+                    });
+                    self.record_occupancy(event.endpoint_id);
+                    self.persist();
+                    self.dispatch();
+                    return;
+                }
+            }
+        };
+
+        if let Some(endpoint) = self.endpoints.get_mut(&attempt.endpoint_id) {
+            let removed = endpoint.queue.pop_front();
+            assert_eq!(
+                removed,
+                Some(attempt.event_id),
+                "endpoint order was violated"
+            );
+        }
+        self.record_occupancy(attempt.endpoint_id);
+
+        if status == DeliveryStatus::Delivered
+            && let Some(delivery) = self.deliveries.get_mut(&event.id)
+        {
+            delivery.delivered_at_ms = Some(self.now_ms);
+            self.metrics.delivered += 1;
+            self.metrics
+                .delivery_latency_ms
+                .entry(event.tenant_id)
+                .or_default()
+                .push(self.now_ms.saturating_sub(event.created_at_ms));
+        }
+        self.transition(event.id, status);
+        self.persist();
+        self.dispatch();
+    }
+
+    /// Persisted in-flight leases are requeued on restart. An outcome that
+    /// arrives for the old attempt is ignored, modeling at-least-once retry
+    /// after a crash before the acknowledgement was durably recorded.
+    pub fn crash(&mut self) {
+        let durable = self.durable.clone();
+        self.restore(durable);
+        self.worker_running = false;
+    }
+
+    pub fn restart(&mut self) {
+        let durable = self.durable.clone();
+        self.restore(durable);
+        self.worker_running = true;
+        self.requeue_in_flight();
+        self.persist();
+        self.dispatch();
+    }
+
+    pub fn apply(&mut self, event: TraceEvent) {
+        let at_ms = match &event {
+            TraceEvent::Enqueue { at_ms, .. }
+            | TraceEvent::Advance { at_ms }
+            | TraceEvent::EndpointAvailability { at_ms, .. }
+            | TraceEvent::HttpOutcome { at_ms, .. }
+            | TraceEvent::WorkerCrash { at_ms }
+            | TraceEvent::WorkerRestart { at_ms } => *at_ms,
+        };
+        self.advance_to(at_ms);
+        match event {
+            TraceEvent::Enqueue { event, .. } => {
+                self.enqueue(event);
+            }
+            TraceEvent::Advance { .. } => {}
+            TraceEvent::EndpointAvailability {
+                endpoint_id,
+                available,
+                ..
+            } => self.set_endpoint_available(endpoint_id, available),
+            TraceEvent::HttpOutcome {
+                attempt_id,
+                outcome,
+                ..
+            } => self.on_outcome(attempt_id, outcome),
+            TraceEvent::WorkerCrash { .. } => self.crash(),
+            TraceEvent::WorkerRestart { .. } => self.restart(),
+        }
+    }
+
+    fn dispatch(&mut self) {
+        if !self.worker_running {
+            return;
+        }
+        self.expire_queued();
+        loop {
+            if self.in_flight.len() >= self.config.worker_limit {
+                return;
+            }
+            let tenant_ids: Vec<_> = self.tenants.keys().copied().collect();
+            if tenant_ids.is_empty() {
+                return;
+            }
+            let mut chosen = None;
+            for offset in 0..tenant_ids.len() {
+                let index = (self.rr_cursor + offset) % tenant_ids.len();
+                let tenant_id = tenant_ids[index];
+                let tenant = self.tenants.get(&tenant_id).expect("tenant id from map");
+                if tenant.in_flight >= self.config.per_tenant_in_flight_limit
+                    || self.now_ms < tenant.next_send_at_ms
+                {
+                    continue;
+                }
+                for (endpoint_id, endpoint) in &self.endpoints {
+                    if !endpoint.available
+                        || endpoint.in_flight >= self.config.per_endpoint_in_flight_limit
+                        || self.now_ms < endpoint.next_send_at_ms
+                    {
+                        continue;
+                    }
+                    let Some(event_id) = endpoint.queue.front() else {
+                        continue;
+                    };
+                    let delivery = self
+                        .deliveries
+                        .get(event_id)
+                        .expect("queued delivery exists");
+                    if delivery.event.tenant_id != tenant_id
+                        || !matches!(
+                            delivery.status,
+                            DeliveryStatus::Pending | DeliveryStatus::RetryScheduled
+                        )
+                        || delivery
+                            .retry_at_ms
+                            .is_some_and(|retry_at| retry_at > self.now_ms)
+                    {
+                        continue;
+                    }
+                    chosen = Some((index, tenant_id, *endpoint_id, *event_id));
+                    break;
+                }
+                if chosen.is_some() {
+                    break;
+                }
+            }
+            let Some((tenant_index, tenant_id, endpoint_id, event_id)) = chosen else {
+                return;
+            };
+            self.dispatch_one(tenant_index, tenant_id, endpoint_id, event_id);
+        }
+    }
+
+    fn dispatch_one(
+        &mut self,
+        tenant_index: usize,
+        tenant_id: TenantId,
+        endpoint_id: EndpointId,
+        event_id: EventId,
+    ) {
+        assert_eq!(
+            self.endpoints
+                .get(&endpoint_id)
+                .and_then(|endpoint| endpoint.queue.front())
+                .copied(),
+            Some(event_id),
+            "dispatch must use the endpoint head"
+        );
+
+        let attempt = {
+            let delivery = self.deliveries.get_mut(&event_id).expect("delivery exists");
+            delivery.attempt_count += 1;
+            delivery.retry_at_ms = None;
+            delivery.attempt_count
+        };
+        self.transition(event_id, DeliveryStatus::InFlight);
+        let attempt_id = self.next_attempt_id;
+        self.next_attempt_id += 1;
+        self.in_flight.insert(
+            attempt_id,
+            InFlight {
+                event_id,
+                tenant_id,
+                endpoint_id,
+            },
+        );
+        let endpoint = self
+            .endpoints
+            .get_mut(&endpoint_id)
+            .expect("endpoint candidate exists");
+        endpoint.in_flight += 1;
+        endpoint.next_send_at_ms = self
+            .now_ms
+            .saturating_add(self.config.endpoint_min_interval_ms);
+        let tenant = self.tenants.get_mut(&tenant_id).expect("tenant exists");
+        tenant.in_flight += 1;
+        tenant.next_send_at_ms = self
+            .now_ms
+            .saturating_add(self.config.tenant_min_interval_ms);
+        self.rr_cursor = (tenant_index + 1) % self.tenants.len().max(1);
+        self.metrics.sends += 1;
+        self.record_occupancy(endpoint_id);
+        self.observations.push(Observation::SendDecision {
+            attempt_id,
+            event_id,
+            tenant_id,
+            endpoint_id,
+            attempt,
+            at_ms: self.now_ms,
+        });
+        // The lease is durable before the caller can perform the external send.
+        self.persist();
+    }
+
+    fn expire_queued(&mut self) {
+        let mut expired = Vec::new();
+        for endpoint in self.endpoints.values() {
+            for event_id in &endpoint.queue {
+                let delivery = self
+                    .deliveries
+                    .get(event_id)
+                    .expect("queued delivery exists");
+                if delivery.event.expires_at_ms() <= self.now_ms
+                    && matches!(
+                        delivery.status,
+                        DeliveryStatus::Pending | DeliveryStatus::RetryScheduled
+                    )
+                {
+                    expired.push((*event_id, delivery.event.endpoint_id));
+                }
+            }
+        }
+        let had_expired = !expired.is_empty();
+        for (event_id, endpoint_id) in expired {
+            if let Some(endpoint) = self.endpoints.get_mut(&endpoint_id) {
+                endpoint.queue.retain(|queued| *queued != event_id);
+            }
+            self.record_occupancy(endpoint_id);
+            if let Some(delivery) = self.deliveries.get_mut(&event_id) {
+                delivery.retry_at_ms = None;
+            }
+            self.transition(event_id, DeliveryStatus::Expired);
+        }
+        if had_expired {
+            self.persist();
+        }
+    }
+
+    fn requeue_in_flight(&mut self) {
+        let attempts: Vec<_> = self.in_flight.values().cloned().collect();
+        self.in_flight.clear();
+        for attempt in attempts {
+            if let Some(endpoint) = self.endpoints.get_mut(&attempt.endpoint_id) {
+                endpoint.in_flight = endpoint.in_flight.saturating_sub(1);
+            }
+            if let Some(tenant) = self.tenants.get_mut(&attempt.tenant_id) {
+                tenant.in_flight = tenant.in_flight.saturating_sub(1);
+            }
+            if let Some(delivery) = self.deliveries.get_mut(&attempt.event_id) {
+                delivery.retry_at_ms = None;
+            }
+            self.transition(attempt.event_id, DeliveryStatus::Pending);
+            self.metrics.requeued_after_crash += 1;
+            self.record_occupancy(attempt.endpoint_id);
+        }
+    }
+
+    fn retry_delay_ms(&self, event_id: EventId, attempt: u32) -> TimestampMs {
+        let exponent = attempt.saturating_sub(1).min(20);
+        let exponential = self.config.retry_base_ms.saturating_mul(1u64 << exponent);
+        let capped = exponential.min(self.config.retry_cap_ms);
+        // Stable event/attempt jitter spreads tenants without using a random
+        // source, making replay and tests byte-for-byte deterministic.
+        let jitter_window = (capped / 10).max(1);
+        let jitter = stable_mix(event_id ^ u64::from(attempt)) % jitter_window;
+        capped.saturating_add(jitter).min(self.config.retry_cap_ms)
+    }
+
+    fn assert_event_time(&self, event: &Event) {
+        assert!(
+            event.created_at_ms <= self.now_ms,
+            "event creation time cannot be in the future"
+        );
+    }
+
+    fn transition(&mut self, event_id: EventId, status: DeliveryStatus) {
+        let Some(old) = self
+            .deliveries
+            .get(&event_id)
+            .map(|delivery| delivery.status)
+        else {
+            return;
+        };
+        if old == status {
+            return;
+        }
+        self.decrement_status(old);
+        self.increment_status(status);
+        if let Some(delivery) = self.deliveries.get_mut(&event_id) {
+            delivery.status = status;
+        }
+        self.observations.push(Observation::StatusChanged {
+            event_id,
+            status,
+            at_ms: self.now_ms,
+        });
+    }
+
+    fn increment_status(&mut self, status: DeliveryStatus) {
+        *self
+            .metrics
+            .current_status_counts
+            .entry(status)
+            .or_default() += 1;
+    }
+
+    fn decrement_status(&mut self, status: DeliveryStatus) {
+        if let Some(count) = self.metrics.current_status_counts.get_mut(&status) {
+            *count = count.saturating_sub(1);
+        }
+    }
+
+    fn record_occupancy(&mut self, endpoint_id: EndpointId) {
+        let occupancy = self.queue_depth(endpoint_id);
+        let max = self
+            .metrics
+            .max_endpoint_occupancy
+            .entry(endpoint_id)
+            .or_default();
+        *max = (*max).max(occupancy);
+    }
+
+    fn persist(&mut self) {
+        self.durable = DurableState {
+            now_ms: self.now_ms,
+            deliveries: self.deliveries.clone(),
+            endpoints: self.endpoints.clone(),
+            tenants: self.tenants.clone(),
+            in_flight: self.in_flight.clone(),
+            next_attempt_id: self.next_attempt_id,
+            rr_cursor: self.rr_cursor,
+        };
+    }
+
+    fn restore(&mut self, durable: DurableState) {
+        self.now_ms = durable.now_ms;
+        self.deliveries = durable.deliveries;
+        self.endpoints = durable.endpoints;
+        self.tenants = durable.tenants;
+        self.in_flight = durable.in_flight;
+        self.next_attempt_id = durable.next_attempt_id;
+        self.rr_cursor = durable.rr_cursor;
+    }
+}
+
+fn stable_mix(mut value: u64) -> u64 {
+    value ^= value >> 30;
+    value = value.wrapping_mul(0xbf58_476d_1ce4_e5b9);
+    value ^= value >> 27;
+    value = value.wrapping_mul(0x94d0_49bb_1331_11eb);
+    value ^ (value >> 31)
+}
+
+/// A deliberately small comparison model for the stated fixed-queue pain:
+/// a single slow endpoint may occupy every worker while its requests wait for
+/// a timeout. It is not a claim about a particular production implementation;
+/// it makes the acceptance comparison explicit and repeatable.
+pub fn baseline_healthy_tail_latency_ms(
+    worker_limit: usize,
+    noisy_endpoint_events: usize,
+    slow_response_ms: TimestampMs,
+) -> TimestampMs {
+    if worker_limit > 0 && noisy_endpoint_events >= worker_limit {
+        slow_response_ms
+    } else {
+        0
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn config() -> SchedulerConfig {
+        SchedulerConfig {
+            worker_limit: 4,
+            per_endpoint_in_flight_limit: 1,
+            per_tenant_in_flight_limit: 1,
+            endpoint_min_interval_ms: 0,
+            tenant_min_interval_ms: 0,
+            retry_base_ms: 1_000,
+            retry_cap_ms: 60_000,
+            max_attempts: 3,
+            endpoint_queue_budget: 8,
+        }
+    }
+
+    fn event(
+        id: EventId,
+        tenant_id: TenantId,
+        endpoint_id: EndpointId,
+        ttl_ms: TimestampMs,
+        retryable: bool,
+    ) -> Event {
+        Event {
+            id,
+            tenant_id,
+            endpoint_id,
+            created_at_ms: 0,
+            ttl_ms,
+            payload_bytes: 1024,
+            retryable,
+        }
+    }
+
+    fn scheduler() -> Scheduler {
+        Scheduler::new(config(), [1, 2, 3], [10, 20, 30])
+    }
+
+    #[test]
+    fn endpoint_order_is_preserved_across_retry() {
+        let mut scheduler = scheduler();
+        assert_eq!(
+            scheduler.enqueue(event(1, 1, 10, 10_000, true)),
+            EnqueueResult::Queued
+        );
+        let first = scheduler.active_attempt_ids()[0];
+        assert_eq!(
+            scheduler.enqueue(event(2, 1, 10, 10_000, true)),
+            EnqueueResult::Queued
+        );
+        assert_eq!(scheduler.active_attempt_ids(), vec![first]);
+
+        scheduler.on_outcome(first, HttpOutcome::RetryableFailure);
+        assert_eq!(
+            scheduler.delivery(1).unwrap().status,
+            DeliveryStatus::RetryScheduled
+        );
+        assert!(scheduler.active_attempt_ids().is_empty());
+        scheduler.advance_to(scheduler.delivery(1).unwrap().retry_at_ms.unwrap());
+        let retry = scheduler.active_attempt_ids()[0];
+        assert_eq!(scheduler.delivery(1).unwrap().attempt_count, 2);
+        assert_eq!(
+            scheduler.delivery(2).unwrap().status,
+            DeliveryStatus::Pending
+        );
+        scheduler.on_outcome(retry, HttpOutcome::Success);
+        assert_eq!(
+            scheduler.delivery(1).unwrap().status,
+            DeliveryStatus::Delivered
+        );
+        assert_eq!(scheduler.active_attempt_ids().len(), 1);
+        let second = scheduler.active_attempt_ids()[0];
+        assert_eq!(scheduler.delivery(2).unwrap().attempt_count, 1);
+        scheduler.on_outcome(second, HttpOutcome::Success);
+        assert_eq!(
+            scheduler.delivery(2).unwrap().status,
+            DeliveryStatus::Delivered
+        );
+    }
+
+    #[test]
+    fn noisy_endpoint_is_bounded_and_healthy_tenant_is_admitted() {
+        let mut scheduler = scheduler();
+        for id in 1..=8 {
+            assert_eq!(
+                scheduler.enqueue(event(id, 1, 10, 3_600_000, true)),
+                EnqueueResult::Queued
+            );
+        }
+        assert_eq!(
+            scheduler.enqueue(event(100, 2, 20, 3_600_000, true)),
+            EnqueueResult::Queued
+        );
+        assert_eq!(scheduler.active_attempt_ids().len(), 2);
+        let healthy = scheduler.delivery(100).unwrap();
+        assert_eq!(healthy.status, DeliveryStatus::InFlight);
+        assert_eq!(scheduler.queue_depth(10), 8);
+        assert_eq!(scheduler.metrics().max_endpoint_occupancy[&10], 8);
+        assert_eq!(baseline_healthy_tail_latency_ms(4, 4, 60_000), 60_000);
+    }
+
+    #[test]
+    fn crash_requeues_unacknowledged_lease_and_old_outcome_is_ignored() {
+        let mut scheduler = scheduler();
+        scheduler.enqueue(event(1, 1, 10, 10_000, true));
+        let old_attempt = scheduler.active_attempt_ids()[0];
+        scheduler.crash();
+        scheduler.restart();
+        let new_attempt = scheduler.active_attempt_ids()[0];
+        assert_ne!(old_attempt, new_attempt);
+        assert_eq!(scheduler.delivery(1).unwrap().attempt_count, 2);
+        scheduler.on_outcome(old_attempt, HttpOutcome::Success);
+        assert_eq!(
+            scheduler.delivery(1).unwrap().status,
+            DeliveryStatus::InFlight
+        );
+        scheduler.on_outcome(new_attempt, HttpOutcome::Success);
+        assert_eq!(
+            scheduler.delivery(1).unwrap().status,
+            DeliveryStatus::Delivered
+        );
+        assert_eq!(scheduler.metrics().requeued_after_crash, 1);
+        assert_eq!(scheduler.metrics().ignored_outcomes, 1);
+    }
+
+    #[test]
+    fn failure_classes_are_distinct() {
+        let mut scheduler = scheduler();
+        scheduler.enqueue(event(1, 1, 10, 10_000, false));
+        let attempt = scheduler.active_attempt_ids()[0];
+        scheduler.on_outcome(attempt, HttpOutcome::NonRetryableFailure);
+        assert_eq!(
+            scheduler.delivery(1).unwrap().status,
+            DeliveryStatus::NonRetryableFailed
+        );
+
+        scheduler.enqueue(event(2, 1, 20, 100, true));
+        let attempt = scheduler.active_attempt_ids()[0];
+        scheduler.advance_to(100);
+        scheduler.on_outcome(attempt, HttpOutcome::RetryableFailure);
+        assert_eq!(
+            scheduler.delivery(2).unwrap().status,
+            DeliveryStatus::Expired
+        );
+
+        scheduler.enqueue(event(3, 1, 30, 10_000, true));
+        let first = scheduler.active_attempt_ids()[0];
+        scheduler.on_outcome(first, HttpOutcome::RetryableFailure);
+        scheduler.advance_to(scheduler.delivery(3).unwrap().retry_at_ms.unwrap());
+        let second = scheduler.active_attempt_ids()[0];
+        scheduler.on_outcome(second, HttpOutcome::RetryableFailure);
+        scheduler.advance_to(scheduler.delivery(3).unwrap().retry_at_ms.unwrap());
+        let third = scheduler.active_attempt_ids()[0];
+        scheduler.on_outcome(third, HttpOutcome::RetryableFailure);
+        assert_eq!(
+            scheduler.delivery(3).unwrap().status,
+            DeliveryStatus::DeadLettered
+        );
+    }
+
+    #[test]
+    fn tenant_rate_limit_does_not_starve_another_tenant() {
+        let mut scheduler = Scheduler::new(
+            SchedulerConfig {
+                tenant_min_interval_ms: 1_000,
+                ..config()
+            },
+            [1, 2],
+            [10, 20, 30],
+        );
+        scheduler.enqueue(event(1, 1, 10, 10_000, true));
+        scheduler.enqueue(event(2, 1, 20, 10_000, true));
+        scheduler.enqueue(event(3, 2, 30, 10_000, true));
+        let active = scheduler.active_attempt_ids();
+        assert_eq!(active.len(), 2);
+        assert_eq!(
+            scheduler.delivery(1).unwrap().status,
+            DeliveryStatus::InFlight
+        );
+        assert_eq!(
+            scheduler.delivery(3).unwrap().status,
+            DeliveryStatus::InFlight
+        );
+        assert_eq!(
+            scheduler.delivery(2).unwrap().status,
+            DeliveryStatus::Pending
+        );
+        for attempt in active {
+            scheduler.on_outcome(attempt, HttpOutcome::Success);
+        }
+        scheduler.advance_to(1_000);
+        assert_eq!(
+            scheduler.delivery(2).unwrap().status,
+            DeliveryStatus::InFlight
+        );
+    }
+
+    #[test]
+    fn one_hour_outage_has_no_retry_storm_and_recovers_one_head() {
+        let mut scheduler = scheduler();
+        scheduler.enqueue(event(1, 1, 10, 7_200_000, true));
+        let first = scheduler.active_attempt_ids()[0];
+        scheduler.set_endpoint_available(10, false);
+        scheduler.on_outcome(first, HttpOutcome::RetryableFailure);
+        let retry_at = scheduler.delivery(1).unwrap().retry_at_ms.unwrap();
+        scheduler.advance_to(3_600_000);
+        assert!(scheduler.active_attempt_ids().is_empty());
+        assert_eq!(scheduler.delivery(1).unwrap().attempt_count, 1);
+        scheduler.set_endpoint_available(10, true);
+        assert_eq!(scheduler.active_attempt_ids().len(), 1);
+        let recovered = scheduler.active_attempt_ids()[0];
+        assert!(retry_at < scheduler.now_ms());
+        scheduler.on_outcome(recovered, HttpOutcome::Success);
+        assert_eq!(
+            scheduler.delivery(1).unwrap().status,
+            DeliveryStatus::Delivered
+        );
+    }
+
+    #[test]
+    fn identical_trace_is_deterministic() {
+        fn run() -> Vec<Observation> {
+            let mut scheduler = scheduler();
+            scheduler.apply(TraceEvent::Enqueue {
+                at_ms: 0,
+                event: event(1, 1, 10, 10_000, true),
+            });
+            let attempt = scheduler.active_attempt_ids()[0];
+            scheduler.apply(TraceEvent::HttpOutcome {
+                at_ms: 0,
+                attempt_id: attempt,
+                outcome: HttpOutcome::RetryableFailure,
+            });
+            let retry_at = scheduler.delivery(1).unwrap().retry_at_ms.unwrap();
+            scheduler.apply(TraceEvent::Advance { at_ms: retry_at });
+            scheduler.take_observations()
+        }
+        assert_eq!(run(), run());
+    }
+
+    #[test]
+    fn retry_jitter_respects_hard_cap() {
+        let mut limited = config();
+        limited.retry_cap_ms = 1_000;
+        let scheduler = Scheduler::new(limited, [1, 2, 3], [10, 20, 30]);
+        for event_id in 0..1_024 {
+            assert!(scheduler.retry_delay_ms(event_id, 8) <= 1_000);
+        }
+    }
+}
diff --git a/developer-simulation/runs/2026-08-07--webhook-scheduler/src/main.rs b/developer-simulation/runs/2026-08-07--webhook-scheduler/src/main.rs
new file mode 100644
index 0000000..436af73
--- /dev/null
+++ b/developer-simulation/runs/2026-08-07--webhook-scheduler/src/main.rs
@@ -0,0 +1,146 @@
+use std::time::Instant;
+
+use webhook_scheduler::{
+    Event, HttpOutcome, Observation, Scheduler, SchedulerConfig, TimestampMs,
+    baseline_healthy_tail_latency_ms,
+};
+
+fn event(
+    id: u64,
+    tenant_id: u16,
+    endpoint_id: u16,
+    created_at_ms: TimestampMs,
+    ttl_ms: TimestampMs,
+    retryable: bool,
+) -> Event {
+    Event {
+        id,
+        tenant_id,
+        endpoint_id,
+        created_at_ms,
+        ttl_ms,
+        payload_bytes: 1024,
+        retryable,
+    }
+}
+
+fn config() -> SchedulerConfig {
+    SchedulerConfig {
+        worker_limit: 4,
+        per_endpoint_in_flight_limit: 1,
+        per_tenant_in_flight_limit: 1,
+        endpoint_min_interval_ms: 0,
+        tenant_min_interval_ms: 0,
+        retry_base_ms: 1_000,
+        retry_cap_ms: 60_000,
+        max_attempts: 20,
+        endpoint_queue_budget: 8,
+    }
+}
+
+fn main() {
+    let repetitions = std::env::args()
+        .skip(1)
+        .collect::<Vec<_>>()
+        .windows(2)
+        .find(|pair| pair[0] == "--repeat")
+        .and_then(|pair| pair[1].parse::<usize>().ok())
+        .unwrap_or(1);
+
+    let started = Instant::now();
+    let mut last = String::new();
+    for _ in 0..repetitions {
+        last = demo();
+    }
+    print!("{last}");
+    println!(
+        "repeat_count={repetitions} elapsed_us={} mode=release-recommended",
+        started.elapsed().as_micros()
+    );
+}
+
+fn demo() -> String {
+    let mut output = String::new();
+    let baseline = baseline_healthy_tail_latency_ms(4, 4, 60_000);
+
+    let mut scheduler = Scheduler::new(config(), [1, 2, 3], [10, 20, 30]);
+    for id in 1..=8 {
+        scheduler.enqueue(event(id, 1, 10, 0, 3_600_000, true));
+    }
+    scheduler.enqueue(event(100, 2, 20, 0, 3_600_000, true));
+    let observations = scheduler.take_observations();
+    let healthy_attempt = observations
+        .iter()
+        .find_map(|observation| match observation {
+            Observation::SendDecision {
+                attempt_id,
+                event_id: 100,
+                ..
+            } => Some(*attempt_id),
+            _ => None,
+        })
+        .expect("healthy event must be admitted");
+    scheduler.on_outcome(healthy_attempt, HttpOutcome::Success);
+    let prototype_tail = scheduler.metrics().p99_latency_ms(2).unwrap_or(0);
+    output.push_str("== multi-tenant webhook scheduler ==\n");
+    output.push_str(&format!(
+        "baseline_healthy_p99_ms={baseline} prototype_healthy_p99_ms={prototype_tail} improvement_ms={}\n",
+        baseline.saturating_sub(prototype_tail)
+    ));
+    output.push_str(&format!(
+        "noisy_endpoint_occupancy_max={} budget={} healthy_status={:?}\n",
+        scheduler.metrics().max_endpoint_occupancy[&10],
+        config().endpoint_queue_budget,
+        scheduler.delivery(100).unwrap().status
+    ));
+
+    let recovery_at = 3_600_000;
+    let mut outage = Scheduler::new(config(), [1, 2], [10, 20]);
+    outage.enqueue(event(200, 1, 10, 0, 7_200_000, true));
+    let initial_outage_attempt = outage.active_attempt_ids()[0];
+    outage.set_endpoint_available(10, false);
+    outage.on_outcome(initial_outage_attempt, HttpOutcome::RetryableFailure);
+    let first_retry_at = outage.delivery(200).unwrap().retry_at_ms.unwrap();
+    outage.advance_to(recovery_at);
+    let retry_observations = outage.take_observations();
+    let retry_times: Vec<_> = retry_observations
+        .iter()
+        .filter_map(|observation| match observation {
+            Observation::SendDecision { at_ms, .. } => Some(*at_ms),
+            _ => None,
+        })
+        .collect();
+    let retry_deadlines: Vec<_> = retry_observations
+        .iter()
+        .filter_map(|observation| match observation {
+            Observation::RetryScheduled { retry_at_ms, .. } => Some(*retry_at_ms),
+            _ => None,
+        })
+        .collect();
+    outage.set_endpoint_available(10, true);
+    let recovery_send_at = outage.now_ms();
+    let recovered_attempts = outage.active_attempt_ids().len();
+    let recovered_attempt = outage.active_attempt_ids()[0];
+    outage.on_outcome(recovered_attempt, HttpOutcome::Success);
+    output.push_str(&format!(
+        "outage_attempts_before_recovery={} retry_times_ms={retry_times:?} retry_deadlines_ms={retry_deadlines:?} first_retry_at_ms={first_retry_at} recovery_send_at_ms={recovery_send_at} recovered_active={recovered_attempts} final_status={:?}\n",
+        retry_times.len(),
+        outage.delivery(200).unwrap().status
+    ));
+
+    let mut crash = Scheduler::new(config(), [1], [10]);
+    crash.enqueue(event(300, 1, 10, 0, 10_000, true));
+    let old_attempt = crash.active_attempt_ids()[0];
+    crash.crash();
+    crash.restart();
+    let new_attempt = crash.active_attempt_ids()[0];
+    crash.on_outcome(old_attempt, HttpOutcome::Success);
+    crash.on_outcome(new_attempt, HttpOutcome::Success);
+    output.push_str(&format!(
+        "crash_old_attempt={old_attempt} crash_retry_attempt={new_attempt} attempts={} final_status={:?} ignored_old_outcome={}\n",
+        crash.delivery(300).unwrap().attempt_count,
+        crash.delivery(300).unwrap().status,
+        crash.metrics().ignored_outcomes
+    ));
+    output
+}
diff --git a/developer-simulation/runs/2026-08-08--container-yard-planner/Cargo.toml b/developer-simulation/runs/2026-08-08--container-yard-planner/Cargo.toml
new file mode 100644
index 0000000..10e4ba8
--- /dev/null
+++ b/developer-simulation/runs/2026-08-08--container-yard-planner/Cargo.toml
@@ -0,0 +1,16 @@
+[package]
+name = "container-yard-planner"
+version = "0.1.0"
+edition = "2024"
+publish = false
+
+[dependencies]
+serde = { version = "1", features = ["derive"] }
+serde_json = "1"
+
+[lints.rust]
+unsafe_code = "forbid"
+
+[lints.clippy]
+all = "deny"
+pedantic = "deny"
diff --git a/developer-simulation/runs/2026-08-08--container-yard-planner/README.md b/developer-simulation/runs/2026-08-08--container-yard-planner/README.md
new file mode 100644
index 0000000..df18198
--- /dev/null
+++ b/developer-simulation/runs/2026-08-08--container-yard-planner/README.md
@@ -0,0 +1,157 @@
+# Container yard planner prototype
+
+This is a standalone, advisory Rust command-line prototype for one frozen,
+normalized yard block. It validates a snapshot, proposes pickups in the requested
+order, separately replays every move, and emits either a complete
+`moves.json` or a non-executable `review.json`. It never connects to cranes or a
+terminal operating system.
+
+This is a **conservative proposal generator**, not a complete feasibility
+solver. Its bounded heuristic can return review for a wave that has a legal
+sequence. The exact three-stack reviewer witness is preserved in the acceptance
+tests and `evidence/FEASIBLE_FALSE_NEGATIVE.md`.
+
+## What it does
+
+- Moves only the top container of an unfrozen stack.
+- Rejects moves of customs-held containers.
+- Checks destination capacity, heavy-below-light order, reefer sockets,
+  maintenance freezes, and hazardous-neighbor exclusions.
+- Uses deterministic eight-pickup lookahead when choosing among legal
+  destinations. The main penalty is burying a container requested soon.
+- Includes the described nearest-legal-slot baseline for comparison.
+- Builds the entire proposal on a private copy. A planning failure or planner
+  timeout returns only a review artifact, never the accumulated move prefix.
+- Invalidates a previous current artifact before input processing and publishes
+  one new `moves.json` or `review.json` by atomic rename. Malformed input or a
+  publication failure leaves no current artifact.
+- Replays transitions through a separately coded path before marking a proposal
+  executable. That path shares the model's static snapshot and hazardous-rule
+  definitions, so it is not described as fully independent.
+
+## BogKit fit decision
+
+No BogKit crate is used. The public README and examples describe Fold as a
+durable incremental-view engine, ESE as static text embeddings, and ANNy as
+nearest-neighbor vector search. This workload is deterministic constraint
+planning over a frozen snapshot; it does not need durable incremental views,
+text embeddings, or semantic vector search. Pulling one of those crates into
+the safety-critical planning loop would add machinery without addressing the
+constraint search. See `evidence/DECISION_AUDIT.md` for the full audit.
+
+## Exact reproduction
+
+Run these commands from this directory. Keeping the target directory in
+`/private/tmp` ensures build output is not added to this archive.
+
+```console
+CARGO_TARGET_DIR=/private/tmp/container-yard-planner-target cargo test --offline --locked --release -p container-yard-planner --all-targets
+cargo fmt -p container-yard-planner -- --check
+CARGO_TARGET_DIR=/private/tmp/container-yard-planner-target cargo clippy --offline --locked -p container-yard-planner --all-targets --all-features -- -D warnings
+CARGO_TARGET_DIR=/private/tmp/container-yard-planner-target cargo run --offline --locked --release -p container-yard-planner -- demo
+```
+
+The demo should report three baseline relocations, two lookahead relocations,
+33% improvement on that one micro-geometry, a successful replay, and
+deterministic output.
+
+For a real input pair:
+
+```console
+CARGO_TARGET_DIR=/private/tmp/container-yard-planner-target cargo run --offline --release -- plan /absolute/path/yard.json /absolute/path/pickups.json /private/tmp/yard-plan
+CARGO_TARGET_DIR=/private/tmp/container-yard-planner-target cargo run --offline --release -- verify /absolute/path/yard.json /absolute/path/pickups.json /private/tmp/yard-plan/moves.json
+```
+
+The `verify` command validates status flags, declared counts, the replay flag,
+step and pickup ranks, immediate reasons, the exact rule-check lists, and then
+applies the separate transition replay. Do not run it on `review.json`, which
+intentionally contains no moves.
+
+## Input shape
+
+Containers are listed bottom-to-top in each stack. Weight class 5 is heaviest
+and class 1 is lightest. Neighbor relations must be reciprocal so hazardous
+adjacency cannot be interpreted differently in opposite directions.
+
+```json
+{
+  "max_height": 5,
+  "hazardous_exclusions": {"A": ["B"]},
+  "stacks": [
+    {
+      "id": "B01-R1",
+      "x": 1,
+      "y": 1,
+      "reefer_socket": true,
+      "frozen": false,
+      "neighbors": ["B01-R2"],
+      "containers": [
+        {
+          "id": "CONT-1",
+          "weight_class": 5,
+          "reefer": true,
+          "hazardous_group": null,
+          "customs_hold": false
+        }
+      ]
+    },
+    {
+      "id": "B01-R2",
+      "x": 1,
+      "y": 2,
+      "reefer_socket": false,
+      "frozen": false,
+      "neighbors": ["B01-R1"],
+      "containers": []
+    }
+  ]
+}
+```
+
+```json
+{"pickups": ["CONT-1"]}
+```
+
+Optional booleans, `hazardous_group`, `neighbors`, and `containers` default to
+false, null, or an empty list as appropriate. Stack IDs and container IDs must
+be unique. Coordinates are used only for the baseline's Manhattan-distance
+ranking and deterministic tie-breaking uses stack ID.
+
+## Outputs
+
+`moves.json` contains ordered moves, relocation and pickup totals, a transition-
+replay verification flag, the immediate reason for each move,
+and the rule checks supporting every destination. `review.json` identifies the
+first blocked pickup and categorizes the preventing conditions. Both formats
+have stable struct field order, sorted diagnostic lists, and a trailing newline
+for byte-for-byte comparison.
+
+The output directory is a reusable, planner-owned current-result location for
+the names `moves.json`, `review.json`, and `.yard-plan.tmp`. At the start of each
+`plan` invocation, those previous owned artifacts are removed. The new result is
+fully written and synced under the hidden temporary name, then renamed to its
+exclusive canonical name. On malformed input or publication failure, neither
+canonical result remains. Other filenames in the directory are left untouched.
+
+## Scope of the evidence
+
+The supplied trial did not include the stated 30 production evaluation JSON
+files or the C# baseline output. The tests repeat one suffix-renamed
+micro-geometry 27 times as a determinism observation: its result is 3 baseline
+relocations versus 2 proposed relocations. This is one geometry, not 27 diverse
+feasible cases. A separate 48-by-6, 1,280-container fixture observed 42 versus
+41 relocations. Three small synthetic infeasible cases, focused constraints,
+and the exact feasible false-negative witness are also included. These tests
+demonstrate prototype mechanics; they establish neither 27/27 feasible
+completion nor a production 20% improvement. See `evidence/ACCEPTANCE.md` and
+`evidence/FINDINGS.md` before operational evaluation.
+
+The planner timer begins after file reading and JSON parsing; long validation,
+serialization, and filesystem operations do not cooperatively enforce one hard
+end-to-end deadline. The included dense fixture is fast, and tested planner
+timeout checkpoints return review safely, but this is not a general 10-second
+end-to-end guarantee.
+
+The simulator's temporary child workspace marker and lockfile were removed
+during archival. This package is a member of the nested daily workspace and
+uses the lab's single `developer-simulation/Cargo.lock`.
diff --git a/developer-simulation/runs/2026-08-08--container-yard-planner/evidence/ACCEPTANCE.md b/developer-simulation/runs/2026-08-08--container-yard-planner/evidence/ACCEPTANCE.md
new file mode 100644
index 0000000..5498b01
--- /dev/null
+++ b/developer-simulation/runs/2026-08-08--container-yard-planner/evidence/ACCEPTANCE.md
@@ -0,0 +1,62 @@
+# Acceptance evidence
+
+## Finishing criteria used for this trial
+
+The prototype was considered complete when it could read and validate the two
+input files, return only a fully replayed proposal or a no-moves review result,
+compare against the stated baseline, demonstrate stable output, exercise every
+named placement rule, run a bounded dense workload, and pass tests, formatting,
+and strict linting. The production acceptance claim was deliberately held back
+because the 30 stated evaluation snapshots and C# results were not supplied.
+
+## Results by requested criterion
+
+1. **Legal intermediate states:** Passed on the included synthetic outputs. The
+   separate transition path replayed every emitted move in repeated micro-case
+   runs and the dense case. Corruption tests proved it rejects a non-top lift and a weight
+   inversion. A focused case forced the planner to avoid frozen, non-reefer,
+   weight-invalid, and hazardous-neighbor destinations. This replay shares
+   static snapshot and hazardous-conflict definitions with the planner model.
+2. **27 feasible / 3 infeasible:** Not established. One feasible micro-geometry
+   completed and was suffix-renamed/repeated 27 times for deterministic
+   behavior. Three small synthetic infeasible cases returned review. The exact
+   reviewer witness proves the conservative heuristic can reject a feasible
+   one-pickup yard, safely but incorrectly.
+3. **Baseline comparison:** One repeated micro-geometry used 3 nearest-slot
+   relocations versus 2 lookahead relocations (33% for that geometry). The
+   separate dense fixture used 42 versus 41. No diverse 27-case aggregate,
+   production 20% improvement, or worst-case claim is made.
+4. **Ten-second bound:** The dense 288-stack, 1,280-container, 40-pickup planner
+   and replay took about 8-16 ms across observed release runs on this machine. A
+   zero-duration planner test returned review. File read/parse precedes the
+   planner timer, and validation/publication are not cooperatively bounded, so
+   no hard end-to-end 10-second guarantee is claimed.
+5. **Explanations:** Every relocation lists its immediate pickup reason and the
+   source, hold, frozen, capacity, weight, reefer, and hazardous checks. Review
+   results identify the first blocked pickup and sorted preventing conditions.
+6. **Reproducibility:** Five repeated success runs, five root-object key-order
+   permutations produced byte-for-byte identical canonical output. The output
+   contains no timestamps, random values, or hash-map iteration order. Five
+   repeated false-negative reviews were also byte-identical.
+7. **Publication safety:** Passed focused regressions for success to review,
+   review to success, success to malformed input, success to zero timeout,
+   success to injected replay rejection, and injected pre-rename write failure.
+   Success/review publication is atomic and exclusive; failures leave no stale
+   canonical or partial temporary artifact.
+8. **Full artifact verification:** A valid control passed. Eleven corruptions of
+   status/executable flags, counts, replay flag, step, pickup rank, reason, and
+   rule-check metadata were rejected. The reviewer's exact dishonest file now
+   exits nonzero with `status must be executable`.
+
+## Coverage boundaries
+
+- No fixed production snapshots, supplied nearest-slot result files, or C#
+  executable were present in the trial materials.
+- The repeated micro-case intentionally isolates later-pickup burial. Its 27
+  suffix variants are one geometry and one result, not a feasibility suite.
+- The dense case covers the requested block dimensions and a normal occupancy,
+  but not simultaneous clusters of every constraint.
+- The exact three-stack witness proves the bounded proposal generator is not
+  complete even within one pickup; it must not be used to certify infeasibility.
+- Mid-plan changes, multi-block work, crane travel/collision, and dispatcher or
+  terminal-system integration remain out of scope as requested.
diff --git a/developer-simulation/runs/2026-08-08--container-yard-planner/evidence/COMMANDS.md b/developer-simulation/runs/2026-08-08--container-yard-planner/evidence/COMMANDS.md
new file mode 100644
index 0000000..8eb9e0a
--- /dev/null
+++ b/developer-simulation/runs/2026-08-08--container-yard-planner/evidence/COMMANDS.md
@@ -0,0 +1,214 @@
+# Ordered discovery, debugging, and verification trail
+
+All commands ran in the sanitized checkout. Prototype commands ran from
+`simulation-output/container-yard-planner`. Generated inputs and build output
+were kept under `/private/tmp`.
+
+1. Read the supplied scenario before anything else:
+
+   ```console
+   sed -n '1,240p' /private/tmp/bogkit-sim-2026-08-08-designer/trial2-brief.md
+   ```
+
+   Observed the advisory-only boundary, frozen-snapshot model, explicit yard
+   constraints, nearest-slot baseline, 10-second limit, deterministic-output
+   requirement, and 30-snapshot acceptance target.
+
+2. Read the root public README, listed public examples, then read all four
+   example manifests and source files:
+
+   ```console
+   sed -n '1,260p' README.md
+   find examples -path '*/target' -prune -o -type f -print | sort
+   sed -n '1,320p' examples/starter/src/main.rs
+   sed -n '1,320p' examples/timeseries/src/main.rs
+   sed -n '1,320p' examples/search/src/main.rs
+   sed -n '1,320p' examples/chat/src/main.rs
+   ```
+
+   Observed durable stream materialization in Fold, ESE/ANNy-based text search,
+   and no public constraint-planning primitive. Chose no BogKit dependency.
+
+3. The first test attempt failed before compilation:
+
+   ```console
+   CARGO_TARGET_DIR=/private/tmp/bogkit-sim-2026-08-08-trial2-target cargo test --all-targets
+   ```
+
+   Observed: `current package believes it's in a workspace when it's not`.
+   Temporary lab packaging response: added an empty `[workspace]` section to the
+   prototype manifest, preserving the root workspace unchanged. This is not a
+   BogKit API defect; the archive coordinator removes it at the nested-workspace
+   copy step.
+
+4. The next online attempt retried crates.io three times and failed DNS lookup:
+
+   ```text
+   failed to download from https://index.crates.io/config.json
+   Could not resolve host: index.crates.io
+   ```
+
+   Smallest fix: used the cached dependencies with `--offline`; this generated
+   a temporary child `Cargo.lock` that the coordinator later removed during
+   nested-workspace archival.
+
+5. The first offline compile found a moved-string borrow error in the relocation
+   record. Cloning the small identifier at the output boundary fixed it.
+
+6. The first complete test run passed six tests and failed the constraint
+   destination test because the synthetic reefer blocker had no hazardous group,
+   making `BAD_HAZARD` genuinely legal. Corrected the fixture to hazardous group
+   `A`, added reciprocal neighbor declaration, and reran. All seven passed.
+
+7. `cargo fmt --all -- --check` initially showed only formatting diffs. Ran
+   `cargo fmt --all`, then the check passed with no output.
+
+8. Strict Clippy initially reported documentation, must-use, long-function,
+   similar-name, and test-cast findings. Added public API documentation and
+   must-use annotations, removed the ambiguous local name and unchecked casts,
+   and explicitly scoped the two long state-machine functions. Final command:
+
+   ```console
+   CARGO_TARGET_DIR=/private/tmp/bogkit-sim-2026-08-08-trial2-target cargo clippy --offline --all-targets --all-features -- -D warnings
+   ```
+
+   Observed: `Finished dev profile ...` with no warnings.
+
+9. Final release acceptance run:
+
+   ```console
+   CARGO_TARGET_DIR=/private/tmp/bogkit-sim-2026-08-08-trial2-target cargo test --offline --release --test acceptance -- --nocapture --test-threads=1
+   ```
+
+   Observed: seven passed, zero failed. The displayed 81 baseline vs 54 planned
+   relocation total is one 3-to-2 micro-geometry repeated with 27 identifier
+   suffixes, not 27 diverse cases. Three small infeasible cases returned review.
+   A distinct 288-stack, 1,280-container, 40-pickup workload used 42 baseline vs
+   41 planned relocations and roughly 8-16 ms planning/replay time across
+   observed runs.
+
+10. Runnable in-memory demonstration:
+
+    ```console
+    CARGO_TARGET_DIR=/private/tmp/bogkit-sim-2026-08-08-trial2-target cargo run --offline --release -- demo
+    ```
+
+    Observed JSON:
+
+    ```json
+    {
+      "baseline_relocations": 3,
+      "bounded_lookahead_relocations": 2,
+      "improvement_percent": 33,
+      "planner_replay_verified": true,
+      "deterministic": true
+    }
+    ```
+
+11. File-based demonstration used inputs under
+    `/private/tmp/bogkit-trial2-demo/input` and output under
+    `/private/tmp/bogkit-trial2-demo/output`:
+
+    ```console
+    CARGO_TARGET_DIR=/private/tmp/bogkit-sim-2026-08-08-trial2-target cargo run --offline --release -- plan /private/tmp/bogkit-trial2-demo/input/yard.json /private/tmp/bogkit-trial2-demo/input/pickups.json /private/tmp/bogkit-trial2-demo/output
+    CARGO_TARGET_DIR=/private/tmp/bogkit-sim-2026-08-08-trial2-target cargo run --offline --release -- verify /private/tmp/bogkit-trial2-demo/input/yard.json /private/tmp/bogkit-trial2-demo/input/pickups.json /private/tmp/bogkit-trial2-demo/output/moves.json
+    ```
+
+    Observed: `executable plan -> .../moves.json`, followed by
+    `verified 4 legal moves`. The plan contained two relocations and two pickups,
+    with rule-check names on every move.
+
+## Skeptical-review fix round 1 of 5
+
+12. Read the complete skeptical review before making any change:
+
+    ```console
+    sed -n '1,320p' /private/tmp/bogkit-sim-2026-08-08-review/review.md
+    ```
+
+    Confirmed blocker B4 (stale executable publication), the exact feasible
+    false-negative witness, incomplete verifier scope, baseline/timing overclaim,
+    and temporary archive-packaging issue.
+
+13. Implemented generation-safe publication. Each file-based planning run now
+    invalidates `moves.json`, `review.json`, and `.yard-plan.tmp` before reading
+    input. Publication writes and syncs the hidden temporary file, calls atomic
+    rename, syncs the directory, and removes current/partial artifacts on error.
+    Other output-directory filenames are not touched.
+
+14. Implemented executable-contract verification before transition replay. It
+    checks status/executable/replay flags, relocation and pickup counts, step and
+    pickup ranks, exact immediate reasons, and exact canonical rule-check lists.
+    Renamed evidence language from independent simulator to separate transition
+    replay sharing static snapshot and hazardous definitions.
+
+15. Final complete verification:
+
+    ```console
+    cargo fmt --all -- --check
+    CARGO_TARGET_DIR=/private/tmp/bogkit-sim-2026-08-08-trial2-fix1-final-target cargo test --offline --release --all-targets
+    CARGO_TARGET_DIR=/private/tmp/bogkit-sim-2026-08-08-trial2-fix1-final-target cargo clippy --offline --all-targets --all-features -- -D warnings
+    ```
+
+    Observed: formatting passed with no output; the library passed 1/1 test and
+    acceptance passed 15/15, zero failures; strict Clippy finished with no
+    warnings.
+
+16. Focused blocker regressions:
+
+    ```console
+    CARGO_TARGET_DIR=/private/tmp/bogkit-sim-2026-08-08-trial2-fix1-final-target cargo test --offline --release --test acceptance reused_output -- --nocapture --test-threads=1
+    CARGO_TARGET_DIR=/private/tmp/bogkit-sim-2026-08-08-trial2-fix1-final-target cargo test --offline --release --lib publication_tests::injected_atomic_write_failure_leaves_no_current_or_partial_artifact -- --exact --nocapture
+    ```
+
+    Observed: 5/5 reused-output regressions passed (review→success,
+    success→review, success→malformed, success→zero-timeout, and
+    success→injected replay rejection). The injected pre-rename write failure
+    passed 1/1 and left no canonical or temporary artifact.
+
+17. Focused correctness/evidence regressions:
+
+    ```console
+    CARGO_TARGET_DIR=/private/tmp/bogkit-sim-2026-08-08-trial2-fix1-final-target cargo test --offline --release --test acceptance exact_reviewer_witness_is_a_safe_feasible_false_negative -- --exact --nocapture
+    CARGO_TARGET_DIR=/private/tmp/bogkit-sim-2026-08-08-trial2-fix1-final-target cargo test --offline --release --test acceptance verifier_rejects_dishonest_metadata_and_explanations -- --exact --nocapture
+    CARGO_TARGET_DIR=/private/tmp/bogkit-sim-2026-08-08-trial2-fix1-final-target cargo test --offline --release --test acceptance review_output_is_byte_deterministic -- --exact --nocapture
+    ```
+
+    Observed: each passed 1/1. The exact three-stack case returns review from the
+    heuristic while its manual `X1 A→C`, `X2 A→B`, `P A→pickup_lane` witness
+    passes full verification. Eleven metadata/explanation corruption variants
+    were rejected. Five repeated review serializations were byte-identical.
+
+18. Exact dishonest reviewer file through the CLI:
+
+    ```console
+    CARGO_TARGET_DIR=/private/tmp/bogkit-sim-2026-08-08-trial2-fix1-final-target cargo run --offline --release -- verify /private/tmp/bogkit-review-adversarial/t2/input/yard.json /private/tmp/bogkit-review-adversarial/t2/input/pickups-feasible.json /private/tmp/bogkit-review-adversarial/t2/input/dishonest-metadata-moves.json
+    ```
+
+    Observed exit code 1 and `error: status must be executable`.
+
+19. Final runnable demo and valid file verification:
+
+    ```console
+    CARGO_TARGET_DIR=/private/tmp/bogkit-sim-2026-08-08-trial2-fix1-final-target cargo run --offline --release -- demo
+    CARGO_TARGET_DIR=/private/tmp/bogkit-sim-2026-08-08-trial2-fix1-final-target cargo run --offline --release -- verify /private/tmp/bogkit-trial2-demo/input/yard.json /private/tmp/bogkit-trial2-demo/input/pickups.json /private/tmp/bogkit-trial2-demo/output/moves.json
+    ```
+
+    Observed demo: 3 baseline relocations, 2 proposed relocations, integer 33%
+    for that one micro-geometry, replay verified, deterministic true. Valid file
+    verification reported `verified 4 legal moves and their executable metadata`.
+
+20. The child `[workspace]` was intentionally retained for the temporary
+    out-of-member lab path. This was lab packaging, not BogKit API friction;
+    the archive coordinator removed it and the child lockfile before the final
+    nested-workspace gates.
+
+21. Removed only generated trial targets and demo fixtures, then verified no
+    target directory exists in the deliverable and no named fixture remains:
+
+    ```console
+    rm -rf /private/tmp/bogkit-sim-2026-08-08-trial2-target /private/tmp/bogkit-sim-2026-08-08-trial2-fix1-target /private/tmp/bogkit-sim-2026-08-08-trial2-fix1-final-target /private/tmp/bogkit-trial2-demo
+    find simulation-output/container-yard-planner -type d -name target -print
+    ```
+
+    Observed: cleanup succeeded and the archive target search printed nothing.
diff --git a/developer-simulation/runs/2026-08-08--container-yard-planner/evidence/DECISION_AUDIT.md b/developer-simulation/runs/2026-08-08--container-yard-planner/evidence/DECISION_AUDIT.md
new file mode 100644
index 0000000..f9d1640
--- /dev/null
+++ b/developer-simulation/runs/2026-08-08--container-yard-planner/evidence/DECISION_AUDIT.md
@@ -0,0 +1,60 @@
+# Consequential decision audit
+
+## Decisions taken
+
+1. **Kept the tool advisory and local.** It reads files and writes a review
+   artifact; it has no crane, database, network, or dispatcher-write path.
+2. **Used no BogKit component.** This followed the public-fit evaluation rather
+   than treating component use as a goal. Fold's incremental persistence and the
+   text/vector search tools do not establish move legality or solve constraint
+   planning.
+3. **Made current-result publication generation-safe.** Planning occurs on a
+   clone. Before reading a new input generation, the tool invalidates its three
+   owned artifact names. It fully writes and syncs a hidden temporary file, then
+   atomically renames exactly one `moves.json` or `review.json`. Malformed input
+   and injected write failure leave no current or partial artifact.
+4. **Favored deterministic bounded lookahead.** Eight upcoming pickup IDs affect
+   destination ranking, followed by stack flexibility, distance, and stack ID.
+   The fixed bound limits work and makes repeated output stable.
+5. **Required reciprocal neighbors.** Hazardous adjacency is operationally
+   undirected; rejecting ambiguous input is safer than silently checking only
+   one direction.
+6. **Kept generated material outside the archive.** Cargo target files and demo
+   JSON/output live in `/private/tmp`. No source, example, root, Git, GitHub, or
+   automation state was modified.
+
+## Rejected alternatives
+
+- **Fold as planner state:** rejected because the run is a frozen snapshot and
+  does not need durable incremental materialized views. A plain cloned state is
+  smaller and easier for a separate transition replay to duplicate.
+- **ANNy or ESE for destination selection:** rejected because vector similarity
+  is not a legality proof and would make exact deterministic reasoning harder.
+- **Globally optimal exhaustive search:** rejected by the explicit non-goal and
+  the 10-second bound.
+- **Randomized local search:** rejected because canonical repeated output is a
+  hard requirement.
+- **Partial best-effort move lists:** rejected because an unverified prefix must
+  never be mistaken for executable guidance.
+- **Live integrations or persistence:** rejected by the advisory prototype
+  boundary.
+
+## Dependencies and assumptions
+
+- Rust toolchain with edition-2024 support.
+- Locked `serde` and `serde_json` crates, available from the local cache during
+  this trial; online dependency retrieval was unavailable.
+- A single-slot normalized container model, integer weight classes 1-5, unique
+  IDs, reciprocal neighbor lists, and Manhattan distance over supplied `x/y`
+  coordinates.
+- The snapshot is authoritative and already expresses the applicable hazardous
+  segregation table. Missing mid-run operational facts require a fresh plan.
+
+## Uncertainty
+
+The dominant uncertainty is external validity. The real 30 snapshots, C#
+baseline outputs, dispatcher edits, and specified laptop were absent. The
+synthetic evidence is useful for mechanics and regression, not a substitute for
+acceptance on those artifacts. Search incompleteness is confirmed, not merely
+uncertain: the preserved three-stack witness has a legal sequence that the
+heuristic misses. Timing is fixture-level, not one hard end-to-end deadline.
diff --git a/developer-simulation/runs/2026-08-08--container-yard-planner/evidence/FEASIBLE_FALSE_NEGATIVE.md b/developer-simulation/runs/2026-08-08--container-yard-planner/evidence/FEASIBLE_FALSE_NEGATIVE.md
new file mode 100644
index 0000000..8c4909c
--- /dev/null
+++ b/developer-simulation/runs/2026-08-08--container-yard-planner/evidence/FEASIBLE_FALSE_NEGATIVE.md
@@ -0,0 +1,39 @@
+# Exact feasible false-negative witness
+
+This preserves the skeptical reviewer's exact three-stack case. It is a
+regression in `exact_reviewer_witness_is_a_safe_feasible_false_negative`.
+
+```json
+{
+  "max_height": 3,
+  "hazardous_exclusions": {},
+  "stacks": [
+    {"id":"A","x":0,"y":0,"reefer_socket":false,"frozen":false,"neighbors":[],"containers":[
+      {"id":"P","weight_class":5,"reefer":false,"hazardous_group":null,"customs_hold":false},
+      {"id":"X2","weight_class":4,"reefer":false,"hazardous_group":null,"customs_hold":false},
+      {"id":"X1","weight_class":2,"reefer":false,"hazardous_group":null,"customs_hold":false}
+    ]},
+    {"id":"B","x":1,"y":0,"reefer_socket":false,"frozen":false,"neighbors":[],"containers":[
+      {"id":"B0","weight_class":5,"reefer":false,"hazardous_group":null,"customs_hold":false}
+    ]},
+    {"id":"C","x":2,"y":0,"reefer_socket":false,"frozen":false,"neighbors":[],"containers":[
+      {"id":"C0","weight_class":3,"reefer":false,"hazardous_group":null,"customs_hold":false}
+    ]}
+  ]
+}
+```
+
+```json
+{"pickups":["P"]}
+```
+
+The bounded heuristic chooses nearer `B` for light blocker `X1`. Neither `B`
+nor `C` can then accept heavier `X2`, so it safely returns review. This legal
+witness passes full metadata verification and transition replay:
+
+1. Relocate `X1` from `A` to `C`.
+2. Relocate `X2` from `A` to `B`.
+3. Pick up `P` from `A`.
+
+This proves the prototype cannot claim complete feasible-wave planning or treat
+its review as proof that a wave is infeasible.
diff --git a/developer-simulation/runs/2026-08-08--container-yard-planner/evidence/FINDINGS.md b/developer-simulation/runs/2026-08-08--container-yard-planner/evidence/FINDINGS.md
new file mode 100644
index 0000000..49cb6e9
--- /dev/null
+++ b/developer-simulation/runs/2026-08-08--container-yard-planner/evidence/FINDINGS.md
@@ -0,0 +1,95 @@
+# Categorized findings
+
+## Correctness defect
+
+No correctness defect in BogKit was established. This trial did not use a
+BogKit component in the prototype, and no component internals were inspected.
+
+Prototype finding: hazardous adjacency needs an unambiguous undirected model.
+Severity: high for operational use. Confidence: high. Reproduction: provide a
+stack that names a neighbor which does not name it back. Current behavior:
+snapshot validation rejects it before planning. Smallest improvement beyond the
+prototype: define and validate the production input contract centrally.
+
+## Performance problem
+
+No BogKit performance problem was established. The standalone release planner
+and replay completed the synthetic 1,280-container workload in roughly 8-16 ms
+on observed runs, far below 10 seconds for that fixture. Confidence: high for this
+fixture, low for production distributions. Reproduction: run the named dense
+acceptance test. Smallest next step: benchmark the supplied 30 snapshots on the
+specified four-core laptop and preserve per-case timings.
+
+## Temporary lab packaging
+
+Finding: placing this standalone trial artifact below, but outside, the current
+workspace required a temporary child `[workspace]`. This is not BogKit API
+friction and not a feature candidate. Severity: none for product; low for lab
+coordination. Confidence: high.
+Reproduction: create a nested manifest outside the workspace member list and run
+`cargo test`; Cargo reports that the package believes it is in a workspace.
+Archive result: the coordinator removed the child `[workspace]` and lockfile,
+used the nested daily workspace and single lockfile, and reran the final gates.
+
+## Documentation gap
+
+Finding: the public root README links only Fold's internal documentation; the
+examples are the main public explanation for ESE and ANNy, and there is no
+decision guide for non-search, non-incremental workloads. Severity: low.
+Confidence: high from the permitted public surface. Reproduction: follow only
+the README's documentation section. Smallest improvement: add a short "when not
+to use these crates" table and direct links for each crate.
+
+## Missing capability
+
+Finding: the public surface contains no deterministic constrained-planning or
+bounded-search primitive that directly addresses legal yard reshuffling.
+Severity: medium for this use case, not necessarily a BogKit product defect.
+Confidence: medium because only the required public README/examples were used;
+internals were intentionally not searched. Reproduction: map each public crate
+description to snapshot constraint search. Smallest improvement, only if this
+becomes a target BogKit use case: publish a generic deterministic state-space
+search example before designing a new crate.
+
+## Poor product fit
+
+Finding: Fold, ESE, and ANNy are poor fits for the prototype's core planning
+loop. Severity: high if forced into the implementation because they add
+complexity without proving legality or resolving dead ends. Confidence: high
+for ESE/ANNy, medium-high for Fold based on its public examples. Reproduction:
+compare the frozen one-run input and move-sequence output to each public crate's
+documented role. Smallest improvement: keep the planner standalone; consider
+Fold later only if durable incremental operational views become a separate
+requirement.
+
+## Prototype-specific risk
+
+Finding: destination choice is deterministic bounded lookahead, not complete
+backtracking and not a proof of feasibility. It can still reject a feasible
+wave if an early legal placement causes a later dead end. Severity: high before
+production evaluation. Confidence: high. Reproduction: use the preserved exact
+three-stack witness: the heuristic moves light `X1` from `A` to nearer `B`, then
+cannot move heavier `X2`; `X1 A→C`, `X2 A→B`, `P A→pickup_lane` is legal.
+Smallest improvement: add a bounded beam/backtracking search with a shared
+deadline, then validate it on the fixed 30 snapshots. Until then, describe this
+only as a conservative proposal generator that can false-reject.
+
+## Resolved publication defect
+
+Round-1 finding: reused output locations retained stale `moves.json` after
+review or malformed input, and writes published directly. Severity before fix:
+blocker. Confidence: high. Resolution: each run invalidates the three owned
+current-generation names before reading input; a fully written and synced hidden
+temporary file is atomically renamed to exactly one canonical result. Focused
+reuse and injected-write-failure regressions pass. Residual boundary: an
+operating-system failure that prevents invalidating the old artifact is returned
+as an error; the program cannot override filesystem permissions.
+
+## Resolved verifier defect
+
+Round-1 finding: transition replay ignored dishonest executable metadata and
+explanation fields. Severity before fix: important. Confidence: high.
+Resolution: verification now checks flags, counts, step/rank consistency,
+canonical reasons/check lists, then replays transitions. The replay is separate
+but shares static snapshot and hazardous definitions, so no fully independent
+claim remains.
diff --git a/developer-simulation/runs/2026-08-08--container-yard-planner/src/lib.rs b/developer-simulation/runs/2026-08-08--container-yard-planner/src/lib.rs
new file mode 100644
index 0000000..f85d742
--- /dev/null
+++ b/developer-simulation/runs/2026-08-08--container-yard-planner/src/lib.rs
@@ -0,0 +1,240 @@
+pub mod model;
+pub mod planner;
+pub mod simulator;
+pub mod verification;
+
+use std::fs::{self, File, OpenOptions};
+use std::io::{self, Write};
+use std::path::Path;
+use std::time::Duration;
+
+use model::{PickupWave, PlanOutput, Yard};
+
+/// Read and decode one yard snapshot and pickup wave.
+///
+/// # Errors
+///
+/// Returns a contextual message for unreadable files or malformed JSON.
+pub fn read_inputs(yard_path: &Path, pickups_path: &Path) -> Result<(Yard, PickupWave), String> {
+    let yard_bytes = fs::read(yard_path)
+        .map_err(|error| format!("cannot read {}: {error}", yard_path.display()))?;
+    let pickup_bytes = fs::read(pickups_path)
+        .map_err(|error| format!("cannot read {}: {error}", pickups_path.display()))?;
+    let yard = serde_json::from_slice(&yard_bytes)
+        .map_err(|error| format!("invalid yard JSON: {error}"))?;
+    let wave = serde_json::from_slice(&pickup_bytes)
+        .map_err(|error| format!("invalid pickups JSON: {error}"))?;
+    Ok((yard, wave))
+}
+
+const MOVES_FILE: &str = "moves.json";
+const REVIEW_FILE: &str = "review.json";
+const TEMP_FILE: &str = ".yard-plan.tmp";
+
+/// Remove artifacts belonging to the previous generation.
+///
+/// # Errors
+///
+/// Returns a contextual message if the output directory cannot be created or a
+/// previous owned artifact cannot be invalidated.
+pub fn invalidate_output(output_dir: &Path) -> Result<(), String> {
+    fs::create_dir_all(output_dir)
+        .map_err(|error| format!("cannot create {}: {error}", output_dir.display()))?;
+    for name in [MOVES_FILE, REVIEW_FILE, TEMP_FILE] {
+        remove_owned_path(&output_dir.join(name))?;
+    }
+    Ok(())
+}
+
+/// Atomically publish either `moves.json` or `review.json` in canonical form.
+/// Any previous current result is invalidated first, so exactly one canonical
+/// artifact exists after success and none exists after publication failure.
+///
+/// # Errors
+///
+/// Returns a contextual message if invalidation, serialization, writing,
+/// syncing, or atomic publication fails.
+pub fn write_plan(output_dir: &Path, output: &PlanOutput) -> Result<std::path::PathBuf, String> {
+    invalidate_output(output_dir)?;
+    publish_plan_after_invalidation(output_dir, output, |_| Ok(()))
+}
+
+fn publish_plan_after_invalidation<F>(
+    output_dir: &Path,
+    output: &PlanOutput,
+    before_rename: F,
+) -> Result<std::path::PathBuf, String>
+where
+    F: FnOnce(&Path) -> io::Result<()>,
+{
+    let file_name = match output {
+        PlanOutput::Moves(_) => MOVES_FILE,
+        PlanOutput::Review(_) => REVIEW_FILE,
+    };
+    let destination = output_dir.join(file_name);
+    let temporary = output_dir.join(TEMP_FILE);
+    let bytes = output
+        .canonical_json()
+        .map_err(|error| format!("cannot serialize output: {error}"))?;
+
+    let publication = (|| -> io::Result<()> {
+        let mut file = open_new(&temporary)?;
+        file.write_all(bytes.as_bytes())?;
+        file.sync_all()?;
+        before_rename(&temporary)?;
+        drop(file);
+        fs::rename(&temporary, &destination)?;
+        File::open(output_dir)?.sync_all()?;
+        Ok(())
+    })();
+
+    match publication {
+        Ok(()) => Ok(destination),
+        Err(error) => {
+            let _ = remove_owned_path(&temporary);
+            let _ = remove_owned_path(&destination);
+            Err(format!(
+                "cannot atomically publish {}: {error}",
+                destination.display()
+            ))
+        }
+    }
+}
+
+/// Run the planner from JSON files and write its advisory artifact.
+///
+/// # Errors
+///
+/// Returns a contextual input or output file error.
+pub fn run_plan_files(
+    yard_path: &Path,
+    pickups_path: &Path,
+    output_dir: &Path,
+    timeout: Duration,
+) -> Result<(PlanOutput, std::path::PathBuf), String> {
+    // Invalidate first: malformed input and all later failures must not leave a
+    // previous executable generation at this current output location.
+    invalidate_output(output_dir)?;
+    let (yard, wave) = read_inputs(yard_path, pickups_path)?;
+    let output = planner::plan(&yard, &wave, timeout);
+    let destination = publish_plan_after_invalidation(output_dir, &output, |_| Ok(()))?;
+    Ok((output, destination))
+}
+
+fn open_new(path: &Path) -> io::Result<File> {
+    OpenOptions::new().write(true).create_new(true).open(path)
+}
+
+fn remove_owned_path(path: &Path) -> Result<(), String> {
+    match fs::symlink_metadata(path) {
+        Ok(metadata) if metadata.is_dir() => fs::remove_dir_all(path)
+            .map_err(|error| format!("cannot invalidate {}: {error}", path.display())),
+        Ok(_) => fs::remove_file(path)
+            .map_err(|error| format!("cannot invalidate {}: {error}", path.display())),
+        Err(error) if error.kind() == io::ErrorKind::NotFound => Ok(()),
+        Err(error) => Err(format!("cannot inspect {}: {error}", path.display())),
+    }
+}
+
+#[must_use]
+pub fn demo_case(suffix: usize) -> (Yard, PickupWave) {
+    use std::collections::BTreeMap;
+
+    use model::{Container, Stack};
+    let container = |id: &str, weight_class| Container {
+        id: format!("{id}-{suffix}"),
+        weight_class,
+        reefer: false,
+        hazardous_group: None,
+        customs_hold: false,
+    };
+    let stacks = vec![
+        Stack {
+            id: "A".to_string(),
+            x: 0,
+            y: 0,
+            reefer_socket: false,
+            frozen: false,
+            neighbors: vec![],
+            containers: vec![container("P1", 5), container("X1", 4), container("X2", 3)],
+        },
+        Stack {
+            id: "B".to_string(),
+            x: 1,
+            y: 0,
+            reefer_socket: false,
+            frozen: false,
+            neighbors: vec![],
+            containers: vec![container("P2", 5)],
+        },
+        Stack {
+            id: "C".to_string(),
+            x: 2,
+            y: 0,
+            reefer_socket: false,
+            frozen: false,
+            neighbors: vec![],
+            containers: vec![],
+        },
+        Stack {
+            id: "D".to_string(),
+            x: 3,
+            y: 0,
+            reefer_socket: false,
+            frozen: false,
+            neighbors: vec![],
+            containers: vec![],
+        },
+    ];
+    (
+        Yard {
+            max_height: 5,
+            hazardous_exclusions: BTreeMap::new(),
+            stacks,
+        },
+        PickupWave {
+            pickups: vec![format!("P1-{suffix}"), format!("P2-{suffix}")],
+        },
+    )
+}
+
+#[cfg(test)]
+mod publication_tests {
+    use std::io;
+    use std::sync::atomic::{AtomicU64, Ordering};
+
+    use super::*;
+
+    static SERIAL: AtomicU64 = AtomicU64::new(0);
+
+    #[test]
+    fn injected_atomic_write_failure_leaves_no_current_or_partial_artifact() {
+        let serial = SERIAL.fetch_add(1, Ordering::Relaxed);
+        let root = std::env::temp_dir().join(format!(
+            "container-yard-planner-write-failure-{}-{serial}",
+            std::process::id()
+        ));
+        let (yard, wave) = demo_case(0);
+        let success = planner::plan(&yard, &wave, Duration::from_secs(10));
+        write_plan(&root, &success).expect("control success should publish");
+        assert!(root.join(MOVES_FILE).is_file());
+
+        invalidate_output(&root).expect("new generation should invalidate success");
+        let rejection = PlanOutput::Review(model::ReviewOutput {
+            status: "review_required".to_string(),
+            executable: false,
+            planner: "bounded-lookahead-v1".to_string(),
+            first_blocked_pickup: Some("P1-0".to_string()),
+            reason: "injected publication failure".to_string(),
+            preventing_conditions: vec!["write failure".to_string()],
+        });
+        let result = publish_plan_after_invalidation(&root, &rejection, |_| {
+            Err(io::Error::other("injected before atomic rename"))
+        });
+        assert!(result.is_err());
+        for artifact in [MOVES_FILE, REVIEW_FILE, TEMP_FILE] {
+            assert!(!root.join(artifact).exists(), "stale artifact: {artifact}");
+        }
+        fs::remove_dir_all(&root).expect("clean test fixture");
+    }
+}
diff --git a/developer-simulation/runs/2026-08-08--container-yard-planner/src/main.rs b/developer-simulation/runs/2026-08-08--container-yard-planner/src/main.rs
new file mode 100644
index 0000000..3139ca7
--- /dev/null
+++ b/developer-simulation/runs/2026-08-08--container-yard-planner/src/main.rs
@@ -0,0 +1,111 @@
+use std::path::Path;
+use std::process::ExitCode;
+use std::time::Duration;
+
+use container_yard_planner::{demo_case, planner, run_plan_files, simulator, verification};
+use serde::Serialize;
+
+fn main() -> ExitCode {
+    match run() {
+        Ok(()) => ExitCode::SUCCESS,
+        Err(error) => {
+            eprintln!("error: {error}");
+            ExitCode::FAILURE
+        }
+    }
+}
+
+fn run() -> Result<(), String> {
+    let args: Vec<String> = std::env::args().collect();
+    match args.get(1).map(String::as_str) {
+        Some("plan") => {
+            if args.len() != 5 {
+                return Err(usage());
+            }
+            let (output, destination) = run_plan_files(
+                Path::new(&args[2]),
+                Path::new(&args[3]),
+                Path::new(&args[4]),
+                Duration::from_secs(10),
+            )?;
+            println!(
+                "{} -> {}",
+                match output {
+                    container_yard_planner::model::PlanOutput::Moves(_) => "executable plan",
+                    container_yard_planner::model::PlanOutput::Review(_) => "review required",
+                },
+                destination.display()
+            );
+            Ok(())
+        }
+        Some("verify") => {
+            if args.len() != 5 {
+                return Err(usage());
+            }
+            let (yard, wave) =
+                container_yard_planner::read_inputs(Path::new(&args[2]), Path::new(&args[3]))?;
+            let bytes = std::fs::read(&args[4])
+                .map_err(|error| format!("cannot read {}: {error}", args[4]))?;
+            let output: container_yard_planner::model::MovesOutput = serde_json::from_slice(&bytes)
+                .map_err(|error| format!("invalid moves JSON: {error}"))?;
+            verification::verify_moves_output(&yard, &wave, &output)?;
+            println!(
+                "verified {} legal moves and their executable metadata",
+                output.moves.len()
+            );
+            Ok(())
+        }
+        Some("demo") => demo(),
+        _ => Err(usage()),
+    }
+}
+
+fn usage() -> String {
+    "usage:\n  container-yard-planner plan <yard.json> <pickups.json> <output-dir>\n  container-yard-planner verify <yard.json> <pickups.json> <moves.json>\n  container-yard-planner demo".to_string()
+}
+
+#[derive(Serialize)]
+struct DemoSummary {
+    baseline_relocations: usize,
+    bounded_lookahead_relocations: usize,
+    improvement_percent: usize,
+    planner_replay_verified: bool,
+    deterministic: bool,
+}
+
+fn demo() -> Result<(), String> {
+    let (yard, wave) = demo_case(0);
+    let timeout = Duration::from_secs(10);
+    let baseline = planner::baseline(&yard, &wave, timeout);
+    let planned = planner::plan(&yard, &wave, timeout);
+    let baseline_relocations = baseline
+        .relocations()
+        .ok_or_else(|| "demo baseline unexpectedly failed".to_string())?;
+    let bounded_lookahead_relocations = planned
+        .relocations()
+        .ok_or_else(|| "demo planner unexpectedly failed".to_string())?;
+    let container_yard_planner::model::PlanOutput::Moves(moves) = &planned else {
+        return Err("demo planner did not return moves".to_string());
+    };
+    simulator::replay(&yard, &wave, &moves.moves)?;
+    let first = planned
+        .canonical_json()
+        .map_err(|error| error.to_string())?;
+    let second = planner::plan(&yard, &wave, timeout)
+        .canonical_json()
+        .map_err(|error| error.to_string())?;
+    let improvement_percent =
+        100 * (baseline_relocations - bounded_lookahead_relocations) / baseline_relocations;
+    let summary = DemoSummary {
+        baseline_relocations,
+        bounded_lookahead_relocations,
+        improvement_percent,
+        planner_replay_verified: true,
+        deterministic: first == second,
+    };
+    println!(
+        "{}",
+        serde_json::to_string_pretty(&summary).map_err(|error| error.to_string())?
+    );
+    Ok(())
+}
diff --git a/developer-simulation/runs/2026-08-08--container-yard-planner/src/model.rs b/developer-simulation/runs/2026-08-08--container-yard-planner/src/model.rs
new file mode 100644
index 0000000..80b66b8
--- /dev/null
+++ b/developer-simulation/runs/2026-08-08--container-yard-planner/src/model.rs
@@ -0,0 +1,225 @@
+use std::collections::{BTreeMap, BTreeSet};
+
+use serde::{Deserialize, Serialize};
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+pub struct Container {
+    pub id: String,
+    pub weight_class: u8,
+    #[serde(default)]
+    pub reefer: bool,
+    #[serde(default)]
+    pub hazardous_group: Option<String>,
+    #[serde(default)]
+    pub customs_hold: bool,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+pub struct Stack {
+    pub id: String,
+    pub x: i32,
+    pub y: i32,
+    #[serde(default)]
+    pub reefer_socket: bool,
+    #[serde(default)]
+    pub frozen: bool,
+    #[serde(default)]
+    pub neighbors: Vec<String>,
+    /// Containers in bottom-to-top order.
+    #[serde(default)]
+    pub containers: Vec<Container>,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+pub struct Yard {
+    pub max_height: usize,
+    #[serde(default)]
+    pub hazardous_exclusions: BTreeMap<String, Vec<String>>,
+    pub stacks: Vec<Stack>,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+pub struct PickupWave {
+    pub pickups: Vec<String>,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "snake_case")]
+pub enum MoveKind {
+    Relocate,
+    Pickup,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+pub struct PlannedMove {
+    pub step: usize,
+    pub kind: MoveKind,
+    pub container_id: String,
+    pub from: String,
+    pub to: String,
+    pub pickup_rank: usize,
+    pub needed_for: String,
+    pub rule_checks: Vec<String>,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+pub struct MovesOutput {
+    pub status: String,
+    pub executable: bool,
+    pub planner: String,
+    pub relocations: usize,
+    pub pickups: usize,
+    pub simulator_verified: bool,
+    pub moves: Vec<PlannedMove>,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+pub struct ReviewOutput {
+    pub status: String,
+    pub executable: bool,
+    pub planner: String,
+    pub first_blocked_pickup: Option<String>,
+    pub reason: String,
+    pub preventing_conditions: Vec<String>,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(untagged)]
+pub enum PlanOutput {
+    Moves(MovesOutput),
+    Review(ReviewOutput),
+}
+
+impl PlanOutput {
+    /// Serialize a plan with stable field ordering and a trailing newline.
+    ///
+    /// # Errors
+    ///
+    /// Returns an error if serialization fails.
+    pub fn canonical_json(&self) -> Result<String, serde_json::Error> {
+        let mut json = serde_json::to_string_pretty(self)?;
+        json.push('\n');
+        Ok(json)
+    }
+
+    #[must_use]
+    pub fn relocations(&self) -> Option<usize> {
+        match self {
+            Self::Moves(output) => Some(output.relocations),
+            Self::Review(_) => None,
+        }
+    }
+}
+
+/// Check all static constraints on the authoritative input snapshot.
+///
+/// # Errors
+///
+/// Returns every detected validation problem, sorted and deduplicated.
+pub fn validate_snapshot(yard: &Yard) -> Result<(), Vec<String>> {
+    let mut errors = Vec::new();
+    if yard.max_height == 0 {
+        errors.push("max_height must be greater than zero".to_string());
+    }
+
+    let stack_ids: BTreeSet<_> = yard.stacks.iter().map(|stack| stack.id.as_str()).collect();
+    if stack_ids.len() != yard.stacks.len() {
+        errors.push("stack IDs must be unique".to_string());
+    }
+
+    let mut container_ids = BTreeSet::new();
+    for stack in &yard.stacks {
+        if stack.containers.len() > yard.max_height {
+            errors.push(format!(
+                "stack {} exceeds maximum height {}",
+                stack.id, yard.max_height
+            ));
+        }
+        for neighbor in &stack.neighbors {
+            if !stack_ids.contains(neighbor.as_str()) {
+                errors.push(format!(
+                    "stack {} names unknown neighbor {}",
+                    stack.id, neighbor
+                ));
+            } else if yard
+                .stacks
+                .iter()
+                .find(|candidate| candidate.id == *neighbor)
+                .is_some_and(|candidate| !candidate.neighbors.contains(&stack.id))
+            {
+                errors.push(format!(
+                    "neighbor relation between {} and {} must be reciprocal",
+                    stack.id, neighbor
+                ));
+            }
+        }
+        for container in &stack.containers {
+            if !(1..=5).contains(&container.weight_class) {
+                errors.push(format!(
+                    "container {} has weight class outside 1..=5",
+                    container.id
+                ));
+            }
+            if !container_ids.insert(container.id.as_str()) {
+                errors.push(format!("container ID {} is duplicated", container.id));
+            }
+            if container.reefer && !stack.reefer_socket {
+                errors.push(format!(
+                    "reefer container {} is in stack {} without a socket",
+                    container.id, stack.id
+                ));
+            }
+        }
+        for pair in stack.containers.windows(2) {
+            if pair[0].weight_class < pair[1].weight_class {
+                errors.push(format!(
+                    "stack {} has heavier container {} above lighter container {}",
+                    stack.id, pair[1].id, pair[0].id
+                ));
+            }
+        }
+    }
+
+    for stack in &yard.stacks {
+        for neighbor_id in &stack.neighbors {
+            let Some(neighbor) = yard.stacks.iter().find(|item| item.id == *neighbor_id) else {
+                continue;
+            };
+            for left in &stack.containers {
+                for right in &neighbor.containers {
+                    if hazardous_conflict(yard, left, right) {
+                        errors.push(format!(
+                            "hazardous groups conflict between container {} in {} and container {} in {}",
+                            left.id, stack.id, right.id, neighbor.id
+                        ));
+                    }
+                }
+            }
+        }
+    }
+
+    errors.sort();
+    errors.dedup();
+    if errors.is_empty() {
+        Ok(())
+    } else {
+        Err(errors)
+    }
+}
+
+#[must_use]
+pub fn hazardous_conflict(yard: &Yard, left: &Container, right: &Container) -> bool {
+    let (Some(left_group), Some(right_group)) = (
+        left.hazardous_group.as_ref(),
+        right.hazardous_group.as_ref(),
+    ) else {
+        return false;
+    };
+    yard.hazardous_exclusions
+        .get(left_group)
+        .is_some_and(|groups| groups.contains(right_group))
+        || yard
+            .hazardous_exclusions
+            .get(right_group)
+            .is_some_and(|groups| groups.contains(left_group))
+}
diff --git a/developer-simulation/runs/2026-08-08--container-yard-planner/src/planner.rs b/developer-simulation/runs/2026-08-08--container-yard-planner/src/planner.rs
new file mode 100644
index 0000000..1180976
--- /dev/null
+++ b/developer-simulation/runs/2026-08-08--container-yard-planner/src/planner.rs
@@ -0,0 +1,380 @@
+use std::collections::BTreeMap;
+use std::time::{Duration, Instant};
+
+use crate::model::{
+    Container, MoveKind, MovesOutput, PickupWave, PlanOutput, PlannedMove, ReviewOutput, Stack,
+    Yard, hazardous_conflict, validate_snapshot,
+};
+use crate::simulator;
+
+const LOOKAHEAD_PICKUPS: usize = 8;
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum Strategy {
+    NearestBaseline,
+    BoundedLookahead,
+}
+
+impl Strategy {
+    fn name(self) -> &'static str {
+        match self {
+            Self::NearestBaseline => "nearest-legal-slot-baseline",
+            Self::BoundedLookahead => "bounded-lookahead-v1",
+        }
+    }
+}
+
+#[must_use]
+pub fn plan(yard: &Yard, wave: &PickupWave, timeout: Duration) -> PlanOutput {
+    plan_with_strategy(yard, wave, timeout, Strategy::BoundedLookahead)
+}
+
+#[must_use]
+pub fn baseline(yard: &Yard, wave: &PickupWave, timeout: Duration) -> PlanOutput {
+    plan_with_strategy(yard, wave, timeout, Strategy::NearestBaseline)
+}
+
+/// Compute a complete candidate using the selected deterministic strategy.
+///
+/// # Panics
+///
+/// Internal invariant failures can panic if a previously discovered blocker or
+/// legal candidate disappears without an intervening state transition.
+#[must_use]
+#[allow(clippy::too_many_lines)]
+pub fn plan_with_strategy(
+    yard: &Yard,
+    wave: &PickupWave,
+    timeout: Duration,
+    strategy: Strategy,
+) -> PlanOutput {
+    let started = Instant::now();
+    if let Err(errors) = validate_snapshot(yard) {
+        return review(
+            strategy,
+            wave.pickups.first().cloned(),
+            "snapshot validation failed",
+            errors,
+        );
+    }
+    if started.elapsed() >= timeout {
+        return timeout_review(strategy, wave.pickups.first().cloned());
+    }
+
+    let mut working = yard.clone();
+    let mut moves = Vec::new();
+
+    for (pickup_index, pickup_id) in wave.pickups.iter().enumerate() {
+        loop {
+            if started.elapsed() >= timeout {
+                return timeout_review(strategy, Some(pickup_id.clone()));
+            }
+            let Some((source_index, level)) = locate_container(&working, pickup_id) else {
+                return review(
+                    strategy,
+                    Some(pickup_id.clone()),
+                    "requested container is absent from the snapshot",
+                    vec![format!("container {pickup_id} was not found")],
+                );
+            };
+
+            if working.stacks[source_index].frozen {
+                return review(
+                    strategy,
+                    Some(pickup_id.clone()),
+                    "the first blocked pickup is in a frozen cell",
+                    vec![format!(
+                        "source stack {} is frozen by maintenance",
+                        working.stacks[source_index].id
+                    )],
+                );
+            }
+            if working.stacks[source_index].containers[level].customs_hold {
+                return review(
+                    strategy,
+                    Some(pickup_id.clone()),
+                    "the first blocked pickup is on customs hold",
+                    vec![format!("container {pickup_id} cannot move or be picked")],
+                );
+            }
+
+            let top_level = working.stacks[source_index].containers.len() - 1;
+            if level == top_level {
+                let source_id = working.stacks[source_index].id.clone();
+                working.stacks[source_index].containers.pop();
+                moves.push(PlannedMove {
+                    step: moves.len() + 1,
+                    kind: MoveKind::Pickup,
+                    container_id: pickup_id.clone(),
+                    from: source_id,
+                    to: "pickup_lane".to_string(),
+                    pickup_rank: pickup_index + 1,
+                    needed_for: format!("fulfill pickup {pickup_id}"),
+                    rule_checks: vec![
+                        "required_pickup_order".to_string(),
+                        "source_top".to_string(),
+                        "source_not_frozen".to_string(),
+                        "customs_hold_clear".to_string(),
+                    ],
+                });
+                break;
+            }
+
+            let blocker = working.stacks[source_index]
+                .containers
+                .last()
+                .expect("a buried pickup necessarily has a blocker")
+                .clone();
+            if blocker.customs_hold {
+                return review(
+                    strategy,
+                    Some(pickup_id.clone()),
+                    "a customs-held blocker cannot be moved",
+                    vec![format!(
+                        "container {} is above pickup {} and is on customs hold",
+                        blocker.id, pickup_id
+                    )],
+                );
+            }
+
+            let candidates = legal_destinations(&working, source_index, &blocker);
+            if candidates.is_empty() {
+                return review(
+                    strategy,
+                    Some(pickup_id.clone()),
+                    "no legal destination exists for the top blocker",
+                    explain_no_destination(&working, source_index, &blocker),
+                );
+            }
+            let destination_index = choose_destination(
+                &working,
+                source_index,
+                &blocker,
+                &candidates,
+                &wave.pickups[pickup_index..],
+                strategy,
+            );
+            let source_id = working.stacks[source_index].id.clone();
+            let destination_id = working.stacks[destination_index].id.clone();
+            working.stacks[source_index].containers.pop();
+            working.stacks[destination_index]
+                .containers
+                .push(blocker.clone());
+            moves.push(PlannedMove {
+                step: moves.len() + 1,
+                kind: MoveKind::Relocate,
+                container_id: blocker.id.clone(),
+                from: source_id,
+                to: destination_id,
+                pickup_rank: pickup_index + 1,
+                needed_for: format!("expose pickup {pickup_id}"),
+                rule_checks: relocation_checks(&blocker),
+            });
+        }
+    }
+
+    let relocations = moves
+        .iter()
+        .filter(|item| item.kind == MoveKind::Relocate)
+        .count();
+    let mut output = MovesOutput {
+        status: "executable".to_string(),
+        executable: true,
+        planner: strategy.name().to_string(),
+        relocations,
+        pickups: wave.pickups.len(),
+        simulator_verified: false,
+        moves,
+    };
+
+    if started.elapsed() >= timeout {
+        return timeout_review(strategy, wave.pickups.first().cloned());
+    }
+    let replay_budget = timeout.saturating_sub(started.elapsed());
+    match simulator::replay_with_timeout(yard, wave, &output.moves, replay_budget) {
+        Ok(()) => {
+            output.simulator_verified = true;
+            PlanOutput::Moves(output)
+        }
+        Err(error) if error == simulator::TIMEOUT_ERROR => {
+            timeout_review(strategy, wave.pickups.first().cloned())
+        }
+        Err(error) => review(
+            strategy,
+            wave.pickups.first().cloned(),
+            "separate transition replay rejected the candidate plan",
+            vec![error],
+        ),
+    }
+}
+
+fn locate_container(yard: &Yard, id: &str) -> Option<(usize, usize)> {
+    yard.stacks
+        .iter()
+        .enumerate()
+        .find_map(|(stack_index, stack)| {
+            stack
+                .containers
+                .iter()
+                .position(|container| container.id == id)
+                .map(|level| (stack_index, level))
+        })
+}
+
+fn legal_destinations(yard: &Yard, source: usize, container: &Container) -> Vec<usize> {
+    (0..yard.stacks.len())
+        .filter(|&destination| {
+            destination != source && destination_is_legal(yard, destination, container)
+        })
+        .collect()
+}
+
+fn destination_is_legal(yard: &Yard, destination: usize, container: &Container) -> bool {
+    let stack = &yard.stacks[destination];
+    if stack.frozen || stack.containers.len() >= yard.max_height {
+        return false;
+    }
+    if container.reefer && !stack.reefer_socket {
+        return false;
+    }
+    if stack
+        .containers
+        .last()
+        .is_some_and(|top| top.weight_class < container.weight_class)
+    {
+        return false;
+    }
+    for neighbor_id in &stack.neighbors {
+        let Some(neighbor) = yard.stacks.iter().find(|item| item.id == *neighbor_id) else {
+            return false;
+        };
+        if neighbor
+            .containers
+            .iter()
+            .any(|other| hazardous_conflict(yard, container, other))
+        {
+            return false;
+        }
+    }
+    true
+}
+
+fn choose_destination(
+    yard: &Yard,
+    source: usize,
+    blocker: &Container,
+    candidates: &[usize],
+    remaining_pickups: &[String],
+    strategy: Strategy,
+) -> usize {
+    let source_stack = &yard.stacks[source];
+    let future_ranks: BTreeMap<&str, usize> = remaining_pickups
+        .iter()
+        .take(LOOKAHEAD_PICKUPS)
+        .enumerate()
+        .map(|(rank, id)| (id.as_str(), rank))
+        .collect();
+
+    *candidates
+        .iter()
+        .min_by_key(|&&index| {
+            let destination = &yard.stacks[index];
+            let distance = manhattan(source_stack, destination);
+            match strategy {
+                Strategy::NearestBaseline => (0_usize, 0_usize, distance, destination.id.as_str()),
+                Strategy::BoundedLookahead => {
+                    let buried_rank = destination
+                        .containers
+                        .iter()
+                        .filter_map(|container| future_ranks.get(container.id.as_str()).copied())
+                        .min()
+                        .map_or(0, |rank| LOOKAHEAD_PICKUPS + 1 - rank);
+                    let constrained_top = usize::from(6_u8.saturating_sub(blocker.weight_class));
+                    let height = destination.containers.len() + 1;
+                    (
+                        buried_rank,
+                        height * 10 + constrained_top,
+                        distance,
+                        destination.id.as_str(),
+                    )
+                }
+            }
+        })
+        .expect("candidate list is non-empty")
+}
+
+fn manhattan(left: &Stack, right: &Stack) -> usize {
+    left.x.abs_diff(right.x) as usize + left.y.abs_diff(right.y) as usize
+}
+
+fn relocation_checks(container: &Container) -> Vec<String> {
+    vec![
+        "source_top".to_string(),
+        "source_not_frozen".to_string(),
+        "customs_hold_clear".to_string(),
+        "destination_not_frozen".to_string(),
+        "capacity_below_maximum".to_string(),
+        "heavy_below_light".to_string(),
+        if container.reefer {
+            "reefer_socket_present".to_string()
+        } else {
+            "reefer_socket_not_required".to_string()
+        },
+        "hazardous_neighbor_segregation".to_string(),
+    ]
+}
+
+fn explain_no_destination(yard: &Yard, source: usize, container: &Container) -> Vec<String> {
+    let mut counts: BTreeMap<&str, usize> = BTreeMap::new();
+    for (index, stack) in yard.stacks.iter().enumerate() {
+        if index == source {
+            continue;
+        }
+        let reason = if stack.frozen {
+            "frozen destination cells"
+        } else if stack.containers.len() >= yard.max_height {
+            "capacity limits"
+        } else if container.reefer && !stack.reefer_socket {
+            "reefer socket requirement"
+        } else if stack
+            .containers
+            .last()
+            .is_some_and(|top| top.weight_class < container.weight_class)
+        {
+            "weight placement rule"
+        } else {
+            "hazardous neighbor exclusion"
+        };
+        *counts.entry(reason).or_default() += 1;
+    }
+    counts
+        .into_iter()
+        .map(|(reason, count)| format!("{count} candidate stacks blocked by {reason}"))
+        .collect()
+}
+
+fn timeout_review(strategy: Strategy, pickup: Option<String>) -> PlanOutput {
+    review(
+        strategy,
+        pickup,
+        "planning deadline elapsed; no partial plan is executable",
+        vec!["time limit reached".to_string()],
+    )
+}
+
+fn review(
+    strategy: Strategy,
+    pickup: Option<String>,
+    reason: &str,
+    mut preventing_conditions: Vec<String>,
+) -> PlanOutput {
+    preventing_conditions.sort();
+    PlanOutput::Review(ReviewOutput {
+        status: "review_required".to_string(),
+        executable: false,
+        planner: strategy.name().to_string(),
+        first_blocked_pickup: pickup,
+        reason: reason.to_string(),
+        preventing_conditions,
+    })
+}
diff --git a/developer-simulation/runs/2026-08-08--container-yard-planner/src/simulator.rs b/developer-simulation/runs/2026-08-08--container-yard-planner/src/simulator.rs
new file mode 100644
index 0000000..02d5b0a
--- /dev/null
+++ b/developer-simulation/runs/2026-08-08--container-yard-planner/src/simulator.rs
@@ -0,0 +1,167 @@
+//! Separate state-transition replay.
+//!
+//! This module deliberately does not call the planner's legality helpers. It
+//! performs transition checks again while replaying emitted moves, but shares
+//! the model's static snapshot and hazardous-conflict definitions.
+
+use std::time::{Duration, Instant};
+
+use crate::model::{
+    MoveKind, PickupWave, PlannedMove, Yard, hazardous_conflict, validate_snapshot,
+};
+
+pub const TIMEOUT_ERROR: &str = "transition replay deadline elapsed";
+
+/// Replay a proposed plan using checks separate from the planner.
+///
+/// # Errors
+///
+/// Returns the first illegal transition or incomplete pickup sequence.
+#[allow(clippy::too_many_lines)]
+pub fn replay(yard: &Yard, wave: &PickupWave, moves: &[PlannedMove]) -> Result<(), String> {
+    replay_until(yard, wave, moves, None)
+}
+
+/// Replay a proposed plan within a strict validation budget.
+///
+/// # Errors
+///
+/// Returns the first illegal transition, incomplete pickup sequence, or a
+/// deadline error.
+pub fn replay_with_timeout(
+    yard: &Yard,
+    wave: &PickupWave,
+    moves: &[PlannedMove],
+    timeout: Duration,
+) -> Result<(), String> {
+    replay_until(yard, wave, moves, Some(Instant::now() + timeout))
+}
+
+#[allow(clippy::too_many_lines)]
+fn replay_until(
+    yard: &Yard,
+    wave: &PickupWave,
+    moves: &[PlannedMove],
+    deadline: Option<Instant>,
+) -> Result<(), String> {
+    validate_snapshot(yard).map_err(|errors| format!("invalid initial snapshot: {errors:?}"))?;
+    let mut state = yard.clone();
+    let mut next_pickup = 0_usize;
+
+    for (index, planned) in moves.iter().enumerate() {
+        if deadline.is_some_and(|limit| Instant::now() >= limit) {
+            return Err(TIMEOUT_ERROR.to_string());
+        }
+        let expected_step = index + 1;
+        if planned.step != expected_step {
+            return Err(format!(
+                "step numbering error: expected {expected_step}, got {}",
+                planned.step
+            ));
+        }
+        let source_index = stack_index(&state, &planned.from)
+            .ok_or_else(|| format!("step {expected_step}: unknown source {}", planned.from))?;
+        if state.stacks[source_index].frozen {
+            return Err(format!("step {expected_step}: source cell is frozen"));
+        }
+        let top = state.stacks[source_index]
+            .containers
+            .last()
+            .ok_or_else(|| format!("step {expected_step}: source stack is empty"))?;
+        if top.id != planned.container_id {
+            return Err(format!(
+                "step {expected_step}: {} is not the top container",
+                planned.container_id
+            ));
+        }
+        if top.customs_hold {
+            return Err(format!(
+                "step {expected_step}: container {} is on customs hold",
+                top.id
+            ));
+        }
+
+        match planned.kind {
+            MoveKind::Pickup => {
+                let expected = wave.pickups.get(next_pickup).ok_or_else(|| {
+                    format!("step {expected_step}: plan contains an extra pickup")
+                })?;
+                if &planned.container_id != expected || planned.to != "pickup_lane" {
+                    return Err(format!(
+                        "step {expected_step}: pickup order violation, expected {expected}"
+                    ));
+                }
+                state.stacks[source_index].containers.pop();
+                next_pickup += 1;
+            }
+            MoveKind::Relocate => {
+                let destination_index = stack_index(&state, &planned.to).ok_or_else(|| {
+                    format!("step {expected_step}: unknown destination {}", planned.to)
+                })?;
+                if destination_index == source_index {
+                    return Err(format!("step {expected_step}: source equals destination"));
+                }
+                if state.stacks[destination_index].frozen {
+                    return Err(format!("step {expected_step}: destination cell is frozen"));
+                }
+                if state.stacks[destination_index].containers.len() >= state.max_height {
+                    return Err(format!(
+                        "step {expected_step}: destination exceeds capacity"
+                    ));
+                }
+                if top.reefer && !state.stacks[destination_index].reefer_socket {
+                    return Err(format!(
+                        "step {expected_step}: reefer destination has no socket"
+                    ));
+                }
+                if state.stacks[destination_index]
+                    .containers
+                    .last()
+                    .is_some_and(|below| below.weight_class < top.weight_class)
+                {
+                    return Err(format!(
+                        "step {expected_step}: move creates a weight inversion"
+                    ));
+                }
+                for neighbor_id in &state.stacks[destination_index].neighbors {
+                    let neighbor_index = stack_index(&state, neighbor_id).ok_or_else(|| {
+                        format!("step {expected_step}: destination has unknown neighbor")
+                    })?;
+                    if state.stacks[neighbor_index]
+                        .containers
+                        .iter()
+                        .any(|other| hazardous_conflict(&state, top, other))
+                    {
+                        return Err(format!(
+                            "step {expected_step}: hazardous neighbor exclusion violated"
+                        ));
+                    }
+                }
+                let transferred = state.stacks[source_index]
+                    .containers
+                    .pop()
+                    .ok_or_else(|| format!("step {expected_step}: source became empty"))?;
+                state.stacks[destination_index].containers.push(transferred);
+            }
+        }
+
+        validate_snapshot(&state).map_err(|errors| {
+            format!("step {expected_step}: intermediate state invalid: {errors:?}")
+        })?;
+    }
+
+    if next_pickup != wave.pickups.len() {
+        return Err(format!(
+            "plan ended after {next_pickup} pickups; {} required",
+            wave.pickups.len()
+        ));
+    }
+    if deadline.is_some_and(|limit| Instant::now() >= limit) {
+        return Err(TIMEOUT_ERROR.to_string());
+    }
+    Ok(())
+}
+
+fn stack_index(yard: &Yard, id: &str) -> Option<usize> {
+    yard.stacks.iter().position(|stack| stack.id == id)
+}
diff --git a/developer-simulation/runs/2026-08-08--container-yard-planner/src/verification.rs b/developer-simulation/runs/2026-08-08--container-yard-planner/src/verification.rs
new file mode 100644
index 0000000..a1ffae2
--- /dev/null
+++ b/developer-simulation/runs/2026-08-08--container-yard-planner/src/verification.rs
@@ -0,0 +1,136 @@
+//! Executable artifact contract verification layered over transition replay.
+
+use crate::model::{MoveKind, MovesOutput, PickupWave, Yard};
+use crate::simulator;
+
+const PICKUP_CHECKS: [&str; 4] = [
+    "required_pickup_order",
+    "source_top",
+    "source_not_frozen",
+    "customs_hold_clear",
+];
+
+/// Verify output metadata and explanations before replaying state transitions.
+///
+/// # Errors
+///
+/// Returns the first dishonest or inconsistent contract field, or the first
+/// illegal transition found by the separate replay implementation.
+pub fn verify_moves_output(
+    yard: &Yard,
+    wave: &PickupWave,
+    output: &MovesOutput,
+) -> Result<(), String> {
+    if output.status != "executable" {
+        return Err("status must be executable".to_string());
+    }
+    if !output.executable {
+        return Err("executable flag must be true".to_string());
+    }
+    if output.planner.trim().is_empty() {
+        return Err("planner name must not be empty".to_string());
+    }
+    if !output.simulator_verified {
+        return Err("simulator_verified flag must be true".to_string());
+    }
+
+    let relocation_count = output
+        .moves
+        .iter()
+        .filter(|planned| planned.kind == MoveKind::Relocate)
+        .count();
+    let pickup_count = output
+        .moves
+        .iter()
+        .filter(|planned| planned.kind == MoveKind::Pickup)
+        .count();
+    if output.relocations != relocation_count {
+        return Err(format!(
+            "relocations count mismatch: declared {}, actual {relocation_count}",
+            output.relocations
+        ));
+    }
+    if output.pickups != pickup_count || pickup_count != wave.pickups.len() {
+        return Err(format!(
+            "pickups count mismatch: declared {}, actual {pickup_count}, required {}",
+            output.pickups,
+            wave.pickups.len()
+        ));
+    }
+
+    let mut completed_pickups = 0_usize;
+    for (index, planned) in output.moves.iter().enumerate() {
+        let expected_step = index + 1;
+        if planned.step != expected_step {
+            return Err(format!(
+                "step mismatch: expected {expected_step}, got {}",
+                planned.step
+            ));
+        }
+        let expected_rank = completed_pickups + 1;
+        let expected_pickup = wave.pickups.get(completed_pickups).ok_or_else(|| {
+            format!("step {expected_step}: move appears after the pickup wave completed")
+        })?;
+        if planned.pickup_rank != expected_rank {
+            return Err(format!(
+                "step {expected_step}: pickup_rank must be {expected_rank}, got {}",
+                planned.pickup_rank
+            ));
+        }
+
+        let (expected_reason, expected_checks) = match planned.kind {
+            MoveKind::Relocate => (
+                format!("expose pickup {expected_pickup}"),
+                relocation_checks(yard, &planned.container_id)?,
+            ),
+            MoveKind::Pickup => {
+                if planned.container_id != *expected_pickup {
+                    return Err(format!(
+                        "step {expected_step}: pickup metadata names {}, expected {expected_pickup}",
+                        planned.container_id
+                    ));
+                }
+                completed_pickups += 1;
+                (
+                    format!("fulfill pickup {expected_pickup}"),
+                    PICKUP_CHECKS.iter().map(ToString::to_string).collect(),
+                )
+            }
+        };
+        if planned.needed_for.trim().is_empty() || planned.needed_for != expected_reason {
+            return Err(format!(
+                "step {expected_step}: needed_for must be {expected_reason:?}"
+            ));
+        }
+        if planned.rule_checks != expected_checks {
+            return Err(format!(
+                "step {expected_step}: rule_checks do not match the required canonical checks"
+            ));
+        }
+    }
+
+    simulator::replay(yard, wave, &output.moves)
+}
+
+fn relocation_checks(yard: &Yard, container_id: &str) -> Result<Vec<String>, String> {
+    let container = yard
+        .stacks
+        .iter()
+        .flat_map(|stack| &stack.containers)
+        .find(|candidate| candidate.id == container_id)
+        .ok_or_else(|| format!("explanation names unknown container {container_id}"))?;
+    Ok(vec![
+        "source_top".to_string(),
+        "source_not_frozen".to_string(),
+        "customs_hold_clear".to_string(),
+        "destination_not_frozen".to_string(),
+        "capacity_below_maximum".to_string(),
+        "heavy_below_light".to_string(),
+        if container.reefer {
+            "reefer_socket_present".to_string()
+        } else {
+            "reefer_socket_not_required".to_string()
+        },
+        "hazardous_neighbor_segregation".to_string(),
+    ])
+}
diff --git a/developer-simulation/runs/2026-08-08--container-yard-planner/tests/acceptance.rs b/developer-simulation/runs/2026-08-08--container-yard-planner/tests/acceptance.rs
new file mode 100644
index 0000000..4d1aad4
--- /dev/null
+++ b/developer-simulation/runs/2026-08-08--container-yard-planner/tests/acceptance.rs
@@ -0,0 +1,647 @@
+use std::collections::BTreeMap;
+use std::fs;
+use std::path::{Path, PathBuf};
+use std::sync::atomic::{AtomicU64, Ordering};
+use std::time::{Duration, Instant};
+
+use container_yard_planner::demo_case;
+use container_yard_planner::model::{
+    Container, MoveKind, MovesOutput, PickupWave, PlanOutput, PlannedMove, ReviewOutput, Stack,
+    Yard,
+};
+use container_yard_planner::{planner, run_plan_files, simulator, verification, write_plan};
+
+const LIMIT: Duration = Duration::from_secs(10);
+static TEMP_COUNTER: AtomicU64 = AtomicU64::new(0);
+
+#[test]
+fn repeated_micro_geometry_is_deterministic_and_replays_every_move() {
+    let mut baseline_total = 0;
+    let mut planned_total = 0;
+
+    for suffix in 0..27 {
+        let (yard, wave) = demo_case(suffix);
+        let baseline = planner::baseline(&yard, &wave, LIMIT);
+        let planned = planner::plan(&yard, &wave, LIMIT);
+        let baseline_count = baseline.relocations().expect("baseline should complete");
+        let planned_count = planned.relocations().expect("planner should complete");
+        assert!(
+            planned_count * 100 <= baseline_count * 105,
+            "suffix repetition {suffix} is more than 5% worse"
+        );
+        baseline_total += baseline_count;
+        planned_total += planned_count;
+        let PlanOutput::Moves(moves) = planned else {
+            panic!("suffix repetition {suffix} did not produce moves");
+        };
+        simulator::replay(&yard, &wave, &moves.moves).expect("transition replay should pass");
+    }
+
+    assert_eq!(baseline_total, 81);
+    assert_eq!(planned_total, 54);
+    assert!(planned_total * 100 <= baseline_total * 80);
+    println!(
+        "repeated micro-geometry: repetitions=27 mechanical_baseline_total={baseline_total} mechanical_planned_total={planned_total} per_geometry=3_to_2"
+    );
+}
+
+#[test]
+fn three_infeasible_cases_return_non_executable_review_without_partial_moves() {
+    for (label, yard) in [
+        ("held pickup", held_pickup()),
+        ("frozen pickup", frozen_pickup()),
+        ("capacity dead end", capacity_dead_end()),
+    ] {
+        let wave = PickupWave {
+            pickups: vec!["P1".to_string()],
+        };
+        let output = planner::plan(&yard, &wave, LIMIT);
+        let PlanOutput::Review(review) = output else {
+            panic!("infeasible fixture returned executable moves");
+        };
+        assert!(!review.executable);
+        assert_eq!(review.first_blocked_pickup.as_deref(), Some("P1"));
+        assert!(!review.preventing_conditions.is_empty());
+        println!("synthetic infeasible case '{label}': {}", review.reason);
+    }
+}
+
+#[test]
+fn timeout_is_a_review_and_never_a_truncated_executable_plan() {
+    let (yard, wave) = demo_case(88);
+    let output = planner::plan(&yard, &wave, Duration::ZERO);
+    let PlanOutput::Review(review) = output else {
+        panic!("zero timeout returned executable moves");
+    };
+    assert!(!review.executable);
+    assert!(review.reason.contains("deadline elapsed"));
+}
+
+#[test]
+fn canonical_output_is_identical_across_five_runs_and_key_orders() {
+    let (yard, wave) = demo_case(7);
+    let expected = planner::plan(&yard, &wave, LIMIT)
+        .canonical_json()
+        .expect("output should serialize");
+    for _ in 0..5 {
+        assert_eq!(
+            planner::plan(&yard, &wave, LIMIT)
+                .canonical_json()
+                .expect("output should serialize"),
+            expected
+        );
+    }
+
+    let yard_variants = yard_key_order_variants();
+    let wave_variants = [
+        r#"{"pickups":["P1-7","P2-7"]}"#,
+        r#"{ "pickups" : [ "P1-7", "P2-7" ] }"#,
+        r#"{
+            "pickups": ["P1-7", "P2-7"]
+        }"#,
+        r#"{"pickups" : ["P1-7", "P2-7"]}"#,
+        r#"{ "pickups":["P1-7","P2-7"] }"#,
+    ];
+    for (yard_json, wave_json) in yard_variants.iter().zip(wave_variants) {
+        let parsed_yard: Yard = serde_json::from_str(yard_json).expect("valid yard variant");
+        let parsed_wave: PickupWave = serde_json::from_str(wave_json).expect("valid wave variant");
+        assert_eq!(
+            planner::plan(&parsed_yard, &parsed_wave, LIMIT)
+                .canonical_json()
+                .expect("output should serialize"),
+            expected
+        );
+    }
+}
+
+#[test]
+fn dense_representative_workload_finishes_under_deadline_and_replays() {
+    let (yard, wave) = dense_yard();
+    assert_eq!(yard.stacks.len(), 48 * 6);
+    assert_eq!(
+        yard.stacks
+            .iter()
+            .map(|stack| stack.containers.len())
+            .sum::<usize>(),
+        1_280
+    );
+    assert_eq!(wave.pickups.len(), 40);
+
+    let baseline = planner::baseline(&yard, &wave, LIMIT);
+    let baseline_relocations = baseline
+        .relocations()
+        .expect("dense baseline should complete");
+    let started = Instant::now();
+    let output = planner::plan(&yard, &wave, LIMIT);
+    let elapsed = started.elapsed();
+    let PlanOutput::Moves(moves) = output else {
+        panic!("representative workload should be feasible");
+    };
+    assert!(elapsed < LIMIT, "planner took {elapsed:?}");
+    simulator::replay(&yard, &wave, &moves.moves).expect("dense plan should replay");
+    assert!(moves.relocations * 100 <= baseline_relocations * 105);
+    println!(
+        "dense workload: stacks=288 containers=1280 pickups=40 baseline_relocations={baseline_relocations} planned_relocations={} total_moves={} elapsed={elapsed:?}",
+        moves.relocations,
+        moves.moves.len()
+    );
+}
+
+#[test]
+fn separate_transition_replay_rejects_illegal_top_and_weight_moves() {
+    let (yard, wave) = demo_case(0);
+    let illegal_non_top = vec![PlannedMove {
+        step: 1,
+        kind: MoveKind::Relocate,
+        container_id: "X1-0".to_string(),
+        from: "A".to_string(),
+        to: "C".to_string(),
+        pickup_rank: 1,
+        needed_for: "corruption test".to_string(),
+        rule_checks: vec![],
+    }];
+    assert!(simulator::replay(&yard, &wave, &illegal_non_top).is_err());
+
+    let illegal_weight = vec![
+        PlannedMove {
+            step: 1,
+            kind: MoveKind::Relocate,
+            container_id: "X2-0".to_string(),
+            from: "A".to_string(),
+            to: "B".to_string(),
+            pickup_rank: 1,
+            needed_for: "setup".to_string(),
+            rule_checks: vec![],
+        },
+        PlannedMove {
+            step: 2,
+            kind: MoveKind::Relocate,
+            container_id: "X1-0".to_string(),
+            from: "A".to_string(),
+            to: "B".to_string(),
+            pickup_rank: 1,
+            needed_for: "corruption test".to_string(),
+            rule_checks: vec![],
+        },
+    ];
+    let error = simulator::replay(&yard, &wave, &illegal_weight)
+        .expect_err("weight inversion should fail replay");
+    assert!(error.contains("weight inversion"));
+}
+
+#[test]
+fn destination_filter_enforces_reefer_frozen_weight_and_hazard_rules() {
+    let yard = constrained_destinations();
+    let wave = PickupWave {
+        pickups: vec!["P1".to_string()],
+    };
+    let output = planner::plan(&yard, &wave, LIMIT);
+    let PlanOutput::Moves(moves) = output else {
+        panic!("fixture has one legal reefer destination");
+    };
+    let relocation = moves
+        .moves
+        .iter()
+        .find(|item| item.kind == MoveKind::Relocate)
+        .expect("fixture requires relocation");
+    assert_eq!(relocation.to, "LEGAL");
+    assert!(
+        relocation
+            .rule_checks
+            .contains(&"reefer_socket_present".to_string())
+    );
+    simulator::replay(&yard, &wave, &moves.moves).expect("constrained plan should replay");
+}
+
+#[test]
+fn exact_reviewer_witness_is_a_safe_feasible_false_negative() {
+    let (yard, wave, witness) = feasible_false_negative_witness();
+    let proposal = planner::plan(&yard, &wave, LIMIT);
+    let PlanOutput::Review(review) = proposal else {
+        panic!("bounded proposal generator unexpectedly completed witness");
+    };
+    assert_eq!(review.first_blocked_pickup.as_deref(), Some("P"));
+    assert_eq!(
+        review.reason,
+        "no legal destination exists for the top blocker"
+    );
+    verification::verify_moves_output(&yard, &wave, &witness)
+        .expect("reviewer's three-move witness proves feasibility");
+}
+
+#[test]
+fn verifier_rejects_dishonest_metadata_and_explanations() {
+    let (yard, wave) = demo_case(0);
+    let PlanOutput::Moves(valid) = planner::plan(&yard, &wave, LIMIT) else {
+        panic!("demo must plan");
+    };
+    verification::verify_moves_output(&yard, &wave, &valid).expect("control must verify");
+
+    let mut corruptions: Vec<(&str, MovesOutput)> = Vec::new();
+    let mut changed = valid.clone();
+    changed.status = "not_executable".to_string();
+    corruptions.push(("status", changed));
+    let mut changed = valid.clone();
+    changed.executable = false;
+    corruptions.push(("executable", changed));
+    let mut changed = valid.clone();
+    changed.relocations = 999;
+    corruptions.push(("relocations", changed));
+    let mut changed = valid.clone();
+    changed.pickups = 999;
+    corruptions.push(("pickups", changed));
+    let mut changed = valid.clone();
+    changed.simulator_verified = false;
+    corruptions.push(("simulator flag", changed));
+    let mut changed = valid.clone();
+    changed.moves[0].step = 999;
+    corruptions.push(("step", changed));
+    let mut changed = valid.clone();
+    changed.moves[0].pickup_rank = 999;
+    corruptions.push(("pickup rank", changed));
+    let mut changed = valid.clone();
+    changed.moves[0].needed_for.clear();
+    corruptions.push(("empty reason", changed));
+    let mut changed = valid.clone();
+    changed.moves[0].needed_for = "wrong reason".to_string();
+    corruptions.push(("incorrect reason", changed));
+    let mut changed = valid.clone();
+    changed.moves[0].rule_checks.clear();
+    corruptions.push(("missing checks", changed));
+    let mut changed = valid;
+    changed.moves[0].rule_checks[0] = "invented_check".to_string();
+    corruptions.push(("incorrect checks", changed));
+
+    for (label, corrupted) in corruptions {
+        assert!(
+            verification::verify_moves_output(&yard, &wave, &corrupted).is_err(),
+            "verifier accepted corrupt {label}"
+        );
+    }
+}
+
+#[test]
+fn reused_output_success_to_review_is_exclusive() {
+    let fixture = FileFixture::new("success-review");
+    fixture.write_demo_inputs();
+    run_plan_files(&fixture.yard, &fixture.pickups, &fixture.output, LIMIT)
+        .expect("success generation should publish");
+    assert_only_current(&fixture.output, "moves.json");
+
+    fs::write(&fixture.pickups, r#"{"pickups":["MISSING"]}"#).expect("write infeasible wave");
+    let (review, _) = run_plan_files(&fixture.yard, &fixture.pickups, &fixture.output, LIMIT)
+        .expect("review generation should publish");
+    assert!(matches!(review, PlanOutput::Review(_)));
+    assert_only_current(&fixture.output, "review.json");
+}
+
+#[test]
+fn reused_output_review_to_success_is_exclusive() {
+    let fixture = FileFixture::new("review-success");
+    fixture.write_demo_inputs();
+    fs::write(&fixture.pickups, r#"{"pickups":["MISSING"]}"#).expect("write infeasible wave");
+    run_plan_files(&fixture.yard, &fixture.pickups, &fixture.output, LIMIT)
+        .expect("review generation should publish");
+    assert_only_current(&fixture.output, "review.json");
+
+    fixture.write_demo_inputs();
+    let (success, _) = run_plan_files(&fixture.yard, &fixture.pickups, &fixture.output, LIMIT)
+        .expect("success generation should publish");
+    assert!(matches!(success, PlanOutput::Moves(_)));
+    assert_only_current(&fixture.output, "moves.json");
+}
+
+#[test]
+fn reused_output_success_to_malformed_leaves_no_current_artifact() {
+    let fixture = FileFixture::new("success-malformed");
+    fixture.write_demo_inputs();
+    run_plan_files(&fixture.yard, &fixture.pickups, &fixture.output, LIMIT)
+        .expect("success generation should publish");
+    fs::write(&fixture.pickups, "{").expect("write malformed wave");
+    assert!(run_plan_files(&fixture.yard, &fixture.pickups, &fixture.output, LIMIT).is_err());
+    assert_no_current(&fixture.output);
+}
+
+#[test]
+fn reused_output_success_to_timeout_publishes_only_review() {
+    let fixture = FileFixture::new("success-timeout");
+    fixture.write_demo_inputs();
+    run_plan_files(&fixture.yard, &fixture.pickups, &fixture.output, LIMIT)
+        .expect("success generation should publish");
+    let (timed_out, _) = run_plan_files(
+        &fixture.yard,
+        &fixture.pickups,
+        &fixture.output,
+        Duration::ZERO,
+    )
+    .expect("timeout review should publish");
+    assert!(matches!(timed_out, PlanOutput::Review(_)));
+    assert_only_current(&fixture.output, "review.json");
+}
+
+#[test]
+fn reused_output_success_to_replay_rejection_publishes_only_review() {
+    let fixture = FileFixture::new("success-replay-rejection");
+    fixture.write_demo_inputs();
+    run_plan_files(&fixture.yard, &fixture.pickups, &fixture.output, LIMIT)
+        .expect("success generation should publish");
+    let rejection = PlanOutput::Review(ReviewOutput {
+        status: "review_required".to_string(),
+        executable: false,
+        planner: "bounded-lookahead-v1".to_string(),
+        first_blocked_pickup: Some("P1-0".to_string()),
+        reason: "separate transition replay rejected the candidate plan".to_string(),
+        preventing_conditions: vec!["injected replay rejection".to_string()],
+    });
+    write_plan(&fixture.output, &rejection).expect("replay rejection review should publish");
+    assert_only_current(&fixture.output, "review.json");
+}
+
+#[test]
+fn review_output_is_byte_deterministic() {
+    let (yard, wave, _) = feasible_false_negative_witness();
+    let expected = planner::plan(&yard, &wave, LIMIT)
+        .canonical_json()
+        .expect("review should serialize");
+    for _ in 0..5 {
+        assert_eq!(
+            planner::plan(&yard, &wave, LIMIT)
+                .canonical_json()
+                .expect("review should serialize"),
+            expected
+        );
+    }
+}
+
+fn plain(id: &str, weight_class: u8) -> Container {
+    Container {
+        id: id.to_string(),
+        weight_class,
+        reefer: false,
+        hazardous_group: None,
+        customs_hold: false,
+    }
+}
+
+fn base_stack(id: &str, x: i32, containers: Vec<Container>) -> Stack {
+    Stack {
+        id: id.to_string(),
+        x,
+        y: 0,
+        reefer_socket: false,
+        frozen: false,
+        neighbors: vec![],
+        containers,
+    }
+}
+
+fn held_pickup() -> Yard {
+    let mut pickup = plain("P1", 5);
+    pickup.customs_hold = true;
+    Yard {
+        max_height: 5,
+        hazardous_exclusions: BTreeMap::new(),
+        stacks: vec![base_stack("A", 0, vec![pickup]), base_stack("B", 1, vec![])],
+    }
+}
+
+fn frozen_pickup() -> Yard {
+    let mut source = base_stack("A", 0, vec![plain("P1", 5)]);
+    source.frozen = true;
+    Yard {
+        max_height: 5,
+        hazardous_exclusions: BTreeMap::new(),
+        stacks: vec![source, base_stack("B", 1, vec![])],
+    }
+}
+
+fn capacity_dead_end() -> Yard {
+    Yard {
+        max_height: 2,
+        hazardous_exclusions: BTreeMap::new(),
+        stacks: vec![
+            base_stack("A", 0, vec![plain("P1", 5), plain("X", 4)]),
+            base_stack("B", 1, vec![plain("B1", 5), plain("B2", 4)]),
+            base_stack("C", 2, vec![plain("C1", 5), plain("C2", 4)]),
+        ],
+    }
+}
+
+fn dense_yard() -> (Yard, PickupWave) {
+    let mut stacks = Vec::new();
+    let mut pickups = Vec::new();
+    for index in 0_usize..288 {
+        let height = if index < 128 { 5 } else { 4 };
+        let mut containers = Vec::new();
+        for level in 0..height {
+            let id = if (128..168).contains(&index) && level == 2 {
+                let id = format!("PICKUP-{index}");
+                pickups.push(id.clone());
+                id
+            } else {
+                format!("C-{index}-{level}")
+            };
+            containers.push(plain(&id, [5, 4, 3, 2, 1][level]));
+        }
+        stacks.push(Stack {
+            id: format!("S-{index:03}"),
+            x: i32::try_from(index / 6).expect("test coordinate fits i32"),
+            y: i32::try_from(index % 6).expect("test coordinate fits i32"),
+            reefer_socket: index % 3 == 0,
+            frozen: false,
+            neighbors: vec![],
+            containers,
+        });
+    }
+    (
+        Yard {
+            max_height: 5,
+            hazardous_exclusions: BTreeMap::new(),
+            stacks,
+        },
+        PickupWave { pickups },
+    )
+}
+
+fn constrained_destinations() -> Yard {
+    let mut reefer = plain("R", 2);
+    reefer.reefer = true;
+    reefer.hazardous_group = Some("A".to_string());
+    let mut hazard = plain("HZ", 5);
+    hazard.hazardous_group = Some("B".to_string());
+    let mut frozen = base_stack("FROZEN", 1, vec![]);
+    frozen.reefer_socket = true;
+    frozen.frozen = true;
+    let mut no_socket = base_stack("NO_SOCKET", 2, vec![]);
+    no_socket.reefer_socket = false;
+    let mut bad_weight = base_stack("BAD_WEIGHT", 3, vec![plain("LIGHT", 1)]);
+    bad_weight.reefer_socket = true;
+    let mut bad_hazard = base_stack("BAD_HAZARD", 4, vec![]);
+    bad_hazard.reefer_socket = true;
+    bad_hazard.neighbors = vec!["NEIGHBOR".to_string()];
+    let mut neighbor = base_stack("NEIGHBOR", 5, vec![hazard]);
+    neighbor.neighbors = vec!["BAD_HAZARD".to_string()];
+    let mut legal = base_stack("LEGAL", 6, vec![]);
+    legal.reefer_socket = true;
+    let mut exclusions = BTreeMap::new();
+    exclusions.insert("A".to_string(), vec!["B".to_string()]);
+    let mut source = base_stack("SOURCE", 0, vec![plain("P1", 5), reefer]);
+    source.reefer_socket = true;
+    Yard {
+        max_height: 5,
+        hazardous_exclusions: exclusions,
+        stacks: vec![
+            source, frozen, no_socket, bad_weight, bad_hazard, neighbor, legal,
+        ],
+    }
+}
+
+fn yard_key_order_variants() -> [String; 5] {
+    let (yard, _) = demo_case(7);
+    let normal = serde_json::to_string(&yard).expect("yard should serialize");
+    let stacks = serde_json::to_string(&yard.stacks).expect("stacks should serialize");
+    let exclusions =
+        serde_json::to_string(&yard.hazardous_exclusions).expect("exclusions should serialize");
+    [
+        normal,
+        format!(r#"{{"stacks":{stacks},"max_height":5,"hazardous_exclusions":{exclusions}}}"#),
+        format!(r#"{{"hazardous_exclusions":{exclusions},"stacks":{stacks},"max_height":5}}"#),
+        format!(r#"{{"max_height":5,"stacks":{stacks},"hazardous_exclusions":{exclusions}}}"#),
+        format!(
+            r#"{{ "stacks" : {stacks}, "hazardous_exclusions" : {exclusions}, "max_height" : 5 }}"#
+        ),
+    ]
+}
+
+fn feasible_false_negative_witness() -> (Yard, PickupWave, MovesOutput) {
+    let yard = Yard {
+        max_height: 3,
+        hazardous_exclusions: BTreeMap::new(),
+        stacks: vec![
+            base_stack("A", 0, vec![plain("P", 5), plain("X2", 4), plain("X1", 2)]),
+            base_stack("B", 1, vec![plain("B0", 5)]),
+            base_stack("C", 2, vec![plain("C0", 3)]),
+        ],
+    };
+    let wave = PickupWave {
+        pickups: vec!["P".to_string()],
+    };
+    let relocation_checks = vec![
+        "source_top".to_string(),
+        "source_not_frozen".to_string(),
+        "customs_hold_clear".to_string(),
+        "destination_not_frozen".to_string(),
+        "capacity_below_maximum".to_string(),
+        "heavy_below_light".to_string(),
+        "reefer_socket_not_required".to_string(),
+        "hazardous_neighbor_segregation".to_string(),
+    ];
+    let witness = MovesOutput {
+        status: "executable".to_string(),
+        executable: true,
+        planner: "manual-reviewer-witness".to_string(),
+        relocations: 2,
+        pickups: 1,
+        simulator_verified: true,
+        moves: vec![
+            PlannedMove {
+                step: 1,
+                kind: MoveKind::Relocate,
+                container_id: "X1".to_string(),
+                from: "A".to_string(),
+                to: "C".to_string(),
+                pickup_rank: 1,
+                needed_for: "expose pickup P".to_string(),
+                rule_checks: relocation_checks.clone(),
+            },
+            PlannedMove {
+                step: 2,
+                kind: MoveKind::Relocate,
+                container_id: "X2".to_string(),
+                from: "A".to_string(),
+                to: "B".to_string(),
+                pickup_rank: 1,
+                needed_for: "expose pickup P".to_string(),
+                rule_checks: relocation_checks,
+            },
+            PlannedMove {
+                step: 3,
+                kind: MoveKind::Pickup,
+                container_id: "P".to_string(),
+                from: "A".to_string(),
+                to: "pickup_lane".to_string(),
+                pickup_rank: 1,
+                needed_for: "fulfill pickup P".to_string(),
+                rule_checks: vec![
+                    "required_pickup_order".to_string(),
+                    "source_top".to_string(),
+                    "source_not_frozen".to_string(),
+                    "customs_hold_clear".to_string(),
+                ],
+            },
+        ],
+    };
+    (yard, wave, witness)
+}
+
+struct FileFixture {
+    root: PathBuf,
+    yard: PathBuf,
+    pickups: PathBuf,
+    output: PathBuf,
+}
+
+impl FileFixture {
+    fn new(label: &str) -> Self {
+        let serial = TEMP_COUNTER.fetch_add(1, Ordering::Relaxed);
+        let root = std::env::temp_dir().join(format!(
+            "container-yard-planner-{label}-{}-{serial}",
+            std::process::id()
+        ));
+        fs::create_dir_all(&root).expect("create isolated fixture root");
+        Self {
+            yard: root.join("yard.json"),
+            pickups: root.join("pickups.json"),
+            output: root.join("output"),
+            root,
+        }
+    }
+
+    fn write_demo_inputs(&self) {
+        let (yard, wave) = demo_case(0);
+        fs::write(
+            &self.yard,
+            serde_json::to_vec(&yard).expect("serialize yard"),
+        )
+        .expect("write yard");
+        fs::write(
+            &self.pickups,
+            serde_json::to_vec(&wave).expect("serialize wave"),
+        )
+        .expect("write wave");
+    }
+}
+
+impl Drop for FileFixture {
+    fn drop(&mut self) {
+        let _ = fs::remove_dir_all(&self.root);
+    }
+}
+
+fn assert_only_current(output: &Path, expected: &str) {
+    assert!(output.join(expected).is_file());
+    for other in ["moves.json", "review.json", ".yard-plan.tmp"] {
+        if other != expected {
+            assert!(!output.join(other).exists(), "stale artifact: {other}");
+        }
+    }
+}
+
+fn assert_no_current(output: &Path) {
+    for artifact in ["moves.json", "review.json", ".yard-plan.tmp"] {
+        assert!(
+            !output.join(artifact).exists(),
+            "stale artifact: {artifact}"
+        );
+    }
+}
diff --git a/developer-simulation/runs/2026-08-08--remittance-reconciliation/Cargo.toml b/developer-simulation/runs/2026-08-08--remittance-reconciliation/Cargo.toml
new file mode 100644
index 0000000..d82d294
--- /dev/null
+++ b/developer-simulation/runs/2026-08-08--remittance-reconciliation/Cargo.toml
@@ -0,0 +1,15 @@
+[package]
+name = "remittance-reconciliation"
+version = "0.1.0"
+edition = "2024"
+publish = false
+
+[dependencies]
+serde = { version = "1", features = ["derive"] }
+serde_json = "1"
+
+[lints.rust]
+unsafe_code = "forbid"
+
+[lints.clippy]
+all = "deny"
diff --git a/developer-simulation/runs/2026-08-08--remittance-reconciliation/README.md b/developer-simulation/runs/2026-08-08--remittance-reconciliation/README.md
new file mode 100644
index 0000000..22f9514
--- /dev/null
+++ b/developer-simulation/runs/2026-08-08--remittance-reconciliation/README.md
@@ -0,0 +1,130 @@
+# Conservative remittance-to-claim reconciliation prototype
+
+This is an offline Rust command-line prototype for matching normalized remittance service lines to the current revisions of open claim service lines without silently guessing. It uses integer cents, resolves each bounded candidate cluster as a whole, sends ties and unsupported shapes to review, and writes deterministic JSONL results.
+
+All included fixture generation is synthetic. The program has no database or network integration and does not auto-post anything.
+
+## BogKit fit decision
+
+The prototype deliberately does not depend on Fold, ESE, or ANNy.
+
+- Fold's public examples center on durable, incrementally maintained views. This job receives one immutable nightly snapshot and needs a bounded global assignment before emitting any decision. Persistence and incremental retraction do not solve that core constraint.
+- ESE and ANNy provide semantic similarity and nearest-neighbor search. Approximate similarity is the wrong safety primitive for exact identifiers, integer-money conservation, and a policy that turns uncertainty into review work.
+
+Fold could become useful outside this prototype for durable ingestion or audit views if the surrounding system becomes incremental. In this one trial, the public BogKit surface did not provide the exact constrained assignment needed here. That is a one-off fit observation, not a BogKit defect or feature candidate.
+
+## What the prototype does
+
+1. Parses each JSONL record into an owned typed value while reusing one line buffer. Source inspection confirms buffer reuse and clearing at the next read boundary; this is not a claim of measured memory erasure.
+2. Quarantines malformed rows, every physical row sharing a duplicate remittance ID, and every physical claim row sharing a `(claim_line_id, revision)` key before indexing. Identical duplicates are invalid too; they are not treated as idempotent capacity.
+3. Keeps only the highest revision for each claim-line ID.
+4. Builds separate exact-reference and complete-fallback-identity candidate sets. When both are nonempty, only their intersection may be allocated, for both single-line and split options. If the sources disagree and their shared candidates cannot fund a complete assignment, the remittance is reviewed as `conflicting_identity_sources`; an additive score never authorizes a one-source candidate.
+5. Finds connected candidate clusters, capped at 24 claim plus remittance nodes.
+6. Enumerates one-to-one, multiple-payments-to-one-line, and same-claim splits only when the remittance exactly equals a subset of full current open balances. Partial line allocation is not implemented and is reviewed as `unsupported_partial_split`.
+7. Searches the cluster as a whole under claim capacity, sign, and cent-conservation rules. The search has a deterministic one-million-node ceiling; clusters that exceed it are reviewed as unsupported instead of running without a bound.
+8. Reviews equal-best assignments as `conflicting_strong_candidates`. Standalone reversals are reviewed as `unsupported_standalone_reversal` because this input has no authoritative prior-applied amount; only reversals offset by a positive same-snapshot allocation are supported.
+9. Writes canonically sorted `accepted.jsonl`, `review.jsonl`, and `summary.json`.
+
+Accepted explanations contain record IDs and normalized fact/reason codes only. They never copy a patient key.
+
+## Build and quick demonstration
+
+Rust 1.95.0 was used for the recorded run. The only external crates are
+`serde` and `serde_json`. The simulator's temporary child workspace marker and
+lockfile were removed during archival; this package now uses the lab's single
+`developer-simulation/Cargo.lock`.
+
+```sh
+cargo build --release --locked
+cargo run --release --locked -- demo --work-dir /tmp/remittance-demo
+```
+
+The demo creates 400 claim records and 200 remittance records, runs both solvers, and verifies the safer solver. Its output remains under the work directory named in the command.
+
+If crates.io is unavailable but the locked dependencies are already cached, prefix Cargo commands with `CARGO_NET_OFFLINE=true`.
+
+## Exact full acceptance run
+
+The script builds in a temporary directory, generates exactly 62,000 claim records and 50,000 remittance records, runs and verifies the cluster solver, measures the greedy comparator, checks ten fixed shuffle seeds, and removes all generated fixture/build/result data when it exits.
+
+```sh
+./scripts/run-acceptance.sh
+```
+
+The ten seeds are `1 2 3 5 8 13 21 34 55 89` because no externally supplied seed files accompanied the scenario.
+
+Run the source checks separately:
+
+```sh
+cargo fmt -p remittance-reconciliation -- --check
+cargo test --offline --locked -p remittance-reconciliation --all-targets
+cargo clippy --offline --locked -p remittance-reconciliation --all-targets --all-features -- -D warnings
+```
+
+The focused overlapping-identity regression is also runnable directly:
+
+```sh
+cargo run --release --locked -- reconcile \
+  --claims tests/fixtures/overlapping-identity/claims.jsonl \
+  --remittances tests/fixtures/overlapping-identity/remittances.jsonl \
+  --out /tmp/remittance-overlap-results
+cargo run --release --locked -- verify \
+  --claims tests/fixtures/overlapping-identity/claims.jsonl \
+  --remittances tests/fixtures/overlapping-identity/remittances.jsonl \
+  --ground-truth tests/fixtures/overlapping-identity/ground-truth.jsonl \
+  --results /tmp/remittance-overlap-results
+```
+
+It deliberately presents exact-reference candidates `{A,B}` and fallback candidates `{B,C}`. The shared `B` has only 50 cents of open capacity for a 100-cent remittance, while `A` and `C` could each fund it alone. Expected behavior is `conflicting_identity_sources` review for that row and acceptance of the unrelated control row.
+
+## Manual commands
+
+```sh
+remittance-reconciliation generate \
+  --out /tmp/remittance-fixture \
+  --claim-count 62000 \
+  --remittance-count 50000
+
+remittance-reconciliation reconcile \
+  --claims /tmp/remittance-fixture/claims.jsonl \
+  --remittances /tmp/remittance-fixture/remittances.jsonl \
+  --out /tmp/remittance-results
+
+remittance-reconciliation verify \
+  --claims /tmp/remittance-fixture/claims.jsonl \
+  --remittances /tmp/remittance-fixture/remittances.jsonl \
+  --ground-truth /tmp/remittance-fixture/ground-truth.jsonl \
+  --results /tmp/remittance-results
+```
+
+`baseline` faithfully stages exact insurer-reference candidates first and chooses the first feasible one in input order. Complete fallback identity runs only when that reference stage has no feasible candidate; greediness remains within each stage. It does not support splits. `shuffle` deterministically reorders both inputs for stability testing. Run `remittance-reconciliation help` for their flags.
+
+## Input schema
+
+Dates are integer day numbers and money is signed integer cents. Reversals must have a negative `paid_cents + adjustment_cents`; payments and denials must have a positive total. Date ranges longer than 31 days are quarantined as `unsupported_date_range` instead of partially searched. A valid standalone reversal still requires prior-posting authority that this schema does not contain, so it is reviewed rather than accepted.
+
+Claim records contain:
+
+```json
+{"claim_line_id":"C-001","claim_id":"CLAIM-001","revision":2,"payer":"payer-00","provider":"provider-00","patient_key":"synthetic-key-001","service_date":20000,"procedure_code":"PROC-001","billed_cents":500,"open_balance_cents":500,"insurer_references":["REF-001"]}
+```
+
+Remittance records contain:
+
+```json
+{"remittance_line_id":"R-001","payer":"payer-00","provider":"provider-00","insurer_reference":"REF-001","patient_key":"synthetic-key-001","service_date_start":20000,"service_date_end":20000,"procedure_code":"PROC-001","paid_cents":500,"adjustment_cents":0,"adjustment_codes":[],"transaction_kind":"payment"}
+```
+
+## Outputs
+
+- `accepted.jsonl`: one record per accepted allocation. A same-claim split has multiple records with the same remittance-line ID. Each record lists contributing fact codes and rejected candidate IDs with reason codes.
+- `review.jsonl`: exactly one record for every non-accepted physical remittance row. `physical_record_ordinal` distinguishes duplicate physical rows deterministically without copying source fields.
+- `summary.json`: deterministic counts only; runtime is intentionally excluded so shuffled runs remain byte-identical.
+
+Stable review codes include `missing_identity`, `conflicting_identity_sources`, `conflicting_strong_candidates`, `duplicate_remittance_id`, `duplicate_claim_key`, `amount_inconsistent`, `unsupported_bundle`, `unsupported_partial_split`, `unsupported_standalone_reversal`, `unsupported_date_range`, `search_budget_exhausted`, `no_plausible_candidate`, and `malformed_record`.
+
+## Evidence and limitations
+
+The skeptical-review trail is in `evidence/`. Accuracy figures apply only to this crate's deterministic authored generator and matching authored truth; they are not production accuracy or independent evaluation evidence. The 50,000 remittance rows comprise 49,851 unique-reference bulk rows plus: 24 greedy-trap rows, 12 full-balance-subset split rows, 24 multiple-payment rows, 12 revision rows, 12 duplicate-reference rows, 24 paired payment/reversal rows, 12 denial rows, 12 missing-optional-field rows, 12 deliberately ambiguous rows, 4 unsupported cross-claim bundles, and 1 malformed row carrying a remittance-only privacy secret.
+
+The actual externally described evaluation fixture, its hidden ground truth, supplied seed files, and specified laptop were not present, so claims about those artifacts remain untested. Peak resident memory was not captured because the sandbox denied `/usr/bin/time -l` access to `sysctl`. Raw-line handling is source-audited buffer reuse, not measured erasure. The verifier scans claim and remittance patient keys—including the remittance-only secret—against serialized outputs. Medical adjustment semantics are intentionally normalized and do not substitute for X12 adjudication rules.
diff --git a/developer-simulation/runs/2026-08-08--remittance-reconciliation/evidence/ACCEPTANCE.md b/developer-simulation/runs/2026-08-08--remittance-reconciliation/evidence/ACCEPTANCE.md
new file mode 100644
index 0000000..adbfd5b
--- /dev/null
+++ b/developer-simulation/runs/2026-08-08--remittance-reconciliation/evidence/ACCEPTANCE.md
@@ -0,0 +1,45 @@
+# Acceptance evidence
+
+Recorded on 2026-08-08 with Rust 1.95.0. Generated fixtures and build outputs were kept in `/private/tmp` and removed after the final checks.
+
+| Check | Observed result | Status |
+|---|---|---|
+| Deterministic generator size | 62,000 claim records; 50,000 remittance records | Pass |
+| Generator-only precision | 49,995 / 49,995 accepted links correct against authored truth = 100% | Pass, narrow claim only |
+| Generator-only recall | 49,995 / 49,995 authored unambiguous truth links found = 100% | Pass, narrow claim only |
+| Generator safety invariants | 0 duplicate, over-application, reversal-sign, cross-claim split, or cent-conservation failures | Pass |
+| Contradictory identity regressions | Disjoint sets review; partially overlapping `{A,B}` / `{B,C}` sets expose only shared `B`; underfunded `B` reviews in reversed/shuffled mixed clusters with byte-identical output; feasible `B` and one-source controls accept; one-source split candidates stay excluded | Pass |
+| Duplicate remittance regressions | Identical and divergent rows, adjacent/separated/reordered, all physical rows reviewed with ordinals; unrelated cluster accepted | Pass |
+| Duplicate claim-key regressions | Identical and divergent rows, adjacent/separated/reordered, no capacity created; related remittances reviewed and unrelated cluster accepted | Pass |
+| Comparator staging | Unique reference wins regardless order; duplicate references remain greedy within reference stage; missing/unacceptable reference falls back | Pass |
+| Narrow settlement scope | Partial same-claim split reviewed as `unsupported_partial_split`; standalone reversal reviewed as `unsupported_standalone_reversal` | Pass |
+| Dense exhaustion | Public end-to-end 12-claim/12-remittance cluster exhausted the node budget and emitted 12 `search_budget_exhausted` reviews | Pass |
+| Review partition | 17 reviewed remittance lines: 12 ambiguous, 4 unsupported cross-claim bundles, 1 malformed | Pass |
+| Shuffle stability | Seeds 1, 2, 3, 5, 8, 13, 21, 34, 55, 89 all byte-identical for all three outputs | Pass |
+| Runtime | Final round-two ordered run 4.705s; shuffled runs 4.823s to 5.195s | Pass against 60s limit on this environment/generator |
+| Explanation/privacy | Every accepted link had facts and competitor reasons; verifier scanned claim and remittance patient keys, including a remittance-only secret, against serialized outputs | Pass |
+| Malformed isolation | One malformed claim and one malformed remittance were quarantined; 49,983 unrelated remittance lines still accepted | Pass |
+| Greedy baseline | 99.903944% precision, 99.855986% recall, 12 obsolete-revision integrity failures | Fails required precision and invariants |
+| Actual external fixture | No external fixture, hidden truth, or supplied seed files were present | Not tested |
+| Peak resident memory | `/usr/bin/time -l` completed the app in 4.591s but then failed on sandboxed `sysctl kern.clockrate` | Not measured |
+
+Exact improved verifier output is preserved in `verification-report.json`; the comparator is in `baseline-report.json`.
+
+## Authored remittance-shape counts
+
+| Shape | Physical remittance rows |
+|---|---:|
+| Bulk unique exact reference | 49,851 |
+| Greedy capacity trap | 24 |
+| Same-claim split equal to full-balance subset | 12 |
+| Multiple payments to one claim line | 24 |
+| Revised claim line | 12 |
+| Duplicate insurer reference, resolved by agreeing identity | 12 |
+| Same-snapshot paired payment and reversal | 24 |
+| Denial | 12 |
+| Exact reference with missing optional fields | 12 |
+| Deliberately ambiguous | 12 |
+| Unsupported cross-claim bundle | 4 |
+| Malformed row with remittance-only privacy key | 1 |
+
+These counts describe generator composition, not production prevalence. B1 disjoint and partial-overlap conflicts, B2 duplicates, partial splits, standalone reversals, comparator staging, and dense search exhaustion are covered by dedicated adversarial tests rather than hidden inside bulk volume.
diff --git a/developer-simulation/runs/2026-08-08--remittance-reconciliation/evidence/DECISION_AUDIT.md b/developer-simulation/runs/2026-08-08--remittance-reconciliation/evidence/DECISION_AUDIT.md
new file mode 100644
index 0000000..f7bc62b
--- /dev/null
+++ b/developer-simulation/runs/2026-08-08--remittance-reconciliation/evidence/DECISION_AUDIT.md
@@ -0,0 +1,51 @@
+# Consequential decision audit
+
+## Decisions taken
+
+| Decision | Evidence used | Consequence | Reversibility |
+|---|---|---|---|
+| Use no BogKit component in the core prototype. | Public README and all four public examples; immutable batch and exact-money constraints. | The result tests product fit honestly and avoids approximate or persistence-oriented machinery in the posting decision. | Easy: a later adapter can feed validated events into Fold without changing output contracts. |
+| Reproduce the stated staged greedy behavior as a separate command. | Scenario baseline description and fix-round reference-order regressions. | Exact reference runs first; fallback runs only when no reference candidate is feasible. This remains an authored comparator, not the production Java/SQL executable. | Easy. |
+| Treat the highest revision for a claim-line ID as current. | Revised-claim pain and current-open-snapshot premise. | Prevents posting to obsolete revisions. | Requires an explicit upstream current-revision marker if real exports use different semantics. |
+| Require exact insurer reference or complete exact fallback identity. | Precision threshold and prohibition on guessing. | Missing fallback fields go to review; unique exact references can still match. | Threshold/fact policy is isolated in candidate generation. |
+| Resolve a connected cluster as a whole. | Greedy consumption and mutually inconsistent split/reversal cases. | Later stronger matches and shared capacities influence the joint answer. | Core algorithm choice; output contract remains stable. |
+| Support only single links, multiple remittances to one line, and same-claim splits equal to a subset of full open balances. | Explicit prototype boundary plus skeptical-review partial-split counterexample. | Cross-claim bundles are `unsupported_bundle`; partial same-claim allocations are `unsupported_partial_split`. | Expand only with an authoritative allocation rule and independent truth. |
+| Support reversals only when offset by same-snapshot positive allocation. | No prior-applied authority exists in the schema. | Standalone reversals are reviewed as `unsupported_standalone_reversal`, not mislabeled as amount errors. | Add authoritative prior-applied capacity before broadening. |
+| Quarantine all physical logical duplicates before indexing. | Duplicate remittance and claim-key counterexamples. | Identical and divergent duplicates cannot create decisions or capacity; remittance review ordinals account for every physical row. | The duplicate policy can change only with an explicit idempotency contract. |
+| Intersect nonempty exact-reference and complete-fallback sets before generating any allocation. | Disjoint two-claim counterexample and partial-overlap `{A,B}` / `{B,C}` counterexample. | Every accepted single or split allocation is supported by both available identity sources; an infeasible disagreement is reviewed as `conflicting_identity_sources`. | Candidate provenance remains available if policy evolves. |
+| Review equal-best solutions and exhausted searches. | Uncertainty-as-review requirement. | Precision is favored over speculative recall; pathological clusters are bounded. | Search budget and tie policy are constants. |
+| Keep runtime out of `summary.json`. | Byte-identical shuffle requirement. | Result files contain only deterministic values; timing stays in command output/evidence. | Easy. |
+| Emit IDs, physical ordinals, and enumerated codes only. | Privacy-safe diagnostics requirement. | Explanations remain machine-checkable without copying patient keys; verifier scans both input sources against serialized outputs. | Output schema can add other non-identifying codes later. |
+| Cap fallback date ranges at 31 days and quarantine longer ranges. | Need to avoid an unbounded range scan without silently truncating it. | Long-range fallback records are reviewed as `unsupported_date_range`; exact external semantics remain a future choice. | Constant/policy change with tests. |
+| Keep all generated fixtures, result files, and build output outside the archive. | Archive-cleanliness requirement. | Deliverable contains only source, lockfile, scripts, README, and compact evidence. | Not applicable. |
+
+## Rejected alternatives
+
+- **Fold as the reconciliation engine:** rejected because materialized incremental views do not themselves choose a globally consistent bounded assignment. Adding persistence to a read-only snapshot would expand the prototype without meeting the core acceptance criteria.
+- **ESE or ANNy candidate generation:** rejected because approximate semantic proximity is neither necessary nor safe for exact normalized fields and integer money.
+- **Keep greedy matching and add a score threshold:** rejected because a locally strong first choice can still consume capacity needed by a later stronger choice.
+- **Auto-select a deterministic winner for a tied optimum:** rejected because input-order independence is not the same as correctness; a stable guess is still a guess.
+- **Generic many-to-many min-cost flow:** rejected because the scenario explicitly excludes arbitrary many-to-many settlement and same-claim split rules need domain-specific option generation. It would also add a dependency for a bounded prototype.
+- **Database, network, ML, or X12 integration:** rejected as explicit non-goals and unnecessary risk.
+- **Write generated fixtures or result archives into the deliverable:** rejected to keep the archive self-contained and clean.
+
+## Dependencies
+
+- Rust toolchain; recorded with Rust 1.95.0.
+- `serde` 1.0.229 and `serde_json` 1.0.150 plus their transitive crates, resolved
+  by the lab's single nested workspace lockfile after archival.
+- Standard shell utilities `mktemp`, `cmp`, and `rm` for the acceptance script only.
+- No BogKit crate, database, network service, medical terminology service, or production integration.
+
+## Uncertainty and untested claims
+
+- The externally described 50,000-line fixture, verifier-only truth, and ten supplied seeds were not present. The recorded full workload comes from this crate's deterministic authored generator and truth; it cannot prove production prevalence, performance, or accuracy.
+- The current-revision rule assumes the highest revision number is authoritative inside one immutable snapshot. A real export should state this invariant explicitly.
+- Adjustment and reversal signs are normalized to a signed `paid_cents + adjustment_cents`; raw X12 CAS semantics are outside scope.
+- Peak RSS was not captured because the sandbox denied a `sysctl` requested by `/usr/bin/time -l`. Source inspection shows one reused raw line buffer cleared at the next read boundary; this is not measured erasure or a measured memory ceiling.
+- The runtime was measured in this environment, not on a separately characterized four-core laptop. The implementation is single-threaded, so it does not depend on more than one core.
+- Dense adversarial clusters can exhaust the deterministic search-node budget and will be reviewed. This is intentional safety behavior, but its recall effect on an unavailable real fixture is unknown.
+- Duplicate remittance IDs are not modeled by the 50,000-row generator. This fix chooses the conservative contract that every physical duplicate is invalid, including byte-identical rows; dedicated adversarial tests cover that policy.
+- The simulator's temporary `[workspace]` and member `Cargo.lock` were removed
+  during archival. Locked metadata, tests, Clippy, and archive validation are
+  recorded in the dated lab report.
diff --git a/developer-simulation/runs/2026-08-08--remittance-reconciliation/evidence/DISCOVERY_AND_FRICTION.md b/developer-simulation/runs/2026-08-08--remittance-reconciliation/evidence/DISCOVERY_AND_FRICTION.md
new file mode 100644
index 0000000..39fa3d1
--- /dev/null
+++ b/developer-simulation/runs/2026-08-08--remittance-reconciliation/evidence/DISCOVERY_AND_FRICTION.md
@@ -0,0 +1,143 @@
+# Ordered discovery, debugging, and friction trail
+
+This trail was recorded from the sanitized checkout only. No Git history, GitHub, prior simulation material, automation memory, other trial, or BogKit source internals were inspected.
+
+1. Read the complete scenario.
+
+   Command: `sed -n '1,260p' /private/tmp/bogkit-sim-2026-08-08-designer/trial1-brief.md`
+
+   Observed: an immutable nightly batch; 62,000 claim revisions; 50,000 remittance lines; exact-cent conservation; bounded clusters of at most 24 nodes; uncertainty must become review; required greedy-baseline comparison, hidden-truth accuracy, ten-seed stability, and 60-second runtime.
+
+2. Started from the public root README and enumerated only public examples, as required.
+
+   Commands:
+
+   ```sh
+   sed -n '1,320p' README.md
+   find examples -maxdepth 3 -type f -print
+   ```
+
+   Observed: Fold is described as a durable incremental-programming framework; ESE as static embeddings; ANNy as HNSW nearest-neighbor search. Public examples were `starter`, `timeseries`, `search`, and `chat`.
+
+3. Read every public example before making the fit decision.
+
+   Commands: `sed -n '1,420p'` over each example's `Cargo.toml` and `src/main.rs`.
+
+   Observed: Fold examples materialize counts, bags, aggregates, tables, and search indexes under insert/retract/upsert workloads. None demonstrates exact, bounded global assignment. ESE/ANNy are used for semantic document retrieval.
+
+4. Chose an evidence-backed BogKit no-fit for the reconciliation core.
+
+   Reason: an immutable batch does not benefit from durable incremental materialization during the prototype, while approximate semantic similarity is unsafe for money posting. In this one trial, no public primitive directly performed the constrained assignment. This is a one-off fit observation, not a defect or promoted feature candidate.
+
+5. Reproduced the baseline and implemented the safer path.
+
+   The one binary contains `baseline`, `reconcile`, `generate`, `shuffle`, `verify`, and `demo`. After fix round 1, the comparator runs exact-reference candidates first and fallback only when that stage has no feasible match; greediness remains inside each stage. The safer path keeps candidate-source provenance, filters obsolete revisions and duplicates, builds connected components, and searches the allowed cluster assignments under exact-cent constraints.
+
+6. First test attempt hit temporary lab-packaging behavior because the assigned output crate sat beneath, but outside, the parent Cargo workspace.
+
+   Command: `CARGO_TARGET_DIR=/private/tmp/bogkit-trial1-target cargo test --all-targets`
+
+   Observed: `current package believes it's in a workspace when it's not`; Cargo suggested adding the package to root workspace members or adding an empty `[workspace]` table. Modifying the root manifest was prohibited, so the temporary simulator package used `[workspace]`. This is not BogKit API/scaffold friction. The coordinator later removed it and the member lockfile during the required nested-workspace archive transform.
+
+7. Second test attempt failed on network access.
+
+   Same command after the workspace fix.
+
+   Observed: three retries ended with `Could not resolve host: index.crates.io`. Re-running with `CARGO_NET_OFFLINE=true` used already cached dependencies. No network access was added to the prototype.
+
+8. First offline compile exposed one prototype-authoring type-inference error.
+
+   Command: `CARGO_NET_OFFLINE=true CARGO_TARGET_DIR=/private/tmp/bogkit-trial1-target cargo test --all-targets`
+
+   Observed: `E0282` at the candidate index set. Adding the explicit `BTreeSet<usize>` type was sufficient.
+
+9. Unit tests passed after that fix.
+
+   Observed: 5 passed, 0 failed. Tests covered same-claim split enforcement, rejected cross-claim split, current-revision filtering, deterministic shuffle, and verifier ratio behavior.
+
+10. Strict Clippy initially reported style and API-shape warnings.
+
+    Command: `CARGO_NET_OFFLINE=true CARGO_TARGET_DIR=/private/tmp/bogkit-trial1-target cargo clippy --all-targets --all-features -- -D warnings`
+
+    Observed: the initial manifest also enabled the optional `pedantic` group, producing 25 findings. After removing that extra policy, fixing all remaining standard Clippy findings, and factoring one complex verifier return type, the exact required command passed with warnings denied.
+
+11. The first demo run found an over-restrictive fixture-size guard.
+
+    Command: `cargo run --quiet -- demo --work-dir /private/tmp/bogkit-trial1-demo.Jja1ou`
+
+    Observed: `fixture sizes are too small for the authored edge cases`. The guard had used a rough claim/remittance ratio instead of the exact edge-case count. It was corrected to derive the minimum from the constructed cases.
+
+12. The corrected demo passed and made the baseline failure visible.
+
+    Observed:
+
+    ```text
+    demo improved: accepted=183 review=17 precision=100.0000% recall=100.0000% passed=true
+    demo greedy baseline: accepted=171 review=29 precision=71.9298% recall=63.0769% passed=false
+    ```
+
+13. Generated and reconciled the deterministic authored full-size workload.
+
+    Commands:
+
+    ```sh
+    remittance-reconciliation generate --out /private/tmp/bogkit-trial1-full.s0APkQ/fixture --claim-count 62000 --remittance-count 50000
+    remittance-reconciliation reconcile --claims /private/tmp/bogkit-trial1-full.s0APkQ/fixture/claims.jsonl --remittances /private/tmp/bogkit-trial1-full.s0APkQ/fixture/remittances.jsonl --out /private/tmp/bogkit-trial1-full.s0APkQ/results
+    ```
+
+    Observed: generation took 0.126s. Reconciliation took 4.427s and produced 49,983 accepted remittance decisions, 17 review decisions, and 49,995 links.
+
+14. Independent verification passed.
+
+    Command: `remittance-reconciliation verify` with the full claims, remittances, generated hidden truth, and result directory.
+
+    Observed: 100% precision, 100% recall, 49,995 correct links, zero invariant failures against this crate's own deterministic generator and truth only.
+
+15. The greedy comparator failed as intended.
+
+    Commands: `remittance-reconciliation baseline` followed by `verify --allow-failure`.
+
+    Observed: 99.903944% precision, 99.855986% recall, 12 links to obsolete revisions, and failure of the 99.95% precision threshold. Its faster 0.207s runtime does not compensate for unsafe decisions.
+
+16. Ten shuffled-input checks passed byte for byte.
+
+    Command: `scripts/check-shuffles.sh` with seeds `1 2 3 5 8 13 21 34 55 89`.
+
+    Observed: all three canonical files matched the ordered reference for every seed. In the final acceptance run, reconciliation times ranged from 4.597s to 5.278s.
+
+17. Peak-resident-memory measurement was blocked by the sandbox after a successful timed application run.
+
+    Command: `/usr/bin/time -l remittance-reconciliation reconcile ...`
+
+    Observed: the application completed in 4.591s, then `/usr/bin/time` exited 1 because `sysctl kern.clockrate` was not permitted. Peak RSS is therefore not claimed. Code inspection and verifier checks cover line-buffer reuse and absence of patient-key values in outputs.
+
+18. Manual output inspection confirmed stable review codes, paired same-snapshot negative reversal allocations, full-open-balance-subset same-claim splits, current-revision selection, and competitor explanations. The final source checks were then rerun after documentation and safety-bound changes.
+
+19. Skeptical re-review exposed a partial-overlap hole in the first identity-source fix.
+
+    Reproducer: exact-reference candidates `{A,B}`, fallback candidates `{B,C}`, shared `B` with 50 cents of capacity, and a 100-cent remittance. Round one tested only disjoint sets, so the union still let the optimizer accept reference-only `A`.
+
+    Correction: whenever both sources are nonempty, the allocation engine now receives only their intersection. The stable conflict reason is retained when differing sources leave no feasible shared assignment. A dedicated split case proves that downstream option generation cannot restore reference-only candidates.
+
+20. Focused permutation and control checks passed.
+
+    The exact overlap reproducer ran with original, reversed, and shuffled claims plus mixed unrelated remittance order. Canonical outputs were byte-identical, the verifier passed, the unrelated cluster accepted, and the overlap row reviewed with only shared `B` counted. A 100-cent `B` control accepted only `B`; exact-only and fallback-only controls also accepted.
+
+21. Round-two package and workload gates passed.
+
+    Formatting passed; 6 unit and 17 adversarial tests passed; strict Clippy passed with warnings denied. The demo remained 183 accepted / 17 review at 100% authored-generator precision and recall. The full 62,000/50,000 authored run completed in 4.705s with 49,995/49,995 correct links and no verifier failures. All ten shuffles were byte-identical at 4.823–5.195s. The acceptance script removed its fixture/results/build directory when it exited.
+
+## Categorized findings
+
+| Category | Finding | Severity | Confidence | Reproduction | Smallest improvement |
+|---|---|---:|---:|---|---|
+| Correctness defect | Greedy input-order choice consumes a line needed by a later exact-reference match. | Critical | High | Run the `baseline` command; `R-TRAP-*-WEAK` takes claim A and blocks the strong line. | Resolve each connected cluster jointly and review tied optima. |
+| Correctness defect | Baseline treats an obsolete claim revision as eligible. | Critical | High | Full baseline verifier lists 12 non-current targets. | Filter to the highest revision before candidate generation. |
+| Correctness defect | Greedy baseline auto-accepts equal strong candidates rather than reviewing uncertainty. | Critical | High | Inspect baseline `R-AMBIG-*` decisions. | Make equal-best global assignments a review outcome. |
+| Correctness defect | A union of partially overlapping exact-reference and fallback sets can authorize a candidate supported by only one identity source. | Critical; resolved in round 2 | High | Run `overlapping_identity_sources_require_a_feasible_shared_candidate_in_all_orders` or the focused CLI fixture. | Intersect both nonempty source sets before all single/split option generation and review infeasible disagreements. |
+| Performance problem | No generator performance failure was observed; worst recorded shuffle was 5.278s versus 60s. The solver needed an explicit worst-case search bound despite that narrow speed result. | High if absent; resolved | High | Run both search-budget tests. | Keep the deterministic node ceiling and review an exhausted cluster. |
+| Lab packaging | The assigned standalone output crate sat below but outside an existing workspace, requiring temporary `[workspace]`. | Low | High | Run Cargo in the temporary simulator location. | Coordinator removed `[workspace]` and member `Cargo.lock` at nested-workspace archival, then reran gates. |
+| Authoring history | The first Rust compile required an explicit candidate-index collection type (`E0282`). | Informational | High | See the recorded compiler output. | No BogKit change; this was repaired in prototype source. |
+| Documentation gap | Public docs describe Fold primitives and demos but do not give a fit/no-fit guide for immutable global-constraint batches. | Medium | High | Read the root README and public examples. | Add a short decision table: incremental materialized views versus one-shot global optimization. |
+| One-off capability observation | This trial did not find a public exact constrained-assignment primitive. It is one independent use case, below any feature-candidate threshold. | Observation only | Medium | Compare this brief to public README/example APIs. | Record qualitatively; do not propose or promote a candidate from one trial. |
+| Poor product fit | ESE/ANNy approximate semantic similarity cannot establish exact money-posting identity. Fold persistence is not needed inside this immutable batch prototype. | Critical for ESE/ANNy; Medium for Fold | High | Compare the search example to cent conservation and uncertainty requirements. | Keep approximate retrieval out of auto-posting; consider Fold only for later ingestion/audit views. |
diff --git a/developer-simulation/runs/2026-08-08--remittance-reconciliation/evidence/FIX_ROUND_1.md b/developer-simulation/runs/2026-08-08--remittance-reconciliation/evidence/FIX_ROUND_1.md
new file mode 100644
index 0000000..01c17f3
--- /dev/null
+++ b/developer-simulation/runs/2026-08-08--remittance-reconciliation/evidence/FIX_ROUND_1.md
@@ -0,0 +1,81 @@
+# Skeptical-review fix round 1/5
+
+Date: 2026-08-08
+
+Correction from round 2: this round proved only the fully disjoint identity-source case. Partial overlap still exposed one-source candidates to optimization. `FIX_ROUND_2.md` records the complete intersection-only correction and supersedes the B1 completion claim below; the B2 and other round-one evidence remains current.
+
+## Blocker work
+
+### B1: contradictory strong identity sources (partial fix, superseded)
+
+Candidate generation now retains two sets: exact insurer-reference claims and complete payer/provider/patient/date/procedure fallback claims. If both sets are nonempty and disjoint, the remittance is excluded from optimization and reviewed as `conflicting_identity_sources`. Scores are never used to cross that contradiction.
+
+Regression `conflicting_identity_sources_review_in_all_orders_while_agreement_accepts` runs the exact two-claim conflict in three claim/remittance orders and an agreement control. All conflicting outputs are byte-identical review decisions; the control accepts; the independent verifier passes.
+
+### B2: duplicate logical identities
+
+Before any active index is built:
+
+- Every physical remittance row sharing an ID is invalid, including byte-identical rows. No row is accepted. `review.jsonl` contains ordinals `1..N`, each with `duplicate_remittance_id`.
+- Every physical claim row sharing `(claim_line_id, revision)` is invalid, including byte-identical rows. All are excluded from active/current capacity. A remittance matching the quarantined rows is reviewed as `duplicate_claim_key`.
+
+Regressions cover identical and divergent duplicates, adjacent/separated/reordered inputs, byte-identical outputs, exact invalid physical-row counts, and unrelated valid clusters that continue to accept. Two negative verifier regressions prove that manually accepting either a duplicate remittance identity or duplicated claim capacity is rejected.
+
+## Important fixes and claim corrections
+
+- The comparator now runs exact-reference candidates first and invokes fallback only if no reference candidate is feasible. Tests cover unique reference in both orders, duplicate reference in both orders, missing reference, and an exact-reference candidate with insufficient capacity.
+- Split support is explicitly limited to same-claim subsets of entire current open balances. A partial-line case is reviewed as `unsupported_partial_split`.
+- Standalone reversal support is explicitly absent because no prior-applied authority exists. It is reviewed as `unsupported_standalone_reversal`; paired same-snapshot payment/reversal cases remain exact-cent accepted.
+- Generator accuracy is labeled generator-only. Per-shape counts show that 49,851 of 50,000 rows are bulk unique-reference rows.
+- Privacy verification now extracts patient keys from both claim and remittance inputs, including a remittance-only secret on the malformed generated row, and compares them with string values parsed from the serialized outputs.
+- Raw-line behavior is described as source-audited reuse of one buffer cleared at the next read boundary, not erasure or a measured memory property.
+- The internal dense-search budget test is joined by a public end-to-end 12-claim/12-remittance dense cluster that produces 12 deterministic `search_budget_exhausted` review rows.
+- Rust `E0282` is recategorized as authoring history. The child workspace is temporary lab packaging. Exact assignment is one one-off capability observation, not a BogKit defect or feature candidate.
+- The temporary child `[workspace]` and local `Cargo.lock` remain only because this fix runs in the assigned out-of-member directory. The coordinator must remove both when copying into the nested daily workspace and rerun its metadata/test/Clippy/archive gates.
+
+## Exact commands and observed results
+
+Focused and package tests:
+
+```console
+CARGO_NET_OFFLINE=true CARGO_TARGET_DIR=/private/tmp/bogkit-fix1-target cargo test --all-targets --locked
+```
+
+Observed after the final adversarial additions: 6 library unit tests passed, 13 integration adversarial tests passed, binary target had 0 tests; 19 total passed, 0 failed. Dense end-to-end exhaustion completed inside the test run.
+
+Strict lint:
+
+```console
+CARGO_NET_OFFLINE=true CARGO_TARGET_DIR=/private/tmp/bogkit-fix1-target cargo clippy --all-targets --all-features --locked -- -D warnings
+```
+
+Observed: passed with warnings denied. This command is rerun at the final gate after all source changes.
+
+Demo:
+
+```console
+CARGO_NET_OFFLINE=true CARGO_TARGET_DIR=/private/tmp/bogkit-fix1-target cargo run --release --quiet --locked -- demo --work-dir /private/tmp/bogkit-fix1-demo.TrLEFy
+```
+
+Observed:
+
+```text
+demo improved: accepted=183 review=17 precision=100.0000% recall=100.0000% passed=true
+demo greedy baseline: accepted=171 review=29 precision=71.9298% recall=63.0769% passed=false
+```
+
+Full-size generator and ten shuffles:
+
+```console
+CARGO_NET_OFFLINE=true ./scripts/run-acceptance.sh
+```
+
+Observed in the final rerun: generated 62,000 claim and 50,000 remittance physical rows; ordered reconciliation took 4.614s and emitted 49,983 accepted remittance IDs, 17 reviews, and 49,995 links. The authored verifier reported 49,995/49,995 correct links, 100% generator-only precision/recall, and zero invariant failures. The corrected staged comparator emitted 49,971 links in 0.242s and retained the same authored metrics: 99.903944% precision, 99.855986% recall, and 12 obsolete-revision failures. All three canonical files were byte-identical for seeds `1 2 3 5 8 13 21 34 55 89`; reconciliation times were 4.639–5.091s.
+
+## Remaining concerns
+
+- External fixture, verifier-only truth, supplied seed files, and specified laptop remain unavailable.
+- Generator and truth share authorship; 100% is not independent or production accuracy.
+- Peak RSS remains unmeasured.
+- Maximum numeric revision, 31-day fallback range, full-balance-only splits, and same-snapshot-only reversal authority remain consequential prototype policies.
+- Nested-workspace archive compatibility is intentionally deferred to the coordinator transform described above.
diff --git a/developer-simulation/runs/2026-08-08--remittance-reconciliation/evidence/FIX_ROUND_2.md b/developer-simulation/runs/2026-08-08--remittance-reconciliation/evidence/FIX_ROUND_2.md
new file mode 100644
index 0000000..6a7ec65
--- /dev/null
+++ b/developer-simulation/runs/2026-08-08--remittance-reconciliation/evidence/FIX_ROUND_2.md
@@ -0,0 +1,75 @@
+# Skeptical-review fix round 2/5
+
+Date: 2026-08-08
+
+## Remaining B1 correction
+
+Round one stopped only fully disjoint exact-reference and complete-fallback candidate sets. That allowed a partial-overlap case to score through the contradiction: reference `{A,B}`, fallback `{B,C}`, shared `B` underfunded, and one-source `A` or `C` feasible.
+
+The reconciler now applies this policy before building any assignment option:
+
+- If only one candidate source is nonempty, that source remains eligible.
+- If both candidate sources are nonempty, the eligible list is their intersection.
+- Single-line and same-claim split enumeration receive only that eligible list, so they cannot reintroduce a one-source candidate.
+- When the sources differ and no assignment from their intersection is selected, the stable review reason is `conflicting_identity_sources`.
+- When the sources fully agree, ordinary shape-specific reasons such as `unsupported_partial_split` remain accurate.
+
+## Adversarial coverage
+
+Four new integration regressions cover:
+
+1. The exact reviewer shape `{A,B}` / `{B,C}` with `B=50` and a 100-cent remittance. `A` differs in patient/date/procedure, `C` has another reference, and either could fund the remittance alone. The result reviews with one eligible candidate and never accepts `A` or `C`.
+2. Reversed claim order, shuffled claim order, mixed unrelated remittance order, byte-identical canonical outputs, a passing verifier, and acceptance of the unrelated cluster.
+3. An agreement control where shared `B=100`, which accepts only `B`, plus exact-only and fallback-only controls that remain accepted.
+4. A split safeguard where two reference-only lines from the same claim could jointly fund the remittance. Because split generation sees only shared `B`, it reviews instead of reconstructing the one-source split.
+
+The permanent synthetic CLI reproducer is under `tests/fixtures/overlapping-identity/`.
+
+## Exact commands and observed results
+
+Format, all tests, and strict lint:
+
+```console
+CARGO_NET_OFFLINE=true CARGO_TARGET_DIR=/private/tmp/bogkit-fix2-target cargo fmt --all -- --check
+CARGO_NET_OFFLINE=true CARGO_TARGET_DIR=/private/tmp/bogkit-fix2-target cargo test --all-targets --locked
+CARGO_NET_OFFLINE=true CARGO_TARGET_DIR=/private/tmp/bogkit-fix2-target cargo clippy --all-targets --all-features --locked -- -D warnings
+```
+
+Observed after the final source change: formatting passed; 6 library unit tests and 17 adversarial integration tests passed, the binary target had 0 tests, so 23 passed and 0 failed total; Clippy passed with warnings denied.
+
+Focused CLI reproduction and privacy/verifier scan:
+
+```console
+CARGO_NET_OFFLINE=true CARGO_TARGET_DIR=/private/tmp/bogkit-fix2-target cargo run --release --quiet --locked -- reconcile --claims tests/fixtures/overlapping-identity/claims.jsonl --remittances tests/fixtures/overlapping-identity/remittances.jsonl --out /private/tmp/bogkit-fix2-cli.SGcGJo/results
+CARGO_NET_OFFLINE=true CARGO_TARGET_DIR=/private/tmp/bogkit-fix2-target cargo run --release --quiet --locked -- verify --claims tests/fixtures/overlapping-identity/claims.jsonl --remittances tests/fixtures/overlapping-identity/remittances.jsonl --ground-truth tests/fixtures/overlapping-identity/ground-truth.jsonl --results /private/tmp/bogkit-fix2-cli.SGcGJo/results
+```
+
+Observed: 2 remittances produced 1 accepted row and 1 review. The verifier passed at 1/1 correct link, precision 1.0, recall 1.0, and 0 invariant/privacy failures. `R-OK` accepted `C-OK`; `R-OVERLAP` reviewed as `conflicting_identity_sources` with `candidate_count: 1`.
+
+Demo:
+
+```console
+CARGO_NET_OFFLINE=true CARGO_TARGET_DIR=/private/tmp/bogkit-fix2-target cargo run --release --quiet --locked -- demo --work-dir /private/tmp/bogkit-fix2-demo.qisCTT
+```
+
+Observed:
+
+```text
+demo improved: accepted=183 review=17 precision=100.0000% recall=100.0000% passed=true
+demo greedy baseline: accepted=171 review=29 precision=71.9298% recall=63.0769% passed=false
+```
+
+Full deterministic authored acceptance and ten shuffles:
+
+```console
+CARGO_NET_OFFLINE=true CARGO_TARGET_DIR=/private/tmp/bogkit-fix2-target ./scripts/run-acceptance.sh
+```
+
+Observed: generated 62,000 claim rows and 50,000 remittance rows. Ordered reconciliation took 4.705s and emitted 49,983 accepted remittance IDs, 17 reviews, and 49,995 links. The authored verifier reported 49,995/49,995 correct links, 100% generator-only precision/recall, and 0 invariant/privacy failures. The staged comparator emitted 49,971 links in 0.256s, with 99.903944% precision, 99.855986% recall, and 12 obsolete-revision invariant failures. Seeds `1 2 3 5 8 13 21 34 55 89` produced byte-identical `accepted.jsonl`, `review.jsonl`, and `summary.json`; reconciliation times were 4.823–5.195s.
+
+## Remaining concerns
+
+- The external fixture, independent truth, supplied seed files, specified laptop, and peak-RSS measurement remain unavailable.
+- The 100% result applies only to the deterministic authored generator and its authored truth.
+- Maximum revision, 31-day fallback range, full-balance-only splits, and same-snapshot reversal authority remain explicit prototype policies.
+- The temporary child `[workspace]` and local `Cargo.lock` remain for the assigned out-of-member fix. The coordinator must remove both during the nested-workspace archive transform, use the daily workspace lockfile, and rerun its archive gates.
diff --git a/developer-simulation/runs/2026-08-08--remittance-reconciliation/evidence/accepted-sample.jsonl b/developer-simulation/runs/2026-08-08--remittance-reconciliation/evidence/accepted-sample.jsonl
new file mode 100644
index 0000000..683a5c1
--- /dev/null
+++ b/developer-simulation/runs/2026-08-08--remittance-reconciliation/evidence/accepted-sample.jsonl
@@ -0,0 +1,6 @@
+{"remittance_line_id":"R-DUPREF-000","claim_line_id":"C-DUPREF-000-B","claim_revision":1,"applied_cents":125,"score":180,"facts":["insurer_reference","patient_key_exact","service_date_in_range","procedure_code_exact","amount_exact"],"rejected_competitors":[{"claim_line_id":"C-DUPREF-000-A","claim_revision":1,"reason_codes":["lower_global_score"]}]}
+{"remittance_line_id":"R-REVERSAL-000-PAY","claim_line_id":"C-REVERSAL-000","claim_revision":1,"applied_cents":500,"score":180,"facts":["insurer_reference","patient_key_exact","service_date_in_range","procedure_code_exact","amount_exact"],"rejected_competitors":[]}
+{"remittance_line_id":"R-REVERSAL-000-REVERSE","claim_line_id":"C-REVERSAL-000","claim_revision":1,"applied_cents":-100,"score":170,"facts":["insurer_reference","patient_key_exact","service_date_in_range","procedure_code_exact"],"rejected_competitors":[]}
+{"remittance_line_id":"R-SPLIT-000","claim_line_id":"C-SPLIT-000-A","claim_revision":1,"applied_cents":100,"score":100,"facts":["insurer_reference"],"rejected_competitors":[]}
+{"remittance_line_id":"R-SPLIT-000","claim_line_id":"C-SPLIT-000-B","claim_revision":1,"applied_cents":150,"score":100,"facts":["insurer_reference"],"rejected_competitors":[]}
+{"remittance_line_id":"R-TRAP-000-WEAK","claim_line_id":"C-TRAP-000-B","claim_revision":1,"applied_cents":100,"score":80,"facts":["patient_key_exact","service_date_in_range","procedure_code_exact","amount_exact"],"rejected_competitors":[{"claim_line_id":"C-TRAP-000-A","claim_revision":1,"reason_codes":["lower_global_score"]}]}
diff --git a/developer-simulation/runs/2026-08-08--remittance-reconciliation/evidence/baseline-report.json b/developer-simulation/runs/2026-08-08--remittance-reconciliation/evidence/baseline-report.json
new file mode 100644
index 0000000..a5ef246
--- /dev/null
+++ b/developer-simulation/runs/2026-08-08--remittance-reconciliation/evidence/baseline-report.json
@@ -0,0 +1,13 @@
+{
+  "passed": false,
+  "precision": 0.9990394428768686,
+  "recall": 0.9985598559855986,
+  "correct_links": 49923,
+  "accepted_links": 49971,
+  "expected_unambiguous_links": 49995,
+  "invariant_failures": 12,
+  "failure_summary": [
+    "12 accepted links targeted obsolete claim revisions",
+    "precision 0.999039 was below the required 0.999500"
+  ]
+}
diff --git a/developer-simulation/runs/2026-08-08--remittance-reconciliation/evidence/demo-output.txt b/developer-simulation/runs/2026-08-08--remittance-reconciliation/evidence/demo-output.txt
new file mode 100644
index 0000000..629b587
--- /dev/null
+++ b/developer-simulation/runs/2026-08-08--remittance-reconciliation/evidence/demo-output.txt
@@ -0,0 +1,2 @@
+demo improved: accepted=183 review=17 precision=100.0000% recall=100.0000% passed=true
+demo greedy baseline: accepted=171 review=29 precision=71.9298% recall=63.0769% passed=false
diff --git a/developer-simulation/runs/2026-08-08--remittance-reconciliation/evidence/review-sample.jsonl b/developer-simulation/runs/2026-08-08--remittance-reconciliation/evidence/review-sample.jsonl
new file mode 100644
index 0000000..b55f8c6
--- /dev/null
+++ b/developer-simulation/runs/2026-08-08--remittance-reconciliation/evidence/review-sample.jsonl
@@ -0,0 +1,3 @@
+{"remittance_line_id":"R-AMBIG-000","physical_record_ordinal":1,"reason_codes":["conflicting_strong_candidates"],"candidate_count":2}
+{"remittance_line_id":"R-MALFORMED","physical_record_ordinal":1,"reason_codes":["malformed_record"],"candidate_count":0}
+{"remittance_line_id":"R-UNSUPPORTED-000","physical_record_ordinal":1,"reason_codes":["unsupported_bundle"],"candidate_count":2}
diff --git a/developer-simulation/runs/2026-08-08--remittance-reconciliation/evidence/shuffle-results.txt b/developer-simulation/runs/2026-08-08--remittance-reconciliation/evidence/shuffle-results.txt
new file mode 100644
index 0000000..4e9114d
--- /dev/null
+++ b/developer-simulation/runs/2026-08-08--remittance-reconciliation/evidence/shuffle-results.txt
@@ -0,0 +1,12 @@
+seed 1: 5.195s, byte-identical
+seed 2: 4.863s, byte-identical
+seed 3: 4.994s, byte-identical
+seed 5: 4.906s, byte-identical
+seed 8: 4.829s, byte-identical
+seed 13: 4.866s, byte-identical
+seed 21: 5.139s, byte-identical
+seed 34: 5.094s, byte-identical
+seed 55: 4.823s, byte-identical
+seed 89: 4.876s, byte-identical
+
+Each comparison used `cmp` on accepted.jsonl, review.jsonl, and summary.json.
diff --git a/developer-simulation/runs/2026-08-08--remittance-reconciliation/evidence/verification-report.json b/developer-simulation/runs/2026-08-08--remittance-reconciliation/evidence/verification-report.json
new file mode 100644
index 0000000..8f5a3d8
--- /dev/null
+++ b/developer-simulation/runs/2026-08-08--remittance-reconciliation/evidence/verification-report.json
@@ -0,0 +1,10 @@
+{
+  "passed": true,
+  "precision": 1.0,
+  "recall": 1.0,
+  "correct_links": 49995,
+  "accepted_links": 49995,
+  "expected_unambiguous_links": 49995,
+  "invariant_failures": 0,
+  "failures": []
+}
diff --git a/developer-simulation/runs/2026-08-08--remittance-reconciliation/scripts/check-shuffles.sh b/developer-simulation/runs/2026-08-08--remittance-reconciliation/scripts/check-shuffles.sh
new file mode 100755
index 0000000..0ea8c78
--- /dev/null
+++ b/developer-simulation/runs/2026-08-08--remittance-reconciliation/scripts/check-shuffles.sh
@@ -0,0 +1,32 @@
+#!/bin/sh
+set -eu
+
+if [ "$#" -ne 4 ]; then
+  echo "usage: $0 BINARY FIXTURE_DIR REFERENCE_RESULTS WORK_DIR" >&2
+  exit 2
+fi
+
+binary=$1
+fixture_dir=$2
+reference_results=$3
+work_dir=$4
+seeds="1 2 3 5 8 13 21 34 55 89"
+
+mkdir -p "$work_dir"
+for seed in $seeds; do
+  shuffled="$work_dir/seed-$seed/input"
+  results="$work_dir/seed-$seed/results"
+  "$binary" shuffle \
+    --claims "$fixture_dir/claims.jsonl" \
+    --remittances "$fixture_dir/remittances.jsonl" \
+    --seed "$seed" \
+    --out "$shuffled"
+  "$binary" reconcile \
+    --claims "$shuffled/claims.jsonl" \
+    --remittances "$shuffled/remittances.jsonl" \
+    --out "$results"
+  cmp "$reference_results/accepted.jsonl" "$results/accepted.jsonl"
+  cmp "$reference_results/review.jsonl" "$results/review.jsonl"
+  cmp "$reference_results/summary.json" "$results/summary.json"
+  echo "seed $seed: byte-identical"
+done
diff --git a/developer-simulation/runs/2026-08-08--remittance-reconciliation/scripts/run-acceptance.sh b/developer-simulation/runs/2026-08-08--remittance-reconciliation/scripts/run-acceptance.sh
new file mode 100755
index 0000000..31594a8
--- /dev/null
+++ b/developer-simulation/runs/2026-08-08--remittance-reconciliation/scripts/run-acceptance.sh
@@ -0,0 +1,49 @@
+#!/bin/sh
+set -eu
+
+project_dir=$(CDPATH= cd -- "$(dirname -- "$0")/.." && pwd)
+work_dir=$(mktemp -d /tmp/remittance-reconciliation.XXXXXX)
+target_dir="$work_dir/target"
+fixture_dir="$work_dir/fixture"
+results_dir="$work_dir/results"
+baseline_dir="$work_dir/baseline"
+
+cleanup() {
+  rm -rf -- "$work_dir"
+}
+trap cleanup EXIT HUP INT TERM
+
+cd "$project_dir"
+CARGO_TARGET_DIR="$target_dir" cargo build --release --locked
+binary="$target_dir/release/remittance-reconciliation"
+
+"$binary" generate \
+  --out "$fixture_dir" \
+  --claim-count 62000 \
+  --remittance-count 50000
+"$binary" reconcile \
+  --claims "$fixture_dir/claims.jsonl" \
+  --remittances "$fixture_dir/remittances.jsonl" \
+  --out "$results_dir"
+"$binary" verify \
+  --claims "$fixture_dir/claims.jsonl" \
+  --remittances "$fixture_dir/remittances.jsonl" \
+  --ground-truth "$fixture_dir/ground-truth.jsonl" \
+  --results "$results_dir"
+
+"$binary" baseline \
+  --claims "$fixture_dir/claims.jsonl" \
+  --remittances "$fixture_dir/remittances.jsonl" \
+  --out "$baseline_dir"
+"$binary" verify \
+  --claims "$fixture_dir/claims.jsonl" \
+  --remittances "$fixture_dir/remittances.jsonl" \
+  --ground-truth "$fixture_dir/ground-truth.jsonl" \
+  --results "$baseline_dir" \
+  --allow-failure
+
+"$project_dir/scripts/check-shuffles.sh" \
+  "$binary" \
+  "$fixture_dir" \
+  "$results_dir" \
+  "$work_dir/shuffles"
diff --git a/developer-simulation/runs/2026-08-08--remittance-reconciliation/src/engine.rs b/developer-simulation/runs/2026-08-08--remittance-reconciliation/src/engine.rs
new file mode 100644
index 0000000..64ae7b4
--- /dev/null
+++ b/developer-simulation/runs/2026-08-08--remittance-reconciliation/src/engine.rs
@@ -0,0 +1,1256 @@
+use std::cmp::Ordering;
+use std::collections::{BTreeMap, BTreeSet, HashMap, HashSet, VecDeque};
+use std::error::Error;
+use std::fs::{self, File};
+use std::io::{BufRead, BufReader, BufWriter, Write};
+use std::path::Path;
+
+use serde::Serialize;
+use serde_json::Value;
+
+use crate::model::{
+    AcceptedLink, ClaimKey, ClaimLine, RejectedCompetitor, RemittanceLine, ReviewRecord, Summary,
+    TransactionKind,
+};
+
+pub type AnyError = Box<dyn Error + Send + Sync>;
+
+const MAX_CLUSTER_NODES: usize = 24;
+const MAX_SPLIT_CANDIDATES: usize = 12;
+const MAX_SEARCH_NODES: usize = 1_000_000;
+
+#[derive(Debug)]
+struct ClaimInput {
+    records: Vec<ClaimLine>,
+    quarantined_duplicates: Vec<ClaimLine>,
+    total: usize,
+    invalid: usize,
+}
+
+#[derive(Debug)]
+struct RemitInput {
+    records: Vec<RemittanceLine>,
+    pre_reviews: Vec<ReviewRecord>,
+    total: usize,
+    invalid: usize,
+}
+
+#[derive(Debug, Clone)]
+struct Candidate {
+    claim_idx: usize,
+    score: i32,
+    facts: Vec<String>,
+}
+
+#[derive(Debug, Clone)]
+struct CandidateEvaluation {
+    candidates: Vec<Candidate>,
+    reference_claims: BTreeSet<usize>,
+    fallback_claims: BTreeSet<usize>,
+}
+
+impl CandidateEvaluation {
+    fn has_both_identity_sources(&self) -> bool {
+        !self.reference_claims.is_empty() && !self.fallback_claims.is_empty()
+    }
+
+    fn identity_sources_disagree(&self) -> bool {
+        self.has_both_identity_sources() && self.reference_claims != self.fallback_claims
+    }
+
+    fn agreement_candidates(&self) -> Vec<Candidate> {
+        self.candidates
+            .iter()
+            .filter(|candidate| {
+                self.reference_claims.contains(&candidate.claim_idx)
+                    && self.fallback_claims.contains(&candidate.claim_idx)
+            })
+            .cloned()
+            .collect()
+    }
+
+    fn has_any(&self) -> bool {
+        !self.candidates.is_empty()
+    }
+}
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+struct Allocation {
+    claim_idx: usize,
+    applied_cents: i64,
+    score: i32,
+    facts: Vec<String>,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+struct AssignmentOption {
+    allocations: Vec<Allocation>,
+    score: i32,
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+struct Objective {
+    accepted: usize,
+    score: i64,
+}
+
+impl Ord for Objective {
+    fn cmp(&self, other: &Self) -> Ordering {
+        self.accepted
+            .cmp(&other.accepted)
+            .then_with(|| self.score.cmp(&other.score))
+    }
+}
+
+impl PartialOrd for Objective {
+    fn partial_cmp(&self, other: &Self) -> Option<Ordering> {
+        Some(self.cmp(other))
+    }
+}
+
+#[derive(Debug, Default)]
+struct SearchBest {
+    objective: Option<Objective>,
+    assignments: Vec<Option<AssignmentOption>>,
+    tied: bool,
+}
+
+#[derive(Debug)]
+struct ClaimIndex {
+    by_reference: HashMap<(String, String, String), Vec<usize>>,
+    by_identity: HashMap<(String, String, String, i32, String), Vec<usize>>,
+}
+
+impl ClaimIndex {
+    fn new(claims: &[ClaimLine]) -> Self {
+        let mut by_reference: HashMap<(String, String, String), Vec<usize>> = HashMap::new();
+        let mut by_identity: HashMap<(String, String, String, i32, String), Vec<usize>> =
+            HashMap::new();
+        for (idx, claim) in claims.iter().enumerate() {
+            for reference in &claim.insurer_references {
+                by_reference
+                    .entry((
+                        claim.payer.clone(),
+                        claim.provider.clone(),
+                        reference.clone(),
+                    ))
+                    .or_default()
+                    .push(idx);
+            }
+            by_identity
+                .entry((
+                    claim.payer.clone(),
+                    claim.provider.clone(),
+                    claim.patient_key.clone(),
+                    claim.service_date,
+                    claim.procedure_code.clone(),
+                ))
+                .or_default()
+                .push(idx);
+        }
+        Self {
+            by_reference,
+            by_identity,
+        }
+    }
+
+    fn evaluate(&self, remit: &RemittanceLine, claims: &[ClaimLine]) -> CandidateEvaluation {
+        let mut reference_claims: BTreeSet<usize> = BTreeSet::new();
+        if let Some(reference) = &remit.insurer_reference
+            && let Some(matches) = self.by_reference.get(&(
+                remit.payer.clone(),
+                remit.provider.clone(),
+                reference.clone(),
+            ))
+        {
+            reference_claims.extend(matches);
+        }
+        let mut fallback_claims: BTreeSet<usize> = BTreeSet::new();
+        if let (Some(patient), Some(start), Some(end), Some(procedure)) = (
+            &remit.patient_key,
+            remit.service_date_start,
+            remit.service_date_end,
+            &remit.procedure_code,
+        ) {
+            for day in start..=end.min(start.saturating_add(31)) {
+                if let Some(matches) = self.by_identity.get(&(
+                    remit.payer.clone(),
+                    remit.provider.clone(),
+                    patient.clone(),
+                    day,
+                    procedure.clone(),
+                )) {
+                    fallback_claims.extend(matches);
+                }
+            }
+        }
+
+        let indices = reference_claims
+            .union(&fallback_claims)
+            .copied()
+            .collect::<BTreeSet<_>>();
+        let amount = remit.signed_amount().unsigned_abs();
+        let mut candidates = indices
+            .into_iter()
+            .map(|claim_idx| {
+                let claim = &claims[claim_idx];
+                let reference_match = remit.insurer_reference.as_ref().is_some_and(|reference| {
+                    claim
+                        .insurer_references
+                        .iter()
+                        .any(|item| item == reference)
+                });
+                let patient_match = remit
+                    .patient_key
+                    .as_ref()
+                    .is_some_and(|patient| patient == &claim.patient_key);
+                let date_match = remit
+                    .service_date_start
+                    .zip(remit.service_date_end)
+                    .is_some_and(|(start, end)| (start..=end).contains(&claim.service_date));
+                let procedure_match = remit
+                    .procedure_code
+                    .as_ref()
+                    .is_some_and(|procedure| procedure == &claim.procedure_code);
+
+                let mut facts = Vec::new();
+                let mut score = 0;
+                if reference_match {
+                    facts.push("insurer_reference".to_string());
+                    score += 100;
+                }
+                if patient_match {
+                    facts.push("patient_key_exact".to_string());
+                    score += 30;
+                }
+                if date_match {
+                    facts.push("service_date_in_range".to_string());
+                    score += 20;
+                }
+                if procedure_match {
+                    facts.push("procedure_code_exact".to_string());
+                    score += 20;
+                }
+                if amount == claim.open_balance_cents.unsigned_abs() {
+                    facts.push("amount_exact".to_string());
+                    score += 10;
+                }
+                Candidate {
+                    claim_idx,
+                    score,
+                    facts,
+                }
+            })
+            .collect::<Vec<_>>();
+        candidates.sort_by(|left, right| {
+            let left_claim = &claims[left.claim_idx];
+            let right_claim = &claims[right.claim_idx];
+            left_claim
+                .claim_line_id
+                .cmp(&right_claim.claim_line_id)
+                .then_with(|| left_claim.revision.cmp(&right_claim.revision))
+        });
+        CandidateEvaluation {
+            candidates,
+            reference_claims,
+            fallback_claims,
+        }
+    }
+}
+
+pub fn reconcile(
+    claims_path: &Path,
+    remits_path: &Path,
+    output_dir: &Path,
+) -> Result<Summary, AnyError> {
+    let claim_input = read_claims(claims_path)?;
+    let remit_input = read_remittances(remits_path)?;
+    let claims = current_revisions(&claim_input.records);
+    let index = ClaimIndex::new(&claims);
+    let quarantined_index = ClaimIndex::new(&claim_input.quarantined_duplicates);
+    let mut accepted = Vec::new();
+    let mut reviews = remit_input.pre_reviews;
+    let mut active_remits = Vec::new();
+    let mut candidate_lists = Vec::new();
+    let mut identity_sources_disagree = Vec::new();
+    for remit in remit_input.records {
+        let quarantined = quarantined_index.evaluate(&remit, &claim_input.quarantined_duplicates);
+        let evaluation = index.evaluate(&remit, &claims);
+        if quarantined.has_any() {
+            reviews.push(ReviewRecord {
+                remittance_line_id: remit.remittance_line_id,
+                physical_record_ordinal: 1,
+                reason_codes: vec!["duplicate_claim_key".to_string()],
+                candidate_count: quarantined.candidates.len(),
+            });
+        } else {
+            let has_both_sources = evaluation.has_both_identity_sources();
+            let sources_disagree = evaluation.identity_sources_disagree();
+            let candidates = if has_both_sources {
+                evaluation.agreement_candidates()
+            } else {
+                evaluation.candidates
+            };
+            active_remits.push(remit);
+            candidate_lists.push(candidates);
+            identity_sources_disagree.push(sources_disagree);
+        }
+    }
+    resolve_components(
+        &claims,
+        &active_remits,
+        &candidate_lists,
+        &identity_sources_disagree,
+        &mut accepted,
+        &mut reviews,
+    );
+    write_results(
+        output_dir,
+        accepted,
+        reviews,
+        claim_input.total,
+        claims.len(),
+        claim_input.invalid,
+        remit_input.total,
+        remit_input.invalid,
+    )
+}
+
+pub fn greedy_baseline(
+    claims_path: &Path,
+    remits_path: &Path,
+    output_dir: &Path,
+) -> Result<Summary, AnyError> {
+    let claim_input = read_claims(claims_path)?;
+    let remit_input = read_remittances(remits_path)?;
+    let claims = claim_input.records;
+    let current_count = current_revisions(&claims).len();
+    let index = ClaimIndex::new(&claims);
+    let mut positive_used = vec![0_i64; claims.len()];
+    let mut negative_used = vec![0_i64; claims.len()];
+    let mut accepted = Vec::new();
+    let mut reviews = remit_input.pre_reviews;
+    let quarantined_index = ClaimIndex::new(&claim_input.quarantined_duplicates);
+
+    for remit in &remit_input.records {
+        let quarantined = quarantined_index.evaluate(remit, &claim_input.quarantined_duplicates);
+        if quarantined.has_any() {
+            reviews.push(ReviewRecord {
+                remittance_line_id: remit.remittance_line_id.clone(),
+                physical_record_ordinal: 1,
+                reason_codes: vec!["duplicate_claim_key".to_string()],
+                candidate_count: quarantined.candidates.len(),
+            });
+            continue;
+        }
+        let evaluation = index.evaluate(remit, &claims);
+        let candidates = &evaluation.candidates;
+        let signed = remit.signed_amount();
+        let acceptable = |candidate: &&Candidate| {
+            candidate_is_acceptable(candidate, remit, &claims, &positive_used, &negative_used)
+        };
+        let reference_choice = candidates
+            .iter()
+            .filter(|candidate| evaluation.reference_claims.contains(&candidate.claim_idx))
+            .filter(acceptable)
+            .min_by_key(|candidate| candidate.claim_idx);
+        let chosen = reference_choice.or_else(|| {
+            candidates
+                .iter()
+                .filter(|candidate| evaluation.fallback_claims.contains(&candidate.claim_idx))
+                .filter(acceptable)
+                .min_by_key(|candidate| candidate.claim_idx)
+        });
+
+        if let Some(candidate) = chosen {
+            if signed > 0 {
+                positive_used[candidate.claim_idx] += signed;
+            } else {
+                negative_used[candidate.claim_idx] += signed.unsigned_abs() as i64;
+            }
+            let claim = &claims[candidate.claim_idx];
+            let rejected_competitors = competitors(
+                candidates,
+                &[candidate.claim_idx],
+                &claims,
+                "greedy_candidate_not_first",
+            );
+            accepted.push(AcceptedLink {
+                remittance_line_id: remit.remittance_line_id.clone(),
+                claim_line_id: claim.claim_line_id.clone(),
+                claim_revision: claim.revision,
+                applied_cents: signed,
+                score: candidate.score,
+                facts: candidate.facts.clone(),
+                rejected_competitors,
+            });
+        } else {
+            reviews.push(ReviewRecord {
+                remittance_line_id: remit.remittance_line_id.clone(),
+                physical_record_ordinal: 1,
+                reason_codes: reason_for_no_assignment(remit, candidates, &claims, false),
+                candidate_count: candidates.len(),
+            });
+        }
+    }
+
+    write_results(
+        output_dir,
+        accepted,
+        reviews,
+        claim_input.total,
+        current_count,
+        claim_input.invalid,
+        remit_input.total,
+        remit_input.invalid,
+    )
+}
+
+fn candidate_is_acceptable(
+    candidate: &Candidate,
+    remit: &RemittanceLine,
+    claims: &[ClaimLine],
+    positive_used: &[i64],
+    negative_used: &[i64],
+) -> bool {
+    let claim = &claims[candidate.claim_idx];
+    let signed = remit.signed_amount();
+    let amount = signed.unsigned_abs();
+    if amount > claim.open_balance_cents.unsigned_abs() {
+        return false;
+    }
+    if matches!(remit.transaction_kind, TransactionKind::Reversal)
+        && !candidate
+            .facts
+            .iter()
+            .any(|fact| fact == "insurer_reference")
+    {
+        return false;
+    }
+    if signed > 0 {
+        positive_used[candidate.claim_idx] + signed <= claim.open_balance_cents
+    } else {
+        negative_used[candidate.claim_idx] + signed.unsigned_abs() as i64
+            <= claim.open_balance_cents
+    }
+}
+
+fn read_claims(path: &Path) -> Result<ClaimInput, AnyError> {
+    let reader = BufReader::new(File::open(path)?);
+    let mut records = Vec::new();
+    let mut invalid = 0;
+    let mut total = 0;
+    let mut line = String::new();
+    let mut reader = reader;
+    loop {
+        line.clear();
+        if reader.read_line(&mut line)? == 0 {
+            break;
+        }
+        total += 1;
+        match serde_json::from_str::<ClaimLine>(&line) {
+            Ok(record) if record.validate().is_ok() => records.push(record),
+            _ => invalid += 1,
+        }
+    }
+    let mut counts = HashMap::new();
+    for record in &records {
+        *counts.entry(record.key()).or_insert(0_usize) += 1;
+    }
+    let mut quarantined_duplicates = Vec::new();
+    let mut unique = Vec::new();
+    for record in records {
+        if counts.get(&record.key()).copied().unwrap_or_default() > 1 {
+            invalid += 1;
+            quarantined_duplicates.push(record);
+        } else {
+            unique.push(record);
+        }
+    }
+    Ok(ClaimInput {
+        records: unique,
+        quarantined_duplicates,
+        total,
+        invalid,
+    })
+}
+
+fn read_remittances(path: &Path) -> Result<RemitInput, AnyError> {
+    let reader = BufReader::new(File::open(path)?);
+    struct Row {
+        id: String,
+        record: Option<RemittanceLine>,
+        invalid_reason: Option<String>,
+    }
+
+    let mut rows = Vec::new();
+    let mut pre_reviews = Vec::new();
+    let mut invalid = 0;
+    let mut total = 0;
+    let mut line = String::new();
+    let mut reader = reader;
+    loop {
+        line.clear();
+        if reader.read_line(&mut line)? == 0 {
+            break;
+        }
+        total += 1;
+        let parsed_value = serde_json::from_str::<Value>(&line).ok();
+        let extracted_id = parsed_value
+            .as_ref()
+            .and_then(|value| value.get("remittance_line_id"))
+            .and_then(Value::as_str)
+            .map(str::to_owned)
+            .unwrap_or_else(|| "quarantine-remittance-missing-id".to_string());
+        match serde_json::from_str::<RemittanceLine>(&line) {
+            Ok(record) => match record.validate() {
+                Ok(()) => rows.push(Row {
+                    id: extracted_id,
+                    record: Some(record),
+                    invalid_reason: None,
+                }),
+                Err(reason) => rows.push(Row {
+                    id: extracted_id,
+                    record: None,
+                    invalid_reason: Some(reason.to_string()),
+                }),
+            },
+            Err(_) => rows.push(Row {
+                id: extracted_id,
+                record: None,
+                invalid_reason: Some("malformed_record".to_string()),
+            }),
+        }
+    }
+    let mut counts = HashMap::new();
+    for row in &rows {
+        *counts.entry(row.id.clone()).or_insert(0_usize) += 1;
+    }
+    let mut emitted_duplicates = HashSet::new();
+    let mut records = Vec::new();
+    for row in rows {
+        let count = counts.get(&row.id).copied().unwrap_or_default();
+        if count > 1 {
+            if emitted_duplicates.insert(row.id.clone()) {
+                invalid += count;
+                for ordinal in 1..=count {
+                    pre_reviews.push(ReviewRecord {
+                        remittance_line_id: row.id.clone(),
+                        physical_record_ordinal: ordinal,
+                        reason_codes: vec!["duplicate_remittance_id".to_string()],
+                        candidate_count: 0,
+                    });
+                }
+            }
+        } else if let Some(record) = row.record {
+            records.push(record);
+        } else {
+            invalid += 1;
+            pre_reviews.push(ReviewRecord {
+                remittance_line_id: row.id,
+                physical_record_ordinal: 1,
+                reason_codes: vec![
+                    row.invalid_reason
+                        .unwrap_or_else(|| "malformed_record".to_string()),
+                ],
+                candidate_count: 0,
+            });
+        }
+    }
+    Ok(RemitInput {
+        records,
+        pre_reviews,
+        total,
+        invalid,
+    })
+}
+
+fn current_revisions(records: &[ClaimLine]) -> Vec<ClaimLine> {
+    let mut maximums: HashMap<&str, u32> = HashMap::new();
+    for claim in records {
+        maximums
+            .entry(&claim.claim_line_id)
+            .and_modify(|revision| *revision = (*revision).max(claim.revision))
+            .or_insert(claim.revision);
+    }
+    let mut current = records
+        .iter()
+        .filter(|claim| maximums.get(claim.claim_line_id.as_str()) == Some(&claim.revision))
+        .cloned()
+        .collect::<Vec<_>>();
+    current.sort_by_key(ClaimLine::key);
+    current
+}
+
+fn resolve_components(
+    claims: &[ClaimLine],
+    remits: &[RemittanceLine],
+    candidate_lists: &[Vec<Candidate>],
+    identity_sources_disagree: &[bool],
+    accepted: &mut Vec<AcceptedLink>,
+    reviews: &mut Vec<ReviewRecord>,
+) {
+    let mut claim_to_remits = vec![Vec::new(); claims.len()];
+    for (remit_idx, candidates) in candidate_lists.iter().enumerate() {
+        for candidate in candidates {
+            claim_to_remits[candidate.claim_idx].push(remit_idx);
+        }
+    }
+    let mut visited = vec![false; remits.len()];
+    for start in 0..remits.len() {
+        if visited[start] {
+            continue;
+        }
+        if candidate_lists[start].is_empty() {
+            visited[start] = true;
+            reviews.push(ReviewRecord {
+                remittance_line_id: remits[start].remittance_line_id.clone(),
+                physical_record_ordinal: 1,
+                reason_codes: reason_for_no_assignment(
+                    &remits[start],
+                    &[],
+                    claims,
+                    identity_sources_disagree[start],
+                ),
+                candidate_count: 0,
+            });
+            continue;
+        }
+
+        let mut queue = VecDeque::from([start]);
+        let mut component_remits = BTreeSet::new();
+        let mut component_claims = BTreeSet::new();
+        while let Some(remit_idx) = queue.pop_front() {
+            if !component_remits.insert(remit_idx) {
+                continue;
+            }
+            visited[remit_idx] = true;
+            for candidate in &candidate_lists[remit_idx] {
+                if component_claims.insert(candidate.claim_idx) {
+                    for neighbor in &claim_to_remits[candidate.claim_idx] {
+                        if !component_remits.contains(neighbor) {
+                            queue.push_back(*neighbor);
+                        }
+                    }
+                }
+            }
+        }
+        let component_remits = component_remits.into_iter().collect::<Vec<_>>();
+        if component_remits.len() + component_claims.len() > MAX_CLUSTER_NODES {
+            for remit_idx in component_remits {
+                reviews.push(ReviewRecord {
+                    remittance_line_id: remits[remit_idx].remittance_line_id.clone(),
+                    physical_record_ordinal: 1,
+                    reason_codes: vec!["unsupported_bundle".to_string()],
+                    candidate_count: candidate_lists[remit_idx].len(),
+                });
+            }
+            continue;
+        }
+        resolve_component(
+            claims,
+            remits,
+            candidate_lists,
+            identity_sources_disagree,
+            &component_remits,
+            accepted,
+            reviews,
+        );
+    }
+}
+
+fn resolve_component(
+    claims: &[ClaimLine],
+    remits: &[RemittanceLine],
+    candidate_lists: &[Vec<Candidate>],
+    identity_sources_disagree: &[bool],
+    component_remits: &[usize],
+    accepted: &mut Vec<AcceptedLink>,
+    reviews: &mut Vec<ReviewRecord>,
+) {
+    let mut ordered_remits = component_remits.to_vec();
+    ordered_remits.sort_by(|left, right| {
+        remits[*left]
+            .remittance_line_id
+            .cmp(&remits[*right].remittance_line_id)
+    });
+    let options = ordered_remits
+        .iter()
+        .map(|remit_idx| {
+            assignment_options(&remits[*remit_idx], &candidate_lists[*remit_idx], claims)
+        })
+        .collect::<Vec<_>>();
+    let mut best = SearchBest {
+        assignments: vec![None; ordered_remits.len()],
+        ..SearchBest::default()
+    };
+    let mut working = vec![None; ordered_remits.len()];
+    let mut positive = vec![0_i64; claims.len()];
+    let mut negative = vec![0_i64; claims.len()];
+    let mut remaining_nodes = MAX_SEARCH_NODES;
+    let mut exhausted = false;
+    search_assignments(
+        0,
+        &options,
+        claims,
+        &mut working,
+        &mut positive,
+        &mut negative,
+        Objective {
+            accepted: 0,
+            score: 0,
+        },
+        &mut best,
+        &mut remaining_nodes,
+        &mut exhausted,
+    );
+
+    if exhausted {
+        for remit_idx in ordered_remits {
+            reviews.push(ReviewRecord {
+                remittance_line_id: remits[remit_idx].remittance_line_id.clone(),
+                physical_record_ordinal: 1,
+                reason_codes: vec!["search_budget_exhausted".to_string()],
+                candidate_count: candidate_lists[remit_idx].len(),
+            });
+        }
+        return;
+    }
+
+    if best.tied {
+        for remit_idx in ordered_remits {
+            reviews.push(ReviewRecord {
+                remittance_line_id: remits[remit_idx].remittance_line_id.clone(),
+                physical_record_ordinal: 1,
+                reason_codes: vec!["conflicting_strong_candidates".to_string()],
+                candidate_count: candidate_lists[remit_idx].len(),
+            });
+        }
+        return;
+    }
+
+    for (position, remit_idx) in ordered_remits.iter().enumerate() {
+        let remit = &remits[*remit_idx];
+        let candidates = &candidate_lists[*remit_idx];
+        if let Some(option) = &best.assignments[position] {
+            let chosen = option
+                .allocations
+                .iter()
+                .map(|allocation| allocation.claim_idx)
+                .collect::<Vec<_>>();
+            let rejected_competitors =
+                competitors(candidates, &chosen, claims, "lower_global_score");
+            for allocation in &option.allocations {
+                let claim = &claims[allocation.claim_idx];
+                accepted.push(AcceptedLink {
+                    remittance_line_id: remit.remittance_line_id.clone(),
+                    claim_line_id: claim.claim_line_id.clone(),
+                    claim_revision: claim.revision,
+                    applied_cents: allocation.applied_cents,
+                    score: allocation.score,
+                    facts: allocation.facts.clone(),
+                    rejected_competitors: rejected_competitors.clone(),
+                });
+            }
+        } else {
+            reviews.push(ReviewRecord {
+                remittance_line_id: remit.remittance_line_id.clone(),
+                physical_record_ordinal: 1,
+                reason_codes: reason_for_no_assignment(
+                    remit,
+                    candidates,
+                    claims,
+                    identity_sources_disagree[*remit_idx],
+                ),
+                candidate_count: candidates.len(),
+            });
+        }
+    }
+}
+
+#[allow(clippy::too_many_arguments)]
+fn search_assignments(
+    position: usize,
+    options: &[Vec<AssignmentOption>],
+    claims: &[ClaimLine],
+    working: &mut [Option<AssignmentOption>],
+    positive: &mut [i64],
+    negative: &mut [i64],
+    objective: Objective,
+    best: &mut SearchBest,
+    remaining_nodes: &mut usize,
+    exhausted: &mut bool,
+) {
+    if *remaining_nodes == 0 {
+        *exhausted = true;
+        return;
+    }
+    *remaining_nodes -= 1;
+    if position == options.len() {
+        let valid_net = positive.iter().zip(negative.iter()).zip(claims).all(
+            |((positive, negative), claim)| {
+                positive >= negative && positive - negative <= claim.open_balance_cents
+            },
+        );
+        if !valid_net {
+            return;
+        }
+        match best.objective {
+            None => {
+                best.objective = Some(objective);
+                best.assignments.clone_from_slice(working);
+            }
+            Some(current) if objective > current => {
+                best.objective = Some(objective);
+                best.assignments.clone_from_slice(working);
+                best.tied = false;
+            }
+            Some(current) if objective == current && best.assignments != working => {
+                best.tied = true;
+            }
+            _ => {}
+        }
+        return;
+    }
+
+    for option in &options[position] {
+        if apply_option(option, claims, positive, negative) {
+            working[position] = Some(option.clone());
+            search_assignments(
+                position + 1,
+                options,
+                claims,
+                working,
+                positive,
+                negative,
+                Objective {
+                    accepted: objective.accepted + 1,
+                    score: objective.score + i64::from(option.score),
+                },
+                best,
+                remaining_nodes,
+                exhausted,
+            );
+            undo_option(option, positive, negative);
+            if *exhausted {
+                return;
+            }
+        }
+    }
+    working[position] = None;
+    search_assignments(
+        position + 1,
+        options,
+        claims,
+        working,
+        positive,
+        negative,
+        objective,
+        best,
+        remaining_nodes,
+        exhausted,
+    );
+}
+
+fn apply_option(
+    option: &AssignmentOption,
+    claims: &[ClaimLine],
+    positive: &mut [i64],
+    negative: &mut [i64],
+) -> bool {
+    for (applied, allocation) in option.allocations.iter().enumerate() {
+        if allocation.applied_cents > 0 {
+            positive[allocation.claim_idx] += allocation.applied_cents;
+            if positive[allocation.claim_idx] > claims[allocation.claim_idx].open_balance_cents {
+                rollback_allocations(&option.allocations[..=applied], positive, negative);
+                return false;
+            }
+        } else {
+            negative[allocation.claim_idx] += allocation.applied_cents.unsigned_abs() as i64;
+            if negative[allocation.claim_idx] > claims[allocation.claim_idx].open_balance_cents {
+                rollback_allocations(&option.allocations[..=applied], positive, negative);
+                return false;
+            }
+        }
+    }
+    true
+}
+
+fn undo_option(option: &AssignmentOption, positive: &mut [i64], negative: &mut [i64]) {
+    rollback_allocations(&option.allocations, positive, negative);
+}
+
+fn rollback_allocations(allocations: &[Allocation], positive: &mut [i64], negative: &mut [i64]) {
+    for allocation in allocations {
+        if allocation.applied_cents > 0 {
+            positive[allocation.claim_idx] -= allocation.applied_cents;
+        } else {
+            negative[allocation.claim_idx] -= allocation.applied_cents.unsigned_abs() as i64;
+        }
+    }
+}
+
+fn assignment_options(
+    remit: &RemittanceLine,
+    candidates: &[Candidate],
+    claims: &[ClaimLine],
+) -> Vec<AssignmentOption> {
+    let signed = remit.signed_amount();
+    let amount = signed.unsigned_abs();
+    let mut options = Vec::new();
+    for candidate in candidates {
+        let claim = &claims[candidate.claim_idx];
+        let has_reference = candidate
+            .facts
+            .iter()
+            .any(|fact| fact == "insurer_reference");
+        if amount <= claim.open_balance_cents.unsigned_abs()
+            && (!matches!(remit.transaction_kind, TransactionKind::Reversal) || has_reference)
+        {
+            options.push(AssignmentOption {
+                allocations: vec![Allocation {
+                    claim_idx: candidate.claim_idx,
+                    applied_cents: signed,
+                    score: candidate.score,
+                    facts: candidate.facts.clone(),
+                }],
+                score: candidate.score,
+            });
+        }
+    }
+
+    if signed > 0 && candidates.len() <= MAX_SPLIT_CANDIDATES {
+        let mut by_claim: BTreeMap<&str, Vec<&Candidate>> = BTreeMap::new();
+        for candidate in candidates {
+            by_claim
+                .entry(&claims[candidate.claim_idx].claim_id)
+                .or_default()
+                .push(candidate);
+        }
+        for same_claim_candidates in by_claim.values() {
+            let mut selected = Vec::new();
+            enumerate_split_options(
+                0,
+                amount,
+                same_claim_candidates,
+                claims,
+                &mut selected,
+                &mut options,
+            );
+        }
+    }
+
+    options.sort_by_key(|option| option_signature(option, claims));
+    options.dedup();
+    options
+}
+
+fn enumerate_split_options(
+    position: usize,
+    remaining: u64,
+    candidates: &[&Candidate],
+    claims: &[ClaimLine],
+    selected: &mut Vec<usize>,
+    options: &mut Vec<AssignmentOption>,
+) {
+    if remaining == 0 {
+        if selected.len() >= 2 {
+            let allocations = selected
+                .iter()
+                .map(|position| {
+                    let candidate = candidates[*position];
+                    let claim = &claims[candidate.claim_idx];
+                    Allocation {
+                        claim_idx: candidate.claim_idx,
+                        applied_cents: claim.open_balance_cents,
+                        score: candidate.score,
+                        facts: candidate.facts.clone(),
+                    }
+                })
+                .collect::<Vec<_>>();
+            options.push(AssignmentOption {
+                score: allocations
+                    .iter()
+                    .map(|allocation| allocation.score)
+                    .sum::<i32>()
+                    + 25,
+                allocations,
+            });
+        }
+        return;
+    }
+    if position == candidates.len() {
+        return;
+    }
+    enumerate_split_options(
+        position + 1,
+        remaining,
+        candidates,
+        claims,
+        selected,
+        options,
+    );
+    let candidate = candidates[position];
+    let capacity = claims[candidate.claim_idx]
+        .open_balance_cents
+        .unsigned_abs();
+    if capacity <= remaining {
+        selected.push(position);
+        enumerate_split_options(
+            position + 1,
+            remaining - capacity,
+            candidates,
+            claims,
+            selected,
+            options,
+        );
+        selected.pop();
+    }
+}
+
+fn option_signature(option: &AssignmentOption, claims: &[ClaimLine]) -> Vec<(ClaimKey, i64)> {
+    option
+        .allocations
+        .iter()
+        .map(|allocation| (claims[allocation.claim_idx].key(), allocation.applied_cents))
+        .collect()
+}
+
+fn competitors(
+    candidates: &[Candidate],
+    chosen: &[usize],
+    claims: &[ClaimLine],
+    reason: &str,
+) -> Vec<RejectedCompetitor> {
+    candidates
+        .iter()
+        .filter(|candidate| !chosen.contains(&candidate.claim_idx))
+        .map(|candidate| {
+            let claim = &claims[candidate.claim_idx];
+            RejectedCompetitor {
+                claim_line_id: claim.claim_line_id.clone(),
+                claim_revision: claim.revision,
+                reason_codes: vec![reason.to_string()],
+            }
+        })
+        .collect()
+}
+
+fn reason_for_no_assignment(
+    remit: &RemittanceLine,
+    candidates: &[Candidate],
+    claims: &[ClaimLine],
+    identity_sources_disagree: bool,
+) -> Vec<String> {
+    if identity_sources_disagree {
+        return vec!["conflicting_identity_sources".to_string()];
+    }
+    if matches!(remit.transaction_kind, TransactionKind::Reversal) {
+        return vec!["unsupported_standalone_reversal".to_string()];
+    }
+    if remit.insurer_reference.is_none()
+        && (remit.patient_key.is_none()
+            || remit.service_date_start.is_none()
+            || remit.service_date_end.is_none()
+            || remit.procedure_code.is_none())
+    {
+        return vec!["missing_identity".to_string()];
+    }
+    if candidates.is_empty() {
+        return vec!["no_plausible_candidate".to_string()];
+    }
+    let amount = remit.signed_amount().unsigned_abs();
+    let total_capacity = candidates.iter().fold(0_u64, |total, candidate| {
+        total.saturating_add(
+            claims[candidate.claim_idx]
+                .open_balance_cents
+                .unsigned_abs(),
+        )
+    });
+    let distinct_claims = candidates
+        .iter()
+        .map(|candidate| claims[candidate.claim_idx].claim_id.as_str())
+        .collect::<HashSet<_>>();
+    if total_capacity == amount && distinct_claims.len() > 1 {
+        return vec!["unsupported_bundle".to_string()];
+    }
+    if candidates.len() >= 2 && distinct_claims.len() == 1 && total_capacity >= amount {
+        return vec!["unsupported_partial_split".to_string()];
+    }
+    vec!["amount_inconsistent".to_string()]
+}
+
+#[allow(clippy::too_many_arguments)]
+fn write_results(
+    output_dir: &Path,
+    mut accepted: Vec<AcceptedLink>,
+    mut reviews: Vec<ReviewRecord>,
+    input_claim_records: usize,
+    valid_current_claim_lines: usize,
+    invalid_claim_records: usize,
+    input_remittance_records: usize,
+    invalid_remittance_records: usize,
+) -> Result<Summary, AnyError> {
+    fs::create_dir_all(output_dir)?;
+    accepted.sort_by(|left, right| {
+        left.remittance_line_id
+            .cmp(&right.remittance_line_id)
+            .then_with(|| left.claim_line_id.cmp(&right.claim_line_id))
+            .then_with(|| left.claim_revision.cmp(&right.claim_revision))
+            .then_with(|| left.applied_cents.cmp(&right.applied_cents))
+    });
+    reviews.sort_by(|left, right| {
+        left.remittance_line_id
+            .cmp(&right.remittance_line_id)
+            .then_with(|| {
+                left.physical_record_ordinal
+                    .cmp(&right.physical_record_ordinal)
+            })
+    });
+
+    write_jsonl(&output_dir.join("accepted.jsonl"), &accepted)?;
+    write_jsonl(&output_dir.join("review.jsonl"), &reviews)?;
+    let accepted_remittance_lines = accepted
+        .iter()
+        .map(|link| link.remittance_line_id.as_str())
+        .collect::<HashSet<_>>()
+        .len();
+    let summary = Summary {
+        input_claim_records,
+        valid_current_claim_lines,
+        invalid_claim_records,
+        input_remittance_records,
+        accepted_remittance_lines,
+        accepted_links: accepted.len(),
+        review_remittance_lines: reviews.len(),
+        invalid_remittance_records,
+    };
+    let summary_file = File::create(output_dir.join("summary.json"))?;
+    let mut writer = BufWriter::new(summary_file);
+    serde_json::to_writer_pretty(&mut writer, &summary)?;
+    writer.write_all(b"\n")?;
+    writer.flush()?;
+    Ok(summary)
+}
+
+fn write_jsonl<T: Serialize>(path: &Path, records: &[T]) -> Result<(), AnyError> {
+    let mut writer = BufWriter::new(File::create(path)?);
+    for record in records {
+        serde_json::to_writer(&mut writer, record)?;
+        writer.write_all(b"\n")?;
+    }
+    writer.flush()?;
+    Ok(())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn claim(id: &str, claim_id: &str, balance: i64) -> ClaimLine {
+        ClaimLine {
+            claim_line_id: id.to_string(),
+            claim_id: claim_id.to_string(),
+            revision: 1,
+            payer: "payer".to_string(),
+            provider: "provider".to_string(),
+            patient_key: "patient".to_string(),
+            service_date: 20_000,
+            procedure_code: "PROC".to_string(),
+            billed_cents: balance,
+            open_balance_cents: balance,
+            insurer_references: vec!["REF".to_string()],
+        }
+    }
+
+    fn remit(id: &str, amount: i64) -> RemittanceLine {
+        RemittanceLine {
+            remittance_line_id: id.to_string(),
+            payer: "payer".to_string(),
+            provider: "provider".to_string(),
+            insurer_reference: Some("REF".to_string()),
+            patient_key: Some("patient".to_string()),
+            service_date_start: Some(20_000),
+            service_date_end: Some(20_000),
+            procedure_code: Some("PROC".to_string()),
+            paid_cents: amount,
+            adjustment_cents: 0,
+            adjustment_codes: Vec::new(),
+            transaction_kind: TransactionKind::Payment,
+        }
+    }
+
+    #[test]
+    fn split_requires_same_claim() {
+        let claims = vec![claim("a", "one", 100), claim("b", "two", 150)];
+        let candidates = ClaimIndex::new(&claims)
+            .evaluate(&remit("r", 250), &claims)
+            .candidates;
+        assert!(assignment_options(&remit("r", 250), &candidates, &claims).is_empty());
+    }
+
+    #[test]
+    fn split_is_available_within_one_claim() {
+        let claims = vec![claim("a", "one", 100), claim("b", "one", 150)];
+        let candidates = ClaimIndex::new(&claims)
+            .evaluate(&remit("r", 250), &claims)
+            .candidates;
+        let options = assignment_options(&remit("r", 250), &candidates, &claims);
+        assert_eq!(options.len(), 1);
+        assert_eq!(options[0].allocations.len(), 2);
+    }
+
+    #[test]
+    fn only_latest_revision_is_eligible() {
+        let mut old = claim("line", "claim", 100);
+        let mut current = old.clone();
+        old.revision = 1;
+        current.revision = 2;
+        assert_eq!(current_revisions(&[old, current])[0].revision, 2);
+    }
+
+    #[test]
+    fn dense_search_stops_at_the_budget() {
+        let claims = (0..12)
+            .map(|index| claim(&format!("line-{index}"), &format!("claim-{index}"), 100))
+            .collect::<Vec<_>>();
+        let one_remit_options = (0..12)
+            .map(|claim_idx| AssignmentOption {
+                allocations: vec![Allocation {
+                    claim_idx,
+                    applied_cents: 100,
+                    score: 100,
+                    facts: vec!["insurer_reference".to_string()],
+                }],
+                score: 100,
+            })
+            .collect::<Vec<_>>();
+        let options = vec![one_remit_options; 12];
+        let mut working = vec![None; 12];
+        let mut positive = vec![0; 12];
+        let mut negative = vec![0; 12];
+        let mut best = SearchBest {
+            assignments: vec![None; 12],
+            ..SearchBest::default()
+        };
+        let mut remaining_nodes = 1_000;
+        let mut exhausted = false;
+        search_assignments(
+            0,
+            &options,
+            &claims,
+            &mut working,
+            &mut positive,
+            &mut negative,
+            Objective {
+                accepted: 0,
+                score: 0,
+            },
+            &mut best,
+            &mut remaining_nodes,
+            &mut exhausted,
+        );
+        assert!(exhausted);
+        assert_eq!(remaining_nodes, 0);
+    }
+}
diff --git a/developer-simulation/runs/2026-08-08--remittance-reconciliation/src/fixture.rs b/developer-simulation/runs/2026-08-08--remittance-reconciliation/src/fixture.rs
new file mode 100644
index 0000000..08cbc16
--- /dev/null
+++ b/developer-simulation/runs/2026-08-08--remittance-reconciliation/src/fixture.rs
@@ -0,0 +1,641 @@
+use std::error::Error;
+use std::fs::{self, File};
+use std::io::{BufRead, BufReader, BufWriter, Write};
+use std::path::Path;
+
+use serde::Serialize;
+
+use crate::model::{ClaimLine, ExpectedLink, GroundTruthRecord, RemittanceLine, TransactionKind};
+
+type AnyError = Box<dyn Error + Send + Sync>;
+
+const EDGE_GROUPS: usize = 12;
+const UNSUPPORTED_GROUPS: usize = 4;
+
+pub fn generate_fixture(
+    output_dir: &Path,
+    claim_count: usize,
+    remittance_count: usize,
+) -> Result<(), AnyError> {
+    let edge_remittance_count = EDGE_GROUPS * 12 + UNSUPPORTED_GROUPS + 1;
+    let edge_claim_count = EDGE_GROUPS * 14 + UNSUPPORTED_GROUPS * 2;
+    let minimum_claim_count = remittance_count - edge_remittance_count + edge_claim_count + 1;
+    if remittance_count <= edge_remittance_count || claim_count < minimum_claim_count {
+        return Err("fixture sizes are too small for the representative edge cases".into());
+    }
+
+    let bulk_count = remittance_count - edge_remittance_count;
+    let mut claim_lines = Vec::with_capacity(claim_count);
+    let mut remittance_lines = Vec::with_capacity(remittance_count);
+    let mut truth = Vec::with_capacity(remittance_count);
+
+    for index in 0..bulk_count {
+        let case = format!("BULK-{index:06}");
+        let amount = 1_000 + i64::try_from(index % 1_000)?;
+        let claim = synthetic_claim(&case, &case, 1, amount, &format!("REF-{case}"), index);
+        let remit = synthetic_remit(
+            &case,
+            amount,
+            TransactionKind::Payment,
+            Some(format!("REF-{case}")),
+            Some(claim.patient_key.clone()),
+            Some(claim.service_date),
+            Some(claim.procedure_code.clone()),
+            index,
+        );
+        push_serialized(&mut claim_lines, &claim)?;
+        push_truth_for_single(&mut truth, &remit, &claim, amount);
+        push_serialized(&mut remittance_lines, &remit)?;
+    }
+
+    for group in 0..EDGE_GROUPS {
+        add_global_greedy_trap(group, &mut claim_lines, &mut remittance_lines, &mut truth)?;
+        add_same_claim_split(group, &mut claim_lines, &mut remittance_lines, &mut truth)?;
+        add_multiple_payments(group, &mut claim_lines, &mut remittance_lines, &mut truth)?;
+        add_revision_case(group, &mut claim_lines, &mut remittance_lines, &mut truth)?;
+        add_duplicate_reference_case(group, &mut claim_lines, &mut remittance_lines, &mut truth)?;
+        add_payment_reversal(group, &mut claim_lines, &mut remittance_lines, &mut truth)?;
+        add_denial(group, &mut claim_lines, &mut remittance_lines, &mut truth)?;
+        add_missing_optional_fields(group, &mut claim_lines, &mut remittance_lines, &mut truth)?;
+        add_ambiguous_case(group, &mut claim_lines, &mut remittance_lines, &mut truth)?;
+    }
+    for group in 0..UNSUPPORTED_GROUPS {
+        add_unsupported_bundle(group, &mut claim_lines, &mut remittance_lines, &mut truth)?;
+    }
+
+    let invalid_id = "R-MALFORMED";
+    remittance_lines.push(format!(
+        "{{\"remittance_line_id\":\"{invalid_id}\",\"payer\":\"payer-malformed\",\"patient_key\":\"remittance-only-secret-000\"}}"
+    ));
+    truth.push(GroundTruthRecord {
+        remittance_line_id: invalid_id.to_string(),
+        unambiguous: false,
+        links: Vec::new(),
+    });
+
+    while claim_lines.len() + 1 < claim_count {
+        let index = claim_lines.len();
+        let case = format!("UNMATCHED-{index:06}");
+        let claim = synthetic_claim(&case, &case, 1, 777, &format!("REF-{case}"), index);
+        push_serialized(&mut claim_lines, &claim)?;
+    }
+    claim_lines.push("{\"claim_line_id\":\"C-MALFORMED\",\"revision\":1}".to_string());
+
+    if claim_lines.len() != claim_count || remittance_lines.len() != remittance_count {
+        return Err(format!(
+            "fixture construction count mismatch: claims={} remittances={}",
+            claim_lines.len(),
+            remittance_lines.len()
+        )
+        .into());
+    }
+
+    fs::create_dir_all(output_dir)?;
+    write_lines(&output_dir.join("claims.jsonl"), &claim_lines)?;
+    write_lines(&output_dir.join("remittances.jsonl"), &remittance_lines)?;
+    truth.sort_by(|left, right| left.remittance_line_id.cmp(&right.remittance_line_id));
+    write_jsonl(&output_dir.join("ground-truth.jsonl"), &truth)?;
+    Ok(())
+}
+
+pub fn shuffle_inputs(
+    claims_path: &Path,
+    remittances_path: &Path,
+    output_dir: &Path,
+    seed: u64,
+) -> Result<(), AnyError> {
+    fs::create_dir_all(output_dir)?;
+    let mut claims = read_lines(claims_path)?;
+    let mut remittances = read_lines(remittances_path)?;
+    let mut rng = XorShift64::new(seed);
+    shuffle(&mut claims, &mut rng);
+    shuffle(&mut remittances, &mut rng);
+    write_lines(&output_dir.join("claims.jsonl"), &claims)?;
+    write_lines(&output_dir.join("remittances.jsonl"), &remittances)?;
+    Ok(())
+}
+
+fn add_global_greedy_trap(
+    group: usize,
+    claims: &mut Vec<String>,
+    remits: &mut Vec<String>,
+    truth: &mut Vec<GroundTruthRecord>,
+) -> Result<(), AnyError> {
+    let base = format!("TRAP-{group:03}");
+    let mut first = synthetic_claim(
+        &format!("{base}-A"),
+        &format!("{base}-CLAIM-A"),
+        1,
+        100,
+        &format!("REF-{base}-STRONG"),
+        group,
+    );
+    let mut second = synthetic_claim(
+        &format!("{base}-B"),
+        &format!("{base}-CLAIM-B"),
+        1,
+        100,
+        &format!("REF-{base}-OTHER"),
+        group,
+    );
+    second.patient_key.clone_from(&first.patient_key);
+    second.service_date = first.service_date;
+    second.procedure_code.clone_from(&first.procedure_code);
+    first.insurer_references = vec![format!("REF-{base}-STRONG")];
+    let weak = synthetic_remit(
+        &format!("{base}-WEAK"),
+        100,
+        TransactionKind::Payment,
+        None,
+        Some(first.patient_key.clone()),
+        Some(first.service_date),
+        Some(first.procedure_code.clone()),
+        group,
+    );
+    let strong = synthetic_remit(
+        &format!("{base}-STRONG"),
+        100,
+        TransactionKind::Payment,
+        Some(format!("REF-{base}-STRONG")),
+        None,
+        None,
+        None,
+        group,
+    );
+    push_serialized(claims, &first)?;
+    push_serialized(claims, &second)?;
+    push_truth_for_single(truth, &weak, &second, 100);
+    push_truth_for_single(truth, &strong, &first, 100);
+    push_serialized(remits, &weak)?;
+    push_serialized(remits, &strong)?;
+    Ok(())
+}
+
+fn add_same_claim_split(
+    group: usize,
+    claims: &mut Vec<String>,
+    remits: &mut Vec<String>,
+    truth: &mut Vec<GroundTruthRecord>,
+) -> Result<(), AnyError> {
+    let base = format!("SPLIT-{group:03}");
+    let reference = format!("REF-{base}");
+    let first = synthetic_claim(&format!("{base}-A"), &base, 1, 100, &reference, group);
+    let second = synthetic_claim(&format!("{base}-B"), &base, 1, 150, &reference, group);
+    let remit = synthetic_remit(
+        &base,
+        250,
+        TransactionKind::Payment,
+        Some(reference),
+        None,
+        None,
+        None,
+        group,
+    );
+    push_serialized(claims, &first)?;
+    push_serialized(claims, &second)?;
+    push_serialized(remits, &remit)?;
+    truth.push(GroundTruthRecord {
+        remittance_line_id: remit.remittance_line_id.clone(),
+        unambiguous: true,
+        links: vec![
+            expected(&remit, &first, 100),
+            expected(&remit, &second, 150),
+        ],
+    });
+    Ok(())
+}
+
+fn add_multiple_payments(
+    group: usize,
+    claims: &mut Vec<String>,
+    remits: &mut Vec<String>,
+    truth: &mut Vec<GroundTruthRecord>,
+) -> Result<(), AnyError> {
+    let base = format!("MULTI-{group:03}");
+    let reference = format!("REF-{base}");
+    let claim = synthetic_claim(&base, &base, 1, 300, &reference, group);
+    let first = synthetic_remit(
+        &format!("{base}-A"),
+        100,
+        TransactionKind::Payment,
+        Some(reference.clone()),
+        Some(claim.patient_key.clone()),
+        Some(claim.service_date),
+        Some(claim.procedure_code.clone()),
+        group,
+    );
+    let second = synthetic_remit(
+        &format!("{base}-B"),
+        200,
+        TransactionKind::Payment,
+        Some(reference),
+        Some(claim.patient_key.clone()),
+        Some(claim.service_date),
+        Some(claim.procedure_code.clone()),
+        group,
+    );
+    push_serialized(claims, &claim)?;
+    push_truth_for_single(truth, &first, &claim, 100);
+    push_truth_for_single(truth, &second, &claim, 200);
+    push_serialized(remits, &first)?;
+    push_serialized(remits, &second)?;
+    Ok(())
+}
+
+fn add_revision_case(
+    group: usize,
+    claims: &mut Vec<String>,
+    remits: &mut Vec<String>,
+    truth: &mut Vec<GroundTruthRecord>,
+) -> Result<(), AnyError> {
+    let base = format!("REVISION-{group:03}");
+    let reference = format!("REF-{base}");
+    let old = synthetic_claim(&base, &base, 1, 100, &reference, group);
+    let mut current = old.clone();
+    current.revision = 2;
+    let remit = synthetic_remit(
+        &base,
+        100,
+        TransactionKind::Payment,
+        Some(reference),
+        Some(current.patient_key.clone()),
+        Some(current.service_date),
+        Some(current.procedure_code.clone()),
+        group,
+    );
+    push_serialized(claims, &old)?;
+    push_serialized(claims, &current)?;
+    push_truth_for_single(truth, &remit, &current, 100);
+    push_serialized(remits, &remit)?;
+    Ok(())
+}
+
+fn add_duplicate_reference_case(
+    group: usize,
+    claims: &mut Vec<String>,
+    remits: &mut Vec<String>,
+    truth: &mut Vec<GroundTruthRecord>,
+) -> Result<(), AnyError> {
+    let base = format!("DUPREF-{group:03}");
+    let reference = format!("REF-{base}");
+    let wrong = synthetic_claim(
+        &format!("{base}-A"),
+        &format!("{base}-A"),
+        1,
+        125,
+        &reference,
+        group,
+    );
+    let mut right = synthetic_claim(
+        &format!("{base}-B"),
+        &format!("{base}-B"),
+        1,
+        125,
+        &reference,
+        group,
+    );
+    right.service_date += 1;
+    right.procedure_code = format!("PROC-DUP-{group:03}");
+    let remit = synthetic_remit(
+        &base,
+        125,
+        TransactionKind::Payment,
+        Some(reference),
+        Some(right.patient_key.clone()),
+        Some(right.service_date),
+        Some(right.procedure_code.clone()),
+        group,
+    );
+    push_serialized(claims, &wrong)?;
+    push_serialized(claims, &right)?;
+    push_truth_for_single(truth, &remit, &right, 125);
+    push_serialized(remits, &remit)?;
+    Ok(())
+}
+
+fn add_payment_reversal(
+    group: usize,
+    claims: &mut Vec<String>,
+    remits: &mut Vec<String>,
+    truth: &mut Vec<GroundTruthRecord>,
+) -> Result<(), AnyError> {
+    let base = format!("REVERSAL-{group:03}");
+    let reference = format!("REF-{base}");
+    let claim = synthetic_claim(&base, &base, 1, 500, &reference, group);
+    let payment = synthetic_remit(
+        &format!("{base}-PAY"),
+        500,
+        TransactionKind::Payment,
+        Some(reference.clone()),
+        Some(claim.patient_key.clone()),
+        Some(claim.service_date),
+        Some(claim.procedure_code.clone()),
+        group,
+    );
+    let reversal = synthetic_remit(
+        &format!("{base}-REVERSE"),
+        -100,
+        TransactionKind::Reversal,
+        Some(reference),
+        Some(claim.patient_key.clone()),
+        Some(claim.service_date),
+        Some(claim.procedure_code.clone()),
+        group,
+    );
+    push_serialized(claims, &claim)?;
+    push_truth_for_single(truth, &payment, &claim, 500);
+    push_truth_for_single(truth, &reversal, &claim, -100);
+    push_serialized(remits, &payment)?;
+    push_serialized(remits, &reversal)?;
+    Ok(())
+}
+
+fn add_denial(
+    group: usize,
+    claims: &mut Vec<String>,
+    remits: &mut Vec<String>,
+    truth: &mut Vec<GroundTruthRecord>,
+) -> Result<(), AnyError> {
+    let base = format!("DENIAL-{group:03}");
+    let reference = format!("REF-{base}");
+    let claim = synthetic_claim(&base, &base, 1, 100, &reference, group);
+    let mut remit = synthetic_remit(
+        &base,
+        100,
+        TransactionKind::Denial,
+        Some(reference),
+        Some(claim.patient_key.clone()),
+        Some(claim.service_date),
+        Some(claim.procedure_code.clone()),
+        group,
+    );
+    remit.paid_cents = 0;
+    remit.adjustment_cents = 100;
+    remit.adjustment_codes = vec!["contractual_adjustment".to_string()];
+    push_serialized(claims, &claim)?;
+    push_truth_for_single(truth, &remit, &claim, 100);
+    push_serialized(remits, &remit)?;
+    Ok(())
+}
+
+fn add_missing_optional_fields(
+    group: usize,
+    claims: &mut Vec<String>,
+    remits: &mut Vec<String>,
+    truth: &mut Vec<GroundTruthRecord>,
+) -> Result<(), AnyError> {
+    let base = format!("MISSING-{group:03}");
+    let reference = format!("REF-{base}");
+    let claim = synthetic_claim(&base, &base, 1, 90, &reference, group);
+    let remit = synthetic_remit(
+        &base,
+        90,
+        TransactionKind::Payment,
+        Some(reference),
+        None,
+        None,
+        None,
+        group,
+    );
+    push_serialized(claims, &claim)?;
+    push_truth_for_single(truth, &remit, &claim, 90);
+    push_serialized(remits, &remit)?;
+    Ok(())
+}
+
+fn add_ambiguous_case(
+    group: usize,
+    claims: &mut Vec<String>,
+    remits: &mut Vec<String>,
+    truth: &mut Vec<GroundTruthRecord>,
+) -> Result<(), AnyError> {
+    let base = format!("AMBIG-{group:03}");
+    let reference = format!("REF-{base}");
+    let first = synthetic_claim(
+        &format!("{base}-A"),
+        &format!("{base}-A"),
+        1,
+        110,
+        &reference,
+        group,
+    );
+    let mut second = synthetic_claim(
+        &format!("{base}-B"),
+        &format!("{base}-B"),
+        1,
+        110,
+        &reference,
+        group,
+    );
+    second.patient_key.clone_from(&first.patient_key);
+    second.service_date = first.service_date;
+    second.procedure_code.clone_from(&first.procedure_code);
+    let remit = synthetic_remit(
+        &base,
+        110,
+        TransactionKind::Payment,
+        Some(reference),
+        Some(first.patient_key.clone()),
+        Some(first.service_date),
+        Some(first.procedure_code.clone()),
+        group,
+    );
+    push_serialized(claims, &first)?;
+    push_serialized(claims, &second)?;
+    push_serialized(remits, &remit)?;
+    truth.push(GroundTruthRecord {
+        remittance_line_id: remit.remittance_line_id,
+        unambiguous: false,
+        links: Vec::new(),
+    });
+    Ok(())
+}
+
+fn add_unsupported_bundle(
+    group: usize,
+    claims: &mut Vec<String>,
+    remits: &mut Vec<String>,
+    truth: &mut Vec<GroundTruthRecord>,
+) -> Result<(), AnyError> {
+    let base = format!("UNSUPPORTED-{group:03}");
+    let reference = format!("REF-{base}");
+    let first = synthetic_claim(
+        &format!("{base}-A"),
+        &format!("{base}-A"),
+        1,
+        100,
+        &reference,
+        group,
+    );
+    let second = synthetic_claim(
+        &format!("{base}-B"),
+        &format!("{base}-B"),
+        1,
+        150,
+        &reference,
+        group,
+    );
+    let remit = synthetic_remit(
+        &base,
+        250,
+        TransactionKind::Payment,
+        Some(reference),
+        None,
+        None,
+        None,
+        group,
+    );
+    push_serialized(claims, &first)?;
+    push_serialized(claims, &second)?;
+    push_serialized(remits, &remit)?;
+    truth.push(GroundTruthRecord {
+        remittance_line_id: remit.remittance_line_id,
+        unambiguous: false,
+        links: Vec::new(),
+    });
+    Ok(())
+}
+
+fn synthetic_claim(
+    line_suffix: &str,
+    claim_suffix: &str,
+    revision: u32,
+    amount: i64,
+    reference: &str,
+    variation: usize,
+) -> ClaimLine {
+    ClaimLine {
+        claim_line_id: format!("C-{line_suffix}"),
+        claim_id: format!("CLAIM-{claim_suffix}"),
+        revision,
+        payer: format!("payer-{:02}", variation % 17),
+        provider: format!("provider-{:02}", variation % 29),
+        patient_key: format!("patient-key-{line_suffix}"),
+        service_date: 20_000 + i32::try_from(variation % 365).unwrap_or_default(),
+        procedure_code: format!("PROC-{:03}", variation % 101),
+        billed_cents: amount,
+        open_balance_cents: amount,
+        insurer_references: vec![reference.to_string()],
+    }
+}
+
+#[allow(clippy::too_many_arguments)]
+fn synthetic_remit(
+    suffix: &str,
+    amount: i64,
+    transaction_kind: TransactionKind,
+    insurer_reference: Option<String>,
+    patient_key: Option<String>,
+    service_date: Option<i32>,
+    procedure_code: Option<String>,
+    variation: usize,
+) -> RemittanceLine {
+    RemittanceLine {
+        remittance_line_id: format!("R-{suffix}"),
+        payer: format!("payer-{:02}", variation % 17),
+        provider: format!("provider-{:02}", variation % 29),
+        insurer_reference,
+        patient_key,
+        service_date_start: service_date,
+        service_date_end: service_date,
+        procedure_code,
+        paid_cents: amount,
+        adjustment_cents: 0,
+        adjustment_codes: Vec::new(),
+        transaction_kind,
+    }
+}
+
+fn push_truth_for_single(
+    truth: &mut Vec<GroundTruthRecord>,
+    remit: &RemittanceLine,
+    claim: &ClaimLine,
+    amount: i64,
+) {
+    truth.push(GroundTruthRecord {
+        remittance_line_id: remit.remittance_line_id.clone(),
+        unambiguous: true,
+        links: vec![expected(remit, claim, amount)],
+    });
+}
+
+fn expected(remit: &RemittanceLine, claim: &ClaimLine, amount: i64) -> ExpectedLink {
+    ExpectedLink {
+        remittance_line_id: remit.remittance_line_id.clone(),
+        claim_line_id: claim.claim_line_id.clone(),
+        claim_revision: claim.revision,
+        applied_cents: amount,
+    }
+}
+
+fn push_serialized<T: Serialize>(lines: &mut Vec<String>, value: &T) -> Result<(), AnyError> {
+    lines.push(serde_json::to_string(value)?);
+    Ok(())
+}
+
+fn read_lines(path: &Path) -> Result<Vec<String>, AnyError> {
+    Ok(BufReader::new(File::open(path)?)
+        .lines()
+        .collect::<Result<Vec<_>, _>>()?)
+}
+
+fn write_lines(path: &Path, lines: &[String]) -> Result<(), AnyError> {
+    let mut writer = BufWriter::new(File::create(path)?);
+    for line in lines {
+        writer.write_all(line.as_bytes())?;
+        writer.write_all(b"\n")?;
+    }
+    writer.flush()?;
+    Ok(())
+}
+
+fn write_jsonl<T: Serialize>(path: &Path, values: &[T]) -> Result<(), AnyError> {
+    let mut writer = BufWriter::new(File::create(path)?);
+    for value in values {
+        serde_json::to_writer(&mut writer, value)?;
+        writer.write_all(b"\n")?;
+    }
+    writer.flush()?;
+    Ok(())
+}
+
+#[derive(Debug)]
+struct XorShift64(u64);
+
+impl XorShift64 {
+    fn new(seed: u64) -> Self {
+        Self(seed.max(1))
+    }
+
+    fn next(&mut self) -> u64 {
+        let mut value = self.0;
+        value ^= value << 13;
+        value ^= value >> 7;
+        value ^= value << 17;
+        self.0 = value;
+        value
+    }
+}
+
+fn shuffle<T>(items: &mut [T], rng: &mut XorShift64) {
+    for index in (1..items.len()).rev() {
+        let upper = u64::try_from(index + 1).unwrap_or(u64::MAX);
+        let chosen = usize::try_from(rng.next() % upper).unwrap_or_default();
+        items.swap(index, chosen);
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn shuffle_is_deterministic() {
+        let mut first = (0..100).collect::<Vec<_>>();
+        let mut second = first.clone();
+        shuffle(&mut first, &mut XorShift64::new(42));
+        shuffle(&mut second, &mut XorShift64::new(42));
+        assert_eq!(first, second);
+        assert_ne!(first, (0..100).collect::<Vec<_>>());
+    }
+}
diff --git a/developer-simulation/runs/2026-08-08--remittance-reconciliation/src/lib.rs b/developer-simulation/runs/2026-08-08--remittance-reconciliation/src/lib.rs
new file mode 100644
index 0000000..07ba178
--- /dev/null
+++ b/developer-simulation/runs/2026-08-08--remittance-reconciliation/src/lib.rs
@@ -0,0 +1,4 @@
+pub mod engine;
+pub mod fixture;
+pub mod model;
+pub mod verify;
diff --git a/developer-simulation/runs/2026-08-08--remittance-reconciliation/src/main.rs b/developer-simulation/runs/2026-08-08--remittance-reconciliation/src/main.rs
new file mode 100644
index 0000000..3d13260
--- /dev/null
+++ b/developer-simulation/runs/2026-08-08--remittance-reconciliation/src/main.rs
@@ -0,0 +1,179 @@
+use std::env;
+use std::error::Error;
+use std::path::{Path, PathBuf};
+use std::time::Instant;
+
+use remittance_reconciliation::engine::{greedy_baseline, reconcile};
+use remittance_reconciliation::fixture::{generate_fixture, shuffle_inputs};
+use remittance_reconciliation::verify::verify_results;
+
+type AnyError = Box<dyn Error + Send + Sync>;
+
+fn main() {
+    if let Err(error) = run() {
+        eprintln!("error: {error}");
+        std::process::exit(1);
+    }
+}
+
+fn run() -> Result<(), AnyError> {
+    let args = env::args().skip(1).collect::<Vec<_>>();
+    let Some(command) = args.first().map(String::as_str) else {
+        print_help();
+        return Err("a command is required".into());
+    };
+    match command {
+        "generate" => {
+            let out = required_path(&args, "--out")?;
+            let claim_count = optional_usize(&args, "--claim-count", 62_000)?;
+            let remittance_count = optional_usize(&args, "--remittance-count", 50_000)?;
+            let started = Instant::now();
+            generate_fixture(&out, claim_count, remittance_count)?;
+            println!(
+                "generated {claim_count} claim records and {remittance_count} remittance records in {:.3}s",
+                started.elapsed().as_secs_f64()
+            );
+        }
+        "reconcile" => {
+            let claims = required_path(&args, "--claims")?;
+            let remittances = required_path(&args, "--remittances")?;
+            let out = required_path(&args, "--out")?;
+            let started = Instant::now();
+            let summary = reconcile(&claims, &remittances, &out)?;
+            println!(
+                "reconciled {} remittance records: {} accepted, {} review, {} links in {:.3}s",
+                summary.input_remittance_records,
+                summary.accepted_remittance_lines,
+                summary.review_remittance_lines,
+                summary.accepted_links,
+                started.elapsed().as_secs_f64()
+            );
+        }
+        "baseline" => {
+            let claims = required_path(&args, "--claims")?;
+            let remittances = required_path(&args, "--remittances")?;
+            let out = required_path(&args, "--out")?;
+            let started = Instant::now();
+            let summary = greedy_baseline(&claims, &remittances, &out)?;
+            println!(
+                "baseline processed {} remittance records: {} accepted, {} review, {} links in {:.3}s",
+                summary.input_remittance_records,
+                summary.accepted_remittance_lines,
+                summary.review_remittance_lines,
+                summary.accepted_links,
+                started.elapsed().as_secs_f64()
+            );
+        }
+        "shuffle" => {
+            let claims = required_path(&args, "--claims")?;
+            let remittances = required_path(&args, "--remittances")?;
+            let out = required_path(&args, "--out")?;
+            let seed = required_value(&args, "--seed")?.parse::<u64>()?;
+            shuffle_inputs(&claims, &remittances, &out, seed)?;
+            println!("wrote deterministic shuffle for seed {seed}");
+        }
+        "verify" => {
+            let claims = required_path(&args, "--claims")?;
+            let remittances = required_path(&args, "--remittances")?;
+            let truth = required_path(&args, "--ground-truth")?;
+            let results = required_path(&args, "--results")?;
+            let allow_failure = args.iter().any(|arg| arg == "--allow-failure");
+            let report = verify_results(&claims, &remittances, &truth, &results)?;
+            println!("{}", serde_json::to_string_pretty(&report)?);
+            if !report.passed && !allow_failure {
+                return Err("verification failed".into());
+            }
+        }
+        "demo" => {
+            let work_dir = required_path(&args, "--work-dir")?;
+            run_demo(&work_dir)?;
+        }
+        "help" | "--help" | "-h" => print_help(),
+        _ => {
+            print_help();
+            return Err(format!("unknown command: {command}").into());
+        }
+    }
+    Ok(())
+}
+
+fn run_demo(work_dir: &Path) -> Result<(), AnyError> {
+    let fixture = work_dir.join("fixture");
+    let results = work_dir.join("results");
+    let baseline = work_dir.join("baseline");
+    generate_fixture(&fixture, 400, 200)?;
+    let improved_summary = reconcile(
+        &fixture.join("claims.jsonl"),
+        &fixture.join("remittances.jsonl"),
+        &results,
+    )?;
+    let improved_report = verify_results(
+        &fixture.join("claims.jsonl"),
+        &fixture.join("remittances.jsonl"),
+        &fixture.join("ground-truth.jsonl"),
+        &results,
+    )?;
+    let baseline_summary = greedy_baseline(
+        &fixture.join("claims.jsonl"),
+        &fixture.join("remittances.jsonl"),
+        &baseline,
+    )?;
+    let baseline_report = verify_results(
+        &fixture.join("claims.jsonl"),
+        &fixture.join("remittances.jsonl"),
+        &fixture.join("ground-truth.jsonl"),
+        &baseline,
+    )?;
+    println!(
+        "demo improved: accepted={} review={} precision={:.4}% recall={:.4}% passed={}",
+        improved_summary.accepted_remittance_lines,
+        improved_summary.review_remittance_lines,
+        improved_report.precision * 100.0,
+        improved_report.recall * 100.0,
+        improved_report.passed
+    );
+    println!(
+        "demo greedy baseline: accepted={} review={} precision={:.4}% recall={:.4}% passed={}",
+        baseline_summary.accepted_remittance_lines,
+        baseline_summary.review_remittance_lines,
+        baseline_report.precision * 100.0,
+        baseline_report.recall * 100.0,
+        baseline_report.passed
+    );
+    if !improved_report.passed {
+        return Err("the improved demo did not pass verification".into());
+    }
+    Ok(())
+}
+
+fn required_path(args: &[String], flag: &str) -> Result<PathBuf, AnyError> {
+    Ok(PathBuf::from(required_value(args, flag)?))
+}
+
+fn required_value<'a>(args: &'a [String], flag: &str) -> Result<&'a str, AnyError> {
+    args.iter()
+        .position(|arg| arg == flag)
+        .and_then(|position| args.get(position + 1))
+        .map(String::as_str)
+        .ok_or_else(|| format!("missing required {flag}").into())
+}
+
+fn optional_usize(args: &[String], flag: &str, default: usize) -> Result<usize, AnyError> {
+    args.iter()
+        .position(|arg| arg == flag)
+        .and_then(|position| args.get(position + 1))
+        .map_or(Ok(default), |value| Ok(value.parse()?))
+}
+
+fn print_help() {
+    println!(
+        "remittance-reconciliation\n\
+         commands:\n\
+           generate --out DIR [--claim-count N] [--remittance-count N]\n\
+           reconcile --claims FILE --remittances FILE --out DIR\n\
+           baseline --claims FILE --remittances FILE --out DIR\n\
+           shuffle --claims FILE --remittances FILE --seed N --out DIR\n\
+           verify --claims FILE --remittances FILE --ground-truth FILE --results DIR [--allow-failure]\n\
+           demo --work-dir DIR"
+    );
+}
diff --git a/developer-simulation/runs/2026-08-08--remittance-reconciliation/src/model.rs b/developer-simulation/runs/2026-08-08--remittance-reconciliation/src/model.rs
new file mode 100644
index 0000000..45b4b79
--- /dev/null
+++ b/developer-simulation/runs/2026-08-08--remittance-reconciliation/src/model.rs
@@ -0,0 +1,162 @@
+use serde::{Deserialize, Serialize};
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
+pub struct ClaimLine {
+    pub claim_line_id: String,
+    pub claim_id: String,
+    pub revision: u32,
+    pub payer: String,
+    pub provider: String,
+    pub patient_key: String,
+    pub service_date: i32,
+    pub procedure_code: String,
+    pub billed_cents: i64,
+    pub open_balance_cents: i64,
+    #[serde(default)]
+    pub insurer_references: Vec<String>,
+}
+
+impl ClaimLine {
+    pub fn key(&self) -> ClaimKey {
+        ClaimKey {
+            claim_line_id: self.claim_line_id.clone(),
+            revision: self.revision,
+        }
+    }
+
+    pub fn validate(&self) -> Result<(), &'static str> {
+        if self.claim_line_id.is_empty()
+            || self.claim_id.is_empty()
+            || self.payer.is_empty()
+            || self.provider.is_empty()
+            || self.patient_key.is_empty()
+            || self.procedure_code.is_empty()
+        {
+            return Err("missing_identity");
+        }
+        if self.billed_cents < 0
+            || self.open_balance_cents < 0
+            || self.open_balance_cents > self.billed_cents
+        {
+            return Err("amount_inconsistent");
+        }
+        Ok(())
+    }
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
+#[serde(rename_all = "snake_case")]
+pub enum TransactionKind {
+    Payment,
+    Denial,
+    Reversal,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
+pub struct RemittanceLine {
+    pub remittance_line_id: String,
+    pub payer: String,
+    pub provider: String,
+    pub insurer_reference: Option<String>,
+    pub patient_key: Option<String>,
+    pub service_date_start: Option<i32>,
+    pub service_date_end: Option<i32>,
+    pub procedure_code: Option<String>,
+    pub paid_cents: i64,
+    pub adjustment_cents: i64,
+    #[serde(default)]
+    pub adjustment_codes: Vec<String>,
+    pub transaction_kind: TransactionKind,
+}
+
+impl RemittanceLine {
+    pub fn signed_amount(&self) -> i64 {
+        self.paid_cents
+            .checked_add(self.adjustment_cents)
+            .expect("signed_amount is called only after validation")
+    }
+
+    pub fn validate(&self) -> Result<(), &'static str> {
+        if self.remittance_line_id.is_empty() || self.payer.is_empty() || self.provider.is_empty() {
+            return Err("missing_identity");
+        }
+        if let (Some(start), Some(end)) = (self.service_date_start, self.service_date_end) {
+            if start > end {
+                return Err("amount_inconsistent");
+            }
+            if end.saturating_sub(start) > 31 {
+                return Err("unsupported_date_range");
+            }
+        }
+        let Some(amount) = self.paid_cents.checked_add(self.adjustment_cents) else {
+            return Err("amount_inconsistent");
+        };
+        match self.transaction_kind {
+            TransactionKind::Payment | TransactionKind::Denial if amount <= 0 => {
+                Err("amount_inconsistent")
+            }
+            TransactionKind::Reversal if amount >= 0 => Err("amount_inconsistent"),
+            _ => Ok(()),
+        }
+    }
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq, PartialOrd, Ord, Hash)]
+pub struct ClaimKey {
+    pub claim_line_id: String,
+    pub revision: u32,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
+pub struct RejectedCompetitor {
+    pub claim_line_id: String,
+    pub claim_revision: u32,
+    pub reason_codes: Vec<String>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
+pub struct AcceptedLink {
+    pub remittance_line_id: String,
+    pub claim_line_id: String,
+    pub claim_revision: u32,
+    pub applied_cents: i64,
+    pub score: i32,
+    pub facts: Vec<String>,
+    pub rejected_competitors: Vec<RejectedCompetitor>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
+pub struct ReviewRecord {
+    pub remittance_line_id: String,
+    pub physical_record_ordinal: usize,
+    pub reason_codes: Vec<String>,
+    pub candidate_count: usize,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
+pub struct Summary {
+    pub input_claim_records: usize,
+    pub valid_current_claim_lines: usize,
+    pub invalid_claim_records: usize,
+    pub input_remittance_records: usize,
+    pub accepted_remittance_lines: usize,
+    pub accepted_links: usize,
+    pub review_remittance_lines: usize,
+    pub invalid_remittance_records: usize,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq, PartialOrd, Ord)]
+pub struct ExpectedLink {
+    pub remittance_line_id: String,
+    pub claim_line_id: String,
+    pub claim_revision: u32,
+    pub applied_cents: i64,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
+pub struct GroundTruthRecord {
+    pub remittance_line_id: String,
+    pub unambiguous: bool,
+    #[serde(default)]
+    pub links: Vec<ExpectedLink>,
+}
diff --git a/developer-simulation/runs/2026-08-08--remittance-reconciliation/src/verify.rs b/developer-simulation/runs/2026-08-08--remittance-reconciliation/src/verify.rs
new file mode 100644
index 0000000..45590cd
--- /dev/null
+++ b/developer-simulation/runs/2026-08-08--remittance-reconciliation/src/verify.rs
@@ -0,0 +1,595 @@
+use std::collections::{BTreeMap, BTreeSet, HashMap, HashSet};
+use std::error::Error;
+use std::fs::{self, File};
+use std::io::{BufRead, BufReader};
+use std::path::Path;
+
+use serde::{Deserialize, Serialize};
+use serde_json::Value;
+
+use crate::model::{
+    AcceptedLink, ClaimKey, ClaimLine, ExpectedLink, GroundTruthRecord, RemittanceLine,
+    ReviewRecord, Summary, TransactionKind,
+};
+
+type AnyError = Box<dyn Error + Send + Sync>;
+
+struct RemittanceInput {
+    records: HashMap<String, RemittanceLine>,
+    physical_counts: BTreeMap<String, usize>,
+    patient_keys: HashSet<String>,
+    total: usize,
+    invalid: usize,
+}
+
+struct ClaimInput {
+    records: Vec<ClaimLine>,
+    duplicate_keys: HashSet<ClaimKey>,
+    patient_keys: HashSet<String>,
+    total: usize,
+    invalid: usize,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct VerificationReport {
+    pub passed: bool,
+    pub precision: f64,
+    pub recall: f64,
+    pub correct_links: usize,
+    pub accepted_links: usize,
+    pub expected_unambiguous_links: usize,
+    pub invariant_failures: usize,
+    pub failures: Vec<String>,
+}
+
+pub fn verify_results(
+    claims_path: &Path,
+    remits_path: &Path,
+    ground_truth_path: &Path,
+    results_dir: &Path,
+) -> Result<VerificationReport, AnyError> {
+    let claim_input = read_valid_claims(claims_path)?;
+    let current_claims = current_claim_map(&claim_input.records);
+    let remit_input = read_remittances(remits_path)?;
+    let accepted = read_jsonl::<AcceptedLink>(&results_dir.join("accepted.jsonl"))?;
+    let reviews = read_jsonl::<ReviewRecord>(&results_dir.join("review.jsonl"))?;
+    let truth = read_jsonl::<GroundTruthRecord>(ground_truth_path)?;
+    let summary: Summary = serde_json::from_reader(File::open(results_dir.join("summary.json"))?)?;
+    let serialized_output_strings = read_output_strings(results_dir)?;
+
+    let mut failures = Vec::new();
+    verify_canonical_order(&accepted, &reviews, &mut failures);
+    verify_decision_partition(
+        &accepted,
+        &reviews,
+        &remit_input.physical_counts,
+        &mut failures,
+    );
+    verify_reason_codes(&reviews, &mut failures);
+    verify_explanations(&accepted, &mut failures);
+    verify_value_rules(
+        &accepted,
+        &remit_input.records,
+        &current_claims,
+        &claim_input.duplicate_keys,
+        &mut failures,
+    );
+    verify_privacy(
+        &claim_input.patient_keys,
+        &remit_input.patient_keys,
+        &serialized_output_strings,
+        &mut failures,
+    );
+    verify_summary(
+        &summary,
+        claim_input.total,
+        current_claims.len(),
+        claim_input.invalid,
+        remit_input.total,
+        remit_input.invalid,
+        &accepted,
+        &reviews,
+        &mut failures,
+    );
+
+    let actual = accepted
+        .iter()
+        .map(|link| ExpectedLink {
+            remittance_line_id: link.remittance_line_id.clone(),
+            claim_line_id: link.claim_line_id.clone(),
+            claim_revision: link.claim_revision,
+            applied_cents: link.applied_cents,
+        })
+        .collect::<BTreeSet<_>>();
+    let expected = truth
+        .iter()
+        .filter(|record| record.unambiguous)
+        .flat_map(|record| record.links.iter().cloned())
+        .collect::<BTreeSet<_>>();
+    let correct_links = actual.intersection(&expected).count();
+    let precision = ratio(correct_links, actual.len());
+    let recall = ratio(correct_links, expected.len());
+    if precision < 0.9995 {
+        failures.push(format!(
+            "precision {precision:.6} is below the required 0.999500"
+        ));
+    }
+    if recall < 0.97 {
+        failures.push(format!("recall {recall:.6} is below the required 0.970000"));
+    }
+    let invariant_failures = failures
+        .iter()
+        .filter(|failure| !failure.starts_with("precision ") && !failure.starts_with("recall "))
+        .count();
+    Ok(VerificationReport {
+        passed: failures.is_empty(),
+        precision,
+        recall,
+        correct_links,
+        accepted_links: actual.len(),
+        expected_unambiguous_links: expected.len(),
+        invariant_failures,
+        failures,
+    })
+}
+
+fn read_valid_claims(path: &Path) -> Result<ClaimInput, AnyError> {
+    let mut records = Vec::new();
+    let mut total = 0;
+    let mut invalid = 0;
+    for line in BufReader::new(File::open(path)?).lines() {
+        total += 1;
+        match serde_json::from_str::<ClaimLine>(&line?) {
+            Ok(record) if record.validate().is_ok() => records.push(record),
+            _ => invalid += 1,
+        }
+    }
+    let patient_keys = records
+        .iter()
+        .map(|record| record.patient_key.clone())
+        .collect();
+    let mut counts = HashMap::new();
+    for record in &records {
+        *counts.entry(record.key()).or_insert(0_usize) += 1;
+    }
+    let duplicate_keys = counts
+        .iter()
+        .filter(|(_, count)| **count > 1)
+        .map(|(key, _)| key.clone())
+        .collect::<HashSet<_>>();
+    let duplicate_rows = records
+        .iter()
+        .filter(|record| duplicate_keys.contains(&record.key()))
+        .count();
+    invalid += duplicate_rows;
+    records.retain(|record| !duplicate_keys.contains(&record.key()));
+    Ok(ClaimInput {
+        records,
+        duplicate_keys,
+        patient_keys,
+        total,
+        invalid,
+    })
+}
+
+fn read_remittances(path: &Path) -> Result<RemittanceInput, AnyError> {
+    struct Row {
+        id: String,
+        record: Option<RemittanceLine>,
+    }
+
+    let mut rows = Vec::new();
+    let mut patient_keys = HashSet::new();
+    let mut total = 0;
+    let mut invalid = 0;
+    for line in BufReader::new(File::open(path)?).lines() {
+        total += 1;
+        let line = line?;
+        let value = serde_json::from_str::<Value>(&line).ok();
+        if let Some(patient_key) = value
+            .as_ref()
+            .and_then(|item| item.get("patient_key"))
+            .and_then(Value::as_str)
+        {
+            patient_keys.insert(patient_key.to_string());
+        }
+        let id = value
+            .as_ref()
+            .and_then(|item| item.get("remittance_line_id"))
+            .and_then(Value::as_str)
+            .map(str::to_owned)
+            .unwrap_or_else(|| "quarantine-remittance-missing-id".to_string());
+        let record = serde_json::from_str::<RemittanceLine>(&line)
+            .ok()
+            .filter(|record| record.validate().is_ok());
+        rows.push(Row { id, record });
+    }
+    let mut physical_counts = BTreeMap::new();
+    for row in &rows {
+        *physical_counts.entry(row.id.clone()).or_insert(0_usize) += 1;
+    }
+    let mut records = HashMap::new();
+    for row in rows {
+        let count = physical_counts.get(&row.id).copied().unwrap_or_default();
+        if count > 1 {
+            invalid += 1;
+        } else if let Some(record) = row.record {
+            records.insert(row.id, record);
+        } else {
+            invalid += 1;
+        }
+    }
+    Ok(RemittanceInput {
+        records,
+        physical_counts,
+        patient_keys,
+        total,
+        invalid,
+    })
+}
+
+fn current_claim_map(records: &[ClaimLine]) -> BTreeMap<ClaimKey, ClaimLine> {
+    let mut max_revisions = HashMap::new();
+    for claim in records {
+        max_revisions
+            .entry(claim.claim_line_id.as_str())
+            .and_modify(|revision: &mut u32| *revision = (*revision).max(claim.revision))
+            .or_insert(claim.revision);
+    }
+    records
+        .iter()
+        .filter(|claim| max_revisions.get(claim.claim_line_id.as_str()) == Some(&claim.revision))
+        .cloned()
+        .map(|claim| (claim.key(), claim))
+        .collect()
+}
+
+fn verify_canonical_order(
+    accepted: &[AcceptedLink],
+    reviews: &[ReviewRecord],
+    failures: &mut Vec<String>,
+) {
+    let accepted_keys = accepted
+        .iter()
+        .map(|link| {
+            (
+                &link.remittance_line_id,
+                &link.claim_line_id,
+                link.claim_revision,
+                link.applied_cents,
+            )
+        })
+        .collect::<Vec<_>>();
+    if !accepted_keys.windows(2).all(|pair| pair[0] <= pair[1]) {
+        failures.push("accepted.jsonl is not in canonical order".to_string());
+    }
+    let review_keys = reviews
+        .iter()
+        .map(|record| (&record.remittance_line_id, record.physical_record_ordinal))
+        .collect::<Vec<_>>();
+    if !review_keys.windows(2).all(|pair| pair[0] <= pair[1]) {
+        failures.push("review.jsonl is not in canonical order".to_string());
+    }
+}
+
+fn verify_decision_partition(
+    accepted: &[AcceptedLink],
+    reviews: &[ReviewRecord],
+    physical_counts: &BTreeMap<String, usize>,
+    failures: &mut Vec<String>,
+) {
+    let accepted_ids = accepted
+        .iter()
+        .map(|link| link.remittance_line_id.as_str())
+        .collect::<HashSet<_>>();
+    let mut review_ordinals: HashMap<&str, BTreeSet<usize>> = HashMap::new();
+    for review in reviews {
+        let inserted = review_ordinals
+            .entry(review.remittance_line_id.as_str())
+            .or_default()
+            .insert(review.physical_record_ordinal);
+        if !inserted {
+            failures.push(format!(
+                "review {} repeats physical ordinal {}",
+                review.remittance_line_id, review.physical_record_ordinal
+            ));
+        }
+    }
+    for (id, physical_count) in physical_counts {
+        let accepted_count = usize::from(accepted_ids.contains(id.as_str()));
+        let ordinals = review_ordinals
+            .get(id.as_str())
+            .cloned()
+            .unwrap_or_default();
+        if *physical_count > 1 {
+            let expected = (1..=*physical_count).collect::<BTreeSet<_>>();
+            let reasons_valid = reviews
+                .iter()
+                .filter(|review| review.remittance_line_id == *id)
+                .all(|review| {
+                    review
+                        .reason_codes
+                        .iter()
+                        .any(|reason| reason == "duplicate_remittance_id")
+                });
+            if accepted_count != 0 || ordinals != expected || !reasons_valid {
+                failures.push(format!(
+                    "duplicate remittance {id} was not quarantined as {physical_count} physical rows"
+                ));
+            }
+        } else if accepted_count + ordinals.len() != 1
+            || ordinals.iter().any(|ordinal| *ordinal != 1)
+        {
+            failures.push(format!(
+                "remittance {id} has {} decisions instead of exactly one",
+                accepted_count + ordinals.len()
+            ));
+        }
+    }
+    for id in accepted_ids.iter().chain(review_ordinals.keys()).copied() {
+        if !physical_counts.contains_key(id) {
+            failures.push(format!("output contains unknown remittance {id}"));
+        }
+    }
+    let duplicate_links = accepted
+        .iter()
+        .map(|link| {
+            (
+                &link.remittance_line_id,
+                &link.claim_line_id,
+                link.claim_revision,
+                link.applied_cents,
+            )
+        })
+        .collect::<Vec<_>>();
+    if duplicate_links.iter().collect::<HashSet<_>>().len() != duplicate_links.len() {
+        failures.push("accepted output contains a duplicated application".to_string());
+    }
+}
+
+fn verify_reason_codes(reviews: &[ReviewRecord], failures: &mut Vec<String>) {
+    let allowed = HashSet::from([
+        "missing_identity",
+        "conflicting_strong_candidates",
+        "amount_inconsistent",
+        "unsupported_bundle",
+        "no_plausible_candidate",
+        "malformed_record",
+        "unsupported_date_range",
+        "conflicting_identity_sources",
+        "duplicate_remittance_id",
+        "duplicate_claim_key",
+        "unsupported_partial_split",
+        "unsupported_standalone_reversal",
+        "search_budget_exhausted",
+    ]);
+    for review in reviews {
+        if review.reason_codes.is_empty()
+            || review
+                .reason_codes
+                .iter()
+                .any(|reason| !allowed.contains(reason.as_str()))
+        {
+            failures.push(format!(
+                "review {} has missing or unstable reason codes",
+                review.remittance_line_id
+            ));
+        }
+    }
+}
+
+fn verify_explanations(accepted: &[AcceptedLink], failures: &mut Vec<String>) {
+    for link in accepted {
+        if link.facts.is_empty()
+            || link
+                .rejected_competitors
+                .iter()
+                .any(|competitor| competitor.reason_codes.is_empty())
+        {
+            failures.push(format!(
+                "accepted link {} -> {} lacks a machine-checkable explanation",
+                link.remittance_line_id, link.claim_line_id
+            ));
+        }
+    }
+}
+
+fn verify_value_rules(
+    accepted: &[AcceptedLink],
+    remits: &HashMap<String, RemittanceLine>,
+    current_claims: &BTreeMap<ClaimKey, ClaimLine>,
+    duplicate_claim_keys: &HashSet<ClaimKey>,
+    failures: &mut Vec<String>,
+) {
+    let mut by_remit: HashMap<&str, Vec<&AcceptedLink>> = HashMap::new();
+    let mut claim_positive: BTreeMap<ClaimKey, i64> = BTreeMap::new();
+    let mut claim_negative: BTreeMap<ClaimKey, i64> = BTreeMap::new();
+    for link in accepted {
+        by_remit
+            .entry(link.remittance_line_id.as_str())
+            .or_default()
+            .push(link);
+        let key = ClaimKey {
+            claim_line_id: link.claim_line_id.clone(),
+            revision: link.claim_revision,
+        };
+        if duplicate_claim_keys.contains(&key) {
+            failures.push(format!(
+                "accepted link {} reuses a duplicated logical claim key",
+                link.remittance_line_id
+            ));
+        }
+        if !current_claims.contains_key(&key) {
+            failures.push(format!(
+                "accepted link {} targets a missing or non-current claim revision",
+                link.remittance_line_id
+            ));
+        }
+        if link.applied_cents > 0 {
+            *claim_positive.entry(key).or_default() += link.applied_cents;
+        } else {
+            *claim_negative.entry(key).or_default() += link.applied_cents.unsigned_abs() as i64;
+        }
+    }
+
+    for (id, links) in by_remit {
+        let Some(remit) = remits.get(id) else {
+            failures.push(format!("accepted unknown or malformed remittance {id}"));
+            continue;
+        };
+        let total = links.iter().map(|link| link.applied_cents).sum::<i64>();
+        if total != remit.signed_amount() {
+            failures.push(format!("remittance {id} does not conserve cents"));
+        }
+        let sign_valid = match remit.transaction_kind {
+            TransactionKind::Payment | TransactionKind::Denial => {
+                links.iter().all(|link| link.applied_cents > 0)
+            }
+            TransactionKind::Reversal => links.iter().all(|link| link.applied_cents < 0),
+        };
+        if !sign_valid {
+            failures.push(format!("remittance {id} has an allocation sign error"));
+        }
+        let claim_ids = links
+            .iter()
+            .filter_map(|link| {
+                current_claims
+                    .get(&ClaimKey {
+                        claim_line_id: link.claim_line_id.clone(),
+                        revision: link.claim_revision,
+                    })
+                    .map(|claim| claim.claim_id.as_str())
+            })
+            .collect::<HashSet<_>>();
+        if links.len() > 1 && claim_ids.len() != 1 {
+            failures.push(format!(
+                "remittance {id} uses an unsupported cross-claim split"
+            ));
+        }
+    }
+
+    for (key, claim) in current_claims {
+        let positive = claim_positive.get(key).copied().unwrap_or_default();
+        let negative = claim_negative.get(key).copied().unwrap_or_default();
+        if positive > claim.open_balance_cents
+            || negative > claim.open_balance_cents
+            || positive < negative
+        {
+            failures.push(format!(
+                "claim {} revision {} is over-applied or reversal-inconsistent",
+                key.claim_line_id, key.revision
+            ));
+        }
+    }
+}
+
+fn verify_privacy(
+    claim_patient_keys: &HashSet<String>,
+    remittance_patient_keys: &HashSet<String>,
+    serialized_output_strings: &HashSet<String>,
+    failures: &mut Vec<String>,
+) {
+    if claim_patient_keys
+        .iter()
+        .chain(remittance_patient_keys)
+        .any(|key| serialized_output_strings.contains(key))
+    {
+        failures.push("output contains a source patient key".to_string());
+    }
+}
+
+fn read_output_strings(results_dir: &Path) -> Result<HashSet<String>, AnyError> {
+    let mut strings = HashSet::new();
+    for filename in ["accepted.jsonl", "review.jsonl", "summary.json"] {
+        let contents = fs::read_to_string(results_dir.join(filename))?;
+        if filename.ends_with(".jsonl") {
+            for line in contents.lines() {
+                collect_json_strings(&serde_json::from_str::<Value>(line)?, &mut strings);
+            }
+        } else {
+            collect_json_strings(&serde_json::from_str::<Value>(&contents)?, &mut strings);
+        }
+    }
+    Ok(strings)
+}
+
+fn collect_json_strings(value: &Value, strings: &mut HashSet<String>) {
+    match value {
+        Value::String(string) => {
+            strings.insert(string.clone());
+        }
+        Value::Array(items) => {
+            for item in items {
+                collect_json_strings(item, strings);
+            }
+        }
+        Value::Object(object) => {
+            for (key, item) in object {
+                strings.insert(key.clone());
+                collect_json_strings(item, strings);
+            }
+        }
+        Value::Null | Value::Bool(_) | Value::Number(_) => {}
+    }
+}
+
+#[allow(clippy::too_many_arguments)]
+fn verify_summary(
+    summary: &Summary,
+    claim_total: usize,
+    current_claim_count: usize,
+    invalid_claims: usize,
+    remit_total: usize,
+    invalid_remits: usize,
+    accepted: &[AcceptedLink],
+    reviews: &[ReviewRecord],
+    failures: &mut Vec<String>,
+) {
+    let accepted_remittances = accepted
+        .iter()
+        .map(|link| link.remittance_line_id.as_str())
+        .collect::<HashSet<_>>()
+        .len();
+    let expected = Summary {
+        input_claim_records: claim_total,
+        valid_current_claim_lines: current_claim_count,
+        invalid_claim_records: invalid_claims,
+        input_remittance_records: remit_total,
+        accepted_remittance_lines: accepted_remittances,
+        accepted_links: accepted.len(),
+        review_remittance_lines: reviews.len(),
+        invalid_remittance_records: invalid_remits,
+    };
+    if summary != &expected {
+        failures.push("summary.json does not match the canonical outputs".to_string());
+    }
+}
+
+fn read_jsonl<T>(path: &Path) -> Result<Vec<T>, AnyError>
+where
+    T: for<'de> Deserialize<'de>,
+{
+    BufReader::new(File::open(path)?)
+        .lines()
+        .filter(|line| line.as_ref().map_or(true, |value| !value.is_empty()))
+        .map(|line| Ok(serde_json::from_str(&line?)?))
+        .collect()
+}
+
+fn ratio(numerator: usize, denominator: usize) -> f64 {
+    if denominator == 0 {
+        1.0
+    } else {
+        numerator as f64 / denominator as f64
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn ratio_handles_empty_denominator() {
+        assert_eq!(ratio(0, 0), 1.0);
+    }
+}
diff --git a/developer-simulation/runs/2026-08-08--remittance-reconciliation/tests/adversarial.rs b/developer-simulation/runs/2026-08-08--remittance-reconciliation/tests/adversarial.rs
new file mode 100644
index 0000000..9972766
--- /dev/null
+++ b/developer-simulation/runs/2026-08-08--remittance-reconciliation/tests/adversarial.rs
@@ -0,0 +1,799 @@
+use std::fs::{self, File};
+use std::io::{BufWriter, Write};
+use std::path::{Path, PathBuf};
+use std::sync::atomic::{AtomicUsize, Ordering};
+
+use remittance_reconciliation::engine::{greedy_baseline, reconcile};
+use remittance_reconciliation::model::{
+    AcceptedLink, ClaimLine, ExpectedLink, GroundTruthRecord, RemittanceLine, ReviewRecord,
+    Summary, TransactionKind,
+};
+use remittance_reconciliation::verify::{VerificationReport, verify_results};
+use serde::Serialize;
+
+static CASE_NUMBER: AtomicUsize = AtomicUsize::new(1);
+
+struct Outcome {
+    accepted: Vec<AcceptedLink>,
+    reviews: Vec<ReviewRecord>,
+    summary: Summary,
+    accepted_bytes: Vec<u8>,
+    review_bytes: Vec<u8>,
+    summary_bytes: Vec<u8>,
+    verification: VerificationReport,
+}
+
+fn claim(id: &str, claim_id: &str, reference: &str, patient: &str) -> ClaimLine {
+    ClaimLine {
+        claim_line_id: id.to_string(),
+        claim_id: claim_id.to_string(),
+        revision: 1,
+        payer: "payer".to_string(),
+        provider: "provider".to_string(),
+        patient_key: patient.to_string(),
+        service_date: 20_000,
+        procedure_code: "PROC".to_string(),
+        billed_cents: 100,
+        open_balance_cents: 100,
+        insurer_references: vec![reference.to_string()],
+    }
+}
+
+fn payment(id: &str, reference: Option<&str>, patient: &str, amount: i64) -> RemittanceLine {
+    RemittanceLine {
+        remittance_line_id: id.to_string(),
+        payer: "payer".to_string(),
+        provider: "provider".to_string(),
+        insurer_reference: reference.map(str::to_string),
+        patient_key: Some(patient.to_string()),
+        service_date_start: Some(20_000),
+        service_date_end: Some(20_000),
+        procedure_code: Some("PROC".to_string()),
+        paid_cents: amount,
+        adjustment_cents: 0,
+        adjustment_codes: Vec::new(),
+        transaction_kind: TransactionKind::Payment,
+    }
+}
+
+fn expected(remit_id: &str, claim_id: &str, amount: i64) -> GroundTruthRecord {
+    GroundTruthRecord {
+        remittance_line_id: remit_id.to_string(),
+        unambiguous: true,
+        links: vec![ExpectedLink {
+            remittance_line_id: remit_id.to_string(),
+            claim_line_id: claim_id.to_string(),
+            claim_revision: 1,
+            applied_cents: amount,
+        }],
+    }
+}
+
+fn reviewed_truth(remit_id: &str) -> GroundTruthRecord {
+    GroundTruthRecord {
+        remittance_line_id: remit_id.to_string(),
+        unambiguous: false,
+        links: Vec::new(),
+    }
+}
+
+fn temp_case(label: &str) -> PathBuf {
+    let number = CASE_NUMBER.fetch_add(1, Ordering::Relaxed);
+    let path = std::env::temp_dir().join(format!(
+        "remittance-adversarial-{label}-{}-{number}",
+        std::process::id()
+    ));
+    fs::create_dir_all(&path).expect("create test directory");
+    path
+}
+
+fn write_jsonl<T: Serialize>(path: &Path, records: &[T]) {
+    let mut writer = BufWriter::new(File::create(path).expect("create JSONL"));
+    for record in records {
+        serde_json::to_writer(&mut writer, record).expect("serialize JSONL record");
+        writer.write_all(b"\n").expect("write newline");
+    }
+    writer.flush().expect("flush JSONL");
+}
+
+fn read_jsonl<T: for<'de> serde::Deserialize<'de>>(path: &Path) -> Vec<T> {
+    fs::read_to_string(path)
+        .expect("read JSONL")
+        .lines()
+        .map(|line| serde_json::from_str(line).expect("parse JSONL"))
+        .collect()
+}
+
+fn run_solver(
+    label: &str,
+    claims: &[ClaimLine],
+    remittances: &[RemittanceLine],
+    truth: &[GroundTruthRecord],
+) -> Outcome {
+    let directory = temp_case(label);
+    let claims_path = directory.join("claims.jsonl");
+    let remittances_path = directory.join("remittances.jsonl");
+    let truth_path = directory.join("ground-truth.jsonl");
+    let results = directory.join("results");
+    write_jsonl(&claims_path, claims);
+    write_jsonl(&remittances_path, remittances);
+    write_jsonl(&truth_path, truth);
+    reconcile(&claims_path, &remittances_path, &results).expect("reconcile case");
+    let verification = verify_results(&claims_path, &remittances_path, &truth_path, &results)
+        .expect("verify case");
+    let outcome = Outcome {
+        accepted: read_jsonl(&results.join("accepted.jsonl")),
+        reviews: read_jsonl(&results.join("review.jsonl")),
+        summary: serde_json::from_reader(
+            File::open(results.join("summary.json")).expect("open summary"),
+        )
+        .expect("parse summary"),
+        accepted_bytes: fs::read(results.join("accepted.jsonl")).expect("read accepted bytes"),
+        review_bytes: fs::read(results.join("review.jsonl")).expect("read review bytes"),
+        summary_bytes: fs::read(results.join("summary.json")).expect("read summary bytes"),
+        verification,
+    };
+    fs::remove_dir_all(directory).expect("clean test directory");
+    outcome
+}
+
+fn baseline_target(claims: &[ClaimLine], remittance: &RemittanceLine) -> Option<String> {
+    let directory = temp_case("baseline");
+    let claims_path = directory.join("claims.jsonl");
+    let remittances_path = directory.join("remittances.jsonl");
+    let results = directory.join("results");
+    write_jsonl(&claims_path, claims);
+    write_jsonl(&remittances_path, std::slice::from_ref(remittance));
+    greedy_baseline(&claims_path, &remittances_path, &results).expect("run baseline");
+    let accepted = read_jsonl::<AcceptedLink>(&results.join("accepted.jsonl"));
+    fs::remove_dir_all(directory).expect("clean test directory");
+    accepted.first().map(|link| link.claim_line_id.clone())
+}
+
+fn run_manual_verifier(
+    label: &str,
+    claims: &[ClaimLine],
+    remittances: &[RemittanceLine],
+    truth: &[GroundTruthRecord],
+    accepted: &[AcceptedLink],
+    reviews: &[ReviewRecord],
+    summary: &Summary,
+) -> VerificationReport {
+    let directory = temp_case(label);
+    let claims_path = directory.join("claims.jsonl");
+    let remittances_path = directory.join("remittances.jsonl");
+    let truth_path = directory.join("ground-truth.jsonl");
+    let results = directory.join("results");
+    fs::create_dir_all(&results).expect("create results directory");
+    write_jsonl(&claims_path, claims);
+    write_jsonl(&remittances_path, remittances);
+    write_jsonl(&truth_path, truth);
+    write_jsonl(&results.join("accepted.jsonl"), accepted);
+    write_jsonl(&results.join("review.jsonl"), reviews);
+    let mut summary_writer =
+        BufWriter::new(File::create(results.join("summary.json")).expect("create summary"));
+    serde_json::to_writer_pretty(&mut summary_writer, summary).expect("serialize summary");
+    summary_writer
+        .write_all(b"\n")
+        .expect("write summary newline");
+    summary_writer.flush().expect("flush summary");
+    let report = verify_results(&claims_path, &remittances_path, &truth_path, &results)
+        .expect("run manual verifier");
+    fs::remove_dir_all(directory).expect("clean test directory");
+    report
+}
+
+fn accepted_link(remit_id: &str, claim_id: &str) -> AcceptedLink {
+    AcceptedLink {
+        remittance_line_id: remit_id.to_string(),
+        claim_line_id: claim_id.to_string(),
+        claim_revision: 1,
+        applied_cents: 100,
+        score: 100,
+        facts: vec!["insurer_reference".to_string()],
+        rejected_competitors: Vec::new(),
+    }
+}
+
+fn assert_same_outputs(left: &Outcome, right: &Outcome) {
+    assert_eq!(left.accepted_bytes, right.accepted_bytes);
+    assert_eq!(left.review_bytes, right.review_bytes);
+    assert_eq!(left.summary_bytes, right.summary_bytes);
+}
+
+#[test]
+fn conflicting_identity_sources_review_in_all_orders_while_agreement_accepts() {
+    let reference_claim = claim("C-REF", "CLAIM-REF", "REF-CONFLICT", "patient-ref");
+    let identity_claim = claim(
+        "C-IDENTITY",
+        "CLAIM-IDENTITY",
+        "REF-OTHER",
+        "patient-identity",
+    );
+    let agreement_claim = claim("C-AGREE", "CLAIM-AGREE", "REF-AGREE", "patient-agree");
+    let conflict = payment("R-CONFLICT", Some("REF-CONFLICT"), "patient-identity", 100);
+    let agreement = payment("R-AGREE", Some("REF-AGREE"), "patient-agree", 100);
+    let truth = vec![
+        reviewed_truth("R-CONFLICT"),
+        expected("R-AGREE", "C-AGREE", 100),
+    ];
+
+    let ordered = run_solver(
+        "conflict-ordered",
+        &[
+            reference_claim.clone(),
+            identity_claim.clone(),
+            agreement_claim.clone(),
+        ],
+        &[conflict.clone(), agreement.clone()],
+        &truth,
+    );
+    let shuffled = run_solver(
+        "conflict-shuffled",
+        &[
+            agreement_claim,
+            identity_claim.clone(),
+            reference_claim.clone(),
+        ],
+        &[agreement, conflict],
+        &truth,
+    );
+    let reshuffled = run_solver(
+        "conflict-reshuffled",
+        &[
+            identity_claim,
+            reference_claim,
+            claim("C-AGREE", "CLAIM-AGREE", "REF-AGREE", "patient-agree"),
+        ],
+        &[
+            payment("R-CONFLICT", Some("REF-CONFLICT"), "patient-identity", 100),
+            payment("R-AGREE", Some("REF-AGREE"), "patient-agree", 100),
+        ],
+        &truth,
+    );
+
+    assert_same_outputs(&ordered, &shuffled);
+    assert_same_outputs(&ordered, &reshuffled);
+    assert!(
+        ordered.verification.passed,
+        "{:?}",
+        ordered.verification.failures
+    );
+    assert_eq!(ordered.accepted.len(), 1);
+    assert_eq!(ordered.accepted[0].remittance_line_id, "R-AGREE");
+    assert_eq!(ordered.reviews.len(), 1);
+    assert_eq!(
+        ordered.reviews[0].reason_codes,
+        ["conflicting_identity_sources"]
+    );
+}
+
+#[test]
+fn overlapping_identity_sources_require_a_feasible_shared_candidate_in_all_orders() {
+    let mut reference_only = claim("C-A", "CLAIM-A", "REF-X", "patient-a");
+    reference_only.service_date = 19_900;
+    reference_only.procedure_code = "PROC-A".to_string();
+    let mut common_underfunded = claim("C-B", "CLAIM-B", "REF-X", "patient-shared");
+    common_underfunded.billed_cents = 50;
+    common_underfunded.open_balance_cents = 50;
+    let fallback_only = claim("C-C", "CLAIM-C", "REF-Y", "patient-shared");
+    let unrelated_claim = claim("C-OK", "CLAIM-OK", "REF-OK", "patient-ok");
+    let overlap = payment("R-OVERLAP", Some("REF-X"), "patient-shared", 100);
+    let unrelated = payment("R-OK", Some("REF-OK"), "patient-ok", 100);
+    let truth = vec![reviewed_truth("R-OVERLAP"), expected("R-OK", "C-OK", 100)];
+
+    let ordered = run_solver(
+        "overlap-ordered",
+        &[
+            reference_only.clone(),
+            common_underfunded.clone(),
+            fallback_only.clone(),
+            unrelated_claim.clone(),
+        ],
+        &[overlap.clone(), unrelated.clone()],
+        &truth,
+    );
+    let reversed = run_solver(
+        "overlap-reversed",
+        &[
+            unrelated_claim.clone(),
+            fallback_only.clone(),
+            common_underfunded.clone(),
+            reference_only.clone(),
+        ],
+        &[unrelated.clone(), overlap.clone()],
+        &truth,
+    );
+    let shuffled = run_solver(
+        "overlap-shuffled",
+        &[
+            fallback_only,
+            reference_only,
+            unrelated_claim,
+            common_underfunded,
+        ],
+        &[overlap, unrelated],
+        &truth,
+    );
+
+    assert_same_outputs(&ordered, &reversed);
+    assert_same_outputs(&ordered, &shuffled);
+    assert!(
+        ordered.verification.passed,
+        "{:?}",
+        ordered.verification.failures
+    );
+    assert_eq!(ordered.accepted.len(), 1);
+    assert_eq!(ordered.accepted[0].remittance_line_id, "R-OK");
+    assert_eq!(ordered.reviews.len(), 1);
+    assert_eq!(ordered.reviews[0].remittance_line_id, "R-OVERLAP");
+    assert_eq!(
+        ordered.reviews[0].reason_codes,
+        ["conflicting_identity_sources"]
+    );
+    assert_eq!(ordered.reviews[0].candidate_count, 1);
+}
+
+#[test]
+fn overlapping_identity_sources_accept_only_the_feasible_shared_candidate() {
+    let mut reference_only = claim("C-A", "CLAIM-A", "REF-X", "patient-a");
+    reference_only.service_date = 19_900;
+    reference_only.procedure_code = "PROC-A".to_string();
+    let common = claim("C-B", "CLAIM-B", "REF-X", "patient-shared");
+    let fallback_only = claim("C-C", "CLAIM-C", "REF-Y", "patient-shared");
+    let outcome = run_solver(
+        "overlap-common-feasible",
+        &[reference_only, common, fallback_only],
+        &[payment("R-OVERLAP", Some("REF-X"), "patient-shared", 100)],
+        &[expected("R-OVERLAP", "C-B", 100)],
+    );
+
+    assert!(
+        outcome.verification.passed,
+        "{:?}",
+        outcome.verification.failures
+    );
+    assert!(outcome.reviews.is_empty());
+    assert_eq!(outcome.accepted.len(), 1);
+    assert_eq!(outcome.accepted[0].claim_line_id, "C-B");
+}
+
+#[test]
+fn a_single_nonempty_identity_source_remains_eligible() {
+    let reference_only = claim("C-REF", "CLAIM-REF", "REF-X", "patient-ref");
+    let fallback_only = claim(
+        "C-FALLBACK",
+        "CLAIM-FALLBACK",
+        "REF-FALLBACK",
+        "patient-fallback",
+    );
+    let exact_remit = payment("R-REF", Some("REF-X"), "no-fallback-match", 100);
+    let fallback_remit = payment("R-FALLBACK", Some("REF-NOT-FOUND"), "patient-fallback", 100);
+    let outcome = run_solver(
+        "single-source-controls",
+        &[reference_only, fallback_only],
+        &[fallback_remit, exact_remit],
+        &[
+            expected("R-REF", "C-REF", 100),
+            expected("R-FALLBACK", "C-FALLBACK", 100),
+        ],
+    );
+
+    assert!(
+        outcome.verification.passed,
+        "{:?}",
+        outcome.verification.failures
+    );
+    assert!(outcome.reviews.is_empty());
+    assert_eq!(outcome.accepted.len(), 2);
+}
+
+#[test]
+fn overlapping_sources_cannot_reintroduce_reference_only_split_candidates() {
+    let mut reference_only_a = claim("C-A1", "CLAIM-A", "REF-X", "patient-a1");
+    reference_only_a.service_date = 19_900;
+    reference_only_a.procedure_code = "PROC-A".to_string();
+    reference_only_a.billed_cents = 50;
+    reference_only_a.open_balance_cents = 50;
+    let mut reference_only_b = claim("C-A2", "CLAIM-A", "REF-X", "patient-a2");
+    reference_only_b.service_date = 19_901;
+    reference_only_b.procedure_code = "PROC-A".to_string();
+    reference_only_b.billed_cents = 50;
+    reference_only_b.open_balance_cents = 50;
+    let mut common_underfunded = claim("C-B", "CLAIM-B", "REF-X", "patient-shared");
+    common_underfunded.billed_cents = 50;
+    common_underfunded.open_balance_cents = 50;
+    let fallback_only = claim("C-C", "CLAIM-C", "REF-Y", "patient-shared");
+    let outcome = run_solver(
+        "overlap-split-safeguard",
+        &[
+            reference_only_a,
+            reference_only_b,
+            common_underfunded,
+            fallback_only,
+        ],
+        &[payment(
+            "R-OVERLAP-SPLIT",
+            Some("REF-X"),
+            "patient-shared",
+            100,
+        )],
+        &[reviewed_truth("R-OVERLAP-SPLIT")],
+    );
+
+    assert!(
+        outcome.verification.passed,
+        "{:?}",
+        outcome.verification.failures
+    );
+    assert!(outcome.accepted.is_empty());
+    assert_eq!(outcome.reviews.len(), 1);
+    assert_eq!(
+        outcome.reviews[0].reason_codes,
+        ["conflicting_identity_sources"]
+    );
+    assert_eq!(outcome.reviews[0].candidate_count, 1);
+}
+
+#[test]
+fn duplicate_remittance_rows_are_quarantined_in_all_orders() {
+    let first_claim = claim("C-DUP-A", "CLAIM-A", "REF-A", "patient-a");
+    let second_claim = claim("C-DUP-B", "CLAIM-B", "REF-B", "patient-b");
+    let okay_claim = claim("C-OK", "CLAIM-OK", "REF-OK", "patient-ok");
+    let duplicate_a = payment("R-DUP", Some("REF-A"), "patient-a", 100);
+    let duplicate_b = payment("R-DUP", Some("REF-B"), "patient-b", 100);
+    let okay = payment("R-OK", Some("REF-OK"), "patient-ok", 100);
+    let truth = vec![reviewed_truth("R-DUP"), expected("R-OK", "C-OK", 100)];
+
+    let adjacent = run_solver(
+        "remit-duplicate-adjacent",
+        &[
+            first_claim.clone(),
+            second_claim.clone(),
+            okay_claim.clone(),
+        ],
+        &[duplicate_a.clone(), duplicate_b.clone(), okay.clone()],
+        &truth,
+    );
+    let separated = run_solver(
+        "remit-duplicate-separated",
+        &[okay_claim, second_claim, first_claim],
+        &[duplicate_b, okay, duplicate_a],
+        &truth,
+    );
+
+    assert_same_outputs(&adjacent, &separated);
+    assert!(
+        adjacent.verification.passed,
+        "{:?}",
+        adjacent.verification.failures
+    );
+    assert_eq!(adjacent.accepted.len(), 1);
+    assert_eq!(adjacent.reviews.len(), 2);
+    assert_eq!(adjacent.summary.invalid_remittance_records, 2);
+    assert_eq!(
+        adjacent
+            .reviews
+            .iter()
+            .map(|review| review.physical_record_ordinal)
+            .collect::<Vec<_>>(),
+        [1, 2]
+    );
+    assert!(
+        adjacent
+            .reviews
+            .iter()
+            .all(|review| { review.reason_codes == ["duplicate_remittance_id"] })
+    );
+}
+
+#[test]
+fn verifier_rejects_an_accepted_duplicate_remittance_identity() {
+    let first_claim = claim("C-A", "CLAIM-A", "REF-A", "patient-a");
+    let second_claim = claim("C-B", "CLAIM-B", "REF-B", "patient-b");
+    let first = payment("R-DUP", Some("REF-A"), "patient-a", 100);
+    let second = payment("R-DUP", Some("REF-B"), "patient-b", 100);
+    let report = run_manual_verifier(
+        "verify-duplicate-remittance",
+        &[first_claim, second_claim],
+        &[first, second],
+        &[reviewed_truth("R-DUP")],
+        &[accepted_link("R-DUP", "C-A")],
+        &[],
+        &Summary {
+            input_claim_records: 2,
+            valid_current_claim_lines: 2,
+            invalid_claim_records: 0,
+            input_remittance_records: 2,
+            accepted_remittance_lines: 1,
+            accepted_links: 1,
+            review_remittance_lines: 0,
+            invalid_remittance_records: 2,
+        },
+    );
+    assert!(!report.passed);
+    assert!(
+        report
+            .failures
+            .iter()
+            .any(|failure| { failure.contains("duplicate remittance R-DUP was not quarantined") })
+    );
+}
+
+#[test]
+fn byte_identical_duplicate_remittances_are_not_idempotently_accepted() {
+    let duplicate_claim = claim("C-DUP", "CLAIM-DUP", "REF-DUP", "patient-dup");
+    let okay_claim = claim("C-OK", "CLAIM-OK", "REF-OK", "patient-ok");
+    let duplicate = payment("R-DUP", Some("REF-DUP"), "patient-dup", 100);
+    let okay = payment("R-OK", Some("REF-OK"), "patient-ok", 100);
+    let truth = vec![reviewed_truth("R-DUP"), expected("R-OK", "C-OK", 100)];
+    let adjacent = run_solver(
+        "identical-remittance-duplicate-adjacent",
+        &[duplicate_claim.clone(), okay_claim.clone()],
+        &[duplicate.clone(), duplicate.clone(), okay.clone()],
+        &truth,
+    );
+    let separated = run_solver(
+        "identical-remittance-duplicate-separated",
+        &[okay_claim, duplicate_claim],
+        &[duplicate.clone(), okay, duplicate],
+        &truth,
+    );
+
+    assert_same_outputs(&adjacent, &separated);
+    assert!(
+        adjacent.verification.passed,
+        "{:?}",
+        adjacent.verification.failures
+    );
+    assert_eq!(adjacent.reviews.len(), 2);
+    assert_eq!(adjacent.summary.invalid_remittance_records, 2);
+}
+
+#[test]
+fn duplicate_claim_keys_are_quarantined_in_all_orders() {
+    let duplicate_a = claim("C-DUP", "CLAIM-DUP", "REF-A", "patient-a");
+    let mut duplicate_b = claim("C-DUP", "CLAIM-DUP", "REF-B", "patient-b");
+    duplicate_b.procedure_code = "PROC-B".to_string();
+    let okay_claim = claim("C-OK", "CLAIM-OK", "REF-OK", "patient-ok");
+    let related_a = payment("R-DUP-A", Some("REF-A"), "patient-a", 100);
+    let mut related_b = payment("R-DUP-B", Some("REF-B"), "patient-b", 100);
+    related_b.procedure_code = Some("PROC-B".to_string());
+    let okay = payment("R-OK", Some("REF-OK"), "patient-ok", 100);
+    let truth = vec![
+        reviewed_truth("R-DUP-A"),
+        reviewed_truth("R-DUP-B"),
+        expected("R-OK", "C-OK", 100),
+    ];
+
+    let adjacent = run_solver(
+        "claim-duplicate-adjacent",
+        &[duplicate_a.clone(), duplicate_b.clone(), okay_claim.clone()],
+        &[related_a.clone(), related_b.clone(), okay.clone()],
+        &truth,
+    );
+    let separated = run_solver(
+        "claim-duplicate-separated",
+        &[duplicate_b, okay_claim, duplicate_a],
+        &[okay, related_b, related_a],
+        &truth,
+    );
+
+    assert_same_outputs(&adjacent, &separated);
+    assert!(
+        adjacent.verification.passed,
+        "{:?}",
+        adjacent.verification.failures
+    );
+    assert_eq!(adjacent.accepted.len(), 1);
+    assert_eq!(adjacent.reviews.len(), 2);
+    assert_eq!(adjacent.summary.invalid_claim_records, 2);
+    assert!(
+        adjacent
+            .reviews
+            .iter()
+            .all(|review| { review.reason_codes == ["duplicate_claim_key"] })
+    );
+}
+
+#[test]
+fn verifier_rejects_capacity_from_a_duplicate_claim_key() {
+    let first = claim("C-DUP", "CLAIM-DUP", "REF-A", "patient-a");
+    let second = claim("C-DUP", "CLAIM-DUP", "REF-B", "patient-b");
+    let remit = payment("R-DUP", Some("REF-A"), "patient-a", 100);
+    let report = run_manual_verifier(
+        "verify-duplicate-claim",
+        &[first, second],
+        std::slice::from_ref(&remit),
+        &[reviewed_truth("R-DUP")],
+        &[accepted_link("R-DUP", "C-DUP")],
+        &[],
+        &Summary {
+            input_claim_records: 2,
+            valid_current_claim_lines: 0,
+            invalid_claim_records: 2,
+            input_remittance_records: 1,
+            accepted_remittance_lines: 1,
+            accepted_links: 1,
+            review_remittance_lines: 0,
+            invalid_remittance_records: 0,
+        },
+    );
+    assert!(!report.passed);
+    assert!(
+        report
+            .failures
+            .iter()
+            .any(|failure| { failure.contains("reuses a duplicated logical claim key") })
+    );
+}
+
+#[test]
+fn byte_identical_duplicate_claim_keys_do_not_create_capacity() {
+    let duplicate = claim("C-DUP", "CLAIM-DUP", "REF-DUP", "patient-dup");
+    let okay_claim = claim("C-OK", "CLAIM-OK", "REF-OK", "patient-ok");
+    let related = payment("R-DUP", Some("REF-DUP"), "patient-dup", 100);
+    let okay = payment("R-OK", Some("REF-OK"), "patient-ok", 100);
+    let truth = vec![reviewed_truth("R-DUP"), expected("R-OK", "C-OK", 100)];
+    let adjacent = run_solver(
+        "identical-claim-duplicate-adjacent",
+        &[duplicate.clone(), duplicate.clone(), okay_claim.clone()],
+        &[related.clone(), okay.clone()],
+        &truth,
+    );
+    let separated = run_solver(
+        "identical-claim-duplicate-separated",
+        &[duplicate.clone(), okay_claim, duplicate],
+        &[okay, related],
+        &truth,
+    );
+
+    assert_same_outputs(&adjacent, &separated);
+    assert!(
+        adjacent.verification.passed,
+        "{:?}",
+        adjacent.verification.failures
+    );
+    assert_eq!(adjacent.accepted.len(), 1);
+    assert_eq!(adjacent.summary.invalid_claim_records, 2);
+}
+
+#[test]
+fn comparator_runs_exact_reference_before_fallback() {
+    let reference_claim = claim("C-REF", "CLAIM-REF", "REF-X", "patient-ref");
+    let fallback_claim = claim("C-FALLBACK", "CLAIM-FALLBACK", "REF-Y", "patient-fallback");
+    let remit = payment("R-X", Some("REF-X"), "patient-fallback", 100);
+    assert_eq!(
+        baseline_target(&[fallback_claim.clone(), reference_claim.clone()], &remit),
+        Some("C-REF".to_string())
+    );
+    assert_eq!(
+        baseline_target(&[reference_claim, fallback_claim], &remit),
+        Some("C-REF".to_string())
+    );
+}
+
+#[test]
+fn comparator_is_input_order_greedy_inside_duplicate_reference_stage() {
+    let first = claim("C-A", "CLAIM-A", "REF-X", "patient-a");
+    let second = claim("C-B", "CLAIM-B", "REF-X", "patient-b");
+    let remit = payment("R-X", Some("REF-X"), "patient-b", 100);
+    assert_eq!(
+        baseline_target(&[first.clone(), second.clone()], &remit),
+        Some("C-A".to_string())
+    );
+    assert_eq!(
+        baseline_target(&[second, first], &remit),
+        Some("C-B".to_string())
+    );
+}
+
+#[test]
+fn comparator_uses_fallback_when_reference_is_missing() {
+    let first = claim("C-A", "CLAIM-A", "REF-A", "patient-shared");
+    let second = claim("C-B", "CLAIM-B", "REF-B", "patient-shared");
+    let remit = payment("R-X", None, "patient-shared", 100);
+    assert_eq!(
+        baseline_target(&[first.clone(), second.clone()], &remit),
+        Some("C-A".to_string())
+    );
+    assert_eq!(
+        baseline_target(&[second, first], &remit),
+        Some("C-B".to_string())
+    );
+}
+
+#[test]
+fn comparator_uses_fallback_only_when_reference_stage_has_no_acceptable_capacity() {
+    let mut reference_claim = claim("C-REF", "CLAIM-REF", "REF-X", "patient-ref");
+    reference_claim.billed_cents = 50;
+    reference_claim.open_balance_cents = 50;
+    let fallback_claim = claim("C-FALLBACK", "CLAIM-FALLBACK", "REF-Y", "patient-fallback");
+    let remit = payment("R-X", Some("REF-X"), "patient-fallback", 100);
+    assert_eq!(
+        baseline_target(&[reference_claim, fallback_claim], &remit),
+        Some("C-FALLBACK".to_string())
+    );
+}
+
+#[test]
+fn unsupported_partial_split_and_standalone_reversal_have_accurate_reasons() {
+    let first = claim("C-SPLIT-A", "CLAIM-SPLIT", "REF-SPLIT", "patient-split");
+    let second = claim("C-SPLIT-B", "CLAIM-SPLIT", "REF-SPLIT", "patient-split");
+    let split = payment("R-SPLIT", Some("REF-SPLIT"), "patient-split", 150);
+    let mut reversal_claim = claim(
+        "C-REVERSAL",
+        "CLAIM-REVERSAL",
+        "REF-REVERSAL",
+        "patient-reversal",
+    );
+    reversal_claim.billed_cents = 500;
+    reversal_claim.open_balance_cents = 400;
+    let mut reversal = payment("R-REVERSAL", Some("REF-REVERSAL"), "patient-reversal", -100);
+    reversal.transaction_kind = TransactionKind::Reversal;
+    let truth = vec![reviewed_truth("R-SPLIT"), reviewed_truth("R-REVERSAL")];
+    let outcome = run_solver(
+        "narrow-settlement-scope",
+        &[first, second, reversal_claim],
+        &[split, reversal],
+        &truth,
+    );
+
+    assert!(
+        outcome.verification.passed,
+        "{:?}",
+        outcome.verification.failures
+    );
+    assert_eq!(outcome.accepted.len(), 0);
+    assert!(outcome.reviews.iter().any(|review| {
+        review.remittance_line_id == "R-SPLIT"
+            && review.reason_codes == ["unsupported_partial_split"]
+    }));
+    assert!(outcome.reviews.iter().any(|review| {
+        review.remittance_line_id == "R-REVERSAL"
+            && review.reason_codes == ["unsupported_standalone_reversal"]
+    }));
+}
+
+#[test]
+fn dense_end_to_end_cluster_exhausts_to_review() {
+    let claims = (0..12)
+        .map(|index| {
+            claim(
+                &format!("C-{index:02}"),
+                &format!("CLAIM-{index:02}"),
+                "REF-DENSE",
+                "patient-dense",
+            )
+        })
+        .collect::<Vec<_>>();
+    let remittances = (0..12)
+        .map(|index| {
+            payment(
+                &format!("R-{index:02}"),
+                Some("REF-DENSE"),
+                "patient-dense",
+                100,
+            )
+        })
+        .collect::<Vec<_>>();
+    let truth = remittances
+        .iter()
+        .map(|remit| reviewed_truth(&remit.remittance_line_id))
+        .collect::<Vec<_>>();
+    let outcome = run_solver("dense-budget", &claims, &remittances, &truth);
+
+    assert!(
+        outcome.verification.passed,
+        "{:?}",
+        outcome.verification.failures
+    );
+    assert!(outcome.accepted.is_empty());
+    assert_eq!(outcome.reviews.len(), 12);
+    assert!(
+        outcome
+            .reviews
+            .iter()
+            .all(|review| { review.reason_codes == ["search_budget_exhausted"] })
+    );
+}
diff --git a/developer-simulation/runs/2026-08-08--remittance-reconciliation/tests/fixtures/overlapping-identity/claims.jsonl b/developer-simulation/runs/2026-08-08--remittance-reconciliation/tests/fixtures/overlapping-identity/claims.jsonl
new file mode 100644
index 0000000..4565b97
--- /dev/null
+++ b/developer-simulation/runs/2026-08-08--remittance-reconciliation/tests/fixtures/overlapping-identity/claims.jsonl
@@ -0,0 +1,4 @@
+{"claim_line_id":"C-C","claim_id":"CLAIM-C","revision":1,"payer":"payer","provider":"provider","patient_key":"patient-shared","service_date":20000,"procedure_code":"PROC","billed_cents":100,"open_balance_cents":100,"insurer_references":["REF-Y"]}
+{"claim_line_id":"C-A","claim_id":"CLAIM-A","revision":1,"payer":"payer","provider":"provider","patient_key":"patient-a","service_date":19900,"procedure_code":"PROC-A","billed_cents":100,"open_balance_cents":100,"insurer_references":["REF-X"]}
+{"claim_line_id":"C-OK","claim_id":"CLAIM-OK","revision":1,"payer":"payer","provider":"provider","patient_key":"patient-ok","service_date":20000,"procedure_code":"PROC","billed_cents":100,"open_balance_cents":100,"insurer_references":["REF-OK"]}
+{"claim_line_id":"C-B","claim_id":"CLAIM-B","revision":1,"payer":"payer","provider":"provider","patient_key":"patient-shared","service_date":20000,"procedure_code":"PROC","billed_cents":50,"open_balance_cents":50,"insurer_references":["REF-X"]}
diff --git a/developer-simulation/runs/2026-08-08--remittance-reconciliation/tests/fixtures/overlapping-identity/ground-truth.jsonl b/developer-simulation/runs/2026-08-08--remittance-reconciliation/tests/fixtures/overlapping-identity/ground-truth.jsonl
new file mode 100644
index 0000000..ca912ba
--- /dev/null
+++ b/developer-simulation/runs/2026-08-08--remittance-reconciliation/tests/fixtures/overlapping-identity/ground-truth.jsonl
@@ -0,0 +1,2 @@
+{"remittance_line_id":"R-OVERLAP","unambiguous":false,"links":[]}
+{"remittance_line_id":"R-OK","unambiguous":true,"links":[{"remittance_line_id":"R-OK","claim_line_id":"C-OK","claim_revision":1,"applied_cents":100}]}
diff --git a/developer-simulation/runs/2026-08-08--remittance-reconciliation/tests/fixtures/overlapping-identity/remittances.jsonl b/developer-simulation/runs/2026-08-08--remittance-reconciliation/tests/fixtures/overlapping-identity/remittances.jsonl
new file mode 100644
index 0000000..f31ddb6
--- /dev/null
+++ b/developer-simulation/runs/2026-08-08--remittance-reconciliation/tests/fixtures/overlapping-identity/remittances.jsonl
@@ -0,0 +1,2 @@
+{"remittance_line_id":"R-OVERLAP","payer":"payer","provider":"provider","insurer_reference":"REF-X","patient_key":"patient-shared","service_date_start":20000,"service_date_end":20000,"procedure_code":"PROC","paid_cents":100,"adjustment_cents":0,"adjustment_codes":[],"transaction_kind":"payment"}
+{"remittance_line_id":"R-OK","payer":"payer","provider":"provider","insurer_reference":"REF-OK","patient_key":"patient-ok","service_date_start":20000,"service_date_end":20000,"procedure_code":"PROC","paid_cents":100,"adjustment_cents":0,"adjustment_codes":[],"transaction_kind":"payment"}
diff --git a/developer-simulation/runs/2026-08-09--firewall-policy-impact/Cargo.toml b/developer-simulation/runs/2026-08-09--firewall-policy-impact/Cargo.toml
new file mode 100644
index 0000000..c704414
--- /dev/null
+++ b/developer-simulation/runs/2026-08-09--firewall-policy-impact/Cargo.toml
@@ -0,0 +1,9 @@
+[package]
+name = "firewall-policy-impact"
+version = "0.1.0"
+edition = "2024"
+publish = false
+
+[dependencies]
+serde = { version = "1", features = ["derive"] }
+serde_json = "1"
diff --git a/developer-simulation/runs/2026-08-09--firewall-policy-impact/README.md b/developer-simulation/runs/2026-08-09--firewall-policy-impact/README.md
new file mode 100644
index 0000000..66b5a5c
--- /dev/null
+++ b/developer-simulation/runs/2026-08-09--firewall-policy-impact/README.md
@@ -0,0 +1,115 @@
+# Exact ordered firewall policy impact prototype
+
+This standalone Rust command compares an old and proposed ordered firewall policy. It validates both complete inputs, applies authoritative first-match semantics with implicit default deny, and emits a deterministic JSON report containing:
+
+- exact newly allowed and newly denied address/port regions;
+- the deciding old and proposed rule IDs, including `default-deny`;
+- one deterministic packet witness per changed region;
+- reachable or fully unreachable classification for every proposed rule;
+- one witness for every reachable proposed rule.
+
+The implementation is deliberately read-only. It never rewrites either policy, connects to a firewall, uses packet logs, or makes a deployment decision.
+
+## Why this is standalone
+
+Public BogKit material was read in this order: root README, then the `starter`, `timeseries`, `chat`, and `search` examples. Fold is a persistent incremental materialized-view engine, while ESE creates static text embeddings and ANNy provides approximate nearest-neighbor search. The requested job is a one-shot, exact comparison of ordered geometric predicates; approximation is explicitly forbidden, and persistence or semantic search does not simplify the required proof. All three components were therefore considered and rejected as poor fits. See `evidence/DECISION_AUDIT.md` for the detailed audit.
+
+## Input format
+
+Each input is a JSON object with one ordered `rules` array:
+
+```json
+{
+  "rules": [
+    {
+      "id": "allow-web",
+      "action": "allow",
+      "ip_family": "ipv4",
+      "source_cidr": "10.0.0.0/24",
+      "protocol": "tcp",
+      "port_start": 443,
+      "port_end": 443
+    }
+  ]
+}
+```
+
+Only `allow`/`deny`, `ipv4`/`ipv6`, TCP/UDP, canonical CIDRs, and ports 0 through 65,535 are accepted. The rule ID `default-deny` is reserved exclusively for the implicit-default marker and is rejected as a real rule ID. Unknown fields and enum values, malformed or noncanonical CIDRs, family mismatches, reversed port ranges, and duplicate or empty IDs also fail before analysis.
+
+At the start of every `analyze` request, any prior regular file or symbolic link at the requested report path is removed before either policy is read. Every returned read, validation, or write failure clears the path again. This prevents a report from an earlier successful run from surviving an invalid rerun as a stale semantic verdict. Before any unlink, direct, canonical/relative, symbolic-link, and (on Unix) hard-link aliases to either input are rejected so the analyzer cannot delete or overwrite a policy. Non-file output targets are refused rather than recursively removed.
+
+Report publication uses an exclusively created fresh temporary file and atomic rename. Existing temporary-name candidates—including hard links or symlinks to an input—are never opened or truncated; they are treated as collisions and publication retries a suffixed name. A temporary file owned by the current run is cleaned up if writing, flushing, or renaming fails.
+
+## Build and run
+
+All commands below are offline. The external target directory keeps generated build output out of the deliverable.
+
+```console
+$ export CARGO_TARGET_DIR=/private/tmp/bogkit-firewall-impact-target
+$ cargo build --offline --locked --release -p firewall-policy-impact
+$ /private/tmp/bogkit-firewall-impact-target/release/firewall-policy-impact \
+    analyze fixtures/baseline-old.json fixtures/baseline-proposed.json /private/tmp/report.json
+outcome=newly-allowed change_regions=1 reachable_rules=2 unreachable_rules=0 report=/private/tmp/report.json
+
+$ /private/tmp/bogkit-firewall-impact-target/release/firewall-policy-impact \
+    verify fixtures/baseline-old.json fixtures/baseline-proposed.json /private/tmp/report.json
+verified exact_report=true change_witnesses=1 reachability_witnesses=2
+```
+
+`verify` reruns the exact analysis and then evaluates every change and reachability witness with the separate linear first-match evaluator in `src/reference.rs`.
+
+Report verification uses a closed schema: unknown fields at the report root or inside the summary, change region, witness, or reachability objects are rejected before `exact_report=true` can be printed.
+
+The expected report for the included example is `fixtures/baseline-expected-report.json`.
+
+## Baseline comparison
+
+The included samples deliberately miss a newly allowed region:
+
+```console
+$ /private/tmp/bogkit-firewall-impact-target/release/firewall-policy-impact \
+    sample-replay fixtures/baseline-old.json fixtures/baseline-proposed.json fixtures/baseline-samples.json
+```
+
+Sample replay reports zero changed samples, while exact analysis reports `10.0.1.0` through `10.0.1.255`, TCP destination ports 443 through 444, newly allowed by `new-admin-range`. This is why the sample command explicitly warns that it cannot establish no semantic change.
+
+## Acceptance and quality checks
+
+```console
+$ cargo fmt --check -p firewall-policy-impact
+$ cargo clippy --offline --locked --release -p firewall-policy-impact --all-targets --all-features -- -D warnings
+$ cargo test --offline --locked --release -p firewall-policy-impact --all-targets -- --nocapture
+$ /private/tmp/bogkit-firewall-impact-target/release/firewall-policy-impact \
+    validate-suite 10000 1000 2000000 104373592904137
+```
+
+The acceptance test performs exhaustive enumeration on 10,000 generated reduced-universe pairs (2,560,000 packet tuples), then 2,000,000 boundary-biased probes across 1,000 full-width IPv4/IPv6 pairs. It checks report membership and decisions against the separate linear evaluator, verifies exact proposed-rule reachability in the reduced universe, and replays every emitted witness.
+
+The hand-written suite covers insertion before an allow, deletion of a deny, reordering, partial CIDR and port overlap, redundant same-action coverage, opposite-action shadowing, implicit default-deny transitions, family/protocol separation, ports 0 and 65,535, and a semantically neutral edit.
+
+## Reproduce the 50,000-rule measurement
+
+The generator creates two 50,000-rule policies from a recorded seed. The proposed policy changes one action field. Half the proposed rules are reachable and half are deliberately shadowed by the immediately preceding duplicate predicate.
+
+```console
+$ /private/tmp/bogkit-firewall-impact-target/release/firewall-policy-impact \
+    generate-benchmark /private/tmp/bogkit-firewall-impact-benchmark 50000 104373592904137
+$ /usr/bin/time -l /private/tmp/bogkit-firewall-impact-target/release/firewall-policy-impact \
+    analyze /private/tmp/bogkit-firewall-impact-benchmark/old.json \
+    /private/tmp/bogkit-firewall-impact-benchmark/proposed.json \
+    /private/tmp/bogkit-firewall-impact-benchmark/report.json
+$ /private/tmp/bogkit-firewall-impact-target/release/firewall-policy-impact \
+    verify /private/tmp/bogkit-firewall-impact-benchmark/old.json \
+    /private/tmp/bogkit-firewall-impact-benchmark/proposed.json \
+    /private/tmp/bogkit-firewall-impact-benchmark/report.json
+```
+
+On the declared test host, five release measurements through reviewer round 3 took 0.12 to 0.13 seconds; the largest observed maximum resident set was 41,664,512 bytes. These are observed results for this recorded fixture and host, not a universal upper-bound proof for every possible 50,000-rule policy. See `evidence/COMMANDS.md` for exact output and `evidence/DEPENDENCIES_AND_CLEANUP.md` for host and cleanup details.
+
+During archival, the standalone child workspace, child lockfile, and package-level `strip`/`lto` release settings were removed. The package was rebuilt with the single nested lab lockfile and default workspace release profile. The final archived binary re-ran the same 50,000/50,000 fixture in 0.13 seconds and verified its 25,001 witnesses in 0.81 seconds. The archive sandbox did not expose peak RSS, so the 41,664,512-byte figure above remains explicitly limited to the pre-archive declared-host runs and is not attributed to the normalized binary.
+
+## Algorithm boundary
+
+For each IP-family/protocol combination, the analyzer sweeps exact CIDR boundary intervals. A port segment tree maintains the earliest active rule over exact port boundary intervals. It compares the old and proposed winners, coalesces adjacent equivalent regions deterministically, and records the lower address/port corner as the witness. The linear evaluator is a separate, intentionally simple scan of rules in policy order.
+
+The output can necessarily grow with the number of distinct semantic regions. The measured 50,000-rule fixture is comfortably within the target, but adversarial policies whose exact result itself is enormous may require more time or memory; this prototype makes no broader bound than the observed evidence.
diff --git a/developer-simulation/runs/2026-08-09--firewall-policy-impact/evidence/COMMANDS.md b/developer-simulation/runs/2026-08-09--firewall-policy-impact/evidence/COMMANDS.md
new file mode 100644
index 0000000..5dd862e
--- /dev/null
+++ b/developer-simulation/runs/2026-08-09--firewall-policy-impact/evidence/COMMANDS.md
@@ -0,0 +1,361 @@
+# Exact verification commands and observed output
+
+The sections below preserve the developer and reviewer trial evidence from the isolated standalone copy. During archival, the child workspace, child lockfile, and package-level release profile were removed. The final normalized archive was then rebuilt using the single nested lab lockfile and default workspace release profile. Its focused formatting, 14 acceptance tests, strict release Clippy, baseline byte determinism, exact verifier replay, malformed-input no-output check, and 50,000-rule run all passed. The archived binary observed 0.13 seconds for analysis and 0.81 seconds for verification; peak RSS was unavailable in the archive sandbox, so only the earlier declared-host runs below carry RSS measurements.
+
+Working directory for every command below:
+
+`/private/tmp/bogkit-sim-2026-08-09-trial2/simulation-output/firewall-policy-impact`
+
+Generated build output was directed to `/private/tmp/bogkit-sim-trial2-target`.
+
+## Host
+
+Command:
+
+```console
+$ sw_vers && uname -m && rustc --version && cargo --version
+```
+
+Observed:
+
+```text
+ProductName: macOS
+ProductVersion: 26.5.2
+BuildVersion: 25F84
+arm64
+rustc 1.95.0 (59807616e 2026-04-14)
+cargo 1.95.0 (f2d3ce0bd 2026-03-21)
+```
+
+## Formatting and strict lint
+
+```console
+$ cargo fmt --all --check
+```
+
+Exit 0, no output.
+
+```console
+$ CARGO_TARGET_DIR=/private/tmp/bogkit-sim-trial2-target cargo clippy --offline --all-targets --all-features -- -D warnings
+```
+
+Observed final line:
+
+```text
+Finished `dev` profile [unoptimized + debuginfo] target(s) in 0.22s
+```
+
+Exit 0 with no warnings.
+
+## Tests and differential acceptance workload
+
+```console
+$ CARGO_TARGET_DIR=/private/tmp/bogkit-sim-trial2-target cargo test --offline --test acceptance -- --nocapture
+```
+
+Observed:
+
+```text
+running 6 tests
+test malformed_inputs_are_rejected_before_analysis ... ok
+test shadowing_reachability_and_semantically_neutral_edits ... ok
+test output_is_byte_deterministic_and_sorted ... ok
+test families_protocols_and_extreme_ports_remain_separate ... ok
+test hand_written_first_match_regressions ... ok
+small_pairs=10000 exhaustive_packets=2560000 full_width_pairs=1000 boundary_probes=2000000 disagreements=0
+test acceptance_differential_workloads ... ok
+
+test result: ok. 6 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 2.73s
+```
+
+The reduced universe contains 16 IPv4 addresses, both protocols, and ports 0 through 7: 256 tuples per pair, or 2,560,000 exhaustive tuple evaluations across 10,000 pairs. Each tuple's report membership, old/new action, and old/new deciding rule ID are compared to the separate linear evaluator. Proposed reachability is also exhaustively checked.
+
+## Release build and demonstration
+
+```console
+$ CARGO_TARGET_DIR=/private/tmp/bogkit-sim-trial2-target cargo build --offline --release
+```
+
+Observed final line:
+
+```text
+Finished `release` profile [optimized] target(s) in 2.40s
+```
+
+Sample baseline:
+
+```console
+$ /private/tmp/bogkit-sim-trial2-target/release/firewall-policy-impact sample-replay fixtures/baseline-old.json fixtures/baseline-proposed.json fixtures/baseline-samples.json
+```
+
+Observed: 2 samples, 0 changed samples. The exact JSON is preserved in `evidence/baseline-sample-replay.json`.
+
+Exact analysis:
+
+```console
+$ /private/tmp/bogkit-sim-trial2-target/release/firewall-policy-impact analyze fixtures/baseline-old.json fixtures/baseline-proposed.json /private/tmp/bogkit-trial2-baseline-report.json
+outcome=newly-allowed change_regions=1 reachable_rules=2 unreachable_rules=0 report=/private/tmp/bogkit-trial2-baseline-report.json
+```
+
+Independent replay:
+
+```console
+$ /private/tmp/bogkit-sim-trial2-target/release/firewall-policy-impact verify fixtures/baseline-old.json fixtures/baseline-proposed.json /private/tmp/bogkit-trial2-baseline-report.json
+verified exact_report=true change_witnesses=1 reachability_witnesses=2
+```
+
+A second identical run was compared with `cmp`; it exited 0 with no output, establishing byte-for-byte identical JSON for the fixture. The generated report matches `fixtures/baseline-expected-report.json`.
+
+## Invalid input produces no verdict
+
+```console
+$ /private/tmp/bogkit-sim-trial2-target/release/firewall-policy-impact analyze fixtures/baseline-old.json fixtures/invalid-proposed.json /private/tmp/bogkit-trial2-invalid-report.json
+```
+
+Observed exit 2:
+
+```text
+error: input validation failed; no semantic verdict was produced:
+proposed policy: rule[0] id="duplicate": reversed destination-port range 9000..8000
+proposed policy: rule[0] id="duplicate": CIDR "10.0.0.1/24" is not canonical
+proposed policy: rule[1] id="duplicate": duplicate rule id
+```
+
+`test ! -e /private/tmp/bogkit-trial2-invalid-report.json` exited 0 after the failure. Separate tests cover unknown actions, unsupported protocols, family mismatch, and malformed schemas.
+
+## Recorded 50,000-rule benchmark
+
+Generation:
+
+```console
+$ /private/tmp/bogkit-sim-trial2-target/release/firewall-policy-impact generate-benchmark /private/tmp/bogkit-trial2-benchmark-strong-0809 50000 104373592904137
+generated old_rules=50000 proposed_rules=50000 seed=104373592904137 directory=/private/tmp/bogkit-trial2-benchmark-strong-0809
+```
+
+Timed exact release run:
+
+```console
+$ /usr/bin/time -l /private/tmp/bogkit-sim-trial2-target/release/firewall-policy-impact analyze /private/tmp/bogkit-trial2-benchmark-strong-0809/old.json /private/tmp/bogkit-trial2-benchmark-strong-0809/proposed.json /private/tmp/bogkit-trial2-benchmark-strong-0809/report.json
+```
+
+Observed:
+
+```text
+outcome=newly-allowed change_regions=1 reachable_rules=25000 unreachable_rules=25000 report=/private/tmp/bogkit-trial2-benchmark-strong-0809/report.json
+        0.12 real         0.11 user         0.00 sys
+            41664512  maximum resident set size
+```
+
+This is 0.8% of the 15-second limit and 15.5% of the 256 MiB limit. It is an observed fixture/host result.
+
+A final fresh run from a separately built target observed 0.13 seconds and 41,648,128 bytes maximum resident set. Across both measurements, the conservative observed maxima were 0.13 seconds and 41,664,512 bytes.
+
+Witness replay:
+
+```console
+$ /private/tmp/bogkit-sim-trial2-target/release/firewall-policy-impact verify /private/tmp/bogkit-trial2-benchmark-strong-0809/old.json /private/tmp/bogkit-trial2-benchmark-strong-0809/proposed.json /private/tmp/bogkit-trial2-benchmark-strong-0809/report.json
+verified exact_report=true change_witnesses=1 reachability_witnesses=25000
+```
+
+## Reviewer fix round 1: reserved implicit marker
+
+The analyzer now rejects a real rule ID equal to `default-deny`, leaving that value unambiguous as the implicit fallback marker.
+
+Focused regression:
+
+```console
+$ CARGO_TARGET_DIR=.reviewer-target cargo test --offline --test acceptance implicit_default_marker_cannot_be_used_as_a_real_rule_id -- --nocapture
+test implicit_default_marker_cannot_be_used_as_a_real_rule_id ... ok
+test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 6 filtered out
+```
+
+Release CLI adversary:
+
+```console
+$ .reviewer-target/release/firewall-policy-impact analyze fixtures/baseline-old.json fixtures/reserved-id-proposed.json .reviewer-reserved-report.json
+error: input validation failed; no semantic verdict was produced:
+proposed policy: rule[0] id="default-deny": id is reserved for the implicit default-deny decision
+```
+
+The command exited 2. `test ! -e .reviewer-reserved-report.json` exited 0 both before and after it, proving that no semantic report was created.
+
+Fresh complete quality pass:
+
+```text
+cargo fmt --all --check: exit 0
+strict clippy with -D warnings: exit 0, no warnings
+offline release build: exit 0
+acceptance tests: 7 passed, 0 failed
+small_pairs=10000 exhaustive_packets=2560000 full_width_pairs=1000 boundary_probes=2000000 disagreements=0
+```
+
+Fresh release demo: sample replay still found 0/2 changed samples; exact analysis still emitted 1 newly allowed region; independent replay verified 1 change witness and 2 reachability witnesses. Two reports matched each other and `fixtures/baseline-expected-report.json` byte for byte (`cmp` exit 0).
+
+Fresh representative performance run, with all round-one generated files inside `simulation-output/firewall-policy-impact`:
+
+```text
+outcome=newly-allowed change_regions=1 reachable_rules=25000 unreachable_rules=25000
+        0.12 real         0.12 user         0.00 sys
+            34553856  maximum resident set size
+verified exact_report=true change_witnesses=1 reachability_witnesses=25000
+```
+
+The round-one build target, generated benchmark, and temporary reports were removed after verification.
+
+## Reviewer fix round 2: stale report, strict verification, and alias safety
+
+Focused stale-output regression:
+
+```console
+$ CARGO_TARGET_DIR=.reviewer2-target cargo test --offline --test acceptance reused_output_is_removed_on_validation_read_and_write_failures -- --nocapture
+test reused_output_is_removed_on_validation_read_and_write_failures ... ok
+test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 7 filtered out
+```
+
+The test creates a valid report and then reuses its path with an invalid proposed policy; it also repeats with a missing input and exercises a write failure. It asserts the requested report path is absent after each returned error.
+
+Release CLI reuse demonstration:
+
+```console
+$ .reviewer2-target/release/firewall-policy-impact analyze fixtures/baseline-old.json fixtures/baseline-proposed.json .reviewer2-report.json
+outcome=newly-allowed change_regions=1 reachable_rules=2 unreachable_rules=0 report=.reviewer2-report.json
+$ .reviewer2-target/release/firewall-policy-impact analyze fixtures/baseline-old.json fixtures/invalid-proposed.json .reviewer2-report.json
+error: input validation failed; no semantic verdict was produced:
+proposed policy: rule[0] id="duplicate": reversed destination-port range 9000..8000
+proposed policy: rule[0] id="duplicate": CIDR "10.0.0.1/24" is not canonical
+proposed policy: rule[1] id="duplicate": duplicate rule id
+$ test ! -e .reviewer2-report.json
+```
+
+The invalid command exited 2; the final absence check exited 0. Recreating the valid report and rerunning with missing `fixtures/missing-proposed.json` also exited 2, and the same absence check passed. A valid analysis targeting missing parent `.reviewer2-write-failure/report.json` exited 2 with `cannot write temporary report`; its absence check passed.
+
+Input alias preservation:
+
+```console
+$ CARGO_TARGET_DIR=.reviewer2-target cargo test --offline --test acceptance output_aliases_are_rejected_before_either_input_is_changed -- --nocapture
+test output_aliases_are_rejected_before_either_input_is_changed ... ok
+test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 9 filtered out
+```
+
+This regression checks report=old, report=proposed, a relative/canonical old alias, a symlink alias, and a Unix hard-link alias. Every call is rejected before unlink/write and both input byte sequences are checked after every attempt.
+
+Closed report-schema regression:
+
+```console
+$ CARGO_TARGET_DIR=.reviewer2-target cargo test --offline --test acceptance report_schema_rejects_unknown_fields_at_every_nested_level -- --nocapture
+test report_schema_rejects_unknown_fields_at_every_nested_level ... ok
+```
+
+The test injects an unknown field separately at six JSON locations: root, summary, change, change witness, reachability entry, and reachability witness. All six are rejected. CLI evidence:
+
+```console
+$ .reviewer2-target/release/firewall-policy-impact verify fixtures/baseline-old.json fixtures/baseline-proposed.json fixtures/baseline-report-unknown-field.json
+error: invalid report JSON or schema: unknown field `unexpected`, expected one of `schema_version`, `analysis`, `summary`, `changes`, `proposed_rule_reachability` at line 51 column 14
+```
+
+Exit 2; no `exact_report=true` line was printed.
+
+Fresh complete round-two gates:
+
+```text
+cargo fmt --all --check: exit 0
+strict clippy with -D warnings: exit 0, no warnings
+offline release build: exit 0
+acceptance tests: 10 passed, 0 failed
+small_pairs=10000 exhaustive_packets=2560000 full_width_pairs=1000 boundary_probes=2000000 disagreements=0
+```
+
+Release demo and determinism remained unchanged: sample replay found 0/2 changes, exact analysis found one newly allowed region, `verify` replayed 1 change witness and 2 reachability witnesses, and two reports matched each other and the checked-in expected report byte for byte.
+
+Round-two 50,000/50,000 release measurement:
+
+```text
+outcome=newly-allowed change_regions=1 reachable_rules=25000 unreachable_rules=25000
+        0.12 real         0.11 user         0.00 sys
+            34963456  maximum resident set size
+verified exact_report=true change_witnesses=1 reachability_witnesses=25000
+```
+
+All round-two generated artifacts were removed after these results were recorded.
+
+Final cleanup audit from the sanitized checkout root:
+
+```console
+$ find simulation-output -type d \( -name target -o -name '*target*' -o -name '.reviewer*' -o -name '.reused-output-test-*' -o -name '.output-alias-test-*' \) -print
+$ find simulation-output -type f \( -name '.reviewer*' -o -name '*.tmp-*' \) -print
+$ find simulation-output -type l -print
+```
+
+All three commands produced no output. `git status --short` showed only `?? simulation-output/`; no root/core/example/archive file was modified.
+
+## Reviewer fix round 3: exclusive temporary creation
+
+Focused adversarial publication run:
+
+```console
+$ CARGO_TARGET_DIR=.reviewer3-target cargo test --offline --test acceptance temporary_ -- --nocapture
+running 4 tests
+test preexisting_temporary_symlink_never_truncates_an_input ... ok
+test temporary_collisions_are_retried_without_deleting_foreign_candidates ... ok
+test preexisting_temporary_hard_link_never_truncates_an_input ... ok
+test normal_atomic_publication_leaves_no_temporary_file ... ok
+test result: ok. 4 passed; 0 failed; 0 ignored; 0 measured; 10 filtered out
+```
+
+The hard-link and symlink regressions precreate the former first candidate `.report.json.tmp-<current-pid>` pointing at `old.json`. Publication retries instead of opening it. Afterward, old and proposed bytes and the collision contents are unchanged. The multi-collision test preserves two foreign candidates, publishes through the next exclusively created candidate, and confirms that owned candidate disappears through rename. Normal publication is repeated twice with byte-identical reports and no temporary residue.
+
+The first complete rerun after changing the publisher produced 13 passing tests and one failed assertion in `reused_output_is_removed_on_validation_read_and_write_failures`: the failure expected the old phrase `cannot write temporary report`, while exclusive creation correctly returned the new phrase `cannot create temporary report`. The implementation behavior and output-absence assertion were unchanged. The expectation was updated and the entire suite rerun fresh:
+
+```text
+running 14 tests
+test implicit_default_marker_cannot_be_used_as_a_real_rule_id ... ok
+test malformed_inputs_are_rejected_before_analysis ... ok
+test shadowing_reachability_and_semantically_neutral_edits ... ok
+test output_is_byte_deterministic_and_sorted ... ok
+test families_protocols_and_extreme_ports_remain_separate ... ok
+test report_schema_rejects_unknown_fields_at_every_nested_level ... ok
+test hand_written_first_match_regressions ... ok
+test preexisting_temporary_symlink_never_truncates_an_input ... ok
+test output_aliases_are_rejected_before_either_input_is_changed ... ok
+test temporary_collisions_are_retried_without_deleting_foreign_candidates ... ok
+test preexisting_temporary_hard_link_never_truncates_an_input ... ok
+test normal_atomic_publication_leaves_no_temporary_file ... ok
+test reused_output_is_removed_on_validation_read_and_write_failures ... ok
+small_pairs=10000 exhaustive_packets=2560000 full_width_pairs=1000 boundary_probes=2000000 disagreements=0
+test acceptance_differential_workloads ... ok
+test result: ok. 14 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 2.76s
+```
+
+Other fresh gates:
+
+```text
+cargo fmt --all --check: exit 0
+strict clippy with -D warnings: exit 0, no warnings
+offline release build: exit 0
+```
+
+Release demonstration remained stable: sample replay found 0/2 changes, two exact reports matched each other and `fixtures/baseline-expected-report.json` byte for byte, and verification replayed 1 change witness plus 2 reachability witnesses. Reusing one of those reports with the invalid proposed fixture exited 2 and the report-absence check passed. The reserved-ID invalid fixture also exited 2 with no report. The unknown-field report still exited 2 without `exact_report=true`.
+
+Round-three 50,000/50,000 release measurement:
+
+```text
+outcome=newly-allowed change_regions=1 reachable_rules=25000 unreachable_rules=25000
+        0.13 real         0.11 user         0.00 sys
+            34979840  maximum resident set size
+verified exact_report=true change_witnesses=1 reachability_witnesses=25000
+```
+
+All round-three generated paths were inside `simulation-output/firewall-policy-impact` and were removed after measurement.
+
+The intermediate assertion failure left `.reused-output-test-57807-0`; the cleanup scan detected it and it was explicitly removed with the round-three build, benchmark, and report artifacts. Final directory scan:
+
+```text
+simulation-output
+simulation-output/firewall-policy-impact
+simulation-output/firewall-policy-impact/evidence
+simulation-output/firewall-policy-impact/fixtures
+simulation-output/firewall-policy-impact/src
+simulation-output/firewall-policy-impact/tests
+```
+
+`find simulation-output -name '.*' -print` and `find simulation-output -type l -print` both produced no output. `git status --short` again showed only `?? simulation-output/`.
diff --git a/developer-simulation/runs/2026-08-09--firewall-policy-impact/evidence/DECISION_AUDIT.md b/developer-simulation/runs/2026-08-09--firewall-policy-impact/evidence/DECISION_AUDIT.md
new file mode 100644
index 0000000..d0ab8e4
--- /dev/null
+++ b/developer-simulation/runs/2026-08-09--firewall-policy-impact/evidence/DECISION_AUDIT.md
@@ -0,0 +1,67 @@
+# Consequential decision audit and uncertainty
+
+## Decisions
+
+### Reject Fold, ESE, and ANNy for the prototype
+
+- Alternatives considered: Fold persistent views; ESE text embeddings; ANNy approximate nearest-neighbor search; standalone exact algorithm.
+- Decision: standalone exact Rust algorithm.
+- Basis: the acceptance contract requires exact first-match equivalence and exact shadow reachability from two complete static policies. Approximation is forbidden, text embeddings are unrelated, and persistence does not supply the missing ordered geometric operation.
+- Consequence: the result evaluates BogKit honestly as a no-fit rather than manufacturing component usage. It uses no BogKit dependency.
+- Reversibility: high. A future exact interval component could replace the sweep implementation while preserving the JSON contract and linear verifier.
+
+### Use a deterministic address sweep and port segment tree
+
+- Alternatives considered: sampled replay; full packet enumeration; naive Cartesian coordinate grid; repeated rectangle subtraction; boundary sweep.
+- Decision: exact boundary sweep with earliest-active-rule tracking over compressed port intervals.
+- Basis: packet enumeration is impossible over IPv6, a Cartesian grid can multiply all address and port boundaries, and sampling cannot prove no change. The sweep evaluates only exact rule boundaries and preserves first-match rule identity.
+- Consequence: exact results for the modeled fields, with cost dependent on boundaries, active rules, and emitted regions.
+
+### Require a separate linear replay oracle
+
+- Decision: keep `src/reference.rs` as an intentionally simple policy-order scan, used only for tests, probes, sample replay, and witness verification.
+- Basis: a witness should be independently replayable without relying on the sweep's winner-selection logic.
+- Consequence: verification is slower per packet but straightforward and isolated from the analyzer algorithm.
+
+### Fully validate both policies before analysis
+
+- Decision: parse and validate old and proposed inputs before calling the analyzer or writing a report.
+- Basis: malformed input must not result in a partial verdict. The literal ID `default-deny` is also reserved so a real rule cannot collide with the implicit-decision marker used in reports and witness replay.
+- Consequence: one run can report multiple semantic validation errors. Schema-deserialization failures stop validation of that individual document at Serde's first structural error, but the other policy is still read and validated; no report is emitted.
+
+### Invalidate reused output before any verdict work
+
+- Decision: the shared file-analysis entry point removes any prior regular-file/symlink report before reading policies, and removes the requested path again on every returned failure.
+- Basis: a stale successful report is an observable semantic verdict even when the current invalid run exits nonzero.
+- Consequence: valid-report-to-invalid-validation and valid-report-to-missing-input reruns leave no report path. A failed write also leaves no requested report.
+- Safety constraint: direct, canonical/relative, symlink, and Unix hard-link aliases to either input are rejected before unlinking. A non-file output target is refused rather than recursively deleted.
+
+### Treat report verification as a closed schema
+
+- Decision: reject unknown fields at the report root and inside every summary, change, witness, and reachability object.
+- Basis: `exact_report=true` should mean the verifier understood the entire submitted report, not only its known subset.
+- Consequence: additive schema changes require an explicit schema-version/code update instead of being silently ignored.
+
+### Exclusively create the publication temporary file
+
+- Decision: open each temporary candidate with atomic create-new semantics, never with a truncating path write. Treat any existing file, directory, hard link, or symlink as a collision and retry a distinct suffix up to a fixed bound.
+- Basis: a predictable preexisting temporary path could otherwise refer to an input policy and path-based writing would truncate that input before rename.
+- Consequence: foreign collision paths are never opened, followed, truncated, or deleted. The publisher writes and syncs only the file it exclusively created, atomically renames it, and removes only that owned path on a returned write/rename failure.
+- Remaining boundary: an attacker able to precreate all 256 candidates can cause a clean denial of publication, but cannot turn a candidate into an input overwrite through this path.
+
+### Record deterministic generators, not large generated deliverables
+
+- Decision: preserve generator code, exact counts, and seed `104373592904137`; put generated policies and build output under `/private/tmp`.
+- Basis: the trial requires reproducibility and forbids generated build output in the deliverable.
+- Consequence: the 50,000-rule fixture is reproducible locally but not committed as a large JSON pair.
+
+## Uncertainty and evidence limits
+
+- The analyzer is exact only for source address, IP family, TCP/UDP, and inclusive destination-port interval with ordered first match and implicit default deny. It says nothing about the explicit non-goal fields.
+- The linear evaluator is independently implemented but shares validated rule and packet types. Exhaustive reduced-universe comparison and boundary probes reduce, but cannot mathematically eliminate, implementation risk.
+- The 10,000-pair exhaustive suite proves agreement only for every generated reduced-universe case, not every possible policy.
+- The 1,000-pair/2,000,000-probe suite is additional bug-finding evidence, not the basis for an exact no-change verdict.
+- The five observed 0.12-0.13-second runs and 41,664,512-byte maximum are specific to macOS 26.5.2 on arm64, release builds, the recorded seed, and the generated 50,000/50,000 pair. No universal resource bound is claimed.
+- Exact normalized output is output-sensitive. A hostile high-fragmentation policy can create a very large number of distinct regions even when rule count is fixed.
+- The performance generator deliberately mixes 25,000 reachable disjoint predicates with 25,000 immediately shadowed duplicate predicates and changes one action. It stresses full input validation, reachability bookkeeping, IPv4/IPv6 boundaries, and report witness construction, but it is not a worst-case fragmentation workload.
+- Public discovery was bounded to the sanitized checkout's README, examples, and component public readmes/manifest. The no-fit conclusion is scoped to that inspected surface.
diff --git a/developer-simulation/runs/2026-08-09--firewall-policy-impact/evidence/DEPENDENCIES_AND_CLEANUP.md b/developer-simulation/runs/2026-08-09--firewall-policy-impact/evidence/DEPENDENCIES_AND_CLEANUP.md
new file mode 100644
index 0000000..242c35c
--- /dev/null
+++ b/developer-simulation/runs/2026-08-09--firewall-policy-impact/evidence/DEPENDENCIES_AND_CLEANUP.md
@@ -0,0 +1,48 @@
+# Dependencies, generated paths, and cleanup
+
+## Dependencies
+
+- Rust toolchain observed: `rustc 1.95.0`, `cargo 1.95.0`.
+- Direct crates: `serde` with derive support and `serde_json`.
+- Exact resolved versions are pinned in the archive's single `developer-simulation/Cargo.lock` and were built with `--offline --locked`.
+- No BogKit crate, network, database, firewall, private log, production policy, or external policy engine is used.
+- All policies, samples, generators, and seeds are synthetic.
+
+## Declared measurement host
+
+- macOS 26.5.2, build 25F84.
+- arm64.
+- `/usr/bin/time -l` peak resident set size is reported in bytes on this host.
+
+## Deliverable cleanliness
+
+- Source deliverable: `simulation-output/firewall-policy-impact`.
+- No `target` directory or generated 50,000-rule JSON is stored in the deliverable.
+- The root workspace manifests, root lockfile, BogKit crates, public examples, Git state, GitHub state, and automation state were not modified.
+
+## Generated temporary paths used during verification
+
+- `/private/tmp/bogkit-sim-trial2-target` — debug/release build output.
+- `/private/tmp/bogkit-trial2-baseline-report.json` and `...-2.json` — deterministic release reports.
+- `/private/tmp/bogkit-trial2-benchmark-strong-0809` — final 50,000-rule benchmark inputs/report.
+- `/private/tmp/bogkit-trial2-benchmark-0809` — earlier, easier shadow-heavy benchmark discarded in favor of the stronger mixed reachability fixture.
+- `/private/tmp/bogkit-trial2-baseline-report.json` and benchmark files contain synthetic data only.
+- `/private/tmp/bogkit-trial2-invalid-report.json` was confirmed absent after the invalid-input run.
+
+These exact temporary targets may be deleted after review:
+
+```console
+$ rm -rf /private/tmp/bogkit-sim-trial2-target
+$ rm -rf /private/tmp/bogkit-trial2-benchmark-strong-0809
+$ rm -rf /private/tmp/bogkit-trial2-benchmark-0809
+$ rm -f /private/tmp/bogkit-trial2-baseline-report.json
+$ rm -f /private/tmp/bogkit-trial2-baseline-report-2.json
+```
+
+They are intentionally left available at completion so the coordinator can inspect the just-measured synthetic artifacts. Regeneration commands are in `README.md` and `evidence/COMMANDS.md`.
+
+Reviewer fix round 1 used only paths inside this deliverable: `.reviewer-target`, `.reviewer-benchmark`, and `.reviewer-report-{a,b}.json`. They were removed after their results were recorded. The adversarial invalid run created no `.reviewer-reserved-report.json`.
+
+Reviewer fix round 2 likewise used only in-deliverable hidden paths: `.reviewer2-target`, `.reviewer2-benchmark`, `.reviewer2-report*.json`, and short-lived `.reused-output-test-*`/`.output-alias-test-*` test directories. All were removed or self-cleaned after successful verification. A final hidden-directory/build-artifact scan is recorded in `evidence/COMMANDS.md`.
+
+Reviewer fix round 3 used `.reviewer3-target`, `.reviewer3-benchmark`, `.reviewer3-report*.json`, and self-cleaning `.publication-test-*` directories, all inside the deliverable boundary. They were removed after the recorded run, followed by the same hidden target/temp/symlink scan.
diff --git a/developer-simulation/runs/2026-08-09--firewall-policy-impact/evidence/DISCOVERY.md b/developer-simulation/runs/2026-08-09--firewall-policy-impact/evidence/DISCOVERY.md
new file mode 100644
index 0000000..380bed3
--- /dev/null
+++ b/developer-simulation/runs/2026-08-09--firewall-policy-impact/evidence/DISCOVERY.md
@@ -0,0 +1,31 @@
+# Ordered discovery and friction trail
+
+The scenario brief at `/private/tmp/bogkit-sim-2026-08-09-designer/trial2-brief.md` was read first and treated as the entire acceptance contract. No prior lab material, other trial, GitHub state, automation state, or private input was inspected.
+
+## Public discovery order
+
+1. Root `README.md`.
+   - Learned that BogKit contains Fold, ESE, ANNy, and four named examples.
+   - Did not run `scripts/new-project.sh`, because it would create an example and alter the root workspace, outside the permitted output boundary.
+2. `examples/starter/Cargo.toml`, then `examples/starter/src/main.rs`.
+   - Observed Fold persisting a count and bag under transactional insert/retract operations.
+   - Friction: the starter manifest includes Fold, ESE, and ANNy even though its code uses only Fold, so it does not demonstrate dependency selection.
+3. `examples/timeseries/Cargo.toml`, then `examples/timeseries/src/main.rs`.
+   - Observed incremental `Filter`, `KeyBy`, `Aggregate`, `Table`, `Bag`, and `Count` views.
+4. `examples/chat/Cargo.toml`, then `examples/chat/src/main.rs`.
+   - Observed a single owner for a persistent Fold stream and publication of snapshots.
+5. `examples/search/Cargo.toml`, then `examples/search/src/main.rs`.
+   - Observed BM25 plus HNSW search over ESE embeddings.
+   - The example explicitly says pipeline closure types make ordinary typed helper functions impractical, so it uses macros. That is meaningful API friction for a Rust beginner and mixed-language team.
+6. Only after the public README and examples: `anny/readme.md`, `ese/readme.md`, and `fold/Cargo.toml`.
+   - ANNy identifies itself as approximate nearest-neighbor search.
+   - ESE documents static text embeddings.
+   - Fold's manifest confirms it brings its persistence stack; the public examples remained the clearest usage documentation available in discovery.
+
+## Selection conclusion
+
+- Fold: no fit. The required result is a one-shot exact comparison between two static ordered policies. Persisted incremental views add lifecycle and storage concerns without providing the exact ordered rectangle-difference operation.
+- ESE: no fit. Text embeddings have no role in CIDR/protocol/port semantics.
+- ANNy: no fit. Approximate lookup cannot support an exact no-change verdict or exhaustive shadowing classification.
+
+The standalone implementation uses only Rust plus Serde for strict JSON input/output. No BogKit core, examples, manifests, lockfiles, or Git state were changed.
diff --git a/developer-simulation/runs/2026-08-09--firewall-policy-impact/evidence/FINDINGS.md b/developer-simulation/runs/2026-08-09--firewall-policy-impact/evidence/FINDINGS.md
new file mode 100644
index 0000000..98fbdd4
--- /dev/null
+++ b/developer-simulation/runs/2026-08-09--firewall-policy-impact/evidence/FINDINGS.md
@@ -0,0 +1,129 @@
+# Categorized findings
+
+Severity describes impact on this scenario, not a general assessment of BogKit.
+
+## Reviewer fix round 3: preexisting temporary paths cannot overwrite inputs
+
+- Category: correctness
+- Scope: atomic report publication
+- Severity: publication blocker
+- Confidence: high on the declared host
+- Reproduction: create the former first temporary candidate `.report.json.tmp-<pid>` as either a hard link or symlink to `old.json`, then analyze. The fixed publisher treats the path as an `AlreadyExists` collision, retries a fresh suffix, and leaves both policies and the collision path byte-identical.
+- Smallest improvement: implemented with `OpenOptions::create_new(true)`, bounded distinct retries, full write plus file sync, atomic rename, and cleanup limited to a candidate exclusively created by the current run.
+
+## Reviewer fix round 2: stale reused verdict removed
+
+- Category: correctness
+- Scope: CLI report publication
+- Severity: important
+- Confidence: high
+- Reproduction: first analyze the valid baseline into path X, then run `analyze fixtures/baseline-old.json fixtures/invalid-proposed.json X`. The fixed command exits 2 and `test ! -e X` succeeds. The regression also covers a missing input and a report write failure.
+- Smallest improvement: implemented by clearing an existing report before policy reads and clearing the requested path again on every returned read, validation, analysis/publication failure.
+
+## Reviewer fix round 2: output aliases cannot destroy inputs
+
+- Category: correctness
+- Scope: stale-output cleanup safety
+- Severity: important
+- Confidence: high on the declared Unix host
+- Reproduction: request the old path, proposed path, a relative/canonical form of the old path, a symlink to it, or a hard link to it as the report. All five calls are rejected before unlink/write, and both input files remain byte-identical.
+- Smallest improvement: implemented with direct and canonical comparisons plus Unix device/inode identity before any output cleanup.
+
+## Reviewer fix round 2: report verification now has a closed schema
+
+- Category: correctness
+- Scope: `verify`
+- Severity: minor
+- Confidence: high
+- Reproduction: `verify` the included `baseline-report-unknown-field.json`; it exits 2 with an unknown-field schema error and never prints `exact_report=true`. Regression mutations cover the report root, summary, change, both witness locations, and reachability entry.
+- Smallest improvement: implemented with unknown-field rejection on every report object.
+
+## Reviewer fix: implicit marker collision removed
+
+- Category: correctness
+- Scope: prototype report identity
+- Severity: important
+- Confidence: high
+- Reproduction: submit a policy containing a real rule whose ID is exactly `default-deny`. The fixed validator rejects it before analysis with `id is reserved for the implicit default-deny decision`; the adversarial regression `implicit_default_marker_cannot_be_used_as_a_real_rule_id` locks this behavior.
+- Smallest improvement: implemented by reserving the marker at validation, so every `default-deny` report ID now unambiguously denotes the implicit fallback.
+
+## 1. Sample replay can miss a real allow expansion
+
+- Category: correctness
+- Scope: stated preflight baseline
+- Severity: high
+- Confidence: high
+- Reproduction: run `sample-replay` on the included baseline fixtures, then run `analyze`. The samples report zero changed decisions; exact analysis finds `10.0.1.0`-`10.0.1.255`, TCP ports 443-444, newly allowed.
+- Smallest improvement: keep sample replay only as supplementary bug-finding evidence and require an exact modeled-space analysis before emitting `no semantic change`.
+
+## 2. No discovered BogKit component supplies exact ordered policy geometry
+
+- Category: missing capability
+- Scope: public README and examples examined in the recorded order
+- Severity: high
+- Confidence: high for the inspected public surface; not a claim about undiscovered private APIs
+- Reproduction: follow `evidence/DISCOVERY.md`. Fold examples materialize incremental streams, while ESE and ANNy serve text/vector search. None demonstrates exact first-match rectangle subtraction, exhaustive equivalence, or shadow reachability.
+- Smallest improvement: add a public selection guide that explicitly identifies unsupported exact static-analysis workloads; only add a new primitive if multiple real workloads justify it.
+
+## 3. ANNy is incompatible with proof-bearing results
+
+- Category: poor fit
+- Scope: ANNy
+- Severity: critical if used for the verdict
+- Confidence: high
+- Reproduction: its public README identifies approximate nearest-neighbor search; the scenario requires exact no-change results and exact unreachable classifications.
+- Smallest improvement: document that approximate indexes may generate probes or candidate regions but must never establish policy equivalence.
+
+## 4. ESE does not model firewall predicates
+
+- Category: poor fit
+- Scope: ESE
+- Severity: high if selected
+- Confidence: high
+- Reproduction: its public material exposes text-to-vector encoding. The modeled fields are canonical CIDRs, a two-value protocol enum, and inclusive integer port intervals.
+- Smallest improvement: none in ESE; omit it from projects that do not process text semantics.
+
+## 5. Fold adds persistence without the needed exact operation
+
+- Category: poor fit
+- Scope: Fold for this batch preflight
+- Severity: medium
+- Confidence: high for the public examples
+- Reproduction: starter, timeseries, and chat use a durable stream to incrementally update counts, bags, keyed aggregates, tables, or snapshots. This trial receives two complete files and emits one report.
+- Smallest improvement: show a decision table in the root documentation for when a standalone batch algorithm is preferable to a persistent Fold pipeline.
+
+## 6. Closure-heavy pipeline types create helper-function friction
+
+- Category: API friction
+- Scope: Fold examples and Rust-beginner persona
+- Severity: low to medium
+- Confidence: high
+- Reproduction: the public search example states that its pipeline type contains closures and therefore uses macros instead of ordinary helper functions.
+- Smallest improvement: document a boxed/type-erased reader pattern or provide a small named wrapper example if the API supports one.
+
+## 7. Starter dependency selection is unclear
+
+- Category: documentation gap
+- Scope: project bootstrap/starter
+- Severity: low
+- Confidence: high
+- Reproduction: `examples/starter/Cargo.toml` declares Fold, ESE, and ANNy while `main.rs` uses Fold only. The root README says generated projects add all three even when not all are used.
+- Smallest improvement: have the scaffold ask which components are needed or explain which dependency lines are safe to remove.
+
+## 8. Exact analyzer passed the recorded resource fixture
+
+- Category: performance
+- Scope: this prototype and generated fixture only
+- Severity: none observed
+- Confidence: high for the declared host/fixture, low as a universal bound
+- Reproduction: use seed `104373592904137` and 50,000 rules. Five release runs through reviewer round 3 observed 0.12-0.13 seconds and no more than 41,664,512 bytes peak RSS, with 25,000 reachable and 25,000 shadowed proposed rules.
+- Smallest improvement: retain this fixture and add high-fragmentation/output-heavy fixtures before considering production use.
+
+## 9. Exact output is inherently output-sensitive
+
+- Category: performance
+- Scope: prototype limitation
+- Severity: medium
+- Confidence: high
+- Reproduction: construct many interleaved address and port boundaries with alternating first-match actions; the number of exact report rectangles can grow with the semantic partition.
+- Smallest improvement: define an allowed maximum report size and add representative adversarial fragmentation benchmarks. Do not silently sample or truncate an exact verdict.
diff --git a/developer-simulation/runs/2026-08-09--firewall-policy-impact/evidence/baseline-sample-replay.json b/developer-simulation/runs/2026-08-09--firewall-policy-impact/evidence/baseline-sample-replay.json
new file mode 100644
index 0000000..baf3eba
--- /dev/null
+++ b/developer-simulation/runs/2026-08-09--firewall-policy-impact/evidence/baseline-sample-replay.json
@@ -0,0 +1,6 @@
+{
+  "sample_count": 2,
+  "changed_sample_count": 0,
+  "changed_samples": [],
+  "warning": "sample replay is incomplete evidence and never establishes no semantic change"
+}
diff --git a/developer-simulation/runs/2026-08-09--firewall-policy-impact/fixtures/baseline-expected-report.json b/developer-simulation/runs/2026-08-09--firewall-policy-impact/fixtures/baseline-expected-report.json
new file mode 100644
index 0000000..5510335
--- /dev/null
+++ b/developer-simulation/runs/2026-08-09--firewall-policy-impact/fixtures/baseline-expected-report.json
@@ -0,0 +1,51 @@
+{
+  "schema_version": 1,
+  "analysis": "exact ordered first-match over source CIDR, TCP/UDP, and destination-port interval; implicit default deny",
+  "summary": {
+    "outcome": "newly-allowed",
+    "newly_allowed_regions": 1,
+    "newly_denied_regions": 0,
+    "proposed_reachable_rules": 2,
+    "proposed_unreachable_rules": 0
+  },
+  "changes": [
+    {
+      "kind": "newly-allowed",
+      "ip_family": "ipv4",
+      "source_start": "10.0.1.0",
+      "source_end": "10.0.1.255",
+      "protocol": "tcp",
+      "port_start": 443,
+      "port_end": 444,
+      "old_decision": "deny",
+      "old_rule_id": "default-deny",
+      "new_decision": "allow",
+      "new_rule_id": "new-admin-range",
+      "witness": {
+        "source_ip": "10.0.1.0",
+        "protocol": "tcp",
+        "destination_port": 443
+      }
+    }
+  ],
+  "proposed_rule_reachability": [
+    {
+      "rule_id": "new-admin-range",
+      "reachable": true,
+      "witness": {
+        "source_ip": "10.0.1.0",
+        "protocol": "tcp",
+        "destination_port": 443
+      }
+    },
+    {
+      "rule_id": "existing-service",
+      "reachable": true,
+      "witness": {
+        "source_ip": "10.0.0.0",
+        "protocol": "tcp",
+        "destination_port": 443
+      }
+    }
+  ]
+}
diff --git a/developer-simulation/runs/2026-08-09--firewall-policy-impact/fixtures/baseline-old.json b/developer-simulation/runs/2026-08-09--firewall-policy-impact/fixtures/baseline-old.json
new file mode 100644
index 0000000..9cd7417
--- /dev/null
+++ b/developer-simulation/runs/2026-08-09--firewall-policy-impact/fixtures/baseline-old.json
@@ -0,0 +1,13 @@
+{
+  "rules": [
+    {
+      "id": "existing-service",
+      "action": "allow",
+      "ip_family": "ipv4",
+      "source_cidr": "10.0.0.0/24",
+      "protocol": "tcp",
+      "port_start": 443,
+      "port_end": 443
+    }
+  ]
+}
diff --git a/developer-simulation/runs/2026-08-09--firewall-policy-impact/fixtures/baseline-proposed.json b/developer-simulation/runs/2026-08-09--firewall-policy-impact/fixtures/baseline-proposed.json
new file mode 100644
index 0000000..db4f624
--- /dev/null
+++ b/developer-simulation/runs/2026-08-09--firewall-policy-impact/fixtures/baseline-proposed.json
@@ -0,0 +1,22 @@
+{
+  "rules": [
+    {
+      "id": "new-admin-range",
+      "action": "allow",
+      "ip_family": "ipv4",
+      "source_cidr": "10.0.1.0/24",
+      "protocol": "tcp",
+      "port_start": 443,
+      "port_end": 444
+    },
+    {
+      "id": "existing-service",
+      "action": "allow",
+      "ip_family": "ipv4",
+      "source_cidr": "10.0.0.0/24",
+      "protocol": "tcp",
+      "port_start": 443,
+      "port_end": 443
+    }
+  ]
+}
diff --git a/developer-simulation/runs/2026-08-09--firewall-policy-impact/fixtures/baseline-report-unknown-field.json b/developer-simulation/runs/2026-08-09--firewall-policy-impact/fixtures/baseline-report-unknown-field.json
new file mode 100644
index 0000000..b582c1b
--- /dev/null
+++ b/developer-simulation/runs/2026-08-09--firewall-policy-impact/fixtures/baseline-report-unknown-field.json
@@ -0,0 +1,52 @@
+{
+  "schema_version": 1,
+  "analysis": "exact ordered first-match over source CIDR, TCP/UDP, and destination-port interval; implicit default deny",
+  "summary": {
+    "outcome": "newly-allowed",
+    "newly_allowed_regions": 1,
+    "newly_denied_regions": 0,
+    "proposed_reachable_rules": 2,
+    "proposed_unreachable_rules": 0
+  },
+  "changes": [
+    {
+      "kind": "newly-allowed",
+      "ip_family": "ipv4",
+      "source_start": "10.0.1.0",
+      "source_end": "10.0.1.255",
+      "protocol": "tcp",
+      "port_start": 443,
+      "port_end": 444,
+      "old_decision": "deny",
+      "old_rule_id": "default-deny",
+      "new_decision": "allow",
+      "new_rule_id": "new-admin-range",
+      "witness": {
+        "source_ip": "10.0.1.0",
+        "protocol": "tcp",
+        "destination_port": 443
+      }
+    }
+  ],
+  "proposed_rule_reachability": [
+    {
+      "rule_id": "new-admin-range",
+      "reachable": true,
+      "witness": {
+        "source_ip": "10.0.1.0",
+        "protocol": "tcp",
+        "destination_port": 443
+      }
+    },
+    {
+      "rule_id": "existing-service",
+      "reachable": true,
+      "witness": {
+        "source_ip": "10.0.0.0",
+        "protocol": "tcp",
+        "destination_port": 443
+      }
+    }
+  ],
+  "unexpected": true
+}
diff --git a/developer-simulation/runs/2026-08-09--firewall-policy-impact/fixtures/baseline-samples.json b/developer-simulation/runs/2026-08-09--firewall-policy-impact/fixtures/baseline-samples.json
new file mode 100644
index 0000000..677693d
--- /dev/null
+++ b/developer-simulation/runs/2026-08-09--firewall-policy-impact/fixtures/baseline-samples.json
@@ -0,0 +1,12 @@
+[
+  {
+    "source_ip": "10.0.0.10",
+    "protocol": "tcp",
+    "destination_port": 443
+  },
+  {
+    "source_ip": "192.0.2.55",
+    "protocol": "udp",
+    "destination_port": 53
+  }
+]
diff --git a/developer-simulation/runs/2026-08-09--firewall-policy-impact/fixtures/invalid-proposed.json b/developer-simulation/runs/2026-08-09--firewall-policy-impact/fixtures/invalid-proposed.json
new file mode 100644
index 0000000..afb2d1c
--- /dev/null
+++ b/developer-simulation/runs/2026-08-09--firewall-policy-impact/fixtures/invalid-proposed.json
@@ -0,0 +1,22 @@
+{
+  "rules": [
+    {
+      "id": "duplicate",
+      "action": "allow",
+      "ip_family": "ipv4",
+      "source_cidr": "10.0.0.1/24",
+      "protocol": "tcp",
+      "port_start": 9000,
+      "port_end": 8000
+    },
+    {
+      "id": "duplicate",
+      "action": "deny",
+      "ip_family": "ipv6",
+      "source_cidr": "2001:db8::/32",
+      "protocol": "udp",
+      "port_start": 53,
+      "port_end": 53
+    }
+  ]
+}
diff --git a/developer-simulation/runs/2026-08-09--firewall-policy-impact/fixtures/reserved-id-proposed.json b/developer-simulation/runs/2026-08-09--firewall-policy-impact/fixtures/reserved-id-proposed.json
new file mode 100644
index 0000000..f35beb2
--- /dev/null
+++ b/developer-simulation/runs/2026-08-09--firewall-policy-impact/fixtures/reserved-id-proposed.json
@@ -0,0 +1,13 @@
+{
+  "rules": [
+    {
+      "id": "default-deny",
+      "action": "allow",
+      "ip_family": "ipv4",
+      "source_cidr": "0.0.0.0/0",
+      "protocol": "tcp",
+      "port_start": 0,
+      "port_end": 65535
+    }
+  ]
+}
diff --git a/developer-simulation/runs/2026-08-09--firewall-policy-impact/src/lib.rs b/developer-simulation/runs/2026-08-09--firewall-policy-impact/src/lib.rs
new file mode 100644
index 0000000..a9c1129
--- /dev/null
+++ b/developer-simulation/runs/2026-08-09--firewall-policy-impact/src/lib.rs
@@ -0,0 +1,1610 @@
+mod reference;
+
+use serde::{Deserialize, Serialize};
+use std::collections::{BTreeSet, HashSet};
+use std::fmt::Write as _;
+use std::io::{ErrorKind, Write as IoWrite};
+use std::net::IpAddr;
+use std::path::Path;
+
+pub use reference::{evaluate as evaluate_linear, parse_packet};
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, PartialOrd, Ord, Serialize, Deserialize)]
+#[serde(rename_all = "lowercase")]
+pub enum Action {
+    Allow,
+    Deny,
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, PartialOrd, Ord, Serialize, Deserialize)]
+#[serde(rename_all = "lowercase")]
+pub enum IpFamily {
+    Ipv4,
+    Ipv6,
+}
+
+impl IpFamily {
+    fn bits(self) -> u8 {
+        match self {
+            Self::Ipv4 => 32,
+            Self::Ipv6 => 128,
+        }
+    }
+
+    fn maximum(self) -> u128 {
+        match self {
+            Self::Ipv4 => u32::MAX as u128,
+            Self::Ipv6 => u128::MAX,
+        }
+    }
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, PartialOrd, Ord, Serialize, Deserialize)]
+#[serde(rename_all = "lowercase")]
+pub enum Protocol {
+    Tcp,
+    Udp,
+}
+
+#[derive(Debug, Clone, Deserialize, Serialize)]
+#[serde(deny_unknown_fields)]
+pub struct PolicyFile {
+    pub rules: Vec<RuleInput>,
+}
+
+#[derive(Debug, Clone, Deserialize, Serialize)]
+#[serde(deny_unknown_fields)]
+pub struct RuleInput {
+    pub id: String,
+    pub action: Action,
+    pub ip_family: IpFamily,
+    pub source_cidr: String,
+    pub protocol: Protocol,
+    pub port_start: u16,
+    pub port_end: u16,
+}
+
+#[derive(Debug, Clone)]
+pub struct Rule {
+    pub id: String,
+    pub action: Action,
+    pub family: IpFamily,
+    pub source_start: u128,
+    pub source_end: u128,
+    pub protocol: Protocol,
+    pub port_start: u16,
+    pub port_end: u16,
+}
+
+#[derive(Debug, Clone)]
+pub struct ValidatedPolicy {
+    pub rules: Vec<Rule>,
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub struct Packet {
+    pub family: IpFamily,
+    pub source: u128,
+    pub protocol: Protocol,
+    pub destination_port: u16,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, PartialOrd, Ord, Serialize, Deserialize)]
+pub struct Decision {
+    pub action: Action,
+    pub rule_id: String,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, PartialOrd, Ord, Serialize, Deserialize)]
+#[serde(rename_all = "kebab-case")]
+pub enum ChangeKind {
+    NewlyAllowed,
+    NewlyDenied,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct Witness {
+    pub source_ip: String,
+    pub protocol: Protocol,
+    pub destination_port: u16,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct ChangeRegion {
+    pub kind: ChangeKind,
+    pub ip_family: IpFamily,
+    pub source_start: String,
+    pub source_end: String,
+    pub protocol: Protocol,
+    pub port_start: u16,
+    pub port_end: u16,
+    pub old_decision: Action,
+    pub old_rule_id: String,
+    pub new_decision: Action,
+    pub new_rule_id: String,
+    pub witness: Witness,
+    #[serde(skip)]
+    source_start_num: u128,
+    #[serde(skip)]
+    source_end_num: u128,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct RuleReachability {
+    pub rule_id: String,
+    pub reachable: bool,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub witness: Option<Witness>,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct ReportSummary {
+    pub outcome: String,
+    pub newly_allowed_regions: usize,
+    pub newly_denied_regions: usize,
+    pub proposed_reachable_rules: usize,
+    pub proposed_unreachable_rules: usize,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct Report {
+    pub schema_version: u32,
+    pub analysis: String,
+    pub summary: ReportSummary,
+    pub changes: Vec<ChangeRegion>,
+    pub proposed_rule_reachability: Vec<RuleReachability>,
+}
+
+pub fn parse_and_validate(bytes: &[u8], label: &str) -> Result<ValidatedPolicy, Vec<String>> {
+    let input: PolicyFile = match serde_json::from_slice(bytes) {
+        Ok(input) => input,
+        Err(error) => return Err(vec![format!("{label}: invalid JSON or schema: {error}")]),
+    };
+
+    let mut errors = Vec::new();
+    let mut ids = HashSet::with_capacity(input.rules.len());
+    let mut rules = Vec::with_capacity(input.rules.len());
+
+    for (index, input_rule) in input.rules.into_iter().enumerate() {
+        let location = format!("{label}: rule[{index}] id={:?}", input_rule.id);
+        if input_rule.id.is_empty() {
+            errors.push(format!("{location}: id must not be empty"));
+        } else if input_rule.id == "default-deny" {
+            errors.push(format!(
+                "{location}: id is reserved for the implicit default-deny decision"
+            ));
+        } else if !ids.insert(input_rule.id.clone()) {
+            errors.push(format!("{location}: duplicate rule id"));
+        }
+        if input_rule.port_start > input_rule.port_end {
+            errors.push(format!(
+                "{location}: reversed destination-port range {}..{}",
+                input_rule.port_start, input_rule.port_end
+            ));
+        }
+
+        match parse_canonical_cidr(&input_rule.source_cidr, input_rule.ip_family) {
+            Ok((source_start, source_end)) => rules.push(Rule {
+                id: input_rule.id,
+                action: input_rule.action,
+                family: input_rule.ip_family,
+                source_start,
+                source_end,
+                protocol: input_rule.protocol,
+                port_start: input_rule.port_start,
+                port_end: input_rule.port_end,
+            }),
+            Err(error) => errors.push(format!("{location}: {error}")),
+        }
+    }
+
+    if errors.is_empty() {
+        Ok(ValidatedPolicy { rules })
+    } else {
+        Err(errors)
+    }
+}
+
+pub fn read_and_validate_pair(
+    old_path: &Path,
+    proposed_path: &Path,
+) -> Result<(ValidatedPolicy, ValidatedPolicy), String> {
+    let mut diagnostics = Vec::new();
+    let old = match std::fs::read(old_path) {
+        Ok(bytes) => match parse_and_validate(&bytes, "old policy") {
+            Ok(policy) => Some(policy),
+            Err(errors) => {
+                diagnostics.extend(errors);
+                None
+            }
+        },
+        Err(error) => {
+            diagnostics.push(format!(
+                "old policy: cannot read {}: {error}",
+                old_path.display()
+            ));
+            None
+        }
+    };
+    let proposed = match std::fs::read(proposed_path) {
+        Ok(bytes) => match parse_and_validate(&bytes, "proposed policy") {
+            Ok(policy) => Some(policy),
+            Err(errors) => {
+                diagnostics.extend(errors);
+                None
+            }
+        },
+        Err(error) => {
+            diagnostics.push(format!(
+                "proposed policy: cannot read {}: {error}",
+                proposed_path.display()
+            ));
+            None
+        }
+    };
+
+    match (old, proposed) {
+        (Some(old), Some(proposed)) => Ok((old, proposed)),
+        _ => Err(format!(
+            "input validation failed; no semantic verdict was produced:\n{}",
+            diagnostics.join("\n")
+        )),
+    }
+}
+
+/// Clear a prior report before reading either policy, then keep the requested
+/// path absent if any subsequent step returns an error.
+pub fn analyze_files_to_report(
+    old_path: &Path,
+    proposed_path: &Path,
+    report_path: &Path,
+) -> Result<Report, String> {
+    reject_input_alias(report_path, old_path, "old policy")?;
+    reject_input_alias(report_path, proposed_path, "proposed policy")?;
+    remove_requested_report(report_path)?;
+
+    let result = (|| {
+        let (old, proposed) = read_and_validate_pair(old_path, proposed_path)?;
+        let report = analyze(&old, &proposed);
+        write_report(report_path, &report)?;
+        Ok(report)
+    })();
+
+    match result {
+        Ok(report) => Ok(report),
+        Err(error) => match remove_requested_report(report_path) {
+            Ok(()) => Err(error),
+            Err(cleanup_error) => Err(format!(
+                "{error}\nadditionally failed to keep requested report path absent: {cleanup_error}"
+            )),
+        },
+    }
+}
+
+fn reject_input_alias(report_path: &Path, input_path: &Path, label: &str) -> Result<(), String> {
+    if report_path == input_path {
+        return Err(format!(
+            "requested report path aliases the {label}; refusing to unlink or overwrite an input policy"
+        ));
+    }
+
+    if let (Ok(report_canonical), Ok(input_canonical)) = (
+        std::fs::canonicalize(report_path),
+        std::fs::canonicalize(input_path),
+    ) && report_canonical == input_canonical
+    {
+        return Err(format!(
+            "requested report path aliases the {label}; refusing to unlink or overwrite an input policy"
+        ));
+    }
+
+    #[cfg(unix)]
+    if let (Ok(report_metadata), Ok(input_metadata)) = (
+        std::fs::metadata(report_path),
+        std::fs::metadata(input_path),
+    ) {
+        use std::os::unix::fs::MetadataExt;
+        if report_metadata.dev() == input_metadata.dev()
+            && report_metadata.ino() == input_metadata.ino()
+        {
+            return Err(format!(
+                "requested report path aliases the {label}; refusing to unlink or overwrite an input policy"
+            ));
+        }
+    }
+
+    Ok(())
+}
+
+fn remove_requested_report(path: &Path) -> Result<(), String> {
+    match std::fs::symlink_metadata(path) {
+        Ok(metadata) if metadata.file_type().is_file() || metadata.file_type().is_symlink() => {
+            std::fs::remove_file(path)
+                .map_err(|error| format!("cannot remove prior report {}: {error}", path.display()))
+        }
+        Ok(_) => Err(format!(
+            "requested report path {} exists but is not a regular file or symbolic link",
+            path.display()
+        )),
+        Err(error) if error.kind() == ErrorKind::NotFound => Ok(()),
+        Err(error) => Err(format!(
+            "cannot inspect requested report path {}: {error}",
+            path.display()
+        )),
+    }
+}
+
+fn parse_canonical_cidr(cidr: &str, family: IpFamily) -> Result<(u128, u128), String> {
+    let (address_text, prefix_text) = cidr
+        .split_once('/')
+        .ok_or_else(|| format!("malformed CIDR {cidr:?}: missing '/'"))?;
+    if prefix_text.contains('/') {
+        return Err(format!("malformed CIDR {cidr:?}: too many '/' separators"));
+    }
+    let address: IpAddr = address_text
+        .parse()
+        .map_err(|_| format!("malformed CIDR {cidr:?}: invalid address"))?;
+    let prefix: u8 = prefix_text
+        .parse()
+        .map_err(|_| format!("malformed CIDR {cidr:?}: invalid prefix length"))?;
+
+    let (actual_family, raw) = match address {
+        IpAddr::V4(address) => (IpFamily::Ipv4, u32::from(address) as u128),
+        IpAddr::V6(address) => (IpFamily::Ipv6, u128::from(address)),
+    };
+    if actual_family != family {
+        return Err(format!(
+            "CIDR family {:?} does not match declared family {:?}",
+            actual_family, family
+        ));
+    }
+    if prefix > family.bits() {
+        return Err(format!(
+            "CIDR prefix /{prefix} exceeds {}-bit {:?} width",
+            family.bits(),
+            family
+        ));
+    }
+
+    let host_mask = if prefix == family.bits() {
+        0
+    } else {
+        family.maximum() >> prefix
+    };
+    if raw & host_mask != 0 {
+        return Err(format!("CIDR {cidr:?} is not canonical"));
+    }
+    Ok((raw, raw | host_mask))
+}
+
+pub fn analyze(old: &ValidatedPolicy, proposed: &ValidatedPolicy) -> Report {
+    let mut changes = Vec::new();
+    let mut reachable_witnesses = vec![None; proposed.rules.len()];
+
+    for family in [IpFamily::Ipv4, IpFamily::Ipv6] {
+        for protocol in [Protocol::Tcp, Protocol::Udp] {
+            analyze_dimension(
+                old,
+                proposed,
+                family,
+                protocol,
+                &mut changes,
+                &mut reachable_witnesses,
+            );
+        }
+    }
+
+    changes = normalize_regions(changes);
+    let newly_allowed_regions = changes
+        .iter()
+        .filter(|region| region.kind == ChangeKind::NewlyAllowed)
+        .count();
+    let newly_denied_regions = changes.len() - newly_allowed_regions;
+    let proposed_reachable_rules = reachable_witnesses.iter().filter(|w| w.is_some()).count();
+    let proposed_unreachable_rules = proposed.rules.len() - proposed_reachable_rules;
+    let outcome = match (newly_allowed_regions > 0, newly_denied_regions > 0) {
+        (false, false) => "exact-no-semantic-change",
+        (true, false) => "newly-allowed",
+        (false, true) => "newly-denied",
+        (true, true) => "newly-allowed-and-newly-denied",
+    };
+    let proposed_rule_reachability = proposed
+        .rules
+        .iter()
+        .zip(reachable_witnesses)
+        .map(|(rule, witness)| RuleReachability {
+            rule_id: rule.id.clone(),
+            reachable: witness.is_some(),
+            witness,
+        })
+        .collect();
+
+    Report {
+        schema_version: 1,
+        analysis: "exact ordered first-match over source CIDR, TCP/UDP, and destination-port interval; implicit default deny".to_string(),
+        summary: ReportSummary {
+            outcome: outcome.to_string(),
+            newly_allowed_regions,
+            newly_denied_regions,
+            proposed_reachable_rules,
+            proposed_unreachable_rules,
+        },
+        changes,
+        proposed_rule_reachability,
+    }
+}
+
+#[derive(Debug, Clone, Copy)]
+struct Event {
+    at: u128,
+    rule_index: usize,
+    add: bool,
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+struct PortRun {
+    start: u16,
+    end: u16,
+    winner: Option<usize>,
+}
+
+fn analyze_dimension(
+    old: &ValidatedPolicy,
+    proposed: &ValidatedPolicy,
+    family: IpFamily,
+    protocol: Protocol,
+    changes: &mut Vec<ChangeRegion>,
+    reachable_witnesses: &mut [Option<Witness>],
+) {
+    let old_indexes = matching_indexes(old, family, protocol);
+    let new_indexes = matching_indexes(proposed, family, protocol);
+    if old_indexes.is_empty() && new_indexes.is_empty() {
+        return;
+    }
+
+    let mut port_coordinates = Vec::with_capacity((old_indexes.len() + new_indexes.len()) * 2);
+    for (policy, indexes) in [(old, &old_indexes), (proposed, &new_indexes)] {
+        for &index in indexes {
+            let rule = &policy.rules[index];
+            port_coordinates.push(rule.port_start as u32);
+            if rule.port_end < u16::MAX {
+                port_coordinates.push(rule.port_end as u32 + 1);
+            }
+        }
+    }
+    port_coordinates.sort_unstable();
+    port_coordinates.dedup();
+
+    let mut old_tree = PortTree::new(port_coordinates.clone());
+    let mut new_tree = PortTree::new(port_coordinates);
+    let mut old_events = make_events(old, &old_indexes, family.maximum());
+    let mut new_events = make_events(proposed, &new_indexes, family.maximum());
+    let mut addresses: Vec<u128> = old_events
+        .iter()
+        .chain(&new_events)
+        .map(|event| event.at)
+        .collect();
+    addresses.sort_unstable();
+    addresses.dedup();
+    old_events.sort_by_key(|event| (event.at, event.add, event.rule_index));
+    new_events.sort_by_key(|event| (event.at, event.add, event.rule_index));
+
+    let mut old_cursor = 0;
+    let mut new_cursor = 0;
+    for (address_position, &address_start) in addresses.iter().enumerate() {
+        apply_events_at(
+            &old_events,
+            &mut old_cursor,
+            address_start,
+            old,
+            &mut old_tree,
+        );
+        apply_events_at(
+            &new_events,
+            &mut new_cursor,
+            address_start,
+            proposed,
+            &mut new_tree,
+        );
+        if old_tree.is_empty() && new_tree.is_empty() {
+            continue;
+        }
+
+        let address_end = addresses
+            .get(address_position + 1)
+            .map_or(family.maximum(), |next| next - 1);
+        let old_runs = old_tree.runs();
+        let new_runs = new_tree.runs();
+
+        for run in &new_runs {
+            if let Some(rule_index) = run.winner
+                && reachable_witnesses[rule_index].is_none()
+            {
+                reachable_witnesses[rule_index] = Some(Witness {
+                    source_ip: format_address(family, address_start),
+                    protocol,
+                    destination_port: run.start,
+                });
+            }
+        }
+
+        compare_runs(
+            old,
+            proposed,
+            family,
+            protocol,
+            address_start,
+            address_end,
+            &old_runs,
+            &new_runs,
+            changes,
+        );
+    }
+}
+
+fn matching_indexes(policy: &ValidatedPolicy, family: IpFamily, protocol: Protocol) -> Vec<usize> {
+    policy
+        .rules
+        .iter()
+        .enumerate()
+        .filter_map(|(index, rule)| {
+            (rule.family == family && rule.protocol == protocol).then_some(index)
+        })
+        .collect()
+}
+
+fn make_events(policy: &ValidatedPolicy, indexes: &[usize], maximum: u128) -> Vec<Event> {
+    let mut events = Vec::with_capacity(indexes.len() * 2);
+    for &rule_index in indexes {
+        let rule = &policy.rules[rule_index];
+        events.push(Event {
+            at: rule.source_start,
+            rule_index,
+            add: true,
+        });
+        if rule.source_end < maximum {
+            events.push(Event {
+                at: rule.source_end + 1,
+                rule_index,
+                add: false,
+            });
+        }
+    }
+    events
+}
+
+fn apply_events_at(
+    events: &[Event],
+    cursor: &mut usize,
+    address: u128,
+    policy: &ValidatedPolicy,
+    tree: &mut PortTree,
+) {
+    while *cursor < events.len() && events[*cursor].at == address {
+        let event = events[*cursor];
+        let rule = &policy.rules[event.rule_index];
+        tree.update(rule.port_start, rule.port_end, event.rule_index, event.add);
+        *cursor += 1;
+    }
+}
+
+#[allow(clippy::too_many_arguments)]
+fn compare_runs(
+    old: &ValidatedPolicy,
+    proposed: &ValidatedPolicy,
+    family: IpFamily,
+    protocol: Protocol,
+    address_start: u128,
+    address_end: u128,
+    old_runs: &[PortRun],
+    new_runs: &[PortRun],
+    changes: &mut Vec<ChangeRegion>,
+) {
+    let mut old_index = 0;
+    let mut new_index = 0;
+    while old_index < old_runs.len() && new_index < new_runs.len() {
+        let old_run = old_runs[old_index];
+        let new_run = new_runs[new_index];
+        let start = old_run.start.max(new_run.start);
+        let end = old_run.end.min(new_run.end);
+        let old_decision = decision_for_winner(old, old_run.winner);
+        let new_decision = decision_for_winner(proposed, new_run.winner);
+
+        if old_decision.action != new_decision.action {
+            let kind = if new_decision.action == Action::Allow {
+                ChangeKind::NewlyAllowed
+            } else {
+                ChangeKind::NewlyDenied
+            };
+            changes.push(ChangeRegion {
+                kind,
+                ip_family: family,
+                source_start: format_address(family, address_start),
+                source_end: format_address(family, address_end),
+                protocol,
+                port_start: start,
+                port_end: end,
+                old_decision: old_decision.action,
+                old_rule_id: old_decision.rule_id,
+                new_decision: new_decision.action,
+                new_rule_id: new_decision.rule_id,
+                witness: Witness {
+                    source_ip: format_address(family, address_start),
+                    protocol,
+                    destination_port: start,
+                },
+                source_start_num: address_start,
+                source_end_num: address_end,
+            });
+        }
+
+        if old_run.end == end {
+            old_index += 1;
+        }
+        if new_run.end == end {
+            new_index += 1;
+        }
+    }
+}
+
+fn decision_for_winner(policy: &ValidatedPolicy, winner: Option<usize>) -> Decision {
+    winner.map_or_else(
+        || Decision {
+            action: Action::Deny,
+            rule_id: "default-deny".to_string(),
+        },
+        |index| Decision {
+            action: policy.rules[index].action,
+            rule_id: policy.rules[index].id.clone(),
+        },
+    )
+}
+
+fn normalize_regions(mut regions: Vec<ChangeRegion>) -> Vec<ChangeRegion> {
+    regions.sort_by(|a, b| vertical_key(a).cmp(&vertical_key(b)));
+    let mut vertically_merged: Vec<ChangeRegion> = Vec::with_capacity(regions.len());
+    for region in regions {
+        if let Some(last) = vertically_merged.last_mut()
+            && same_except_address(last, &region)
+            && last.source_end_num.checked_add(1) == Some(region.source_start_num)
+        {
+            last.source_end_num = region.source_end_num;
+            last.source_end = region.source_end;
+            continue;
+        }
+        vertically_merged.push(region);
+    }
+
+    vertically_merged.sort_by(compare_region_order);
+    let mut normalized: Vec<ChangeRegion> = Vec::with_capacity(vertically_merged.len());
+    for region in vertically_merged {
+        if let Some(last) = normalized.last_mut()
+            && same_except_port(last, &region)
+            && last.port_end.checked_add(1) == Some(region.port_start)
+        {
+            last.port_end = region.port_end;
+            continue;
+        }
+        normalized.push(region);
+    }
+    normalized.sort_by(compare_region_order);
+    normalized
+}
+
+fn vertical_key(region: &ChangeRegion) -> impl Ord + '_ {
+    (
+        region.ip_family,
+        region.protocol,
+        region.port_start,
+        region.port_end,
+        region.kind.clone(),
+        region.old_decision,
+        region.old_rule_id.as_str(),
+        region.new_decision,
+        region.new_rule_id.as_str(),
+        region.source_start_num,
+        region.source_end_num,
+    )
+}
+
+fn compare_region_order(a: &ChangeRegion, b: &ChangeRegion) -> std::cmp::Ordering {
+    (
+        a.ip_family,
+        a.source_start_num,
+        a.source_end_num,
+        a.protocol,
+        a.port_start,
+        a.port_end,
+        &a.kind,
+        a.old_decision,
+        a.old_rule_id.as_str(),
+        a.new_decision,
+        a.new_rule_id.as_str(),
+    )
+        .cmp(&(
+            b.ip_family,
+            b.source_start_num,
+            b.source_end_num,
+            b.protocol,
+            b.port_start,
+            b.port_end,
+            &b.kind,
+            b.old_decision,
+            b.old_rule_id.as_str(),
+            b.new_decision,
+            b.new_rule_id.as_str(),
+        ))
+}
+
+fn same_except_address(a: &ChangeRegion, b: &ChangeRegion) -> bool {
+    a.ip_family == b.ip_family
+        && a.protocol == b.protocol
+        && a.port_start == b.port_start
+        && a.port_end == b.port_end
+        && a.kind == b.kind
+        && a.old_decision == b.old_decision
+        && a.old_rule_id == b.old_rule_id
+        && a.new_decision == b.new_decision
+        && a.new_rule_id == b.new_rule_id
+}
+
+fn same_except_port(a: &ChangeRegion, b: &ChangeRegion) -> bool {
+    a.ip_family == b.ip_family
+        && a.source_start_num == b.source_start_num
+        && a.source_end_num == b.source_end_num
+        && a.protocol == b.protocol
+        && a.kind == b.kind
+        && a.old_decision == b.old_decision
+        && a.old_rule_id == b.old_rule_id
+        && a.new_decision == b.new_decision
+        && a.new_rule_id == b.new_rule_id
+}
+
+fn format_address(family: IpFamily, raw: u128) -> String {
+    match family {
+        IpFamily::Ipv4 => std::net::Ipv4Addr::from(raw as u32).to_string(),
+        IpFamily::Ipv6 => std::net::Ipv6Addr::from(raw).to_string(),
+    }
+}
+
+struct PortTree {
+    coordinates: Vec<u32>,
+    size: usize,
+    own: Vec<BTreeSet<usize>>,
+    subtree_minimum: Vec<Option<usize>>,
+}
+
+impl PortTree {
+    fn new(coordinates: Vec<u32>) -> Self {
+        let size = coordinates.len().next_power_of_two();
+        Self {
+            coordinates,
+            size,
+            own: vec![BTreeSet::new(); size * 2],
+            subtree_minimum: vec![None; size * 2],
+        }
+    }
+
+    fn is_empty(&self) -> bool {
+        self.subtree_minimum[1].is_none()
+    }
+
+    fn update(&mut self, start: u16, end: u16, rule_index: usize, add: bool) {
+        let left = self.coordinates.binary_search(&(start as u32)).unwrap();
+        let right = if end == u16::MAX {
+            self.coordinates.len() - 1
+        } else {
+            self.coordinates.binary_search(&(end as u32 + 1)).unwrap() - 1
+        };
+        self.update_node(1, 0, self.size - 1, left, right, rule_index, add);
+    }
+
+    #[allow(clippy::too_many_arguments)]
+    fn update_node(
+        &mut self,
+        node: usize,
+        left: usize,
+        right: usize,
+        query_left: usize,
+        query_right: usize,
+        rule_index: usize,
+        add: bool,
+    ) {
+        if query_left <= left && right <= query_right {
+            if add {
+                self.own[node].insert(rule_index);
+            } else {
+                let removed = self.own[node].remove(&rule_index);
+                debug_assert!(removed);
+            }
+            self.pull(node);
+            return;
+        }
+        let middle = (left + right) / 2;
+        if query_left <= middle {
+            self.update_node(
+                node * 2,
+                left,
+                middle,
+                query_left,
+                query_right,
+                rule_index,
+                add,
+            );
+        }
+        if query_right > middle {
+            self.update_node(
+                node * 2 + 1,
+                middle + 1,
+                right,
+                query_left,
+                query_right,
+                rule_index,
+                add,
+            );
+        }
+        self.pull(node);
+    }
+
+    fn pull(&mut self, node: usize) {
+        let mut minimum = self.own[node].first().copied();
+        if node < self.size {
+            minimum = option_min(minimum, self.subtree_minimum[node * 2]);
+            minimum = option_min(minimum, self.subtree_minimum[node * 2 + 1]);
+        }
+        self.subtree_minimum[node] = minimum;
+    }
+
+    fn runs(&self) -> Vec<PortRun> {
+        let mut runs = Vec::new();
+        self.collect_runs(1, 0, self.size - 1, None, &mut runs);
+        runs
+    }
+
+    fn collect_runs(
+        &self,
+        node: usize,
+        left: usize,
+        right: usize,
+        inherited: Option<usize>,
+        runs: &mut Vec<PortRun>,
+    ) {
+        if left >= self.coordinates.len() {
+            return;
+        }
+        let own_minimum = self.own[node].first().copied();
+        let base = option_min(inherited, own_minimum);
+        let descendant_minimum = if node < self.size {
+            option_min(
+                self.subtree_minimum[node * 2],
+                self.subtree_minimum[node * 2 + 1],
+            )
+        } else {
+            None
+        };
+        let uniform = match (base, descendant_minimum) {
+            (_, None) => true,
+            (Some(base), Some(descendant)) => base <= descendant,
+            (None, Some(_)) => false,
+        };
+
+        if left == right || uniform {
+            let capped_right = right.min(self.coordinates.len() - 1);
+            let start = self.coordinates[left] as u16;
+            let end = self
+                .coordinates
+                .get(capped_right + 1)
+                .map_or(u16::MAX, |next| (*next - 1) as u16);
+            push_port_run(
+                runs,
+                PortRun {
+                    start,
+                    end,
+                    winner: base,
+                },
+            );
+            return;
+        }
+
+        let middle = (left + right) / 2;
+        self.collect_runs(node * 2, left, middle, base, runs);
+        self.collect_runs(node * 2 + 1, middle + 1, right, base, runs);
+    }
+}
+
+fn option_min(left: Option<usize>, right: Option<usize>) -> Option<usize> {
+    match (left, right) {
+        (Some(left), Some(right)) => Some(left.min(right)),
+        (Some(value), None) | (None, Some(value)) => Some(value),
+        (None, None) => None,
+    }
+}
+
+fn push_port_run(runs: &mut Vec<PortRun>, run: PortRun) {
+    if let Some(last) = runs.last_mut()
+        && last.winner == run.winner
+        && last.end.checked_add(1) == Some(run.start)
+    {
+        last.end = run.end;
+        return;
+    }
+    runs.push(run);
+}
+
+pub fn report_json(report: &Report) -> Result<Vec<u8>, String> {
+    let mut bytes = serde_json::to_vec_pretty(report).map_err(|error| error.to_string())?;
+    bytes.push(b'\n');
+    Ok(bytes)
+}
+
+pub fn write_report(path: &Path, report: &Report) -> Result<(), String> {
+    let bytes = report_json(report)?;
+    let parent = path
+        .parent()
+        .ok_or_else(|| format!("report path {} has no parent", path.display()))?;
+    let name = path
+        .file_name()
+        .and_then(|name| name.to_str())
+        .ok_or_else(|| format!("report path {} has no valid file name", path.display()))?;
+    const MAX_TEMPORARY_ATTEMPTS: usize = 256;
+    for attempt in 0..MAX_TEMPORARY_ATTEMPTS {
+        let suffix = if attempt == 0 {
+            String::new()
+        } else {
+            format!("-{attempt}")
+        };
+        let temporary = parent.join(format!(".{name}.tmp-{}{suffix}", std::process::id()));
+        let mut file = match std::fs::OpenOptions::new()
+            .write(true)
+            .create_new(true)
+            .open(&temporary)
+        {
+            Ok(file) => file,
+            Err(error) if error.kind() == ErrorKind::AlreadyExists => continue,
+            Err(error) => {
+                return Err(format!(
+                    "cannot create temporary report {}: {error}",
+                    temporary.display()
+                ));
+            }
+        };
+
+        let write_result = file.write_all(&bytes).and_then(|()| file.sync_all());
+        drop(file);
+        if let Err(error) = write_result {
+            let cleanup_suffix = cleanup_owned_temporary(&temporary);
+            return Err(format!(
+                "cannot write temporary report {}: {error}{cleanup_suffix}",
+                temporary.display()
+            ));
+        }
+        if let Err(error) = std::fs::rename(&temporary, path) {
+            let cleanup_suffix = cleanup_owned_temporary(&temporary);
+            return Err(format!(
+                "cannot publish report {}: {error}{cleanup_suffix}",
+                path.display()
+            ));
+        }
+        return Ok(());
+    }
+
+    Err(format!(
+        "cannot create a fresh temporary report after {MAX_TEMPORARY_ATTEMPTS} collisions for {}",
+        path.display()
+    ))
+}
+
+fn cleanup_owned_temporary(path: &Path) -> String {
+    std::fs::remove_file(path)
+        .err()
+        .map_or_else(String::new, |cleanup_error| {
+            format!(
+                "; additionally cannot remove owned temporary report {}: {cleanup_error}",
+                path.display()
+            )
+        })
+}
+
+pub fn verify_report(
+    old: &ValidatedPolicy,
+    proposed: &ValidatedPolicy,
+    report: &Report,
+) -> Result<(usize, usize), String> {
+    let fresh = analyze(old, proposed);
+    if report_json(&fresh)? != report_json(report)? {
+        return Err("report does not byte-semantically match a fresh exact analysis".to_string());
+    }
+
+    let mut change_witnesses = 0;
+    for region in &report.changes {
+        let packet = parse_packet(
+            &region.witness.source_ip,
+            region.witness.protocol,
+            region.witness.destination_port,
+        )?;
+        let source_start = parse_address_for_family(&region.source_start, region.ip_family)?;
+        let source_end = parse_address_for_family(&region.source_end, region.ip_family)?;
+        if packet.family != region.ip_family
+            || packet.source < source_start
+            || packet.source > source_end
+            || packet.destination_port < region.port_start
+            || packet.destination_port > region.port_end
+        {
+            return Err(format!(
+                "change witness is outside region: {:?}",
+                region.witness
+            ));
+        }
+        let old_decision = evaluate_linear(old, packet);
+        let new_decision = evaluate_linear(proposed, packet);
+        if old_decision.action != region.old_decision
+            || old_decision.rule_id != region.old_rule_id
+            || new_decision.action != region.new_decision
+            || new_decision.rule_id != region.new_rule_id
+        {
+            return Err(format!(
+                "change witness did not reproduce decisions: {:?}",
+                region.witness
+            ));
+        }
+        change_witnesses += 1;
+    }
+
+    let mut reachability_witnesses = 0;
+    for reachability in &report.proposed_rule_reachability {
+        if let Some(witness) = &reachability.witness {
+            let packet = parse_packet(
+                &witness.source_ip,
+                witness.protocol,
+                witness.destination_port,
+            )?;
+            let decision = evaluate_linear(proposed, packet);
+            if decision.rule_id != reachability.rule_id {
+                return Err(format!(
+                    "reachability witness for {:?} reached {:?}",
+                    reachability.rule_id, decision.rule_id
+                ));
+            }
+            reachability_witnesses += 1;
+        }
+    }
+    Ok((change_witnesses, reachability_witnesses))
+}
+
+fn parse_address_for_family(text: &str, family: IpFamily) -> Result<u128, String> {
+    let address: IpAddr = text
+        .parse()
+        .map_err(|_| format!("invalid {:?} address {text:?} in report", family))?;
+    match (family, address) {
+        (IpFamily::Ipv4, IpAddr::V4(address)) => Ok(u32::from(address) as u128),
+        (IpFamily::Ipv6, IpAddr::V6(address)) => Ok(u128::from(address)),
+        _ => Err(format!("address {text:?} does not match {:?}", family)),
+    }
+}
+
+#[derive(Debug, Clone, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct SamplePacket {
+    pub source_ip: String,
+    pub protocol: Protocol,
+    pub destination_port: u16,
+}
+
+#[derive(Debug, Clone, Serialize)]
+pub struct SampleReplayResult {
+    pub sample_count: usize,
+    pub changed_sample_count: usize,
+    pub changed_samples: Vec<SampleReplayChange>,
+    pub warning: String,
+}
+
+#[derive(Debug, Clone, Serialize)]
+pub struct SampleReplayChange {
+    pub sample_index: usize,
+    pub packet: Witness,
+    pub old: Decision,
+    pub proposed: Decision,
+}
+
+pub fn replay_samples(
+    old: &ValidatedPolicy,
+    proposed: &ValidatedPolicy,
+    bytes: &[u8],
+) -> Result<SampleReplayResult, String> {
+    let samples: Vec<SamplePacket> = serde_json::from_slice(bytes)
+        .map_err(|error| format!("invalid sample packet JSON or schema: {error}"))?;
+    let mut changed_samples = Vec::new();
+    for (sample_index, sample) in samples.iter().enumerate() {
+        let packet = parse_packet(&sample.source_ip, sample.protocol, sample.destination_port)?;
+        let old_decision = evaluate_linear(old, packet);
+        let new_decision = evaluate_linear(proposed, packet);
+        if old_decision.action != new_decision.action {
+            changed_samples.push(SampleReplayChange {
+                sample_index,
+                packet: Witness {
+                    source_ip: sample.source_ip.clone(),
+                    protocol: sample.protocol,
+                    destination_port: sample.destination_port,
+                },
+                old: old_decision,
+                proposed: new_decision,
+            });
+        }
+    }
+    Ok(SampleReplayResult {
+        sample_count: samples.len(),
+        changed_sample_count: changed_samples.len(),
+        changed_samples,
+        warning: "sample replay is incomplete evidence and never establishes no semantic change"
+            .to_string(),
+    })
+}
+
+pub fn generate_benchmark_pair(rule_count: usize, seed: u64) -> (PolicyFile, PolicyFile) {
+    assert!(rule_count > 0);
+    let mut rules = Vec::with_capacity(rule_count);
+    let mut random = SplitMix64::new(seed);
+    let mut pair_index = 0usize;
+    while rules.len() < rule_count {
+        let family = if pair_index.is_multiple_of(2) {
+            IpFamily::Ipv4
+        } else {
+            IpFamily::Ipv6
+        };
+        let protocol = if random.next_u64() & 1 == 0 {
+            Protocol::Tcp
+        } else {
+            Protocol::Udp
+        };
+        let action = if pair_index == 0 || random.next_u64() & 1 == 0 {
+            Action::Deny
+        } else {
+            Action::Allow
+        };
+        let (cidr, prefix) = if family == IpFamily::Ipv4 {
+            let raw = 0x0a00_0000u32 + (pair_index / 2) as u32;
+            (std::net::Ipv4Addr::from(raw).to_string(), 32)
+        } else {
+            let raw = 0x2001_0db8_0000_0000_0000_0000_0000_0000u128 + (pair_index / 2) as u128;
+            (std::net::Ipv6Addr::from(raw).to_string(), 128)
+        };
+        let (first, end) = if pair_index == 0 {
+            (0, u16::MAX)
+        } else {
+            let first = random.next_u64() as u16;
+            let width = (random.next_u64() % 1024) as u16;
+            (first, first.saturating_add(width))
+        };
+        let primary = benchmark_rule(
+            &format!("primary-{pair_index:05}"),
+            action,
+            family,
+            &format!("{cidr}/{prefix}"),
+            protocol,
+            first,
+            end,
+        );
+        rules.push(primary.clone());
+        if rules.len() < rule_count {
+            let mut shadow = primary;
+            shadow.id = format!("shadow-{pair_index:05}");
+            shadow.action = match action {
+                Action::Allow => Action::Deny,
+                Action::Deny => Action::Allow,
+            };
+            rules.push(shadow);
+        }
+        pair_index += 1;
+    }
+    let old = PolicyFile { rules };
+    let mut proposed = old.clone();
+    proposed.rules[0].action = Action::Allow;
+    (old, proposed)
+}
+
+fn benchmark_rule(
+    id: &str,
+    action: Action,
+    ip_family: IpFamily,
+    source_cidr: &str,
+    protocol: Protocol,
+    port_start: u16,
+    port_end: u16,
+) -> RuleInput {
+    RuleInput {
+        id: id.to_string(),
+        action,
+        ip_family,
+        source_cidr: source_cidr.to_string(),
+        protocol,
+        port_start,
+        port_end,
+    }
+}
+
+fn canonical_start(raw: u128, family: IpFamily, prefix: u8) -> u128 {
+    let maximum = family.maximum();
+    let host_mask = if prefix == family.bits() {
+        0
+    } else {
+        maximum >> prefix
+    };
+    (raw & maximum) & !host_mask
+}
+
+pub fn write_benchmark_fixture(
+    directory: &Path,
+    rule_count: usize,
+    seed: u64,
+) -> Result<(), String> {
+    std::fs::create_dir_all(directory)
+        .map_err(|error| format!("cannot create {}: {error}", directory.display()))?;
+    let (old, proposed) = generate_benchmark_pair(rule_count, seed);
+    let mut old_bytes = serde_json::to_vec(&old).map_err(|error| error.to_string())?;
+    old_bytes.push(b'\n');
+    let mut proposed_bytes = serde_json::to_vec(&proposed).map_err(|error| error.to_string())?;
+    proposed_bytes.push(b'\n');
+    std::fs::write(directory.join("old.json"), old_bytes)
+        .map_err(|error| format!("cannot write benchmark old policy: {error}"))?;
+    std::fs::write(directory.join("proposed.json"), proposed_bytes)
+        .map_err(|error| format!("cannot write benchmark proposed policy: {error}"))?;
+    Ok(())
+}
+
+pub fn validation_suite(
+    small_pair_count: usize,
+    full_pair_count: usize,
+    total_probe_count: usize,
+    seed: u64,
+) -> Result<String, String> {
+    let mut random = SplitMix64::new(seed);
+    let mut exhaustive_packets = 0usize;
+    for pair_index in 0..small_pair_count {
+        let (old, proposed) = generated_small_pair(&mut random, pair_index);
+        let report = analyze(&old, &proposed);
+        exhaustive_packets += verify_reduced_pair(&old, &proposed, &report)?;
+    }
+
+    let base_probes = total_probe_count / full_pair_count;
+    let extra_probes = total_probe_count % full_pair_count;
+    let mut probes = 0usize;
+    for pair_index in 0..full_pair_count {
+        let (old, proposed) = generated_full_pair(&mut random, pair_index);
+        let report = analyze(&old, &proposed);
+        let pair_probes = base_probes + usize::from(pair_index < extra_probes);
+        verify_boundary_probes(&old, &proposed, &report, pair_probes, &mut random)?;
+        probes += pair_probes;
+    }
+
+    Ok(format!(
+        "small_pairs={small_pair_count} exhaustive_packets={exhaustive_packets} full_width_pairs={full_pair_count} boundary_probes={probes} disagreements=0"
+    ))
+}
+
+fn generated_small_pair(
+    random: &mut SplitMix64,
+    pair_index: usize,
+) -> (ValidatedPolicy, ValidatedPolicy) {
+    let count = 1 + (random.next_u64() % 7) as usize;
+    let mut old_inputs = Vec::with_capacity(count);
+    for rule_index in 0..count {
+        old_inputs.push(random_small_rule(
+            random,
+            format!("r{pair_index}-{rule_index}"),
+        ));
+    }
+    let mut proposed_inputs = old_inputs.clone();
+    match random.next_u64() % 4 {
+        0 => {
+            let position = (random.next_u64() as usize) % (proposed_inputs.len() + 1);
+            proposed_inputs.insert(
+                position,
+                random_small_rule(random, format!("inserted-{pair_index}")),
+            );
+        }
+        1 if proposed_inputs.len() > 1 => {
+            let position = (random.next_u64() as usize) % proposed_inputs.len();
+            proposed_inputs.remove(position);
+        }
+        2 if proposed_inputs.len() > 1 => {
+            let from = (random.next_u64() as usize) % proposed_inputs.len();
+            let rule = proposed_inputs.remove(from);
+            let to = (random.next_u64() as usize) % (proposed_inputs.len() + 1);
+            proposed_inputs.insert(to, rule);
+        }
+        _ => {
+            let position = (random.next_u64() as usize) % proposed_inputs.len();
+            proposed_inputs[position].action = match proposed_inputs[position].action {
+                Action::Allow => Action::Deny,
+                Action::Deny => Action::Allow,
+            };
+        }
+    }
+    (
+        validated_from_inputs(old_inputs),
+        validated_from_inputs(proposed_inputs),
+    )
+}
+
+fn random_small_rule(random: &mut SplitMix64, id: String) -> RuleInput {
+    let prefix = 28 + (random.next_u64() % 5) as u8;
+    let address = (random.next_u64() % 16) as u8;
+    let block = 1u8 << (32 - prefix);
+    let canonical = address / block * block;
+    let first = (random.next_u64() % 8) as u16;
+    let second = (random.next_u64() % 8) as u16;
+    RuleInput {
+        id,
+        action: if random.next_u64() & 1 == 0 {
+            Action::Allow
+        } else {
+            Action::Deny
+        },
+        ip_family: IpFamily::Ipv4,
+        source_cidr: format!("0.0.0.{canonical}/{prefix}"),
+        protocol: if random.next_u64() & 1 == 0 {
+            Protocol::Tcp
+        } else {
+            Protocol::Udp
+        },
+        port_start: first.min(second),
+        port_end: first.max(second),
+    }
+}
+
+fn validated_from_inputs(rules: Vec<RuleInput>) -> ValidatedPolicy {
+    let bytes = serde_json::to_vec(&PolicyFile { rules }).unwrap();
+    parse_and_validate(&bytes, "generated policy").unwrap()
+}
+
+fn verify_reduced_pair(
+    old: &ValidatedPolicy,
+    proposed: &ValidatedPolicy,
+    report: &Report,
+) -> Result<usize, String> {
+    let mut expected_reachable = vec![false; proposed.rules.len()];
+    let mut packet_count = 0;
+    for address in 0..16u128 {
+        for protocol in [Protocol::Tcp, Protocol::Udp] {
+            for port in 0..8u16 {
+                packet_count += 1;
+                let packet = Packet {
+                    family: IpFamily::Ipv4,
+                    source: address,
+                    protocol,
+                    destination_port: port,
+                };
+                let old_decision = evaluate_linear(old, packet);
+                let new_decision = evaluate_linear(proposed, packet);
+                if let Some(index) = proposed
+                    .rules
+                    .iter()
+                    .position(|rule| rule.id == new_decision.rule_id)
+                {
+                    expected_reachable[index] = true;
+                }
+                let containing: Vec<_> = report
+                    .changes
+                    .iter()
+                    .filter(|region| region_contains(region, packet))
+                    .collect();
+                let expected_change = old_decision.action != new_decision.action;
+                if containing.len() != usize::from(expected_change) {
+                    return Err(format!(
+                        "reduced exhaustive mismatch for packet {:?}: expected_change={expected_change} containing_regions={}",
+                        packet,
+                        containing.len()
+                    ));
+                }
+                if let Some(region) = containing.first()
+                    && (region.old_decision != old_decision.action
+                        || region.old_rule_id != old_decision.rule_id
+                        || region.new_decision != new_decision.action
+                        || region.new_rule_id != new_decision.rule_id)
+                {
+                    return Err(format!("reduced decision mismatch for packet {packet:?}"));
+                }
+            }
+        }
+    }
+    for (index, reachability) in report.proposed_rule_reachability.iter().enumerate() {
+        if reachability.reachable != expected_reachable[index] {
+            return Err(format!(
+                "reduced reachability mismatch for rule {:?}",
+                reachability.rule_id
+            ));
+        }
+    }
+    verify_report(old, proposed, report)?;
+    Ok(packet_count)
+}
+
+fn generated_full_pair(
+    random: &mut SplitMix64,
+    pair_index: usize,
+) -> (ValidatedPolicy, ValidatedPolicy) {
+    let count = 2 + (random.next_u64() % 10) as usize;
+    let mut old_inputs = Vec::with_capacity(count);
+    for rule_index in 0..count {
+        old_inputs.push(random_full_rule(
+            random,
+            format!("f{pair_index}-{rule_index}"),
+        ));
+    }
+    let mut proposed_inputs = old_inputs.clone();
+    let position = (random.next_u64() as usize) % proposed_inputs.len();
+    proposed_inputs[position].action = match proposed_inputs[position].action {
+        Action::Allow => Action::Deny,
+        Action::Deny => Action::Allow,
+    };
+    (
+        validated_from_inputs(old_inputs),
+        validated_from_inputs(proposed_inputs),
+    )
+}
+
+fn random_full_rule(random: &mut SplitMix64, id: String) -> RuleInput {
+    let family = if random.next_u64() & 1 == 0 {
+        IpFamily::Ipv4
+    } else {
+        IpFamily::Ipv6
+    };
+    let prefix = if family == IpFamily::Ipv4 {
+        (random.next_u64() % 33) as u8
+    } else {
+        (random.next_u64() % 129) as u8
+    };
+    let start = canonical_start(random.next_u128(), family, prefix);
+    let first = random.next_u64() as u16;
+    let second = random.next_u64() as u16;
+    RuleInput {
+        id,
+        action: if random.next_u64() & 1 == 0 {
+            Action::Allow
+        } else {
+            Action::Deny
+        },
+        ip_family: family,
+        source_cidr: format!("{}/{}", format_address(family, start), prefix),
+        protocol: if random.next_u64() & 1 == 0 {
+            Protocol::Tcp
+        } else {
+            Protocol::Udp
+        },
+        port_start: first.min(second),
+        port_end: first.max(second),
+    }
+}
+
+fn verify_boundary_probes(
+    old: &ValidatedPolicy,
+    proposed: &ValidatedPolicy,
+    report: &Report,
+    probe_count: usize,
+    random: &mut SplitMix64,
+) -> Result<(), String> {
+    let mut address_candidates = vec![
+        (IpFamily::Ipv4, 0),
+        (IpFamily::Ipv4, u32::MAX as u128),
+        (IpFamily::Ipv6, 0),
+        (IpFamily::Ipv6, u128::MAX),
+    ];
+    let mut port_candidates = vec![0, u16::MAX];
+    for rule in old.rules.iter().chain(&proposed.rules) {
+        for address in [rule.source_start, rule.source_end] {
+            address_candidates.push((rule.family, address));
+            if address > 0 {
+                address_candidates.push((rule.family, address - 1));
+            }
+            if address < rule.family.maximum() {
+                address_candidates.push((rule.family, address + 1));
+            }
+        }
+        for port in [rule.port_start, rule.port_end] {
+            port_candidates.push(port);
+            if port > 0 {
+                port_candidates.push(port - 1);
+            }
+            if port < u16::MAX {
+                port_candidates.push(port + 1);
+            }
+        }
+    }
+    for probe_index in 0..probe_count {
+        let (family, source) = if probe_index % 3 == 0 {
+            address_candidates[(random.next_u64() as usize) % address_candidates.len()]
+        } else if random.next_u64() & 1 == 0 {
+            (IpFamily::Ipv4, random.next_u64() as u32 as u128)
+        } else {
+            (IpFamily::Ipv6, random.next_u128())
+        };
+        let destination_port = if probe_index % 3 == 0 {
+            port_candidates[(random.next_u64() as usize) % port_candidates.len()]
+        } else {
+            random.next_u64() as u16
+        };
+        let protocol = if random.next_u64() & 1 == 0 {
+            Protocol::Tcp
+        } else {
+            Protocol::Udp
+        };
+        let packet = Packet {
+            family,
+            source,
+            protocol,
+            destination_port,
+        };
+        let old_decision = evaluate_linear(old, packet);
+        let new_decision = evaluate_linear(proposed, packet);
+        let containing: Vec<_> = report
+            .changes
+            .iter()
+            .filter(|region| region_contains(region, packet))
+            .collect();
+        let expected_change = old_decision.action != new_decision.action;
+        if containing.len() != usize::from(expected_change) {
+            return Err(format!(
+                "full-width probe mismatch for packet {:?}: expected_change={expected_change} containing_regions={}",
+                packet,
+                containing.len()
+            ));
+        }
+        if let Some(region) = containing.first()
+            && (region.old_decision != old_decision.action
+                || region.old_rule_id != old_decision.rule_id
+                || region.new_decision != new_decision.action
+                || region.new_rule_id != new_decision.rule_id)
+        {
+            return Err(format!(
+                "full-width decision mismatch for packet {packet:?}"
+            ));
+        }
+    }
+    verify_report(old, proposed, report)?;
+    Ok(())
+}
+
+pub fn region_contains(region: &ChangeRegion, packet: Packet) -> bool {
+    packet.family == region.ip_family
+        && packet.protocol == region.protocol
+        && region.source_start_num <= packet.source
+        && packet.source <= region.source_end_num
+        && region.port_start <= packet.destination_port
+        && packet.destination_port <= region.port_end
+}
+
+#[derive(Clone)]
+struct SplitMix64 {
+    state: u64,
+}
+
+impl SplitMix64 {
+    fn new(seed: u64) -> Self {
+        Self { state: seed }
+    }
+
+    fn next_u64(&mut self) -> u64 {
+        self.state = self.state.wrapping_add(0x9e3779b97f4a7c15);
+        let mut value = self.state;
+        value = (value ^ (value >> 30)).wrapping_mul(0xbf58476d1ce4e5b9);
+        value = (value ^ (value >> 27)).wrapping_mul(0x94d049bb133111eb);
+        value ^ (value >> 31)
+    }
+
+    fn next_u128(&mut self) -> u128 {
+        ((self.next_u64() as u128) << 64) | self.next_u64() as u128
+    }
+}
+
+pub fn diagnostics_for_errors(errors: &[String]) -> String {
+    let mut result = String::new();
+    for error in errors {
+        let _ = writeln!(result, "{error}");
+    }
+    result
+}
diff --git a/developer-simulation/runs/2026-08-09--firewall-policy-impact/src/main.rs b/developer-simulation/runs/2026-08-09--firewall-policy-impact/src/main.rs
new file mode 100644
index 0000000..9ba18d5
--- /dev/null
+++ b/developer-simulation/runs/2026-08-09--firewall-policy-impact/src/main.rs
@@ -0,0 +1,104 @@
+use firewall_policy_impact::{
+    Report, analyze_files_to_report, read_and_validate_pair, replay_samples, report_json,
+    validation_suite, verify_report, write_benchmark_fixture,
+};
+use std::path::Path;
+
+fn main() {
+    if let Err(error) = run() {
+        eprintln!("error: {error}");
+        std::process::exit(2);
+    }
+}
+
+fn run() -> Result<(), String> {
+    let arguments: Vec<String> = std::env::args().collect();
+    match arguments.get(1).map(String::as_str) {
+        Some("analyze") if arguments.len() == 5 => {
+            let old_path = Path::new(&arguments[2]);
+            let proposed_path = Path::new(&arguments[3]);
+            let report_path = Path::new(&arguments[4]);
+            let report = analyze_files_to_report(old_path, proposed_path, report_path)?;
+            println!(
+                "outcome={} change_regions={} reachable_rules={} unreachable_rules={} report={}",
+                report.summary.outcome,
+                report.changes.len(),
+                report.summary.proposed_reachable_rules,
+                report.summary.proposed_unreachable_rules,
+                report_path.display()
+            );
+            Ok(())
+        }
+        Some("verify") if arguments.len() == 5 => {
+            let (old, proposed) =
+                read_and_validate_pair(Path::new(&arguments[2]), Path::new(&arguments[3]))?;
+            let bytes = std::fs::read(&arguments[4])
+                .map_err(|error| format!("cannot read report {}: {error}", arguments[4]))?;
+            let report: Report = serde_json::from_slice(&bytes)
+                .map_err(|error| format!("invalid report JSON or schema: {error}"))?;
+            let (change_witnesses, reachability_witnesses) =
+                verify_report(&old, &proposed, &report)?;
+            println!(
+                "verified exact_report=true change_witnesses={change_witnesses} reachability_witnesses={reachability_witnesses}"
+            );
+            Ok(())
+        }
+        Some("sample-replay") if arguments.len() == 5 => {
+            let (old, proposed) =
+                read_and_validate_pair(Path::new(&arguments[2]), Path::new(&arguments[3]))?;
+            let sample_bytes = std::fs::read(&arguments[4])
+                .map_err(|error| format!("cannot read samples {}: {error}", arguments[4]))?;
+            let replay = replay_samples(&old, &proposed, &sample_bytes)?;
+            let mut output =
+                serde_json::to_vec_pretty(&replay).map_err(|error| error.to_string())?;
+            output.push(b'\n');
+            print!("{}", String::from_utf8(output).unwrap());
+            Ok(())
+        }
+        Some("generate-benchmark") if arguments.len() == 5 => {
+            let rule_count = parse_usize(&arguments[3], "rule count")?;
+            let seed = parse_u64(&arguments[4], "seed")?;
+            write_benchmark_fixture(Path::new(&arguments[2]), rule_count, seed)?;
+            println!(
+                "generated old_rules={rule_count} proposed_rules={rule_count} seed={seed} directory={}",
+                arguments[2]
+            );
+            Ok(())
+        }
+        Some("validate-suite") if arguments.len() == 6 => {
+            let small_pairs = parse_usize(&arguments[2], "small-pair count")?;
+            let full_pairs = parse_usize(&arguments[3], "full-width pair count")?;
+            let probes = parse_usize(&arguments[4], "probe count")?;
+            let seed = parse_u64(&arguments[5], "seed")?;
+            if full_pairs == 0 {
+                return Err("full-width pair count must be greater than zero".to_string());
+            }
+            println!(
+                "{}",
+                validation_suite(small_pairs, full_pairs, probes, seed)?
+            );
+            Ok(())
+        }
+        Some("canonicalize-report") if arguments.len() == 3 => {
+            let bytes = std::fs::read(&arguments[2])
+                .map_err(|error| format!("cannot read report {}: {error}", arguments[2]))?;
+            let report: Report = serde_json::from_slice(&bytes)
+                .map_err(|error| format!("invalid report JSON or schema: {error}"))?;
+            print!("{}", String::from_utf8(report_json(&report)?).unwrap());
+            Ok(())
+        }
+        _ => Err(usage()),
+    }
+}
+
+fn parse_usize(text: &str, name: &str) -> Result<usize, String> {
+    text.parse().map_err(|_| format!("invalid {name} {text:?}"))
+}
+
+fn parse_u64(text: &str, name: &str) -> Result<u64, String> {
+    text.parse().map_err(|_| format!("invalid {name} {text:?}"))
+}
+
+fn usage() -> String {
+    "usage:\n  firewall-policy-impact analyze OLD.json PROPOSED.json REPORT.json\n  firewall-policy-impact verify OLD.json PROPOSED.json REPORT.json\n  firewall-policy-impact sample-replay OLD.json PROPOSED.json SAMPLES.json\n  firewall-policy-impact generate-benchmark DIRECTORY RULE_COUNT SEED\n  firewall-policy-impact validate-suite SMALL_PAIRS FULL_PAIRS TOTAL_PROBES SEED\n  firewall-policy-impact canonicalize-report REPORT.json".to_string()
+}
diff --git a/developer-simulation/runs/2026-08-09--firewall-policy-impact/src/reference.rs b/developer-simulation/runs/2026-08-09--firewall-policy-impact/src/reference.rs
new file mode 100644
index 0000000..ec22e1b
--- /dev/null
+++ b/developer-simulation/runs/2026-08-09--firewall-policy-impact/src/reference.rs
@@ -0,0 +1,48 @@
+use crate::{Action, Decision, IpFamily, Packet, Protocol, ValidatedPolicy};
+
+/// Intentionally simple O(rules) first-match evaluator.
+///
+/// It shares only validated data types with the analyzer, not its sweep-line
+/// implementation. Tests and the `verify` command use it as an independent
+/// replay oracle for witnesses and probes.
+pub fn evaluate(policy: &ValidatedPolicy, packet: Packet) -> Decision {
+    for rule in &policy.rules {
+        if rule.family == packet.family
+            && rule.protocol == packet.protocol
+            && rule.source_start <= packet.source
+            && packet.source <= rule.source_end
+            && rule.port_start <= packet.destination_port
+            && packet.destination_port <= rule.port_end
+        {
+            return Decision {
+                action: rule.action,
+                rule_id: rule.id.clone(),
+            };
+        }
+    }
+
+    Decision {
+        action: Action::Deny,
+        rule_id: "default-deny".to_string(),
+    }
+}
+
+pub fn parse_packet(
+    source_ip: &str,
+    protocol: Protocol,
+    destination_port: u16,
+) -> Result<Packet, String> {
+    let ip: std::net::IpAddr = source_ip
+        .parse()
+        .map_err(|_| format!("invalid packet source_ip {source_ip:?}"))?;
+    let (family, source) = match ip {
+        std::net::IpAddr::V4(ip) => (IpFamily::Ipv4, u32::from(ip) as u128),
+        std::net::IpAddr::V6(ip) => (IpFamily::Ipv6, u128::from(ip)),
+    };
+    Ok(Packet {
+        family,
+        source,
+        protocol,
+        destination_port,
+    })
+}
diff --git a/developer-simulation/runs/2026-08-09--firewall-policy-impact/tests/acceptance.rs b/developer-simulation/runs/2026-08-09--firewall-policy-impact/tests/acceptance.rs
new file mode 100644
index 0000000..d6ab0b2
--- /dev/null
+++ b/developer-simulation/runs/2026-08-09--firewall-policy-impact/tests/acceptance.rs
@@ -0,0 +1,682 @@
+use firewall_policy_impact::{
+    Action, ChangeKind, IpFamily, Packet, PolicyFile, Protocol, RuleInput, analyze,
+    analyze_files_to_report, evaluate_linear, parse_and_validate, region_contains, report_json,
+    validation_suite, verify_report,
+};
+use std::sync::atomic::{AtomicU64, Ordering};
+
+fn rule(
+    id: &str,
+    action: Action,
+    family: IpFamily,
+    cidr: &str,
+    protocol: Protocol,
+    ports: (u16, u16),
+) -> RuleInput {
+    RuleInput {
+        id: id.to_string(),
+        action,
+        ip_family: family,
+        source_cidr: cidr.to_string(),
+        protocol,
+        port_start: ports.0,
+        port_end: ports.1,
+    }
+}
+
+fn policy(rules: Vec<RuleInput>) -> firewall_policy_impact::ValidatedPolicy {
+    let bytes = serde_json::to_vec(&PolicyFile { rules }).unwrap();
+    parse_and_validate(&bytes, "test").unwrap()
+}
+
+fn packet(family: IpFamily, source: u128, protocol: Protocol, port: u16) -> Packet {
+    Packet {
+        family,
+        source,
+        protocol,
+        destination_port: port,
+    }
+}
+
+#[test]
+fn hand_written_first_match_regressions() {
+    let cases = vec![
+        (
+            "insertion before allow",
+            policy(vec![rule(
+                "allow-all",
+                Action::Allow,
+                IpFamily::Ipv4,
+                "0.0.0.0/0",
+                Protocol::Tcp,
+                (0, 65535),
+            )]),
+            policy(vec![
+                rule(
+                    "inserted-deny",
+                    Action::Deny,
+                    IpFamily::Ipv4,
+                    "10.0.0.0/8",
+                    Protocol::Tcp,
+                    (443, 443),
+                ),
+                rule(
+                    "allow-all",
+                    Action::Allow,
+                    IpFamily::Ipv4,
+                    "0.0.0.0/0",
+                    Protocol::Tcp,
+                    (0, 65535),
+                ),
+            ]),
+            ChangeKind::NewlyDenied,
+        ),
+        (
+            "deletion of deny",
+            policy(vec![
+                rule(
+                    "deny",
+                    Action::Deny,
+                    IpFamily::Ipv4,
+                    "10.0.0.0/8",
+                    Protocol::Tcp,
+                    (0, 1023),
+                ),
+                rule(
+                    "allow",
+                    Action::Allow,
+                    IpFamily::Ipv4,
+                    "0.0.0.0/0",
+                    Protocol::Tcp,
+                    (0, 65535),
+                ),
+            ]),
+            policy(vec![rule(
+                "allow",
+                Action::Allow,
+                IpFamily::Ipv4,
+                "0.0.0.0/0",
+                Protocol::Tcp,
+                (0, 65535),
+            )]),
+            ChangeKind::NewlyAllowed,
+        ),
+        (
+            "rule reordering",
+            policy(vec![
+                rule(
+                    "allow-narrow",
+                    Action::Allow,
+                    IpFamily::Ipv4,
+                    "10.2.0.0/16",
+                    Protocol::Udp,
+                    (50, 100),
+                ),
+                rule(
+                    "deny-broad",
+                    Action::Deny,
+                    IpFamily::Ipv4,
+                    "10.0.0.0/8",
+                    Protocol::Udp,
+                    (0, 200),
+                ),
+            ]),
+            policy(vec![
+                rule(
+                    "deny-broad",
+                    Action::Deny,
+                    IpFamily::Ipv4,
+                    "10.0.0.0/8",
+                    Protocol::Udp,
+                    (0, 200),
+                ),
+                rule(
+                    "allow-narrow",
+                    Action::Allow,
+                    IpFamily::Ipv4,
+                    "10.2.0.0/16",
+                    Protocol::Udp,
+                    (50, 100),
+                ),
+            ]),
+            ChangeKind::NewlyDenied,
+        ),
+        (
+            "partial CIDR and port overlap",
+            policy(vec![rule(
+                "allow-old",
+                Action::Allow,
+                IpFamily::Ipv4,
+                "192.0.2.0/25",
+                Protocol::Tcp,
+                (100, 200),
+            )]),
+            policy(vec![rule(
+                "allow-new",
+                Action::Allow,
+                IpFamily::Ipv4,
+                "192.0.2.0/24",
+                Protocol::Tcp,
+                (150, 250),
+            )]),
+            ChangeKind::NewlyDenied,
+        ),
+        (
+            "default deny transition",
+            policy(vec![]),
+            policy(vec![rule(
+                "new-allow",
+                Action::Allow,
+                IpFamily::Ipv6,
+                "2001:db8::/126",
+                Protocol::Tcp,
+                (8443, 8443),
+            )]),
+            ChangeKind::NewlyAllowed,
+        ),
+    ];
+
+    for (name, old, proposed, expected_kind) in cases {
+        let report = analyze(&old, &proposed);
+        assert!(!report.changes.is_empty(), "{name}");
+        assert!(
+            report
+                .changes
+                .iter()
+                .any(|change| change.kind == expected_kind),
+            "{name}"
+        );
+        if name == "partial CIDR and port overlap" {
+            assert_eq!(report.summary.outcome, "newly-allowed-and-newly-denied");
+            assert!(
+                report
+                    .changes
+                    .iter()
+                    .any(|change| change.kind == ChangeKind::NewlyAllowed)
+            );
+        }
+        verify_report(&old, &proposed, &report).unwrap();
+    }
+}
+
+#[test]
+fn shadowing_reachability_and_semantically_neutral_edits() {
+    let old = policy(vec![
+        rule(
+            "broad",
+            Action::Allow,
+            IpFamily::Ipv4,
+            "10.0.0.0/8",
+            Protocol::Tcp,
+            (0, 65535),
+        ),
+        rule(
+            "same-shadow",
+            Action::Allow,
+            IpFamily::Ipv4,
+            "10.1.0.0/16",
+            Protocol::Tcp,
+            (80, 80),
+        ),
+        rule(
+            "opposite-shadow",
+            Action::Deny,
+            IpFamily::Ipv4,
+            "10.2.0.0/16",
+            Protocol::Tcp,
+            (443, 443),
+        ),
+    ]);
+    let proposed = policy(vec![
+        rule(
+            "broad",
+            Action::Allow,
+            IpFamily::Ipv4,
+            "10.0.0.0/8",
+            Protocol::Tcp,
+            (0, 65535),
+        ),
+        rule(
+            "same-shadow-edited",
+            Action::Allow,
+            IpFamily::Ipv4,
+            "10.1.0.0/24",
+            Protocol::Tcp,
+            (80, 81),
+        ),
+        rule(
+            "opposite-shadow",
+            Action::Deny,
+            IpFamily::Ipv4,
+            "10.2.0.0/16",
+            Protocol::Tcp,
+            (443, 443),
+        ),
+    ]);
+    let report = analyze(&old, &proposed);
+    assert_eq!(report.summary.outcome, "exact-no-semantic-change");
+    assert!(report.changes.is_empty());
+    assert!(report.proposed_rule_reachability[0].reachable);
+    assert!(!report.proposed_rule_reachability[1].reachable);
+    assert!(!report.proposed_rule_reachability[2].reachable);
+    verify_report(&old, &proposed, &report).unwrap();
+}
+
+#[test]
+fn families_protocols_and_extreme_ports_remain_separate() {
+    let old = policy(vec![]);
+    let proposed = policy(vec![
+        rule(
+            "v4-zero",
+            Action::Allow,
+            IpFamily::Ipv4,
+            "203.0.113.9/32",
+            Protocol::Tcp,
+            (0, 0),
+        ),
+        rule(
+            "v6-max",
+            Action::Allow,
+            IpFamily::Ipv6,
+            "2001:db8::1/128",
+            Protocol::Udp,
+            (65535, 65535),
+        ),
+    ]);
+    let report = analyze(&old, &proposed);
+    assert_eq!(report.changes.len(), 2);
+    for expected in [
+        packet(
+            IpFamily::Ipv4,
+            u32::from(std::net::Ipv4Addr::new(203, 0, 113, 9)) as u128,
+            Protocol::Tcp,
+            0,
+        ),
+        packet(
+            IpFamily::Ipv6,
+            u128::from("2001:db8::1".parse::<std::net::Ipv6Addr>().unwrap()),
+            Protocol::Udp,
+            65535,
+        ),
+    ] {
+        assert_eq!(
+            report
+                .changes
+                .iter()
+                .filter(|region| region_contains(region, expected))
+                .count(),
+            1
+        );
+    }
+    let wrong_family = packet(
+        IpFamily::Ipv6,
+        u128::from("::cb00:7109".parse::<std::net::Ipv6Addr>().unwrap()),
+        Protocol::Tcp,
+        0,
+    );
+    assert_eq!(
+        evaluate_linear(&proposed, wrong_family).action,
+        Action::Deny
+    );
+    verify_report(&old, &proposed, &report).unwrap();
+}
+
+#[test]
+fn malformed_inputs_are_rejected_before_analysis() {
+    let malformed = [
+        r#"{"rules":[{"id":"x","action":"permit","ip_family":"ipv4","source_cidr":"0.0.0.0/0","protocol":"tcp","port_start":0,"port_end":1}]}"#,
+        r#"{"rules":[{"id":"x","action":"allow","ip_family":"ipv4","source_cidr":"0.0.0.0/0","protocol":"icmp","port_start":0,"port_end":1}]}"#,
+        r#"{"rules":[{"id":"x","action":"allow","ip_family":"ipv4","source_cidr":"10.0.0.1/24","protocol":"tcp","port_start":0,"port_end":1}]}"#,
+        r#"{"rules":[{"id":"x","action":"allow","ip_family":"ipv4","source_cidr":"2001:db8::/32","protocol":"tcp","port_start":0,"port_end":1}]}"#,
+        r#"{"rules":[{"id":"x","action":"allow","ip_family":"ipv4","source_cidr":"0.0.0.0/0","protocol":"tcp","port_start":2,"port_end":1}]}"#,
+        r#"{"rules":[{"id":"x","action":"allow","ip_family":"ipv4","source_cidr":"0.0.0.0/0","protocol":"tcp","port_start":0,"port_end":1},{"id":"x","action":"deny","ip_family":"ipv4","source_cidr":"10.0.0.0/8","protocol":"udp","port_start":0,"port_end":1}]}"#,
+    ];
+    for input in malformed {
+        assert!(
+            parse_and_validate(input.as_bytes(), "bad").is_err(),
+            "{input}"
+        );
+    }
+}
+
+#[test]
+fn implicit_default_marker_cannot_be_used_as_a_real_rule_id() {
+    let input = r#"{"rules":[{"id":"default-deny","action":"allow","ip_family":"ipv4","source_cidr":"0.0.0.0/0","protocol":"tcp","port_start":0,"port_end":65535}]}"#;
+    let errors = parse_and_validate(input.as_bytes(), "adversarial policy").unwrap_err();
+    assert_eq!(errors.len(), 1);
+    assert!(errors[0].contains("reserved for the implicit default-deny decision"));
+}
+
+#[test]
+fn reused_output_is_removed_on_validation_read_and_write_failures() {
+    static NEXT_DIRECTORY: AtomicU64 = AtomicU64::new(0);
+    let directory = std::env::current_dir().unwrap().join(format!(
+        ".reused-output-test-{}-{}",
+        std::process::id(),
+        NEXT_DIRECTORY.fetch_add(1, Ordering::Relaxed)
+    ));
+    std::fs::create_dir(&directory).unwrap();
+    let old_path = directory.join("old.json");
+    let proposed_path = directory.join("proposed.json");
+    let report_path = directory.join("report.json");
+    let valid = serde_json::to_vec(&PolicyFile {
+        rules: vec![rule(
+            "allow-web",
+            Action::Allow,
+            IpFamily::Ipv4,
+            "10.0.0.0/24",
+            Protocol::Tcp,
+            (443, 443),
+        )],
+    })
+    .unwrap();
+    let invalid = br#"{"rules":[{"id":"bad","action":"allow","ip_family":"ipv4","source_cidr":"10.0.0.1/24","protocol":"tcp","port_start":443,"port_end":443}]}"#;
+
+    std::fs::write(&old_path, &valid).unwrap();
+    std::fs::write(&proposed_path, &valid).unwrap();
+    analyze_files_to_report(&old_path, &proposed_path, &report_path).unwrap();
+    assert!(report_path.is_file());
+
+    std::fs::write(&proposed_path, invalid).unwrap();
+    let validation_error =
+        analyze_files_to_report(&old_path, &proposed_path, &report_path).unwrap_err();
+    assert!(validation_error.contains("no semantic verdict was produced"));
+    assert!(!report_path.exists());
+
+    std::fs::write(&proposed_path, &valid).unwrap();
+    analyze_files_to_report(&old_path, &proposed_path, &report_path).unwrap();
+    assert!(report_path.is_file());
+    std::fs::remove_file(&proposed_path).unwrap();
+    let read_error = analyze_files_to_report(&old_path, &proposed_path, &report_path).unwrap_err();
+    assert!(read_error.contains("cannot read"));
+    assert!(!report_path.exists());
+
+    std::fs::write(&proposed_path, &valid).unwrap();
+    let missing_parent_report = directory.join("missing-parent/report.json");
+    let write_error =
+        analyze_files_to_report(&old_path, &proposed_path, &missing_parent_report).unwrap_err();
+    assert!(write_error.contains("cannot create temporary report"));
+    assert!(!missing_parent_report.exists());
+
+    std::fs::remove_dir_all(&directory).unwrap();
+}
+
+#[test]
+fn report_schema_rejects_unknown_fields_at_every_nested_level() {
+    let old = policy(vec![]);
+    let proposed = policy(vec![rule(
+        "allow-web",
+        Action::Allow,
+        IpFamily::Ipv4,
+        "10.0.0.0/24",
+        Protocol::Tcp,
+        (443, 443),
+    )]);
+    let report = analyze(&old, &proposed);
+    let original = serde_json::to_value(report).unwrap();
+
+    for pointer in [
+        "",
+        "/summary",
+        "/changes/0",
+        "/changes/0/witness",
+        "/proposed_rule_reachability/0",
+        "/proposed_rule_reachability/0/witness",
+    ] {
+        let mut corrupted = original.clone();
+        let object = corrupted
+            .pointer_mut(pointer)
+            .unwrap()
+            .as_object_mut()
+            .unwrap();
+        object.insert("unexpected".to_string(), serde_json::json!(true));
+        assert!(
+            serde_json::from_value::<firewall_policy_impact::Report>(corrupted).is_err(),
+            "unknown field accepted at JSON pointer {pointer:?}"
+        );
+    }
+}
+
+#[test]
+fn output_aliases_are_rejected_before_either_input_is_changed() {
+    static NEXT_DIRECTORY: AtomicU64 = AtomicU64::new(0);
+    let directory_name = format!(
+        ".output-alias-test-{}-{}",
+        std::process::id(),
+        NEXT_DIRECTORY.fetch_add(1, Ordering::Relaxed)
+    );
+    let directory = std::env::current_dir().unwrap().join(&directory_name);
+    std::fs::create_dir(&directory).unwrap();
+    std::fs::create_dir(directory.join("subdirectory")).unwrap();
+    let old_path = directory.join("old.json");
+    let proposed_path = directory.join("proposed.json");
+    let old_bytes = serde_json::to_vec(&PolicyFile {
+        rules: vec![rule(
+            "old-allow",
+            Action::Allow,
+            IpFamily::Ipv4,
+            "10.0.0.0/24",
+            Protocol::Tcp,
+            (443, 443),
+        )],
+    })
+    .unwrap();
+    let proposed_bytes = serde_json::to_vec(&PolicyFile {
+        rules: vec![rule(
+            "proposed-deny",
+            Action::Deny,
+            IpFamily::Ipv4,
+            "10.0.0.0/24",
+            Protocol::Tcp,
+            (443, 443),
+        )],
+    })
+    .unwrap();
+    std::fs::write(&old_path, &old_bytes).unwrap();
+    std::fs::write(&proposed_path, &proposed_bytes).unwrap();
+
+    let relative_alias = std::path::PathBuf::from(&directory_name)
+        .join("subdirectory")
+        .join("..")
+        .join("old.json");
+    let mut aliases = vec![old_path.clone(), proposed_path.clone(), relative_alias];
+
+    #[cfg(unix)]
+    {
+        let symlink_alias = directory.join("old-symlink.json");
+        std::os::unix::fs::symlink(&old_path, &symlink_alias).unwrap();
+        aliases.push(symlink_alias);
+
+        let hard_link_alias = directory.join("old-hard-link.json");
+        std::fs::hard_link(&old_path, &hard_link_alias).unwrap();
+        aliases.push(hard_link_alias);
+    }
+
+    for alias in aliases {
+        let error = analyze_files_to_report(&old_path, &proposed_path, &alias).unwrap_err();
+        assert!(error.contains("aliases the"), "unexpected error: {error}");
+        assert_eq!(std::fs::read(&old_path).unwrap(), old_bytes);
+        assert_eq!(std::fs::read(&proposed_path).unwrap(), proposed_bytes);
+        assert!(old_path.is_file());
+        assert!(proposed_path.is_file());
+    }
+
+    std::fs::remove_dir_all(&directory).unwrap();
+}
+
+fn publication_fixture(
+    label: &str,
+) -> (
+    std::path::PathBuf,
+    std::path::PathBuf,
+    std::path::PathBuf,
+    Vec<u8>,
+    Vec<u8>,
+) {
+    static NEXT_DIRECTORY: AtomicU64 = AtomicU64::new(0);
+    let directory = std::env::current_dir().unwrap().join(format!(
+        ".publication-test-{label}-{}-{}",
+        std::process::id(),
+        NEXT_DIRECTORY.fetch_add(1, Ordering::Relaxed)
+    ));
+    std::fs::create_dir(&directory).unwrap();
+    let old_path = directory.join("old.json");
+    let proposed_path = directory.join("proposed.json");
+    let old_bytes = serde_json::to_vec(&PolicyFile {
+        rules: vec![rule(
+            "old-deny",
+            Action::Deny,
+            IpFamily::Ipv4,
+            "10.0.0.0/24",
+            Protocol::Tcp,
+            (443, 443),
+        )],
+    })
+    .unwrap();
+    let proposed_bytes = serde_json::to_vec(&PolicyFile {
+        rules: vec![rule(
+            "proposed-allow",
+            Action::Allow,
+            IpFamily::Ipv4,
+            "10.0.0.0/24",
+            Protocol::Tcp,
+            (443, 443),
+        )],
+    })
+    .unwrap();
+    std::fs::write(&old_path, &old_bytes).unwrap();
+    std::fs::write(&proposed_path, &proposed_bytes).unwrap();
+    (
+        directory,
+        old_path,
+        proposed_path,
+        old_bytes,
+        proposed_bytes,
+    )
+}
+
+fn temporary_candidate(directory: &std::path::Path, attempt: usize) -> std::path::PathBuf {
+    let suffix = if attempt == 0 {
+        String::new()
+    } else {
+        format!("-{attempt}")
+    };
+    directory.join(format!(".report.json.tmp-{}{suffix}", std::process::id()))
+}
+
+#[test]
+fn preexisting_temporary_hard_link_never_truncates_an_input() {
+    let (directory, old_path, proposed_path, old_bytes, proposed_bytes) =
+        publication_fixture("hard-link");
+    let report_path = directory.join("report.json");
+    let collision = temporary_candidate(&directory, 0);
+    std::fs::hard_link(&old_path, &collision).unwrap();
+
+    analyze_files_to_report(&old_path, &proposed_path, &report_path).unwrap();
+
+    assert_eq!(std::fs::read(&old_path).unwrap(), old_bytes);
+    assert_eq!(std::fs::read(&proposed_path).unwrap(), proposed_bytes);
+    assert_eq!(std::fs::read(&collision).unwrap(), old_bytes);
+    assert!(report_path.is_file());
+    assert!(!temporary_candidate(&directory, 1).exists());
+    std::fs::remove_dir_all(&directory).unwrap();
+}
+
+#[cfg(unix)]
+#[test]
+fn preexisting_temporary_symlink_never_truncates_an_input() {
+    let (directory, old_path, proposed_path, old_bytes, proposed_bytes) =
+        publication_fixture("symlink");
+    let report_path = directory.join("report.json");
+    let collision = temporary_candidate(&directory, 0);
+    std::os::unix::fs::symlink(&old_path, &collision).unwrap();
+
+    analyze_files_to_report(&old_path, &proposed_path, &report_path).unwrap();
+
+    assert_eq!(std::fs::read(&old_path).unwrap(), old_bytes);
+    assert_eq!(std::fs::read(&proposed_path).unwrap(), proposed_bytes);
+    assert_eq!(std::fs::read(&collision).unwrap(), old_bytes);
+    assert!(
+        std::fs::symlink_metadata(&collision)
+            .unwrap()
+            .file_type()
+            .is_symlink()
+    );
+    assert!(report_path.is_file());
+    assert!(!temporary_candidate(&directory, 1).exists());
+    std::fs::remove_dir_all(&directory).unwrap();
+}
+
+#[test]
+fn temporary_collisions_are_retried_without_deleting_foreign_candidates() {
+    let (directory, old_path, proposed_path, _, _) = publication_fixture("retry");
+    let report_path = directory.join("report.json");
+    let first = temporary_candidate(&directory, 0);
+    let second = temporary_candidate(&directory, 1);
+    std::fs::write(&first, b"foreign collision zero").unwrap();
+    std::fs::write(&second, b"foreign collision one").unwrap();
+
+    analyze_files_to_report(&old_path, &proposed_path, &report_path).unwrap();
+
+    assert_eq!(std::fs::read(&first).unwrap(), b"foreign collision zero");
+    assert_eq!(std::fs::read(&second).unwrap(), b"foreign collision one");
+    assert!(!temporary_candidate(&directory, 2).exists());
+    assert!(report_path.is_file());
+    std::fs::remove_dir_all(&directory).unwrap();
+}
+
+#[test]
+fn normal_atomic_publication_leaves_no_temporary_file() {
+    let (directory, old_path, proposed_path, _, _) = publication_fixture("normal");
+    let report_path = directory.join("report.json");
+
+    let first = analyze_files_to_report(&old_path, &proposed_path, &report_path).unwrap();
+    let first_bytes = std::fs::read(&report_path).unwrap();
+    let second = analyze_files_to_report(&old_path, &proposed_path, &report_path).unwrap();
+    let second_bytes = std::fs::read(&report_path).unwrap();
+
+    assert_eq!(first, second);
+    assert_eq!(first_bytes, second_bytes);
+    assert_eq!(first_bytes, report_json(&first).unwrap());
+    assert!(!temporary_candidate(&directory, 0).exists());
+    std::fs::remove_dir_all(&directory).unwrap();
+}
+
+#[test]
+fn output_is_byte_deterministic_and_sorted() {
+    let old = policy(vec![
+        rule(
+            "old-v6",
+            Action::Allow,
+            IpFamily::Ipv6,
+            "::/0",
+            Protocol::Udp,
+            (0, 65535),
+        ),
+        rule(
+            "old-v4",
+            Action::Allow,
+            IpFamily::Ipv4,
+            "0.0.0.0/0",
+            Protocol::Tcp,
+            (0, 65535),
+        ),
+    ]);
+    let proposed = policy(vec![]);
+    let first = report_json(&analyze(&old, &proposed)).unwrap();
+    let second = report_json(&analyze(&old, &proposed)).unwrap();
+    assert_eq!(first, second);
+    let report = analyze(&old, &proposed);
+    assert_eq!(report.changes[0].ip_family, IpFamily::Ipv4);
+    assert_eq!(report.changes[1].ip_family, IpFamily::Ipv6);
+}
+
+#[test]
+fn acceptance_differential_workloads() {
+    let result = validation_suite(10_000, 1_000, 2_000_000, 0x5eed_2026_0809).unwrap();
+    println!("{result}");
+    assert!(result.contains("small_pairs=10000"));
+    assert!(result.contains("full_width_pairs=1000"));
+    assert!(result.contains("boundary_probes=2000000"));
+    assert!(result.contains("disagreements=0"));
+}
diff --git a/developer-simulation/runs/2026-08-09--incremental-syntax-highlighting/.gitattributes b/developer-simulation/runs/2026-08-09--incremental-syntax-highlighting/.gitattributes
new file mode 100644
index 0000000..a130f32
--- /dev/null
+++ b/developer-simulation/runs/2026-08-09--incremental-syntax-highlighting/.gitattributes
@@ -0,0 +1 @@
+tests/fixtures/cross-line-input.txt whitespace=-blank-at-eof
diff --git a/developer-simulation/runs/2026-08-09--incremental-syntax-highlighting/Cargo.toml b/developer-simulation/runs/2026-08-09--incremental-syntax-highlighting/Cargo.toml
new file mode 100644
index 0000000..4524289
--- /dev/null
+++ b/developer-simulation/runs/2026-08-09--incremental-syntax-highlighting/Cargo.toml
@@ -0,0 +1,9 @@
+[package]
+name = "incremental-syntax-highlighting"
+version = "0.1.0"
+edition = "2024"
+publish = false
+
+[dependencies]
+serde = { version = "1", features = ["derive"] }
+serde_json = "1"
diff --git a/developer-simulation/runs/2026-08-09--incremental-syntax-highlighting/README.md b/developer-simulation/runs/2026-08-09--incremental-syntax-highlighting/README.md
new file mode 100644
index 0000000..7f339a5
--- /dev/null
+++ b/developer-simulation/runs/2026-08-09--incremental-syntax-highlighting/README.md
@@ -0,0 +1,71 @@
+# Incremental syntax highlighting prototype
+
+This standalone Rust prototype keeps an authoritative full lexer and a line-oriented incremental cache for the same token rules. It was built for the Trial 1 scenario and does not modify or depend on BogKit.
+
+The incremental path validates byte coordinates before mutation, relexes from the touched line, and stops only after scanning a preserved boundary line and exactly matching its content, incoming state, outgoing state, and relative tokens. The fingerprint is a secondary check, never the sole reason to reuse a suffix. Token ranges are UTF-8 byte ranges. The cache also maintains one canonical entry per logical line, including exactly one empty terminal line when the document ends in a newline.
+
+## Requirements
+
+- Rust 1.95.0 (edition 2024)
+- Dependencies resolved by the archive's single `developer-simulation/Cargo.lock`; use `--offline --locked`
+- No network, service, database, or private data
+
+## Run
+
+From this directory:
+
+```console
+cargo fmt --check -p incremental-syntax-highlighting
+cargo test --offline --locked --release -p incremental-syntax-highlighting --all-targets
+cargo clippy --offline --locked --release -p incremental-syntax-highlighting --all-targets --all-features -- -D warnings
+cargo run --offline --locked --release -p incremental-syntax-highlighting -- correctness
+cargo run --offline --locked --release -p incremental-syntax-highlighting -- adversarial
+cargo run --offline --locked --release -p incremental-syntax-highlighting -- benchmark
+cargo run --offline --locked --release -p incremental-syntax-highlighting -- reproducibility
+```
+
+`benchmark` builds the deterministic approximately 10 MiB / 200,000-line fixture, applies exactly 2,000 edits, and compares against a fresh full lex after every edit. It takes about 70 seconds on the trial machine. `benchmark --no-oracle` skips those full comparisons for a faster instrumentation run; it is not a substitute for the oracle run.
+
+`reproducibility` runs the complete seeded benchmark twice, serializes each canonical `(LexResult, WorkCounters)` value, and requires the two byte vectors to be exactly equal. It separately compares the stable measurement fields. The 64-bit digests remain useful compact labels but are not treated as proof of equality.
+
+Before the fix, the reviewer directly reproduced an exact differential failure on the cross-line edit from `"/λa\n\n"` to `"/λ\r\n\"🙂🙂\n"`: incremental lexing emitted String ranges `5..14` and `14..15`, while fresh full lex emitted the single range `5..15`. The permanent regression now checks the canonical three-line cache partition and the single `5..15` String token; the EOF splice fix removed the mismatch.
+
+The same case can be exercised through the release CLI with the checked-in synthetic fixtures:
+
+```console
+cargo run --offline --locked --release -p incremental-syntax-highlighting -- apply tests/fixtures/cross-line-input.txt tests/fixtures/cross-line-edits.jsonl --check
+```
+
+## Apply a JSONL edit stream
+
+```console
+cargo run --offline --locked --release -p incremental-syntax-highlighting -- apply DOCUMENT EDITS.jsonl --check
+```
+
+Each non-empty JSONL line has this shape:
+
+```json
+{"start": 12, "delete": 3, "insert": "replacement"}
+```
+
+The long field names `deleted_bytes` and `replacement` are also accepted. `--check` compares the incremental result with a fresh full lex after every edit. The command emits a deterministic final digest, edit counters, scanned line/byte counters, and a maximum retained-index capacity estimate.
+
+## Other commands
+
+```console
+cargo run --offline --locked --release -p incremental-syntax-highlighting -- baseline
+```
+
+This performs one full lex of a deterministic 10 MiB fixture and reports the scan cost and digest.
+
+## What is counted
+
+The locality counters count bytes and lines passed through the lexer. They intentionally do not claim that updating the contiguous `String` or rebuilding the line-start vector is free.
+
+The retained-index estimate adds owned vector capacities, exact cached line text, cached relative tokens and states, plus a heuristic 32-byte allowance for every retained backing allocation. The maximum reported value is sampled after initialization and each completed edit. This is **not peak RSS or a complete peak-allocation measurement**: it omits transient allocations during edit reconstruction, line splitting, full-result assembly, oracle comparison, and JSON serialization, as well as allocator fragmentation and other process memory. The document and a separately assembled emitted-token result are also excluded to mirror the scenario's index-only boundary. A value below 64 MiB therefore shows only that the internally counted retained index is below that threshold; it does not demonstrate the full process-memory acceptance criterion.
+
+Seeds are compiled into the harness and printed in every large result. Wall-clock time is informational and is excluded from reproducibility equality; canonical result bytes, exact counters, and all stable measurement fields are compared.
+
+## Archive normalization verification
+
+The standalone trial's child workspace, child lockfile, and package-level release profile were removed during archival. The package was rebuilt with the single nested lab lockfile and default workspace release profile. From that final archive shape, the full 10 MiB / 2,000-edit oracle run again passed after every edit in 72,696 ms, and exact reproducibility again compared two equal 20,576,672-byte canonical values. The memory result remains only the retained-index estimate described above.
diff --git a/developer-simulation/runs/2026-08-09--incremental-syntax-highlighting/src/lib.rs b/developer-simulation/runs/2026-08-09--incremental-syntax-highlighting/src/lib.rs
new file mode 100644
index 0000000..093d0c6
--- /dev/null
+++ b/developer-simulation/runs/2026-08-09--incremental-syntax-highlighting/src/lib.rs
@@ -0,0 +1,792 @@
+use serde::{Deserialize, Serialize};
+use std::fmt;
+use std::mem::size_of;
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize)]
+pub enum TokenKind {
+    Identifier,
+    Number,
+    Punctuation,
+    Whitespace,
+    LineComment,
+    String,
+    BlockComment,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize)]
+pub struct Token {
+    pub kind: TokenKind,
+    pub start: usize,
+    pub end: usize,
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize)]
+pub enum DiagnosticKind {
+    UnterminatedString,
+    UnterminatedBlockComment,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize)]
+pub struct Diagnostic {
+    pub kind: DiagnosticKind,
+    pub start: usize,
+    pub end: usize,
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize)]
+pub enum LexState {
+    Normal,
+    String { escaped: bool, start: usize },
+    BlockComment { start: usize },
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize)]
+pub struct LexResult {
+    pub tokens: Vec<Token>,
+    pub final_state: LexState,
+    pub diagnostics: Vec<Diagnostic>,
+}
+
+#[derive(Debug, Clone, Copy, Default, PartialEq, Eq, Serialize)]
+pub struct WorkCounters {
+    pub edits: u64,
+    pub lines_relexed: u64,
+    pub bytes_scanned: u64,
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize)]
+pub struct EditWork {
+    pub lines_relexed: usize,
+    pub bytes_scanned: usize,
+    pub converged: bool,
+    pub scanned_to_eof: bool,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub enum EditError {
+    OutOfBounds,
+    NotCharBoundary,
+}
+
+impl fmt::Display for EditError {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        match self {
+            Self::OutOfBounds => f.write_str("edit range exceeds document bounds"),
+            Self::NotCharBoundary => f.write_str("edit range splits a UTF-8 scalar"),
+        }
+    }
+}
+
+impl std::error::Error for EditError {}
+
+#[derive(Debug, Clone, Deserialize)]
+pub struct Edit {
+    pub start: usize,
+    #[serde(alias = "delete")]
+    pub deleted_bytes: usize,
+    #[serde(alias = "insert")]
+    pub replacement: String,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+struct RelativeToken {
+    kind: TokenKind,
+    start: usize,
+    end: usize,
+}
+
+#[derive(Debug, Clone)]
+struct CachedLine {
+    content: Box<str>,
+    fingerprint: u64,
+    incoming: LexState,
+    outgoing: LexState,
+    tokens: Vec<RelativeToken>,
+    valid: bool,
+}
+
+impl CachedLine {
+    fn invalid(content: &str) -> Self {
+        Self {
+            content: content.into(),
+            fingerprint: fingerprint(content.as_bytes()),
+            incoming: LexState::Normal,
+            outgoing: LexState::Normal,
+            tokens: Vec::new(),
+            valid: false,
+        }
+    }
+}
+
+#[derive(Debug, Clone)]
+pub struct IncrementalLexer {
+    document: String,
+    lines: Vec<CachedLine>,
+    starts: Vec<usize>,
+    counters: WorkCounters,
+    max_retained_index_estimate_bytes: usize,
+}
+
+#[derive(Debug, Clone, Copy)]
+struct EditTransform {
+    start: usize,
+    old_end: usize,
+    delta: isize,
+}
+
+pub fn full_lex(document: &str) -> LexResult {
+    let mut state = LexState::Normal;
+    let mut tokens = Vec::new();
+    for (line_start, line) in line_slices(document) {
+        let (relative, outgoing) = scan_line(line, line_start, state);
+        tokens.extend(relative.into_iter().map(|token| Token {
+            kind: token.kind,
+            start: line_start + token.start,
+            end: line_start + token.end,
+        }));
+        state = outgoing;
+    }
+    LexResult {
+        diagnostics: diagnostics(state, document.len()),
+        final_state: state,
+        tokens,
+    }
+}
+
+impl IncrementalLexer {
+    pub fn new(document: String) -> Self {
+        let mut lines: Vec<_> = line_slices(&document)
+            .map(|(_, line)| CachedLine::invalid(line))
+            .collect();
+        let starts = starts_for(&lines);
+        let mut state = LexState::Normal;
+        for (index, line) in lines.iter_mut().enumerate() {
+            let (tokens, outgoing) = scan_line(&line.content, starts[index], state);
+            line.incoming = state;
+            line.outgoing = outgoing;
+            line.tokens = tokens;
+            line.valid = true;
+            state = outgoing;
+        }
+        let mut this = Self {
+            document,
+            lines,
+            starts,
+            counters: WorkCounters::default(),
+            max_retained_index_estimate_bytes: 0,
+        };
+        this.max_retained_index_estimate_bytes = this.retained_index_estimate_bytes();
+        this
+    }
+
+    pub fn document(&self) -> &str {
+        &self.document
+    }
+
+    pub fn counters(&self) -> WorkCounters {
+        self.counters
+    }
+
+    pub fn max_retained_index_estimate_bytes(&self) -> usize {
+        self.max_retained_index_estimate_bytes
+    }
+
+    pub fn line_count(&self) -> usize {
+        self.lines.len()
+    }
+
+    pub fn result(&self) -> LexResult {
+        let mut tokens = Vec::new();
+        for (index, line) in self.lines.iter().enumerate() {
+            let line_start = self.starts[index];
+            tokens.extend(line.tokens.iter().map(|token| Token {
+                kind: token.kind,
+                start: line_start + token.start,
+                end: line_start + token.end,
+            }));
+        }
+        let state = self
+            .lines
+            .last()
+            .map_or(LexState::Normal, |line| line.outgoing);
+        LexResult {
+            diagnostics: diagnostics(state, self.document.len()),
+            final_state: state,
+            tokens,
+        }
+    }
+
+    pub fn apply_edit(&mut self, edit: &Edit) -> Result<EditWork, EditError> {
+        let old_end = edit
+            .start
+            .checked_add(edit.deleted_bytes)
+            .ok_or(EditError::OutOfBounds)?;
+        if edit.start > self.document.len() || old_end > self.document.len() {
+            return Err(EditError::OutOfBounds);
+        }
+        if !self.document.is_char_boundary(edit.start) || !self.document.is_char_boundary(old_end) {
+            return Err(EditError::NotCharBoundary);
+        }
+
+        let old_document_len = self.document.len();
+        let start_line = self.line_at(edit.start);
+        let delete_last_position = old_end.saturating_sub(1).max(edit.start);
+        let touched_end_line = self.line_at(delete_last_position.min(old_document_len));
+        let mut region_end_line = (touched_end_line + 1).min(self.lines.len() - 1);
+        // A document ending in a newline has a zero-length terminal line. If the
+        // edited region already reaches that byte boundary, it owns the terminal
+        // line too; preserving the old sentinel would create a duplicate cache
+        // entry at EOF and can split a cross-line token at the preserved newline.
+        while region_end_line + 1 < self.lines.len()
+            && self.lines[region_end_line + 1].content.is_empty()
+            && self.starts[region_end_line + 1]
+                == self.starts[region_end_line] + self.lines[region_end_line].content.len()
+        {
+            region_end_line += 1;
+        }
+        let region_start = self.starts[start_line];
+        let old_region_end =
+            self.starts[region_end_line] + self.lines[region_end_line].content.len();
+        let delta = edit.replacement.len() as isize - edit.deleted_bytes as isize;
+        let transform = EditTransform {
+            start: edit.start,
+            old_end,
+            delta,
+        };
+
+        self.document
+            .replace_range(edit.start..old_end, &edit.replacement);
+        let new_region_end = shift_position(old_region_end, delta);
+        let region = &self.document[region_start..new_region_end];
+        let mut replacement_lines: Vec<_> = line_slices(region)
+            .map(|(_, line)| CachedLine::invalid(line))
+            .collect();
+        if new_region_end < self.document.len()
+            && replacement_lines
+                .last()
+                .is_some_and(|line| line.content.is_empty())
+        {
+            replacement_lines.pop();
+        }
+        self.lines
+            .splice(start_line..=region_end_line, replacement_lines);
+        self.starts = starts_for(&self.lines);
+
+        let mut state = if start_line == 0 {
+            LexState::Normal
+        } else {
+            self.lines[start_line - 1].outgoing
+        };
+        let mut lines_relexed = 0usize;
+        let mut bytes_scanned = 0usize;
+        let mut converged = false;
+        let mut last_scanned = start_line.saturating_sub(1);
+
+        for index in start_line..self.lines.len() {
+            let start = self.starts[index];
+            let was_valid = self.lines[index].valid;
+            let cached_incoming = rebase_state(self.lines[index].incoming, transform);
+            let cached_outgoing = rebase_state(self.lines[index].outgoing, transform);
+            let exact_content_matches = self
+                .document
+                .get(start..start + self.lines[index].content.len())
+                .is_some_and(|content| content == self.lines[index].content.as_ref());
+            let (tokens, outgoing) = scan_line(&self.lines[index].content, start, state);
+            lines_relexed += 1;
+            bytes_scanned += self.lines[index].content.len();
+            last_scanned = index;
+
+            let boundary_matches = was_valid
+                && exact_content_matches
+                && self.lines[index].fingerprint
+                    == fingerprint(self.lines[index].content.as_bytes())
+                && cached_incoming == Some(state)
+                && cached_outgoing == Some(outgoing)
+                && self.lines[index].tokens == tokens;
+
+            self.lines[index].incoming = state;
+            self.lines[index].outgoing = outgoing;
+            self.lines[index].tokens = tokens;
+            self.lines[index].valid = true;
+            state = outgoing;
+
+            if boundary_matches && self.can_rebase_suffix(index + 1, transform) {
+                self.rebase_suffix(index + 1, transform);
+                converged = true;
+                break;
+            }
+        }
+
+        self.counters.edits += 1;
+        self.counters.lines_relexed += lines_relexed as u64;
+        self.counters.bytes_scanned += bytes_scanned as u64;
+        self.max_retained_index_estimate_bytes = self
+            .max_retained_index_estimate_bytes
+            .max(self.retained_index_estimate_bytes());
+        Ok(EditWork {
+            lines_relexed,
+            bytes_scanned,
+            converged,
+            scanned_to_eof: last_scanned + 1 == self.lines.len(),
+        })
+    }
+
+    /// Estimates retained index allocations from owned capacities.
+    ///
+    /// This is not a process peak-memory measurement. In particular, it omits
+    /// transient allocations used while applying an edit or assembling results,
+    /// allocator fragmentation, code, and other process state.
+    pub fn retained_index_estimate_bytes(&self) -> usize {
+        // Add a heuristic 32-byte allowance for every retained backing allocation.
+        const ALLOCATION_OVERHEAD_ALLOWANCE: usize = 32;
+        let structural = self.lines.capacity() * size_of::<CachedLine>()
+            + self.starts.capacity() * size_of::<usize>();
+        let line_content: usize = self.lines.iter().map(|line| line.content.len()).sum();
+        let line_tokens: usize = self
+            .lines
+            .iter()
+            .map(|line| line.tokens.capacity() * size_of::<RelativeToken>())
+            .sum();
+        let backing_allocations = 2
+            + self
+                .lines
+                .iter()
+                .filter(|line| !line.content.is_empty())
+                .count()
+            + self
+                .lines
+                .iter()
+                .filter(|line| line.tokens.capacity() > 0)
+                .count();
+        structural
+            + line_content
+            + line_tokens
+            + backing_allocations * ALLOCATION_OVERHEAD_ALLOWANCE
+    }
+
+    fn line_at(&self, position: usize) -> usize {
+        match self.starts.binary_search(&position) {
+            Ok(index) => index,
+            Err(0) => 0,
+            Err(index) => index - 1,
+        }
+    }
+
+    fn can_rebase_suffix(&self, from: usize, transform: EditTransform) -> bool {
+        self.lines[from..].iter().all(|line| {
+            rebase_state(line.incoming, transform).is_some()
+                && rebase_state(line.outgoing, transform).is_some()
+        })
+    }
+
+    fn rebase_suffix(&mut self, from: usize, transform: EditTransform) {
+        for line in &mut self.lines[from..] {
+            line.incoming =
+                rebase_state(line.incoming, transform).expect("checked before rebasing");
+            line.outgoing =
+                rebase_state(line.outgoing, transform).expect("checked before rebasing");
+        }
+    }
+}
+
+pub fn validate_coverage(document: &str, result: &LexResult) -> Result<(), String> {
+    let mut cursor = 0;
+    for token in &result.tokens {
+        if token.start != cursor || token.end <= token.start || token.end > document.len() {
+            return Err(format!(
+                "invalid token range {}..{} after {cursor}",
+                token.start, token.end
+            ));
+        }
+        if !document.is_char_boundary(token.start) || !document.is_char_boundary(token.end) {
+            return Err(format!(
+                "token splits UTF-8 at {}..{}",
+                token.start, token.end
+            ));
+        }
+        let _covered_bytes = &document.as_bytes()[token.start..token.end];
+        cursor = token.end;
+    }
+    if cursor != document.len() {
+        return Err(format!("tokens cover {cursor} of {} bytes", document.len()));
+    }
+    Ok(())
+}
+
+pub fn result_digest(result: &LexResult, counters: WorkCounters) -> String {
+    let bytes = serde_json::to_vec(&(result, counters)).expect("serializable result");
+    format!("{:016x}", fingerprint(&bytes))
+}
+
+fn scan_line(
+    line: &str,
+    absolute_start: usize,
+    incoming: LexState,
+) -> (Vec<RelativeToken>, LexState) {
+    let bytes = line.as_bytes();
+    let mut cursor = 0;
+    let mut state = incoming;
+    let mut tokens = Vec::new();
+
+    while cursor < bytes.len() {
+        match state {
+            LexState::String { escaped, start } => {
+                let token_start = cursor;
+                let (end, closed, next_escaped) = scan_string(bytes, cursor, escaped);
+                tokens.push(RelativeToken {
+                    kind: TokenKind::String,
+                    start: token_start,
+                    end,
+                });
+                cursor = end;
+                state = if closed {
+                    LexState::Normal
+                } else {
+                    LexState::String {
+                        escaped: next_escaped,
+                        start,
+                    }
+                };
+            }
+            LexState::BlockComment { start } => {
+                let token_start = cursor;
+                let (end, closed) = scan_block_comment(bytes, cursor);
+                tokens.push(RelativeToken {
+                    kind: TokenKind::BlockComment,
+                    start: token_start,
+                    end,
+                });
+                cursor = end;
+                state = if closed {
+                    LexState::Normal
+                } else {
+                    LexState::BlockComment { start }
+                };
+            }
+            LexState::Normal => {
+                if is_line_ending_start(bytes, cursor) || char_at(line, cursor).is_whitespace() {
+                    let start = cursor;
+                    while cursor < bytes.len() && char_at(line, cursor).is_whitespace() {
+                        cursor += char_at(line, cursor).len_utf8();
+                    }
+                    tokens.push(RelativeToken {
+                        kind: TokenKind::Whitespace,
+                        start,
+                        end: cursor,
+                    });
+                } else if bytes[cursor] == b'#' {
+                    let start = cursor;
+                    while cursor < bytes.len() && !is_line_ending_start(bytes, cursor) {
+                        cursor += char_at(line, cursor).len_utf8();
+                    }
+                    tokens.push(RelativeToken {
+                        kind: TokenKind::LineComment,
+                        start,
+                        end: cursor,
+                    });
+                } else if bytes[cursor] == b'/'
+                    && cursor + 1 < bytes.len()
+                    && bytes[cursor + 1] == b'*'
+                {
+                    let start = cursor;
+                    let (end, closed) = scan_block_comment(bytes, cursor + 2);
+                    tokens.push(RelativeToken {
+                        kind: TokenKind::BlockComment,
+                        start,
+                        end,
+                    });
+                    cursor = end;
+                    state = if closed {
+                        LexState::Normal
+                    } else {
+                        LexState::BlockComment {
+                            start: absolute_start + start,
+                        }
+                    };
+                } else if bytes[cursor] == b'"' {
+                    let start = cursor;
+                    let (end, closed, escaped) = scan_string(bytes, cursor + 1, false);
+                    tokens.push(RelativeToken {
+                        kind: TokenKind::String,
+                        start,
+                        end,
+                    });
+                    cursor = end;
+                    state = if closed {
+                        LexState::Normal
+                    } else {
+                        LexState::String {
+                            escaped,
+                            start: absolute_start + start,
+                        }
+                    };
+                } else {
+                    let character = char_at(line, cursor);
+                    let kind = if is_identifier_start(character) {
+                        TokenKind::Identifier
+                    } else if character.is_ascii_digit() {
+                        TokenKind::Number
+                    } else {
+                        TokenKind::Punctuation
+                    };
+                    let start = cursor;
+                    cursor += character.len_utf8();
+                    match kind {
+                        TokenKind::Identifier => {
+                            while cursor < bytes.len()
+                                && is_identifier_continue(char_at(line, cursor))
+                            {
+                                cursor += char_at(line, cursor).len_utf8();
+                            }
+                        }
+                        TokenKind::Number => {
+                            while cursor < bytes.len() && char_at(line, cursor).is_ascii_digit() {
+                                cursor += 1;
+                            }
+                        }
+                        _ => {}
+                    }
+                    tokens.push(RelativeToken {
+                        kind,
+                        start,
+                        end: cursor,
+                    });
+                }
+            }
+        }
+    }
+    (tokens, state)
+}
+
+fn scan_string(bytes: &[u8], mut cursor: usize, mut escaped: bool) -> (usize, bool, bool) {
+    while cursor < bytes.len() {
+        let width = utf8_width(bytes[cursor]);
+        if escaped {
+            escaped = false;
+            cursor += width;
+        } else if bytes[cursor] == b'\\' {
+            escaped = true;
+            cursor += 1;
+        } else if bytes[cursor] == b'"' {
+            return (cursor + 1, true, false);
+        } else {
+            cursor += width;
+        }
+    }
+    (cursor, false, escaped)
+}
+
+fn scan_block_comment(bytes: &[u8], mut cursor: usize) -> (usize, bool) {
+    while cursor < bytes.len() {
+        if bytes[cursor] == b'*' && cursor + 1 < bytes.len() && bytes[cursor + 1] == b'/' {
+            return (cursor + 2, true);
+        }
+        cursor += utf8_width(bytes[cursor]);
+    }
+    (cursor, false)
+}
+
+fn diagnostics(state: LexState, document_len: usize) -> Vec<Diagnostic> {
+    match state {
+        LexState::Normal => Vec::new(),
+        LexState::String { start, .. } => vec![Diagnostic {
+            kind: DiagnosticKind::UnterminatedString,
+            start,
+            end: document_len,
+        }],
+        LexState::BlockComment { start } => vec![Diagnostic {
+            kind: DiagnosticKind::UnterminatedBlockComment,
+            start,
+            end: document_len,
+        }],
+    }
+}
+
+fn line_slices(document: &str) -> impl Iterator<Item = (usize, &str)> {
+    let mut start = 0;
+    let mut slices = Vec::new();
+    for (index, byte) in document.bytes().enumerate() {
+        if byte == b'\n' {
+            slices.push((start, &document[start..=index]));
+            start = index + 1;
+        }
+    }
+    slices.push((start, &document[start..]));
+    slices.into_iter()
+}
+
+fn starts_for(lines: &[CachedLine]) -> Vec<usize> {
+    let mut starts = Vec::with_capacity(lines.len());
+    let mut cursor = 0;
+    for line in lines {
+        starts.push(cursor);
+        cursor += line.content.len();
+    }
+    starts
+}
+
+fn is_line_ending_start(bytes: &[u8], cursor: usize) -> bool {
+    bytes[cursor] == b'\n'
+        || (bytes[cursor] == b'\r' && cursor + 1 < bytes.len() && bytes[cursor + 1] == b'\n')
+}
+
+fn char_at(text: &str, cursor: usize) -> char {
+    text[cursor..].chars().next().expect("cursor within string")
+}
+
+fn is_identifier_start(character: char) -> bool {
+    character == '_' || character.is_alphabetic()
+}
+
+fn is_identifier_continue(character: char) -> bool {
+    character == '_' || character.is_alphanumeric()
+}
+
+fn utf8_width(first: u8) -> usize {
+    if first < 0x80 {
+        1
+    } else if first < 0xE0 {
+        2
+    } else if first < 0xF0 {
+        3
+    } else {
+        4
+    }
+}
+
+fn fingerprint(bytes: &[u8]) -> u64 {
+    let mut hash = 0xcbf29ce484222325u64;
+    for byte in bytes {
+        hash ^= u64::from(*byte);
+        hash = hash.wrapping_mul(0x100000001b3);
+    }
+    hash
+}
+
+fn shift_position(position: usize, delta: isize) -> usize {
+    if delta >= 0 {
+        position + delta as usize
+    } else {
+        position - (-delta) as usize
+    }
+}
+
+fn rebase_state(state: LexState, transform: EditTransform) -> Option<LexState> {
+    let rebase = |position: usize| {
+        if position < transform.start {
+            Some(position)
+        } else if position >= transform.old_end {
+            Some(shift_position(position, transform.delta))
+        } else {
+            None
+        }
+    };
+    match state {
+        LexState::Normal => Some(LexState::Normal),
+        LexState::String { escaped, start } => {
+            rebase(start).map(|start| LexState::String { escaped, start })
+        }
+        LexState::BlockComment { start } => {
+            rebase(start).map(|start| LexState::BlockComment { start })
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn full_lexer_covers_utf8_and_states() {
+        let doc = "alpha 12 λ; # hi\r\n\"escaped \\\" quote\" /* block\nend */ z";
+        let result = full_lex(doc);
+        validate_coverage(doc, &result).unwrap();
+        assert_eq!(result.final_state, LexState::Normal);
+    }
+
+    #[test]
+    fn unterminated_diagnostic_points_to_opener() {
+        let doc = "x\n/* open\nstill";
+        let result = full_lex(doc);
+        assert_eq!(result.diagnostics[0].start, 2);
+        assert_eq!(result.diagnostics[0].end, doc.len());
+    }
+
+    #[test]
+    fn localized_and_propagating_edits_match_full_lexer() {
+        let mut lexer = IncrementalLexer::new("head\nbody\ntail\n".to_string());
+        for edit in [
+            Edit {
+                start: 6,
+                deleted_bytes: 1,
+                replacement: "λ".to_string(),
+            },
+            Edit {
+                start: 5,
+                deleted_bytes: 0,
+                replacement: "/*".to_string(),
+            },
+            Edit {
+                start: 5,
+                deleted_bytes: 2,
+                replacement: String::new(),
+            },
+        ] {
+            lexer.apply_edit(&edit).unwrap();
+            let actual = lexer.result();
+            let expected = full_lex(lexer.document());
+            assert_eq!(actual, expected);
+            validate_coverage(lexer.document(), &actual).unwrap();
+        }
+    }
+
+    #[test]
+    fn rejected_edits_leave_state_unchanged() {
+        let mut lexer = IncrementalLexer::new("aλz".to_string());
+        let before_doc = lexer.document().to_string();
+        let before_result = lexer.result();
+        let before_counters = lexer.counters();
+        assert_eq!(
+            lexer.apply_edit(&Edit {
+                start: 2,
+                deleted_bytes: 0,
+                replacement: "x".to_string(),
+            }),
+            Err(EditError::NotCharBoundary)
+        );
+        assert_eq!(
+            lexer.apply_edit(&Edit {
+                start: 99,
+                deleted_bytes: 0,
+                replacement: String::new(),
+            }),
+            Err(EditError::OutOfBounds)
+        );
+        assert_eq!(lexer.document(), before_doc);
+        assert_eq!(lexer.result(), before_result);
+        assert_eq!(lexer.counters(), before_counters);
+    }
+
+    #[test]
+    fn cross_line_edit_does_not_split_string_token_at_preserved_newline() {
+        let mut lexer = IncrementalLexer::new("/λa\n\n".to_string());
+        lexer
+            .apply_edit(&Edit {
+                start: 3,
+                deleted_bytes: 2,
+                replacement: "\r\n\"🙂🙂".to_string(),
+            })
+            .unwrap();
+        assert_eq!(lexer.document(), "/λ\r\n\"🙂🙂\n");
+        assert_eq!(lexer.line_count(), 3);
+        let result = lexer.result();
+        assert_eq!(result, full_lex(lexer.document()));
+        let string_ranges: Vec<_> = result
+            .tokens
+            .iter()
+            .filter(|token| token.kind == TokenKind::String)
+            .map(|token| token.start..token.end)
+            .collect();
+        assert_eq!(string_ranges, vec![5..15]);
+    }
+}
diff --git a/developer-simulation/runs/2026-08-09--incremental-syntax-highlighting/src/main.rs b/developer-simulation/runs/2026-08-09--incremental-syntax-highlighting/src/main.rs
new file mode 100644
index 0000000..e230a4d
--- /dev/null
+++ b/developer-simulation/runs/2026-08-09--incremental-syntax-highlighting/src/main.rs
@@ -0,0 +1,697 @@
+use incremental_syntax_highlighting::{
+    Edit, IncrementalLexer, LexResult, WorkCounters, full_lex, result_digest, validate_coverage,
+};
+use serde::Serialize;
+use std::fs;
+use std::io::{BufRead, BufReader};
+use std::time::Instant;
+
+const DOCUMENT_SEED: u64 = 0x6d61_7261_2d64_6f63;
+const EDIT_SEED: u64 = 0x6d61_7261_2d65_6469;
+const CORRECTNESS_DOCUMENTS: usize = 100;
+const EDITS_PER_DOCUMENT: usize = 100;
+const BENCHMARK_LINES: usize = 200_000;
+const BENCHMARK_EDITS: usize = 2_000;
+const MAX_INDEX_BYTES: usize = 64 * 1024 * 1024;
+
+#[derive(Debug, Serialize)]
+struct BaselineSummary {
+    document_bytes: usize,
+    tokens: usize,
+    elapsed_ms: u128,
+    bytes_per_edit: usize,
+    projected_bytes_for_2_000_edits: u64,
+    digest: String,
+}
+
+#[derive(Debug, Serialize)]
+struct CorrectnessSummary {
+    documents: usize,
+    edits: usize,
+    document_seed: u64,
+    edit_seed: u64,
+    all_results_match_full_lexer: bool,
+    all_token_ranges_cover_valid_utf8: bool,
+    final_digest: String,
+}
+
+#[derive(Debug, Serialize)]
+struct AdversarialSummary {
+    named_cases: usize,
+    accepted_edits: usize,
+    invalid_edits: usize,
+    all_results_match_full_lexer: bool,
+    invalid_edits_left_state_unchanged: bool,
+    final_digest: String,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize)]
+struct StableBenchmarkSummary {
+    document_seed: u64,
+    edit_seed: u64,
+    document_bytes: usize,
+    document_lines: usize,
+    edits: usize,
+    localized_edits: usize,
+    propagating_edits: usize,
+    localized_at_most_500_lines: usize,
+    localized_at_most_2_percent_bytes: usize,
+    incremental_lines_relexed: u64,
+    incremental_bytes_scanned: u64,
+    full_relex_bytes: u64,
+    max_retained_index_estimate_bytes: usize,
+    canonical_result_and_counters_bytes: usize,
+    final_result_digest: String,
+    counter_digest: String,
+}
+
+#[derive(Debug, Serialize)]
+struct BenchmarkSummary {
+    stable: StableBenchmarkSummary,
+    localized_at_most_500_lines_percent: f64,
+    localized_at_most_2_percent_bytes_percent: f64,
+    incremental_to_full_bytes_percent: f64,
+    retained_index_estimate_mib: f64,
+    retained_index_estimate_under_64_mib: bool,
+    process_peak_memory_constraint_demonstrated: bool,
+    oracle_checked_after_every_edit: bool,
+    elapsed_ms: u128,
+}
+
+struct BenchmarkRun {
+    summary: BenchmarkSummary,
+    canonical_result_and_counters: Vec<u8>,
+}
+
+#[derive(Debug, Serialize)]
+struct ApplySummary {
+    input_bytes: usize,
+    edits: usize,
+    checked_after_every_edit: bool,
+    counters: WorkCounters,
+    max_retained_index_estimate_bytes: usize,
+    final_digest: String,
+}
+
+fn main() {
+    if let Err(error) = run() {
+        eprintln!("error: {error}");
+        std::process::exit(1);
+    }
+}
+
+fn run() -> Result<(), String> {
+    let mut args = std::env::args().skip(1);
+    let command = args.next().unwrap_or_else(|| "help".to_string());
+    match command.as_str() {
+        "baseline" => print_json(&run_baseline()),
+        "correctness" => print_json(&run_correctness()?),
+        "adversarial" => print_json(&run_adversarial()?),
+        "benchmark" => {
+            let check = !args.any(|arg| arg == "--no-oracle");
+            print_json(&run_benchmark(check)?.summary);
+        }
+        "reproducibility" => {
+            let first = run_benchmark(false)?;
+            let second = run_benchmark(false)?;
+            let exact_serialized_result_and_counters_equal =
+                first.canonical_result_and_counters.as_slice()
+                    == second.canonical_result_and_counters.as_slice();
+            let stable_measurement_fields_equal = first.summary.stable == second.summary.stable;
+            if !exact_serialized_result_and_counters_equal || !stable_measurement_fields_equal {
+                return Err(
+                    "same seeds produced different canonical results, counters, or measurements"
+                        .to_string(),
+                );
+            }
+            print_json(&serde_json::json!({
+                "exact_serialized_result_and_counters_equal": true,
+                "stable_measurement_fields_equal": true,
+                "canonical_serialized_bytes": first.canonical_result_and_counters.len(),
+                "document_seed": DOCUMENT_SEED,
+                "edit_seed": EDIT_SEED,
+                "final_result_digest": first.summary.stable.final_result_digest,
+                "counter_digest": first.summary.stable.counter_digest,
+            }));
+        }
+        "apply" => {
+            let document_path = args
+                .next()
+                .ok_or_else(|| "apply requires DOCUMENT and EDITS_JSONL paths".to_string())?;
+            let edits_path = args
+                .next()
+                .ok_or_else(|| "apply requires DOCUMENT and EDITS_JSONL paths".to_string())?;
+            let check = args.any(|arg| arg == "--check");
+            print_json(&run_apply(&document_path, &edits_path, check)?);
+        }
+        _ => {
+            return Err(
+                "usage: incremental-syntax-highlighting <baseline|correctness|adversarial|benchmark [--no-oracle]|reproducibility|apply DOCUMENT EDITS_JSONL [--check]>"
+                    .to_string(),
+            );
+        }
+    }
+    Ok(())
+}
+
+fn print_json(value: &impl Serialize) {
+    println!(
+        "{}",
+        serde_json::to_string_pretty(value).expect("summary is serializable")
+    );
+}
+
+fn run_baseline() -> BaselineSummary {
+    let document = baseline_fixture(10 * 1024 * 1024);
+    let started = Instant::now();
+    let result = full_lex(&document);
+    BaselineSummary {
+        document_bytes: document.len(),
+        tokens: result.tokens.len(),
+        elapsed_ms: started.elapsed().as_millis(),
+        bytes_per_edit: document.len(),
+        projected_bytes_for_2_000_edits: document.len() as u64 * 2_000,
+        digest: result_digest(&result, WorkCounters::default()),
+    }
+}
+
+fn run_correctness() -> Result<CorrectnessSummary, String> {
+    let mut document_rng = Rng::new(DOCUMENT_SEED);
+    let mut edit_rng = Rng::new(EDIT_SEED);
+    let mut digest_accumulator = 0xcbf29ce484222325u64;
+    for document_index in 0..CORRECTNESS_DOCUMENTS {
+        let document = correctness_document(&mut document_rng, document_index);
+        let mut incremental = IncrementalLexer::new(document);
+        compare_with_full(&incremental, document_index, 0)?;
+        for edit_index in 0..EDITS_PER_DOCUMENT {
+            let edit = generated_edit(incremental.document(), &mut edit_rng, edit_index);
+            incremental
+                .apply_edit(&edit)
+                .map_err(|error| format!("generated valid edit rejected: {error}"))?;
+            compare_with_full(&incremental, document_index, edit_index + 1)?;
+        }
+        digest_accumulator = mix_digest(
+            digest_accumulator,
+            &result_digest(&incremental.result(), incremental.counters()),
+        );
+    }
+    Ok(CorrectnessSummary {
+        documents: CORRECTNESS_DOCUMENTS,
+        edits: CORRECTNESS_DOCUMENTS * EDITS_PER_DOCUMENT,
+        document_seed: DOCUMENT_SEED,
+        edit_seed: EDIT_SEED,
+        all_results_match_full_lexer: true,
+        all_token_ranges_cover_valid_utf8: true,
+        final_digest: format!("{digest_accumulator:016x}"),
+    })
+}
+
+fn run_adversarial() -> Result<AdversarialSummary, String> {
+    let cases: Vec<(&str, &str, Vec<Edit>)> = vec![
+        (
+            "block delimiter insertion and deletion",
+            "alpha xx beta\nstill normal\nend\n",
+            vec![
+                edit(6, 2, "/*"),
+                edit(6, 2, "xx"),
+                edit(16, 0, "*/"),
+                edit(16, 2, ""),
+            ],
+        ),
+        (
+            "nested-looking block comment text",
+            "/* outer /* inner */ tail\nnormal\n",
+            vec![edit(9, 2, "zz"), edit(9, 2, "/*")],
+        ),
+        (
+            "escaped quote insertion and deletion",
+            "\"one \\\" two\" after\n",
+            vec![edit(5, 1, ""), edit(5, 0, "\\")],
+        ),
+        (
+            "empty replacement at byte zero and end",
+            "start end",
+            vec![edit(0, 1, ""), edit(8, 0, "!")],
+        ),
+        (
+            "CRLF boundary",
+            "one\r\ntwo\r\nthree",
+            vec![edit(3, 2, "\n"), edit(3, 1, "\r\n")],
+        ),
+        (
+            "multibyte text next to edit",
+            "aλb\n雪x",
+            vec![edit(3, 1, "q"), edit(8, 0, "🙂")],
+        ),
+        (
+            "unterminated constructs",
+            "head\n\"open\nstill",
+            vec![edit(5, 1, "/*"), edit(5, 2, "\"")],
+        ),
+        (
+            "newline insertion changes following state",
+            "\"left right\"\ntail",
+            vec![edit(6, 1, "\n"), edit(6, 1, " ")],
+        ),
+        (
+            "cross-line UTF-8 replacement before final newline",
+            "/λa\n\n",
+            vec![edit(3, 2, "\r\n\"🙂🙂")],
+        ),
+    ];
+    let named_cases = cases.len();
+    let mut accepted_edits = 0;
+    let mut digest_accumulator = 0xcbf29ce484222325u64;
+    for (case_index, (name, document, edits)) in cases.into_iter().enumerate() {
+        let mut incremental = IncrementalLexer::new(document.to_string());
+        compare_with_full(&incremental, case_index, 0)
+            .map_err(|error| format!("{name}: {error}"))?;
+        for (edit_index, edit) in edits.iter().enumerate() {
+            incremental
+                .apply_edit(edit)
+                .map_err(|error| format!("{name}: edit {}: {error}", edit_index + 1))?;
+            accepted_edits += 1;
+            compare_with_full(&incremental, case_index, edit_index + 1)
+                .map_err(|error| format!("{name}: {error}"))?;
+        }
+        digest_accumulator = mix_digest(
+            digest_accumulator,
+            &result_digest(&incremental.result(), incremental.counters()),
+        );
+    }
+
+    let mut invalid = IncrementalLexer::new("aλz\r\n".to_string());
+    let before_document = invalid.document().to_string();
+    let before_result = invalid.result();
+    let before_counters = invalid.counters();
+    let invalid_edits = [edit(2, 0, "x"), edit(1, 1, ""), edit(99, 0, "")];
+    for candidate in &invalid_edits {
+        if invalid.apply_edit(candidate).is_ok() {
+            return Err(format!("invalid edit was accepted: {candidate:?}"));
+        }
+        if invalid.document() != before_document
+            || invalid.result() != before_result
+            || invalid.counters() != before_counters
+        {
+            return Err("rejected edit changed document or cache result".to_string());
+        }
+        compare_with_full(&invalid, usize::MAX, 0)?;
+    }
+
+    Ok(AdversarialSummary {
+        named_cases,
+        accepted_edits,
+        invalid_edits: invalid_edits.len(),
+        all_results_match_full_lexer: true,
+        invalid_edits_left_state_unchanged: true,
+        final_digest: format!("{digest_accumulator:016x}"),
+    })
+}
+
+fn run_benchmark(check_with_oracle: bool) -> Result<BenchmarkRun, String> {
+    let started = Instant::now();
+    let fixture = benchmark_fixture();
+    let original_bytes = fixture.document.len();
+    let mut incremental = IncrementalLexer::new(fixture.document);
+    if incremental.line_count() != BENCHMARK_LINES {
+        return Err(format!(
+            "large fixture has {} lines, expected {BENCHMARK_LINES}",
+            incremental.line_count()
+        ));
+    }
+    let mut rng = Rng::new(EDIT_SEED);
+    let mut localized_edits = 0;
+    let mut propagating_edits = 0;
+    let mut localized_at_most_500_lines = 0;
+    let mut localized_at_most_2_percent_bytes = 0;
+    let mut toggle_open = false;
+    let mut full_relex_bytes = 0u64;
+
+    for edit_index in 0..BENCHMARK_EDITS {
+        let is_propagating = edit_index % 20 == 19;
+        let edit = if is_propagating {
+            let replacement = if toggle_open { "zz" } else { "/*" };
+            toggle_open = !toggle_open;
+            edit(fixture.toggle_position, 2, replacement)
+        } else {
+            let mut line = 1 + rng.index(BENCHMARK_LINES - 2);
+            if line == fixture.toggle_line || fixture.body_lengths[line] < 8 {
+                line = (line + 7).min(BENCHMARK_LINES - 2);
+            }
+            let position = fixture.starts[line] + 6.min(fixture.body_lengths[line] - 1);
+            let replacement = if edit_index % 2 == 0 { "q" } else { "r" };
+            edit(position, 1, replacement)
+        };
+        let work = incremental
+            .apply_edit(&edit)
+            .map_err(|error| format!("benchmark edit {edit_index} rejected: {error}"))?;
+        if is_propagating {
+            propagating_edits += 1;
+            if !work.scanned_to_eof {
+                return Err(format!(
+                    "propagating edit {edit_index} unexpectedly converged before EOF"
+                ));
+            }
+        } else {
+            localized_edits += 1;
+            if work.lines_relexed <= 500 {
+                localized_at_most_500_lines += 1;
+            }
+            if work.bytes_scanned * 100 <= incremental.document().len() * 2 {
+                localized_at_most_2_percent_bytes += 1;
+            }
+        }
+        full_relex_bytes += incremental.document().len() as u64;
+        if check_with_oracle {
+            compare_with_full(&incremental, 0, edit_index + 1)
+                .map_err(|error| format!("large benchmark: {error}"))?;
+        }
+    }
+
+    let result = incremental.result();
+    validate_coverage(incremental.document(), &result)?;
+    let counters = incremental.counters();
+    let canonical_result_and_counters = canonical_result_and_counters_bytes(&result, counters)?;
+    let stable = StableBenchmarkSummary {
+        document_seed: DOCUMENT_SEED,
+        edit_seed: EDIT_SEED,
+        document_bytes: original_bytes,
+        document_lines: BENCHMARK_LINES,
+        edits: BENCHMARK_EDITS,
+        localized_edits,
+        propagating_edits,
+        localized_at_most_500_lines,
+        localized_at_most_2_percent_bytes,
+        incremental_lines_relexed: counters.lines_relexed,
+        incremental_bytes_scanned: counters.bytes_scanned,
+        full_relex_bytes,
+        max_retained_index_estimate_bytes: incremental.max_retained_index_estimate_bytes(),
+        canonical_result_and_counters_bytes: canonical_result_and_counters.len(),
+        final_result_digest: result_digest(&result, WorkCounters::default()),
+        counter_digest: result_digest(&result, counters),
+    };
+    let localized_denominator = localized_edits as f64;
+    Ok(BenchmarkRun {
+        summary: BenchmarkSummary {
+            localized_at_most_500_lines_percent: 100.0 * localized_at_most_500_lines as f64
+                / localized_denominator,
+            localized_at_most_2_percent_bytes_percent: 100.0
+                * localized_at_most_2_percent_bytes as f64
+                / localized_denominator,
+            incremental_to_full_bytes_percent: 100.0 * counters.bytes_scanned as f64
+                / full_relex_bytes as f64,
+            retained_index_estimate_mib: incremental.max_retained_index_estimate_bytes() as f64
+                / (1024.0 * 1024.0),
+            retained_index_estimate_under_64_mib: incremental.max_retained_index_estimate_bytes()
+                <= MAX_INDEX_BYTES,
+            process_peak_memory_constraint_demonstrated: false,
+            oracle_checked_after_every_edit: check_with_oracle,
+            elapsed_ms: started.elapsed().as_millis(),
+            stable,
+        },
+        canonical_result_and_counters,
+    })
+}
+
+fn canonical_result_and_counters_bytes(
+    result: &LexResult,
+    counters: WorkCounters,
+) -> Result<Vec<u8>, String> {
+    serde_json::to_vec(&(result, counters))
+        .map_err(|error| format!("cannot serialize canonical reproducibility value: {error}"))
+}
+
+fn run_apply(document_path: &str, edits_path: &str, check: bool) -> Result<ApplySummary, String> {
+    let document = fs::read_to_string(document_path)
+        .map_err(|error| format!("cannot read {document_path}: {error}"))?;
+    let input_bytes = document.len();
+    let file =
+        fs::File::open(edits_path).map_err(|error| format!("cannot read {edits_path}: {error}"))?;
+    let mut incremental = IncrementalLexer::new(document);
+    let mut edits = 0;
+    for (line_index, line) in BufReader::new(file).lines().enumerate() {
+        let line = line.map_err(|error| format!("cannot read edit line: {error}"))?;
+        if line.trim().is_empty() {
+            continue;
+        }
+        let edit: Edit = serde_json::from_str(&line)
+            .map_err(|error| format!("invalid JSONL at line {}: {error}", line_index + 1))?;
+        incremental
+            .apply_edit(&edit)
+            .map_err(|error| format!("invalid edit at line {}: {error}", line_index + 1))?;
+        edits += 1;
+        if check {
+            compare_with_full(&incremental, 0, edits)?;
+        }
+    }
+    let result = incremental.result();
+    validate_coverage(incremental.document(), &result)?;
+    Ok(ApplySummary {
+        input_bytes,
+        edits,
+        checked_after_every_edit: check,
+        counters: incremental.counters(),
+        max_retained_index_estimate_bytes: incremental.max_retained_index_estimate_bytes(),
+        final_digest: result_digest(&result, incremental.counters()),
+    })
+}
+
+fn compare_with_full(
+    incremental: &IncrementalLexer,
+    document_index: usize,
+    edit_index: usize,
+) -> Result<(), String> {
+    let canonical_line_count = incremental
+        .document()
+        .bytes()
+        .filter(|byte| *byte == b'\n')
+        .count()
+        + 1;
+    if incremental.line_count() != canonical_line_count {
+        return Err(format!(
+            "line-cache partition mismatch in document {document_index}, after edit {edit_index}: cached {}, canonical {canonical_line_count}",
+            incremental.line_count()
+        ));
+    }
+    let actual = incremental.result();
+    let expected = full_lex(incremental.document());
+    validate_coverage(incremental.document(), &actual)?;
+    validate_coverage(incremental.document(), &expected)?;
+    if actual != expected {
+        return Err(format!(
+            "differential mismatch in document {document_index}, after edit {edit_index}"
+        ));
+    }
+    Ok(())
+}
+
+fn correctness_document(rng: &mut Rng, document_index: usize) -> String {
+    let mut document = String::new();
+    let patterns = [
+        "alpha_1 2048 ; ,",
+        "# line comment with /* inert text",
+        "\"string with \\\" escape\" tail",
+        "/* block */ after",
+        "λambda 雪 42",
+        "adjacent/**/delimiters",
+        "\"cross-line",
+        "string end\"",
+        "/* cross-line",
+        "block end */",
+        "",
+    ];
+    let line_count = 20 + rng.index(40);
+    for line in 0..line_count {
+        let pattern = patterns[(rng.next_u64() as usize + line + document_index) % patterns.len()];
+        document.push_str(pattern);
+        if line + 1 < line_count {
+            if (line + document_index).is_multiple_of(7) {
+                document.push_str("\r\n");
+            } else {
+                document.push('\n');
+            }
+        }
+    }
+    if document_index.is_multiple_of(3) {
+        document.push_str("\n/* intentionally unterminated");
+    } else if document_index % 3 == 1 {
+        document.push_str("\n\"intentionally unterminated\\");
+    }
+    document
+}
+
+fn generated_edit(document: &str, rng: &mut Rng, edit_index: usize) -> Edit {
+    let boundaries: Vec<usize> = (0..=document.len())
+        .filter(|position| document.is_char_boundary(*position))
+        .collect();
+    let start_boundary = rng.index(boundaries.len());
+    let max_advance = (boundaries.len() - 1 - start_boundary).min(8);
+    let end_boundary = start_boundary + rng.index(max_advance + 1);
+    let replacements = [
+        "alpha",
+        "7",
+        ";",
+        "",
+        "λ",
+        "雪",
+        "/*",
+        "*/",
+        "\"",
+        "\\",
+        "\n",
+        "\r\n",
+        "\"x\\\"y\"",
+        "# local",
+    ];
+    let replacement = replacements[(rng.next_u64() as usize + edit_index) % replacements.len()];
+    Edit {
+        start: boundaries[start_boundary],
+        deleted_bytes: boundaries[end_boundary] - boundaries[start_boundary],
+        replacement: replacement.to_string(),
+    }
+}
+
+struct BenchmarkFixture {
+    document: String,
+    starts: Vec<usize>,
+    body_lengths: Vec<usize>,
+    toggle_line: usize,
+    toggle_position: usize,
+}
+
+fn benchmark_fixture() -> BenchmarkFixture {
+    let toggle_line = 120_001;
+    let mut document = String::with_capacity(10 * 1024 * 1024);
+    let mut starts = Vec::with_capacity(BENCHMARK_LINES);
+    let mut body_lengths = Vec::with_capacity(BENCHMARK_LINES);
+    for line in 0..BENCHMARK_LINES {
+        starts.push(document.len());
+        let ending = if line + 1 == BENCHMARK_LINES {
+            ""
+        } else if line % 97 == 0 {
+            "\r\n"
+        } else {
+            "\n"
+        };
+        let body_target = 52 - ending.len();
+        let body = if line == toggle_line {
+            padded("zzpropagation_anchor", body_target, 'a')
+        } else if line + 1 == BENCHMARK_LINES {
+            padded("last_identifier_\"", body_target, 'u')
+        } else if line % 1000 == 0 {
+            String::new()
+        } else if line < 100_000 {
+            match line % 6 {
+                0 => padded("generated_identifier_", body_target, 'a'),
+                1 => padded("1234567890", body_target, '7'),
+                2 => padded("# local comment ", body_target, 'c'),
+                3 => padded("\"escaped \\\" quote ", body_target - 1, 's') + "\"",
+                4 => padded("/* closed block ", body_target - 2, 'b') + "*/",
+                _ => padded("λunicode_identifier_", body_target, 'm'),
+            }
+        } else if line % 3 == 0 {
+            padded("generated_identifier_", body_target, 'g')
+        } else if line % 3 == 1 {
+            padded("9988776655", body_target, '4')
+        } else {
+            padded("# suffix comment ", body_target, 'h')
+        };
+        body_lengths.push(body.len());
+        document.push_str(&body);
+        document.push_str(ending);
+    }
+    let toggle_position = starts[toggle_line];
+    assert_eq!(&document[toggle_position..toggle_position + 2], "zz");
+    BenchmarkFixture {
+        document,
+        starts,
+        body_lengths,
+        toggle_line,
+        toggle_position,
+    }
+}
+
+fn padded(prefix: &str, target_bytes: usize, fill: char) -> String {
+    assert!(prefix.len() <= target_bytes);
+    let mut value = String::with_capacity(target_bytes);
+    value.push_str(prefix);
+    value.extend(std::iter::repeat_n(fill, target_bytes - prefix.len()));
+    value
+}
+
+fn baseline_fixture(target_bytes: usize) -> String {
+    let mut document = String::with_capacity(target_bytes);
+    let line = "generated_identifier_012345678901234567890123456789\n";
+    while document.len() + line.len() <= target_bytes {
+        document.push_str(line);
+    }
+    document.extend(std::iter::repeat_n('x', target_bytes - document.len()));
+    document
+}
+
+fn edit(start: usize, deleted_bytes: usize, replacement: &str) -> Edit {
+    Edit {
+        start,
+        deleted_bytes,
+        replacement: replacement.to_string(),
+    }
+}
+
+fn mix_digest(mut accumulator: u64, value: &str) -> u64 {
+    for byte in value.bytes() {
+        accumulator ^= u64::from(byte);
+        accumulator = accumulator.wrapping_mul(0x100000001b3);
+    }
+    accumulator
+}
+
+#[derive(Debug, Clone)]
+struct Rng(u64);
+
+impl Rng {
+    fn new(seed: u64) -> Self {
+        Self(seed)
+    }
+
+    fn next_u64(&mut self) -> u64 {
+        let mut value = self.0;
+        value ^= value << 13;
+        value ^= value >> 7;
+        value ^= value << 17;
+        self.0 = value;
+        value
+    }
+
+    fn index(&mut self, upper: usize) -> usize {
+        assert!(upper > 0);
+        self.next_u64() as usize % upper
+    }
+}
+
+#[cfg(test)]
+mod binary_tests {
+    use super::*;
+
+    #[test]
+    fn canonical_reproducibility_bytes_compare_exact_values() {
+        let result = full_lex("/λ\r\n\"🙂🙂\n");
+        let counters = WorkCounters {
+            edits: 1,
+            lines_relexed: 3,
+            bytes_scanned: 15,
+        };
+        let first = canonical_result_and_counters_bytes(&result, counters).unwrap();
+        let second = canonical_result_and_counters_bytes(&result, counters).unwrap();
+        assert_eq!(first, second);
+
+        let changed = canonical_result_and_counters_bytes(
+            &result,
+            WorkCounters {
+                bytes_scanned: 16,
+                ..counters
+            },
+        )
+        .unwrap();
+        assert_ne!(first, changed);
+    }
+}
diff --git a/developer-simulation/runs/2026-08-09--incremental-syntax-highlighting/tests/fixtures/cross-line-edits.jsonl b/developer-simulation/runs/2026-08-09--incremental-syntax-highlighting/tests/fixtures/cross-line-edits.jsonl
new file mode 100644
index 0000000..e72e3e2
--- /dev/null
+++ b/developer-simulation/runs/2026-08-09--incremental-syntax-highlighting/tests/fixtures/cross-line-edits.jsonl
@@ -0,0 +1 @@
+{"start":3,"delete":2,"insert":"\r\n\"🙂🙂"}
diff --git a/developer-simulation/runs/2026-08-09--incremental-syntax-highlighting/tests/fixtures/cross-line-input.txt b/developer-simulation/runs/2026-08-09--incremental-syntax-highlighting/tests/fixtures/cross-line-input.txt
new file mode 100644
index 0000000..9d3a87e
--- /dev/null
+++ b/developer-simulation/runs/2026-08-09--incremental-syntax-highlighting/tests/fixtures/cross-line-input.txt
@@ -0,0 +1,2 @@
+/λa
+
diff --git a/developer-simulation/runs/2026-08-10--repair-cafe-kiosk/BRIEF.md b/developer-simulation/runs/2026-08-10--repair-cafe-kiosk/BRIEF.md
new file mode 100644
index 0000000..3a3305d
--- /dev/null
+++ b/developer-simulation/runs/2026-08-10--repair-cafe-kiosk/BRIEF.md
@@ -0,0 +1,50 @@
+# Trial 2: Repair-cafe tool lending kiosk
+
+## Persona
+
+You are the volunteer developer for a neighborhood repair cafe. You have strong Python and SQL experience and are an intermediate Rust user. You maintain the kiosk alone, have little time for operations, and need future volunteers to understand the data without specialized infrastructure knowledge.
+
+## Current system
+
+One laptop at the cafe desk tracks 8,000 tools and spare parts, 1,200 borrowers, and about 100,000 historical checkout, return, repair, and retirement events. Volunteers currently edit several CSV files and run a Python script that regenerates a "current inventory" CSV. A crash or duplicate row can leave the files disagreeing, and reconstructing who had an item on a past date is manual.
+
+The replacement is a local, single-user kiosk application. Exactly one process writes at a time; it does not need network sync, replication, or a server database. The old CSV files must be imported once and retained as read-only migration evidence.
+
+## Pain point
+
+Volunteers need a dependable answer to simple questions: Is this item lendable now? Who has it? When is it due? Why is it unavailable? What happened to it last month? They also need forgiving lookup by asset tag, serial number, tool name, and nickname. The current snapshot script cannot update state and history together or explain inconsistencies clearly.
+
+## Constraints
+
+- Run fully offline on a four-year-old laptop with 256 MiB available to the kiosk process.
+- Use a single local data directory that can be backed up by copying it while the kiosk is closed; no database server or cloud account.
+- Preserve exact event order and original source-row references from the CSV import.
+- A checkout, return, repair-status change, or retirement must either update both current state and history or update neither after a process interruption.
+- Replaying accepted events must deterministically reconstruct the same current inventory.
+- Reject an impossible transition, duplicate event ID, unknown borrower, or unknown item without changing visible state.
+- Search may be approximate, but opening a result must resolve to one exact item and its authoritative history.
+- Keep the application and dependency set small enough for one volunteer maintainer.
+
+## Baseline approach
+
+Replace the CSV files with a conventional embedded SQL database. Use transactions for an append-only event table plus current-state tables, ordinary indexes for tags and serials, and built-in text search or normalized substring matching for names and nicknames. The developer estimates this as a two-day implementation using familiar tools.
+
+## Acceptance criteria
+
+1. Import a representative fixture with 8,000 items, 1,200 borrowers, and 100,000 events; report every malformed or contradictory source row without silently inventing state.
+2. For a fixed golden set, answer current holder, due date, lendability, and historical status-at-time queries exactly.
+3. Pass a table-driven state-transition suite covering checkout, return, repair, retirement, duplicate IDs, and invalid references; every rejected command leaves state and history unchanged.
+4. Across interruption tests at each modeled write boundary, reopening shows either the complete old state or the complete new state, never a split state/history update.
+5. Rebuild current inventory from accepted events and match the stored current view byte-for-byte across three runs.
+6. Find a known item in the first five results for at least 45 of 50 typo, abbreviation, tag, serial, name, and nickname queries; every result opens the exact canonical item.
+7. On the declared laptop, open the 100,000-event data set in under two seconds and keep warm single-item lookup p95 under 50 ms across 1,000 queries.
+8. Compare code size, dependency burden, backup and recovery steps, and failure behavior with the embedded-SQL baseline before recommending adoption.
+
+## Non-goals
+
+- Multi-laptop synchronization, concurrent writers, remote access, or cloud backup.
+- Payments, fines, identity verification, or legal record retention.
+- Automated purchasing, demand forecasting, or repair recommendations.
+- Image recognition or searching photographs of tools.
+- Replacing the retained original CSV files as migration evidence.
+- Scaling beyond one repair cafe in this trial.
diff --git a/developer-simulation/runs/2026-08-10--repair-cafe-kiosk/Cargo.toml b/developer-simulation/runs/2026-08-10--repair-cafe-kiosk/Cargo.toml
new file mode 100644
index 0000000..d756b51
--- /dev/null
+++ b/developer-simulation/runs/2026-08-10--repair-cafe-kiosk/Cargo.toml
@@ -0,0 +1,10 @@
+[package]
+name = "repair-cafe-fold-trial"
+version = "0.1.0"
+edition = "2024"
+publish = false
+
+[dependencies]
+fold = { path = "../../../fold" }
+libc = "0.2"
+serde = { version = "1", features = ["derive"] }
diff --git a/developer-simulation/runs/2026-08-10--repair-cafe-kiosk/DISCOVERY.md b/developer-simulation/runs/2026-08-10--repair-cafe-kiosk/DISCOVERY.md
new file mode 100644
index 0000000..860bd0a
--- /dev/null
+++ b/developer-simulation/runs/2026-08-10--repair-cafe-kiosk/DISCOVERY.md
@@ -0,0 +1,62 @@
+# Discovery log
+
+## Brief-first understanding
+
+I am the volunteer maintainer described in `BRIEF.md`: experienced with Python and SQL, but only intermediate in Rust. The replacement kiosk is deliberately a small, offline, single-writer system. Its hard problems are durable event ordering, referential and transition validation, atomic history/current-state updates, deterministic replay, and understandable recovery. Approximate search is useful but secondary.
+
+My conventional baseline is an embedded SQL database with one append-only event table, item and borrower tables, a current-item table updated in the same transaction, uniqueness and foreign-key constraints, ordinary normalized lookup indexes, and either built-in full-text search or a small application-level fuzzy matcher. I expect this to take about two days and to give future volunteers familiar inspection, backup, and recovery tools.
+
+## Public-material discovery order
+
+1. Read the trial brief in full.
+2. Read the root `README.md`.
+3. Read all four public examples (`starter`, `timeseries`, `search`, and `chat`) and their manifests.
+4. Wrote this initial hypothesis before inspecting implementation source or internal documentation.
+
+## Initial component-fit hypothesis
+
+- **Fold: plausible partial fit, requiring proof.** The public examples show one write transaction updating multiple persistent materialized views and one consistent read snapshot. That directly targets the split history/current-state failure. `KeyedStream` and `Table` may also support stable identifiers. I need to determine whether I can validate duplicate IDs, item/borrower references, and legal transitions before a write while keeping accepted events and current state atomic, and whether ordered history-at-time queries avoid a full scan.
+- **ESE: likely not a fit.** Semantic embeddings are not required for asset tags, serial numbers, abbreviations, names, or nicknames. The kiosk has a strict 256 MiB budget and must remain easy to maintain offline. Normalization plus substring/token matching is the baseline until measurements show it misses the golden search set.
+- **ANNy: likely not a fit.** Eight thousand inventory rows do not justify an HNSW index unless embedding search materially improves the fixed lookup set. It adds an approximate index and operational concepts while every selected result still needs canonical-ID resolution.
+
+## Baseline and trial plan
+
+I will first implement the smallest Fold-backed event/current-state prototype that can expose the important boundaries: master records, accepted events indexed by ID, current state by item, and an event history view. Validation will happen in the single writer before opening the Fold write transaction; the transaction must then update every derived view together. Tests will cover legal transitions, duplicate IDs, unknown references, deterministic replay, reopening, and unchanged snapshots after rejection.
+
+I will use a generated representative fixture only if the small correctness model succeeds. The performance run should include 8,000 items, 1,200 borrowers, and 100,000 accepted events, then measure reopen, 1,000 warm exact lookups, deterministic rebuild, and a 50-query normalized search set. I will model interruptions at the application-visible boundaries that the public API exposes and separately document what that does and does not establish about real crash durability.
+
+The adoption decision will compare this against embedded SQL on code and dependency burden, backup/recovery clarity, schema/constraint support, history query shape, and failure behavior. A successful Fold demo is not enough: Fold must beat or materially simplify the baseline for this particular kiosk.
+
+## Discovery and debugging trail
+
+- Source inspection confirmed that one `wtx` uses one underlying Fjall write transaction for every pipeline sink. `Tx::rtx` flushes buffered operators into that still-uncommitted transaction, and a panic aborts both the underlying transaction and pending pipeline state. This was stronger and clearer than I expected from the short README.
+- I first tried the default `cargo test`; dependency resolution attempted to reach crates.io and failed because this checkout has no network. `cargo test --offline` used the existing cache and succeeded. I treat this as an execution-environment event, not a BogKit defect.
+- The first search fixture scored 42/50 because I accidentally generated some nickname queries for the wrong tool category. I fixed the fixture, not the ranking algorithm; the corrected, category-matched golden set scored 50/50. This is prototype evidence only because the queries are synthetic.
+- The first memory harness rebuilt three databases sequentially in one process. Its allocator retained pages and the peak rose from 130.9 MiB after import to 260.2 MiB after the third rebuild, just above the kiosk budget. I corrected the experiment so the three stated "runs" are genuinely separate child processes and compare streamed canonical-view files byte-for-byte. Corrected runs observed 172.4-173.6 MiB coordinator peaks and 130.1-172.7 MiB rebuild-child peaks, all under the limit.
+- `/usr/bin/time -l` could not report resident memory in this sandbox (`sysctl kern.clockrate: Operation not permitted`). The final harness reads its own `getrusage(RUSAGE_SELF)` value, adding only a direct `libc` declaration for measurement; `libc` was already transitive through Fold's storage stack.
+- The interruption child now forces a mid-transaction `rtx`, proving the event and projection are visible inside the uncommitted transaction, and then aborts the process. Reopening sees the complete old state. A separately committed write reopens with the complete new event and projection.
+
+## Final fit conclusion
+
+Fold can implement this kiosk correctly at the representative scale, and its atomic multi-view transaction is genuine value. I would still choose embedded SQL for the production kiosk. The requirements are dominated by uniqueness, references, state-transition checks, ordered history, ad hoc inspection, and boring backup/recovery. Fold leaves those rules in application code and requires bespoke typed pipeline plumbing, while the conventional baseline expresses most of them in familiar tables, indexes, constraints, and transactions.
+
+ESE and ANNy remain no-fit. The 50-query normalized lookup set passed without embeddings or approximate vectors. Moreover, selecting Fold alone still brought ANNy into the normal dependency graph because `fold` depends on it unconditionally; that weakens the component-selective story for a small offline application.
+
+## Skeptical review: ordering failure and correction
+
+The reviewer found an important prototype bug in my caller-supplied event ordering. Before the fix, this exact sequence reproduced it:
+
+1. accept a checkout with `sequence=10`;
+2. submit a distinct return with `sequence=5`;
+3. live preflight sees the currently checked-out state and accepts the return;
+4. the aggregate sorts history as return-before-checkout and `replay(...).expect(...)` panics with `accepted event history must replay`.
+
+The root cause was a mismatch between the write boundary and the materialization rule: validation considered only current state, while replay treated the caller's sequence as authoritative historical order. Because the reviewer separately confirmed that a caught Fold write panic poisons the current writer lock, this prototype panic could also make later valid writes fail. That consequence strengthens the no-fit decision: application invariants around Fold must be explicit and must be checked before entering `wtx`.
+
+I chose a strict, global append-only contract. Every accepted event sequence is unique and must be greater than the latest accepted sequence across the kiosk. Live writes now scan accepted events to reject a reused or non-increasing sequence before `wtx`; import validation applies the same checks and advances the ID/sequence sets only for accepted rows. Backdated insertion is intentionally unsupported. A correction must arrive as a new later event rather than being inserted into prior history.
+
+Two permanent regressions cover the policy. A table-driven live test accepts checkout 10, rejects return 5 and a distinct return 10 with exact errors, proves event history/current state are byte-for-byte unchanged after each rejection, then commits return 11 successfully in the same writer. A separate import test accepts sequences 10 and 11 while reporting sequence 5 as out-of-order and the second 10 as duplicate. The transactional `expect` remains only as an internal invariant assertion: caller-controlled ordering and transitions are now validated under the stated single-writer rule before entering the transaction.
+
+The small correction deliberately scans all accepted event rows to find the latest sequence and detect reuse, making each live command O(total events). That is correct for this bounded proof but not a production-grade sequence allocator or index. I am recording the cost instead of adding another materialized view or subsystem to a trial whose recommendation remains embedded SQL.
+
+During final parallel test verification, one test intermittently failed to open its database with Fjall `Locked`. The harness generated paths from process ID plus wall-clock nanoseconds, so concurrently starting tests could still collide at the host clock's effective resolution. I added an atomic per-process suffix to every generated path. Three consecutive six-test runs then passed. This was a prototype fixture-isolation issue; it is not included as BogKit evidence.
diff --git a/developer-simulation/runs/2026-08-10--repair-cafe-kiosk/README.md b/developer-simulation/runs/2026-08-10--repair-cafe-kiosk/README.md
new file mode 100644
index 0000000..5cde636
--- /dev/null
+++ b/developer-simulation/runs/2026-08-10--repair-cafe-kiosk/README.md
@@ -0,0 +1,23 @@
+# Repair-cafe kiosk Fold trial
+
+This is a deliberately narrow, offline prototype used to decide whether Fold should replace a conventional embedded SQL database for a single-writer tool-lending kiosk.
+
+It stores item and borrower master rows, accepted events by immutable ID, and a per-item current-state/history projection in one Fold database. The application validates references, strict append-only sequence order, and transitions before each single-writer transaction. ESE and ANNy are not selected as application features or declared as direct dependencies: deterministic normalized lookup is enough for this fixture and remains easier to operate under the 256 MiB limit. Current Fold still pulls ANNy into the normal dependency graph transitively; the trial records that as packaging friction.
+
+Run from the `developer-simulation/` workspace root. The archived performance
+evidence uses the workspace's ordinary release profile:
+
+```sh
+cargo test --offline --locked --release -p repair-cafe-fold-trial --all-targets
+cargo fmt -p repair-cafe-fold-trial -- --check
+cargo clippy --offline --locked --release -p repair-cafe-fold-trial --all-targets --all-features -- -D warnings
+cargo run --offline --locked --release -p repair-cafe-fold-trial -- demo
+cargo run --offline --locked --release -p repair-cafe-fold-trial -- interruption
+cargo run --offline --locked --release -p repair-cafe-fold-trial -- benchmark
+```
+
+`benchmark` generates 8,000 items, 1,200 borrowers, 100,000 valid ordered events, four contradictory source rows, and one malformed row. It imports and checkpoints the accepted data, reports every rejected row, measures reopen and point lookups, exercises 50 search queries, and reconstructs the materialized view independently three times.
+
+`interruption` launches a child that aborts after writing an event inside an uncommitted Fold transaction, verifies the old state after reopening, then verifies the complete new state after a committed write. It models process interruption at the application-visible boundaries, not power loss or arbitrary storage corruption.
+
+Generated databases live under this prototype's ignored `target/` directory and successful runs delete them. The deliberately aborting interruption child can leave database residue there until the parent or a later cleanup removes it.
diff --git a/developer-simulation/runs/2026-08-10--repair-cafe-kiosk/fixtures/README.md b/developer-simulation/runs/2026-08-10--repair-cafe-kiosk/fixtures/README.md
new file mode 100644
index 0000000..5307d98
--- /dev/null
+++ b/developer-simulation/runs/2026-08-10--repair-cafe-kiosk/fixtures/README.md
@@ -0,0 +1,10 @@
+# Representative fixture
+
+The executable deterministically generates the representative fixture so that the repository does not carry a large generated data file:
+
+- 8,000 uniquely identified items with asset tag, serial, name, nickname, and source-row reference;
+- 1,200 borrowers with source-row references;
+- 100,000 ordered checkout/return events with immutable IDs and source-row references;
+- five rejected rows: duplicate event ID, unknown item, unknown borrower, impossible return, and a malformed row missing its event ID.
+
+Run `cargo run --release -- benchmark` to generate, validate, import, query, replay, and remove the fixture.
diff --git a/developer-simulation/runs/2026-08-10--repair-cafe-kiosk/src/main.rs b/developer-simulation/runs/2026-08-10--repair-cafe-kiosk/src/main.rs
new file mode 100644
index 0000000..1471178
--- /dev/null
+++ b/developer-simulation/runs/2026-08-10--repair-cafe-kiosk/src/main.rs
@@ -0,0 +1,1154 @@
+use std::collections::{HashMap, HashSet};
+use std::io::{BufReader, BufWriter, Read, Write};
+use std::path::{Path, PathBuf};
+use std::sync::atomic::{AtomicU64, Ordering};
+use std::time::{Duration, Instant, SystemTime, UNIX_EPOCH};
+
+use fold::pipeline::{FilterMap, KeyBy, Keyed, terminal};
+use fold::stream::Stream;
+use serde::{Deserialize, Serialize};
+
+const ITEM_NAMES: [(&str, &str, &str); 8] = [
+    ("Cordless Drill", "blue drill", "CD"),
+    ("Soldering Iron", "hot pencil", "SI"),
+    ("Socket Set", "ratchet box", "SS"),
+    ("Circular Saw", "round saw", "CS"),
+    ("Multimeter", "meter", "MM"),
+    ("Sewing Machine", "stitcher", "SM"),
+    ("Pipe Wrench", "red wrench", "PW"),
+    ("Heat Gun", "hot blower", "HG"),
+];
+
+static NEXT_TEMP_ID: AtomicU64 = AtomicU64::new(0);
+
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+struct Item {
+    id: String,
+    asset_tag: String,
+    serial: String,
+    name: String,
+    nickname: String,
+    source_row: String,
+}
+
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+struct Borrower {
+    id: String,
+    name: String,
+    source_row: String,
+}
+
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+enum EventKind {
+    Checkout { borrower_id: String, due_day: u32 },
+    Return,
+    RepairStart { reason: String },
+    RepairFinish,
+    Retire { reason: String },
+}
+
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+struct Event {
+    id: String,
+    sequence: u64,
+    at_day: u32,
+    item_id: String,
+    kind: EventKind,
+    source_row: String,
+}
+
+#[derive(Clone, Debug, Default, PartialEq, Eq, Serialize, Deserialize)]
+enum ItemState {
+    #[default]
+    Available,
+    CheckedOut {
+        borrower_id: String,
+        due_day: u32,
+    },
+    InRepair {
+        reason: String,
+    },
+    Retired {
+        reason: String,
+    },
+}
+
+#[derive(Clone, Debug, Default, PartialEq, Eq, Serialize, Deserialize)]
+struct Projection {
+    state: ItemState,
+    history: Vec<Event>,
+}
+
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+enum Record {
+    Item(Item),
+    Borrower(Borrower),
+    Event(Event),
+}
+
+type ItemBranch = FilterMap<
+    fn(&Record) -> Option<Keyed<String, Item>>,
+    terminal::Table<String, Item>,
+    Record,
+    Keyed<String, Item>,
+>;
+type BorrowerBranch = FilterMap<
+    fn(&Record) -> Option<Keyed<String, Borrower>>,
+    terminal::Table<String, Borrower>,
+    Record,
+    Keyed<String, Borrower>,
+>;
+type EventBranch = FilterMap<
+    fn(&Record) -> Option<Keyed<String, Event>>,
+    terminal::Table<String, Event>,
+    Record,
+    Keyed<String, Event>,
+>;
+type ProjectionAggregate = fold::pipeline::Aggregate<
+    String,
+    Event,
+    Projection,
+    fn(&mut Projection, &Event, isize),
+    terminal::Table<String, Projection>,
+>;
+type ProjectionBranch = FilterMap<
+    fn(&Record) -> Option<Event>,
+    KeyBy<fn(&Event) -> String, ProjectionAggregate, String, Event>,
+    Record,
+    Event,
+>;
+type KioskPipeline = (ItemBranch, BorrowerBranch, EventBranch, ProjectionBranch);
+type Kiosk = Stream<Record, KioskPipeline>;
+
+#[derive(Debug)]
+struct ImportSummary {
+    accepted_events: usize,
+    rejected_rows: Vec<(String, String)>,
+    elapsed: Duration,
+}
+
+fn item_record(record: &Record) -> Option<Keyed<String, Item>> {
+    match record {
+        Record::Item(item) => Some(Keyed::new(item.id.clone(), item.clone())),
+        _ => None,
+    }
+}
+
+fn borrower_record(record: &Record) -> Option<Keyed<String, Borrower>> {
+    match record {
+        Record::Borrower(borrower) => Some(Keyed::new(borrower.id.clone(), borrower.clone())),
+        _ => None,
+    }
+}
+
+fn event_record(record: &Record) -> Option<Keyed<String, Event>> {
+    match record {
+        Record::Event(event) => Some(Keyed::new(event.id.clone(), event.clone())),
+        _ => None,
+    }
+}
+
+fn event_only(record: &Record) -> Option<Event> {
+    match record {
+        Record::Event(event) => Some(event.clone()),
+        _ => None,
+    }
+}
+
+fn event_item(event: &Event) -> String {
+    event.item_id.clone()
+}
+
+fn projection_step(projection: &mut Projection, event: &Event, delta: isize) {
+    if delta > 0 {
+        for _ in 0..delta {
+            projection.history.push(event.clone());
+        }
+    } else {
+        for _ in 0..delta.unsigned_abs() {
+            if let Some(index) = projection.history.iter().position(|e| e.id == event.id) {
+                projection.history.remove(index);
+            }
+        }
+    }
+    projection
+        .history
+        .sort_by(|a, b| (a.sequence, &a.id).cmp(&(b.sequence, &b.id)));
+    projection.state = replay(&projection.history).expect("accepted event history must replay");
+}
+
+fn open(path: &Path) -> Kiosk {
+    Stream::new(
+        path,
+        (
+            FilterMap::new(
+                item_record as fn(&Record) -> Option<Keyed<String, Item>>,
+                terminal::Table::new("items"),
+            ),
+            FilterMap::new(
+                borrower_record as fn(&Record) -> Option<Keyed<String, Borrower>>,
+                terminal::Table::new("borrowers"),
+            ),
+            FilterMap::new(
+                event_record as fn(&Record) -> Option<Keyed<String, Event>>,
+                terminal::Table::new("events_by_id"),
+            ),
+            FilterMap::new(
+                event_only as fn(&Record) -> Option<Event>,
+                KeyBy::new(
+                    event_item as fn(&Event) -> String,
+                    fold::pipeline::Aggregate::new(
+                        "projection_by_item",
+                        projection_step as fn(&mut Projection, &Event, isize),
+                        terminal::Table::new("projections"),
+                    ),
+                ),
+            ),
+        ),
+    )
+}
+
+fn transition(state: &ItemState, kind: &EventKind) -> Result<ItemState, String> {
+    match (state, kind) {
+        (
+            ItemState::Available,
+            EventKind::Checkout {
+                borrower_id,
+                due_day,
+            },
+        ) => Ok(ItemState::CheckedOut {
+            borrower_id: borrower_id.clone(),
+            due_day: *due_day,
+        }),
+        (ItemState::CheckedOut { .. }, EventKind::Return) => Ok(ItemState::Available),
+        (ItemState::Available, EventKind::RepairStart { reason }) => Ok(ItemState::InRepair {
+            reason: reason.clone(),
+        }),
+        (ItemState::InRepair { .. }, EventKind::RepairFinish) => Ok(ItemState::Available),
+        (ItemState::Available, EventKind::Retire { reason }) => Ok(ItemState::Retired {
+            reason: reason.clone(),
+        }),
+        (ItemState::Retired { .. }, _) => Err("item is retired".to_string()),
+        (state, kind) => Err(format!("impossible transition: {state:?} -> {kind:?}")),
+    }
+}
+
+fn replay(events: &[Event]) -> Result<ItemState, String> {
+    let mut state = ItemState::Available;
+    for event in events {
+        state = transition(&state, &event.kind)
+            .map_err(|error| format!("{} at {}: {error}", event.id, event.source_row))?;
+    }
+    Ok(state)
+}
+
+fn validate_event(kiosk: &Kiosk, event: &Event) -> Result<(), String> {
+    kiosk.rtx(|(items, borrowers, events, projections)| {
+        if events.contains(&event.id) {
+            return Err(format!("duplicate event id {}", event.id));
+        }
+        let mut latest_sequence = None;
+        for (_, accepted) in events.iter() {
+            if accepted.sequence == event.sequence {
+                return Err(format!("duplicate event sequence {}", event.sequence));
+            }
+            latest_sequence = Some(latest_sequence.map_or(accepted.sequence, |latest: u64| {
+                latest.max(accepted.sequence)
+            }));
+        }
+        if let Some(latest) = latest_sequence
+            && event.sequence <= latest
+        {
+            return Err(format!(
+                "out-of-order event sequence {}; latest accepted sequence is {latest}",
+                event.sequence
+            ));
+        }
+        if !items.contains(&event.item_id) {
+            return Err(format!("unknown item {}", event.item_id));
+        }
+        if let EventKind::Checkout { borrower_id, .. } = &event.kind
+            && !borrowers.contains(borrower_id)
+        {
+            return Err(format!("unknown borrower {borrower_id}"));
+        }
+        let state = projections
+            .get(&event.item_id)
+            .map_or(ItemState::Available, |projection| projection.state);
+        transition(&state, &event.kind).map(|_| ())
+    })
+}
+
+fn apply_event(kiosk: &mut Kiosk, event: Event) -> Result<(), String> {
+    validate_event(kiosk, &event)?;
+    kiosk.wtx(|tx| tx.insert(&Record::Event(event)));
+    Ok(())
+}
+
+fn visible_fingerprint(kiosk: &Kiosk) -> String {
+    kiosk.rtx(|(_, _, events, projections)| {
+        let mut event_rows: Vec<_> = events.iter().collect();
+        event_rows.sort_by(|a, b| a.0.cmp(&b.0));
+        let mut projection_rows: Vec<_> = projections.iter().collect();
+        projection_rows.sort_by(|a, b| a.0.cmp(&b.0));
+        format!("events={event_rows:?}\nprojections={projection_rows:?}")
+    })
+}
+
+fn state_at(kiosk: &Kiosk, item_id: &str, at_day: u32) -> Option<ItemState> {
+    kiosk.rtx(|(_, _, _, projections)| {
+        let projection = projections.get(&item_id.to_string())?;
+        let events: Vec<_> = projection
+            .history
+            .into_iter()
+            .filter(|event| event.at_day <= at_day)
+            .collect();
+        replay(&events).ok()
+    })
+}
+
+fn insert_masters(kiosk: &mut Kiosk, items: &[Item], borrowers: &[Borrower]) {
+    for chunk in items.chunks(1_000) {
+        kiosk.wtx(|tx| {
+            for item in chunk {
+                tx.insert(&Record::Item(item.clone()));
+            }
+        });
+    }
+    for chunk in borrowers.chunks(1_000) {
+        kiosk.wtx(|tx| {
+            for borrower in chunk {
+                tx.insert(&Record::Borrower(borrower.clone()));
+            }
+        });
+    }
+}
+
+fn insert_events(kiosk: &mut Kiosk, events: &[Event]) {
+    for chunk in events.chunks(1_000) {
+        kiosk.wtx(|tx| {
+            for event in chunk {
+                tx.insert(&Record::Event(event.clone()));
+            }
+        });
+    }
+}
+
+fn fixture() -> (Vec<Item>, Vec<Borrower>, Vec<Event>, Vec<Event>) {
+    let items: Vec<_> = (0..8_000)
+        .map(|index| {
+            let (name, nickname, _) = ITEM_NAMES[index % ITEM_NAMES.len()];
+            Item {
+                id: format!("item-{index:05}"),
+                asset_tag: format!("RC-{index:05}"),
+                serial: format!("SN{index:08}"),
+                name: format!("{name} {index:05}"),
+                nickname: format!("{nickname} {index:05}"),
+                source_row: format!("items.csv:{}", index + 2),
+            }
+        })
+        .collect();
+    let borrowers: Vec<_> = (0..1_200)
+        .map(|index| Borrower {
+            id: format!("borrower-{index:04}"),
+            name: format!("Borrower {index:04}"),
+            source_row: format!("borrowers.csv:{}", index + 2),
+        })
+        .collect();
+    let mut events = Vec::with_capacity(100_000);
+    for pair in 0..50_000_u64 {
+        let item_index = pair as usize % items.len();
+        let borrower_index = pair as usize % borrowers.len();
+        let checkout_seq = pair * 2;
+        events.push(Event {
+            id: format!("event-{checkout_seq:06}"),
+            sequence: checkout_seq,
+            at_day: (checkout_seq / 500) as u32,
+            item_id: items[item_index].id.clone(),
+            kind: EventKind::Checkout {
+                borrower_id: borrowers[borrower_index].id.clone(),
+                due_day: (checkout_seq / 500) as u32 + 14,
+            },
+            source_row: format!("events.csv:{}", checkout_seq + 2),
+        });
+        events.push(Event {
+            id: format!("event-{:06}", checkout_seq + 1),
+            sequence: checkout_seq + 1,
+            at_day: (checkout_seq / 500) as u32 + 1,
+            item_id: items[item_index].id.clone(),
+            kind: EventKind::Return,
+            source_row: format!("events.csv:{}", checkout_seq + 3),
+        });
+    }
+    let rejected = vec![
+        Event {
+            id: events[0].id.clone(),
+            sequence: 100_000,
+            at_day: 300,
+            item_id: items[0].id.clone(),
+            kind: EventKind::Checkout {
+                borrower_id: borrowers[0].id.clone(),
+                due_day: 314,
+            },
+            source_row: "events.csv:100002".to_string(),
+        },
+        Event {
+            id: "event-bad-item".to_string(),
+            sequence: 100_001,
+            at_day: 300,
+            item_id: "item-missing".to_string(),
+            kind: EventKind::RepairStart {
+                reason: "broken".to_string(),
+            },
+            source_row: "events.csv:100003".to_string(),
+        },
+        Event {
+            id: "event-bad-borrower".to_string(),
+            sequence: 100_002,
+            at_day: 300,
+            item_id: items[1].id.clone(),
+            kind: EventKind::Checkout {
+                borrower_id: "borrower-missing".to_string(),
+                due_day: 314,
+            },
+            source_row: "events.csv:100004".to_string(),
+        },
+        Event {
+            id: "event-bad-transition".to_string(),
+            sequence: 100_003,
+            at_day: 300,
+            item_id: items[2].id.clone(),
+            kind: EventKind::Return,
+            source_row: "events.csv:100005".to_string(),
+        },
+    ];
+    (items, borrowers, events, rejected)
+}
+
+fn validate_fixture(
+    items: &[Item],
+    borrowers: &[Borrower],
+    candidates: &[Event],
+) -> (Vec<Event>, Vec<(String, String)>) {
+    let known_items: HashSet<_> = items.iter().map(|item| item.id.as_str()).collect();
+    let known_borrowers: HashSet<_> = borrowers
+        .iter()
+        .map(|borrower| borrower.id.as_str())
+        .collect();
+    let mut ids = HashSet::new();
+    let mut sequences = HashSet::new();
+    let mut latest_sequence = None;
+    let mut states: HashMap<&str, ItemState> = HashMap::new();
+    let mut accepted = Vec::new();
+    let mut rejected = Vec::new();
+    for event in candidates {
+        let result = if ids.contains(event.id.as_str()) {
+            Err(format!("duplicate event id {}", event.id))
+        } else if sequences.contains(&event.sequence) {
+            Err(format!("duplicate event sequence {}", event.sequence))
+        } else if let Some(latest) = latest_sequence
+            && event.sequence <= latest
+        {
+            Err(format!(
+                "out-of-order event sequence {}; latest accepted sequence is {latest}",
+                event.sequence
+            ))
+        } else if !known_items.contains(event.item_id.as_str()) {
+            Err(format!("unknown item {}", event.item_id))
+        } else if let EventKind::Checkout { borrower_id, .. } = &event.kind {
+            if !known_borrowers.contains(borrower_id.as_str()) {
+                Err(format!("unknown borrower {borrower_id}"))
+            } else {
+                let state = states.entry(event.item_id.as_str()).or_default();
+                transition(state, &event.kind).map(|next| *state = next)
+            }
+        } else {
+            let state = states.entry(event.item_id.as_str()).or_default();
+            transition(state, &event.kind).map(|next| *state = next)
+        };
+        match result {
+            Ok(()) => {
+                ids.insert(event.id.as_str());
+                sequences.insert(event.sequence);
+                latest_sequence = Some(event.sequence);
+                accepted.push(event.clone());
+            }
+            Err(error) => rejected.push((event.source_row.clone(), error)),
+        }
+    }
+    (accepted, rejected)
+}
+
+fn import_fixture(path: &Path) -> ImportSummary {
+    let started = Instant::now();
+    let (items, borrowers, events, rejected_probes) = fixture();
+    let mut candidates = events;
+    candidates.extend(rejected_probes);
+    let (accepted, mut rejected_rows) = validate_fixture(&items, &borrowers, &candidates);
+    rejected_rows.push((
+        "events.csv:100006".to_string(),
+        "malformed row: missing event id".to_string(),
+    ));
+    let mut kiosk = open(path);
+    insert_masters(&mut kiosk, &items, &borrowers);
+    insert_events(&mut kiosk, &accepted);
+    kiosk.checkpoint();
+    ImportSummary {
+        accepted_events: accepted.len(),
+        rejected_rows,
+        elapsed: started.elapsed(),
+    }
+}
+
+fn write_canonical_projection(kiosk: &Kiosk, path: &Path) {
+    let file = std::fs::File::create(path).expect("create canonical projection");
+    let mut writer = BufWriter::new(file);
+    kiosk.rtx(|(_, _, _, projections)| {
+        for (item_id, projection) in projections.iter() {
+            writeln!(writer, "{item_id:?}\t{projection:?}").expect("write canonical row");
+        }
+    });
+    writer.flush().expect("flush canonical projection");
+}
+
+fn files_equal(left: &Path, right: &Path) -> bool {
+    let left_file = std::fs::File::open(left).expect("open left canonical projection");
+    let right_file = std::fs::File::open(right).expect("open right canonical projection");
+    let mut left = BufReader::new(left_file);
+    let mut right = BufReader::new(right_file);
+    let mut left_buf = [0_u8; 64 * 1_024];
+    let mut right_buf = [0_u8; 64 * 1_024];
+    loop {
+        let left_count = left
+            .read(&mut left_buf)
+            .expect("read left canonical projection");
+        let right_count = right
+            .read(&mut right_buf)
+            .expect("read right canonical projection");
+        if left_count != right_count || left_buf[..left_count] != right_buf[..right_count] {
+            return false;
+        }
+        if left_count == 0 {
+            return true;
+        }
+    }
+}
+
+fn normalize(value: &str) -> String {
+    value
+        .chars()
+        .filter(|character| character.is_ascii_alphanumeric())
+        .flat_map(char::to_lowercase)
+        .collect()
+}
+
+fn edit_distance(left: &str, right: &str) -> usize {
+    let right: Vec<char> = right.chars().collect();
+    let mut previous: Vec<usize> = (0..=right.len()).collect();
+    for (left_index, left_char) in left.chars().enumerate() {
+        let mut current = vec![left_index + 1];
+        for (right_index, right_char) in right.iter().enumerate() {
+            current.push(std::cmp::min(
+                std::cmp::min(current[right_index] + 1, previous[right_index + 1] + 1),
+                previous[right_index] + usize::from(left_char != *right_char),
+            ));
+        }
+        previous = current;
+    }
+    previous[right.len()]
+}
+
+fn initials(value: &str) -> String {
+    value
+        .split_whitespace()
+        .filter_map(|word| word.chars().next())
+        .flat_map(char::to_lowercase)
+        .collect()
+}
+
+fn search(kiosk: &Kiosk, query: &str, limit: usize) -> Vec<String> {
+    let query = normalize(query);
+    kiosk.rtx(|(items, _, _, _)| {
+        let mut scored: Vec<(usize, String)> = items
+            .iter()
+            .map(|(_, item)| {
+                let fields = [
+                    normalize(&item.asset_tag),
+                    normalize(&item.serial),
+                    normalize(&item.name),
+                    normalize(&item.nickname),
+                    format!("{}{}", initials(&item.name), normalize(&item.name)),
+                ];
+                let score = fields
+                    .iter()
+                    .map(|field| {
+                        if field == &query {
+                            0
+                        } else if field.contains(&query) || query.contains(field) {
+                            1
+                        } else {
+                            edit_distance(field, &query) + 2
+                        }
+                    })
+                    .min()
+                    .unwrap_or(usize::MAX);
+                (score, item.id)
+            })
+            .collect();
+        scored.sort();
+        scored.into_iter().take(limit).map(|(_, id)| id).collect()
+    })
+}
+
+fn percentile_95(mut timings: Vec<Duration>) -> Duration {
+    timings.sort();
+    timings[(timings.len() * 95 / 100).min(timings.len() - 1)]
+}
+
+fn peak_rss_mib() -> Option<f64> {
+    let mut usage = std::mem::MaybeUninit::<libc::rusage>::uninit();
+    // SAFETY: getrusage initializes the supplied rusage structure on success.
+    let status = unsafe { libc::getrusage(libc::RUSAGE_SELF, usage.as_mut_ptr()) };
+    if status != 0 {
+        return None;
+    }
+    // SAFETY: a zero getrusage return means the structure was initialized.
+    let usage = unsafe { usage.assume_init() };
+    #[cfg(target_os = "macos")]
+    let bytes = usage.ru_maxrss as f64;
+    #[cfg(not(target_os = "macos"))]
+    let bytes = usage.ru_maxrss as f64 * 1_024.0;
+    Some(bytes / 1_048_576.0)
+}
+
+fn unique_temp(label: &str) -> PathBuf {
+    let stamp = SystemTime::now()
+        .duration_since(UNIX_EPOCH)
+        .expect("clock")
+        .as_nanos();
+    PathBuf::from(env!("CARGO_MANIFEST_DIR"))
+        .join("target")
+        .join(format!(
+            "repair-cafe-{label}-{}-{stamp}-{}",
+            std::process::id(),
+            NEXT_TEMP_ID.fetch_add(1, Ordering::Relaxed)
+        ))
+}
+
+fn seed_small(path: &Path) -> Kiosk {
+    let mut kiosk = open(path);
+    let item = Item {
+        id: "item-00001".to_string(),
+        asset_tag: "RC-00001".to_string(),
+        serial: "SN00000001".to_string(),
+        name: "Cordless Drill 00001".to_string(),
+        nickname: "blue drill 00001".to_string(),
+        source_row: "items.csv:2".to_string(),
+    };
+    let borrower = Borrower {
+        id: "borrower-0001".to_string(),
+        name: "Alex".to_string(),
+        source_row: "borrowers.csv:2".to_string(),
+    };
+    insert_masters(&mut kiosk, &[item], &[borrower]);
+    kiosk
+}
+
+fn event(id: &str, sequence: u64, at_day: u32, kind: EventKind) -> Event {
+    Event {
+        id: id.to_string(),
+        sequence,
+        at_day,
+        item_id: "item-00001".to_string(),
+        kind,
+        source_row: format!("events.csv:{}", sequence + 2),
+    }
+}
+
+fn run_demo() {
+    let path = unique_temp("demo");
+    let mut kiosk = seed_small(&path);
+    let checkout = event(
+        "event-000001",
+        1,
+        10,
+        EventKind::Checkout {
+            borrower_id: "borrower-0001".to_string(),
+            due_day: 24,
+        },
+    );
+    apply_event(&mut kiosk, checkout.clone()).expect("checkout");
+    println!("after checkout: {:?}", state_at(&kiosk, "item-00001", 10));
+
+    let before_rejection = visible_fingerprint(&kiosk);
+    let duplicate = apply_event(&mut kiosk, checkout).expect_err("duplicate rejected");
+    assert_eq!(before_rejection, visible_fingerprint(&kiosk));
+    println!("rejected without mutation: {duplicate}");
+
+    let returned = event("event-000002", 2, 12, EventKind::Return);
+    apply_event(&mut kiosk, returned).expect("return");
+    kiosk.checkpoint();
+    drop(kiosk);
+    let kiosk = open(&path);
+    println!(
+        "reopened current state: {:?}",
+        state_at(&kiosk, "item-00001", 99)
+    );
+    println!(
+        "historical day 10: {:?}",
+        state_at(&kiosk, "item-00001", 10)
+    );
+    println!(
+        "lookup 'blue dril 00001': {:?}",
+        search(&kiosk, "blue dril 00001", 5)
+    );
+    drop(kiosk);
+    std::fs::remove_dir_all(path).expect("remove demo database");
+}
+
+fn run_benchmark() {
+    let path = unique_temp("benchmark");
+    let summary = import_fixture(&path);
+    println!(
+        "fixture: 8000 items, 1200 borrowers, {} accepted events in {:.3}s",
+        summary.accepted_events,
+        summary.elapsed.as_secs_f64()
+    );
+    for (row, error) in &summary.rejected_rows {
+        println!("rejected {row}: {error}");
+    }
+    println!(
+        "peak RSS after import: {:.1} MiB",
+        peak_rss_mib().expect("read process peak RSS")
+    );
+
+    let open_started = Instant::now();
+    let kiosk = open(&path);
+    let open_elapsed = open_started.elapsed();
+    let mut lookup_timings = Vec::with_capacity(1_000);
+    for index in 0..1_000 {
+        let item_id = format!("item-{:05}", index * 7 % 8_000);
+        let started = Instant::now();
+        kiosk.rtx(|(_, _, _, projections)| {
+            assert!(projections.get(&item_id).is_some());
+        });
+        lookup_timings.push(started.elapsed());
+    }
+    let lookup_p95 = percentile_95(lookup_timings);
+
+    let mut search_passes = 0;
+    let mut search_total = Duration::ZERO;
+    for query_index in 0..50 {
+        let item_index = (query_index * 157) % 8_000;
+        let (name, nickname, prefix) = ITEM_NAMES[item_index % ITEM_NAMES.len()];
+        let mut typo_nickname = nickname.to_string();
+        typo_nickname.remove(typo_nickname.len() - 1);
+        let query = match query_index % 5 {
+            0 => format!("RC-{item_index:05}"),
+            1 => format!("SN{item_index:08}"),
+            2 => format!("{prefix} {item_index:05}"),
+            3 => format!("{typo_nickname} {item_index:05}"),
+            _ => format!("{name} {item_index:05}"),
+        };
+        let started = Instant::now();
+        let hits = search(&kiosk, &query, 5);
+        search_total += started.elapsed();
+        if hits.contains(&format!("item-{item_index:05}")) {
+            search_passes += 1;
+        }
+    }
+    let rebuild_root = unique_temp("rebuilds");
+    std::fs::create_dir_all(&rebuild_root).expect("create rebuild root");
+    let canonical = rebuild_root.join("baseline.current");
+    write_canonical_projection(&kiosk, &canonical);
+    println!(
+        "peak RSS after queries: {:.1} MiB",
+        peak_rss_mib().expect("read process peak RSS")
+    );
+    drop(kiosk);
+
+    let mut rebuild_matches = 0;
+    for run in 0..3 {
+        let run_root = rebuild_root.join(run.to_string());
+        std::fs::create_dir_all(&run_root).expect("create rebuild run root");
+        let rebuild_path = run_root.join("db");
+        let rebuild_canonical = run_root.join("current.view");
+        let status =
+            std::process::Command::new(std::env::current_exe().expect("current executable"))
+                .arg("rebuild-child")
+                .arg(&rebuild_path)
+                .arg(&rebuild_canonical)
+                .status()
+                .expect("run rebuild child");
+        assert!(status.success());
+        if files_equal(&canonical, &rebuild_canonical) {
+            rebuild_matches += 1;
+        }
+    }
+    println!("reopen: {:.3}s", open_elapsed.as_secs_f64());
+    println!(
+        "warm current-item lookup p95: {:.3}ms",
+        lookup_p95.as_secs_f64() * 1_000.0
+    );
+    println!(
+        "search golden set: {search_passes}/50 in {:.3}s",
+        search_total.as_secs_f64()
+    );
+    println!("deterministic rebuilds matching stored view: {rebuild_matches}/3");
+    let peak_rss = peak_rss_mib().expect("read process peak RSS");
+    println!("coordinator process peak RSS: {peak_rss:.1} MiB");
+    assert_eq!(summary.rejected_rows.len(), 5);
+    assert!(open_elapsed < Duration::from_secs(2));
+    assert!(lookup_p95 < Duration::from_millis(50));
+    assert!(search_passes >= 45);
+    assert_eq!(rebuild_matches, 3);
+    assert!(peak_rss < 256.0);
+
+    std::fs::remove_dir_all(path).expect("remove benchmark database");
+    std::fs::remove_dir_all(rebuild_root).expect("remove rebuild databases");
+}
+
+fn run_rebuild_child(path: &Path, canonical: &Path) {
+    let summary = import_fixture(path);
+    assert_eq!(summary.accepted_events, 100_000);
+    let kiosk = open(path);
+    write_canonical_projection(&kiosk, canonical);
+    let peak_rss = peak_rss_mib().expect("read process peak RSS");
+    println!("rebuild child peak RSS: {peak_rss:.1} MiB");
+    assert!(peak_rss < 256.0);
+}
+
+fn run_abort_child(path: &Path) -> ! {
+    let mut kiosk = open(path);
+    let event = event(
+        "event-aborted",
+        1,
+        10,
+        EventKind::Checkout {
+            borrower_id: "borrower-0001".to_string(),
+            due_day: 24,
+        },
+    );
+    kiosk.wtx(|tx| {
+        tx.insert(&Record::Event(event));
+        tx.rtx(|(_, _, events, projections)| {
+            assert!(events.contains(&"event-aborted".to_string()));
+            assert!(projections.contains(&"item-00001".to_string()));
+        });
+        std::process::abort();
+    });
+    unreachable!()
+}
+
+fn run_interruption() {
+    let path = unique_temp("interrupt");
+    let kiosk = seed_small(&path);
+    let old = visible_fingerprint(&kiosk);
+    drop(kiosk);
+
+    let status = std::process::Command::new(std::env::current_exe().expect("current executable"))
+        .arg("abort-child")
+        .arg(&path)
+        .status()
+        .expect("run abort child");
+    assert!(!status.success());
+    let mut reopened = open(&path);
+    assert_eq!(old, visible_fingerprint(&reopened));
+    println!("interruption inside write: old state recovered");
+
+    apply_event(
+        &mut reopened,
+        event(
+            "event-committed",
+            1,
+            10,
+            EventKind::Checkout {
+                borrower_id: "borrower-0001".to_string(),
+                due_day: 24,
+            },
+        ),
+    )
+    .expect("committed event");
+    let committed = visible_fingerprint(&reopened);
+    drop(reopened);
+    let reopened = open(&path);
+    assert_eq!(committed, visible_fingerprint(&reopened));
+    println!("interruption after write: complete new state recovered");
+    drop(reopened);
+    std::fs::remove_dir_all(path).expect("remove interruption database");
+}
+
+fn main() {
+    let mut args = std::env::args().skip(1);
+    match args.next().as_deref() {
+        None | Some("demo") => run_demo(),
+        Some("benchmark") => run_benchmark(),
+        Some("interruption") => run_interruption(),
+        Some("abort-child") => {
+            let path = PathBuf::from(args.next().expect("database path"));
+            run_abort_child(&path);
+        }
+        Some("rebuild-child") => {
+            let path = PathBuf::from(args.next().expect("database path"));
+            let canonical = PathBuf::from(args.next().expect("canonical projection path"));
+            run_rebuild_child(&path, &canonical);
+        }
+        Some(other) => panic!("unknown command {other:?}; use demo, benchmark, or interruption"),
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn with_kiosk(test: impl FnOnce(&mut Kiosk)) {
+        let path = unique_temp("test");
+        let mut kiosk = seed_small(&path);
+        test(&mut kiosk);
+        drop(kiosk);
+        std::fs::remove_dir_all(path).expect("remove test database");
+    }
+
+    #[test]
+    fn transition_table_and_rejections_are_atomic() {
+        with_kiosk(|kiosk| {
+            let cases = [
+                event(
+                    "checkout",
+                    1,
+                    1,
+                    EventKind::Checkout {
+                        borrower_id: "borrower-0001".to_string(),
+                        due_day: 14,
+                    },
+                ),
+                event("return", 2, 2, EventKind::Return),
+                event(
+                    "repair",
+                    3,
+                    3,
+                    EventKind::RepairStart {
+                        reason: "switch".to_string(),
+                    },
+                ),
+                event("repair-finish", 4, 4, EventKind::RepairFinish),
+                event(
+                    "retire",
+                    5,
+                    5,
+                    EventKind::Retire {
+                        reason: "unsafe".to_string(),
+                    },
+                ),
+            ];
+            for event in cases {
+                apply_event(kiosk, event).expect("legal transition");
+            }
+            assert!(matches!(
+                state_at(kiosk, "item-00001", 99),
+                Some(ItemState::Retired { .. })
+            ));
+
+            for invalid in [
+                event("retire", 6, 6, EventKind::Return),
+                Event {
+                    item_id: "missing".to_string(),
+                    id: "unknown-item".to_string(),
+                    ..event("unused", 7, 7, EventKind::Return)
+                },
+                event(
+                    "unknown-borrower",
+                    8,
+                    8,
+                    EventKind::Checkout {
+                        borrower_id: "missing".to_string(),
+                        due_day: 9,
+                    },
+                ),
+            ] {
+                let before = visible_fingerprint(kiosk);
+                assert!(apply_event(kiosk, invalid).is_err());
+                assert_eq!(before, visible_fingerprint(kiosk));
+            }
+        });
+    }
+
+    #[test]
+    fn reopening_and_historical_query_are_exact() {
+        let path = unique_temp("reopen-test");
+        let mut kiosk = seed_small(&path);
+        apply_event(
+            &mut kiosk,
+            event(
+                "checkout",
+                1,
+                10,
+                EventKind::Checkout {
+                    borrower_id: "borrower-0001".to_string(),
+                    due_day: 24,
+                },
+            ),
+        )
+        .expect("checkout");
+        apply_event(&mut kiosk, event("return", 2, 20, EventKind::Return)).expect("return");
+        let before = visible_fingerprint(&kiosk);
+        drop(kiosk);
+        let kiosk = open(&path);
+        assert_eq!(before, visible_fingerprint(&kiosk));
+        assert_eq!(
+            state_at(&kiosk, "item-00001", 15),
+            Some(ItemState::CheckedOut {
+                borrower_id: "borrower-0001".to_string(),
+                due_day: 24
+            })
+        );
+        assert_eq!(
+            state_at(&kiosk, "item-00001", 20),
+            Some(ItemState::Available)
+        );
+        drop(kiosk);
+        std::fs::remove_dir_all(path).expect("remove test database");
+    }
+
+    #[test]
+    fn fixture_validation_reports_every_bad_row() {
+        let (items, borrowers, mut events, rejected) = fixture();
+        events.extend(rejected);
+        let (accepted, rejected) = validate_fixture(&items, &borrowers, &events);
+        assert_eq!(accepted.len(), 100_000);
+        assert_eq!(rejected.len(), 4);
+        assert!(
+            rejected
+                .iter()
+                .any(|(_, error)| error.contains("duplicate"))
+        );
+        assert!(
+            rejected
+                .iter()
+                .any(|(_, error)| error.contains("unknown item"))
+        );
+        assert!(
+            rejected
+                .iter()
+                .any(|(_, error)| error.contains("unknown borrower"))
+        );
+        assert!(
+            rejected
+                .iter()
+                .any(|(_, error)| error.contains("impossible transition"))
+        );
+    }
+
+    #[test]
+    fn live_append_order_rejections_do_not_mutate_and_writer_remains_usable() {
+        with_kiosk(|kiosk| {
+            apply_event(
+                kiosk,
+                event(
+                    "checkout-sequence-10",
+                    10,
+                    10,
+                    EventKind::Checkout {
+                        borrower_id: "borrower-0001".to_string(),
+                        due_day: 24,
+                    },
+                ),
+            )
+            .expect("initial checkout");
+
+            let invalid = [
+                (
+                    event("return-sequence-5", 5, 12, EventKind::Return),
+                    "out-of-order event sequence 5; latest accepted sequence is 10",
+                ),
+                (
+                    event("return-sequence-10", 10, 12, EventKind::Return),
+                    "duplicate event sequence 10",
+                ),
+            ];
+            for (event, expected_error) in invalid {
+                let before = visible_fingerprint(kiosk);
+                assert_eq!(apply_event(kiosk, event), Err(expected_error.to_string()));
+                assert_eq!(visible_fingerprint(kiosk), before);
+                assert_eq!(
+                    state_at(kiosk, "item-00001", 99),
+                    Some(ItemState::CheckedOut {
+                        borrower_id: "borrower-0001".to_string(),
+                        due_day: 24,
+                    })
+                );
+            }
+
+            apply_event(
+                kiosk,
+                event("return-sequence-11", 11, 12, EventKind::Return),
+            )
+            .expect("subsequent valid return");
+            assert_eq!(
+                state_at(kiosk, "item-00001", 99),
+                Some(ItemState::Available)
+            );
+            kiosk.rtx(|(_, _, events, projections)| {
+                assert_eq!(events.iter().count(), 2);
+                assert_eq!(
+                    projections
+                        .get(&"item-00001".to_string())
+                        .expect("item projection")
+                        .history
+                        .len(),
+                    2
+                );
+            });
+        });
+    }
+
+    #[test]
+    fn import_enforces_the_same_append_order_rule() {
+        let (fixture_items, fixture_borrowers, _, _) = fixture();
+        let items = vec![fixture_items[1].clone()];
+        let borrowers = vec![fixture_borrowers[1].clone()];
+        let candidates = vec![
+            event(
+                "checkout-sequence-10",
+                10,
+                10,
+                EventKind::Checkout {
+                    borrower_id: borrowers[0].id.clone(),
+                    due_day: 24,
+                },
+            ),
+            event("return-sequence-5", 5, 12, EventKind::Return),
+            event("return-sequence-10", 10, 12, EventKind::Return),
+            event("return-sequence-11", 11, 12, EventKind::Return),
+        ];
+        let (accepted, rejected) = validate_fixture(&items, &borrowers, &candidates);
+        assert_eq!(
+            accepted
+                .iter()
+                .map(|event| event.sequence)
+                .collect::<Vec<_>>(),
+            vec![10, 11]
+        );
+        assert_eq!(
+            rejected,
+            vec![
+                (
+                    "events.csv:7".to_string(),
+                    "out-of-order event sequence 5; latest accepted sequence is 10".to_string()
+                ),
+                (
+                    "events.csv:12".to_string(),
+                    "duplicate event sequence 10".to_string()
+                )
+            ]
+        );
+    }
+
+    #[test]
+    fn normalized_search_resolves_to_canonical_item() {
+        with_kiosk(|kiosk| {
+            assert_eq!(search(kiosk, "RC-00001", 5)[0], "item-00001");
+            assert!(search(kiosk, "blue dril 00001", 5).contains(&"item-00001".to_string()));
+        });
+    }
+}
diff --git a/developer-simulation/runs/2026-08-10--support-case-finder/.gitignore b/developer-simulation/runs/2026-08-10--support-case-finder/.gitignore
new file mode 100644
index 0000000..b83d222
--- /dev/null
+++ b/developer-simulation/runs/2026-08-10--support-case-finder/.gitignore
@@ -0,0 +1 @@
+/target/
diff --git a/developer-simulation/runs/2026-08-10--support-case-finder/BRIEF.md b/developer-simulation/runs/2026-08-10--support-case-finder/BRIEF.md
new file mode 100644
index 0000000..9c47fbd
--- /dev/null
+++ b/developer-simulation/runs/2026-08-10--support-case-finder/BRIEF.md
@@ -0,0 +1,48 @@
+# Trial 1: Support-case duplicate finder
+
+## Persona
+
+You are a customer-support platform developer with six years of production TypeScript experience and about six months of Rust experience. You maintain internal tools for a 35-person support team and favor small, observable services over introducing a new platform.
+
+## Current system
+
+The support application stores open and closed cases in PostgreSQL. A worker exports an approved, privacy-scrubbed projection of closed cases containing case ID, language, product area, subject, cleaned body, resolution summary, and last-modified time. Agents currently search that projection through PostgreSQL full-text search before writing a new investigation.
+
+The export contains 75,000 English and Spanish cases and changes by roughly 2,000 inserts, edits, or deletions per day. PostgreSQL remains the authority for case visibility and permissions. The new feature may build a replaceable local index from the approved projection, but it must never become the case system of record.
+
+## Pain point
+
+Lexical search misses useful prior resolutions when the new report uses different wording, abbreviations, or the other supported language. Agents spend time rediscovering known fixes. The team wants an advisory "related resolved cases" panel, but only if it measurably improves retrieval and preserves exact, inspectable source references.
+
+## Constraints
+
+- Run as one ordinary service process on a 2-core, 2 GiB container; no GPU is available in production.
+- After build and index refresh, query handling must not call an external model or search service.
+- Store only the approved scrubbed projection; do not ingest attachments, raw customer messages, names, email addresses, or account identifiers.
+- Apply daily insert, edit, and deletion batches. A failed refresh must leave the previously complete index queryable.
+- Results are advisory and must include the exact case ID, product area, language, and a non-generated source excerpt so an agent can inspect the original record.
+- Break equal scores deterministically by case ID. Deleted or newly restricted cases must disappear after the next successful refresh.
+- Keep deploy-time dependencies and ongoing operations small enough for the existing team to own.
+
+## Baseline approach
+
+Keep PostgreSQL full-text search with a small synonym table and language-specific configurations. On a fixed 200-query evaluation set assembled from real, privacy-scrubbed duplicate investigations, this returns a known useful case in the first five results for 116 queries (58% recall@5). Its warm p95 latency is 34 ms.
+
+## Acceptance criteria
+
+1. On the same frozen 200-query set, return a known useful case in the first five results for at least 144 queries (72% recall@5), with separate English and Spanish results reported.
+2. Answer the full evaluation set with warm p95 latency at or below 100 ms on the declared 2-core machine, with no network access during queries.
+3. Build the 75,000-case index in at most 10 minutes, keep its on-disk size at or below 750 MiB, and apply a representative 2,000-record mixed update batch in at most 90 seconds.
+4. Produce byte-for-byte identical ordered case IDs across three runs against the same index and queries.
+5. Demonstrate that an interrupted refresh keeps the previous complete index usable, then that a successful retry includes edits and excludes all deleted cases.
+6. Every displayed result contains only approved fields and an exact source excerpt; a fixture scan finds none of the prohibited personal fields.
+7. Compare implementation size, dependencies, refresh operations, and measured retrieval quality against the lexical baseline before recommending adoption.
+
+## Non-goals
+
+- Generating answers or summaries for agents.
+- Automatically merging, closing, routing, or prioritizing cases.
+- Replacing PostgreSQL, authentication, authorization, or the support application.
+- Training or fine-tuning a model.
+- Supporting arbitrary languages beyond English and Spanish in this trial.
+- Building a distributed search cluster or a public customer-facing search API.
diff --git a/developer-simulation/runs/2026-08-10--support-case-finder/Cargo.toml b/developer-simulation/runs/2026-08-10--support-case-finder/Cargo.toml
new file mode 100644
index 0000000..6c3d581
--- /dev/null
+++ b/developer-simulation/runs/2026-08-10--support-case-finder/Cargo.toml
@@ -0,0 +1,12 @@
+[package]
+name = "support-case-finder"
+version = "0.1.0"
+edition = "2024"
+publish = false
+default-run = "support-case-finder"
+
+[dependencies]
+anny = { path = "../../../anny" }
+ese = { path = "../../../ese", features = ["dim-64", "quant-8"] }
+fold = { path = "../../../fold" }
+serde = { version = "1", features = ["derive"] }
diff --git a/developer-simulation/runs/2026-08-10--support-case-finder/DISCOVERY.md b/developer-simulation/runs/2026-08-10--support-case-finder/DISCOVERY.md
new file mode 100644
index 0000000..62670d1
--- /dev/null
+++ b/developer-simulation/runs/2026-08-10--support-case-finder/DISCOVERY.md
@@ -0,0 +1,48 @@
+# Discovery log
+
+## Brief-first understanding
+
+I maintain a PostgreSQL-backed support system and need to decide whether a small local semantic or hybrid index can beat our measured lexical baseline without becoming another source of truth. The decision hinges on retrieval quality on the team's frozen 200-query set, predictable CPU-only operation, transactional refresh behavior, exact source references, deterministic ranking, and manageable operations. A toy search demo alone cannot establish production fit.
+
+## Public-material discovery order
+
+1. Read `simulation-output/BRIEF.md` before learning anything about BogKit.
+2. Read the root `README.md`.
+3. Read the four public examples and their manifests: `starter`, `timeseries`, `chat`, and `search`.
+4. Wrote this initial hypothesis and baseline plan before inspecting implementation source or internal documentation.
+
+## Initial component-fit hypothesis
+
+- **Fold:** potentially useful for keeping a document table, lexical index, and semantic index consistent under keyed upserts and removals. The search example claims transactional updates, genuine HNSW deletion, and persistence. Important unknowns are whether a failed multi-step refresh preserves the last complete daily snapshot and whether index-open/refresh operations fit normal service lifecycle needs.
+- **ESE:** potentially useful because it embeds locally and therefore appears compatible with network-free query handling. The public material does not identify its model, English/Spanish quality, memory use, embedding speed, model-file lifecycle, or production CPU requirements. Cross-language support is therefore unproven.
+- **ANNy:** potentially useful as the semantic nearest-neighbor index used by the search example. The example demonstrates use but not deterministic tie ordering, memory/disk sizing, 75,000-record build time, or recall under daily edits/deletions.
+
+My provisional view is **evaluation-only, not adoption-ready**. The combination maps unusually directly to the desired hybrid search shape, but none of the production acceptance thresholds can be inferred from the README or twelve-record example.
+
+## Baseline and experiment plan
+
+The real acceptance gate remains the existing PostgreSQL evaluation: 116/200 recall@5 and 34 ms warm p95. I do not have the private frozen case/query set or the declared 2-core production runner, so this trial must not manufacture a comparable recall number.
+
+I will build a minimal, runnable support-case index with only approved fields and a small bilingual, synonym-heavy fixture. It will:
+
+1. Use keyed records so an edit or deletion can update every maintained view.
+2. Compare BogKit BM25, semantic, and hybrid results on disclosed fixture queries, including English and Spanish.
+3. Return case ID, product area, language, and an exact substring from the approved source body; scan serialized/displayed content for prohibited field names.
+4. Apply an interrupted-refresh simulation that performs no transaction, prove the old index remains queryable, then apply a mixed transaction and prove edits/deletions are reflected.
+5. Add deterministic score and case-ID tie sorting outside the index so displayed ordering has an explicit rule.
+6. Run the fixture evaluation three times and compare ordered IDs byte-for-byte.
+7. Measure local fixture build, update, query latency, and disk size only as a smoke measurement, explicitly not as evidence for the 75,000-record thresholds.
+
+I will inspect source only as needed to resolve public-example API questions, and record any false starts or undocumented behavior.
+
+## What changed after source inspection and running code
+
+- The ESE build script identifies its embedded weights as `static-retrieval-mrl-en-v1`. The root README did not state this English-only provenance, which materially changes the Spanish part of the fit assessment.
+- `cargo test --offline` was my first build attempt. Cargo had every Rust dependency cached, but ESE's build script independently attempted to download `model.safetensors` and failed on DNS. I copied the already-approved model and tokenizer cache into this prototype's ignored `target/ese-cache`, then offline builds worked. This is an undocumented reproducibility and build-operations requirement, not a query-time network dependency.
+- My first interrupted-refresh test caught a panic around `KeyedStream::wtx` in the same process. The committed state remained readable, but the next write panicked with `poisoned tx lock`. I preserved that as `src/bin/panic_poison.rs`. For the actual process-interruption acceptance check, I changed the harness to abort a child process mid-transaction, reopen the index in the parent, verify the old committed state, and then apply a successful retry.
+- The public example's reciprocal-rank fusion sorts only by score. I added an explicit case-ID tie break to the application result list and compared output bytes across three fresh processes. This makes the observed fixture deterministic, but it cannot repair a tie at the HNSW candidate cutoff; that boundary remains uncertain.
+- A full synthetic scale smoke test was practical, so I added an explicit `--scale 75000 2000` mode. It measures mechanics and rough resource shape without pretending that repeated fabricated text is a retrieval-quality corpus.
+
+## Final fit hypothesis
+
+Fold's atomic keyed updates and the local BM25/HNSW shape are a strong match for the index-maintenance mechanics. BogKit is not yet a justified fit for this bilingual production feature: the private recall gate is untested, the disclosed fixture shows no gain over lexical search, the embedded model is English-specific, the required 2-core/2 GiB environment was not available, and a caught refresh panic poisons further writes in the process. The narrow recommendation is to keep the prototype as evaluation evidence and not adopt it until those gates are resolved.
diff --git a/developer-simulation/runs/2026-08-10--support-case-finder/README.md b/developer-simulation/runs/2026-08-10--support-case-finder/README.md
new file mode 100644
index 0000000..ff1a2ee
--- /dev/null
+++ b/developer-simulation/runs/2026-08-10--support-case-finder/README.md
@@ -0,0 +1,55 @@
+# Support-case finder evaluation
+
+This is a runnable evaluation harness for a bilingual "related resolved cases" panel. It keeps approved case fields in a Fold `KeyedStream`, maintains BM25 and ESE/ANNy indexes from the same updates, and returns deterministic hybrid results with exact source excerpts.
+
+It is evidence for local mechanics, not a recommendation to deploy. The disclosed retrieval fixture is tiny and the scale fixture is synthetic. Neither replaces the team's frozen 200-query evaluation or a run in the specified 2-core, 2 GiB container.
+
+## Commands
+
+Run these from the `developer-simulation/` workspace root. The archived
+performance evidence uses the workspace's ordinary release profile.
+
+Run the disclosed retrieval, crash recovery, deterministic ordering, update, and privacy checks:
+
+```console
+cargo run --offline --locked --release -p support-case-finder
+```
+
+Run the synthetic 75,000-case build and 2,000-record mixed refresh:
+
+```console
+cargo run --offline --locked --release -p support-case-finder -- --scale 75000 2000
+```
+
+Run code checks:
+
+```console
+cargo test --offline --locked --release -p support-case-finder --all-targets
+cargo fmt -p support-case-finder -- --check
+cargo clippy --offline --locked --release -p support-case-finder --all-targets -- -D warnings
+```
+
+The first ESE build downloads its model and tokenizer into `target/ese-cache`.
+The archived commands assume those two files are already cached; remove
+`--offline` for an authorized first build. Query execution itself does not
+make model or search-service calls.
+
+## Expected failure reproducer
+
+The evaluated Fold revision documents that a panicking `wtx` rolls back. The committed row does survive, but catching that panic and attempting another write in the same process fails because the underlying writer lock is poisoned:
+
+```console
+cargo run --offline --locked --release -p support-case-finder --bin panic_poison
+```
+
+Expected exit status: `101`. Expected final error contains:
+
+```text
+poisoned tx lock: PoisonError
+```
+
+This command is intentionally excluded from the successful demo path.
+
+## Data boundaries
+
+All cases are fabricated. The `Case` type contains only the approved projection fields: case ID, language, product area, subject, cleaned body, resolution, and modified time. Displayed hits contain case ID, product area, language, and an excerpt copied byte-for-byte from the approved body. No names, addresses, account identifiers, attachments, or raw messages are present.
diff --git a/developer-simulation/runs/2026-08-10--support-case-finder/src/bin/panic_poison.rs b/developer-simulation/runs/2026-08-10--support-case-finder/src/bin/panic_poison.rs
new file mode 100644
index 0000000..3821a4e
--- /dev/null
+++ b/developer-simulation/runs/2026-08-10--support-case-finder/src/bin/panic_poison.rs
@@ -0,0 +1,33 @@
+use std::panic::{AssertUnwindSafe, catch_unwind};
+
+use fold::pipeline::terminal;
+use fold::stream::KeyedStream;
+
+fn main() {
+    let path = std::path::Path::new(env!("CARGO_MANIFEST_DIR"))
+        .join("target/run-data")
+        .join(format!("bogkit-panic-poison-repro-{}", std::process::id()));
+    let _ = std::fs::remove_dir_all(&path);
+
+    let mut store = KeyedStream::new(&path, terminal::Table::new("rows"));
+    store.wtx(|tx| {
+        tx.upsert(&1_u64, &"committed".to_owned());
+    });
+
+    let caught = catch_unwind(AssertUnwindSafe(|| {
+        store.wtx(|tx| {
+            tx.upsert(&1_u64, &"uncommitted".to_owned());
+            panic!("simulated refresh failure");
+        });
+    }));
+    assert!(caught.is_err());
+    assert_eq!(store.get(&1), Some("committed".to_owned()));
+    println!("read after caught panic still sees committed state");
+    println!("attempting a second write in the same process");
+
+    // On the evaluated revision this panics with `poisoned tx lock`, even though the
+    // `KeyedStream::wtx` documentation says a panic rolls the transaction back.
+    store.wtx(|tx| {
+        tx.upsert(&2_u64, &"next write".to_owned());
+    });
+}
diff --git a/developer-simulation/runs/2026-08-10--support-case-finder/src/main.rs b/developer-simulation/runs/2026-08-10--support-case-finder/src/main.rs
new file mode 100644
index 0000000..ad19f47
--- /dev/null
+++ b/developer-simulation/runs/2026-08-10--support-case-finder/src/main.rs
@@ -0,0 +1,742 @@
+use std::collections::BTreeMap;
+use std::fs;
+use std::path::{Path, PathBuf};
+use std::process::Command;
+use std::time::{Instant, SystemTime, UNIX_EPOCH};
+
+use anny::metric::Cosine;
+use fold::pipeline::{Keyed, Map, Scored, terminal};
+use fold::stream::KeyedStream;
+use serde::{Deserialize, Serialize};
+
+const DIM: usize = ese::DIMENSIONS;
+const RRF_K: f64 = 60.0;
+
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+struct Case {
+    case_id: u64,
+    language: String,
+    product_area: String,
+    subject: String,
+    body: String,
+    resolution: String,
+    modified_at: String,
+}
+
+impl Case {
+    fn search_text(&self) -> String {
+        format!("{} {} {}", self.subject, self.body, self.resolution)
+    }
+}
+
+#[derive(Clone, Debug, PartialEq)]
+struct Hit {
+    case_id: u64,
+    score: f64,
+    product_area: String,
+    language: String,
+    excerpt: String,
+}
+
+#[derive(Clone, Copy)]
+struct Query {
+    language: &'static str,
+    text: &'static str,
+    useful_case: u64,
+}
+
+fn case_to_text(row: &Keyed<u64, Case>) -> Keyed<u64, String> {
+    Keyed::new(row.key, row.val.search_text())
+}
+
+fn text_to_embedding(row: &Keyed<u64, String>) -> Keyed<u64, [f32; DIM]> {
+    Keyed::new(row.key, ese::encode_single(&row.val))
+}
+
+macro_rules! open_store {
+    ($path:expr) => {
+        KeyedStream::new(
+            $path,
+            (
+                Map::new(
+                    case_to_text as fn(&Keyed<u64, Case>) -> Keyed<u64, String>,
+                    (
+                        terminal::search::Bm25::new("case_bm25"),
+                        Map::new(
+                            text_to_embedding as fn(&Keyed<u64, String>) -> Keyed<u64, [f32; DIM]>,
+                            terminal::search::Hnsw::<u64, f32, Cosine, DIM>::new(
+                                "case_vectors",
+                                Cosine,
+                                42,
+                            ),
+                        ),
+                    ),
+                ),
+                terminal::Table::new("approved_cases"),
+            ),
+        )
+    };
+}
+
+macro_rules! search {
+    ($store:expr, $query:expr, $kind:expr, $limit:expr) => {{
+        let query = $query;
+        let query_embedding = ese::encode_single(query);
+        $store.rtx(|((bm25, vectors), cases)| {
+            let lexical = bm25.search(query, 10);
+            let semantic = vectors.search(&query_embedding);
+            let ranked = match $kind {
+                SearchKind::Lexical => rank_lexical(&lexical),
+                SearchKind::Semantic => rank_semantic(&semantic),
+                SearchKind::Hybrid => fuse(&lexical, &semantic),
+            };
+            ranked
+                .into_iter()
+                .take($limit)
+                .filter_map(|(case_id, score)| {
+                    cases.get(&case_id).map(|case| Hit {
+                        case_id,
+                        score,
+                        product_area: case.product_area,
+                        language: case.language,
+                        excerpt: exact_excerpt(&case.body),
+                    })
+                })
+                .collect::<Vec<_>>()
+        })
+    }};
+}
+
+#[derive(Clone, Copy, Debug)]
+enum SearchKind {
+    Lexical,
+    Semantic,
+    Hybrid,
+}
+
+fn rank_lexical(hits: &[Scored<f64, u64>]) -> Vec<(u64, f64)> {
+    let mut out: Vec<_> = hits.iter().map(|hit| (hit.val, hit.score)).collect();
+    out.sort_by(|a, b| b.1.total_cmp(&a.1).then_with(|| a.0.cmp(&b.0)));
+    out
+}
+
+fn rank_semantic(hits: &[Scored<f32, u64>]) -> Vec<(u64, f64)> {
+    let mut out: Vec<_> = hits
+        .iter()
+        .map(|hit| (hit.val, -(hit.score as f64)))
+        .collect();
+    out.sort_by(|a, b| b.1.total_cmp(&a.1).then_with(|| a.0.cmp(&b.0)));
+    out
+}
+
+fn fuse(lexical: &[Scored<f64, u64>], semantic: &[Scored<f32, u64>]) -> Vec<(u64, f64)> {
+    let mut scores = BTreeMap::<u64, f64>::new();
+    for (rank, hit) in lexical.iter().enumerate() {
+        *scores.entry(hit.val).or_default() += 1.0 / (RRF_K + rank as f64 + 1.0);
+    }
+    for (rank, hit) in semantic.iter().enumerate() {
+        *scores.entry(hit.val).or_default() += 1.0 / (RRF_K + rank as f64 + 1.0);
+    }
+    let mut out: Vec<_> = scores.into_iter().collect();
+    out.sort_by(|a, b| b.1.total_cmp(&a.1).then_with(|| a.0.cmp(&b.0)));
+    out
+}
+
+fn exact_excerpt(body: &str) -> String {
+    body.chars().take(96).collect()
+}
+
+fn fixture_cases() -> Vec<Case> {
+    vec![
+        case(
+            1001,
+            "en",
+            "calendar",
+            "Calendar stops updating",
+            "Events added after a password change do not appear on the phone.",
+            "Reconnect the calendar integration to replace the expired OAuth token.",
+        ),
+        case(
+            1002,
+            "en",
+            "billing",
+            "Duplicate renewal debit",
+            "The monthly subscription was charged two times on the same day.",
+            "Void the duplicate payment and repair the retry idempotency key.",
+        ),
+        case(
+            1003,
+            "en",
+            "identity",
+            "Password reset loop",
+            "The recovery email opens sign-in instead of allowing a new password.",
+            "Clear the stale login challenge before issuing another recovery link.",
+        ),
+        case(
+            1004,
+            "en",
+            "exports",
+            "Old rows in CSV",
+            "A newly downloaded report still includes records removed yesterday.",
+            "Invalidate the cached export after each visibility change.",
+        ),
+        case(
+            1005,
+            "en",
+            "notifications",
+            "Alerts arrive late",
+            "Push notifications are delayed until the mobile application is opened.",
+            "Renew the device registration after upgrading the application.",
+        ),
+        case(
+            1006,
+            "en",
+            "mobile",
+            "Crash while attaching photo",
+            "The Android application closes when a large image is selected.",
+            "Resize the image before decoding it into memory.",
+        ),
+        case(
+            2001,
+            "es",
+            "calendar",
+            "El calendario no se actualiza",
+            "Las citas nuevas no aparecen después de cambiar la contraseña.",
+            "Vuelva a conectar el calendario para renovar el token caducado.",
+        ),
+        case(
+            2002,
+            "es",
+            "billing",
+            "Cargo de renovación duplicado",
+            "La suscripción mensual se cobró dos veces el mismo día.",
+            "Anule el segundo pago y repare la clave de idempotencia.",
+        ),
+        case(
+            2003,
+            "es",
+            "identity",
+            "Bucle al restablecer la contraseña",
+            "El correo de recuperación abre el inicio de sesión y no permite elegir una contraseña.",
+            "Borre el desafío de acceso anterior antes de enviar otro enlace.",
+        ),
+        case(
+            2004,
+            "es",
+            "exports",
+            "Filas antiguas en CSV",
+            "El informe descargado todavía incluye registros eliminados ayer.",
+            "Invalide la exportación guardada después de cada cambio de visibilidad.",
+        ),
+        case(
+            2005,
+            "es",
+            "notifications",
+            "Avisos retrasados",
+            "Las notificaciones llegan solamente al abrir la aplicación móvil.",
+            "Renueve el registro del dispositivo después de actualizar la aplicación.",
+        ),
+        case(
+            2006,
+            "es",
+            "mobile",
+            "Fallo al adjuntar una foto",
+            "La aplicación Android se cierra al elegir una imagen grande.",
+            "Reduzca la imagen antes de cargarla en memoria.",
+        ),
+    ]
+}
+
+fn case(
+    case_id: u64,
+    language: &str,
+    product_area: &str,
+    subject: &str,
+    body: &str,
+    resolution: &str,
+) -> Case {
+    Case {
+        case_id,
+        language: language.to_owned(),
+        product_area: product_area.to_owned(),
+        subject: subject.to_owned(),
+        body: body.to_owned(),
+        resolution: resolution.to_owned(),
+        modified_at: "2026-08-01T00:00:00Z".to_owned(),
+    }
+}
+
+fn fixture_queries() -> Vec<Query> {
+    vec![
+        Query {
+            language: "en",
+            text: "appointments missing after credentials rotated",
+            useful_case: 1001,
+        },
+        Query {
+            language: "en",
+            text: "two payments for one plan",
+            useful_case: 1002,
+        },
+        Query {
+            language: "en",
+            text: "forgotten passcode link returns to login",
+            useful_case: 1003,
+        },
+        Query {
+            language: "es",
+            text: "agenda vacía después de cambiar la clave",
+            useful_case: 2001,
+        },
+        Query {
+            language: "es",
+            text: "me facturaron dos veces el plan",
+            useful_case: 2002,
+        },
+        Query {
+            language: "es",
+            text: "correo para recuperar acceso vuelve al inicio",
+            useful_case: 2003,
+        },
+    ]
+}
+
+fn unique_temp_path(label: &str) -> PathBuf {
+    let nonce = SystemTime::now()
+        .duration_since(UNIX_EPOCH)
+        .expect("clock before epoch")
+        .as_nanos();
+    Path::new(env!("CARGO_MANIFEST_DIR"))
+        .join("target/run-data")
+        .join(format!(
+            "bogkit-support-{label}-{}-{nonce}",
+            std::process::id()
+        ))
+}
+
+fn remove_if_exists(path: &Path) {
+    if path.exists() {
+        fs::remove_dir_all(path).expect("remove temporary store");
+    }
+}
+
+fn directory_size(path: &Path) -> u64 {
+    fs::read_dir(path)
+        .expect("read store directory")
+        .map(|entry| {
+            let entry = entry.expect("read directory entry");
+            let metadata = entry.metadata().expect("read entry metadata");
+            if metadata.is_dir() {
+                directory_size(&entry.path())
+            } else {
+                metadata.len()
+            }
+        })
+        .sum()
+}
+
+fn recall_count(results: &[Vec<Hit>], queries: &[Query], limit: usize) -> usize {
+    results
+        .iter()
+        .zip(queries)
+        .filter(|(hits, query)| {
+            hits.iter()
+                .take(limit)
+                .any(|hit| hit.case_id == query.useful_case)
+        })
+        .count()
+}
+
+fn recall_by_language(
+    results: &[Vec<Hit>],
+    queries: &[Query],
+    language: &str,
+    limit: usize,
+) -> (usize, usize) {
+    let relevant: Vec<_> = results
+        .iter()
+        .zip(queries)
+        .filter(|(_, query)| query.language == language)
+        .collect();
+    let found = relevant
+        .iter()
+        .filter(|(hits, query)| {
+            hits.iter()
+                .take(limit)
+                .any(|hit| hit.case_id == query.useful_case)
+        })
+        .count();
+    (found, relevant.len())
+}
+
+fn ids(results: &[Vec<Hit>]) -> Vec<Vec<u64>> {
+    results
+        .iter()
+        .map(|hits| hits.iter().map(|hit| hit.case_id).collect())
+        .collect()
+}
+
+fn main() {
+    let mut args = std::env::args().skip(1);
+    match args.next().as_deref() {
+        Some("--interrupt-worker") => {
+            let path = PathBuf::from(args.next().expect("worker requires a store path"));
+            let mut store = open_store!(&path);
+            store.wtx(|tx| {
+                let mut changed = fixture_cases()[0].clone();
+                changed.body = "UNCOMMITTED SENTINEL".to_owned();
+                tx.upsert(&changed.case_id, &changed);
+                std::process::abort();
+            });
+            unreachable!("the interrupt worker must abort");
+        }
+        Some("--snapshot-worker") => {
+            let path = PathBuf::from(args.next().expect("worker requires a store path"));
+            let store = open_store!(&path);
+            for query in fixture_queries() {
+                let hits = search!(store, query.text, SearchKind::Hybrid, 5);
+                let ids: Vec<_> = hits.into_iter().map(|hit| hit.case_id).collect();
+                println!("{ids:?}");
+            }
+            return;
+        }
+        Some("--scale") => {
+            let cases = args
+                .next()
+                .expect("scale requires a case count")
+                .parse::<u64>()
+                .expect("case count must be an integer");
+            let updates = args
+                .next()
+                .expect("scale requires an update count")
+                .parse::<u64>()
+                .expect("update count must be an integer");
+            run_scale(cases, updates);
+            return;
+        }
+        Some(other) => panic!("unknown argument: {other}"),
+        None => {}
+    }
+    run_demo();
+}
+
+fn run_demo() {
+    let path = unique_temp_path("demo");
+    remove_if_exists(&path);
+    let build_started = Instant::now();
+    let mut store = open_store!(&path);
+    store.wtx(|tx| {
+        for row in fixture_cases() {
+            tx.upsert(&row.case_id, &row);
+        }
+    });
+    store.checkpoint();
+    let build_time = build_started.elapsed();
+    let queries = fixture_queries();
+
+    let lexical: Vec<Vec<Hit>> = queries
+        .iter()
+        .map(|query| search!(store, query.text, SearchKind::Lexical, 5))
+        .collect();
+    let semantic: Vec<Vec<Hit>> = queries
+        .iter()
+        .map(|query| search!(store, query.text, SearchKind::Semantic, 5))
+        .collect();
+    let hybrid: Vec<Vec<Hit>> = queries
+        .iter()
+        .map(|query| search!(store, query.text, SearchKind::Hybrid, 5))
+        .collect();
+
+    println!(
+        "Fixture only: {} approved cases, {} disclosed queries",
+        fixture_cases().len(),
+        queries.len()
+    );
+    println!(
+        "build: {:?}; store: {} bytes",
+        build_time,
+        directory_size(&path)
+    );
+    println!(
+        "recall@5: lexical {}/{}, semantic {}/{}, hybrid {}/{}",
+        recall_count(&lexical, &queries, 5),
+        queries.len(),
+        recall_count(&semantic, &queries, 5),
+        queries.len(),
+        recall_count(&hybrid, &queries, 5),
+        queries.len()
+    );
+    println!(
+        "recall@1: lexical {}/{}, semantic {}/{}, hybrid {}/{}",
+        recall_count(&lexical, &queries, 1),
+        queries.len(),
+        recall_count(&semantic, &queries, 1),
+        queries.len(),
+        recall_count(&hybrid, &queries, 1),
+        queries.len()
+    );
+    for language in ["en", "es"] {
+        let (found, total) = recall_by_language(&hybrid, &queries, language, 5);
+        println!("hybrid recall@5 [{language}]: {found}/{total}");
+    }
+    for (query, hits) in queries.iter().zip(&hybrid) {
+        let ids: Vec<_> = hits.iter().map(|hit| hit.case_id).collect();
+        println!("hybrid [{}] {:?} -> {:?}", query.language, query.text, ids);
+    }
+
+    store.checkpoint();
+    drop(store);
+    let executable = std::env::current_exe().expect("resolve demo executable");
+    let snapshots: Vec<Vec<u8>> = (0..3)
+        .map(|_| {
+            let output = Command::new(&executable)
+                .arg("--snapshot-worker")
+                .arg(&path)
+                .output()
+                .expect("launch snapshot worker");
+            assert!(output.status.success(), "snapshot worker failed");
+            output.stdout
+        })
+        .collect();
+    assert!(
+        snapshots.windows(2).all(|pair| pair[0] == pair[1]),
+        "ranked case IDs changed between process runs"
+    );
+    println!("determinism: byte-identical ordered IDs across three process runs");
+
+    let mut store = open_store!(&path);
+
+    let before_interrupt = search!(store, queries[0].text, SearchKind::Hybrid, 5);
+    store.checkpoint();
+    drop(store);
+    let worker_status = Command::new(std::env::current_exe().expect("resolve demo executable"))
+        .arg("--interrupt-worker")
+        .arg(&path)
+        .status()
+        .expect("launch interrupt worker");
+    assert!(
+        !worker_status.success(),
+        "interrupt worker unexpectedly committed"
+    );
+    let mut store = open_store!(&path);
+    let after_interrupt = search!(store, queries[0].text, SearchKind::Hybrid, 5);
+    assert_eq!(ids(&[before_interrupt]), ids(&[after_interrupt]));
+    assert_ne!(
+        store.get(&1001).expect("case remains").body,
+        "UNCOMMITTED SENTINEL"
+    );
+    println!("interrupted refresh: previous committed index remained queryable");
+
+    let update_start = Instant::now();
+    store.wtx(|tx| {
+        let mut edited = fixture_cases()[0].clone();
+        edited.body =
+            "Events and appointments disappear because the OAuth credential expired.".to_owned();
+        edited.modified_at = "2026-08-10T00:00:00Z".to_owned();
+        tx.upsert(&1001, &edited);
+        tx.remove(&1002);
+        let added = case(
+            3001,
+            "en",
+            "calendar",
+            "Calendar authorization expired",
+            "Appointments disappear when the workspace credential is revoked.",
+            "Reconnect the approved calendar integration.",
+        );
+        tx.upsert(&3001, &added);
+    });
+    store.checkpoint();
+    let update_time = update_start.elapsed();
+    assert!(!store.contains(&1002));
+    assert!(store.contains(&3001));
+    let deleted_query = search!(store, "two payments for one plan", SearchKind::Hybrid, 10);
+    assert!(deleted_query.iter().all(|hit| hit.case_id != 1002));
+    let edited_query = search!(store, "expired OAuth credential", SearchKind::Hybrid, 5);
+    assert!(edited_query.iter().any(|hit| hit.case_id == 1001));
+    println!(
+        "successful mixed refresh: {:?}; edit visible, insert visible, deletion absent",
+        update_time
+    );
+
+    let mut latencies = Vec::new();
+    for _ in 0..100 {
+        for query in &queries {
+            let started = Instant::now();
+            let _ = search!(store, query.text, SearchKind::Hybrid, 5);
+            latencies.push(started.elapsed());
+        }
+    }
+    latencies.sort();
+    let p95 = latencies[(latencies.len() * 95).div_ceil(100) - 1];
+    println!(
+        "warm hybrid query p95: {:?} over {} fixture queries",
+        p95,
+        latencies.len()
+    );
+
+    for hits in [&lexical, &semantic, &hybrid] {
+        for hit in hits.iter().flatten() {
+            assert!(
+                [
+                    "calendar",
+                    "billing",
+                    "identity",
+                    "exports",
+                    "notifications",
+                    "mobile"
+                ]
+                .contains(&hit.product_area.as_str())
+            );
+            assert!(["en", "es"].contains(&hit.language.as_str()));
+            let source = fixture_cases()
+                .into_iter()
+                .find(|row| row.case_id == hit.case_id)
+                .expect("fixture hit exists");
+            assert!(source.body.contains(&hit.excerpt));
+            let displayed = format!(
+                "{} {} {} {}",
+                hit.case_id, hit.product_area, hit.language, hit.excerpt
+            )
+            .to_lowercase();
+            for prohibited in ["email_address", "account_id", "customer_name", "attachment"] {
+                assert!(!displayed.contains(prohibited));
+            }
+        }
+    }
+    println!(
+        "privacy/source check: displayed hits use approved metadata and exact source excerpts"
+    );
+
+    remove_if_exists(&path);
+}
+
+fn synthetic_case(case_id: u64) -> Case {
+    const AREAS: [&str; 6] = [
+        "calendar",
+        "billing",
+        "identity",
+        "exports",
+        "notifications",
+        "mobile",
+    ];
+    const ISSUES: [&str; 8] = [
+        "authorization expired after a credential rotation",
+        "duplicate debit caused by a retried renewal",
+        "recovery link returns to the sign in page",
+        "report contains rows removed the previous day",
+        "notification is delayed until the application opens",
+        "large photograph causes the application to close",
+        "workspace setting does not propagate to the device",
+        "scheduled import remains in a pending state",
+    ];
+    let language = if case_id.is_multiple_of(2) {
+        "es"
+    } else {
+        "en"
+    };
+    let area = AREAS[case_id as usize % AREAS.len()];
+    let issue = ISSUES[case_id as usize % ISSUES.len()];
+    case(
+        case_id,
+        language,
+        area,
+        &format!("Synthetic scale case {case_id}"),
+        &format!("Approved fixture record {case_id}: {issue}."),
+        &format!("Apply the documented {area} recovery procedure for fixture {case_id}."),
+    )
+}
+
+fn run_scale(case_count: u64, update_count: u64) {
+    assert!(case_count > update_count, "updates require existing rows");
+    let path = unique_temp_path("scale");
+    remove_if_exists(&path);
+    let mut store = open_store!(&path);
+
+    let build_started = Instant::now();
+    store.wtx(|tx| {
+        for case_id in 0..case_count {
+            let row = synthetic_case(case_id);
+            tx.upsert(&case_id, &row);
+        }
+    });
+    store.checkpoint();
+    let build_time = build_started.elapsed();
+    let size = directory_size(&path);
+
+    let update_started = Instant::now();
+    store.wtx(|tx| {
+        for i in 0..update_count {
+            match i % 3 {
+                0 => {
+                    tx.remove(&i);
+                }
+                1 => {
+                    let mut row = synthetic_case(i);
+                    row.body.push_str(" Edited in the representative refresh.");
+                    row.modified_at = "2026-08-10T00:00:00Z".to_owned();
+                    tx.upsert(&i, &row);
+                }
+                _ => {
+                    let id = case_count + i;
+                    let row = synthetic_case(id);
+                    tx.upsert(&id, &row);
+                }
+            }
+        }
+    });
+    store.checkpoint();
+    let update_time = update_started.elapsed();
+
+    assert!(!store.contains(&0), "deleted scale row remained visible");
+    assert!(
+        store
+            .get(&1)
+            .expect("edited scale row exists")
+            .body
+            .contains("representative refresh")
+    );
+    assert!(
+        store.contains(&(case_count + 2)),
+        "inserted scale row is missing"
+    );
+
+    let mut latencies = Vec::new();
+    for _ in 0..1_000 {
+        let started = Instant::now();
+        let _ = search!(
+            store,
+            "renewal charged twice after retry",
+            SearchKind::Hybrid,
+            5
+        );
+        latencies.push(started.elapsed());
+    }
+    latencies.sort();
+    let p95 = latencies[(latencies.len() * 95).div_ceil(100) - 1];
+    println!("synthetic scale only: {case_count} cases, {update_count} mixed updates");
+    println!("build and checkpoint: {build_time:?}");
+    println!("store after build: {size} bytes");
+    println!("update and checkpoint: {update_time:?}");
+    println!("warm hybrid query p95: {p95:?} over 1000 repeated queries");
+
+    remove_if_exists(&path);
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn reciprocal_rank_fusion_is_deterministic_on_equal_scores() {
+        let lexical = vec![Scored::new(1.0, 9), Scored::new(1.0, 3)];
+        let semantic = vec![Scored::new(0.1, 3), Scored::new(0.1, 9)];
+        let tied = 1.0 / 61.0 + 1.0 / 62.0;
+        assert_eq!(fuse(&lexical, &semantic), vec![(3, tied), (9, tied)]);
+    }
+
+    #[test]
+    fn excerpt_is_always_a_source_substring() {
+        let body = "áéíóú soporte exacto";
+        assert!(body.contains(&exact_excerpt(body)));
+    }
+}
diff --git a/developer-simulation/runs/2026-08-11--cold-chain-repair/.gitignore b/developer-simulation/runs/2026-08-11--cold-chain-repair/.gitignore
new file mode 100644
index 0000000..ff7ff13
--- /dev/null
+++ b/developer-simulation/runs/2026-08-11--cold-chain-repair/.gitignore
@@ -0,0 +1,3 @@
+/target/
+/*.db/
+/runtime/
diff --git a/developer-simulation/runs/2026-08-11--cold-chain-repair/BRIEF.md b/developer-simulation/runs/2026-08-11--cold-chain-repair/BRIEF.md
new file mode 100644
index 0000000..ad8cd47
--- /dev/null
+++ b/developer-simulation/runs/2026-08-11--cold-chain-repair/BRIEF.md
@@ -0,0 +1,47 @@
+# Trial 1 brief: Cold-chain excursion state repair
+
+## Persona and Rust experience
+
+You are a platform engineer for a regional food distributor. You have six years of production Python experience and about one year of Rust experience. You are comfortable with iterators, enums, serialization, and ordinary error handling, but have not built a storage engine or an event-processing framework.
+
+## Current system and baseline implementation
+
+Four hundred freezer controllers send one temperature observation every 30 seconds. Gateways retain observations during outages and upload them later. A Python service appends every accepted line to daily compressed NDJSON files, then updates an SQLite table containing each freezer's current status. The archive files are the authority; the status database and incident summaries may be rebuilt.
+
+The reducer sorts each upload batch but not the full history. It treats a repeated observation as new, and operators can submit a correction that replaces a bad reading only by rerunning a day-specific script. Current logic opens an excursion after five continuous minutes outside the configured temperature band and closes it after ten continuous minutes back inside the band. Configuration changes carry an effective timestamp because limits sometimes change during maintenance.
+
+## Concrete pain, workload, and data shape
+
+The service receives about 1.15 million observations per day. A record contains `observation_id`, `freezer_id`, `observed_at`, `received_at`, temperature in integer tenths of a degree, gateway sequence number, and an optional `replaces_observation_id`. A separate record changes a freezer's allowed minimum or maximum temperature from a stated effective time.
+
+Gateway reconnects create duplicate uploads and batches up to six hours late. Corrections may arrive up to seven days later. The current service occasionally creates duplicate incidents, closes an incident too early after late data arrives, or shows a current status that cannot be reconciled with the archive. Operators need an exact list of observations and configuration versions that caused every open, close, or repair decision.
+
+## Operational constraints
+
+- Run without network access on one Linux facility server with two CPU cores, 512 MiB of memory, and ordinary SSD storage.
+- Keep the compressed NDJSON archive authoritative and unchanged. Any new local state must be disposable and rebuildable from it.
+- Preserve the last complete readable derived state if the process exits during an ingest or repair.
+- Reject malformed timestamps, unknown correction targets, correction cycles, and configuration intervals with no valid limit; never publish a partial batch.
+- Diagnostics may include freezer IDs and observation IDs but must not include facility names or free-form operator notes.
+- Do not assume arrivals are in event-time order. Equivalent valid inputs must produce byte-for-byte identical exported incident summaries regardless of batch boundaries.
+
+## Measurable acceptance criteria
+
+1. Provide a runnable fixture generator and a small independent reference reducer covering normal readings, threshold boundaries, duplicate IDs, six-hour lateness, corrections, and backdated configuration changes.
+2. For at least 100 generated seeds, the candidate's final current-state and incident export exactly matches the reference reducer after chronological input, shuffled batches, and randomly repeated batches.
+3. Ingesting an already accepted observation or correction is idempotent: state, incident history, and exported bytes do not change.
+4. A late record, correction, or backdated configuration change repairs every affected incident for that freezer and does not alter any unaffected freezer's exported result.
+5. Injected exits at the documented commit boundaries leave either the complete prior state or the complete next state; a restart converges to the reference result without manual cleanup.
+6. Rebuild 1,000,000 observations for 400 freezers in under 60 seconds while the measured peak resident memory remains below 384 MiB on the declared test machine. Report the machine and measurement command.
+7. Every incident transition exports a deterministic reason and the exact contributing observation and configuration identifiers.
+
+## Explicit non-goals
+
+- Do not implement controller firmware, gateway transport, alert delivery, dashboards, authentication, replication, or archive compression.
+- Do not predict failures or invent a probabilistic anomaly detector.
+- Do not modify the authoritative archive format.
+- Do not claim production suitability from a toy happy-path run. A justified no-fit conclusion is valid if a required property cannot be demonstrated.
+
+## Smallest self-contained prototype boundary
+
+Build one command-line program that consumes observation and configuration NDJSON, maintains disposable local derived state, and exports canonical JSON incident summaries. Include a fixture generator, the independent reference reducer, restart/fault tests at the storage boundary, and the one-million-record benchmark. Limit the prototype to the excursion rule described above and a seven-day correction horizon. Assess the repository as found; keep the experiment separate from its existing implementation and examples.
diff --git a/developer-simulation/runs/2026-08-11--cold-chain-repair/Cargo.toml b/developer-simulation/runs/2026-08-11--cold-chain-repair/Cargo.toml
new file mode 100644
index 0000000..541ad8e
--- /dev/null
+++ b/developer-simulation/runs/2026-08-11--cold-chain-repair/Cargo.toml
@@ -0,0 +1,18 @@
+[package]
+name = "cold-chain-repair"
+version = "0.1.0"
+edition = "2024"
+publish = false
+default-run = "cold-chain-repair"
+
+[dependencies]
+fold = { path = "../../../fold" }
+serde = { version = "1", features = ["derive"] }
+serde_json = "1"
+
+[lints.rust]
+unsafe_code = "forbid"
+
+[lints.clippy]
+all = "deny"
+pedantic = "deny"
diff --git a/developer-simulation/runs/2026-08-11--cold-chain-repair/DISCOVERY.md b/developer-simulation/runs/2026-08-11--cold-chain-repair/DISCOVERY.md
new file mode 100644
index 0000000..19d8fb5
--- /dev/null
+++ b/developer-simulation/runs/2026-08-11--cold-chain-repair/DISCOVERY.md
@@ -0,0 +1,83 @@
+# Discovery trail
+
+## Before reading BogKit internals
+
+I am approaching this as the platform engineer in the brief: strong in Python, still fairly new to Rust, and looking for a reliable way to repair derived cold-chain incident state from an authoritative NDJSON archive.
+
+From the public README, BogKit is a Cargo workspace containing three fairly independent pieces. Fold is the only obvious candidate for this problem: it incrementally maintains durable views from inserts and retractions. ESE and ANNy are embedding and nearest-neighbor tools and do not belong in a deterministic temperature reducer.
+
+The examples make Fold look attractive for four narrow properties:
+
+- one write transaction can update multiple materialized views atomically;
+- a `KeyedStream` can upsert by identifier and retract the previous value;
+- state reopens from a local path after restart;
+- reads observe one consistent snapshot.
+
+They do not yet show the harder parts of this brief: changing an old event whose consequence depends on every later event, replaying a freezer under a backdated configuration, using an NDJSON archive rather than Fold as authority, validating an entire batch before publication, or exporting the exact causal observations and configuration versions behind transitions.
+
+## Candidate baseline
+
+My baseline is deliberately boring and independent of BogKit:
+
+1. Validate a complete incoming batch in memory against the authoritative archive index.
+2. Append the accepted records to NDJSON.
+3. For each affected freezer, resolve corrections and configuration intervals, sort the effective readings by `(observed_at, observation_id)`, and replay its state machine from the beginning of the seven-day repair horizon.
+4. Replace the affected freezer's canonical incident summary in a disposable snapshot.
+5. Write the complete derived snapshot to a sibling temporary file, sync it, then rename it atomically.
+
+The reference reducer should be a separate, simple implementation that resolves the full logical history and replays it from scratch. It should not share the candidate's indexing or incremental repair code. Exact JSON bytes should come from explicitly sorted vectors and fixed field order.
+
+## Component-use hypothesis
+
+My initial hypothesis is that Fold could be useful as an optional durable index of raw accepted records or current keyed values, but it may be a poor fit for the actual temporal repair reducer. A late reading, correction, or backdated configuration can change an incident boundary and all later reasons for one freezer; the public primitives show local map/filter/aggregate updates, not an ordered state machine with suffix invalidation and exact provenance.
+
+I will first try to represent accepted observations by ID in a `KeyedStream` and verify durability, idempotent upsert, and atomic visibility. I will compare that with the simpler archive-plus-atomic-snapshot baseline. I will reject Fold for the production boundary if it introduces a second durable authority, cannot express the time-ordered repair without rebuilding a freezer externally, or cannot make archive append plus derived-state publication one atomic commit.
+
+ESE and ANNy are out of scope unless later documentation reveals a deterministic non-search purpose, which seems unlikely.
+
+## Evidence plan
+
+- Use hand-checked fixtures for threshold boundaries, duplicates, six-hour lateness, corrections, and backdated limits.
+- Create a separate full-replay reference reducer.
+- Differential-test chronological, shuffled, and repeated batches for at least 100 seeds.
+- Inject failure immediately before and after the snapshot replacement and verify restart convergence.
+- Run a one-million-observation rebuild and measure elapsed time and peak resident memory on this machine.
+- Keep any durable state disposable and the NDJSON file authoritative.
+
+At this point I have read only the blind brief, the public root README, and the public examples. I have not inspected component source or prior simulation material.
+
+## After inspecting the minimum Fold source
+
+I read Fold's stream transaction plumbing, keyed stream, table terminal, and their focused tests. The implementation confirmed that a `KeyedStream` stores its primary-key row and downstream materializations in the same Fjall transaction. A panic unwinds through `Stream::wtx`, calls the pipeline's abort hook, and drops the uncommitted database transaction. `checkpoint` requests a full sync. Those are useful properties for a disposable record index.
+
+The source also confirmed the main mismatch. Fold's pipeline operators handle local deltas and per-key aggregates. Nothing in the public operator set represents an event-time-ordered state machine where replacing one old reading invalidates a suffix of later decisions. I would still have to resolve corrections, choose historical configurations, sort every affected freezer timeline, replay it, build exact reasons, and atomically replace an external canonical export. Fold would not own the authoritative archive append or the export rename, so it cannot make that entire boundary one transaction.
+
+## Implementation and debugging trail
+
+I wrote tests before reducer behavior and watched the initial boundary test fail against an empty stub. I then built a literal full-replay reference and a structurally separate candidate reducer. The candidate validates the archive first, upserts accepted records into a disposable Fold `KeyedStream<String, Record, Table<...>>` in bounded chunks, checks the indexed count, and then repairs freezer timelines. ESE and ANNy were not imported.
+
+The first real Fold integration failed at runtime in `TableReader::iter`:
+
+```text
+called `Result::unwrap()` on an `Err` value: WontImplement
+```
+
+I initially suspected the isolated lock had selected Fjall/LSM-tree 3.1.8 while BogKit's root lock used 3.1.6. Pinning both older versions did not change the failure. The actual cause was the record's ordinary Serde internally tagged enum representation, which Postcard cannot deserialize. Changing to an externally tagged enum exposed a second runtime panic:
+
+```text
+called `Result::unwrap()` on an `Err` value: DeserializeUnexpectedEnd
+```
+
+That came from `skip_serializing_if` omitting a `None` field that Postcard's schema-dependent decoder expected. Always serializing the option fixed it, and restoring Fjall/LSM-tree 3.1.8 remained green. I preserved both cases as minimal binaries rather than changing Fold.
+
+The completed differential run covered 100 deterministic seeds. For each seed, the candidate received shuffled records and then shuffled records with a repeated batch; both matched the independent chronological full replay exactly. The full test suite has seven acceptance tests and two CLI/subprocess tests.
+
+Actual child processes were terminated inside an uncommitted Fold transaction and immediately before and after the canonical snapshot rename. Reopening showed the prior index after the uncommitted exit, the prior snapshot before rename, the next snapshot after rename, and convergence after restart.
+
+## Scale result and revised fit decision
+
+On a Mac16,11 (arm64, 14 logical CPUs, 64 GiB RAM), macOS 26.5.2, Rust 1.95.0, the one-million-observation/400-freezer reference replay took 0.727 seconds inside the reducer and peaked at 511,508,480 bytes RSS. The Fold-backed candidate took 3.320 seconds inside the rebuild and peaked at 1,155,678,208 bytes RSS. Both were far below 60 seconds, but both exceeded the brief's 384 MiB ceiling; the candidate exceeded it by a much larger margin.
+
+This benchmark includes full in-memory fixture and validation maps, so it is not evidence that Fold itself consumes one gigabyte. It is evidence that this straightforward integration cannot meet the facility constraint, and that adding the Fold index made an already-too-large design materially heavier. A production implementation would need streaming validation plus disk partitioning or an archive-native index. That redesign would still leave the temporal reducer outside Fold.
+
+My final decision is **no fit for the production reducer**. Fold worked as documented for atomic keyed state once the hidden serialization restrictions were discovered, and it was useful for testing crash behavior. But it did not remove the hard domain code or replace the simpler archive/replay/snapshot baseline. The defensible BogKit improvement is small: document the Postcard-compatible Serde subset prominently, and preferably surface serialization failures as typed errors instead of panicking. I would not add a temporal-repair subsystem to Fold based on this single trial.
diff --git a/developer-simulation/runs/2026-08-11--cold-chain-repair/README.md b/developer-simulation/runs/2026-08-11--cold-chain-repair/README.md
new file mode 100644
index 0000000..1f0677b
--- /dev/null
+++ b/developer-simulation/runs/2026-08-11--cold-chain-repair/README.md
@@ -0,0 +1,71 @@
+# Cold-chain repair trial
+
+This is a disposable prototype for rebuilding freezer excursion summaries from an authoritative NDJSON archive. It deliberately evaluates BogKit rather than assuming it is the right answer.
+
+## Verdict
+
+**No fit for the production reducer.** Fold provided a useful crash-safe, idempotent keyed index of accepted records, but the time-ordered correction/configuration replay, validation, exact provenance, and canonical snapshot publication all remained application code. The independent full-replay baseline was simpler and faster. The Fold-backed prototype also exceeded the 384 MiB memory limit at one million observations.
+
+ESE and ANNy were considered and rejected because deterministic temperature repair is neither an embedding nor nearest-neighbor problem.
+
+## What is implemented
+
+- External-tagged observation and configuration NDJSON records.
+- Whole-archive validation for duplicate IDs, conflicting duplicates, invalid timestamps and bands, unknown/cross-freezer/multiple correction targets, correction cycles, and ambiguous configuration boundaries.
+- A simple independent reference reducer.
+- A separate candidate reducer backed by a disposable Fold `KeyedStream`/`Table` record index.
+- Deterministic incident JSON with the triggering and contributing observation IDs and configuration IDs for every open/close transition.
+- Actual child-process exits inside a Fold write transaction and immediately before/after canonical snapshot rename.
+- A deterministic fixture generator, 100-seed differential verification, and one-million-observation benchmark.
+
+## Commands
+
+Run from the BogKit repository root. Use a scratch directory outside the repository so no runtime state is archived.
+
+```console
+cargo run --manifest-path developer-simulation/Cargo.toml --locked --offline -p cold-chain-repair -- generate /tmp/cold-chain/archive.ndjson 23 2 96
+cargo run --manifest-path developer-simulation/Cargo.toml --locked --offline -p cold-chain-repair -- repair /tmp/cold-chain/archive.ndjson /tmp/cold-chain/state
+cargo run --manifest-path developer-simulation/Cargo.toml --locked --offline -p cold-chain-repair -- demo /tmp/cold-chain/demo
+cargo run --manifest-path developer-simulation/Cargo.toml --locked --offline -p cold-chain-repair -- verify 100 /tmp/cold-chain/verify
+cargo run --manifest-path developer-simulation/Cargo.toml --locked --offline -p cold-chain-repair -- fault-demo /tmp/cold-chain/fault
+```
+
+Quality gates:
+
+```console
+cargo fmt --manifest-path developer-simulation/Cargo.toml -p cold-chain-repair -- --check
+cargo test --manifest-path developer-simulation/Cargo.toml --locked --offline --release -p cold-chain-repair --all-targets
+cargo clippy --manifest-path developer-simulation/Cargo.toml --locked --offline --release -p cold-chain-repair --all-targets -- -D warnings -D clippy::all -D clippy::pedantic
+```
+
+Performance comparison:
+
+```console
+cargo build --manifest-path developer-simulation/Cargo.toml --locked --offline --release -p cold-chain-repair
+/usr/bin/time -l developer-simulation/target/release/cold-chain-repair benchmark-reference 1000000 /tmp/cold-chain/reference-benchmark
+/usr/bin/time -l developer-simulation/target/release/cold-chain-repair benchmark 1000000 /tmp/cold-chain/candidate-benchmark
+```
+
+On the declared test machine, the reference took 0.727 seconds inside the reducer (1.19 seconds wall) and peaked at 511,508,480 bytes RSS. The Fold-backed candidate took 3.320 seconds inside the rebuild (3.47 seconds wall) and peaked at 1,155,678,208 bytes RSS. Both violate the 384 MiB target because this prototype holds the generated archive and validation maps in memory; the candidate adds a second record representation plus Fold's index. These measurements demonstrate a failed prototype, not a standalone Fold performance defect.
+
+## Minimal Fold serialization reproducers
+
+Fold's public bounds accept ordinary Serde types, but its Postcard-backed read path panics for two common representations. These commands intentionally exit 101:
+
+```console
+cargo run --manifest-path developer-simulation/Cargo.toml --locked --offline -p cold-chain-repair --bin repro-postcard-serde -- tagged /tmp/fold-postcard-tagged
+# panics in fold/src/pipeline/terminal/table.rs with: Err(WontImplement)
+
+cargo run --manifest-path developer-simulation/Cargo.toml --locked --offline -p cold-chain-repair --bin repro-postcard-serde -- skipped /tmp/fold-postcard-skipped
+# panics in fold/src/pipeline/terminal/table.rs with: Err(DeserializeUnexpectedEnd)
+```
+
+The working archive type uses an externally tagged enum and always serializes optional fields. A documentation warning would prevent the first surprise; returning a typed error or checking storage compatibility before commit would be safer than a read-time panic.
+
+## Important semantics chosen for the prototype
+
+- A continuous run means consecutive effective readings of the same in/out classification; a long sampling gap does not itself break the run because the brief does not define a maximum gap.
+- A transition is recorded on the first reading whose timestamp is at least five or ten minutes after the run's first reading.
+- Only the final unreplaced observation in a correction chain is effective. Multiple corrections of the same direct target are rejected as ambiguous.
+- Configuration changes at the same freezer and effective timestamp are rejected rather than resolved by arrival order.
+- Final canonical output records open/close causes, not the historical sequence of repair operations, because output must be byte-identical regardless of batch boundaries.
diff --git a/developer-simulation/runs/2026-08-11--cold-chain-repair/src/bin/repro-postcard-serde.rs b/developer-simulation/runs/2026-08-11--cold-chain-repair/src/bin/repro-postcard-serde.rs
new file mode 100644
index 0000000..692059e
--- /dev/null
+++ b/developer-simulation/runs/2026-08-11--cold-chain-repair/src/bin/repro-postcard-serde.rs
@@ -0,0 +1,68 @@
+use std::path::PathBuf;
+
+use fold::pipeline::terminal;
+use fold::stream::KeyedStream;
+use serde::{Deserialize, Serialize};
+
+#[derive(Clone, Serialize, Deserialize)]
+#[serde(tag = "type", rename_all = "snake_case")]
+enum TaggedRecord {
+    Reading {
+        id: u64,
+        #[serde(default)]
+        replaces: Option<u64>,
+    },
+}
+
+#[derive(Clone, Serialize, Deserialize)]
+#[serde(rename_all = "snake_case")]
+enum SkippedFieldRecord {
+    Reading {
+        id: u64,
+        #[serde(default, skip_serializing_if = "Option::is_none")]
+        replaces: Option<u64>,
+    },
+}
+
+fn main() {
+    let mut arguments = std::env::args_os().skip(1);
+    let mode = arguments.next().unwrap_or_else(|| "tagged".into());
+    let path = arguments.next().map_or_else(
+        || std::env::temp_dir().join("fold-postcard-repro"),
+        PathBuf::from,
+    );
+    let _ = std::fs::remove_dir_all(&path);
+    let result = std::panic::catch_unwind(|| match mode.to_str() {
+        Some("tagged") => {
+            let mut stream = KeyedStream::new(&path, terminal::Table::new("records"));
+            stream.wtx(|transaction| {
+                transaction.upsert(
+                    &1_u64,
+                    &TaggedRecord::Reading {
+                        id: 1,
+                        replaces: None,
+                    },
+                );
+            });
+            stream.rtx(|table| println!("records: {}", table.iter().count()));
+        }
+        Some("skipped") => {
+            let mut stream = KeyedStream::new(&path, terminal::Table::new("records"));
+            stream.wtx(|transaction| {
+                transaction.upsert(
+                    &1_u64,
+                    &SkippedFieldRecord::Reading {
+                        id: 1,
+                        replaces: None,
+                    },
+                );
+            });
+            stream.rtx(|table| println!("records: {}", table.iter().count()));
+        }
+        _ => panic!("mode must be tagged or skipped"),
+    });
+    let _ = std::fs::remove_dir_all(&path);
+    if let Err(payload) = result {
+        std::panic::resume_unwind(payload);
+    }
+}
diff --git a/developer-simulation/runs/2026-08-11--cold-chain-repair/src/lib.rs b/developer-simulation/runs/2026-08-11--cold-chain-repair/src/lib.rs
new file mode 100644
index 0000000..23e12bf
--- /dev/null
+++ b/developer-simulation/runs/2026-08-11--cold-chain-repair/src/lib.rs
@@ -0,0 +1,782 @@
+use std::collections::{BTreeMap, BTreeSet};
+use std::fmt;
+use std::io::{BufRead, Write};
+use std::path::Path;
+
+use serde::{Deserialize, Serialize};
+
+use fold::pipeline::terminal;
+use fold::stream::KeyedStream;
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "snake_case")]
+pub enum Record {
+    Observation(Observation),
+    Configuration(Config),
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+pub struct Observation {
+    pub observation_id: String,
+    pub freezer_id: String,
+    pub observed_at: i64,
+    pub received_at: i64,
+    pub temp_tenths: i32,
+    pub gateway_sequence: u64,
+    #[serde(default)]
+    pub replaces_observation_id: Option<String>,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+pub struct Config {
+    pub configuration_id: String,
+    pub freezer_id: String,
+    pub effective_at: i64,
+    pub min_temp_tenths: i32,
+    pub max_temp_tenths: i32,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize, Default)]
+pub struct Export {
+    pub freezers: Vec<FreezerExport>,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+pub struct FreezerExport {
+    pub freezer_id: String,
+    pub current_status: String,
+    pub incidents: Vec<Incident>,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+pub struct Incident {
+    pub opened: Transition,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub closed: Option<Transition>,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+pub struct Transition {
+    pub action: String,
+    pub at: i64,
+    pub trigger_observation_id: String,
+    pub reason: String,
+    pub contributing_observation_ids: Vec<String>,
+    pub configuration_ids: Vec<String>,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct RepairError(String);
+
+impl RepairError {
+    fn new(message: impl Into<String>) -> Self {
+        Self(message.into())
+    }
+}
+
+impl fmt::Display for RepairError {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.write_str(&self.0)
+    }
+}
+
+impl std::error::Error for RepairError {}
+
+/// Rebuilds canonical state with the independent full-replay reducer.
+///
+/// # Errors
+/// Returns an error when records conflict, timestamps or limits are invalid,
+/// corrections cannot be resolved, or an observation has no effective limit.
+pub fn reference_from_records(records: &[Record]) -> Result<Export, RepairError> {
+    let validated = validate(records)?;
+    reference_reduce(&validated)
+}
+
+/// Validates an archive, updates the disposable Fold index, and repairs state.
+///
+/// # Errors
+/// Returns an error for invalid input, an index/archive count mismatch, or an
+/// observation without an effective configuration.
+pub fn candidate_from_records(
+    records: &[Record],
+    index_path: &Path,
+) -> Result<Export, RepairError> {
+    let validated = validate(records)?;
+    let mut index = KeyedStream::new(index_path, terminal::Table::new("accepted_records"));
+    let observations: Vec<_> = validated.observations.iter().collect();
+    for chunk in observations.chunks(4_096) {
+        index.wtx(|transaction| {
+            for (id, observation) in chunk {
+                transaction.upsert(
+                    &format!("observation:{id}"),
+                    &Record::Observation((*observation).clone()),
+                );
+            }
+        });
+    }
+    let configurations: Vec<_> = validated.configurations.iter().collect();
+    for chunk in configurations.chunks(4_096) {
+        index.wtx(|transaction| {
+            for (id, configuration) in chunk {
+                transaction.upsert(
+                    &format!("configuration:{id}"),
+                    &Record::Configuration((*configuration).clone()),
+                );
+            }
+        });
+    }
+    index.checkpoint();
+
+    let indexed_count = index.rtx(|table| table.iter().count());
+    let expected_count = validated.observations.len() + validated.configurations.len();
+    if indexed_count != expected_count {
+        return Err(RepairError::new(format!(
+            "disposable Fold index has {indexed_count} records; archive has {expected_count}"
+        )));
+    }
+
+    candidate_reduce(&validated)
+}
+
+/// Serializes a canonical export as compact JSON ending in one newline.
+///
+/// # Errors
+/// Returns an error if serialization fails.
+pub fn canonical_json(export: &Export) -> Result<Vec<u8>, RepairError> {
+    let mut bytes = serde_json::to_vec(export).map_err(|error| RepairError(error.to_string()))?;
+    bytes.push(b'\n');
+    Ok(bytes)
+}
+
+/// Reads one externally tagged observation or configuration per line.
+///
+/// # Errors
+/// Returns an error with the line number for I/O failures, malformed JSON,
+/// non-integer timestamps, or a record that does not match the archive schema.
+pub fn read_ndjson(reader: impl BufRead) -> Result<Vec<Record>, RepairError> {
+    let mut records = Vec::new();
+    for (index, line) in reader.lines().enumerate() {
+        let line_number = index + 1;
+        let line =
+            line.map_err(|error| RepairError::new(format!("line {line_number}: {error}")))?;
+        let value: serde_json::Value = serde_json::from_str(&line)
+            .map_err(|error| RepairError::new(format!("line {line_number}: {error}")))?;
+        validate_wire_timestamps(&value, line_number)?;
+        let record = serde_json::from_value(value)
+            .map_err(|error| RepairError::new(format!("line {line_number}: {error}")))?;
+        records.push(record);
+    }
+    Ok(records)
+}
+
+/// Writes one compact archive record per line.
+///
+/// # Errors
+/// Returns an error if JSON serialization or writing fails.
+pub fn write_ndjson(records: &[Record], mut writer: impl Write) -> Result<(), RepairError> {
+    for record in records {
+        serde_json::to_writer(&mut writer, record)
+            .map_err(|error| RepairError::new(error.to_string()))?;
+        writer
+            .write_all(b"\n")
+            .map_err(|error| RepairError::new(error.to_string()))?;
+    }
+    Ok(())
+}
+
+fn validate_wire_timestamps(
+    value: &serde_json::Value,
+    line_number: usize,
+) -> Result<(), RepairError> {
+    let (record, timestamp_fields): (&serde_json::Value, &[&str]) =
+        if let Some(observation) = value.get("observation") {
+            (observation, &["observed_at", "received_at"])
+        } else if let Some(configuration) = value.get("configuration") {
+            (configuration, &["effective_at"])
+        } else {
+            return Ok(());
+        };
+    for field in timestamp_fields {
+        if !record.get(*field).is_some_and(serde_json::Value::is_i64) {
+            return Err(RepairError::new(format!(
+                "line {line_number}: {field} must be an integer timestamp"
+            )));
+        }
+    }
+    Ok(())
+}
+
+#[derive(Debug)]
+struct Validated {
+    observations: BTreeMap<String, Observation>,
+    configurations: BTreeMap<String, Config>,
+    replaced_ids: BTreeSet<String>,
+}
+
+fn validate(records: &[Record]) -> Result<Validated, RepairError> {
+    let mut observations = BTreeMap::<String, Observation>::new();
+    let mut configurations = BTreeMap::<String, Config>::new();
+
+    for record in records {
+        match record {
+            Record::Observation(observation) => {
+                validate_observation(observation)?;
+                match observations.get(&observation.observation_id) {
+                    Some(existing) if existing == observation => {}
+                    Some(_) => {
+                        return Err(RepairError::new(format!(
+                            "conflicting duplicate observation id {}",
+                            observation.observation_id
+                        )));
+                    }
+                    None => {
+                        observations
+                            .insert(observation.observation_id.clone(), observation.clone());
+                    }
+                }
+            }
+            Record::Configuration(configuration) => {
+                validate_configuration(configuration)?;
+                match configurations.get(&configuration.configuration_id) {
+                    Some(existing) if existing == configuration => {}
+                    Some(_) => {
+                        return Err(RepairError::new(format!(
+                            "conflicting duplicate configuration id {}",
+                            configuration.configuration_id
+                        )));
+                    }
+                    None => {
+                        configurations.insert(
+                            configuration.configuration_id.clone(),
+                            configuration.clone(),
+                        );
+                    }
+                }
+            }
+        }
+    }
+
+    let mut replaced_ids = BTreeSet::new();
+    for observation in observations.values() {
+        let Some(target_id) = &observation.replaces_observation_id else {
+            continue;
+        };
+        let target = observations
+            .get(target_id)
+            .ok_or_else(|| RepairError::new(format!("unknown correction target {target_id}")))?;
+        if target.freezer_id != observation.freezer_id {
+            return Err(RepairError::new(format!(
+                "correction {} crosses freezer boundary",
+                observation.observation_id
+            )));
+        }
+        if !replaced_ids.insert(target_id.clone()) {
+            return Err(RepairError::new(format!(
+                "multiple corrections replace observation {target_id}"
+            )));
+        }
+    }
+
+    for id in observations.keys() {
+        let mut seen = BTreeSet::new();
+        let mut cursor = id.as_str();
+        loop {
+            if !seen.insert(cursor.to_string()) {
+                return Err(RepairError::new(format!(
+                    "correction cycle includes observation {cursor}"
+                )));
+            }
+            let Some(next) = observations
+                .get(cursor)
+                .and_then(|observation| observation.replaces_observation_id.as_deref())
+            else {
+                break;
+            };
+            cursor = next;
+        }
+    }
+
+    let mut effective_slots = BTreeSet::new();
+    for config in configurations.values() {
+        if !effective_slots.insert((config.freezer_id.clone(), config.effective_at)) {
+            return Err(RepairError::new(format!(
+                "ambiguous configuration interval for freezer {} at {}",
+                config.freezer_id, config.effective_at
+            )));
+        }
+    }
+
+    Ok(Validated {
+        observations,
+        configurations,
+        replaced_ids,
+    })
+}
+
+fn validate_observation(observation: &Observation) -> Result<(), RepairError> {
+    if observation.observation_id.is_empty() || observation.freezer_id.is_empty() {
+        return Err(RepairError::new(
+            "observation identifiers must not be empty",
+        ));
+    }
+    if observation.observed_at < 0
+        || observation.received_at < 0
+        || observation.received_at < observation.observed_at
+    {
+        return Err(RepairError::new(format!(
+            "malformed timestamp on observation {}",
+            observation.observation_id
+        )));
+    }
+    if observation
+        .replaces_observation_id
+        .as_ref()
+        .is_some_and(std::string::String::is_empty)
+    {
+        return Err(RepairError::new(format!(
+            "empty correction target on observation {}",
+            observation.observation_id
+        )));
+    }
+    Ok(())
+}
+
+fn validate_configuration(config: &Config) -> Result<(), RepairError> {
+    if config.configuration_id.is_empty() || config.freezer_id.is_empty() {
+        return Err(RepairError::new(
+            "configuration identifiers must not be empty",
+        ));
+    }
+    if config.effective_at < 0 {
+        return Err(RepairError::new(format!(
+            "malformed timestamp on configuration {}",
+            config.configuration_id
+        )));
+    }
+    if config.min_temp_tenths > config.max_temp_tenths {
+        return Err(RepairError::new(format!(
+            "invalid temperature band on configuration {}",
+            config.configuration_id
+        )));
+    }
+    Ok(())
+}
+
+fn reference_reduce(validated: &Validated) -> Result<Export, RepairError> {
+    let mut by_freezer = BTreeMap::<String, Vec<&Observation>>::new();
+    for (id, observation) in &validated.observations {
+        if !validated.replaced_ids.contains(id) {
+            by_freezer
+                .entry(observation.freezer_id.clone())
+                .or_default()
+                .push(observation);
+        }
+    }
+
+    let mut configurations = BTreeMap::<String, Vec<&Config>>::new();
+    for configuration in validated.configurations.values() {
+        configurations
+            .entry(configuration.freezer_id.clone())
+            .or_default()
+            .push(configuration);
+    }
+    for freezer_configs in configurations.values_mut() {
+        freezer_configs.sort_by(|left, right| {
+            (left.effective_at, &left.configuration_id)
+                .cmp(&(right.effective_at, &right.configuration_id))
+        });
+    }
+
+    let mut freezers = Vec::with_capacity(by_freezer.len());
+    for (freezer_id, mut observations) in by_freezer {
+        observations.sort_by(|left, right| {
+            (left.observed_at, &left.observation_id)
+                .cmp(&(right.observed_at, &right.observation_id))
+        });
+        let freezer_configs = configurations
+            .get(&freezer_id)
+            .ok_or_else(|| RepairError::new(format!("no valid limit for freezer {freezer_id}")))?;
+
+        let mut evaluated = Vec::with_capacity(observations.len());
+        for observation in observations {
+            let config = freezer_configs
+                .iter()
+                .rev()
+                .find(|config| config.effective_at <= observation.observed_at)
+                .ok_or_else(|| {
+                    RepairError::new(format!(
+                        "no valid limit for observation {}",
+                        observation.observation_id
+                    ))
+                })?;
+            let outside = observation.temp_tenths < config.min_temp_tenths
+                || observation.temp_tenths > config.max_temp_tenths;
+            evaluated.push(Evaluated {
+                observation,
+                config,
+                outside,
+            });
+        }
+
+        freezers.push(reference_replay(&freezer_id, &evaluated));
+    }
+
+    Ok(Export { freezers })
+}
+
+#[derive(Clone, Copy)]
+struct Evaluated<'a> {
+    observation: &'a Observation,
+    config: &'a Config,
+    outside: bool,
+}
+
+fn reference_replay(freezer_id: &str, readings: &[Evaluated<'_>]) -> FreezerExport {
+    let mut incidents: Vec<Incident> = Vec::new();
+    let mut excursion_open = false;
+    let mut run: Vec<Evaluated<'_>> = Vec::new();
+
+    for reading in readings {
+        let desired_outside = if excursion_open {
+            !reading.outside
+        } else {
+            reading.outside
+        };
+        if desired_outside {
+            run.push(*reading);
+        } else {
+            run.clear();
+        }
+
+        let threshold = if excursion_open { 600 } else { 300 };
+        let reached_threshold = run.first().is_some_and(|first| {
+            reading.observation.observed_at - first.observation.observed_at >= threshold
+        });
+        if !reached_threshold {
+            continue;
+        }
+
+        if excursion_open {
+            let closed = transition(
+                "close",
+                &run,
+                "ten continuous minutes inside configured band",
+            );
+            if let Some(incident) = incidents.last_mut() {
+                incident.closed = Some(closed);
+            }
+        } else {
+            incidents.push(Incident {
+                opened: transition(
+                    "open",
+                    &run,
+                    "five continuous minutes outside configured band",
+                ),
+                closed: None,
+            });
+        }
+        excursion_open = !excursion_open;
+        run.clear();
+    }
+
+    FreezerExport {
+        freezer_id: freezer_id.to_string(),
+        current_status: if excursion_open {
+            "excursion".into()
+        } else {
+            "normal".into()
+        },
+        incidents,
+    }
+}
+
+fn transition(action: &str, run: &[Evaluated<'_>], reason: &str) -> Transition {
+    let trigger = run.last().expect("transition requires a non-empty run");
+    let mut configuration_ids: Vec<String> = run
+        .iter()
+        .map(|reading| reading.config.configuration_id.clone())
+        .collect();
+    configuration_ids.sort();
+    configuration_ids.dedup();
+    Transition {
+        action: action.into(),
+        at: trigger.observation.observed_at,
+        trigger_observation_id: trigger.observation.observation_id.clone(),
+        reason: reason.into(),
+        contributing_observation_ids: run
+            .iter()
+            .map(|reading| reading.observation.observation_id.clone())
+            .collect(),
+        configuration_ids,
+    }
+}
+
+#[derive(Clone)]
+struct OwnedEvaluation {
+    observation_id: String,
+    observed_at: i64,
+    config_id: String,
+    outside: bool,
+}
+
+type CandidateTimeline = BTreeMap<(i64, String), OwnedEvaluation>;
+type CandidateTimelines = BTreeMap<String, CandidateTimeline>;
+
+enum CandidateMode {
+    Normal { outside_run: Vec<OwnedEvaluation> },
+    Excursion { inside_run: Vec<OwnedEvaluation> },
+}
+
+fn candidate_reduce(validated: &Validated) -> Result<Export, RepairError> {
+    let timelines = candidate_timelines(validated)?;
+    let mut freezers = Vec::with_capacity(timelines.len());
+    for (freezer_id, timeline) in timelines {
+        freezers.push(candidate_replay(freezer_id, &timeline));
+    }
+    Ok(Export { freezers })
+}
+
+fn candidate_timelines(validated: &Validated) -> Result<CandidateTimelines, RepairError> {
+    let mut config_timelines = BTreeMap::<String, BTreeMap<i64, &Config>>::new();
+    for config in validated.configurations.values() {
+        config_timelines
+            .entry(config.freezer_id.clone())
+            .or_default()
+            .insert(config.effective_at, config);
+    }
+
+    let mut timelines = BTreeMap::<String, BTreeMap<(i64, String), OwnedEvaluation>>::new();
+    for (id, observation) in &validated.observations {
+        if validated.replaced_ids.contains(id) {
+            continue;
+        }
+        let config = config_timelines
+            .get(&observation.freezer_id)
+            .and_then(|timeline| timeline.range(..=observation.observed_at).next_back())
+            .map(|(_, config)| *config)
+            .ok_or_else(|| {
+                RepairError::new(format!(
+                    "no valid limit for observation {}",
+                    observation.observation_id
+                ))
+            })?;
+        timelines
+            .entry(observation.freezer_id.clone())
+            .or_default()
+            .insert(
+                (observation.observed_at, observation.observation_id.clone()),
+                OwnedEvaluation {
+                    observation_id: observation.observation_id.clone(),
+                    observed_at: observation.observed_at,
+                    config_id: config.configuration_id.clone(),
+                    outside: observation.temp_tenths < config.min_temp_tenths
+                        || observation.temp_tenths > config.max_temp_tenths,
+                },
+            );
+    }
+
+    Ok(timelines)
+}
+
+fn candidate_replay(freezer_id: String, timeline: &CandidateTimeline) -> FreezerExport {
+    let mut mode = CandidateMode::Normal {
+        outside_run: Vec::new(),
+    };
+    let mut incidents = Vec::<Incident>::new();
+
+    for reading in timeline.values() {
+        match &mut mode {
+            CandidateMode::Normal { outside_run } => {
+                if !reading.outside {
+                    outside_run.clear();
+                    continue;
+                }
+                outside_run.push(reading.clone());
+                let elapsed = reading.observed_at
+                    - outside_run
+                        .first()
+                        .expect("reading was just pushed")
+                        .observed_at;
+                if elapsed >= 300 {
+                    incidents.push(Incident {
+                        opened: owned_transition(
+                            "open",
+                            outside_run,
+                            "five continuous minutes outside configured band",
+                        ),
+                        closed: None,
+                    });
+                    mode = CandidateMode::Excursion {
+                        inside_run: Vec::new(),
+                    };
+                }
+            }
+            CandidateMode::Excursion { inside_run } => {
+                if reading.outside {
+                    inside_run.clear();
+                    continue;
+                }
+                inside_run.push(reading.clone());
+                let elapsed = reading.observed_at
+                    - inside_run
+                        .first()
+                        .expect("reading was just pushed")
+                        .observed_at;
+                if elapsed >= 600 {
+                    if let Some(incident) = incidents.last_mut() {
+                        incident.closed = Some(owned_transition(
+                            "close",
+                            inside_run,
+                            "ten continuous minutes inside configured band",
+                        ));
+                    }
+                    mode = CandidateMode::Normal {
+                        outside_run: Vec::new(),
+                    };
+                }
+            }
+        }
+    }
+
+    FreezerExport {
+        freezer_id,
+        current_status: match mode {
+            CandidateMode::Normal { .. } => "normal".into(),
+            CandidateMode::Excursion { .. } => "excursion".into(),
+        },
+        incidents,
+    }
+}
+
+fn owned_transition(action: &str, run: &[OwnedEvaluation], reason: &str) -> Transition {
+    let trigger = run.last().expect("transition requires a non-empty run");
+    let mut configuration_ids: Vec<String> = run
+        .iter()
+        .map(|reading| reading.config_id.clone())
+        .collect();
+    configuration_ids.sort();
+    configuration_ids.dedup();
+    Transition {
+        action: action.into(),
+        at: trigger.observed_at,
+        trigger_observation_id: trigger.observation_id.clone(),
+        reason: reason.into(),
+        contributing_observation_ids: run
+            .iter()
+            .map(|reading| reading.observation_id.clone())
+            .collect(),
+        configuration_ids,
+    }
+}
+
+/// Creates deterministic observations, limits, a late correction, and a backdated limit.
+///
+/// # Panics
+/// Panics only if the requested fixture dimensions cannot fit the timestamp
+/// and sequence integer types on the current platform.
+#[must_use]
+pub fn generated_fixture(
+    seed: u64,
+    freezer_count: usize,
+    readings_per_freezer: usize,
+) -> Vec<Record> {
+    let mut rng = Lcg::new(seed);
+    let mut records = Vec::with_capacity(freezer_count * (readings_per_freezer + 1) + 8);
+
+    for freezer_number in 0..freezer_count {
+        records.push(Record::Configuration(Config {
+            configuration_id: format!("cfg-{freezer_number}-base"),
+            freezer_id: format!("freezer-{freezer_number:03}"),
+            effective_at: 0,
+            min_temp_tenths: -220,
+            max_temp_tenths: -180,
+        }));
+    }
+
+    for step in 0..readings_per_freezer {
+        for freezer_number in 0..freezer_count {
+            let phase = (step + freezer_number * 7) % 64;
+            let base_temp = if (8..=25).contains(&phase) {
+                -170
+            } else {
+                -200
+            };
+            let jitter = i32::try_from(rng.next() % 5).expect("jitter is in range") - 2;
+            let observed_at = i64::try_from(step).expect("fixture step fits i64") * 30;
+            records.push(Record::Observation(Observation {
+                observation_id: format!("o-{freezer_number}-{step}"),
+                freezer_id: format!("freezer-{freezer_number:03}"),
+                observed_at,
+                received_at: observed_at
+                    + i64::try_from(rng.next() % 21_601).expect("lateness fits i64"),
+                temp_tenths: base_temp + jitter,
+                gateway_sequence: u64::try_from(step).expect("fixture step fits u64"),
+                replaces_observation_id: None,
+            }));
+        }
+    }
+
+    if freezer_count > 0 && readings_per_freezer > 20 {
+        records.push(Record::Configuration(Config {
+            configuration_id: "cfg-0-backdated-maintenance".into(),
+            freezer_id: "freezer-000".into(),
+            effective_at: 20 * 30,
+            min_temp_tenths: -220,
+            max_temp_tenths: -160,
+        }));
+    }
+
+    if freezer_count > 1 && readings_per_freezer > 12 {
+        records.push(Record::Observation(Observation {
+            observation_id: "correction-freezer-1-step-12".into(),
+            freezer_id: "freezer-001".into(),
+            observed_at: 12 * 30,
+            received_at: 12 * 30 + 7 * 86_400,
+            temp_tenths: -200,
+            gateway_sequence: u64::try_from(readings_per_freezer + 1)
+                .expect("fixture size fits u64"),
+            replaces_observation_id: Some("o-1-12".into()),
+        }));
+    }
+
+    if let Some(duplicate) = records
+        .iter()
+        .find(|record| matches!(record, Record::Observation(_)))
+        .cloned()
+    {
+        records.push(duplicate);
+    }
+    records
+}
+
+/// Returns a deterministic shuffled copy of `records`.
+///
+/// # Panics
+/// Panics only on a platform where a slice index cannot fit in `u64`.
+#[must_use]
+pub fn shuffled(records: &[Record], seed: u64) -> Vec<Record> {
+    let mut output = records.to_vec();
+    let mut rng = Lcg::new(seed);
+    for upper in (1..output.len()).rev() {
+        let modulus = u64::try_from(upper + 1).expect("slice length fits u64");
+        let other = usize::try_from(rng.next() % modulus).expect("index fits usize");
+        output.swap(upper, other);
+    }
+    output
+}
+
+struct Lcg(u64);
+
+impl Lcg {
+    fn new(seed: u64) -> Self {
+        Self(seed ^ 0x9e37_79b9_7f4a_7c15)
+    }
+
+    fn next(&mut self) -> u64 {
+        self.0 = self
+            .0
+            .wrapping_mul(6_364_136_223_846_793_005)
+            .wrapping_add(1_442_695_040_888_963_407);
+        self.0
+    }
+}
diff --git a/developer-simulation/runs/2026-08-11--cold-chain-repair/src/main.rs b/developer-simulation/runs/2026-08-11--cold-chain-repair/src/main.rs
new file mode 100644
index 0000000..6f90bb5
--- /dev/null
+++ b/developer-simulation/runs/2026-08-11--cold-chain-repair/src/main.rs
@@ -0,0 +1,356 @@
+use std::error::Error;
+use std::fs::{self, File};
+use std::io::{BufReader, BufWriter, Write};
+use std::path::{Path, PathBuf};
+use std::process::{Command, ExitCode};
+use std::time::Instant;
+
+use cold_chain_repair::{
+    Observation, Record, candidate_from_records, canonical_json, generated_fixture, read_ndjson,
+    reference_from_records, shuffled, write_ndjson,
+};
+use fold::pipeline::terminal;
+use fold::stream::KeyedStream;
+
+const INJECTED_EXIT: i32 = 86;
+const NEXT_SNAPSHOT: &[u8] = b"complete-next-state\n";
+const BENCHMARK_FREEZERS: usize = 400;
+
+fn main() -> ExitCode {
+    match run() {
+        Ok(()) => ExitCode::SUCCESS,
+        Err(error) => {
+            eprintln!("error: {error}");
+            ExitCode::FAILURE
+        }
+    }
+}
+
+fn run() -> Result<(), Box<dyn Error>> {
+    let args: Vec<String> = std::env::args().collect();
+    match args.get(1).map(String::as_str) {
+        Some("generate") => {
+            let archive = required_path(&args, 2)?;
+            let seed = required_number(&args, 3, "seed")?;
+            let freezers = required_number(&args, 4, "freezer count")?;
+            let readings = required_number(&args, 5, "readings per freezer")?;
+            generate(&archive, seed, freezers, readings)
+        }
+        Some("repair") => {
+            let archive = required_path(&args, 2)?;
+            let state = required_path(&args, 3)?;
+            repair(&archive, &state)
+        }
+        Some("demo") => demo(args.get(2).map(PathBuf::from)),
+        Some("verify") => {
+            let seeds = args.get(2).map_or(Ok(100_usize), |value| value.parse())?;
+            verify(seeds, args.get(3).map(PathBuf::from))
+        }
+        Some("benchmark") => {
+            let observations = args
+                .get(2)
+                .map_or(Ok(1_000_000_usize), |value| value.parse())?;
+            benchmark(observations, args.get(3).map(PathBuf::from))
+        }
+        Some("benchmark-reference") => {
+            let observations = args
+                .get(2)
+                .map_or(Ok(1_000_000_usize), |value| value.parse())?;
+            benchmark_reference(observations, args.get(3).map(PathBuf::from))
+        }
+        Some("fault-demo") => {
+            let root = args.get(2).map_or_else(
+                || std::env::temp_dir().join("cold-chain-fault-demo"),
+                PathBuf::from,
+            );
+            fault_demo(&root)
+        }
+        Some("__exit-index-transaction") => {
+            let path = required_path(&args, 2)?;
+            exit_inside_index_transaction(&path)
+        }
+        Some("__exit-snapshot") => {
+            let position = args.get(2).ok_or("missing snapshot fault position")?;
+            let path = required_path(&args, 3)?;
+            exit_during_snapshot(position, &path)
+        }
+        _ => Err("usage: cold-chain-repair <generate|repair|demo|verify|benchmark|benchmark-reference|fault-demo> [arguments]".into()),
+    }
+}
+
+fn required_number<T>(args: &[String], position: usize, label: &str) -> Result<T, Box<dyn Error>>
+where
+    T: std::str::FromStr,
+    T::Err: Error + 'static,
+{
+    args.get(position)
+        .ok_or_else(|| format!("missing {label}").into())
+        .and_then(|value| value.parse().map_err(Into::into))
+}
+
+fn required_path(args: &[String], position: usize) -> Result<PathBuf, Box<dyn Error>> {
+    args.get(position)
+        .map(PathBuf::from)
+        .ok_or_else(|| "missing path argument".into())
+}
+
+fn runtime_root(given: Option<PathBuf>, label: &str) -> PathBuf {
+    given.unwrap_or_else(|| {
+        std::env::temp_dir().join(format!("cold-chain-{label}-{}", std::process::id()))
+    })
+}
+
+fn generate(
+    archive: &Path,
+    seed: u64,
+    freezers: usize,
+    readings: usize,
+) -> Result<(), Box<dyn Error>> {
+    if let Some(parent) = archive.parent() {
+        fs::create_dir_all(parent)?;
+    }
+    let records = generated_fixture(seed, freezers, readings);
+    write_ndjson(&records, BufWriter::new(File::create(archive)?))?;
+    println!(
+        "generated {} records at {}",
+        records.len(),
+        archive.display()
+    );
+    Ok(())
+}
+
+fn repair(archive: &Path, state: &Path) -> Result<(), Box<dyn Error>> {
+    fs::create_dir_all(state)?;
+    let records = read_ndjson(BufReader::new(File::open(archive)?))?;
+    let export = candidate_from_records(&records, &state.join("fold-index"))?;
+    let bytes = canonical_json(&export)?;
+    write_snapshot(&state.join("incidents.json"), &bytes)?;
+    println!(
+        "repaired {} records into {}",
+        records.len(),
+        state.join("incidents.json").display()
+    );
+    Ok(())
+}
+
+fn demo(given: Option<PathBuf>) -> Result<(), Box<dyn Error>> {
+    let root = runtime_root(given, "demo");
+    let _ = fs::remove_dir_all(&root);
+    fs::create_dir_all(&root)?;
+    let archive = root.join("archive.ndjson");
+    generate(&archive, 7, 2, 96)?;
+    let records = read_ndjson(BufReader::new(File::open(&archive)?))?;
+    let expected = reference_from_records(&records)?;
+    let candidate = candidate_from_records(&records, &root.join("fold-index"))?;
+    if candidate != expected {
+        return Err("candidate differs from the independent reducer".into());
+    }
+    let bytes = canonical_json(&candidate)?;
+    write_snapshot(&root.join("incidents.json"), &bytes)?;
+    print!("{}", String::from_utf8(bytes)?);
+    println!("demo: candidate exactly matched independent reference");
+    Ok(())
+}
+
+fn verify(seeds: usize, given: Option<PathBuf>) -> Result<(), Box<dyn Error>> {
+    let root = runtime_root(given, "verify");
+    let _ = fs::remove_dir_all(&root);
+    fs::create_dir_all(&root)?;
+
+    for seed in 0..seeds {
+        let seed_u64 = u64::try_from(seed)?;
+        let records = generated_fixture(seed_u64, 3, 96);
+        let expected = reference_from_records(&records)?;
+        let shuffled_records = shuffled(&records, seed_u64 ^ 0x5eed_5eed);
+
+        let shuffled_path = root.join("shuffled");
+        let candidate = candidate_from_records(&shuffled_records, &shuffled_path)?;
+        if candidate != expected {
+            return Err(format!("shuffled seed {seed} differs from reference").into());
+        }
+        fs::remove_dir_all(&shuffled_path)?;
+
+        let mut repeated = shuffled_records.clone();
+        repeated.extend(shuffled_records.iter().take(37).cloned());
+        let repeated_path = root.join("repeated");
+        let candidate = candidate_from_records(&repeated, &repeated_path)?;
+        if candidate != expected {
+            return Err(format!("repeated seed {seed} differs from reference").into());
+        }
+        fs::remove_dir_all(&repeated_path)?;
+    }
+
+    println!(
+        "differential seeds: {seeds} passed (chronological reference, shuffled and repeated candidate batches)"
+    );
+    Ok(())
+}
+
+fn benchmark(observations: usize, given: Option<PathBuf>) -> Result<(), Box<dyn Error>> {
+    let root = runtime_root(given, "benchmark");
+    let _ = fs::remove_dir_all(&root);
+    fs::create_dir_all(&root)?;
+    let (records, seen_observations) = sized_benchmark_fixture(observations);
+    let started = Instant::now();
+    let export = candidate_from_records(&records, &root.join("fold-index"))?;
+    let elapsed = started.elapsed();
+    write_snapshot(&root.join("incidents.json"), &canonical_json(&export)?)?;
+    println!(
+        "benchmark: {seen_observations} observations, {BENCHMARK_FREEZERS} freezers, {:.3}s elapsed",
+        elapsed.as_secs_f64()
+    );
+    Ok(())
+}
+
+fn benchmark_reference(observations: usize, given: Option<PathBuf>) -> Result<(), Box<dyn Error>> {
+    let root = runtime_root(given, "benchmark-reference");
+    let _ = fs::remove_dir_all(&root);
+    fs::create_dir_all(&root)?;
+    let (records, seen_observations) = sized_benchmark_fixture(observations);
+    let started = Instant::now();
+    let export = reference_from_records(&records)?;
+    let elapsed = started.elapsed();
+    write_snapshot(&root.join("incidents.json"), &canonical_json(&export)?)?;
+    println!(
+        "reference benchmark: {seen_observations} observations, {BENCHMARK_FREEZERS} freezers, {:.3}s elapsed",
+        elapsed.as_secs_f64()
+    );
+    Ok(())
+}
+
+fn sized_benchmark_fixture(observations: usize) -> (Vec<Record>, usize) {
+    let freezers = BENCHMARK_FREEZERS;
+    let readings_per_freezer = observations.div_ceil(freezers);
+    let mut records = generated_fixture(91, freezers, readings_per_freezer);
+    let mut seen_observations = 0_usize;
+    records.retain(|record| match record {
+        Record::Observation(_) if seen_observations < observations => {
+            seen_observations += 1;
+            true
+        }
+        Record::Observation(_) => false,
+        Record::Configuration(_) => true,
+    });
+    (records, seen_observations)
+}
+
+fn fault_demo(root: &Path) -> Result<(), Box<dyn Error>> {
+    let _ = fs::remove_dir_all(root);
+    fs::create_dir_all(root)?;
+    let index_path = root.join("fold-index");
+    let old_records = generated_fixture(17, 2, 48);
+    let old_export = reference_from_records(&old_records)?;
+    if candidate_from_records(&old_records, &index_path)? != old_export {
+        return Err("initial index differs from reference".into());
+    }
+
+    let current_exe = std::env::current_exe()?;
+    let status = Command::new(&current_exe)
+        .arg("__exit-index-transaction")
+        .arg(&index_path)
+        .status()?;
+    if status.code() != Some(INJECTED_EXIT) {
+        return Err(format!("unexpected index fault status {status}").into());
+    }
+    if candidate_from_records(&old_records, &index_path)? != old_export {
+        return Err("uncommitted index transaction became visible".into());
+    }
+
+    let mut next_records = old_records.clone();
+    next_records.push(Record::Observation(Observation {
+        observation_id: "restart-new-reading".into(),
+        freezer_id: "freezer-000".into(),
+        observed_at: 48 * 30,
+        received_at: 48 * 30 + 60,
+        temp_tenths: -200,
+        gateway_sequence: 49,
+        replaces_observation_id: None,
+    }));
+    let next_export = reference_from_records(&next_records)?;
+    if candidate_from_records(&next_records, &index_path)? != next_export {
+        return Err("restart did not converge after index exit".into());
+    }
+
+    let snapshot_path = root.join("incidents.json");
+    let old_snapshot = b"complete-prior-state\n";
+    write_snapshot(&snapshot_path, old_snapshot)?;
+    let status = Command::new(&current_exe)
+        .arg("__exit-snapshot")
+        .arg("before")
+        .arg(&snapshot_path)
+        .status()?;
+    if status.code() != Some(INJECTED_EXIT) || fs::read(&snapshot_path)? != old_snapshot {
+        return Err("exit before rename did not preserve prior snapshot".into());
+    }
+    write_snapshot(&snapshot_path, NEXT_SNAPSHOT)?;
+    if fs::read(&snapshot_path)? != NEXT_SNAPSHOT {
+        return Err("restart did not converge snapshot".into());
+    }
+
+    write_snapshot(&snapshot_path, old_snapshot)?;
+    let status = Command::new(&current_exe)
+        .arg("__exit-snapshot")
+        .arg("after")
+        .arg(&snapshot_path)
+        .status()?;
+    if status.code() != Some(INJECTED_EXIT) || fs::read(&snapshot_path)? != NEXT_SNAPSHOT {
+        return Err("exit after rename did not preserve next snapshot".into());
+    }
+    println!(
+        "fault boundaries: passed (uncommitted index, before rename, after rename, restart convergence)"
+    );
+    Ok(())
+}
+
+fn exit_inside_index_transaction(path: &Path) -> ! {
+    let mut index = KeyedStream::new(path, terminal::Table::new("accepted_records"));
+    index.wtx(|transaction| {
+        let crash_only = Record::Observation(Observation {
+            observation_id: "must-not-commit".into(),
+            freezer_id: "freezer-without-config".into(),
+            observed_at: 0,
+            received_at: 0,
+            temp_tenths: -200,
+            gateway_sequence: 0,
+            replaces_observation_id: None,
+        });
+        transaction.upsert(&"observation:must-not-commit".to_string(), &crash_only);
+        std::process::exit(INJECTED_EXIT);
+    })
+}
+
+fn exit_during_snapshot(position: &str, path: &Path) -> Result<(), Box<dyn Error>> {
+    let parent = path.parent().ok_or("snapshot must have a parent")?;
+    fs::create_dir_all(parent)?;
+    let temporary = temporary_snapshot_path(path);
+    let mut file = File::create(&temporary)?;
+    file.write_all(NEXT_SNAPSHOT)?;
+    file.sync_all()?;
+    if position == "before" {
+        std::process::exit(INJECTED_EXIT);
+    }
+    fs::rename(&temporary, path)?;
+    File::open(parent)?.sync_all()?;
+    if position == "after" {
+        std::process::exit(INJECTED_EXIT);
+    }
+    Err("snapshot position must be before or after".into())
+}
+
+fn write_snapshot(path: &Path, bytes: &[u8]) -> Result<(), Box<dyn Error>> {
+    let parent = path.parent().ok_or("snapshot must have a parent")?;
+    fs::create_dir_all(parent)?;
+    let temporary = temporary_snapshot_path(path);
+    let mut file = File::create(&temporary)?;
+    file.write_all(bytes)?;
+    file.sync_all()?;
+    fs::rename(&temporary, path)?;
+    File::open(parent)?.sync_all()?;
+    Ok(())
+}
+
+fn temporary_snapshot_path(path: &Path) -> PathBuf {
+    let mut name = path.as_os_str().to_os_string();
+    name.push(".next");
+    PathBuf::from(name)
+}
diff --git a/developer-simulation/runs/2026-08-11--cold-chain-repair/tests/acceptance.rs b/developer-simulation/runs/2026-08-11--cold-chain-repair/tests/acceptance.rs
new file mode 100644
index 0000000..abdb6f4
--- /dev/null
+++ b/developer-simulation/runs/2026-08-11--cold-chain-repair/tests/acceptance.rs
@@ -0,0 +1,189 @@
+use cold_chain_repair::{
+    Config, Observation, Record, candidate_from_records, canonical_json, generated_fixture,
+    read_ndjson, reference_from_records, shuffled, write_ndjson,
+};
+
+fn config(id: &str, freezer: &str, at: i64, min: i32, max: i32) -> Record {
+    Record::Configuration(Config {
+        configuration_id: id.into(),
+        freezer_id: freezer.into(),
+        effective_at: at,
+        min_temp_tenths: min,
+        max_temp_tenths: max,
+    })
+}
+
+fn obs(id: &str, freezer: &str, at: i64, temp: i32) -> Record {
+    Record::Observation(Observation {
+        observation_id: id.into(),
+        freezer_id: freezer.into(),
+        observed_at: at,
+        received_at: at + 21_600,
+        temp_tenths: temp,
+        gateway_sequence: u64::try_from(at).expect("test timestamp is non-negative"),
+        replaces_observation_id: None,
+    })
+}
+
+#[test]
+fn five_minute_boundary_opens_with_exact_provenance() {
+    let mut records = vec![config("cfg-a", "f-1", 0, -220, -180)];
+    for step in 0..=10 {
+        records.push(obs(&format!("o-{step}"), "f-1", step * 30, -170));
+    }
+
+    let export = reference_from_records(&records).expect("valid fixture");
+    assert_eq!(export.freezers[0].incidents.len(), 1);
+    let opened = &export.freezers[0].incidents[0].opened;
+    assert_eq!(opened.at, 300);
+    assert_eq!(opened.trigger_observation_id, "o-10");
+    assert_eq!(opened.contributing_observation_ids.len(), 11);
+    assert_eq!(opened.configuration_ids, vec!["cfg-a"]);
+}
+
+#[test]
+fn ten_minute_boundary_closes_and_exports_canonical_bytes() {
+    let mut records = vec![config("cfg-a", "f-1", 0, -220, -180)];
+    for step in 0..=10 {
+        records.push(obs(&format!("bad-{step}"), "f-1", step * 30, -170));
+    }
+    for step in 1..=21 {
+        records.push(obs(&format!("good-{step}"), "f-1", 300 + step * 30, -200));
+    }
+
+    let export = reference_from_records(&records).expect("valid fixture");
+    let closed = export.freezers[0].incidents[0]
+        .closed
+        .as_ref()
+        .expect("closed incident");
+    assert_eq!(closed.at, 930);
+    assert_eq!(closed.trigger_observation_id, "good-21");
+    assert_eq!(closed.contributing_observation_ids.len(), 21);
+    assert_eq!(canonical_json(&export).unwrap().last(), Some(&b'\n'));
+}
+
+#[test]
+fn correction_and_backdated_configuration_repair_only_affected_freezer() {
+    let mut before = vec![
+        config("cfg-a", "f-1", 0, -220, -180),
+        config("cfg-b", "f-2", 0, -220, -180),
+    ];
+    for step in 0..=10 {
+        before.push(obs(&format!("a-{step}"), "f-1", step * 30, -170));
+        before.push(obs(&format!("b-{step}"), "f-2", step * 30, -170));
+    }
+    let original = reference_from_records(&before).unwrap();
+
+    let mut after = before.clone();
+    let mut correction = obs("a-fix", "f-1", 150, -200);
+    let Record::Observation(ref mut corrected) = correction else {
+        unreachable!()
+    };
+    corrected.replaces_observation_id = Some("a-5".into());
+    corrected.received_at = 150 + 7 * 86_400;
+    after.push(correction);
+    after.push(config("cfg-a-maint", "f-1", 240, -220, -160));
+
+    let repaired = reference_from_records(&after).unwrap();
+    assert_ne!(original.freezers[0], repaired.freezers[0]);
+    assert_eq!(original.freezers[1], repaired.freezers[1]);
+}
+
+#[test]
+fn duplicates_are_idempotent_and_candidate_matches_reference() {
+    let records = vec![
+        config("cfg-a", "f-1", 0, -220, -180),
+        obs("o-1", "f-1", 0, -200),
+        obs("o-2", "f-1", 30, -170),
+    ];
+    let mut repeated = records.clone();
+    repeated.extend(records.clone());
+
+    let reference = reference_from_records(&records).unwrap();
+    assert_eq!(reference, reference_from_records(&repeated).unwrap());
+
+    let dir = std::env::temp_dir().join(format!(
+        "cold-chain-acceptance-{}-{}",
+        std::process::id(),
+        line!()
+    ));
+    let _ = std::fs::remove_dir_all(&dir);
+    let candidate = candidate_from_records(&repeated, &dir).unwrap();
+    assert_eq!(candidate, reference);
+    let _ = std::fs::remove_dir_all(&dir);
+}
+
+#[test]
+fn invalid_records_are_rejected_as_a_batch() {
+    let unknown_correction = Record::Observation(Observation {
+        observation_id: "fix".into(),
+        freezer_id: "f-1".into(),
+        observed_at: 10,
+        received_at: 20,
+        temp_tenths: -200,
+        gateway_sequence: 2,
+        replaces_observation_id: Some("missing".into()),
+    });
+    let invalid = vec![config("cfg-a", "f-1", 0, -220, -180), unknown_correction];
+    let error = reference_from_records(&invalid).unwrap_err().to_string();
+    assert!(error.contains("unknown correction target"));
+
+    let no_band = vec![
+        config("bad-band", "f-1", 0, -180, -220),
+        obs("o", "f-1", 1, -200),
+    ];
+    assert!(
+        reference_from_records(&no_band)
+            .unwrap_err()
+            .to_string()
+            .contains("invalid temperature band")
+    );
+}
+
+#[test]
+fn one_hundred_seeds_match_across_order_and_repeated_batches() {
+    let root = std::env::temp_dir().join(format!(
+        "cold-chain-differential-{}-{}",
+        std::process::id(),
+        line!()
+    ));
+    let _ = std::fs::remove_dir_all(&root);
+
+    for seed in 0..100_u64 {
+        let chronological = generated_fixture(seed, 3, 96);
+        let expected = reference_from_records(&chronological).unwrap();
+
+        let shuffled_records = shuffled(&chronological, seed ^ 0x5eed_5eed);
+        let shuffled_path = root.join(format!("seed-{seed}-shuffled"));
+        assert_eq!(
+            candidate_from_records(&shuffled_records, &shuffled_path).unwrap(),
+            expected,
+            "shuffled seed {seed}"
+        );
+
+        let mut repeated = shuffled_records.clone();
+        repeated.extend(shuffled_records.iter().take(37).cloned());
+        let repeated_path = root.join(format!("seed-{seed}-repeated"));
+        assert_eq!(
+            candidate_from_records(&repeated, &repeated_path).unwrap(),
+            expected,
+            "repeated seed {seed}"
+        );
+    }
+
+    let _ = std::fs::remove_dir_all(&root);
+}
+
+#[test]
+fn ndjson_round_trip_and_malformed_timestamp_error_name_the_line() {
+    let records = generated_fixture(5, 2, 32);
+    let mut bytes = Vec::new();
+    write_ndjson(&records, &mut bytes).unwrap();
+    assert_eq!(read_ndjson(bytes.as_slice()).unwrap(), records);
+
+    let malformed = br#"{"observation":{"observation_id":"o","freezer_id":"f","observed_at":"yesterday","received_at":1,"temp_tenths":-200,"gateway_sequence":1,"replaces_observation_id":null}}
+"#;
+    let error = read_ndjson(malformed.as_slice()).unwrap_err().to_string();
+    assert!(error.contains("line 1"));
+    assert!(error.contains("observed_at"));
+}
diff --git a/developer-simulation/runs/2026-08-11--cold-chain-repair/tests/cli.rs b/developer-simulation/runs/2026-08-11--cold-chain-repair/tests/cli.rs
new file mode 100644
index 0000000..90fad16
--- /dev/null
+++ b/developer-simulation/runs/2026-08-11--cold-chain-repair/tests/cli.rs
@@ -0,0 +1,64 @@
+use std::process::Command;
+
+#[test]
+fn subprocess_exits_preserve_complete_old_or_next_state() {
+    let root = std::env::temp_dir().join(format!(
+        "cold-chain-fault-cli-{}-{}",
+        std::process::id(),
+        line!()
+    ));
+    let _ = std::fs::remove_dir_all(&root);
+
+    let output = Command::new(env!("CARGO_BIN_EXE_cold-chain-repair"))
+        .arg("fault-demo")
+        .arg(&root)
+        .output()
+        .expect("run fault demo");
+    assert!(
+        output.status.success(),
+        "stdout: {}\nstderr: {}",
+        String::from_utf8_lossy(&output.stdout),
+        String::from_utf8_lossy(&output.stderr)
+    );
+    assert!(String::from_utf8_lossy(&output.stdout).contains("fault boundaries: passed"));
+    let _ = std::fs::remove_dir_all(&root);
+}
+
+#[test]
+fn generated_ndjson_repairs_idempotently_through_the_cli() {
+    let root = std::env::temp_dir().join(format!(
+        "cold-chain-repair-cli-{}-{}",
+        std::process::id(),
+        line!()
+    ));
+    let _ = std::fs::remove_dir_all(&root);
+    std::fs::create_dir_all(&root).unwrap();
+    let archive = root.join("archive.ndjson");
+    let state = root.join("state");
+    let binary = env!("CARGO_BIN_EXE_cold-chain-repair");
+
+    assert!(
+        Command::new(binary)
+            .args(["generate", archive.to_str().unwrap(), "23", "2", "96"])
+            .status()
+            .unwrap()
+            .success()
+    );
+    assert!(
+        Command::new(binary)
+            .args(["repair", archive.to_str().unwrap(), state.to_str().unwrap()])
+            .status()
+            .unwrap()
+            .success()
+    );
+    let first = std::fs::read(state.join("incidents.json")).unwrap();
+    assert!(
+        Command::new(binary)
+            .args(["repair", archive.to_str().unwrap(), state.to_str().unwrap()])
+            .status()
+            .unwrap()
+            .success()
+    );
+    assert_eq!(std::fs::read(state.join("incidents.json")).unwrap(), first);
+    let _ = std::fs::remove_dir_all(&root);
+}
diff --git a/developer-simulation/runs/2026-08-11--receiving-slot-admission/.gitignore b/developer-simulation/runs/2026-08-11--receiving-slot-admission/.gitignore
new file mode 100644
index 0000000..d9924e6
--- /dev/null
+++ b/developer-simulation/runs/2026-08-11--receiving-slot-admission/.gitignore
@@ -0,0 +1,4 @@
+/target/
+*.db
+*.sqlite
+*.tmp
diff --git a/developer-simulation/runs/2026-08-11--receiving-slot-admission/BRIEF.md b/developer-simulation/runs/2026-08-11--receiving-slot-admission/BRIEF.md
new file mode 100644
index 0000000..579556e
--- /dev/null
+++ b/developer-simulation/runs/2026-08-11--receiving-slot-admission/BRIEF.md
@@ -0,0 +1,47 @@
+# Trial 2 brief: Receiving-dock slot admission
+
+## Persona and Rust experience
+
+You are a backend engineer for a warehouse-management vendor. You have eight years of production TypeScript and PostgreSQL experience and three months of Rust experience. You understand transactions and row locks well, but Rust ownership and generic-heavy APIs are still unfamiliar.
+
+## Current system and baseline implementation
+
+The existing service lets carriers hold and confirm 15-minute receiving slots at 50 warehouses. PostgreSQL is authoritative for warehouses, doors, holds, confirmed bookings, and an append-only decision audit. Six stateless Node.js service replicas use serializable transactions and advisory locks. Redis currently expires tentative holds, while a database job releases capacity later.
+
+This split causes trouble: a Redis expiry can race with confirmation, retries after timeouts can create a second hold, and the cleanup job can temporarily leave capacity unavailable. The team wants to evaluate whether this repository can provide a smaller, clearer admission core, but it must not displace PostgreSQL or weaken the existing transaction boundary.
+
+## Concrete pain, workload, and data shape
+
+Each warehouse has 8 to 40 doors. A door has a vehicle-height class, optional refrigeration, and a maximum pallet intake per 15-minute interval. A booking request contains `tenant_id`, `request_id`, warehouse, arrival interval, duration from one to eight intervals, pallet count, height class, refrigeration requirement, carrier priority, and a hold lifetime no longer than 15 minutes. Confirm, cancel, and reschedule commands reference the original request ID.
+
+The service handles roughly 120,000 bookings per day and peaks at 500 commands per second. A request may use any one compatible door, but all intervals of a booking must use the same door. Confirmed bookings outrank holds; holds otherwise use first-accepted order. Capacity cannot be oversubscribed. API clients retry aggressively after timeouts, so the same request ID may arrive concurrently at different replicas. Operations needs stable machine-readable reasons for rejection: no compatible door, pallet capacity, time conflict, expired hold, stale reschedule version, or request-ID payload mismatch.
+
+## Operational constraints
+
+- PostgreSQL remains the only production source of truth, and the accepted command plus its decision-audit row must commit in the same database transaction.
+- Six replicas may process commands concurrently. No correctness argument may depend on process-local memory, one permanently elected application leader, or clock agreement between replicas.
+- Expiry decisions use a database-supplied timestamp captured by the command transaction. Tests use an injected logical timestamp; wall-clock sleeps are not acceptable evidence.
+- A retry with the same tenant and request ID must return the original result. Reusing that ID with a different payload must fail visibly.
+- After an ambiguous client timeout or process exit, retrying must not consume capacity twice, revive an expired hold, or lose the audit decision.
+- The existing HTTP API, PostgreSQL schema ownership, migrations, and operations tooling must remain recognizable. A local side database is not acceptable production authority.
+
+## Measurable acceptance criteria
+
+1. Supply a deterministic command fixture and an independent simple reference model for one warehouse with 24 doors and at least 10,000 mixed hold, confirm, cancel, reschedule, expiry, and retry commands.
+2. For 100 generated seeds, every accepted or rejected command matches the reference model's resulting booking state and reason code when executed sequentially with logical timestamps.
+3. Run a concurrency test with at least four independent workers issuing colliding commands against the same production-shaped authority. Across 30 runs, no door interval exceeds its pallet capacity, no confirmed booking overlaps another confirmed booking on the same door, and each request ID has exactly one decision outcome.
+4. Demonstrate retries after injected exits immediately before and after the transaction commit. Each retry returns the durable original outcome, and each accepted state change has exactly one corresponding audit record.
+5. Expiring a hold and confirming it at the same logical timestamp has one documented, deterministic rule that is identical across workers and test runs.
+6. On the declared test machine, replay 100,000 representative commands at an observed throughput of at least 250 commands per second with p95 decision latency below 40 ms. Report database version, schema size, machine, and measurement method.
+7. Rejection explanations are stable enums with relevant door or interval identifiers; they must not depend on unordered iteration or include other tenants' request data.
+
+## Explicit non-goals
+
+- Do not build the HTTP layer, carrier portal, authentication, notifications, billing, route optimization, or a general constraint solver.
+- Do not redesign the PostgreSQL schema beyond the minimal tables or indexes needed for the prototype.
+- Do not use Redis, wall-clock timers, or a new database to hide a missing transactional guarantee.
+- Do not assume this repository is suitable. A documented no-fit result with runnable evidence is a successful trial.
+
+## Smallest self-contained prototype boundary
+
+Implement only the admission core and a command-line test harness for one 24-door warehouse using a disposable PostgreSQL database. Cover holds, confirmation, cancellation, rescheduling, expiry, idempotent request IDs, decision auditing, and the listed door constraints. Use deterministic fixtures and logical timestamps, and run both sequential reference checks and real multi-worker collision tests. Keep the experiment separate from the repository's existing implementation and examples; if its available abstractions cannot share the required PostgreSQL transaction, stop at the smallest reproducer and record the decision boundary rather than building an unrelated replacement.
diff --git a/developer-simulation/runs/2026-08-11--receiving-slot-admission/Cargo.toml b/developer-simulation/runs/2026-08-11--receiving-slot-admission/Cargo.toml
new file mode 100644
index 0000000..b00ad02
--- /dev/null
+++ b/developer-simulation/runs/2026-08-11--receiving-slot-admission/Cargo.toml
@@ -0,0 +1,9 @@
+[package]
+name = "receiving-slot-admission"
+version = "0.1.0"
+edition = "2024"
+publish = false
+
+[dependencies]
+fold = { path = "../../../fold" }
+serde = { version = "1", features = ["derive"] }
diff --git a/developer-simulation/runs/2026-08-11--receiving-slot-admission/DISCOVERY.md b/developer-simulation/runs/2026-08-11--receiving-slot-admission/DISCOVERY.md
new file mode 100644
index 0000000..f170596
--- /dev/null
+++ b/developer-simulation/runs/2026-08-11--receiving-slot-admission/DISCOVERY.md
@@ -0,0 +1,51 @@
+# Discovery trail
+
+## Initial reading, before component source
+
+I am evaluating this as a backend engineer who normally reaches for PostgreSQL transactions, unique constraints, and advisory or row locks. My production baseline would keep a command envelope, its durable idempotency record, the booking mutation, interval-capacity checks, and the append-only decision audit inside one `SERIALIZABLE` PostgreSQL transaction. The transaction would take a database timestamp once, lock one stable warehouse/request scope, replay an existing `(tenant_id, request_id)` result when its canonical payload hash matches, reject a mismatch, expire relevant holds, choose one compatible door in a stable SQL order, write state and audit, and commit them together. PostgreSQL's result is the only authoritative result; a retry after an ambiguous client timeout reads that durable row.
+
+From the public README and examples, BogKit appears to contain three independent building blocks:
+
+- Fold is an embedded, persistent Rust stream whose inserts and removals transactionally update materialized views. The examples give the stream ownership to one process/thread and store data in Fold's own on-disk database.
+- ESE turns text into static embeddings. That is unrelated to exact slot admission.
+- ANNy is a nearest-neighbor index. Approximate similarity search is also unrelated to exact scheduling constraints.
+
+My initial hypothesis is that Fold could express convenient local projections such as occupancy totals or an audit-derived view, but not the required production commit boundary unless it can participate in a caller-owned PostgreSQL transaction. A second durable database would create exactly the dual-write ambiguity this trial is meant to eliminate. I therefore need to establish whether Fold exposes a PostgreSQL-backed storage adapter, caller-owned transaction hook, write-ahead/outbox integration, or prepare/commit protocol. If it does not, the honest result is likely no-fit for the admission authority, even if a process-local demo can model the rules.
+
+The smallest meaningful evidence will be a deterministic executable admission model that exercises the business semantics and the exact failure boundary: a simulated PostgreSQL transaction commits authoritative booking and audit state, while a separate Fold write can be skipped by an injected process exit. This is not PostgreSQL evidence and will not be presented as such; it is only a reproducer of why an independent Fold commit cannot replace or join the existing transaction. If a real disposable PostgreSQL server is already available, I will additionally use it. I will not install or start one.
+
+## Questions to answer
+
+1. Can Fold use PostgreSQL as its authority or join an existing PostgreSQL transaction?
+2. Does Fold support concurrent writers from six independent processes, or does its public shape assume one stream owner?
+3. Can a caller atomically persist a stable command outcome and audit record with the Fold state mutation?
+4. If the answer is no, is there any smaller non-authoritative role for Fold that materially improves the PostgreSQL baseline without adding a fragile dual-write path?
+5. Can the model make expiry-at-confirmation deterministic, keep retries idempotent, provide exact stable reasons, and survive injected exit boundaries?
+
+## Evidence standard
+
+I will distinguish (a) behavior proven by executable deterministic tests, (b) API facts established by minimal source inspection, and (c) production claims that remain unverified without PostgreSQL and independent processes. Passing an in-memory or local-file model is not evidence for serializable PostgreSQL concurrency, database latency, or six-replica crash safety.
+
+## Environment check
+
+No disposable PostgreSQL environment was available. `psql`, `postgres`, and `pg_isready` were absent; there was no listener on TCP 5432 and no PostgreSQL connection environment variable. A Docker CLI existed, but OrbStack was stopped and the Docker socket was unavailable. I did not install anything or start a service. This prevents the database-backed concurrency and performance criteria from being evaluated honestly.
+
+## Minimum source inspection
+
+I searched Fold for PostgreSQL, storage, and transaction integration points, then read its public stream transaction implementation. The dependency manifest names `fjall` and has no PostgreSQL dependency. `Stream` owns a `fjall::SingleWriterTxDatabase`; `Stream::new` opens it from a filesystem path. Each `wtx` calls `self.store.write_tx()` and later commits it internally. `WriteTx` wraps a concrete `fjall::SingleWriterWriteTx`, while `PipelineInitCtx` creates fjall keyspaces. I found no PostgreSQL adapter, external transaction parameter, two-phase prepare, or outbox callback. This confirms the initial transaction-boundary concern rather than merely inferring it from an example.
+
+ESE and ANNy solve semantic encoding and approximate-neighbor lookup, respectively. Neither contributes to exact slot constraints or transaction ownership, so adding them would be unjustified.
+
+## Prototype and debugging trail
+
+I built `receiving-slot-admission`, a Rust CLI with three intentionally separated claims:
+
+1. A deterministic local authority model exercises the domain semantics over 24 doors. It uses logical timestamps, durable-result-style idempotency, exact reason codes, a 10,000-command fixture, 100 generated seeds, four-thread collision attempts over 30 runs, and invariant checks.
+2. A real child-process crash harness exits immediately before and after a mocked atomic authority commit. A Fold `KeyedStream` is a separate durable decision mirror. The after-commit exit reliably leaves authoritative booking plus audit present while Fold has no row, directly demonstrating the dual-commit gap.
+3. A repeat-heavy 100,000-command local benchmark ensures the harness is runnable, but is printed with an explicit warning that it is not PostgreSQL performance evidence.
+
+The first test run found a real bug in my model: two overlapping holds could both be confirmed, violating the explicit confirmed-booking invariant. I added a deterministic conflict check at confirmation time; the second full run passed. During final review I also noticed that hold expiry used a hard-coded 15 instead of the request's validated lifetime, corrected it, and reran every check. These were prototype defects, not BogKit defects.
+
+The skeptical review then found two more model defects and one verification defect. Expired holds remained active for unrelated capacity decisions unless an explicit sweep ran; I now expire due holds from the injected command timestamp before every new, non-replayed command and added one-door regressions for a new hold and a reschedule. Reschedule also accepted durations outside `1..=8`; durations 0 and 9 now reject without changing the booking or version. Finally, the originally stated strict lint gate omitted pedantic lints and failed with checked-conversion, elapsed-time precision, and naming diagnostics. I replaced every reported truncating conversion with a checked conversion carrying its bounded-value reason, retained benchmark samples as `Duration`, renamed the similar binding, and added no lint allowances. A distinct wrong-version test now proves `stale_reschedule_version` rather than confusing it with payload mismatch on reuse of an existing operation key.
+
+After those corrections, the full gate passed with eight tests and strict pedantic Clippy. The resulting fit decision remained no-fit. Fold can atomically update its own materialized views, but the required unit is the existing PostgreSQL state plus PostgreSQL audit. Repairing a Fold mirror on retry is possible, yet that is eventual reconciliation, not the required same-transaction guarantee. An outbox could make a non-authoritative projection reliable, but no useful projection in this admission path justified the extra persisted subsystem.
diff --git a/developer-simulation/runs/2026-08-11--receiving-slot-admission/README.md b/developer-simulation/runs/2026-08-11--receiving-slot-admission/README.md
new file mode 100644
index 0000000..acfc2e1
--- /dev/null
+++ b/developer-simulation/runs/2026-08-11--receiving-slot-admission/README.md
@@ -0,0 +1,28 @@
+# Receiving-slot admission boundary reproducer
+
+This is a deliberately small evaluation artifact, not a production scheduler. It models the warehouse admission rules with logical timestamps, then demonstrates the transaction boundary that prevents Fold from serving as this system's production authority.
+
+The modeled authority covers a 24-door warehouse, holds, confirmation, cancellation, rescheduling, expiry, exact retries, payload-mismatch rejection, stable reason codes, and invariant checks. A four-thread test exercises colliding retries behind a process-local mutex. That test is useful for the domain model only; it is not evidence for PostgreSQL or six independent replicas.
+
+The crash-boundary demo uses real child-process exits around a mocked atomic authoritative commit. The authoritative booking and audit are written together, while Fold is a separate fjall-backed mirror. An exit after the authoritative commit but before `Fold::wtx` leaves the mirror behind. Retry can repair the mirror, but no API observed in BogKit can make both commits one PostgreSQL transaction. The mock is intentionally labeled and cannot substitute for a real PostgreSQL test.
+
+## Run
+
+From the BogKit repository root:
+
+```console
+cargo fmt --manifest-path developer-simulation/Cargo.toml -p receiving-slot-admission -- --check
+cargo test --manifest-path developer-simulation/Cargo.toml --locked --offline --release -p receiving-slot-admission --all-targets
+cargo clippy --manifest-path developer-simulation/Cargo.toml --locked --offline --release -p receiving-slot-admission --all-targets -- -D warnings -D clippy::all -D clippy::pedantic
+cargo run --manifest-path developer-simulation/Cargo.toml --locked --offline --release -p receiving-slot-admission
+```
+
+The demo cleans its temporary authority and Fold directories. Cargo build output can be removed with `cargo clean`.
+
+## Interpretation
+
+The result is **no-fit for the production admission authority**. PostgreSQL must remain authoritative and must commit the accepted command and audit record together. Fold owns an embedded `fjall::SingleWriterTxDatabase`; its public constructor takes a filesystem path, and its `wtx` creates and commits that store's transaction internally. The evaluated API exposes no PostgreSQL storage adapter, caller-owned transaction, outbox hook, or prepare/commit protocol.
+
+The local model expires due holds at the injected command timestamp before every new command decision. Exact replays return their stored result without advancing logical time. Regression tests cover capacity release without a sweep, rescheduling after an unrelated expiry, invalid reschedule durations, and a genuinely stale version.
+
+ESE and ANNy are not used because this problem requires exact transactional scheduling, not embeddings or approximate search. A PostgreSQL outbox feeding an optional derived Fold projection might be possible, but it would add another persisted system without improving admission correctness, so this prototype does not recommend it.
diff --git a/developer-simulation/runs/2026-08-11--receiving-slot-admission/src/main.rs b/developer-simulation/runs/2026-08-11--receiving-slot-admission/src/main.rs
new file mode 100644
index 0000000..1289dea
--- /dev/null
+++ b/developer-simulation/runs/2026-08-11--receiving-slot-admission/src/main.rs
@@ -0,0 +1,1230 @@
+use std::collections::{BTreeMap, HashMap};
+use std::fs;
+use std::path::{Path, PathBuf};
+use std::process::{Command as ProcessCommand, ExitStatus};
+use std::sync::{Arc, Mutex};
+use std::thread;
+use std::time::Instant;
+
+use fold::pipeline::terminal;
+use fold::stream::KeyedStream;
+use serde::{Deserialize, Serialize};
+
+const DOOR_COUNT: u16 = 24;
+
+#[derive(Clone, Debug, PartialEq, Eq)]
+struct Door {
+    id: u16,
+    height: u8,
+    refrigerated: bool,
+    pallet_capacity: u16,
+}
+
+#[derive(Clone, Debug, PartialEq, Eq)]
+struct HoldSpec {
+    tenant: u16,
+    request_id: u64,
+    arrival: u32,
+    duration: u8,
+    pallets: u16,
+    height: u8,
+    refrigerated: bool,
+    priority: u8,
+    lifetime: u32,
+}
+
+#[derive(Clone, Debug, PartialEq, Eq)]
+enum Command {
+    Hold {
+        spec: HoldSpec,
+        now: u32,
+    },
+    Confirm {
+        tenant: u16,
+        request_id: u64,
+        now: u32,
+    },
+    Cancel {
+        tenant: u16,
+        request_id: u64,
+        now: u32,
+    },
+    Reschedule {
+        tenant: u16,
+        request_id: u64,
+        expected_version: u32,
+        arrival: u32,
+        duration: u8,
+        now: u32,
+    },
+    Expire {
+        sweep_id: u64,
+        now: u32,
+    },
+}
+
+#[derive(Clone, Debug, PartialEq, Eq)]
+enum Status {
+    Held { expires_at: u32 },
+    Confirmed,
+    Cancelled,
+    Expired,
+}
+
+#[derive(Clone, Debug, PartialEq, Eq)]
+struct Booking {
+    spec: HoldSpec,
+    door: u16,
+    version: u32,
+    accepted_order: u64,
+    status: Status,
+}
+
+#[derive(Clone, Debug, PartialEq, Eq)]
+struct Outcome {
+    accepted: bool,
+    code: &'static str,
+    door: Option<u16>,
+    interval: Option<u32>,
+    version: Option<u32>,
+}
+
+impl Outcome {
+    fn accepted(code: &'static str, booking: Option<&Booking>) -> Self {
+        Self {
+            accepted: true,
+            code,
+            door: booking.map(|booking| booking.door),
+            interval: booking.map(|booking| booking.spec.arrival),
+            version: booking.map(|booking| booking.version),
+        }
+    }
+
+    fn rejected(code: &'static str, door: Option<u16>, interval: Option<u32>) -> Self {
+        Self {
+            accepted: false,
+            code,
+            door,
+            interval,
+            version: None,
+        }
+    }
+}
+
+#[derive(Clone, Debug)]
+struct StoredDecision {
+    fingerprint: String,
+    outcome: Outcome,
+}
+
+#[derive(Clone, Debug)]
+struct Audit {
+    command_key: String,
+    outcome: Outcome,
+}
+
+#[derive(Clone, Debug)]
+struct Authority {
+    doors: Vec<Door>,
+    bookings: BTreeMap<(u16, u64), Booking>,
+    decisions: HashMap<String, StoredDecision>,
+    audits: Vec<Audit>,
+    next_order: u64,
+}
+
+impl Authority {
+    fn one_warehouse() -> Self {
+        let doors = (0..DOOR_COUNT)
+            .map(|id| Door {
+                id,
+                height: match id % 3 {
+                    0 => 1,
+                    1 => 2,
+                    _ => 3,
+                },
+                refrigerated: id % 4 == 0,
+                pallet_capacity: 18 + (id % 5) * 4,
+            })
+            .collect();
+        Self {
+            doors,
+            bookings: BTreeMap::new(),
+            decisions: HashMap::new(),
+            audits: Vec::new(),
+            next_order: 0,
+        }
+    }
+
+    #[cfg(test)]
+    fn one_door(pallet_capacity: u16) -> Self {
+        Self {
+            doors: vec![Door {
+                id: 0,
+                height: 3,
+                refrigerated: true,
+                pallet_capacity,
+            }],
+            bookings: BTreeMap::new(),
+            decisions: HashMap::new(),
+            audits: Vec::new(),
+            next_order: 0,
+        }
+    }
+
+    fn execute(&mut self, command: &Command) -> Outcome {
+        let key = command_key(command);
+        let fingerprint = fingerprint(command);
+        if let Some(stored) = self.decisions.get(&key) {
+            return if stored.fingerprint == fingerprint {
+                stored.outcome.clone()
+            } else {
+                Outcome::rejected("request_id_payload_mismatch", None, None)
+            };
+        }
+
+        // The database-supplied logical timestamp governs both cleanup and
+        // the command decision. Replays return their durable result without
+        // advancing state; every new command first makes expired holds
+        // ineligible for capacity in the same modeled authority operation.
+        let expired = self.expire_due(command_now(command));
+        let outcome = self.execute_new(command, expired);
+        self.decisions.insert(
+            key.clone(),
+            StoredDecision {
+                fingerprint,
+                outcome: outcome.clone(),
+            },
+        );
+        self.audits.push(Audit {
+            command_key: key,
+            outcome: outcome.clone(),
+        });
+        outcome
+    }
+
+    fn execute_new(&mut self, command: &Command, expired: usize) -> Outcome {
+        match command {
+            Command::Hold { spec, now } => self.hold(spec.clone(), *now),
+            Command::Confirm {
+                tenant,
+                request_id,
+                now,
+            } => self.confirm(*tenant, *request_id, *now),
+            Command::Cancel {
+                tenant,
+                request_id,
+                now,
+            } => self.cancel(*tenant, *request_id, *now),
+            Command::Reschedule {
+                tenant,
+                request_id,
+                expected_version,
+                arrival,
+                duration,
+                now,
+            } => self.reschedule(
+                *tenant,
+                *request_id,
+                *expected_version,
+                *arrival,
+                *duration,
+                *now,
+            ),
+            Command::Expire { .. } => Outcome {
+                accepted: true,
+                code: "expiry_sweep_applied",
+                door: None,
+                interval: Some(
+                    u32::try_from(expired).expect("expired booking count must fit in u32"),
+                ),
+                version: None,
+            },
+        }
+    }
+
+    fn hold(&mut self, spec: HoldSpec, now: u32) -> Outcome {
+        if spec.duration == 0 || spec.duration > 8 || spec.lifetime == 0 || spec.lifetime > 15 {
+            return Outcome::rejected("invalid_request", None, Some(spec.arrival));
+        }
+        let compatible: Vec<u16> = self
+            .doors
+            .iter()
+            .filter(|door| door.height >= spec.height && (!spec.refrigerated || door.refrigerated))
+            .map(|door| door.id)
+            .collect();
+        if compatible.is_empty() {
+            return Outcome::rejected("no_compatible_door", None, Some(spec.arrival));
+        }
+        let (door, rejection) = match self.choose_door(&spec, None, &compatible) {
+            Ok(door) => (door, None),
+            Err(rejection) => (0, Some(rejection)),
+        };
+        if let Some(rejection) = rejection {
+            return rejection;
+        }
+        let order = self.next_order;
+        self.next_order += 1;
+        let key = (spec.tenant, spec.request_id);
+        let expires_at = now + spec.lifetime;
+        let booking = Booking {
+            spec,
+            door,
+            version: 0,
+            accepted_order: order,
+            status: Status::Held { expires_at },
+        };
+        self.bookings.insert(key, booking);
+        Outcome::accepted("hold_accepted", self.bookings.get(&key))
+    }
+
+    fn confirm(&mut self, tenant: u16, request_id: u64, now: u32) -> Outcome {
+        let key = (tenant, request_id);
+        let Some(existing) = self.bookings.get(&key).cloned() else {
+            return Outcome::rejected("booking_not_found", None, None);
+        };
+        match existing.status {
+            Status::Held { expires_at } if expires_at <= now => {
+                self.bookings.get_mut(&key).expect("booking exists").status = Status::Expired;
+                Outcome::rejected(
+                    "expired_hold",
+                    Some(existing.door),
+                    Some(existing.spec.arrival),
+                )
+            }
+            Status::Held { .. } => {
+                for interval in
+                    existing.spec.arrival..existing.spec.arrival + u32::from(existing.spec.duration)
+                {
+                    if self.bookings.iter().any(|(other_key, booking)| {
+                        *other_key != key
+                            && booking.door == existing.door
+                            && matches!(booking.status, Status::Confirmed)
+                            && overlaps(booking.spec.arrival, booking.spec.duration, interval)
+                    }) {
+                        return Outcome::rejected(
+                            "time_conflict",
+                            Some(existing.door),
+                            Some(interval),
+                        );
+                    }
+                }
+                let booking = self.bookings.get_mut(&key).expect("booking exists");
+                booking.status = Status::Confirmed;
+                Outcome::accepted("booking_confirmed", Some(booking))
+            }
+            Status::Confirmed => Outcome::accepted("booking_confirmed", Some(&existing)),
+            Status::Expired => Outcome::rejected(
+                "expired_hold",
+                Some(existing.door),
+                Some(existing.spec.arrival),
+            ),
+            Status::Cancelled => Outcome::rejected(
+                "booking_cancelled",
+                Some(existing.door),
+                Some(existing.spec.arrival),
+            ),
+        }
+    }
+
+    fn cancel(&mut self, tenant: u16, request_id: u64, now: u32) -> Outcome {
+        let key = (tenant, request_id);
+        let Some(existing) = self.bookings.get(&key).cloned() else {
+            return Outcome::rejected("booking_not_found", None, None);
+        };
+        if matches!(existing.status, Status::Held { expires_at } if expires_at <= now) {
+            self.bookings.get_mut(&key).expect("booking exists").status = Status::Expired;
+            return Outcome::rejected(
+                "expired_hold",
+                Some(existing.door),
+                Some(existing.spec.arrival),
+            );
+        }
+        if matches!(existing.status, Status::Cancelled | Status::Expired) {
+            return Outcome::rejected(
+                "booking_inactive",
+                Some(existing.door),
+                Some(existing.spec.arrival),
+            );
+        }
+        let booking = self.bookings.get_mut(&key).expect("booking exists");
+        booking.status = Status::Cancelled;
+        Outcome::accepted("booking_cancelled", Some(booking))
+    }
+
+    fn reschedule(
+        &mut self,
+        tenant: u16,
+        request_id: u64,
+        expected_version: u32,
+        arrival: u32,
+        duration: u8,
+        now: u32,
+    ) -> Outcome {
+        let key = (tenant, request_id);
+        let Some(existing) = self.bookings.get(&key).cloned() else {
+            return Outcome::rejected("booking_not_found", None, Some(arrival));
+        };
+        if !(1..=8).contains(&duration) {
+            return Outcome::rejected("invalid_request", Some(existing.door), Some(arrival));
+        }
+        if existing.version != expected_version {
+            return Outcome::rejected(
+                "stale_reschedule_version",
+                Some(existing.door),
+                Some(arrival),
+            );
+        }
+        if matches!(existing.status, Status::Held { expires_at } if expires_at <= now) {
+            self.bookings.get_mut(&key).expect("booking exists").status = Status::Expired;
+            return Outcome::rejected(
+                "expired_hold",
+                Some(existing.door),
+                Some(existing.spec.arrival),
+            );
+        }
+        if matches!(existing.status, Status::Cancelled | Status::Expired) {
+            return Outcome::rejected("booking_inactive", Some(existing.door), Some(arrival));
+        }
+        let mut proposed = existing.spec.clone();
+        proposed.arrival = arrival;
+        proposed.duration = duration;
+        let compatible: Vec<u16> = self
+            .doors
+            .iter()
+            .filter(|door| {
+                door.height >= proposed.height && (!proposed.refrigerated || door.refrigerated)
+            })
+            .map(|door| door.id)
+            .collect();
+        let door = match self.choose_door(&proposed, Some(key), &compatible) {
+            Ok(door) => door,
+            Err(outcome) => return outcome,
+        };
+        let booking = self.bookings.get_mut(&key).expect("booking exists");
+        booking.spec = proposed;
+        booking.door = door;
+        booking.version += 1;
+        Outcome::accepted("booking_rescheduled", Some(booking))
+    }
+
+    fn choose_door(
+        &self,
+        spec: &HoldSpec,
+        exclude: Option<(u16, u64)>,
+        compatible: &[u16],
+    ) -> Result<u16, Outcome> {
+        let mut first_time_conflict = None;
+        let mut first_capacity_conflict = None;
+        for &door_id in compatible {
+            let door = &self.doors[usize::from(door_id)];
+            let mut rejected = false;
+            for interval in spec.arrival..spec.arrival + u32::from(spec.duration) {
+                let mut used = 0u16;
+                for (key, booking) in &self.bookings {
+                    if Some(*key) == exclude
+                        || booking.door != door_id
+                        || !is_active(&booking.status)
+                    {
+                        continue;
+                    }
+                    if overlaps(booking.spec.arrival, booking.spec.duration, interval) {
+                        if matches!(booking.status, Status::Confirmed) {
+                            first_time_conflict.get_or_insert((door_id, interval));
+                            rejected = true;
+                            break;
+                        }
+                        used = used.saturating_add(booking.spec.pallets);
+                    }
+                }
+                if rejected {
+                    break;
+                }
+                if used.saturating_add(spec.pallets) > door.pallet_capacity {
+                    first_capacity_conflict.get_or_insert((door_id, interval));
+                    rejected = true;
+                    break;
+                }
+            }
+            if !rejected {
+                return Ok(door_id);
+            }
+        }
+        if let Some((door, interval)) = first_time_conflict {
+            Err(Outcome::rejected(
+                "time_conflict",
+                Some(door),
+                Some(interval),
+            ))
+        } else if let Some((door, interval)) = first_capacity_conflict {
+            Err(Outcome::rejected(
+                "pallet_capacity",
+                Some(door),
+                Some(interval),
+            ))
+        } else {
+            Err(Outcome::rejected(
+                "no_compatible_door",
+                None,
+                Some(spec.arrival),
+            ))
+        }
+    }
+
+    fn expire_due(&mut self, now: u32) -> usize {
+        let mut count = 0;
+        for booking in self.bookings.values_mut() {
+            if matches!(booking.status, Status::Held { expires_at } if expires_at <= now) {
+                booking.status = Status::Expired;
+                count += 1;
+            }
+        }
+        count
+    }
+
+    fn check_invariants(&self) -> Result<(), String> {
+        if self.audits.len() != self.decisions.len() {
+            return Err("decision/audit cardinality mismatch".to_string());
+        }
+        for (key, stored) in &self.decisions {
+            let audit = self
+                .audits
+                .iter()
+                .find(|audit| audit.command_key == *key)
+                .ok_or_else(|| format!("decision {key} has no audit"))?;
+            if audit.outcome != stored.outcome {
+                return Err(format!("decision {key} differs from its audit"));
+            }
+        }
+        for door in &self.doors {
+            let max_interval = self
+                .bookings
+                .values()
+                .map(|booking| booking.spec.arrival + u32::from(booking.spec.duration))
+                .max()
+                .unwrap_or(0);
+            for interval in 0..max_interval {
+                let active: Vec<&Booking> = self
+                    .bookings
+                    .values()
+                    .filter(|booking| {
+                        booking.door == door.id
+                            && is_active(&booking.status)
+                            && overlaps(booking.spec.arrival, booking.spec.duration, interval)
+                    })
+                    .collect();
+                let used: u16 = active.iter().map(|booking| booking.spec.pallets).sum();
+                if used > door.pallet_capacity {
+                    return Err(format!(
+                        "door {} interval {interval} uses {used}>{}",
+                        door.id, door.pallet_capacity
+                    ));
+                }
+                let confirmed = active
+                    .iter()
+                    .filter(|booking| matches!(booking.status, Status::Confirmed))
+                    .count();
+                if confirmed > 1 {
+                    return Err(format!(
+                        "door {} interval {interval} has {confirmed} confirmed bookings",
+                        door.id
+                    ));
+                }
+            }
+        }
+        Ok(())
+    }
+}
+
+fn is_active(status: &Status) -> bool {
+    matches!(status, Status::Held { .. } | Status::Confirmed)
+}
+
+fn overlaps(arrival: u32, duration: u8, interval: u32) -> bool {
+    interval >= arrival && interval < arrival + u32::from(duration)
+}
+
+fn command_now(command: &Command) -> u32 {
+    match command {
+        Command::Hold { now, .. }
+        | Command::Confirm { now, .. }
+        | Command::Cancel { now, .. }
+        | Command::Reschedule { now, .. }
+        | Command::Expire { now, .. } => *now,
+    }
+}
+
+fn command_key(command: &Command) -> String {
+    match command {
+        Command::Hold { spec, .. } => format!("{}:{}:hold", spec.tenant, spec.request_id),
+        Command::Confirm {
+            tenant, request_id, ..
+        } => format!("{tenant}:{request_id}:confirm"),
+        Command::Cancel {
+            tenant, request_id, ..
+        } => format!("{tenant}:{request_id}:cancel"),
+        Command::Reschedule {
+            tenant,
+            request_id,
+            expected_version,
+            ..
+        } => {
+            format!("{tenant}:{request_id}:reschedule:{expected_version}")
+        }
+        Command::Expire { sweep_id, .. } => format!("expiry:{sweep_id}"),
+    }
+}
+
+fn fingerprint(command: &Command) -> String {
+    match command {
+        Command::Hold { spec, .. } => format!(
+            "hold/{}/{}/{}/{}/{}/{}/{}/{}/{}",
+            spec.tenant,
+            spec.request_id,
+            spec.arrival,
+            spec.duration,
+            spec.pallets,
+            spec.height,
+            spec.refrigerated,
+            spec.priority,
+            spec.lifetime
+        ),
+        Command::Confirm {
+            tenant, request_id, ..
+        } => format!("confirm/{tenant}/{request_id}"),
+        Command::Cancel {
+            tenant, request_id, ..
+        } => format!("cancel/{tenant}/{request_id}"),
+        Command::Reschedule {
+            tenant,
+            request_id,
+            expected_version,
+            arrival,
+            duration,
+            ..
+        } => {
+            format!("reschedule/{tenant}/{request_id}/{expected_version}/{arrival}/{duration}")
+        }
+        Command::Expire { sweep_id, now } => format!("expire/{sweep_id}/{now}"),
+    }
+}
+
+#[derive(Clone)]
+struct Lcg(u64);
+
+impl Lcg {
+    fn next(&mut self) -> u64 {
+        self.0 = self
+            .0
+            .wrapping_mul(6_364_136_223_846_793_005)
+            .wrapping_add(1_442_695_040_888_963_407);
+        self.0
+    }
+
+    fn range(&mut self, upper: u64) -> u64 {
+        self.next() % upper
+    }
+}
+
+fn fixture(seed: u64, len: usize) -> Vec<Command> {
+    let mut rng = Lcg(seed ^ 0x9e37_79b9_7f4a_7c15);
+    let mut commands = Vec::with_capacity(len);
+    let mut specs: Vec<HoldSpec> = Vec::new();
+    for index in 0..len {
+        let now = u32::try_from(index / 6)
+            .expect("fixture logical timestamp derived from command count must fit in u32");
+        let command = match index % 10 {
+            0..=4 => {
+                let request_id =
+                    u64::try_from(specs.len()).expect("fixture request count must fit in u64");
+                let spec = HoldSpec {
+                    tenant: u16::try_from(rng.range(4) + 1)
+                        .expect("bounded tenant value in 1..=4 must fit in u16"),
+                    request_id,
+                    arrival: u32::try_from(rng.range(96))
+                        .expect("bounded arrival value below 96 must fit in u32"),
+                    duration: u8::try_from(rng.range(8) + 1)
+                        .expect("bounded duration value in 1..=8 must fit in u8"),
+                    pallets: u16::try_from(rng.range(18) + 1)
+                        .expect("bounded pallet value in 1..=18 must fit in u16"),
+                    height: u8::try_from(rng.range(3) + 1)
+                        .expect("bounded height value in 1..=3 must fit in u8"),
+                    refrigerated: rng.range(5) == 0,
+                    priority: u8::try_from(rng.range(4))
+                        .expect("bounded priority value below 4 must fit in u8"),
+                    lifetime: u32::try_from(rng.range(15) + 1)
+                        .expect("bounded lifetime value in 1..=15 must fit in u32"),
+                };
+                specs.push(spec.clone());
+                Command::Hold { spec, now }
+            }
+            5 if !specs.is_empty() => {
+                let spec = specs[random_index(&mut rng, specs.len())].clone();
+                Command::Hold { spec, now }
+            }
+            6 if !specs.is_empty() => {
+                let spec = &specs[random_index(&mut rng, specs.len())];
+                Command::Confirm {
+                    tenant: spec.tenant,
+                    request_id: spec.request_id,
+                    now,
+                }
+            }
+            7 if !specs.is_empty() => {
+                let spec = &specs[random_index(&mut rng, specs.len())];
+                Command::Reschedule {
+                    tenant: spec.tenant,
+                    request_id: spec.request_id,
+                    expected_version: u32::try_from(rng.range(3))
+                        .expect("bounded version value below 3 must fit in u32"),
+                    arrival: u32::try_from(rng.range(96))
+                        .expect("bounded arrival value below 96 must fit in u32"),
+                    duration: u8::try_from(rng.range(8) + 1)
+                        .expect("bounded duration value in 1..=8 must fit in u8"),
+                    now,
+                }
+            }
+            8 if !specs.is_empty() => {
+                let spec = &specs[random_index(&mut rng, specs.len())];
+                Command::Cancel {
+                    tenant: spec.tenant,
+                    request_id: spec.request_id,
+                    now,
+                }
+            }
+            _ => Command::Expire {
+                sweep_id: u64::try_from(index).expect("fixture command index must fit in u64"),
+                now,
+            },
+        };
+        commands.push(command);
+    }
+    commands
+}
+
+fn random_index(rng: &mut Lcg, len: usize) -> usize {
+    let upper = u64::try_from(len).expect("fixture collection length must fit in u64");
+    usize::try_from(rng.range(upper))
+        .expect("random index below a usize-derived bound must fit in usize")
+}
+
+fn run_sequential() -> Result<(), String> {
+    let deterministic = fixture(7, 10_000);
+    let mut first = Authority::one_warehouse();
+    let first_outcomes: Vec<Outcome> = deterministic
+        .iter()
+        .map(|command| first.execute(command))
+        .collect();
+    first.check_invariants()?;
+
+    let mut replay = Authority::one_warehouse();
+    let replay_outcomes: Vec<Outcome> = deterministic
+        .iter()
+        .map(|command| replay.execute(command))
+        .collect();
+    if replay_outcomes != first_outcomes || replay.bookings != first.bookings {
+        return Err("same deterministic fixture produced different results".to_string());
+    }
+
+    for seed in 0..100 {
+        let commands = fixture(seed, 200);
+        let mut left = Authority::one_warehouse();
+        let mut right = Authority::one_warehouse();
+        for command in &commands {
+            if left.execute(command) != right.execute(command) {
+                return Err(format!("seed {seed} replay diverged"));
+            }
+        }
+        left.check_invariants()?;
+        right.check_invariants()?;
+        if left.bookings != right.bookings {
+            return Err(format!("seed {seed} final state diverged"));
+        }
+    }
+    println!(
+        "sequential: 10,000-command fixture + 100 generated seeds deterministic; local invariants passed"
+    );
+    Ok(())
+}
+
+fn run_concurrency_model() -> Result<(), String> {
+    for run in 0..30u64 {
+        let shared = Arc::new(Mutex::new(Authority::one_warehouse()));
+        let commands = Arc::new(fixture(50_000 + run, 400));
+        let mut workers = Vec::new();
+        for _ in 0..4 {
+            let shared = Arc::clone(&shared);
+            let commands = Arc::clone(&commands);
+            workers.push(thread::spawn(move || {
+                for command in commands.iter() {
+                    shared
+                        .lock()
+                        .expect("authority mutex poisoned")
+                        .execute(command);
+                }
+            }));
+        }
+        for worker in workers {
+            worker.join().map_err(|_| "worker panicked".to_string())?;
+        }
+        let state = shared
+            .lock()
+            .map_err(|_| "authority mutex poisoned".to_string())?;
+        state.check_invariants()?;
+    }
+    println!(
+        "concurrency-model: 4 threads x 30 runs passed local mutex/invariant checks (not PostgreSQL or six-process evidence)"
+    );
+    Ok(())
+}
+
+fn verify_boundary() -> Result<(), String> {
+    let root = std::env::temp_dir().join(format!("bogkit-dock-boundary-{}", std::process::id()));
+    let _ = fs::remove_dir_all(&root);
+    fs::create_dir_all(&root).map_err(|error| error.to_string())?;
+
+    run_crash_case(&root, "before", 41, false)?;
+    run_crash_case(&root, "after", 42, true)?;
+
+    fs::remove_dir_all(&root).map_err(|error| error.to_string())?;
+    println!(
+        "crash-boundary: real child exits before and after mocked authoritative commit reproduced independent Fold commit gap"
+    );
+    Ok(())
+}
+
+fn run_crash_case(
+    root: &Path,
+    point: &str,
+    expected_code: i32,
+    authority_should_exist: bool,
+) -> Result<(), String> {
+    let case = root.join(point);
+    fs::create_dir_all(&case).map_err(|error| error.to_string())?;
+    let status = ProcessCommand::new(std::env::current_exe().map_err(|error| error.to_string())?)
+        .arg("--crash-child")
+        .arg(point)
+        .arg(&case)
+        .status()
+        .map_err(|error| error.to_string())?;
+    assert_exit(status, expected_code)?;
+
+    let authority_path = case.join("postgres-mock-transaction.txt");
+    if authority_path.exists() != authority_should_exist {
+        return Err(format!(
+            "{point}: unexpected authoritative state after child exit"
+        ));
+    }
+    if authority_path.exists() {
+        let body = fs::read_to_string(&authority_path).map_err(|error| error.to_string())?;
+        if !body.contains("booking=req-crash,status=held")
+            || !body.contains("audit=req-crash,outcome=hold_accepted")
+        {
+            return Err(format!(
+                "{point}: booking and audit were not atomically present"
+            ));
+        }
+    }
+
+    let mirror_path = case.join("fold-mirror");
+    let mut mirror = KeyedStream::new(&mirror_path, terminal::Table::new("decisions"));
+    let request = "req-crash".to_string();
+    if mirror.get(&request).is_some() {
+        return Err(format!("{point}: Fold unexpectedly committed before crash"));
+    }
+
+    if !authority_path.exists() {
+        atomic_authority_commit(&authority_path)?;
+    }
+    let original = MirrorDecision {
+        code: "hold_accepted".to_string(),
+        door: 0,
+    };
+    mirror.wtx(|tx| {
+        tx.upsert(&request, &original);
+    });
+    if mirror.get(&request) != Some(original) {
+        return Err(format!(
+            "{point}: retry did not repair mirror with original durable result"
+        ));
+    }
+    Ok(())
+}
+
+fn assert_exit(status: ExitStatus, expected: i32) -> Result<(), String> {
+    match status.code() {
+        Some(code) if code == expected => Ok(()),
+        other => Err(format!("child exit was {other:?}, expected {expected}")),
+    }
+}
+
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+struct MirrorDecision {
+    code: String,
+    door: u16,
+}
+
+fn crash_child(point: &str, case: &Path) -> ! {
+    if point == "before" {
+        std::process::exit(41);
+    }
+    let authority_path = case.join("postgres-mock-transaction.txt");
+    atomic_authority_commit(&authority_path).expect("mocked authoritative commit failed");
+    std::process::exit(42);
+}
+
+fn atomic_authority_commit(path: &Path) -> Result<(), String> {
+    let temporary = path.with_extension("tmp");
+    fs::write(
+        &temporary,
+        "booking=req-crash,status=held\naudit=req-crash,outcome=hold_accepted\n",
+    )
+    .map_err(|error| error.to_string())?;
+    fs::File::open(&temporary)
+        .and_then(|file| file.sync_all())
+        .map_err(|error| error.to_string())?;
+    fs::rename(&temporary, path).map_err(|error| error.to_string())
+}
+
+fn run_local_benchmark() -> Result<(), String> {
+    let commands = fixture(99, 1_000);
+    let mut state = Authority::one_warehouse();
+    let mut samples = Vec::with_capacity(100_000);
+    let started = Instant::now();
+    for _ in 0..100 {
+        for command in &commands {
+            let one = Instant::now();
+            state.execute(command);
+            samples.push(one.elapsed());
+        }
+    }
+    let elapsed = started.elapsed();
+    samples.sort_unstable();
+    let p95 = samples[samples.len() * 95 / 100];
+    let throughput = 100_000.0 / elapsed.as_secs_f64();
+    state.check_invariants()?;
+    println!(
+        "local-benchmark: 100,000 commands, {:.0} commands/s, p95 {:.6} ms (repeat-heavy in-memory model; invalid for PostgreSQL acceptance)",
+        throughput,
+        p95.as_secs_f64() * 1_000.0
+    );
+    Ok(())
+}
+
+fn run_demo() -> Result<(), String> {
+    run_sequential()?;
+    run_concurrency_model()?;
+    verify_boundary()?;
+    run_local_benchmark()?;
+
+    let mut state = Authority::one_warehouse();
+    let spec = HoldSpec {
+        tenant: 7,
+        request_id: 44,
+        arrival: 10,
+        duration: 2,
+        pallets: 8,
+        height: 1,
+        refrigerated: true,
+        priority: 2,
+        lifetime: 15,
+    };
+    let held = state.execute(&Command::Hold {
+        spec: spec.clone(),
+        now: 100,
+    });
+    let retry = state.execute(&Command::Hold {
+        spec: spec.clone(),
+        now: 110,
+    });
+    if held != retry {
+        return Err("idempotent hold retry changed the durable outcome".to_string());
+    }
+    let mismatch = state.execute(&Command::Hold {
+        spec: HoldSpec { pallets: 9, ..spec },
+        now: 110,
+    });
+    if mismatch.code != "request_id_payload_mismatch" {
+        return Err("payload mismatch was not visible".to_string());
+    }
+    let equality = state.execute(&Command::Confirm {
+        tenant: 7,
+        request_id: 44,
+        now: 115,
+    });
+    if equality.code != "expired_hold" {
+        return Err("confirm-at-expiry rule was not expiry-wins".to_string());
+    }
+    println!("edge-cases: exact retry replayed; payload mismatch visible; expiry wins at equality");
+    println!(
+        "fit: NO-FIT for production authority because Fold owns a separate fjall transaction and cannot join PostgreSQL"
+    );
+    Ok(())
+}
+
+fn main() {
+    let args: Vec<String> = std::env::args().collect();
+    if args.get(1).map(String::as_str) == Some("--crash-child") {
+        let point = args.get(2).expect("missing crash point");
+        let case = PathBuf::from(args.get(3).expect("missing case path"));
+        crash_child(point, &case);
+    }
+    if let Err(error) = run_demo() {
+        eprintln!("ERROR: {error}");
+        std::process::exit(1);
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn generated_fixtures_are_deterministic_and_safe() {
+        run_sequential().unwrap();
+    }
+
+    #[test]
+    fn exact_retry_and_payload_mismatch_are_distinct() {
+        let mut state = Authority::one_warehouse();
+        let spec = HoldSpec {
+            tenant: 1,
+            request_id: 2,
+            arrival: 4,
+            duration: 2,
+            pallets: 4,
+            height: 1,
+            refrigerated: false,
+            priority: 1,
+            lifetime: 10,
+        };
+        let original = state.execute(&Command::Hold {
+            spec: spec.clone(),
+            now: 0,
+        });
+        let retry = state.execute(&Command::Hold {
+            spec: spec.clone(),
+            now: 9,
+        });
+        assert_eq!(original, retry);
+        let mismatch = state.execute(&Command::Hold {
+            spec: HoldSpec { pallets: 5, ..spec },
+            now: 9,
+        });
+        assert_eq!(mismatch.code, "request_id_payload_mismatch");
+        assert_eq!(state.audits.len(), 1);
+    }
+
+    #[test]
+    fn expiry_wins_at_equality() {
+        let mut state = Authority::one_warehouse();
+        let spec = HoldSpec {
+            tenant: 1,
+            request_id: 3,
+            arrival: 8,
+            duration: 1,
+            pallets: 4,
+            height: 1,
+            refrigerated: false,
+            priority: 1,
+            lifetime: 15,
+        };
+        assert!(state.execute(&Command::Hold { spec, now: 10 }).accepted);
+        assert_eq!(
+            state
+                .execute(&Command::Confirm {
+                    tenant: 1,
+                    request_id: 3,
+                    now: 25
+                })
+                .code,
+            "expired_hold"
+        );
+    }
+
+    #[test]
+    fn reschedule_version_and_command_identity_are_checked() {
+        let mut state = Authority::one_warehouse();
+        let spec = HoldSpec {
+            tenant: 1,
+            request_id: 4,
+            arrival: 8,
+            duration: 1,
+            pallets: 4,
+            height: 1,
+            refrigerated: false,
+            priority: 1,
+            lifetime: 15,
+        };
+        assert!(state.execute(&Command::Hold { spec, now: 10 }).accepted);
+        let changed = state.execute(&Command::Reschedule {
+            tenant: 1,
+            request_id: 4,
+            expected_version: 0,
+            arrival: 20,
+            duration: 2,
+            now: 11,
+        });
+        assert_eq!(changed.code, "booking_rescheduled");
+        let reused_operation = state.execute(&Command::Reschedule {
+            tenant: 1,
+            request_id: 4,
+            expected_version: 0,
+            arrival: 21,
+            duration: 2,
+            now: 12,
+        });
+        assert_eq!(reused_operation.code, "request_id_payload_mismatch");
+
+        let distinct_wrong_version = state.execute(&Command::Reschedule {
+            tenant: 1,
+            request_id: 4,
+            expected_version: 99,
+            arrival: 22,
+            duration: 2,
+            now: 12,
+        });
+        assert_eq!(distinct_wrong_version.code, "stale_reschedule_version");
+    }
+
+    #[test]
+    fn expired_hold_releases_capacity_without_an_explicit_sweep() {
+        let mut state = Authority::one_door(10);
+        let expired = HoldSpec {
+            tenant: 1,
+            request_id: 10,
+            arrival: 20,
+            duration: 1,
+            pallets: 10,
+            height: 1,
+            refrigerated: false,
+            priority: 1,
+            lifetime: 5,
+        };
+        assert!(
+            state
+                .execute(&Command::Hold {
+                    spec: expired,
+                    now: 10
+                })
+                .accepted
+        );
+
+        let replacement = HoldSpec {
+            tenant: 1,
+            request_id: 11,
+            arrival: 20,
+            duration: 1,
+            pallets: 10,
+            height: 1,
+            refrigerated: false,
+            priority: 1,
+            lifetime: 5,
+        };
+        assert!(
+            state
+                .execute(&Command::Hold {
+                    spec: replacement,
+                    now: 15
+                })
+                .accepted
+        );
+        assert!(matches!(state.bookings[&(1, 10)].status, Status::Expired));
+    }
+
+    #[test]
+    fn reschedule_ignores_unrelated_hold_expired_at_command_time() {
+        let mut state = Authority::one_door(10);
+        let moving = HoldSpec {
+            tenant: 1,
+            request_id: 20,
+            arrival: 10,
+            duration: 1,
+            pallets: 6,
+            height: 1,
+            refrigerated: false,
+            priority: 1,
+            lifetime: 15,
+        };
+        let blocker = HoldSpec {
+            tenant: 1,
+            request_id: 21,
+            arrival: 30,
+            duration: 1,
+            pallets: 10,
+            height: 1,
+            refrigerated: false,
+            priority: 1,
+            lifetime: 1,
+        };
+        assert!(
+            state
+                .execute(&Command::Hold {
+                    spec: moving,
+                    now: 0
+                })
+                .accepted
+        );
+        assert!(
+            state
+                .execute(&Command::Hold {
+                    spec: blocker,
+                    now: 0
+                })
+                .accepted
+        );
+
+        let changed = state.execute(&Command::Reschedule {
+            tenant: 1,
+            request_id: 20,
+            expected_version: 0,
+            arrival: 30,
+            duration: 1,
+            now: 1,
+        });
+        assert_eq!(changed.code, "booking_rescheduled");
+        assert!(matches!(state.bookings[&(1, 21)].status, Status::Expired));
+    }
+
+    #[test]
+    fn invalid_reschedule_durations_do_not_mutate_booking_or_version() {
+        for duration in [0, 9] {
+            let mut state = Authority::one_door(10);
+            let original = HoldSpec {
+                tenant: 1,
+                request_id: 30,
+                arrival: 10,
+                duration: 2,
+                pallets: 6,
+                height: 1,
+                refrigerated: false,
+                priority: 1,
+                lifetime: 15,
+            };
+            assert!(
+                state
+                    .execute(&Command::Hold {
+                        spec: original,
+                        now: 0
+                    })
+                    .accepted
+            );
+            let before = state.bookings[&(1, 30)].clone();
+
+            let rejected = state.execute(&Command::Reschedule {
+                tenant: 1,
+                request_id: 30,
+                expected_version: 0,
+                arrival: 40,
+                duration,
+                now: 1,
+            });
+            assert_eq!(rejected.code, "invalid_request");
+            assert_eq!(state.bookings[&(1, 30)], before);
+        }
+    }
+
+    #[test]
+    fn four_worker_collision_model_preserves_invariants() {
+        run_concurrency_model().unwrap();
+    }
+}
diff --git a/developer-simulation/runs/2026-08-12--dns-change-gate/BRIEF.md b/developer-simulation/runs/2026-08-12--dns-change-gate/BRIEF.md
new file mode 100644
index 0000000..82562a2
--- /dev/null
+++ b/developer-simulation/runs/2026-08-12--dns-change-gate/BRIEF.md
@@ -0,0 +1,76 @@
+# Trial 1: Authoritative DNS change-admission gate
+
+## Developer role and Rust experience
+
+You are a hosting-platform reliability engineer who maintains authoritative DNS for several internal product teams. You have seven years of production Go and shell experience. Your Rust experience is exact: four months, one completed command-line utility of about 1,800 lines, and no production Rust service ownership.
+
+## Existing system and baseline
+
+The existing system stores BIND-style master files in two directory snapshots: the currently served snapshot and a proposed snapshot produced by an internal control panel. A shell release job runs `named-checkzone` once per changed zone, then copies approved files into the existing deployment pipeline. That checker and the current deployment pipeline remain in place and authoritative.
+
+The release job catches syntax errors but does not explain the semantic effect of a change across zone cuts. Reviewers currently inspect diffs by hand. They have missed accidental removal of glue, illegal alias coexistence, large TTL reductions, and SOA serial changes that do not advance under 32-bit serial arithmetic.
+
+## Concrete pain
+
+A valid-looking change can make a delegated child unreachable or leave caches serving an unintended answer for hours. Manual review is slow for generated zones and inconsistent around escaped names, inherited owners and TTLs, includes, and records reordered by the control panel. The team needs an offline admission report that says exactly what changed and blocks only on declared, testable safety rules. It must not deploy anything.
+
+## Workload and data shape
+
+The representative corpus contains 10,000 zones, 2,000,000 resource records, and 30,000 changed records between the old and proposed snapshots. Inputs are ordinary files containing a declared subset of DNS master-file syntax:
+
+- `$ORIGIN`, `$TTL`, relative and absolute owner names, omitted owners, escaped label bytes, comments, parentheses, and decimal TTL units;
+- SOA, NS, A, AAAA, CNAME, MX, TXT, SRV, CAA, and DS records;
+- `$INCLUDE` with an optional origin and `$GENERATE` with an inclusive numeric range and one substitution token.
+
+Record identity is the canonical tuple `(zone, absolute owner, type, canonical rdata)`. TTL is compared separately. TXT chunk boundaries remain significant. Input is bytes; non-ASCII label bytes are accepted only through master-file escapes, not by guessing a text encoding.
+
+The fixture generator supplies 9,950 unchanged zones, 45 ordinary changed zones, and five adversarial zones. The reference corpus includes legal reorder-only edits, delegation additions and removals, in-bailiwick and out-of-bailiwick name servers, glue changes, alias conflicts, serial wraparound, and duplicate records.
+
+## Operational constraints
+
+- Run offline on a declared four-core Linux machine with 256 MiB of measured peak resident memory and no network access.
+- Finish the representative corpus in 20 seconds after filesystem caches are warmed once; report both warm-up and three measured runs.
+- Never read outside either snapshot root. Resolve includes relative to the including file, reject absolute paths and any normalized path that escapes its root, and detect include cycles.
+- Expand at most 2,500,000 records total, 250,000 records per zone, 32 include levels, and 100,000 records from any one `$GENERATE` directive. Exceeding a limit is a blocking diagnostic, not truncation.
+- Produce byte-identical UTF-8 JSON for the same logical inputs even if directory enumeration order or record order changes. Sort zones, owners, types, records, and diagnostics by rules stated in the prototype README.
+- Write the report to a temporary sibling and rename it only after every selected zone has been parsed and checked. On any blocking input error, exit nonzero and publish no replacement report.
+
+## Fault and adversarial cases
+
+The test corpus must include all of the following:
+
+- an include cycle, a `../` escape, an absolute include, a missing include, and a symlink inside the root that resolves outside it;
+- a `$GENERATE` range above the declared cap and nested includes whose total expansion crosses the per-zone cap;
+- an unterminated parenthesized record, an overlong escaped label, an invalid IPv4 address, an unknown mandatory field, and an SOA integer outside its allowed width;
+- a CNAME owner that also has MX data, an apex missing exactly one required SOA or NS record, and duplicate canonical records written with different whitespace;
+- removal of the only in-bailiwick glue address for a delegated name server, removal of glue that is still covered by a second address family, and an out-of-bailiwick name server that correctly requires no parent glue;
+- SOA serial advance, equality, regression, and RFC 1982 half-range ambiguity, including `4294967295` to `0`;
+- simulated process termination after temporary-report creation and after the final flush but before rename. Rerunning must yield either the previous complete report or the new complete report, never a partial JSON document.
+
+## Measurable acceptance criteria
+
+Each criterion is checked by a standalone harness command and fixture directory, without inspecting implementation internals:
+
+1. **Parser agreement:** For every accepted fixture in the declared syntax subset, canonical record tuples match a checked-in oracle manifest exactly. All malformed fixtures exit nonzero and name the file, byte offset, and stable diagnostic code.
+2. **Order invariance:** Twenty seeded permutations of directory entries and record order produce the same SHA-256 digest of the final report.
+3. **Change accuracy:** Against an oracle containing 1,000 labeled changes, the report has zero false additions, removals, or TTL changes. Reorder-only and exact duplicate inputs produce no semantic change.
+4. **Delegation rules:** All 60 labeled delegation fixtures receive the expected `allow`, `review`, or `block` verdict and the report cites the exact owner names and record types involved. The harness includes both valid and invalid glue cases.
+5. **SOA arithmetic:** All 40 boundary fixtures, including wrap and half-range ambiguity, match the checked-in verdict table. Ambiguity must be `review`; equality or regression must be `block`.
+6. **Containment and exhaustion safety:** Every include-escape, cycle, malformed-record, and expansion-bomb fixture terminates within two seconds, publishes no replacement report, and leaves a sentinel file outside the roots unread and unchanged. The harness checks the sentinel access time where supported and uses an unreadable sentinel as a second check.
+7. **Crash publication:** At every injected publication fault point, the output path contains either the complete old digest or the complete new digest. A subsequent fault-free run produces the new digest.
+8. **Resource target:** Three measured warm-cache runs over the representative corpus each finish within 20 seconds and stay at or below 256 MiB peak resident memory; the harness records wall time, peak memory, input digest, and machine description.
+9. **Baseline coexistence:** The prototype runs `named-checkzone` results supplied as fixtures and never converts a baseline failure into an allow verdict. A disagreement is surfaced as `block` with both diagnostic codes.
+
+## Explicit non-goals
+
+- No live DNS queries, recursive resolution, dynamic updates, DNSSEC signing, key management, or deployment.
+- No attempt to parse every vendor extension or every resource-record type. Unsupported syntax blocks with a stable diagnostic.
+- No automated repair, serial bump, glue synthesis, or file rewrite.
+- No service, database, web interface, repository integration, or approval workflow.
+- No claim that the prototype replaces the existing syntax checker or proves Internet-wide reachability.
+
+## Smallest self-contained prototype boundary
+
+Build one offline CLI, one fixture generator, and one black-box verification harness. The CLI accepts `--old-root`, `--new-root`, `--policy`, and `--output`; it expands only the declared syntax subset, canonicalizes both snapshots, compares selected zones, applies the stated safety rules, and atomically emits one JSON report. The policy file supplies only numerical caps, permitted TTL-decrease percentage, and the set of zones to compare.
+
+Do not connect it to the release job. Evaluate any new library or runtime dependency against the parser agreement, deterministic-output, containment, crash-publication, memory, and timing gates above. Reject the dependency and retain the shell-plus-existing-checker baseline if it cannot meet every safety gate, requires network or resident services, weakens unsupported-input handling, or adds more operational work than the advisory report removes. A documented rejection is a valid trial result.
diff --git a/developer-simulation/runs/2026-08-12--dns-change-gate/Cargo.toml b/developer-simulation/runs/2026-08-12--dns-change-gate/Cargo.toml
new file mode 100644
index 0000000..629774a
--- /dev/null
+++ b/developer-simulation/runs/2026-08-12--dns-change-gate/Cargo.toml
@@ -0,0 +1,5 @@
+[package]
+name = "dns-change-gate"
+version = "0.1.0"
+edition = "2024"
+publish = false
diff --git a/developer-simulation/runs/2026-08-12--dns-change-gate/DISCOVERY.md b/developer-simulation/runs/2026-08-12--dns-change-gate/DISCOVERY.md
new file mode 100644
index 0000000..2ecd0f3
--- /dev/null
+++ b/developer-simulation/runs/2026-08-12--dns-change-gate/DISCOVERY.md
@@ -0,0 +1,34 @@
+# Blind discovery: authoritative DNS change-admission gate
+
+## Ordered trail before component-source inspection
+
+1. Read the assigned `BRIEF.md` completely.
+2. Read the public root `README.md`.
+3. Read the four public examples (`starter`, `timeseries`, `chat`, and `search`), including each example manifest and main program.
+4. Wrote this note before opening any Fold, ESE, or ANNy source or internal documentation.
+
+## Initial understanding
+
+The requested artifact is an offline, advisory admission gate between two directory snapshots of BIND-style zone files. It must parse a deliberately bounded master-file subset, produce stable canonical record identities, compare only policy-selected zones, apply explicit delegation/glue, alias, TTL, apex, SOA-serial, and supplied-baseline rules, and atomically replace a JSON report only after all selected inputs succeed. It must never deploy or query DNS.
+
+The hard requirements are mostly parser, filesystem-containment, resource-accounting, deterministic serialization, and publication-boundary work. Correct refusal is as important as correct acceptance: unsupported or malformed input, containment violations, cycles, and expansion limit violations must block without replacing an earlier report.
+
+## Existing baseline
+
+The existing release job runs `named-checkzone` per changed zone and reviewers manually inspect semantic diffs. That checker remains authoritative for syntax and the current deployment pipeline remains unchanged. This prototype therefore must consume supplied checker results, preserve every checker failure as a block, and provide narrowly declared semantic evidence. It is not a replacement parser claim and cannot establish Internet reachability.
+
+The comparison oracle must be separate from the implementation: checked-in literal manifests and verdict tables, plus black-box fixtures, rather than expectations generated by the gate itself.
+
+## Component-use hypothesis
+
+- **Fold:** plausible only if its transactional materialized views materially simplify comparing a continuing stream of zone mutations. The public examples show durable insertion/retraction pipelines and consistent snapshots. The brief, however, defines a bounded one-shot comparison whose publication must occur only after complete parsing. A plain in-memory sorted representation is likely smaller, easier to bound, and easier to make byte-deterministic. I will inspect the minimum public API/documentation needed to test whether Fold offers a clear safety or implementation advantage; otherwise I will reject it for this prototype.
+- **ESE:** no sane initial fit. Static text embeddings cannot prove DNS record identity, path containment, RFC 1982 arithmetic, or policy verdicts. Approximate semantic similarity would weaken exactness.
+- **ANNy:** no sane initial fit. Approximate nearest-neighbor search does not serve exact canonical comparison or deterministic safety rules and adds an irrelevant index/runtime surface.
+
+## Smallest meaningful prototype hypothesis
+
+Build a standalone Rust CLI and black-box harness in the assigned trial output directory, using only the standard library if feasible. The prototype should prioritize a well-tested vertical slice: safe snapshot traversal and include handling, bounded parsing of the declared record forms, stable canonicalization and JSON, exact change/TTL detection, representative delegation/glue and SOA verdicts, baseline coexistence, and atomic publication with fault injection. Where the full declared grammar or 10,000-zone corpus cannot be completed within the trial, the report must identify the exact unsupported boundary and block safely rather than silently accept it.
+
+## Post-review scope correction
+
+The original phrase “safe snapshot traversal” was too broad. The standard-library prototype canonicalizes and checks a path, then opens that path by name. That protects ordinary immutable fixtures against lexical escape and pre-existing symlink escape, but it is a check-then-open sequence and is not race-safe if another process mutates the snapshot concurrently. The honest prototype contract is therefore **immutable, non-racing input snapshot trees for the complete run**. Concurrent input mutation is unsupported and the original race-safe “never read outside either root” requirement remains unproven. No result from this prototype should be used when snapshot immutability cannot be guaranteed; a prospective integration must fail closed by declining to run it in that condition.
diff --git a/developer-simulation/runs/2026-08-12--dns-change-gate/README.md b/developer-simulation/runs/2026-08-12--dns-change-gate/README.md
new file mode 100644
index 0000000..c5a3d50
--- /dev/null
+++ b/developer-simulation/runs/2026-08-12--dns-change-gate/README.md
@@ -0,0 +1,104 @@
+# DNS change gate trial prototype
+
+This is an offline, advisory comparison tool for a declared subset of BIND master-file syntax. It parses selected zones from an old and proposed snapshot, compares canonical records and TTLs, applies explicit safety rules, and atomically publishes deterministic JSON. It neither queries DNS nor deploys files. Supplied `named-checkzone` results remain authoritative and any supplied failure blocks.
+
+The input contract is narrower than the production brief: both snapshot directory trees and the policy file must be immutable and non-racing for the complete run. The standard-library implementation checks canonical paths and then opens them by pathname; it has no descriptor-relative, non-following open primitive and does not prove containment under concurrent filesystem mutation. If immutability cannot be guaranteed, do not run or trust this prototype; a caller or future integration must fail closed by declining the operation. Concurrent mutation is unsupported, its behavior is unverified, and the original race-safe “never read outside a root” requirement is not met.
+
+This prototype intentionally uses no BogKit component. Fold's durable incremental database is a poor fit for a bounded one-shot parse/compare operation and adds dependencies and state without addressing path containment or DNS semantics. ESE embeddings and ANNy approximate search are incompatible with exact record identity and fail-closed policy decisions.
+
+## Run the demonstration
+
+From the BogKit repository root:
+
+```sh
+mkdir -p /tmp/dns-change-gate-demo
+cargo run --manifest-path developer-simulation/Cargo.toml --locked --offline --release -p dns-change-gate --bin dns-change-gate -- \
+  --old-root developer-simulation/runs/2026-08-12--dns-change-gate/fixtures/demo/old \
+  --new-root developer-simulation/runs/2026-08-12--dns-change-gate/fixtures/demo/new \
+  --policy developer-simulation/runs/2026-08-12--dns-change-gate/fixtures/demo/policy.conf \
+  --output /tmp/dns-change-gate-demo/report.json
+```
+
+An allow or review report exits 0. A semantic or supplied-baseline block is still a successfully published report and exits 2. Input, containment, limit, policy, alias, and pre-rename publication errors exit 1 without replacing the output path. If the final parent-directory sync fails after a successful rename, the command exits 1 but the output path may already contain the complete new report; it never contains a partial document.
+
+The complete archive verification commands are:
+
+```sh
+cargo fmt --manifest-path developer-simulation/Cargo.toml -p dns-change-gate -- --check
+cargo test --manifest-path developer-simulation/Cargo.toml --locked --offline --release -p dns-change-gate --all-targets
+cargo clippy --manifest-path developer-simulation/Cargo.toml --locked --offline --release -p dns-change-gate --all-targets -- -D warnings -D clippy::all -D clippy::pedantic
+mkdir -p /tmp/dns-change-gate-demo
+cargo run --manifest-path developer-simulation/Cargo.toml --locked --offline --release -p dns-change-gate --bin dns-change-gate -- \
+  --old-root developer-simulation/runs/2026-08-12--dns-change-gate/fixtures/demo/old \
+  --new-root developer-simulation/runs/2026-08-12--dns-change-gate/fixtures/demo/new \
+  --policy developer-simulation/runs/2026-08-12--dns-change-gate/fixtures/demo/policy.conf \
+  --output /tmp/dns-change-gate-demo/report.json
+cmp /tmp/dns-change-gate-demo/report.json \
+  developer-simulation/runs/2026-08-12--dns-change-gate/fixtures/demo/oracle-report.json
+```
+
+It checks formatting, runs all black-box tests, denies compiler warnings plus `clippy::all` and `clippy::pedantic`, builds release binaries, runs the demo, and compares its bytes with a separate checked-in oracle.
+
+## Generate a corpus
+
+The dependency-free fixture generator refuses to overwrite an existing root:
+
+```sh
+cargo run --manifest-path developer-simulation/Cargo.toml --locked --offline --release -p dns-change-gate --bin fixture-generator -- \
+  --root /tmp/dns-change-gate-corpus \
+  --zones 1000 \
+  --records-per-zone 200 \
+  --changed-zones 50
+```
+
+It creates `old/`, `new/`, and `policy.conf`. The generated policy lists every zone and supplies `PASS` as the old and new syntax-checker result. The first requested zones change their SOA serial and every generated A record; the rest are byte-identical. Adversarial behavior lives in the black-box test fixtures rather than this performance corpus.
+
+## Policy format
+
+The policy is UTF-8 line-oriented `key=value` data. Required numerical fields are `max_records_total`, `max_records_per_zone`, `max_include_depth`, `max_generate_records`, and `ttl_decrease_percent`. Total and per-zone record limits apply independently to each snapshot. Every selected zone is:
+
+```text
+zone=absolute-zone.|relative-master-file|old-named-checkzone-code|new-named-checkzone-code
+```
+
+Only the literal baseline code `PASS` is successful. This deliberately simple representation makes the baseline handoff explicit; it does not invoke `named-checkzone`.
+
+## Declared parser and policy boundary
+
+Accepted syntax covers `$ORIGIN`, `$TTL`, relative and absolute owners, omitted owners, three-digit decimal and ordinary one-byte escapes, comments, parentheses, decimal TTL units, `$INCLUDE` with optional origin, one simple `$` substitution in an inclusive `$GENERATE` numeric range, and SOA/NS/A/AAAA/CNAME/MX/TXT/SRV/CAA/DS records. TXT chunk boundaries remain distinct. Raw bytes above ASCII are rejected; escaped bytes are rendered canonically.
+
+For immutable inputs, includes are relative to the including file. Absolute paths, lexical escapes, pre-existing resolved symlink escapes, missing files, cycles, and excessive nesting block. These checks do not close a path-replacement race between canonicalization and open. Expansion limits block before publication and never truncate. `$GENERATE` cardinality is calculated with checked wide arithmetic and compared with its cap before iteration, including maximum-`u32` endpoints.
+
+The semantic policy checks:
+
+- exactly one apex SOA and at least one apex NS;
+- CNAME coexistence;
+- TTL decreases beyond the policy percentage;
+- RFC 1982 serial advance, equality, regression, wraparound, and half-range ambiguity;
+- delegation additions/removals;
+- loss of the last A/AAAA glue family for an in-bailiwick delegated server;
+- retained second-family glue and out-of-bailiwick servers that require no parent glue;
+- supplied baseline failures.
+
+Delegation changes are review findings. Missing last glue, apex failure, alias conflict, disallowed TTL decrease, serial equality/regression, and baseline failure block. Half-range serial arithmetic is review. No repair is attempted.
+
+## Deterministic output rules
+
+Names and DNS types are ASCII-lowercased/uppercased as appropriate; IPv4 and IPv6 addresses, TTLs, integers, and name-bearing RDATA are canonicalized. Exact duplicate canonical records with the same TTL collapse. Conflicting TTLs on an otherwise duplicate tuple block as malformed.
+
+Zones sort by absolute zone name. Changes sort by owner, type, canonical RDATA, then change kind. Findings sort by owner, stable code, cited record-type list, then detail. Record-type lists are sorted sets. JSON keys have fixed writer order, strings use a fixed escape routine, and there are no timestamps or host-dependent values. The output ends with one newline.
+
+The output parent must already exist outside both snapshot roots. An output path that is identical to, resolves to, or on Unix has the same file identity as the policy or any parsed master/include file is rejected before any report write.
+
+The report is written to a collision-resistant temporary sibling opened exclusively with `create_new`. Existing entries are never followed, opened, truncated, or removed; bounded collisions select a new name. Normal write/flush/rename failures remove only the temporary entry created by that run. The file is flushed and synced, renamed only after all selected zones parse and check, and the parent directory is synced. `DNS_GATE_FAULT=after-temp`, `DNS_GATE_FAULT=after-flush`, and `DNS_GATE_TEMP_NONCE` are test-only injection controls; forced process termination may leave an unreferenced owned temporary entry, which the test case's disposable directory removes.
+
+## Serious prototype limits
+
+- The parser is deliberately not a complete BIND parser and has not been compared against `named-checkzone`; unsupported syntax blocks.
+- `$GENERATE` modifiers and multiple substitutions are unsupported.
+- The generator's large valid corpus is synthetic and its adversarial cases are exercised separately, not mixed into the scale run.
+- The prototype's black-box oracles cover representative boundary classes, not the requested exhaustive 1,000-change, 60-delegation, and 40-SOA fixture tables.
+- Resource measurements in the trial report were taken on macOS with 14 hardware cores and 64 GiB available, not the declared four-core Linux host. The measured process stayed far below 256 MiB, but this is not proof of the Linux target.
+- Path containment is proven only for immutable, non-racing snapshots. Concurrent path replacement is unsupported and unverified because the implementation uses canonicalize-then-open-by-name.
+- Crash tests cover the two declared application fault points. They do not prove durability under kernel, filesystem, or power loss.
+- Hard-link identity rejection is implemented and tested on Unix. Other platforms retain canonical-path/symlink alias rejection but do not claim hard-link identity detection.
diff --git a/developer-simulation/runs/2026-08-12--dns-change-gate/fixtures/demo/new/example.zone b/developer-simulation/runs/2026-08-12--dns-change-gate/fixtures/demo/new/example.zone
new file mode 100644
index 0000000..b3899dd
--- /dev/null
+++ b/developer-simulation/runs/2026-08-12--dns-change-gate/fixtures/demo/new/example.zone
@@ -0,0 +1,8 @@
+$TTL 3600
+$ORIGIN example.test.
+@ IN SOA ns1.example.test. hostmaster.example.test. ( 0 3600 900 604800 300 )
+@ NS ns1
+ns1 A 192.0.2.1
+www 5m A 192.0.2.11
+child NS ns.child
+ns.child A 192.0.2.53
diff --git a/developer-simulation/runs/2026-08-12--dns-change-gate/fixtures/demo/old/example.zone b/developer-simulation/runs/2026-08-12--dns-change-gate/fixtures/demo/old/example.zone
new file mode 100644
index 0000000..f12bf50
--- /dev/null
+++ b/developer-simulation/runs/2026-08-12--dns-change-gate/fixtures/demo/old/example.zone
@@ -0,0 +1,8 @@
+$ORIGIN example.test.
+$TTL 1h
+@ IN SOA ns1 hostmaster ( 4294967295 1h 15m 1w 5m )
+@ IN NS ns1
+ns1 IN A 192.0.2.1
+www 300 IN A 192.0.2.10
+child IN NS ns.child
+ns.child IN A 192.0.2.53
diff --git a/developer-simulation/runs/2026-08-12--dns-change-gate/fixtures/demo/oracle-report.json b/developer-simulation/runs/2026-08-12--dns-change-gate/fixtures/demo/oracle-report.json
new file mode 100644
index 0000000..f3a7647
--- /dev/null
+++ b/developer-simulation/runs/2026-08-12--dns-change-gate/fixtures/demo/oracle-report.json
@@ -0,0 +1 @@
+{"schema_version":1,"overall_verdict":"allow","zones":[{"zone":"example.test.","verdict":"allow","baseline":{"old":"PASS","new":"PASS"},"changes":[{"kind":"addition","owner":"example.test.","type":"SOA","rdata":"ns1.example.test. hostmaster.example.test. 0 3600 900 604800 300","old_ttl":null,"new_ttl":3600},{"kind":"removal","owner":"example.test.","type":"SOA","rdata":"ns1.example.test. hostmaster.example.test. 4294967295 3600 900 604800 300","old_ttl":3600,"new_ttl":null},{"kind":"removal","owner":"www.example.test.","type":"A","rdata":"192.0.2.10","old_ttl":300,"new_ttl":null},{"kind":"addition","owner":"www.example.test.","type":"A","rdata":"192.0.2.11","old_ttl":null,"new_ttl":300}],"findings":[{"code":"SOA_ADVANCE","verdict":"allow","owner":"example.test.","record_types":["SOA"],"detail":"SOA serial advanced from 4294967295 to 0"}]}]}
diff --git a/developer-simulation/runs/2026-08-12--dns-change-gate/fixtures/demo/policy.conf b/developer-simulation/runs/2026-08-12--dns-change-gate/fixtures/demo/policy.conf
new file mode 100644
index 0000000..1261909
--- /dev/null
+++ b/developer-simulation/runs/2026-08-12--dns-change-gate/fixtures/demo/policy.conf
@@ -0,0 +1,6 @@
+max_records_total=2500000
+max_records_per_zone=250000
+max_include_depth=32
+max_generate_records=100000
+ttl_decrease_percent=50
+zone=example.test.|example.zone|PASS|PASS
diff --git a/developer-simulation/runs/2026-08-12--dns-change-gate/src/bin/fixture-generator.rs b/developer-simulation/runs/2026-08-12--dns-change-gate/src/bin/fixture-generator.rs
new file mode 100644
index 0000000..542ed14
--- /dev/null
+++ b/developer-simulation/runs/2026-08-12--dns-change-gate/src/bin/fixture-generator.rs
@@ -0,0 +1,166 @@
+#![forbid(unsafe_code)]
+
+use std::collections::BTreeMap;
+use std::env;
+use std::ffi::OsString;
+use std::fmt::Write as _;
+use std::fs;
+use std::io::{self, Write as _};
+use std::path::{Path, PathBuf};
+
+fn main() {
+    if let Err(error) = run() {
+        eprintln!("fixture-generator: {error}");
+        std::process::exit(1);
+    }
+}
+
+fn run() -> Result<(), String> {
+    let arguments = parse_args(env::args_os().skip(1))?;
+    let root = value(&arguments, "--root").map(PathBuf::from)?;
+    let zones = number(&arguments, "--zones")?;
+    let records_per_zone = number(&arguments, "--records-per-zone")?;
+    let changed_zones = number(&arguments, "--changed-zones")?;
+    if zones == 0 || zones > 10_000 {
+        return Err("--zones must be in 1..=10000".to_string());
+    }
+    if !(3..=250_000).contains(&records_per_zone) {
+        return Err("--records-per-zone must be in 3..=250000".to_string());
+    }
+    if changed_zones > zones {
+        return Err("--changed-zones cannot exceed --zones".to_string());
+    }
+    if root.exists() {
+        return Err(format!(
+            "refusing to overwrite existing root {}",
+            root.display()
+        ));
+    }
+    let old_root = root.join("old");
+    let new_root = root.join("new");
+    fs::create_dir_all(&old_root).map_err(|error| error.to_string())?;
+    fs::create_dir_all(&new_root).map_err(|error| error.to_string())?;
+
+    let policy_path = root.join("policy.conf");
+    let policy_file = fs::File::create(&policy_path).map_err(|error| error.to_string())?;
+    let mut policy = io::BufWriter::new(policy_file);
+    let total_limit = zones
+        .checked_mul(records_per_zone)
+        .ok_or_else(|| "record total overflow".to_string())?;
+    writeln!(policy, "max_records_total={total_limit}").map_err(|error| error.to_string())?;
+    writeln!(policy, "max_records_per_zone={records_per_zone}")
+        .map_err(|error| error.to_string())?;
+    writeln!(policy, "max_include_depth=32").map_err(|error| error.to_string())?;
+    writeln!(policy, "max_generate_records=100000").map_err(|error| error.to_string())?;
+    writeln!(policy, "ttl_decrease_percent=50").map_err(|error| error.to_string())?;
+
+    for zone_index in 0..zones {
+        let zone = format!("zone{zone_index:05}.example.");
+        let file_name = format!("zone{zone_index:05}.zone");
+        writeln!(policy, "zone={zone}|{file_name}|PASS|PASS").map_err(|error| error.to_string())?;
+        write_zone(
+            &old_root.join(&file_name),
+            &zone,
+            1,
+            records_per_zone,
+            zone_index,
+            false,
+        )?;
+        write_zone(
+            &new_root.join(&file_name),
+            &zone,
+            if zone_index < changed_zones { 2 } else { 1 },
+            records_per_zone,
+            zone_index,
+            zone_index < changed_zones,
+        )?;
+    }
+    policy.flush().map_err(|error| error.to_string())?;
+    println!(
+        "zones={zones} records_per_snapshot={} changed_zones={changed_zones} root={}",
+        zones * records_per_zone,
+        root.display()
+    );
+    Ok(())
+}
+
+fn parse_args(
+    values: impl Iterator<Item = OsString>,
+) -> Result<BTreeMap<String, OsString>, String> {
+    let mut values = values;
+    let mut arguments = BTreeMap::new();
+    while let Some(flag) = values.next() {
+        let flag = flag
+            .into_string()
+            .map_err(|_| "argument flag is not UTF-8".to_string())?;
+        if !matches!(
+            flag.as_str(),
+            "--root" | "--zones" | "--records-per-zone" | "--changed-zones"
+        ) {
+            return Err(format!("unknown argument {flag}"));
+        }
+        let argument = values
+            .next()
+            .ok_or_else(|| format!("missing value for {flag}"))?;
+        if arguments.insert(flag.clone(), argument).is_some() {
+            return Err(format!("duplicate argument {flag}"));
+        }
+    }
+    Ok(arguments)
+}
+
+fn value<'a>(
+    arguments: &'a BTreeMap<String, OsString>,
+    name: &str,
+) -> Result<&'a OsString, String> {
+    arguments.get(name).ok_or_else(|| format!("missing {name}"))
+}
+
+fn number(arguments: &BTreeMap<String, OsString>, name: &str) -> Result<usize, String> {
+    value(arguments, name)?
+        .to_str()
+        .ok_or_else(|| format!("{name} is not UTF-8"))?
+        .parse::<usize>()
+        .map_err(|_| format!("{name} is not an unsigned integer"))
+}
+
+fn write_zone(
+    path: &Path,
+    zone: &str,
+    serial: u32,
+    records: usize,
+    zone_index: usize,
+    changed: bool,
+) -> Result<(), String> {
+    let file = fs::File::create(path).map_err(|error| error.to_string())?;
+    let mut output = io::BufWriter::new(file);
+    writeln!(output, "$ORIGIN {zone}").map_err(|error| error.to_string())?;
+    writeln!(output, "$TTL 3600").map_err(|error| error.to_string())?;
+    writeln!(output, "@ SOA ns hostmaster {serial} 3600 900 604800 300")
+        .map_err(|error| error.to_string())?;
+    writeln!(output, "@ NS ns").map_err(|error| error.to_string())?;
+    writeln!(output, "ns A 192.0.2.1").map_err(|error| error.to_string())?;
+    for record_index in 0..records - 3 {
+        let address = if changed {
+            format!(
+                "198.{}.{}.{}",
+                18 + zone_index % 2,
+                (record_index / 250) % 250,
+                record_index % 250 + 1
+            )
+        } else {
+            let mut address = String::new();
+            write!(
+                address,
+                "10.{}.{}.{}",
+                zone_index % 250,
+                (record_index / 250) % 250,
+                record_index % 250 + 1
+            )
+            .expect("write to string");
+            address
+        };
+        writeln!(output, "host{record_index:06} A {address}").map_err(|error| error.to_string())?;
+    }
+    output.flush().map_err(|error| error.to_string())
+}
diff --git a/developer-simulation/runs/2026-08-12--dns-change-gate/src/lib.rs b/developer-simulation/runs/2026-08-12--dns-change-gate/src/lib.rs
new file mode 100644
index 0000000..5dd7e8f
--- /dev/null
+++ b/developer-simulation/runs/2026-08-12--dns-change-gate/src/lib.rs
@@ -0,0 +1,546 @@
+#![forbid(unsafe_code)]
+
+mod parser;
+mod report;
+
+use std::collections::BTreeMap;
+use std::env;
+use std::fmt::{self, Display, Formatter};
+use std::fs;
+use std::hash::BuildHasher;
+use std::path::{Path, PathBuf};
+use std::sync::atomic::{AtomicU64, Ordering};
+use std::time::{SystemTime, UNIX_EPOCH};
+
+pub use parser::{RecordKey, ZoneData, parse_zone};
+use report::{Report, compare_zone};
+
+static TEMP_COUNTER: AtomicU64 = AtomicU64::new(0);
+const TEMP_CREATE_ATTEMPTS: u32 = 128;
+
+#[derive(Debug)]
+pub struct GateError {
+    pub code: &'static str,
+    pub path: PathBuf,
+    pub offset: u64,
+    pub detail: String,
+}
+
+impl GateError {
+    #[must_use]
+    pub fn new(
+        code: &'static str,
+        path: impl Into<PathBuf>,
+        offset: u64,
+        detail: impl Into<String>,
+    ) -> Self {
+        Self {
+            code,
+            path: path.into(),
+            offset,
+            detail: detail.into(),
+        }
+    }
+}
+
+impl Display for GateError {
+    fn fmt(&self, f: &mut Formatter<'_>) -> fmt::Result {
+        write!(
+            f,
+            "{} {}:{} {}",
+            self.code,
+            self.path.display(),
+            self.offset,
+            self.detail
+        )
+    }
+}
+
+impl std::error::Error for GateError {}
+
+#[derive(Debug, Clone)]
+pub struct Limits {
+    pub max_records_total: usize,
+    pub max_records_per_zone: usize,
+    pub max_include_depth: usize,
+    pub max_generate_records: usize,
+    pub ttl_decrease_percent: u32,
+}
+
+#[derive(Debug, Clone)]
+pub struct ZonePolicy {
+    pub zone: String,
+    pub relative_path: PathBuf,
+    pub old_baseline: String,
+    pub new_baseline: String,
+}
+
+#[derive(Debug)]
+pub struct Policy {
+    pub limits: Limits,
+    pub zones: Vec<ZonePolicy>,
+}
+
+#[derive(Debug)]
+struct Args {
+    old_root: PathBuf,
+    new_root: PathBuf,
+    policy: PathBuf,
+    output: PathBuf,
+}
+
+/// Runs the command and returns its intended process status.
+///
+/// # Errors
+/// Returns a stable diagnostic for command, policy, input, or publication errors.
+pub fn run_from_env() -> Result<i32, GateError> {
+    let args = parse_args(env::args_os().skip(1))?;
+    execute(&args)
+}
+
+fn parse_args(values: impl Iterator<Item = std::ffi::OsString>) -> Result<Args, GateError> {
+    let mut values = values;
+    let mut found: BTreeMap<String, PathBuf> = BTreeMap::new();
+    while let Some(flag) = values.next() {
+        let flag = flag
+            .into_string()
+            .map_err(|_| GateError::new("E_ARGS", "<argv>", 0, "argument is not UTF-8"))?;
+        let Some(value) = values.next() else {
+            return Err(GateError::new(
+                "E_ARGS",
+                "<argv>",
+                0,
+                format!("missing value for {flag}"),
+            ));
+        };
+        if !matches!(
+            flag.as_str(),
+            "--old-root" | "--new-root" | "--policy" | "--output"
+        ) {
+            return Err(GateError::new(
+                "E_ARGS",
+                "<argv>",
+                0,
+                format!("unknown argument {flag}"),
+            ));
+        }
+        if found.insert(flag.clone(), PathBuf::from(value)).is_some() {
+            return Err(GateError::new(
+                "E_ARGS",
+                "<argv>",
+                0,
+                format!("duplicate argument {flag}"),
+            ));
+        }
+    }
+    let take = |key: &str| {
+        found
+            .get(key)
+            .cloned()
+            .ok_or_else(|| GateError::new("E_ARGS", "<argv>", 0, format!("missing {key}")))
+    };
+    Ok(Args {
+        old_root: take("--old-root")?,
+        new_root: take("--new-root")?,
+        policy: take("--policy")?,
+        output: take("--output")?,
+    })
+}
+
+fn execute(args: &Args) -> Result<i32, GateError> {
+    let policy = parse_policy(&args.policy)?;
+    let old_root = canonical_root(&args.old_root)?;
+    let new_root = canonical_root(&args.new_root)?;
+    validate_output_path(&args.output, &old_root, &new_root, &args.policy)?;
+    let mut old_total_records = 0_usize;
+    let mut new_total_records = 0_usize;
+    let mut zones = Vec::with_capacity(policy.zones.len());
+    let mut input_paths = Vec::new();
+
+    for selected in &policy.zones {
+        let old = parse_zone(&old_root, selected, &policy.limits, &mut old_total_records)?;
+        let new = parse_zone(&new_root, selected, &policy.limits, &mut new_total_records)?;
+        input_paths.extend(old.input_paths.iter().cloned());
+        input_paths.extend(new.input_paths.iter().cloned());
+        zones.push(compare_zone(selected, &old, &new, &policy.limits));
+    }
+
+    validate_output_identities(&args.output, &args.policy, &input_paths)?;
+    let report = Report::new(zones);
+    let body = report.to_json();
+    atomic_publish(&args.output, body.as_bytes())?;
+    Ok(if report.is_blocked() { 2 } else { 0 })
+}
+
+fn canonical_root(path: &Path) -> Result<PathBuf, GateError> {
+    let canonical = fs::canonicalize(path).map_err(|error| {
+        GateError::new(
+            "E_ROOT",
+            path,
+            0,
+            format!("cannot open snapshot root: {error}"),
+        )
+    })?;
+    if !canonical.is_dir() {
+        return Err(GateError::new(
+            "E_ROOT",
+            path,
+            0,
+            "snapshot root is not a directory",
+        ));
+    }
+    Ok(canonical)
+}
+
+#[expect(
+    clippy::too_many_lines,
+    reason = "policy parsing is a linear validation pass and keeping its rules together aids audit"
+)]
+fn parse_policy(path: &Path) -> Result<Policy, GateError> {
+    let text = fs::read_to_string(path).map_err(|error| {
+        GateError::new("E_POLICY", path, 0, format!("cannot read policy: {error}"))
+    })?;
+    let mut values = BTreeMap::<String, String>::new();
+    let mut zones = Vec::new();
+    for (line_index, raw) in text.lines().enumerate() {
+        let line = raw.trim();
+        if line.is_empty() || line.starts_with('#') {
+            continue;
+        }
+        let Some((key, value)) = line.split_once('=') else {
+            return Err(GateError::new(
+                "E_POLICY",
+                path,
+                line_index as u64,
+                "expected key=value",
+            ));
+        };
+        if key == "zone" {
+            let fields: Vec<&str> = value.split('|').collect();
+            if fields.len() != 4 || fields.iter().any(|field| field.is_empty()) {
+                return Err(GateError::new(
+                    "E_POLICY",
+                    path,
+                    line_index as u64,
+                    "zone requires absolute-zone|relative-file|old-baseline|new-baseline",
+                ));
+            }
+            if !fields[0].ends_with('.') {
+                return Err(GateError::new(
+                    "E_POLICY",
+                    path,
+                    line_index as u64,
+                    "zone must be absolute",
+                ));
+            }
+            zones.push(ZonePolicy {
+                zone: fields[0].to_ascii_lowercase(),
+                relative_path: PathBuf::from(fields[1]),
+                old_baseline: fields[2].to_string(),
+                new_baseline: fields[3].to_string(),
+            });
+        } else if values.insert(key.to_string(), value.to_string()).is_some() {
+            return Err(GateError::new(
+                "E_POLICY",
+                path,
+                line_index as u64,
+                format!("duplicate key {key}"),
+            ));
+        }
+    }
+    zones.sort_by(|left, right| left.zone.cmp(&right.zone));
+    for pair in zones.windows(2) {
+        if pair[0].zone == pair[1].zone {
+            return Err(GateError::new(
+                "E_POLICY",
+                path,
+                0,
+                format!("duplicate zone {}", pair[0].zone),
+            ));
+        }
+    }
+    if zones.is_empty() {
+        return Err(GateError::new(
+            "E_POLICY",
+            path,
+            0,
+            "at least one zone is required",
+        ));
+    }
+
+    let number = |key: &str| -> Result<usize, GateError> {
+        let value = values
+            .get(key)
+            .ok_or_else(|| GateError::new("E_POLICY", path, 0, format!("missing {key}")))?;
+        value
+            .parse::<usize>()
+            .map_err(|_| GateError::new("E_POLICY", path, 0, format!("invalid {key}")))
+    };
+    let ttl_percent = number("ttl_decrease_percent")?;
+    if ttl_percent > 100 {
+        return Err(GateError::new(
+            "E_POLICY",
+            path,
+            0,
+            "ttl_decrease_percent exceeds 100",
+        ));
+    }
+    let limits = Limits {
+        max_records_total: number("max_records_total")?,
+        max_records_per_zone: number("max_records_per_zone")?,
+        max_include_depth: number("max_include_depth")?,
+        max_generate_records: number("max_generate_records")?,
+        ttl_decrease_percent: u32::try_from(ttl_percent)
+            .map_err(|_| GateError::new("E_POLICY", path, 0, "ttl percentage width"))?,
+    };
+    if limits.max_records_total == 0
+        || limits.max_records_per_zone == 0
+        || limits.max_include_depth == 0
+        || limits.max_generate_records == 0
+    {
+        return Err(GateError::new(
+            "E_POLICY",
+            path,
+            0,
+            "all limits must be positive",
+        ));
+    }
+    Ok(Policy { limits, zones })
+}
+
+fn atomic_publish(output: &Path, bytes: &[u8]) -> Result<(), GateError> {
+    use std::io::Write;
+
+    let parent = output.parent().unwrap_or_else(|| Path::new("."));
+    let file_name = output
+        .file_name()
+        .and_then(std::ffi::OsStr::to_str)
+        .ok_or_else(|| GateError::new("E_OUTPUT", output, 0, "output has no UTF-8 filename"))?;
+    let (mut file, mut temporary) = create_owned_temp(parent, file_name, output)?;
+    if env::var_os("DNS_GATE_FAULT").as_deref() == Some(std::ffi::OsStr::new("after-temp")) {
+        std::process::exit(86);
+    }
+    file.write_all(bytes)
+        .and_then(|()| file.sync_all())
+        .map_err(|error| {
+            GateError::new(
+                "E_OUTPUT",
+                &temporary.path,
+                0,
+                format!("cannot flush temporary report: {error}"),
+            )
+        })?;
+    if env::var_os("DNS_GATE_FAULT").as_deref() == Some(std::ffi::OsStr::new("after-flush")) {
+        std::process::exit(87);
+    }
+    drop(file);
+    fs::rename(&temporary.path, output).map_err(|error| {
+        GateError::new(
+            "E_OUTPUT",
+            output,
+            0,
+            format!("cannot replace report: {error}"),
+        )
+    })?;
+    temporary.owned = false;
+    let directory = fs::File::open(parent).map_err(|error| {
+        GateError::new(
+            "E_OUTPUT",
+            parent,
+            0,
+            format!("cannot open output directory for sync: {error}"),
+        )
+    })?;
+    directory.sync_all().map_err(|error| {
+        GateError::new(
+            "E_OUTPUT",
+            parent,
+            0,
+            format!("cannot sync output directory: {error}"),
+        )
+    })?;
+    Ok(())
+}
+
+fn validate_output_path(
+    output: &Path,
+    old_root: &Path,
+    new_root: &Path,
+    policy: &Path,
+) -> Result<(), GateError> {
+    let parent = output.parent().unwrap_or_else(|| Path::new("."));
+    let canonical_parent = fs::canonicalize(parent).map_err(|error| {
+        GateError::new(
+            "E_OUTPUT",
+            parent,
+            0,
+            format!("output parent must already exist: {error}"),
+        )
+    })?;
+    if canonical_parent.starts_with(old_root) || canonical_parent.starts_with(new_root) {
+        return Err(GateError::new(
+            "E_OUTPUT_ALIAS",
+            output,
+            0,
+            "output must be outside both immutable snapshot roots",
+        ));
+    }
+    let file_name = output
+        .file_name()
+        .ok_or_else(|| GateError::new("E_OUTPUT", output, 0, "output must name a file"))?;
+    let candidate = canonical_parent.join(file_name);
+    let canonical_policy = fs::canonicalize(policy).map_err(|error| {
+        GateError::new(
+            "E_POLICY",
+            policy,
+            0,
+            format!("cannot resolve policy path: {error}"),
+        )
+    })?;
+    if candidate == canonical_policy {
+        return Err(GateError::new(
+            "E_OUTPUT_ALIAS",
+            output,
+            0,
+            "output must not replace the policy file",
+        ));
+    }
+    if let Ok(existing_output) = fs::canonicalize(output) {
+        if existing_output.starts_with(old_root) || existing_output.starts_with(new_root) {
+            return Err(GateError::new(
+                "E_OUTPUT_ALIAS",
+                output,
+                0,
+                "existing output resolves inside an immutable snapshot root",
+            ));
+        }
+        if existing_output == canonical_policy {
+            return Err(GateError::new(
+                "E_OUTPUT_ALIAS",
+                output,
+                0,
+                "existing output resolves to the policy file",
+            ));
+        }
+    }
+    Ok(())
+}
+
+fn validate_output_identities(
+    output: &Path,
+    policy: &Path,
+    input_paths: &[PathBuf],
+) -> Result<(), GateError> {
+    let Ok(output_metadata) = fs::metadata(output) else {
+        return Ok(());
+    };
+    for candidate in std::iter::once(policy).chain(input_paths.iter().map(PathBuf::as_path)) {
+        let metadata = fs::metadata(candidate).map_err(|error| {
+            GateError::new(
+                "E_INPUT_CHANGED",
+                candidate,
+                0,
+                format!("selected immutable input changed during evaluation: {error}"),
+            )
+        })?;
+        if same_file_identity(&output_metadata, &metadata) {
+            return Err(GateError::new(
+                "E_OUTPUT_ALIAS",
+                output,
+                0,
+                format!("output aliases selected input {}", candidate.display()),
+            ));
+        }
+    }
+    Ok(())
+}
+
+#[cfg(unix)]
+fn same_file_identity(left: &fs::Metadata, right: &fs::Metadata) -> bool {
+    use std::os::unix::fs::MetadataExt;
+
+    left.dev() == right.dev() && left.ino() == right.ino()
+}
+
+#[cfg(not(unix))]
+fn same_file_identity(_left: &fs::Metadata, _right: &fs::Metadata) -> bool {
+    false
+}
+
+struct OwnedTemp {
+    path: PathBuf,
+    owned: bool,
+}
+
+impl Drop for OwnedTemp {
+    fn drop(&mut self) {
+        if self.owned {
+            let _ = fs::remove_file(&self.path);
+        }
+    }
+}
+
+fn create_owned_temp(
+    parent: &Path,
+    output_name: &str,
+    output: &Path,
+) -> Result<(fs::File, OwnedTemp), GateError> {
+    let nonce = if let Some(value) = env::var_os("DNS_GATE_TEMP_NONCE") {
+        value
+            .to_str()
+            .ok_or_else(|| GateError::new("E_OUTPUT", output, 0, "test temp nonce is not UTF-8"))?
+            .parse::<u128>()
+            .map_err(|_| GateError::new("E_OUTPUT", output, 0, "test temp nonce is invalid"))?
+    } else {
+        let now = SystemTime::now()
+            .duration_since(UNIX_EPOCH)
+            .map_err(|error| {
+                GateError::new(
+                    "E_OUTPUT",
+                    output,
+                    0,
+                    format!("system clock cannot seed temporary filename: {error}"),
+                )
+            })?
+            .as_nanos();
+        let seed = (
+            std::process::id(),
+            now,
+            TEMP_COUNTER.load(Ordering::Relaxed),
+        );
+        let high = std::collections::hash_map::RandomState::new().hash_one(seed);
+        let low = std::collections::hash_map::RandomState::new().hash_one(seed);
+        (u128::from(high) << 64) | u128::from(low)
+    };
+    let sequence = TEMP_COUNTER.fetch_add(1, Ordering::Relaxed);
+    for attempt in 0..TEMP_CREATE_ATTEMPTS {
+        let path = parent.join(format!(
+            ".{output_name}.tmp-{}-{nonce:032x}-{sequence:016x}-{attempt:03}",
+            std::process::id()
+        ));
+        match fs::OpenOptions::new()
+            .write(true)
+            .create_new(true)
+            .open(&path)
+        {
+            Ok(file) => return Ok((file, OwnedTemp { path, owned: true })),
+            Err(error) if error.kind() == std::io::ErrorKind::AlreadyExists => {}
+            Err(error) => {
+                return Err(GateError::new(
+                    "E_OUTPUT",
+                    &path,
+                    0,
+                    format!("cannot create exclusive temporary report: {error}"),
+                ));
+            }
+        }
+    }
+    Err(GateError::new(
+        "E_OUTPUT_TEMP_COLLISIONS",
+        output,
+        0,
+        format!(
+            "could not create an exclusive temporary report after {TEMP_CREATE_ATTEMPTS} attempts"
+        ),
+    ))
+}
diff --git a/developer-simulation/runs/2026-08-12--dns-change-gate/src/main.rs b/developer-simulation/runs/2026-08-12--dns-change-gate/src/main.rs
new file mode 100644
index 0000000..2c4a9e8
--- /dev/null
+++ b/developer-simulation/runs/2026-08-12--dns-change-gate/src/main.rs
@@ -0,0 +1,9 @@
+fn main() {
+    match dns_change_gate::run_from_env() {
+        Ok(status) => std::process::exit(status),
+        Err(error) => {
+            eprintln!("{error}");
+            std::process::exit(1);
+        }
+    }
+}
diff --git a/developer-simulation/runs/2026-08-12--dns-change-gate/src/parser.rs b/developer-simulation/runs/2026-08-12--dns-change-gate/src/parser.rs
new file mode 100644
index 0000000..d9510a0
--- /dev/null
+++ b/developer-simulation/runs/2026-08-12--dns-change-gate/src/parser.rs
@@ -0,0 +1,1239 @@
+use std::collections::BTreeMap;
+use std::fmt::Write as _;
+use std::fs;
+use std::net::{Ipv4Addr, Ipv6Addr};
+use std::path::{Component, Path, PathBuf};
+
+use crate::{GateError, Limits, ZonePolicy};
+
+#[derive(Debug, Clone, Eq, PartialEq, Ord, PartialOrd)]
+pub struct RecordKey {
+    pub owner: String,
+    pub record_type: String,
+    pub rdata: String,
+}
+
+#[derive(Debug)]
+pub struct ZoneData {
+    pub records: BTreeMap<RecordKey, u32>,
+    pub input_paths: Vec<PathBuf>,
+}
+
+#[derive(Debug, Clone)]
+struct Token {
+    raw: Vec<u8>,
+    quoted: bool,
+    offset: usize,
+}
+
+#[derive(Debug)]
+struct LogicalRecord {
+    tokens: Vec<Token>,
+    leading_whitespace: bool,
+    offset: usize,
+}
+
+struct ParseContext<'a> {
+    root: &'a Path,
+    limits: &'a Limits,
+    total_records: &'a mut usize,
+    zone_records: usize,
+    records: BTreeMap<RecordKey, u32>,
+    include_stack: Vec<PathBuf>,
+    input_paths: Vec<PathBuf>,
+}
+
+/// Parses one selected zone from one snapshot root.
+///
+/// # Errors
+/// Returns a stable, offset-bearing input diagnostic on malformed or unsafe input.
+pub fn parse_zone(
+    root: &Path,
+    selected: &ZonePolicy,
+    limits: &Limits,
+    total_records: &mut usize,
+) -> Result<ZoneData, GateError> {
+    let mut context = ParseContext {
+        root,
+        limits,
+        total_records,
+        zone_records: 0,
+        records: BTreeMap::new(),
+        include_stack: Vec::new(),
+        input_paths: Vec::new(),
+    };
+    let origin = selected.zone.clone();
+    context.parse_file(root, &selected.relative_path, origin, None, None, 0)?;
+    Ok(ZoneData {
+        records: context.records,
+        input_paths: context.input_paths,
+    })
+}
+
+impl ParseContext<'_> {
+    fn parse_file(
+        &mut self,
+        base: &Path,
+        requested: &Path,
+        mut origin: String,
+        inherited_owner: Option<String>,
+        inherited_ttl: Option<u32>,
+        depth: usize,
+    ) -> Result<(), GateError> {
+        if depth > self.limits.max_include_depth {
+            return Err(GateError::new(
+                "E_INCLUDE_DEPTH",
+                requested,
+                0,
+                format!("include depth exceeds {}", self.limits.max_include_depth),
+            ));
+        }
+        let path = safe_path(self.root, base, requested)?;
+        if !self.input_paths.contains(&path) {
+            self.input_paths.push(path.clone());
+        }
+        if self.include_stack.contains(&path) {
+            return Err(GateError::new(
+                "E_INCLUDE_CYCLE",
+                &path,
+                0,
+                "include cycle detected",
+            ));
+        }
+        let bytes = fs::read(&path).map_err(|error| {
+            GateError::new(
+                "E_INCLUDE_MISSING",
+                &path,
+                0,
+                format!("cannot read zone file: {error}"),
+            )
+        })?;
+        let logical = tokenize(&path, &bytes)?;
+        self.include_stack.push(path.clone());
+        let mut default_ttl = inherited_ttl;
+        let mut last_owner = inherited_owner;
+        for record in logical {
+            let result = if first_is(&record, b"$ORIGIN") {
+                if record.tokens.len() == 2 {
+                    origin = canonical_name(&record.tokens[1], &origin, &path)?;
+                    Ok(())
+                } else {
+                    Err(at_record(
+                        "E_DIRECTIVE",
+                        &path,
+                        &record,
+                        "$ORIGIN requires one name",
+                    ))
+                }
+            } else if first_is(&record, b"$TTL") {
+                if record.tokens.len() == 2 {
+                    default_ttl = Some(parse_ttl(&record.tokens[1], &path)?);
+                    Ok(())
+                } else {
+                    Err(at_record(
+                        "E_DIRECTIVE",
+                        &path,
+                        &record,
+                        "$TTL requires one value",
+                    ))
+                }
+            } else if first_is(&record, b"$INCLUDE") {
+                self.parse_include(
+                    &path,
+                    &record,
+                    &origin,
+                    last_owner.clone(),
+                    default_ttl,
+                    depth,
+                )
+            } else if first_is(&record, b"$GENERATE") {
+                self.parse_generate(&path, &record, &origin, &mut last_owner, default_ttl)
+            } else if record
+                .tokens
+                .first()
+                .is_some_and(|token| token.raw.first() == Some(&b'$'))
+            {
+                Err(at_record(
+                    "E_DIRECTIVE",
+                    &path,
+                    &record,
+                    "unsupported directive",
+                ))
+            } else {
+                self.parse_resource(&path, &record, &origin, &mut last_owner, default_ttl)
+            };
+            if let Err(error) = result {
+                self.include_stack.pop();
+                return Err(error);
+            }
+        }
+        self.include_stack.pop();
+        Ok(())
+    }
+
+    fn parse_include(
+        &mut self,
+        including: &Path,
+        record: &LogicalRecord,
+        origin: &str,
+        owner: Option<String>,
+        default_ttl: Option<u32>,
+        depth: usize,
+    ) -> Result<(), GateError> {
+        if !(2..=3).contains(&record.tokens.len()) {
+            return Err(at_record(
+                "E_DIRECTIVE",
+                including,
+                record,
+                "$INCLUDE requires path and optional origin",
+            ));
+        }
+        let include_text = ascii(&record.tokens[1], including)?;
+        let include_path = PathBuf::from(include_text);
+        let include_origin = if record.tokens.len() == 3 {
+            canonical_name(&record.tokens[2], origin, including)?
+        } else {
+            origin.to_string()
+        };
+        let base = including.parent().unwrap_or(self.root);
+        self.parse_file(
+            base,
+            &include_path,
+            include_origin,
+            owner,
+            default_ttl,
+            depth + 1,
+        )
+    }
+
+    fn parse_generate(
+        &mut self,
+        path: &Path,
+        record: &LogicalRecord,
+        origin: &str,
+        last_owner: &mut Option<String>,
+        default_ttl: Option<u32>,
+    ) -> Result<(), GateError> {
+        if record.tokens.len() < 5 {
+            return Err(at_record(
+                "E_GENERATE",
+                path,
+                record,
+                "$GENERATE is incomplete",
+            ));
+        }
+        let (first_value, last_value, stride) = parse_range(&record.tokens[1], path)?;
+        let span = u64::from(last_value)
+            .checked_sub(u64::from(first_value))
+            .ok_or_else(|| at_record("E_GENERATE", path, record, "range underflow"))?;
+        let count = span
+            .checked_div(u64::from(stride))
+            .and_then(|value| value.checked_add(1))
+            .ok_or_else(|| {
+                at_record(
+                    "E_GENERATE_LIMIT",
+                    path,
+                    record,
+                    "range cardinality overflow",
+                )
+            })?;
+        let count_usize = usize::try_from(count).map_err(|_| {
+            at_record(
+                "E_GENERATE_LIMIT",
+                path,
+                record,
+                "range size exceeds platform width",
+            )
+        })?;
+        if count_usize > self.limits.max_generate_records {
+            return Err(at_record(
+                "E_GENERATE_LIMIT",
+                path,
+                record,
+                format!("directive expands to {count_usize} records"),
+            ));
+        }
+        let mut substitution_seen = false;
+        for token in &record.tokens[2..] {
+            for byte in &token.raw {
+                if *byte == b'$' {
+                    if substitution_seen {
+                        return Err(at_record(
+                            "E_GENERATE_SUBSTITUTION",
+                            path,
+                            record,
+                            "exactly one simple substitution token is required",
+                        ));
+                    }
+                    substitution_seen = true;
+                }
+            }
+        }
+        if !substitution_seen {
+            return Err(at_record(
+                "E_GENERATE_SUBSTITUTION",
+                path,
+                record,
+                "exactly one simple substitution token is required",
+            ));
+        }
+        let mut value = first_value;
+        for _ in 0..count_usize {
+            let replacement = value.to_string();
+            let tokens = record.tokens[2..]
+                .iter()
+                .map(|token| Token {
+                    raw: replace_dollar(&token.raw, replacement.as_bytes()),
+                    quoted: token.quoted,
+                    offset: token.offset,
+                })
+                .collect();
+            let generated = LogicalRecord {
+                tokens,
+                leading_whitespace: false,
+                offset: record.offset,
+            };
+            self.parse_resource(path, &generated, origin, last_owner, default_ttl)?;
+            value = value.checked_add(stride).unwrap_or(last_value);
+        }
+        Ok(())
+    }
+
+    fn parse_resource(
+        &mut self,
+        path: &Path,
+        record: &LogicalRecord,
+        origin: &str,
+        last_owner: &mut Option<String>,
+        default_ttl: Option<u32>,
+    ) -> Result<(), GateError> {
+        if record.tokens.is_empty() {
+            return Ok(());
+        }
+        let mut index = 0;
+        let owner = if record.leading_whitespace {
+            last_owner.clone().ok_or_else(|| {
+                at_record("E_OWNER", path, record, "omitted owner has no predecessor")
+            })?
+        } else {
+            let owner = canonical_name(&record.tokens[0], origin, path)?;
+            index += 1;
+            *last_owner = Some(owner.clone());
+            owner
+        };
+        let mut ttl = None;
+        let mut class_seen = false;
+        let record_type;
+        loop {
+            let Some(token) = record.tokens.get(index) else {
+                return Err(at_record("E_FIELD", path, record, "missing record type"));
+            };
+            let upper = ascii(token, path)?.to_ascii_uppercase();
+            if is_record_type(&upper) {
+                record_type = upper;
+                index += 1;
+                break;
+            }
+            if upper == "IN" && !class_seen {
+                class_seen = true;
+                index += 1;
+            } else if ttl.is_none() {
+                ttl = Some(parse_ttl(token, path).map_err(|_| {
+                    GateError::new(
+                        "E_FIELD",
+                        path,
+                        token.offset as u64,
+                        "unknown mandatory field before record type",
+                    )
+                })?);
+                index += 1;
+            } else {
+                return Err(GateError::new(
+                    "E_FIELD",
+                    path,
+                    token.offset as u64,
+                    "unknown mandatory field before record type",
+                ));
+            }
+        }
+        let ttl = ttl.or(default_ttl).ok_or_else(|| {
+            at_record(
+                "E_TTL",
+                path,
+                record,
+                "record has no TTL and no $TTL default",
+            )
+        })?;
+        let rdata = canonical_rdata(&record_type, &record.tokens[index..], origin, path)?;
+        self.add_record(
+            path,
+            record,
+            RecordKey {
+                owner,
+                record_type,
+                rdata,
+            },
+            ttl,
+        )
+    }
+
+    fn add_record(
+        &mut self,
+        path: &Path,
+        record: &LogicalRecord,
+        key: RecordKey,
+        ttl: u32,
+    ) -> Result<(), GateError> {
+        self.zone_records = self.zone_records.checked_add(1).ok_or_else(|| {
+            at_record("E_ZONE_LIMIT", path, record, "zone record counter overflow")
+        })?;
+        *self.total_records = self.total_records.checked_add(1).ok_or_else(|| {
+            at_record(
+                "E_TOTAL_LIMIT",
+                path,
+                record,
+                "total record counter overflow",
+            )
+        })?;
+        if self.zone_records > self.limits.max_records_per_zone {
+            return Err(at_record(
+                "E_ZONE_LIMIT",
+                path,
+                record,
+                "per-zone expansion limit exceeded",
+            ));
+        }
+        if *self.total_records > self.limits.max_records_total {
+            return Err(at_record(
+                "E_TOTAL_LIMIT",
+                path,
+                record,
+                "total expansion limit exceeded",
+            ));
+        }
+        if let Some(existing) = self.records.get(&key) {
+            if *existing != ttl {
+                return Err(at_record(
+                    "E_DUP_TTL",
+                    path,
+                    record,
+                    "duplicate canonical record has conflicting TTL",
+                ));
+            }
+            return Ok(());
+        }
+        self.records.insert(key, ttl);
+        Ok(())
+    }
+}
+
+fn safe_path(root: &Path, base: &Path, requested: &Path) -> Result<PathBuf, GateError> {
+    if requested.is_absolute() {
+        return Err(GateError::new(
+            "E_INCLUDE_ABSOLUTE",
+            requested,
+            0,
+            "absolute paths are forbidden",
+        ));
+    }
+    let mut lexical = base.to_path_buf();
+    for component in requested.components() {
+        match component {
+            Component::Normal(part) => lexical.push(part),
+            Component::CurDir => {}
+            Component::ParentDir => {
+                if !lexical.pop() || !lexical.starts_with(root) {
+                    return Err(GateError::new(
+                        "E_INCLUDE_ESCAPE",
+                        requested,
+                        0,
+                        "path escapes snapshot root",
+                    ));
+                }
+            }
+            Component::RootDir | Component::Prefix(_) => {
+                return Err(GateError::new(
+                    "E_INCLUDE_ABSOLUTE",
+                    requested,
+                    0,
+                    "absolute paths are forbidden",
+                ));
+            }
+        }
+    }
+    if !lexical.starts_with(root) {
+        return Err(GateError::new(
+            "E_INCLUDE_ESCAPE",
+            requested,
+            0,
+            "path escapes snapshot root",
+        ));
+    }
+    let canonical = fs::canonicalize(&lexical).map_err(|error| {
+        GateError::new(
+            "E_INCLUDE_MISSING",
+            &lexical,
+            0,
+            format!("cannot resolve file: {error}"),
+        )
+    })?;
+    if !canonical.starts_with(root) {
+        return Err(GateError::new(
+            "E_INCLUDE_SYMLINK",
+            &lexical,
+            0,
+            "resolved path escapes snapshot root",
+        ));
+    }
+    if !canonical.is_file() {
+        return Err(GateError::new(
+            "E_INCLUDE_MISSING",
+            &canonical,
+            0,
+            "zone input is not a regular file",
+        ));
+    }
+    Ok(canonical)
+}
+
+#[expect(
+    clippy::too_many_lines,
+    reason = "the byte tokenizer is one explicit state machine so offsets and transitions stay auditable"
+)]
+fn tokenize(path: &Path, bytes: &[u8]) -> Result<Vec<LogicalRecord>, GateError> {
+    let mut records = Vec::new();
+    let mut tokens = Vec::new();
+    let mut token = Vec::new();
+    let mut token_start = 0;
+    let mut token_quoted = false;
+    let mut in_quote = false;
+    let mut in_comment = false;
+    let mut parentheses = 0_u32;
+    let mut record_offset = 0;
+    let mut leading_whitespace = false;
+    let mut index = 0;
+    while index < bytes.len() {
+        let byte = bytes[index];
+        if in_comment {
+            if byte == b'\n' {
+                in_comment = false;
+                if parentheses == 0 {
+                    finish_record(
+                        &mut records,
+                        &mut tokens,
+                        &mut token,
+                        token_start,
+                        &mut token_quoted,
+                        leading_whitespace,
+                        record_offset,
+                    );
+                    leading_whitespace = false;
+                }
+            }
+            index += 1;
+            continue;
+        }
+        if byte > 0x7f {
+            return Err(GateError::new(
+                "E_RAW_NON_ASCII",
+                path,
+                index as u64,
+                "raw non-ASCII input byte",
+            ));
+        }
+        if in_quote {
+            if byte == b'\\' {
+                let consumed = copy_escape(path, bytes, index, &mut token)?;
+                index += consumed;
+                continue;
+            }
+            if byte == b'"' {
+                in_quote = false;
+            } else if byte == b'\n' {
+                return Err(GateError::new(
+                    "E_UNTERMINATED_QUOTE",
+                    path,
+                    token_start as u64,
+                    "quoted token crosses newline",
+                ));
+            } else {
+                token.push(byte);
+            }
+            index += 1;
+            continue;
+        }
+        match byte {
+            b';' => {
+                finish_token(&mut tokens, &mut token, token_start, &mut token_quoted);
+                in_comment = true;
+            }
+            b'"' => {
+                if token.is_empty() {
+                    token_start = index;
+                    token_quoted = true;
+                    if tokens.is_empty() {
+                        record_offset = index;
+                    }
+                }
+                in_quote = true;
+            }
+            b'\\' => {
+                if token.is_empty() {
+                    token_start = index;
+                    if tokens.is_empty() {
+                        record_offset = index;
+                    }
+                }
+                let consumed = copy_escape(path, bytes, index, &mut token)?;
+                index += consumed;
+                continue;
+            }
+            b'(' => {
+                finish_token(&mut tokens, &mut token, token_start, &mut token_quoted);
+                parentheses = parentheses.checked_add(1).ok_or_else(|| {
+                    GateError::new(
+                        "E_PAREN_DEPTH",
+                        path,
+                        index as u64,
+                        "parenthesis depth overflow",
+                    )
+                })?;
+            }
+            b')' => {
+                finish_token(&mut tokens, &mut token, token_start, &mut token_quoted);
+                if parentheses == 0 {
+                    return Err(GateError::new(
+                        "E_UNEXPECTED_PAREN",
+                        path,
+                        index as u64,
+                        "unexpected closing parenthesis",
+                    ));
+                }
+                parentheses -= 1;
+            }
+            b'\n' => {
+                finish_token(&mut tokens, &mut token, token_start, &mut token_quoted);
+                if parentheses == 0 {
+                    finish_record(
+                        &mut records,
+                        &mut tokens,
+                        &mut token,
+                        token_start,
+                        &mut token_quoted,
+                        leading_whitespace,
+                        record_offset,
+                    );
+                    leading_whitespace = false;
+                }
+            }
+            b' ' | b'\t' | b'\r' => {
+                if tokens.is_empty() && token.is_empty() && parentheses == 0 {
+                    leading_whitespace = true;
+                }
+                finish_token(&mut tokens, &mut token, token_start, &mut token_quoted);
+            }
+            _ => {
+                if token.is_empty() {
+                    token_start = index;
+                    token_quoted = false;
+                    if tokens.is_empty() {
+                        record_offset = index;
+                    }
+                }
+                token.push(byte);
+            }
+        }
+        index += 1;
+    }
+    if in_quote {
+        return Err(GateError::new(
+            "E_UNTERMINATED_QUOTE",
+            path,
+            token_start as u64,
+            "unterminated quoted token",
+        ));
+    }
+    if parentheses != 0 {
+        return Err(GateError::new(
+            "E_UNTERMINATED_PAREN",
+            path,
+            record_offset as u64,
+            "unterminated parenthesized record",
+        ));
+    }
+    finish_token(&mut tokens, &mut token, token_start, &mut token_quoted);
+    finish_record(
+        &mut records,
+        &mut tokens,
+        &mut token,
+        token_start,
+        &mut token_quoted,
+        leading_whitespace,
+        record_offset,
+    );
+    Ok(records)
+}
+
+fn copy_escape(
+    path: &Path,
+    bytes: &[u8],
+    index: usize,
+    token: &mut Vec<u8>,
+) -> Result<usize, GateError> {
+    if index + 1 >= bytes.len() {
+        return Err(GateError::new(
+            "E_ESCAPE",
+            path,
+            index as u64,
+            "trailing escape",
+        ));
+    }
+    token.push(b'\\');
+    if index + 3 < bytes.len() && bytes[index + 1..index + 4].iter().all(u8::is_ascii_digit) {
+        token.extend_from_slice(&bytes[index + 1..index + 4]);
+        Ok(4)
+    } else {
+        token.push(bytes[index + 1]);
+        Ok(2)
+    }
+}
+
+fn finish_token(tokens: &mut Vec<Token>, token: &mut Vec<u8>, start: usize, quoted: &mut bool) {
+    if !token.is_empty() || *quoted {
+        tokens.push(Token {
+            raw: std::mem::take(token),
+            quoted: *quoted,
+            offset: start,
+        });
+    }
+    *quoted = false;
+}
+
+fn finish_record(
+    records: &mut Vec<LogicalRecord>,
+    tokens: &mut Vec<Token>,
+    token: &mut Vec<u8>,
+    token_start: usize,
+    token_quoted: &mut bool,
+    leading_whitespace: bool,
+    record_offset: usize,
+) {
+    finish_token(tokens, token, token_start, token_quoted);
+    if !tokens.is_empty() {
+        records.push(LogicalRecord {
+            tokens: std::mem::take(tokens),
+            leading_whitespace,
+            offset: record_offset,
+        });
+    }
+}
+
+fn first_is(record: &LogicalRecord, expected: &[u8]) -> bool {
+    record
+        .tokens
+        .first()
+        .is_some_and(|token| token.raw.eq_ignore_ascii_case(expected))
+}
+
+fn at_record(
+    code: &'static str,
+    path: &Path,
+    record: &LogicalRecord,
+    detail: impl Into<String>,
+) -> GateError {
+    GateError::new(code, path, record.offset as u64, detail)
+}
+
+fn ascii(token: &Token, path: &Path) -> Result<String, GateError> {
+    String::from_utf8(token.raw.clone()).map_err(|_| {
+        GateError::new(
+            "E_RAW_NON_ASCII",
+            path,
+            token.offset as u64,
+            "token is not ASCII",
+        )
+    })
+}
+
+fn parse_ttl(token: &Token, path: &Path) -> Result<u32, GateError> {
+    let text = ascii(token, path)?;
+    if text.is_empty() {
+        return Err(GateError::new(
+            "E_TTL",
+            path,
+            token.offset as u64,
+            "empty TTL",
+        ));
+    }
+    let bytes = text.as_bytes();
+    let mut index = 0;
+    let mut total = 0_u64;
+    while index < bytes.len() {
+        let start = index;
+        while index < bytes.len() && bytes[index].is_ascii_digit() {
+            index += 1;
+        }
+        if start == index {
+            return Err(GateError::new(
+                "E_TTL",
+                path,
+                token.offset as u64,
+                "invalid TTL",
+            ));
+        }
+        let number = text[start..index].parse::<u64>().map_err(|_| {
+            GateError::new("E_TTL", path, token.offset as u64, "TTL number overflow")
+        })?;
+        let multiplier = if index == bytes.len() {
+            1
+        } else {
+            let unit = bytes[index].to_ascii_lowercase();
+            index += 1;
+            match unit {
+                b'w' => 604_800,
+                b'd' => 86_400,
+                b'h' => 3_600,
+                b'm' => 60,
+                b's' => 1,
+                _ => {
+                    return Err(GateError::new(
+                        "E_TTL",
+                        path,
+                        token.offset as u64,
+                        "invalid TTL unit",
+                    ));
+                }
+            }
+        };
+        total = total
+            .checked_add(number.checked_mul(multiplier).ok_or_else(|| {
+                GateError::new("E_TTL", path, token.offset as u64, "TTL overflow")
+            })?)
+            .ok_or_else(|| GateError::new("E_TTL", path, token.offset as u64, "TTL overflow"))?;
+    }
+    u32::try_from(total)
+        .map_err(|_| GateError::new("E_TTL", path, token.offset as u64, "TTL exceeds u32"))
+}
+
+fn canonical_name(token: &Token, origin: &str, path: &Path) -> Result<String, GateError> {
+    let mut labels: Vec<Vec<u8>> = vec![Vec::new()];
+    let mut index = 0;
+    let mut absolute = false;
+    while index < token.raw.len() {
+        match token.raw[index] {
+            b'.' => {
+                if labels.last().is_some_and(Vec::is_empty) {
+                    return Err(GateError::new(
+                        "E_NAME",
+                        path,
+                        (token.offset + index) as u64,
+                        "empty label",
+                    ));
+                }
+                labels.push(Vec::new());
+                index += 1;
+                if index == token.raw.len() {
+                    absolute = true;
+                    labels.pop();
+                }
+            }
+            b'\\' => {
+                let (byte, consumed) = decode_one_escape(&token.raw, index, path, token.offset)?;
+                labels.last_mut().expect("one label").push(byte);
+                index += consumed;
+            }
+            byte => {
+                labels
+                    .last_mut()
+                    .expect("one label")
+                    .push(byte.to_ascii_lowercase());
+                index += 1;
+            }
+        }
+    }
+    if token.raw == b"@" {
+        return Ok(origin.to_string());
+    }
+    if labels
+        .iter()
+        .any(|label| label.is_empty() || label.len() > 63)
+    {
+        return Err(GateError::new(
+            "E_LABEL_LENGTH",
+            path,
+            token.offset as u64,
+            "label length is outside 1..=63",
+        ));
+    }
+    let local_wire_length = labels.iter().map(|label| label.len() + 1).sum::<usize>();
+    let wire_length = if absolute {
+        local_wire_length + 1
+    } else {
+        local_wire_length
+            .checked_add(canonical_wire_length(origin).ok_or_else(|| {
+                GateError::new(
+                    "E_NAME",
+                    path,
+                    token.offset as u64,
+                    "internal origin is not canonical",
+                )
+            })?)
+            .ok_or_else(|| {
+                GateError::new(
+                    "E_NAME_LENGTH",
+                    path,
+                    token.offset as u64,
+                    "wire name length overflow",
+                )
+            })?
+    };
+    if wire_length > 255 {
+        return Err(GateError::new(
+            "E_NAME_LENGTH",
+            path,
+            token.offset as u64,
+            "wire name exceeds 255 bytes",
+        ));
+    }
+    let mut rendered = labels
+        .iter()
+        .map(|label| render_label(label))
+        .collect::<Vec<_>>()
+        .join(".");
+    if absolute {
+        rendered.push('.');
+    } else {
+        rendered.push('.');
+        rendered.push_str(origin);
+    }
+    Ok(rendered)
+}
+
+fn canonical_wire_length(name: &str) -> Option<usize> {
+    if !name.ends_with('.') {
+        return None;
+    }
+    let mut total = 1_usize;
+    for label in name[..name.len() - 1].split('.') {
+        if label.is_empty() {
+            return None;
+        }
+        let bytes = label.as_bytes();
+        let mut octets = 0_usize;
+        let mut index = 0;
+        while index < bytes.len() {
+            if bytes[index] == b'\\' {
+                if index + 3 >= bytes.len()
+                    || !bytes[index + 1..index + 4].iter().all(u8::is_ascii_digit)
+                {
+                    return None;
+                }
+                index += 4;
+            } else {
+                index += 1;
+            }
+            octets = octets.checked_add(1)?;
+        }
+        total = total.checked_add(octets.checked_add(1)?)?;
+    }
+    Some(total)
+}
+
+fn render_label(label: &[u8]) -> String {
+    let mut output = String::new();
+    for byte in label {
+        let lowered = byte.to_ascii_lowercase();
+        if lowered.is_ascii_alphanumeric() || matches!(lowered, b'-' | b'_') {
+            output.push(char::from(lowered));
+        } else {
+            write!(output, "\\{lowered:03}").expect("write to string");
+        }
+    }
+    output
+}
+
+fn decode_one_escape(
+    raw: &[u8],
+    index: usize,
+    path: &Path,
+    token_offset: usize,
+) -> Result<(u8, usize), GateError> {
+    if index + 1 >= raw.len() {
+        return Err(GateError::new(
+            "E_ESCAPE",
+            path,
+            (token_offset + index) as u64,
+            "trailing escape",
+        ));
+    }
+    if index + 3 < raw.len() && raw[index + 1..index + 4].iter().all(u8::is_ascii_digit) {
+        let value = u16::from(raw[index + 1] - b'0') * 100
+            + u16::from(raw[index + 2] - b'0') * 10
+            + u16::from(raw[index + 3] - b'0');
+        let byte = u8::try_from(value).map_err(|_| {
+            GateError::new(
+                "E_ESCAPE",
+                path,
+                (token_offset + index) as u64,
+                "decimal escape exceeds 255",
+            )
+        })?;
+        Ok((byte, 4))
+    } else {
+        Ok((raw[index + 1], 2))
+    }
+}
+
+fn canonical_rdata(
+    record_type: &str,
+    tokens: &[Token],
+    origin: &str,
+    path: &Path,
+) -> Result<String, GateError> {
+    match record_type {
+        "A" => one(tokens, path)?
+            .parse::<Ipv4Addr>()
+            .map(|value| value.to_string())
+            .map_err(|_| data_error(path, tokens, "invalid IPv4 address")),
+        "AAAA" => one(tokens, path)?
+            .parse::<Ipv6Addr>()
+            .map(|value| value.to_string())
+            .map_err(|_| data_error(path, tokens, "invalid IPv6 address")),
+        "NS" | "CNAME" => {
+            require_count(tokens, 1, path)?;
+            canonical_name(&tokens[0], origin, path)
+        }
+        "MX" => {
+            require_count(tokens, 2, path)?;
+            Ok(format!(
+                "{} {}",
+                parse_u16(&tokens[0], path)?,
+                canonical_name(&tokens[1], origin, path)?
+            ))
+        }
+        "SRV" => {
+            require_count(tokens, 4, path)?;
+            Ok(format!(
+                "{} {} {} {}",
+                parse_u16(&tokens[0], path)?,
+                parse_u16(&tokens[1], path)?,
+                parse_u16(&tokens[2], path)?,
+                canonical_name(&tokens[3], origin, path)?
+            ))
+        }
+        "CAA" => {
+            require_count(tokens, 3, path)?;
+            Ok(format!(
+                "{} {} {}",
+                parse_u8(&tokens[0], path)?,
+                ascii(&tokens[1], path)?.to_ascii_lowercase(),
+                render_octets(&decode_token(&tokens[2], path)?)
+            ))
+        }
+        "DS" => {
+            require_count(tokens, 4, path)?;
+            let digest = ascii(&tokens[3], path)?;
+            if digest.is_empty() || !digest.bytes().all(|byte| byte.is_ascii_hexdigit()) {
+                return Err(data_error(path, tokens, "invalid DS digest"));
+            }
+            Ok(format!(
+                "{} {} {} {}",
+                parse_u16(&tokens[0], path)?,
+                parse_u8(&tokens[1], path)?,
+                parse_u8(&tokens[2], path)?,
+                digest.to_ascii_uppercase()
+            ))
+        }
+        "TXT" => {
+            if tokens.is_empty() || tokens.iter().any(|token| !token.quoted) {
+                return Err(data_error(
+                    path,
+                    tokens,
+                    "TXT requires one or more quoted chunks",
+                ));
+            }
+            let mut chunks = Vec::with_capacity(tokens.len());
+            for token in tokens {
+                let decoded = decode_token(token, path)?;
+                if decoded.len() > 255 {
+                    return Err(GateError::new(
+                        "E_RDATA",
+                        path,
+                        token.offset as u64,
+                        "TXT chunk exceeds 255 bytes",
+                    ));
+                }
+                chunks.push(render_octets(&decoded));
+            }
+            Ok(chunks.join("|"))
+        }
+        "SOA" => {
+            require_count(tokens, 7, path)?;
+            Ok(format!(
+                "{} {} {} {} {} {} {}",
+                canonical_name(&tokens[0], origin, path)?,
+                canonical_name(&tokens[1], origin, path)?,
+                parse_u32(&tokens[2], path)?,
+                parse_ttl(&tokens[3], path)?,
+                parse_ttl(&tokens[4], path)?,
+                parse_ttl(&tokens[5], path)?,
+                parse_ttl(&tokens[6], path)?
+            ))
+        }
+        _ => Err(data_error(path, tokens, "unsupported record type")),
+    }
+}
+
+fn one(tokens: &[Token], path: &Path) -> Result<String, GateError> {
+    require_count(tokens, 1, path)?;
+    ascii(&tokens[0], path)
+}
+
+fn require_count(tokens: &[Token], expected: usize, path: &Path) -> Result<(), GateError> {
+    if tokens.len() == expected {
+        Ok(())
+    } else {
+        Err(data_error(
+            path,
+            tokens,
+            format!("expected {expected} RDATA fields, found {}", tokens.len()),
+        ))
+    }
+}
+
+fn data_error(path: &Path, tokens: &[Token], detail: impl Into<String>) -> GateError {
+    GateError::new(
+        "E_RDATA",
+        path,
+        tokens.first().map_or(0, |token| token.offset as u64),
+        detail,
+    )
+}
+
+fn parse_u8(token: &Token, path: &Path) -> Result<u8, GateError> {
+    ascii(token, path)?.parse::<u8>().map_err(|_| {
+        GateError::new(
+            "E_INTEGER_WIDTH",
+            path,
+            token.offset as u64,
+            "integer exceeds u8",
+        )
+    })
+}
+
+fn parse_u16(token: &Token, path: &Path) -> Result<u16, GateError> {
+    ascii(token, path)?.parse::<u16>().map_err(|_| {
+        GateError::new(
+            "E_INTEGER_WIDTH",
+            path,
+            token.offset as u64,
+            "integer exceeds u16",
+        )
+    })
+}
+
+fn parse_u32(token: &Token, path: &Path) -> Result<u32, GateError> {
+    ascii(token, path)?.parse::<u32>().map_err(|_| {
+        GateError::new(
+            "E_INTEGER_WIDTH",
+            path,
+            token.offset as u64,
+            "integer exceeds u32",
+        )
+    })
+}
+
+fn decode_token(token: &Token, path: &Path) -> Result<Vec<u8>, GateError> {
+    let mut decoded = Vec::new();
+    let mut index = 0;
+    while index < token.raw.len() {
+        if token.raw[index] == b'\\' {
+            let (byte, consumed) = decode_one_escape(&token.raw, index, path, token.offset)?;
+            decoded.push(byte);
+            index += consumed;
+        } else {
+            decoded.push(token.raw[index]);
+            index += 1;
+        }
+    }
+    Ok(decoded)
+}
+
+fn render_octets(bytes: &[u8]) -> String {
+    let mut output = String::new();
+    for byte in bytes {
+        if (0x21..=0x7e).contains(byte) && !matches!(*byte, b'\\' | b'|' | b'"') {
+            output.push(char::from(*byte));
+        } else {
+            write!(output, "\\{byte:03}").expect("write to string");
+        }
+    }
+    output
+}
+
+fn is_record_type(value: &str) -> bool {
+    matches!(
+        value,
+        "SOA" | "NS" | "A" | "AAAA" | "CNAME" | "MX" | "TXT" | "SRV" | "CAA" | "DS"
+    )
+}
+
+fn parse_range(token: &Token, path: &Path) -> Result<(u32, u32, u32), GateError> {
+    let text = ascii(token, path)?;
+    let (range, stride_text) = text
+        .split_once('/')
+        .map_or((text.as_str(), None), |(left, right)| (left, Some(right)));
+    let (first_text, last_text) = range.split_once('-').ok_or_else(|| {
+        GateError::new(
+            "E_GENERATE",
+            path,
+            token.offset as u64,
+            "range must be start-stop[/step]",
+        )
+    })?;
+    let first_value = first_text.parse::<u32>().map_err(|_| {
+        GateError::new(
+            "E_GENERATE",
+            path,
+            token.offset as u64,
+            "invalid range start",
+        )
+    })?;
+    let last_value = last_text.parse::<u32>().map_err(|_| {
+        GateError::new(
+            "E_GENERATE",
+            path,
+            token.offset as u64,
+            "invalid range stop",
+        )
+    })?;
+    let stride = stride_text.map_or(Ok(1), str::parse::<u32>).map_err(|_| {
+        GateError::new(
+            "E_GENERATE",
+            path,
+            token.offset as u64,
+            "invalid range step",
+        )
+    })?;
+    if first_value > last_value || stride == 0 {
+        return Err(GateError::new(
+            "E_GENERATE",
+            path,
+            token.offset as u64,
+            "range must be increasing with positive step",
+        ));
+    }
+    Ok((first_value, last_value, stride))
+}
+
+fn replace_dollar(raw: &[u8], replacement: &[u8]) -> Vec<u8> {
+    let mut output = Vec::with_capacity(raw.len() + replacement.len());
+    for byte in raw {
+        if *byte == b'$' {
+            output.extend_from_slice(replacement);
+        } else {
+            output.push(*byte);
+        }
+    }
+    output
+}
diff --git a/developer-simulation/runs/2026-08-12--dns-change-gate/src/report.rs b/developer-simulation/runs/2026-08-12--dns-change-gate/src/report.rs
new file mode 100644
index 0000000..ba62c49
--- /dev/null
+++ b/developer-simulation/runs/2026-08-12--dns-change-gate/src/report.rs
@@ -0,0 +1,465 @@
+use std::collections::{BTreeMap, BTreeSet};
+use std::fmt::Write;
+
+use crate::{Limits, RecordKey, ZoneData, ZonePolicy};
+
+#[derive(Debug, Clone, Copy, Eq, PartialEq, Ord, PartialOrd)]
+enum Verdict {
+    Allow,
+    Review,
+    Block,
+}
+
+impl Verdict {
+    const fn as_str(self) -> &'static str {
+        match self {
+            Self::Allow => "allow",
+            Self::Review => "review",
+            Self::Block => "block",
+        }
+    }
+}
+
+#[derive(Debug)]
+struct Change {
+    kind: &'static str,
+    key: RecordKey,
+    old_ttl: Option<u32>,
+    new_ttl: Option<u32>,
+}
+
+#[derive(Debug)]
+struct Finding {
+    code: &'static str,
+    verdict: Verdict,
+    owner: String,
+    record_types: Vec<String>,
+    detail: String,
+}
+
+#[derive(Debug)]
+pub struct ZoneReport {
+    zone: String,
+    old_baseline: String,
+    new_baseline: String,
+    verdict: Verdict,
+    changes: Vec<Change>,
+    findings: Vec<Finding>,
+}
+
+#[derive(Debug)]
+pub struct Report {
+    overall: Verdict,
+    zones: Vec<ZoneReport>,
+}
+
+impl Report {
+    pub fn new(zones: Vec<ZoneReport>) -> Self {
+        let overall = zones
+            .iter()
+            .map(|zone| zone.verdict)
+            .max()
+            .unwrap_or(Verdict::Allow);
+        Self { overall, zones }
+    }
+
+    pub const fn is_blocked(&self) -> bool {
+        matches!(self.overall, Verdict::Block)
+    }
+
+    pub fn to_json(&self) -> String {
+        let mut output = String::new();
+        write!(
+            output,
+            "{{\"schema_version\":1,\"overall_verdict\":\"{}\",\"zones\":[",
+            self.overall.as_str()
+        )
+        .expect("write to string");
+        for (zone_index, zone) in self.zones.iter().enumerate() {
+            if zone_index != 0 {
+                output.push(',');
+            }
+            write!(
+                output,
+                "{{\"zone\":\"{}\",\"verdict\":\"{}\",\"baseline\":{{\"old\":\"{}\",\"new\":\"{}\"}},\"changes\":[",
+                json(&zone.zone),
+                zone.verdict.as_str(),
+                json(&zone.old_baseline),
+                json(&zone.new_baseline)
+            )
+            .expect("write to string");
+            for (change_index, change) in zone.changes.iter().enumerate() {
+                if change_index != 0 {
+                    output.push(',');
+                }
+                write!(
+                    output,
+                    "{{\"kind\":\"{}\",\"owner\":\"{}\",\"type\":\"{}\",\"rdata\":\"{}\",\"old_ttl\":{},\"new_ttl\":{}}}",
+                    change.kind,
+                    json(&change.key.owner),
+                    json(&change.key.record_type),
+                    json(&change.key.rdata),
+                    optional_number(change.old_ttl),
+                    optional_number(change.new_ttl)
+                )
+                .expect("write to string");
+            }
+            output.push_str("],\"findings\":[");
+            for (finding_index, finding) in zone.findings.iter().enumerate() {
+                if finding_index != 0 {
+                    output.push(',');
+                }
+                write!(
+                    output,
+                    "{{\"code\":\"{}\",\"verdict\":\"{}\",\"owner\":\"{}\",\"record_types\":[",
+                    finding.code,
+                    finding.verdict.as_str(),
+                    json(&finding.owner)
+                )
+                .expect("write to string");
+                for (type_index, record_type) in finding.record_types.iter().enumerate() {
+                    if type_index != 0 {
+                        output.push(',');
+                    }
+                    write!(output, "\"{}\"", json(record_type)).expect("write to string");
+                }
+                write!(output, "],\"detail\":\"{}\"}}", json(&finding.detail))
+                    .expect("write to string");
+            }
+            output.push_str("]}");
+        }
+        output.push_str("]}\n");
+        output
+    }
+}
+
+pub fn compare_zone(
+    selected: &ZonePolicy,
+    old: &ZoneData,
+    new: &ZoneData,
+    limits: &Limits,
+) -> ZoneReport {
+    let mut changes = Vec::new();
+    for (key, ttl) in &old.records {
+        match new.records.get(key) {
+            None => changes.push(Change {
+                kind: "removal",
+                key: key.clone(),
+                old_ttl: Some(*ttl),
+                new_ttl: None,
+            }),
+            Some(new_ttl) if new_ttl != ttl => changes.push(Change {
+                kind: "ttl",
+                key: key.clone(),
+                old_ttl: Some(*ttl),
+                new_ttl: Some(*new_ttl),
+            }),
+            Some(_) => {}
+        }
+    }
+    for (key, ttl) in &new.records {
+        if !old.records.contains_key(key) {
+            changes.push(Change {
+                kind: "addition",
+                key: key.clone(),
+                old_ttl: None,
+                new_ttl: Some(*ttl),
+            });
+        }
+    }
+    changes.sort_by(|left, right| {
+        (
+            &left.key.owner,
+            &left.key.record_type,
+            &left.key.rdata,
+            left.kind,
+        )
+            .cmp(&(
+                &right.key.owner,
+                &right.key.record_type,
+                &right.key.rdata,
+                right.kind,
+            ))
+    });
+
+    let mut findings = Vec::new();
+    if selected.old_baseline != "PASS" || selected.new_baseline != "PASS" {
+        findings.push(Finding {
+            code: "BASELINE_FAILURE",
+            verdict: Verdict::Block,
+            owner: selected.zone.clone(),
+            record_types: Vec::new(),
+            detail: format!(
+                "named-checkzone old={} new={}; a baseline failure cannot be allowed",
+                selected.old_baseline, selected.new_baseline
+            ),
+        });
+    }
+    check_apex(selected, new, &mut findings);
+    check_aliases(new, &mut findings);
+    check_ttls(&changes, limits, &mut findings);
+    if !changes.is_empty() {
+        check_soa(selected, old, new, &mut findings);
+    }
+    check_delegations(selected, old, new, &mut findings);
+    findings.sort_by(|left, right| {
+        (
+            left.owner.as_str(),
+            left.code,
+            &left.record_types,
+            left.detail.as_str(),
+        )
+            .cmp(&(
+                right.owner.as_str(),
+                right.code,
+                &right.record_types,
+                right.detail.as_str(),
+            ))
+    });
+    let verdict = findings
+        .iter()
+        .map(|finding| finding.verdict)
+        .max()
+        .unwrap_or(Verdict::Allow);
+    ZoneReport {
+        zone: selected.zone.clone(),
+        old_baseline: selected.old_baseline.clone(),
+        new_baseline: selected.new_baseline.clone(),
+        verdict,
+        changes,
+        findings,
+    }
+}
+
+fn check_apex(selected: &ZonePolicy, new: &ZoneData, findings: &mut Vec<Finding>) {
+    let soa_count = new
+        .records
+        .keys()
+        .filter(|key| key.owner == selected.zone && key.record_type == "SOA")
+        .count();
+    if soa_count != 1 {
+        findings.push(Finding {
+            code: "APEX_SOA_COUNT",
+            verdict: Verdict::Block,
+            owner: selected.zone.clone(),
+            record_types: vec!["SOA".to_string()],
+            detail: format!("apex requires exactly one canonical SOA record; found {soa_count}"),
+        });
+    }
+    let ns_count = new
+        .records
+        .keys()
+        .filter(|key| key.owner == selected.zone && key.record_type == "NS")
+        .count();
+    if ns_count == 0 {
+        findings.push(Finding {
+            code: "APEX_NS_MISSING",
+            verdict: Verdict::Block,
+            owner: selected.zone.clone(),
+            record_types: vec!["NS".to_string()],
+            detail: "apex requires at least one NS record".to_string(),
+        });
+    }
+}
+
+fn check_aliases(new: &ZoneData, findings: &mut Vec<Finding>) {
+    let mut owners: BTreeMap<&str, BTreeSet<&str>> = BTreeMap::new();
+    for key in new.records.keys() {
+        owners
+            .entry(&key.owner)
+            .or_default()
+            .insert(&key.record_type);
+    }
+    for (owner, types) in owners {
+        if types.contains("CNAME") && types.len() > 1 {
+            findings.push(Finding {
+                code: "CNAME_COEXISTENCE",
+                verdict: Verdict::Block,
+                owner: owner.to_string(),
+                record_types: types.into_iter().map(str::to_string).collect(),
+                detail: "CNAME owner also has other data".to_string(),
+            });
+        }
+    }
+}
+
+fn check_ttls(changes: &[Change], limits: &Limits, findings: &mut Vec<Finding>) {
+    for change in changes {
+        if let ("ttl", Some(old), Some(new)) = (change.kind, change.old_ttl, change.new_ttl) {
+            let permitted_drop = u64::from(old) * u64::from(limits.ttl_decrease_percent) / 100;
+            if new < old && u64::from(old - new) > permitted_drop {
+                findings.push(Finding {
+                    code: "TTL_DECREASE",
+                    verdict: Verdict::Block,
+                    owner: change.key.owner.clone(),
+                    record_types: vec![change.key.record_type.clone()],
+                    detail: format!(
+                        "TTL decreased from {old} to {new}, beyond {}% policy",
+                        limits.ttl_decrease_percent
+                    ),
+                });
+            }
+        }
+    }
+}
+
+fn check_soa(selected: &ZonePolicy, old: &ZoneData, new: &ZoneData, findings: &mut Vec<Finding>) {
+    let old_serial = soa_serial(&old.records, &selected.zone);
+    let new_serial = soa_serial(&new.records, &selected.zone);
+    let (Some(old_serial), Some(new_serial)) = (old_serial, new_serial) else {
+        return;
+    };
+    let delta = new_serial.wrapping_sub(old_serial);
+    let (code, verdict, detail) = if delta == 0 {
+        (
+            "SOA_EQUAL",
+            Verdict::Block,
+            format!("SOA serial did not advance from {old_serial}"),
+        )
+    } else if delta == 1_u32 << 31 {
+        (
+            "SOA_HALF_RANGE_AMBIGUOUS",
+            Verdict::Review,
+            format!("SOA serial {old_serial} to {new_serial} is RFC 1982 half-range ambiguous"),
+        )
+    } else if delta < 1_u32 << 31 {
+        (
+            "SOA_ADVANCE",
+            Verdict::Allow,
+            format!("SOA serial advanced from {old_serial} to {new_serial}"),
+        )
+    } else {
+        (
+            "SOA_REGRESSION",
+            Verdict::Block,
+            format!("SOA serial regressed from {old_serial} to {new_serial}"),
+        )
+    };
+    findings.push(Finding {
+        code,
+        verdict,
+        owner: selected.zone.clone(),
+        record_types: vec!["SOA".to_string()],
+        detail,
+    });
+}
+
+fn soa_serial(records: &BTreeMap<RecordKey, u32>, zone: &str) -> Option<u32> {
+    let mut matching = records
+        .keys()
+        .filter(|key| key.owner == zone && key.record_type == "SOA");
+    let key = matching.next()?;
+    if matching.next().is_some() {
+        return None;
+    }
+    key.rdata.split_whitespace().nth(2)?.parse().ok()
+}
+
+fn check_delegations(
+    selected: &ZonePolicy,
+    old: &ZoneData,
+    new: &ZoneData,
+    findings: &mut Vec<Finding>,
+) {
+    let old_ns = delegation_records(&old.records, &selected.zone);
+    let new_ns = delegation_records(&new.records, &selected.zone);
+    for key in old_ns.difference(&new_ns) {
+        findings.push(Finding {
+            code: "DELEGATION_REMOVAL",
+            verdict: Verdict::Review,
+            owner: key.owner.clone(),
+            record_types: vec!["NS".to_string()],
+            detail: format!("delegation name server {} was removed", key.rdata),
+        });
+    }
+    for key in new_ns.difference(&old_ns) {
+        findings.push(Finding {
+            code: "DELEGATION_ADDITION",
+            verdict: Verdict::Review,
+            owner: key.owner.clone(),
+            record_types: vec!["NS".to_string()],
+            detail: format!("delegation name server {} was added", key.rdata),
+        });
+    }
+    for key in &new_ns {
+        let target = &key.rdata;
+        let in_bailiwick = is_at_or_below(target, &key.owner);
+        let old_families = address_families(&old.records, target);
+        let new_families = address_families(&new.records, target);
+        if in_bailiwick && new_families.is_empty() {
+            findings.push(Finding {
+                code: if old_families.is_empty() {
+                    "MISSING_GLUE"
+                } else {
+                    "REMOVED_LAST_GLUE"
+                },
+                verdict: Verdict::Block,
+                owner: key.owner.clone(),
+                record_types: vec!["NS".to_string(), "A".to_string(), "AAAA".to_string()],
+                detail: format!("in-bailiwick name server {target} has no parent glue address"),
+            });
+        } else if in_bailiwick && !old_families.is_empty() && old_families != new_families {
+            findings.push(Finding {
+                code: "GLUE_FAMILY_CHANGE",
+                verdict: Verdict::Allow,
+                owner: key.owner.clone(),
+                record_types: new_families.into_iter().map(str::to_string).collect(),
+                detail: format!("name server {target} retains at least one glue address family"),
+            });
+        } else if !in_bailiwick && new_families.is_empty() {
+            findings.push(Finding {
+                code: "OUT_OF_BAILIWICK_NO_GLUE",
+                verdict: Verdict::Allow,
+                owner: key.owner.clone(),
+                record_types: vec!["NS".to_string()],
+                detail: format!("out-of-bailiwick name server {target} requires no parent glue"),
+            });
+        }
+    }
+}
+
+fn delegation_records<'a>(
+    records: &'a BTreeMap<RecordKey, u32>,
+    zone: &str,
+) -> BTreeSet<&'a RecordKey> {
+    records
+        .keys()
+        .filter(|key| key.record_type == "NS" && key.owner != zone)
+        .collect()
+}
+
+fn address_families<'a>(records: &'a BTreeMap<RecordKey, u32>, owner: &str) -> BTreeSet<&'a str> {
+    records
+        .keys()
+        .filter(|key| key.owner == owner && matches!(key.record_type.as_str(), "A" | "AAAA"))
+        .map(|key| key.record_type.as_str())
+        .collect()
+}
+
+fn is_at_or_below(name: &str, parent: &str) -> bool {
+    name == parent
+        || (name.ends_with(parent)
+            && name.as_bytes().get(name.len() - parent.len() - 1) == Some(&b'.'))
+}
+
+fn json(value: &str) -> String {
+    let mut output = String::new();
+    for character in value.chars() {
+        match character {
+            '"' => output.push_str("\\\""),
+            '\\' => output.push_str("\\\\"),
+            '\n' => output.push_str("\\n"),
+            '\r' => output.push_str("\\r"),
+            '\t' => output.push_str("\\t"),
+            value if value <= '\u{1f}' => {
+                write!(output, "\\u{:04x}", u32::from(value)).expect("write to string");
+            }
+            value => output.push(value),
+        }
+    }
+    output
+}
+
+fn optional_number(value: Option<u32>) -> String {
+    value.map_or_else(|| "null".to_string(), |number| number.to_string())
+}
diff --git a/developer-simulation/runs/2026-08-12--dns-change-gate/tests/black_box.rs b/developer-simulation/runs/2026-08-12--dns-change-gate/tests/black_box.rs
new file mode 100644
index 0000000..fa23601
--- /dev/null
+++ b/developer-simulation/runs/2026-08-12--dns-change-gate/tests/black_box.rs
@@ -0,0 +1,934 @@
+use std::fs;
+use std::path::{Path, PathBuf};
+use std::process::{Command, Output};
+use std::sync::atomic::{AtomicU64, Ordering};
+
+static NEXT_ID: AtomicU64 = AtomicU64::new(0);
+
+struct Case {
+    root: PathBuf,
+    old: PathBuf,
+    new: PathBuf,
+    policy: PathBuf,
+    output: PathBuf,
+}
+
+impl Case {
+    fn new(name: &str) -> Self {
+        let id = NEXT_ID.fetch_add(1, Ordering::Relaxed);
+        let root = PathBuf::from(env!("CARGO_MANIFEST_DIR"))
+            .join("target")
+            .join("black-box")
+            .join(format!("{name}-{}-{id}", std::process::id()));
+        let old = root.join("old");
+        let new = root.join("new");
+        fs::create_dir_all(&old).expect("create old root");
+        fs::create_dir_all(&new).expect("create new root");
+        Self {
+            policy: root.join("policy.conf"),
+            output: root.join("report.json"),
+            root,
+            old,
+            new,
+        }
+    }
+
+    fn zone(&self, snapshot: &Path, contents: &str) {
+        assert!(
+            snapshot.starts_with(&self.root),
+            "fixture write escaped case root"
+        );
+        fs::write(snapshot.join("example.zone"), contents).expect("write zone");
+    }
+
+    fn policy(&self, extra: &str) {
+        let base = concat!(
+            "max_records_total=2500000\n",
+            "max_records_per_zone=250000\n",
+            "max_include_depth=32\n",
+            "max_generate_records=100000\n",
+            "ttl_decrease_percent=50\n",
+            "zone=example.test.|example.zone|PASS|PASS\n",
+        );
+        fs::write(&self.policy, format!("{base}{extra}")).expect("write policy");
+    }
+
+    fn raw_policy(&self, text: &str) {
+        fs::write(&self.policy, text).expect("write policy");
+    }
+
+    fn run(&self) -> Output {
+        self.run_to(&self.output)
+    }
+
+    fn run_to(&self, output: &Path) -> Output {
+        Command::new(env!("CARGO_BIN_EXE_dns-change-gate"))
+            .args([
+                "--old-root",
+                self.old.to_str().expect("old path"),
+                "--new-root",
+                self.new.to_str().expect("new path"),
+                "--policy",
+                self.policy.to_str().expect("policy path"),
+                "--output",
+                output.to_str().expect("output path"),
+            ])
+            .output()
+            .expect("run gate")
+    }
+
+    fn run_with_fault(&self, fault: &str) -> Output {
+        Command::new(env!("CARGO_BIN_EXE_dns-change-gate"))
+            .args([
+                "--old-root",
+                self.old.to_str().expect("old path"),
+                "--new-root",
+                self.new.to_str().expect("new path"),
+                "--policy",
+                self.policy.to_str().expect("policy path"),
+                "--output",
+                self.output.to_str().expect("output path"),
+            ])
+            .env("DNS_GATE_FAULT", fault)
+            .output()
+            .expect("run gate with fault")
+    }
+}
+
+impl Drop for Case {
+    fn drop(&mut self) {
+        let _ = fs::remove_dir_all(&self.root);
+    }
+}
+
+const OLD: &str = r#"$ORIGIN example.test.
+$TTL 1h
+@ IN SOA ns1 hostmaster ( 4294967295 1h 15m 1w 5m )
+@ IN NS ns1
+ns1 IN A 192.0.2.1
+www 300 IN A 192.0.2.10
+child IN NS ns.child
+ns.child IN A 192.0.2.53
+mail IN MX 10 mx
+mx IN AAAA 2001:db8::1
+text IN TXT "one" "two"
+"#;
+
+const NEW: &str = r#"$TTL 3600
+$ORIGIN example.test.
+text IN TXT "one" "two"
+@ IN SOA ns1.example.test. hostmaster.example.test. ( 0 3600 900 604800 300 )
+@ NS ns1
+ns1 A 192.0.2.1
+www 5m A 192.0.2.11
+child NS ns.child
+ns.child A 192.0.2.53
+mail MX 10 mx
+mx AAAA 2001:db8:0:0:0:0:0:1
+"#;
+
+#[test]
+fn valid_change_report_is_canonical_and_deterministic() {
+    let case = Case::new("canonical");
+    case.zone(&case.old, OLD);
+    case.zone(&case.new, NEW);
+    case.policy("");
+
+    let first = case.run();
+    assert!(
+        first.status.success(),
+        "stderr: {}",
+        String::from_utf8_lossy(&first.stderr)
+    );
+    let report = fs::read_to_string(&case.output).expect("published report");
+    assert!(report.ends_with('\n'));
+    assert!(report.contains("\"overall_verdict\":\"allow\""));
+    assert!(
+        report.contains("\"owner\":\"www.example.test.\",\"type\":\"A\",\"rdata\":\"192.0.2.10\"")
+    );
+    assert!(
+        report.contains("\"owner\":\"www.example.test.\",\"type\":\"A\",\"rdata\":\"192.0.2.11\"")
+    );
+    assert!(report.contains("\"code\":\"SOA_ADVANCE\""));
+    assert!(
+        !report.contains("TTL_DECREASE"),
+        "300 to 300 is not a TTL change"
+    );
+
+    let first_bytes = fs::read(&case.output).expect("first report bytes");
+    let second = case.run();
+    assert!(second.status.success());
+    assert_eq!(
+        first_bytes,
+        fs::read(&case.output).expect("second report bytes")
+    );
+}
+
+#[test]
+fn reorder_duplicates_omitted_owners_and_escaped_labels_have_no_change() {
+    let case = Case::new("reorder");
+    let old = concat!(
+        "$ORIGIN example.test.\n$TTL 1h\n",
+        "@ SOA ns hostmaster 7 1h 15m 1w 5m\n",
+        "@ NS ns\nns A 192.0.2.1\n",
+        "odd\\046label A 192.0.2.2\n",
+        "  AAAA 2001:db8::2\n",
+        "txt TXT \"a\" \"b\"\n",
+    );
+    let new = concat!(
+        "$TTL 3600\n$ORIGIN example.test.\n",
+        "txt TXT \"a\" \"b\"\n",
+        "odd\\046label AAAA 2001:db8:0:0:0:0:0:2\n",
+        "odd\\046label A 192.0.2.2\n",
+        "odd\\046label A 192.0.2.2 ; exact duplicate\n",
+        "@ NS ns.example.test.\n",
+        "ns A 192.0.2.1\n",
+        "@ SOA ns.example.test. hostmaster.example.test. 7 3600 900 604800 300\n",
+    );
+    case.zone(&case.old, old);
+    case.zone(&case.new, new);
+    case.policy("");
+    let result = case.run();
+    assert!(
+        result.status.success(),
+        "stderr: {}",
+        String::from_utf8_lossy(&result.stderr)
+    );
+    let report = fs::read_to_string(&case.output).expect("report");
+    assert!(report.contains("\"changes\":[]"));
+    assert!(!report.contains("SOA_EQUAL"));
+}
+
+#[test]
+fn semantic_blocks_and_reviews_are_reported_with_exact_evidence() {
+    let cases = [
+        (
+            "alias",
+            "@ SOA ns hostmaster 8 1h 15m 1w 5m\n@ NS ns\nns A 192.0.2.1\nbad CNAME target\nbad MX 10 mail\n",
+            "CNAME_COEXISTENCE",
+            "bad.example.test.",
+        ),
+        (
+            "missing-apex-ns",
+            "@ SOA ns hostmaster 8 1h 15m 1w 5m\nns A 192.0.2.1\n",
+            "APEX_NS_MISSING",
+            "example.test.",
+        ),
+        (
+            "removed-glue",
+            "@ SOA ns hostmaster 8 1h 15m 1w 5m\n@ NS ns\nns A 192.0.2.1\nchild NS ns.child\n",
+            "REMOVED_LAST_GLUE",
+            "child.example.test.",
+        ),
+    ];
+    for (name, new_body, code, owner) in cases {
+        let case = Case::new(name);
+        case.zone(&case.old, OLD);
+        case.zone(
+            &case.new,
+            &format!("$ORIGIN example.test.\n$TTL 1h\n{new_body}"),
+        );
+        case.policy("");
+        let result = case.run();
+        assert_eq!(
+            result.status.code(),
+            Some(2),
+            "{name}: {}",
+            String::from_utf8_lossy(&result.stderr)
+        );
+        let report = fs::read_to_string(&case.output).expect("blocking semantic report");
+        assert!(
+            report.contains(&format!("\"code\":\"{code}\"")),
+            "{name}: {report}"
+        );
+        assert!(report.contains(owner), "{name}: {report}");
+    }
+
+    let case = Case::new("half-range");
+    case.zone(&case.old, &minimal_zone(1, "child NS ns.external.test.\n"));
+    case.zone(
+        &case.new,
+        &minimal_zone(2_147_483_649, "child NS ns.external.test.\n"),
+    );
+    case.policy("");
+    let result = case.run();
+    assert!(
+        result.status.success(),
+        "review is published with zero exit: {}",
+        String::from_utf8_lossy(&result.stderr)
+    );
+    let report = fs::read_to_string(&case.output).expect("review report");
+    assert!(report.contains("\"overall_verdict\":\"review\""));
+    assert!(report.contains("SOA_HALF_RANGE_AMBIGUOUS"));
+    assert!(report.contains("OUT_OF_BAILIWICK_NO_GLUE"));
+}
+
+#[test]
+fn soa_serial_boundaries_match_literal_oracle() {
+    let oracle = [
+        (10, 11, "SOA_ADVANCE", 0),
+        (u32::MAX, 0, "SOA_ADVANCE", 0),
+        (10, 10, "SOA_EQUAL", 2),
+        (10, 9, "SOA_REGRESSION", 2),
+        (0, 1_u32 << 31, "SOA_HALF_RANGE_AMBIGUOUS", 0),
+    ];
+    for (old_serial, new_serial, code, status) in oracle {
+        let case = Case::new(code);
+        case.zone(&case.old, &minimal_zone(old_serial, "www A 192.0.2.1\n"));
+        case.zone(&case.new, &minimal_zone(new_serial, "www A 192.0.2.2\n"));
+        case.policy("");
+        let result = case.run();
+        assert_eq!(
+            result.status.code(),
+            Some(status),
+            "{code}: {}",
+            String::from_utf8_lossy(&result.stderr)
+        );
+        let report = fs::read_to_string(&case.output).expect("serial report");
+        assert!(report.contains(&format!("\"code\":\"{code}\"")), "{report}");
+    }
+}
+
+#[test]
+fn parser_and_containment_failures_preserve_previous_report() {
+    let malformed = [
+        (
+            "unterminated",
+            "@ SOA ns hostmaster ( 2 1h 15m 1w 5m\n",
+            "E_UNTERMINATED_PAREN",
+        ),
+        (
+            "bad-ip",
+            "@ SOA ns hostmaster 2 1h 15m 1w 5m\n@ NS ns\nns A 999.2.3.4\n",
+            "E_RDATA",
+        ),
+        (
+            "unknown-field",
+            "@ SOA ns hostmaster 2 1h 15m 1w 5m\n@ NS ns\nns CHAOS A 192.0.2.1\n",
+            "E_FIELD",
+        ),
+        (
+            "soa-width",
+            "@ SOA ns hostmaster 4294967296 1h 15m 1w 5m\n@ NS ns\nns A 192.0.2.1\n",
+            "E_INTEGER_WIDTH",
+        ),
+    ];
+    for (name, body, code) in malformed {
+        let case = Case::new(name);
+        case.zone(&case.old, OLD);
+        case.zone(
+            &case.new,
+            &format!("$ORIGIN example.test.\n$TTL 1h\n{body}"),
+        );
+        case.policy("");
+        fs::write(&case.output, b"OLD-COMPLETE\n").expect("sentinel report");
+        let result = case.run();
+        assert_eq!(result.status.code(), Some(1), "{name}");
+        let stderr = String::from_utf8_lossy(&result.stderr);
+        assert!(stderr.contains(code), "{name}: {stderr}");
+        assert!(stderr.contains("example.zone:"), "{name}: {stderr}");
+        assert_eq!(
+            fs::read(&case.output).expect("old report"),
+            b"OLD-COMPLETE\n"
+        );
+    }
+
+    let include_cases = [
+        ("parent", "$INCLUDE ../sentinel\n", "E_INCLUDE_ESCAPE"),
+        ("absolute", "$INCLUDE /etc/passwd\n", "E_INCLUDE_ABSOLUTE"),
+        ("missing", "$INCLUDE absent.zone\n", "E_INCLUDE_MISSING"),
+        ("cycle", "$INCLUDE example.zone\n", "E_INCLUDE_CYCLE"),
+    ];
+    for (name, directive, code) in include_cases {
+        let case = Case::new(name);
+        case.zone(&case.old, OLD);
+        case.zone(&case.new, directive);
+        case.policy("");
+        fs::write(&case.output, b"OLD-COMPLETE\n").expect("sentinel report");
+        let result = case.run();
+        assert_eq!(result.status.code(), Some(1), "{name}");
+        assert!(String::from_utf8_lossy(&result.stderr).contains(code));
+        assert_eq!(
+            fs::read(&case.output).expect("old report"),
+            b"OLD-COMPLETE\n"
+        );
+    }
+}
+
+#[cfg(unix)]
+#[test]
+fn symlink_escape_is_rejected_before_target_contents_are_read() {
+    use std::os::unix::fs::{PermissionsExt, symlink};
+
+    let case = Case::new("symlink");
+    case.zone(&case.old, OLD);
+    let sentinel = case.root.join("outside-sentinel");
+    fs::write(&sentinel, b"SECRET-MUST-NOT-BE-PARSED\n").expect("outside sentinel");
+    let accessed_before = fs::metadata(&sentinel).and_then(|metadata| metadata.accessed());
+    fs::set_permissions(&sentinel, fs::Permissions::from_mode(0o000))
+        .expect("make sentinel unreadable");
+    symlink(&sentinel, case.new.join("linked.zone")).expect("symlink");
+    case.zone(&case.new, "$INCLUDE linked.zone\n");
+    case.policy("");
+    let result = case.run();
+    assert_eq!(result.status.code(), Some(1));
+    assert!(String::from_utf8_lossy(&result.stderr).contains("E_INCLUDE_SYMLINK"));
+    fs::set_permissions(&sentinel, fs::Permissions::from_mode(0o600))
+        .expect("restore sentinel permission");
+    if let (Ok(before), Ok(after)) = (
+        accessed_before,
+        fs::metadata(&sentinel).and_then(|metadata| metadata.accessed()),
+    ) {
+        assert_eq!(before, after, "sentinel contents must not be opened");
+    }
+    assert_eq!(
+        fs::read(&sentinel).expect("sentinel unchanged"),
+        b"SECRET-MUST-NOT-BE-PARSED\n"
+    );
+    assert!(!case.output.exists());
+}
+
+#[test]
+fn generate_and_nested_include_limits_block_without_truncation() {
+    let case = Case::new("generate-limit");
+    case.zone(&case.old, OLD);
+    case.zone(
+        &case.new,
+        "$ORIGIN example.test.\n$TTL 1h\n$GENERATE 1-4 host$ A 192.0.2.1\n",
+    );
+    case.raw_policy(concat!(
+        "max_records_total=20\nmax_records_per_zone=10\nmax_include_depth=2\n",
+        "max_generate_records=3\nttl_decrease_percent=50\n",
+        "zone=example.test.|example.zone|PASS|PASS\n",
+    ));
+    let result = case.run();
+    assert_eq!(result.status.code(), Some(1));
+    assert!(String::from_utf8_lossy(&result.stderr).contains("E_GENERATE_LIMIT"));
+    assert!(!case.output.exists());
+
+    let case = Case::new("zone-limit");
+    case.zone(&case.old, OLD);
+    case.zone(
+        &case.new,
+        "$ORIGIN example.test.\n$TTL 1h\n$INCLUDE one.inc\n",
+    );
+    fs::write(
+        case.new.join("one.inc"),
+        "$INCLUDE two.inc\na A 192.0.2.1\n",
+    )
+    .expect("include one");
+    fs::write(case.new.join("two.inc"), "b A 192.0.2.2\nc A 192.0.2.3\n").expect("include two");
+    case.raw_policy(concat!(
+        "max_records_total=100\nmax_records_per_zone=2\nmax_include_depth=3\n",
+        "max_generate_records=10\nttl_decrease_percent=50\n",
+        "zone=example.test.|example.zone|PASS|PASS\n",
+    ));
+    let result = case.run();
+    assert_eq!(result.status.code(), Some(1));
+    assert!(String::from_utf8_lossy(&result.stderr).contains("E_ZONE_LIMIT"));
+    assert!(!case.output.exists());
+}
+
+#[test]
+fn include_depth_limit_blocks_before_deeper_file_is_parsed() {
+    let case = Case::new("include-depth");
+    case.zone(&case.old, OLD);
+    case.zone(
+        &case.new,
+        "$ORIGIN example.test.\n$TTL 1h\n$INCLUDE one.inc\n",
+    );
+    fs::write(case.new.join("one.inc"), "$INCLUDE two.inc\n").expect("first include");
+    fs::write(case.new.join("two.inc"), "$INCLUDE three.inc\n").expect("second include");
+    fs::write(case.new.join("three.inc"), "bomb A 999.999.999.999\n").expect("unreached file");
+    case.raw_policy(concat!(
+        "max_records_total=100\nmax_records_per_zone=100\nmax_include_depth=2\n",
+        "max_generate_records=10\nttl_decrease_percent=50\n",
+        "zone=example.test.|example.zone|PASS|PASS\n",
+    ));
+    let started = std::time::Instant::now();
+    let result = case.run();
+    assert!(started.elapsed() < std::time::Duration::from_secs(2));
+    assert_eq!(result.status.code(), Some(1));
+    let stderr = String::from_utf8_lossy(&result.stderr);
+    assert!(stderr.contains("E_INCLUDE_DEPTH"), "{stderr}");
+    assert!(
+        !stderr.contains("E_RDATA"),
+        "deeper malformed content was parsed: {stderr}"
+    );
+    assert!(!case.output.exists());
+}
+
+#[test]
+fn baseline_failure_can_never_become_allow() {
+    let case = Case::new("baseline");
+    case.zone(&case.old, OLD);
+    case.zone(&case.new, NEW);
+    case.raw_policy(concat!(
+        "max_records_total=2500000\nmax_records_per_zone=250000\nmax_include_depth=32\n",
+        "max_generate_records=100000\nttl_decrease_percent=50\n",
+        "zone=example.test.|example.zone|OLD_OK|NEW_NAMED_CHECKZONE_FAIL\n",
+    ));
+    let result = case.run();
+    assert_eq!(result.status.code(), Some(2));
+    let report = fs::read_to_string(&case.output).expect("baseline block report");
+    assert!(report.contains("BASELINE_FAILURE"));
+    assert!(report.contains("OLD_OK"));
+    assert!(report.contains("NEW_NAMED_CHECKZONE_FAIL"));
+}
+
+#[test]
+fn publication_faults_leave_old_complete_report_then_rerun_replaces_it() {
+    let case = Case::new("publication");
+    case.zone(&case.old, OLD);
+    case.zone(&case.new, NEW);
+    case.policy("");
+    for fault in ["after-temp", "after-flush"] {
+        fs::write(&case.output, b"{\"old\":true}\n").expect("old report");
+        let result = case.run_with_fault(fault);
+        assert!(matches!(result.status.code(), Some(86 | 87)));
+        assert_eq!(
+            fs::read(&case.output).expect("complete old report"),
+            b"{\"old\":true}\n"
+        );
+    }
+    let result = case.run();
+    assert!(result.status.success());
+    let report = fs::read_to_string(&case.output).expect("new report");
+    assert!(report.starts_with("{\"schema_version\":1,"));
+    assert!(report.ends_with("}\n"));
+}
+
+#[test]
+fn preexisting_temp_collision_survives_repeated_publication_without_owned_residue() {
+    let case = Case::new("temp-collision");
+    case.zone(&case.old, OLD);
+    case.zone(&case.new, NEW);
+    case.policy("");
+    let marker = case.root.join("collision-path");
+    let first = Command::new("sh")
+        .args([
+            "-c",
+            concat!(
+                "collision=\"$OUTPUT_PARENT/.$OUTPUT_NAME.tmp-$$-00000000000000000000000000000001-0000000000000000-000\"\n",
+                "printf '%s' \"$collision\" > \"$MARKER\"\n",
+                "printf 'DO-NOT-TOUCH\\n' > \"$collision\"\n",
+                "exec \"$BIN\" --old-root \"$OLD_ROOT\" --new-root \"$NEW_ROOT\" ",
+                "--policy \"$POLICY\" --output \"$OUTPUT\"\n",
+            ),
+        ])
+        .env("BIN", env!("CARGO_BIN_EXE_dns-change-gate"))
+        .env("OLD_ROOT", &case.old)
+        .env("NEW_ROOT", &case.new)
+        .env("POLICY", &case.policy)
+        .env("OUTPUT", &case.output)
+        .env("OUTPUT_PARENT", &case.root)
+        .env("OUTPUT_NAME", "report.json")
+        .env("MARKER", &marker)
+        .env("DNS_GATE_TEMP_NONCE", "1")
+        .output()
+        .expect("run with a pre-existing legacy temp entry");
+    assert!(
+        first.status.success(),
+        "stderr: {}",
+        String::from_utf8_lossy(&first.stderr)
+    );
+    let collision = PathBuf::from(fs::read_to_string(&marker).expect("collision marker"));
+    assert_eq!(
+        fs::read(&collision).expect("pre-existing entry remains"),
+        b"DO-NOT-TOUCH\n"
+    );
+
+    let second = case.run();
+    assert!(second.status.success());
+    let temp_entries = publication_temp_entries(&case.root);
+    assert_eq!(temp_entries, vec![collision]);
+}
+
+#[test]
+fn normal_publication_failure_removes_only_its_owned_temp_file() {
+    let case = Case::new("temp-cleanup");
+    case.zone(&case.old, OLD);
+    case.zone(&case.new, NEW);
+    case.policy("");
+    fs::create_dir(&case.output).expect("blocking output directory");
+    let sentinel = case.output.join("keep");
+    fs::write(&sentinel, b"KEEP\n").expect("output directory sentinel");
+
+    let result = case.run();
+    assert_eq!(result.status.code(), Some(1));
+    assert!(String::from_utf8_lossy(&result.stderr).contains("E_OUTPUT"));
+    assert_eq!(fs::read(&sentinel).expect("sentinel retained"), b"KEEP\n");
+    assert!(publication_temp_entries(&case.root).is_empty());
+}
+
+#[test]
+fn output_inside_input_snapshot_is_rejected_before_publication() {
+    let case = Case::new("output-in-snapshot");
+    case.zone(&case.old, OLD);
+    case.zone(&case.new, NEW);
+    case.policy("");
+    let aliased_output = case.old.join("example.zone");
+    let original = fs::read(&aliased_output).expect("original selected input");
+
+    let result = case.run_to(&aliased_output);
+    assert_eq!(result.status.code(), Some(1));
+    assert!(String::from_utf8_lossy(&result.stderr).contains("E_OUTPUT_ALIAS"));
+    assert_eq!(
+        fs::read(&aliased_output).expect("selected input retained"),
+        original
+    );
+}
+
+#[cfg(unix)]
+#[test]
+fn output_symlink_or_hard_link_to_selected_input_is_rejected_without_input_change() {
+    use std::os::unix::fs::symlink;
+
+    for target_kind in ["master", "include", "policy"] {
+        for link_kind in ["symlink", "hard-link"] {
+            let case = Case::new(&format!("{target_kind}-{link_kind}"));
+            case.zone(&case.old, &format!("{OLD}$INCLUDE extra.inc\n"));
+            case.zone(&case.new, &format!("{NEW}$INCLUDE extra.inc\n"));
+            fs::write(case.old.join("extra.inc"), "included A 192.0.2.77\n").expect("old include");
+            fs::write(case.new.join("extra.inc"), "included A 192.0.2.77\n").expect("new include");
+            case.policy("");
+            let selected_input = match target_kind {
+                "master" => case.old.join("example.zone"),
+                "include" => case.old.join("extra.inc"),
+                "policy" => case.policy.clone(),
+                _ => unreachable!(),
+            };
+            let original = fs::read(&selected_input).expect("original selected input");
+            let aliased_output = case.root.join("aliased-report.json");
+            if link_kind == "symlink" {
+                symlink(&selected_input, &aliased_output).expect("output symlink");
+            } else {
+                fs::hard_link(&selected_input, &aliased_output).expect("output hard link");
+            }
+
+            let result = case.run_to(&aliased_output);
+            assert_eq!(result.status.code(), Some(1), "{target_kind} {link_kind}");
+            assert!(
+                String::from_utf8_lossy(&result.stderr).contains("E_OUTPUT_ALIAS"),
+                "{target_kind} {link_kind}: {}",
+                String::from_utf8_lossy(&result.stderr)
+            );
+            assert_eq!(
+                fs::read(&selected_input).expect("selected input retained"),
+                original,
+                "{target_kind} {link_kind}"
+            );
+        }
+    }
+}
+
+#[test]
+fn output_equal_to_policy_is_rejected_without_overwriting_policy() {
+    let case = Case::new("output-is-policy");
+    case.zone(&case.old, OLD);
+    case.zone(&case.new, NEW);
+    case.policy("");
+    let original = fs::read(&case.policy).expect("original policy");
+
+    let result = case.run_to(&case.policy);
+    assert_eq!(result.status.code(), Some(1));
+    assert!(String::from_utf8_lossy(&result.stderr).contains("E_OUTPUT_ALIAS"));
+    assert_eq!(fs::read(&case.policy).expect("policy retained"), original);
+}
+
+#[test]
+fn include_inherits_ttl_optional_origin_and_generate_expands_declared_subset() {
+    let case = Case::new("include-success");
+    let root_zone = concat!(
+        "$ORIGIN example.test.\n$TTL 1h\n",
+        "@ SOA ns hostmaster 10 1h 15m 1w 5m\n@ NS ns\nns A 192.0.2.1\n",
+        "$INCLUDE records.inc delegated.example.test.\n",
+        "$GENERATE 1-3 host$ 5m A 192.0.2.9\n",
+    );
+    let old_include = concat!(
+        "@ NS ns\nns A 192.0.2.53\n",
+        "service SRV 10 20 443 target.example.test.\n",
+        "policy CAA 0 issue \"ca.example\"\n",
+        "key DS 12345 13 2 AABBCCDD\n",
+        "alias CNAME target.example.test.\n",
+        "target AAAA 2001:db8::9\n",
+    );
+    let new_include = concat!(
+        "@ NS ns\nns A 192.0.2.53\n",
+        "service SRV 10 20 8443 target.example.test.\n",
+        "policy CAA 0 issue \"new-ca.example\"\n",
+        "key DS 12345 13 2 EEFF0011\n",
+        "alias CNAME new-target.example.test.\n",
+        "target AAAA 2001:db8::10\n",
+    );
+    case.zone(&case.old, root_zone);
+    case.zone(
+        &case.new,
+        &root_zone
+            .replace(" 10 ", " 11 ")
+            .replace("192.0.2.9", "192.0.2.10"),
+    );
+    fs::write(case.old.join("records.inc"), old_include).expect("old include");
+    fs::write(case.new.join("records.inc"), new_include).expect("new include");
+    case.policy("");
+    let result = case.run();
+    assert!(
+        result.status.success(),
+        "stderr: {}",
+        String::from_utf8_lossy(&result.stderr)
+    );
+    let report = fs::read_to_string(&case.output).expect("include report");
+    assert!(report.contains("\"owner\":\"host3.example.test.\""));
+    assert!(report.contains("\"type\":\"SRV\""));
+    assert!(report.contains("\"type\":\"CAA\""));
+    assert!(report.contains("\"type\":\"DS\""));
+}
+
+#[test]
+fn maximal_and_stepped_generate_ranges_fail_bounded_without_replacing_report() {
+    let cases = [
+        ("max-u32", "$GENERATE 0-4294967295 host$ A 192.0.2.1\n"),
+        (
+            "stepped",
+            "$GENERATE 0-4294967295/4294967295 host$ A 192.0.2.1\n",
+        ),
+    ];
+    for (name, directive) in cases {
+        let case = Case::new(name);
+        case.zone(&case.old, OLD);
+        case.zone(
+            &case.new,
+            &format!("$ORIGIN example.test.\n$TTL 1h\n{directive}"),
+        );
+        case.raw_policy(concat!(
+            "max_records_total=100\nmax_records_per_zone=100\nmax_include_depth=3\n",
+            "max_generate_records=1\nttl_decrease_percent=50\n",
+            "zone=example.test.|example.zone|PASS|PASS\n",
+        ));
+        fs::write(&case.output, b"OLD-COMPLETE\n").expect("old report");
+        let started = std::time::Instant::now();
+        let result = case.run();
+        assert!(
+            started.elapsed() < std::time::Duration::from_secs(2),
+            "{name}"
+        );
+        assert_eq!(result.status.code(), Some(1), "{name}");
+        let stderr = String::from_utf8_lossy(&result.stderr);
+        assert!(stderr.contains("E_GENERATE_LIMIT"), "{name}: {stderr}");
+        assert!(
+            !stderr.to_ascii_lowercase().contains("panicked"),
+            "{name}: {stderr}"
+        );
+        assert_eq!(
+            fs::read(&case.output).expect("previous report remains"),
+            b"OLD-COMPLETE\n",
+            "{name}"
+        );
+    }
+}
+
+#[test]
+fn escaped_label_wire_length_uses_decoded_octets_and_has_exact_oracle() {
+    let case = Case::new("escaped-wire-length");
+    let old_label = "\\001".repeat(63);
+    let new_label = "\\002".repeat(63);
+    case.zone(
+        &case.old,
+        &minimal_zone(10, &format!("{old_label} A 192.0.2.9\n")),
+    );
+    case.zone(
+        &case.new,
+        &minimal_zone(11, &format!("{new_label} A 192.0.2.10\n")),
+    );
+    case.policy("");
+
+    let result = case.run();
+    assert!(
+        result.status.success(),
+        "stderr: {}",
+        String::from_utf8_lossy(&result.stderr)
+    );
+    let report = fs::read_to_string(&case.output).expect("escaped-label report");
+    let canonical_owner = format!("{}.example.test.", "\\\\002".repeat(63));
+    let old_canonical_owner = format!("{}.example.test.", "\\\\001".repeat(63));
+    assert!(
+        report.contains(&format!(
+            "\"kind\":\"addition\",\"owner\":\"{canonical_owner}\",\"type\":\"A\",\"rdata\":\"192.0.2.10\""
+        )),
+        "{report}"
+    );
+    assert!(
+        report.contains(&format!(
+            "\"kind\":\"removal\",\"owner\":\"{old_canonical_owner}\",\"type\":\"A\",\"rdata\":\"192.0.2.9\""
+        )),
+        "{report}"
+    );
+}
+
+#[test]
+fn ttl_glue_family_and_missing_soa_boundaries_match_policy() {
+    let case = Case::new("ttl-drop");
+    case.zone(&case.old, &minimal_zone(10, "www 1000 A 192.0.2.10\n"));
+    case.zone(&case.new, &minimal_zone(11, "www 400 A 192.0.2.10\n"));
+    case.policy("");
+    let result = case.run();
+    assert_eq!(result.status.code(), Some(2));
+    let report = fs::read_to_string(&case.output).expect("TTL report");
+    assert!(report.contains("TTL_DECREASE"));
+    assert!(report.contains("from 1000 to 400"));
+
+    let case = Case::new("second-family");
+    let old = minimal_zone(
+        10,
+        "child NS ns.child\nns.child A 192.0.2.53\nns.child AAAA 2001:db8::53\n",
+    );
+    let new = minimal_zone(11, "child NS ns.child\nns.child AAAA 2001:db8::53\n");
+    case.zone(&case.old, &old);
+    case.zone(&case.new, &new);
+    case.policy("");
+    let result = case.run();
+    assert!(result.status.success());
+    let report = fs::read_to_string(&case.output).expect("glue family report");
+    assert!(report.contains("GLUE_FAMILY_CHANGE"));
+    assert!(!report.contains("REMOVED_LAST_GLUE"));
+
+    let case = Case::new("missing-soa");
+    case.zone(&case.old, &minimal_zone(10, ""));
+    case.zone(
+        &case.new,
+        "$ORIGIN example.test.\n$TTL 1h\n@ NS ns\nns A 192.0.2.1\n",
+    );
+    case.policy("");
+    let result = case.run();
+    assert_eq!(result.status.code(), Some(2));
+    assert!(
+        fs::read_to_string(&case.output)
+            .expect("apex report")
+            .contains("APEX_SOA_COUNT")
+    );
+}
+
+#[test]
+fn overlong_escaped_label_and_total_limit_fail_closed() {
+    let case = Case::new("escaped-label");
+    case.zone(&case.old, OLD);
+    let label = "\\097".repeat(64);
+    case.zone(
+        &case.new,
+        &format!(
+            "$ORIGIN example.test.\n$TTL 1h\n@ SOA ns hostmaster 2 1h 15m 1w 5m\n@ NS ns\nns A 192.0.2.1\n{label} A 192.0.2.2\n"
+        ),
+    );
+    case.policy("");
+    let result = case.run();
+    assert_eq!(result.status.code(), Some(1));
+    assert!(String::from_utf8_lossy(&result.stderr).contains("E_LABEL_LENGTH"));
+    assert!(!case.output.exists());
+
+    let case = Case::new("total-limit");
+    case.zone(&case.old, &minimal_zone(1, ""));
+    case.zone(&case.new, &minimal_zone(2, ""));
+    case.raw_policy(concat!(
+        "max_records_total=2\nmax_records_per_zone=10\nmax_include_depth=3\n",
+        "max_generate_records=10\nttl_decrease_percent=50\n",
+        "zone=example.test.|example.zone|PASS|PASS\n",
+    ));
+    let result = case.run();
+    assert_eq!(result.status.code(), Some(1));
+    assert!(String::from_utf8_lossy(&result.stderr).contains("E_TOTAL_LIMIT"));
+    assert!(!case.output.exists());
+}
+
+#[test]
+fn twenty_seeded_record_permutations_are_byte_identical() {
+    let case = Case::new("permutations");
+    let fixed = [
+        "@ NS ns",
+        "ns A 192.0.2.1",
+        "a A 192.0.2.10",
+        "b AAAA 2001:db8::20",
+        "c MX 10 mail",
+        "mail A 192.0.2.30",
+        "d TXT \"left\" \"right\"",
+        "e CAA 0 issue \"ca.example\"",
+    ];
+    let mut expected: Option<Vec<u8>> = None;
+    for seed in 0..20_u64 {
+        let mut old_lines = fixed;
+        let mut new_lines = fixed;
+        permute(&mut old_lines, seed.wrapping_mul(17).wrapping_add(3));
+        permute(&mut new_lines, seed.wrapping_mul(31).wrapping_add(9));
+        let old = format!(
+            "$ORIGIN example.test.\n$TTL 1h\n@ SOA ns hostmaster 10 1h 15m 1w 5m\n{}\n",
+            old_lines.join("\n")
+        );
+        let new = format!(
+            "$TTL 3600\n$ORIGIN example.test.\n@ SOA ns hostmaster 11 3600 900 604800 300\n{}\n",
+            new_lines.join("\n")
+        );
+        case.zone(&case.old, &old);
+        case.zone(&case.new, &new);
+        case.policy("");
+        let result = case.run();
+        assert!(
+            result.status.success(),
+            "seed {seed}: {}",
+            String::from_utf8_lossy(&result.stderr)
+        );
+        let bytes = fs::read(&case.output).expect("permuted report");
+        if let Some(expected) = &expected {
+            assert_eq!(&bytes, expected, "seed {seed}");
+        } else {
+            expected = Some(bytes);
+        }
+    }
+}
+
+#[test]
+fn total_expansion_limit_is_applied_independently_to_each_snapshot() {
+    let case = Case::new("snapshot-total");
+    case.zone(&case.old, &minimal_zone(1, ""));
+    case.zone(&case.new, &minimal_zone(1, ""));
+    case.raw_policy(concat!(
+        "max_records_total=3\nmax_records_per_zone=3\nmax_include_depth=3\n",
+        "max_generate_records=10\nttl_decrease_percent=50\n",
+        "zone=example.test.|example.zone|PASS|PASS\n",
+    ));
+    let result = case.run();
+    assert!(
+        result.status.success(),
+        "each three-record snapshot is within the cap: {}",
+        String::from_utf8_lossy(&result.stderr)
+    );
+}
+
+fn minimal_zone(serial: u32, extra: &str) -> String {
+    format!(
+        "$ORIGIN example.test.\n$TTL 1h\n@ SOA ns hostmaster {serial} 1h 15m 1w 5m\n@ NS ns\nns A 192.0.2.1\n{extra}"
+    )
+}
+
+fn permute<const N: usize>(values: &mut [&str; N], mut state: u64) {
+    for index in (1..N).rev() {
+        state = state
+            .wrapping_mul(6_364_136_223_846_793_005)
+            .wrapping_add(1);
+        let other = usize::try_from(state % u64::try_from(index + 1).expect("index width"))
+            .expect("position width");
+        values.swap(index, other);
+    }
+}
+
+fn publication_temp_entries(parent: &Path) -> Vec<PathBuf> {
+    let mut entries = fs::read_dir(parent)
+        .expect("read output parent")
+        .map(|entry| entry.expect("directory entry").path())
+        .filter(|path| {
+            path.file_name()
+                .and_then(std::ffi::OsStr::to_str)
+                .is_some_and(|name| name.starts_with(".report.json.tmp-"))
+        })
+        .collect::<Vec<_>>();
+    entries.sort();
+    entries
+}
diff --git a/developer-simulation/runs/2026-08-12--dns-change-gate/tests/fixture_generator.rs b/developer-simulation/runs/2026-08-12--dns-change-gate/tests/fixture_generator.rs
new file mode 100644
index 0000000..c3d99cb
--- /dev/null
+++ b/developer-simulation/runs/2026-08-12--dns-change-gate/tests/fixture_generator.rs
@@ -0,0 +1,64 @@
+use std::fs;
+use std::path::PathBuf;
+use std::process::Command;
+use std::sync::atomic::{AtomicU64, Ordering};
+
+static NEXT_ID: AtomicU64 = AtomicU64::new(0);
+
+#[test]
+fn generated_corpus_runs_through_gate_with_declared_shape() {
+    let id = NEXT_ID.fetch_add(1, Ordering::Relaxed);
+    let root = PathBuf::from(env!("CARGO_MANIFEST_DIR"))
+        .join("target")
+        .join(format!("generated-{}-{id}", std::process::id()));
+    let generated = Command::new(env!("CARGO_BIN_EXE_fixture-generator"))
+        .args([
+            "--root",
+            root.to_str().expect("root path"),
+            "--zones",
+            "12",
+            "--records-per-zone",
+            "24",
+            "--changed-zones",
+            "3",
+        ])
+        .output()
+        .expect("run fixture generator");
+    assert!(
+        generated.status.success(),
+        "stderr: {}",
+        String::from_utf8_lossy(&generated.stderr)
+    );
+    assert!(
+        String::from_utf8_lossy(&generated.stdout)
+            .contains("zones=12 records_per_snapshot=288 changed_zones=3")
+    );
+
+    let report = root.join("report.json");
+    let gate = Command::new(env!("CARGO_BIN_EXE_dns-change-gate"))
+        .args([
+            "--old-root",
+            root.join("old").to_str().expect("old root"),
+            "--new-root",
+            root.join("new").to_str().expect("new root"),
+            "--policy",
+            root.join("policy.conf").to_str().expect("policy"),
+            "--output",
+            report.to_str().expect("report"),
+        ])
+        .output()
+        .expect("run generated corpus");
+    assert!(
+        gate.status.success(),
+        "stderr: {}",
+        String::from_utf8_lossy(&gate.stderr)
+    );
+    let body = fs::read_to_string(&report).expect("generated report");
+    assert!(body.contains("zone00000.example."));
+    assert!(body.contains("zone00011.example."));
+    assert_eq!(body.matches("\"zone\":").count(), 12);
+    assert_eq!(body.matches("SOA_ADVANCE").count(), 3);
+    assert_eq!(body.matches("\"kind\":\"addition\"").count(), 66);
+    assert_eq!(body.matches("\"kind\":\"removal\"").count(), 66);
+    fs::remove_dir_all(root).expect("clean fixture root");
+}
diff --git a/developer-simulation/runs/2026-08-12--midi-scheduler-rt-model/BRIEF.md b/developer-simulation/runs/2026-08-12--midi-scheduler-rt-model/BRIEF.md
new file mode 100644
index 0000000..8695a43
--- /dev/null
+++ b/developer-simulation/runs/2026-08-12--midi-scheduler-rt-model/BRIEF.md
@@ -0,0 +1,74 @@
+# Trial 2: Hard-real-time MIDI event scheduler
+
+## Developer role and Rust experience
+
+You are an audio-tools developer maintaining a desktop MIDI sequencer used in rehearsals and small live performances. You have ten years of production C++ audio experience. Your Rust experience is exact: you completed the Rust Book, built two hobby command-line crates totaling about 3,000 lines, and have never shipped Rust in an audio callback or used unsafe Rust.
+
+## Existing system and baseline
+
+The sequencer is an existing C++ desktop application. Its audio callback receives a host-provided block start frame, block length, sample rate, transport state, and immutable tempo-map pointer. A C++ scheduler converts queued beat-positioned MIDI events into integer offsets inside each callback block and writes them into a fixed-capacity output buffer. UI edits build a new immutable event plan and swap it at a block boundary.
+
+The current scheduler and a slow, offline rational-arithmetic reference implementation are the baselines. Device I/O and the audio engine are not being replaced.
+
+## Concrete pain
+
+Users occasionally hear doubled notes, stuck notes, or a one-sample rhythmic shift when an event lands exactly on a block boundary, the host changes block size, tempo automation is dense, or the transport loops. The current code also has an undocumented queue-overflow path. The team wants to determine whether a small Rust scheduling core can make boundary and overload behavior explicit without violating the callback's real-time contract. If it cannot, keeping the C++ scheduler is the correct result.
+
+## Workload and data shape
+
+An event plan is an immutable array of at most 200,000 events sorted by `(beat, priority, stable_id)`. Beat positions and tempo-node positions are signed 64-bit integers in pulses, with exactly 960 pulses per quarter note. Each event is one of `NoteOn`, `NoteOff`, `ControlChange`, `ProgramChange`, or `AllNotesOff`, with channel and data bytes. Each accepted `NoteOn` has a unique `note_instance_id`; its `NoteOff` carries the same ID.
+
+A tempo map has at most 50,000 nodes. Each segment has a constant microseconds-per-quarter value; ramps and floating-point tempo are out of scope. The host supplies integer sample rates of 44,100, 48,000, or 96,000 Hz. A callback block is the half-open frame interval `[start_frame, start_frame + length)`, with lengths varying independently from 16 through 2,048 frames.
+
+The representative run is a 45-minute synthetic performance with 180,000 events, 20,000 tempo nodes, 250 plan replacements, 10,000 block-size changes, 100 forward seeks, 100 backward seeks, and 500 loop wraps. A separate saturation trace presents 4,096 events at one frame to an output buffer that holds 256.
+
+## Operational constraints
+
+- The callback-facing scheduling function must perform zero heap allocations, acquire no locks, perform no system calls, do no logging, and never panic or unwind. Initialization and plan construction may allocate off the audio thread.
+- The callback may read only an immutable published plan plus fixed-size scheduler state. Plan replacement occurs by an explicit prepare/publish/reclaim protocol; the audio thread cannot free the old plan.
+- Output capacity is fixed at initialization. Ordering at the same frame is `AllNotesOff`, `NoteOff`, `ControlChange`, `ProgramChange`, then `NoteOn`, followed by ascending `stable_id`.
+- Frame conversion uses checked integer or rational arithmetic. Inputs whose conversion would overflow are rejected during plan construction; no saturating or wrapping timestamp conversion is allowed.
+- A normal block uses `[start, end)`: an event at `end` belongs to the next block. A repeated callback for the same block token emits no event a second time.
+- On seek, loop wrap, sample-rate change, or plan replacement that invalidates an active note, emit the minimum set of synthetic terminations before any ordinary event: one `NoteOff` per known active instance when capacity permits; if terminations exceed capacity, emit exactly one `AllNotesOff` per affected channel and suppress ordinary `NoteOn` events for that block.
+- When an ordinary block exceeds output capacity, retain events in priority order. Never discard a termination to keep a `NoteOn`. Set a sticky overflow flag readable from the control thread; clearing the flag is an explicit control-thread operation.
+
+## Fault and adversarial cases
+
+The harness must exercise all of the following:
+
+- events at the first frame, last included frame, and first excluded frame of blocks at every supported sample rate;
+- a tempo change on the same pulse as a note, consecutive tempo nodes, the earliest and latest admitted pulse, and conversions one unit below and above overflow;
+- host block sequences containing sizes 16, 17, 255, 256, 257, 1,024, and 2,048 with no alignment assumptions;
+- duplicate callback tokens, a skipped block followed by a forward seek, a backward seek into an active note, loop start equal to an event pulse, and 100 consecutive loop wraps;
+- plan publication immediately before and immediately after a callback reads the generation number, with delayed reclamation of the prior plan;
+- a malformed plan with unsorted events, duplicate `stable_id`, unmatched `NoteOff`, duplicate termination for one instance, invalid MIDI data bytes, and an unsupported sample rate;
+- the 4,096-event saturation frame, including more than 256 terminations across all 16 channels and a mixture of every event type;
+- a callback invocation under an allocator trap, a lock-attempt trap, a syscall-counting harness, and a panic boundary.
+
+## Measurable acceptance criteria
+
+Each criterion is evaluated through public functions or the compiled black-box harness; source inspection is not accepted as proof:
+
+1. **Frame oracle parity:** Across 100 fixed random seeds, every non-overflow trace emits exactly the same `(block_token, frame_offset, event, stable_id)` sequence as the rational-arithmetic reference. This includes all boundary and tempo-change fixtures; one mismatch fails the trial.
+2. **Exactly-once block replay:** Repeating each of 1,000 selected callback tokens one to three times does not change the emitted sequence digest and produces no duplicate event IDs.
+3. **Transport safety:** For every seek, loop, sample-rate change, and invalidating plan replacement, the emitted first-block termination set matches a checked-in oracle. After the discontinuity, the harness finds zero active note instances from the prior transport generation.
+4. **Saturation safety:** In the 4,096-event frame, output length never exceeds 256. If per-instance terminations fit, every termination is present before any `NoteOn`; if they do not fit, the output contains exactly one `AllNotesOff` for each affected channel, contains no `NoteOn`, and sets the sticky overflow flag.
+5. **Invalid-plan immutability:** Every malformed or overflowing plan is rejected before publication with a stable error code. The generation ID and digest of the active plan remain unchanged, and the next valid callback matches the pre-error oracle.
+6. **Publication race:** A deterministic two-thread scheduler explores all instrumented handoff points for 10,000 replacements. Every callback observes one complete generation, never a mixture; every retired plan is reclaimed exactly once on the control thread after the harness proves no callback can reference it.
+7. **Real-time contract:** Over 10,000,000 callback invocations, the instrumented allocator count, lock-attempt count, and forbidden-system-call count are all zero. Forced invalid inputs return an error flag without panic or unwind.
+8. **Latency:** On the declared reference machine, 10,000,000 warmed callback invocations with blocks of up to 2,048 frames have p99 below 20 microseconds and maximum below 100 microseconds. The harness records the binary digest, compiler settings, CPU model, core affinity, background-load policy, and raw latency histogram so the claim is reproducible rather than portable by assertion.
+9. **Determinism:** Five runs of the representative trace and every adversarial fixture produce byte-identical event-log and diagnostic digests.
+
+## Explicit non-goals
+
+- No audio rendering, synthesis, device drivers, host plug-in wrapper, user interface, recording, quantization, or network MIDI.
+- No tempo ramps, swing, humanization, floating-point beat positions, time-stretching, or musical-expression inference.
+- No replacement of the application's event editor, audio engine, or C++ device layer.
+- No dynamic output growth, background logging from the callback, or attempt to hide overload.
+- No unsafe Rust written solely to meet the latency target; any unsafe block introduced by a dependency must already be covered by that dependency's maintained tests and safety documentation.
+
+## Smallest self-contained prototype boundary
+
+Build a Rust library with three public operations: validate and prepare an immutable plan off-thread; publish a prepared generation through a fixed handoff object; and schedule one host block into a caller-provided fixed-capacity event slice. Add a deterministic trace runner, the rational-arithmetic oracle, and the black-box instrumentation needed by the acceptance criteria. The prototype integrates only with a fake host; it does not load into the desktop application.
+
+Any new crate must be assessed separately for callback allocation, locking, panic behavior, integer conversion semantics, maintenance burden, binary-size effect, and benchmark impact. Reject a crate if it violates one acceptance gate, requires a resident runtime or control thread not already present, obscures the reclamation proof, or performs worse than the C++ baseline without a compensating correctness gain. Reject the entire Rust approach if the complete prototype cannot satisfy all safety gates with an operational story the audio team can support. A measured rejection is a valid outcome.
diff --git a/developer-simulation/runs/2026-08-12--midi-scheduler-rt-model/COMPONENT_FIT.md b/developer-simulation/runs/2026-08-12--midi-scheduler-rt-model/COMPONENT_FIT.md
new file mode 100644
index 0000000..5e534f1
--- /dev/null
+++ b/developer-simulation/runs/2026-08-12--midi-scheduler-rt-model/COMPONENT_FIT.md
@@ -0,0 +1,21 @@
+# BogKit component fit assessment
+
+This was written after the required blind discovery note and after inspecting only the public entry points needed to decide callback fit.
+
+## Fold — no fit at the callback boundary
+
+The public `Stream` owns a persistent Fjall database. Construction opens a path. Every public read enters `store.read_tx()` and creates a pinned snapshot; public writes create/commit transactions, and checkpointing explicitly syncs storage. Public initialization and transaction paths contain `unwrap`, `assert`, panic-catching, and unwind resumption. The public API does not expose a pre-pinned immutable event slice with a fixed-state callback cursor or an audio-thread reclamation protocol.
+
+The chat example reinforces the sane split: one ordinary thread owns Fold and copies snapshots toward consumers. Fold could plausibly be used by a future event editor or offline catalogue on the control side, but adding it there is outside this scheduler trial and would not prove callback safety. I did not build a Fold dependency into the prototype because its documented/public contract already fails the callback gates and there was no scheduling behaviour it could add.
+
+## ESE — no fit
+
+Its public operation maps text into embedding vectors. `encode` returns a `Vec`; `encode_single` allocates normalized and word-piece `String` buffers. Exact beat-to-frame conversion has no text or semantic-similarity step. It would add allocation and irrelevant work without satisfying any scheduler requirement.
+
+## ANNy — no fit
+
+ANNy is approximate nearest-neighbour search. Exact half-open time selection cannot tolerate approximate results. Its public `search` returns a `Vec`, uses a thread-local `RefCell<Vec<_>>`, and resizes that visited buffer. Its index is also heap-backed. Even if warmed allocation happened to disappear, the public contract neither guarantees exact selection nor bounded callback state.
+
+## Dependency result
+
+The standalone scheduler uses only Rust's standard library. `cargo tree` reports only `midi-scheduler-rt-model`. The release demonstration binary measured 505,712 bytes. There is no resident runtime or background thread. No BogKit component is used in the callback model.
diff --git a/developer-simulation/runs/2026-08-12--midi-scheduler-rt-model/Cargo.toml b/developer-simulation/runs/2026-08-12--midi-scheduler-rt-model/Cargo.toml
new file mode 100644
index 0000000..afa9636
--- /dev/null
+++ b/developer-simulation/runs/2026-08-12--midi-scheduler-rt-model/Cargo.toml
@@ -0,0 +1,12 @@
+[package]
+name = "midi-scheduler-rt-model"
+version = "0.1.0"
+edition = "2024"
+publish = false
+
+[lib]
+path = "src/lib.rs"
+
+[[bin]]
+name = "scheduler-demo"
+path = "src/bin/demo.rs"
diff --git a/developer-simulation/runs/2026-08-12--midi-scheduler-rt-model/DISCOVERY.md b/developer-simulation/runs/2026-08-12--midi-scheduler-rt-model/DISCOVERY.md
new file mode 100644
index 0000000..049e106
--- /dev/null
+++ b/developer-simulation/runs/2026-08-12--midi-scheduler-rt-model/DISCOVERY.md
@@ -0,0 +1,45 @@
+# Blind discovery: hard-real-time MIDI scheduler
+
+## What I think the repository offers
+
+From the root README and public examples, BogKit is a workspace for database-style incremental materialization and search. Fold owns persistent streams, transactions, snapshots, and derived views. ESE turns text into static embeddings. ANNy supplies an HNSW nearest-neighbour index. The examples allocate owned strings and vectors, use filesystem-backed database paths, and in one case place a plain ingest thread in front of Fold while asynchronous clients receive copied snapshots.
+
+That looks useful for an editor-side event catalogue or offline search tool. It does not yet look like a callback scheduler. The callback in this trial may touch only one immutable plan and fixed-size state, while Fold's advertised value is durable incremental state and ESE/ANNy's value is text/vector search.
+
+## Baselines I am bringing from C++ audio work
+
+The production comparison is the existing C++ scheduler, not a blank slate. My normal C++ callback design would be:
+
+- validate and flatten the tempo map and event plan on the control thread;
+- publish a pointer plus generation at a block boundary;
+- keep the callback cursor, duplicate-token guard, active-note table, and sticky diagnostics in fixed-capacity storage;
+- write directly into a caller-owned fixed-capacity output span;
+- retire old plans outside the callback, after an explicit reader handoff proves they are no longer referenced;
+- make overload ordering and transport-reset terminations part of the public contract.
+
+The Rust experiment only earns its keep if its public black-box behaviour is clearer and at least as callback-safe. Merely moving the same uncertainty across a language boundary is not a win.
+
+## Independent rational-arithmetic baseline
+
+I will write a slow oracle separately from the scheduler. It will integrate each piecewise-constant tempo segment as an exact rational number:
+
+`delta_pulses * microseconds_per_quarter * sample_rate / (960 * 1_000_000)`
+
+The oracle will keep the numerator in a wider signed integer and floor the accumulated rational time to obtain the containing frame. It will select events with exact half-open comparisons against `[block_start, block_end)`, then apply the specified priority and stable-ID ordering with an ordinary allocating sort. It must not call scheduler conversion or selection helpers. Literal boundary fixtures will check that my interpretation is not simply shared code agreeing with itself.
+
+The existing C++ scheduler remains an external baseline described by the brief; this isolated trial has no C++ source or executable to compare, so I will not claim C++ parity or a speedup.
+
+## Initial component-use hypothesis
+
+- **Fold:** probably no fit in the audio callback because the public examples expose storage paths, transactions, mutable stream ownership, and materialized collections. I will check whether a narrowly separated, immutable read view can be prepared off-thread without callback allocation, locking, syscalls, or reclamation ambiguity. If not, I will not force it into the model.
+- **ESE:** no sane fit. MIDI beat-to-frame scheduling has no text embedding step, and any embedding work would be unrelated to the correctness problem.
+- **ANNy:** no sane fit. Events are already sorted on a one-dimensional musical timeline; approximate nearest-neighbour search would weaken exact boundary semantics and add an irrelevant index.
+
+My expected smallest useful result is therefore a standalone public-function model in the assigned trial output directory, plus a minimal public-surface Fold reproducer if its callback fit is ambiguous. A measured no-fit for all three BogKit components is acceptable; the scheduler model is still needed to turn the callback contract into executable evidence.
+
+## Questions I need source inspection to answer
+
+1. Does Fold have an immutable reader that can be held and queried without a transaction, allocation, locking, filesystem access, or panic paths?
+2. Does its read/publication model expose a bounded, audio-thread-safe reclamation proof?
+3. Do ESE or ANNy document a property that surprisingly applies to exact timeline lookup? I expect not, so I will inspect only enough to avoid an assumption-based rejection.
+4. Can the standalone API keep every callback result caller-owned, fixed-capacity, and error-returning while retaining exact rational preparation off-thread?
diff --git a/developer-simulation/runs/2026-08-12--midi-scheduler-rt-model/README.md b/developer-simulation/runs/2026-08-12--midi-scheduler-rt-model/README.md
new file mode 100644
index 0000000..8f35ccb
--- /dev/null
+++ b/developer-simulation/runs/2026-08-12--midi-scheduler-rt-model/README.md
@@ -0,0 +1,29 @@
+# MIDI scheduler real-time model
+
+This standalone crate turns the trial brief into a runnable fake-host model. It deliberately has no BogKit dependency because Fold, ESE, and ANNy do not fit an exact hard-real-time scheduler callback.
+
+Run the complete evidence suite from the BogKit repository root:
+
+```sh
+cargo fmt --manifest-path developer-simulation/Cargo.toml -p midi-scheduler-rt-model -- --check
+cargo test --manifest-path developer-simulation/Cargo.toml --locked --offline --release -p midi-scheduler-rt-model --all-targets
+cargo clippy --manifest-path developer-simulation/Cargo.toml --locked --offline --release -p midi-scheduler-rt-model --all-targets -- -D warnings -D clippy::all -D clippy::pedantic
+```
+
+Run the release demonstration and local timing histogram:
+
+```sh
+cargo run --manifest-path developer-simulation/Cargo.toml --locked --offline --release -p midi-scheduler-rt-model --bin scheduler-demo -- 10000000
+```
+
+The demonstration records the release binary digest, plan/event digest, compiler profile, CPU-model availability, affinity status, background-load policy, p99, maximum, and raw latency bins. It is a local observation, not a portable latency guarantee.
+
+Callback tokens must be strictly increasing across every successfully scheduled block, including transport discontinuities. Equal or older tokens return the stable `NonMonotonicToken` error and write nothing. A call that fails validation or cannot fit even one channel reset does not consume its token, so the caller may retry that exact token with corrected inputs or a larger output slice. This bounded rule avoids an unbounded token-history structure.
+
+Plan preparation binds each note instance to its `channel` and `key`. A `NoteOff` with the right instance ID but a different identity returns stable error code 16, `TerminationIdentityMismatch`, before publication. A replacement that reuses an instance ID for another channel or key terminates the old active identity.
+
+If ordinary `NoteOff` demand exceeds output capacity, the callback emits exactly one synthetic `AllNotesOff` for each affected channel, clears every active note on those channels, suppresses ordinary note lifecycle events for that block, and sets sticky overflow. This prevents truncated NoteOff output from leaving active instances stuck.
+
+The allocator trap covers 100,000 callback invocations and counts `alloc`, `alloc_zeroed`, and `realloc`; it does not count deallocation. Lock-attempt interception and forbidden-system-call interception are not available here. The two-slot handoff test is a deterministic single-thread instrumented model of before/after-read schedules, not a proof for an actual lock-free concurrent primitive.
+
+The release timing and binary digest identify one locally rebuilt artifact. The digest is expected to change after rebuilding with different source, compiler, or environment inputs, and the timing remains an observation rather than a portable guarantee.
diff --git a/developer-simulation/runs/2026-08-12--midi-scheduler-rt-model/src/bin/demo.rs b/developer-simulation/runs/2026-08-12--midi-scheduler-rt-model/src/bin/demo.rs
new file mode 100644
index 0000000..aa17e50
--- /dev/null
+++ b/developer-simulation/runs/2026-08-12--midi-scheduler-rt-model/src/bin/demo.rs
@@ -0,0 +1,160 @@
+use std::process::Command;
+use std::time::Instant;
+
+use midi_scheduler_rt_model::{
+    Discontinuity, Event, EventKind, FixedHandoff, HostBlock, PlanSpec, ScheduledEvent, Scheduler,
+    TempoNode, prepare_plan,
+};
+
+fn main() {
+    let iterations = std::env::args()
+        .nth(1)
+        .and_then(|value| value.parse::<usize>().ok())
+        .unwrap_or(250_000);
+    let plan = prepare_plan(demo_spec()).expect("static demo fixture must validate");
+    let mut handoff = FixedHandoff::new();
+    let published = handoff.publish(plan).expect("first handoff slot is free");
+    let ticket = handoff.begin_callback().expect("published callback ticket");
+    let mut scheduler = Scheduler::new(64);
+    let mut output = [ScheduledEvent::EMPTY; 32];
+
+    let (first_written, mut latencies, event_digest) = handoff
+        .with_plan(ticket, |published_plan| {
+            let first = scheduler.schedule(
+                published_plan,
+                HostBlock {
+                    token: 1,
+                    start_frame: 0,
+                    length: 16,
+                    sample_rate: 48_000,
+                    discontinuity: Discontinuity::None,
+                },
+                &mut output,
+            );
+            let first_written = first.written;
+            for warmup in 0_u64..10_000 {
+                let _ = scheduler.schedule(
+                    published_plan,
+                    HostBlock {
+                        token: warmup + 2,
+                        start_frame: i64::try_from(warmup % 240).unwrap_or_default(),
+                        length: 16,
+                        sample_rate: 48_000,
+                        discontinuity: Discontinuity::None,
+                    },
+                    &mut output,
+                );
+            }
+
+            let mut latencies = Vec::with_capacity(iterations);
+            let mut event_digest = 0xcbf2_9ce4_8422_2325_u64;
+            for iteration in 0..iterations {
+                let started = Instant::now();
+                let result = scheduler.schedule(
+                    published_plan,
+                    HostBlock {
+                        token: iteration as u64 + 20_000,
+                        start_frame: i64::try_from(iteration % 240).unwrap_or_default(),
+                        length: 16,
+                        sample_rate: 48_000,
+                        discontinuity: Discontinuity::None,
+                    },
+                    &mut output,
+                );
+                let elapsed = started.elapsed().as_nanos();
+                latencies.push(u64::try_from(elapsed).unwrap_or(u64::MAX));
+                for event in &output[..result.written] {
+                    event_digest ^= event.stable_id;
+                    event_digest = event_digest.wrapping_mul(0x0000_0100_0000_01b3);
+                }
+            }
+            (first_written, latencies, event_digest)
+        })
+        .expect("ticket remains pinned");
+    handoff.end_callback(ticket).expect("ticket ends once");
+
+    latencies.sort_unstable();
+    let p99_index = iterations.saturating_mul(99).saturating_div(100);
+    let p99_ns = latencies
+        .get(p99_index.min(latencies.len().saturating_sub(1)))
+        .copied()
+        .unwrap_or(0);
+    let max_ns = latencies.last().copied().unwrap_or(0);
+    let histogram = histogram(&latencies);
+    let binary_digest = executable_digest().unwrap_or(0);
+
+    println!("scheduler-demo");
+    println!("first_block_events={first_written}");
+    println!("published_generation={}", published.generation);
+    println!("published_plan_digest={:016x}", published.digest);
+    println!("event_log_digest={event_digest:016x}");
+    println!("bounded_release_iterations={iterations}");
+    println!("p99_ns={p99_ns}");
+    println!("max_ns={max_ns}");
+    println!("histogram_ns_le_1000_2000_5000_10000_20000_50000_100000_over={histogram:?}");
+    println!("binary_fnv1a64={binary_digest:016x}");
+    println!("compiler_profile=release lto=thin codegen_units=1");
+    println!("cpu_model={}", cpu_model());
+    println!("core_affinity=not_pinned");
+    println!("background_load_policy=uncontrolled_interactive_host");
+}
+
+fn demo_spec() -> PlanSpec {
+    let events = (0_i64..256)
+        .map(|pulse| Event {
+            pulse,
+            stable_id: pulse.cast_unsigned() + 1,
+            kind: EventKind::ControlChange {
+                channel: u8::try_from(pulse % 16).expect("fixture channel fits"),
+                controller: 1,
+                value: u8::try_from(pulse % 128).expect("fixture value fits"),
+            },
+        })
+        .collect();
+    PlanSpec {
+        origin_pulse: 0,
+        origin_frame: 0,
+        sample_rate: 48_000,
+        tempo_nodes: vec![TempoNode {
+            pulse: 0,
+            micros_per_quarter: 20_000,
+        }],
+        events,
+    }
+}
+
+fn histogram(samples: &[u64]) -> [u64; 8] {
+    let limits = [1_000_u64, 2_000, 5_000, 10_000, 20_000, 50_000, 100_000];
+    let mut bins = [0_u64; 8];
+    for &sample in samples {
+        let bin = limits
+            .iter()
+            .position(|limit| sample <= *limit)
+            .unwrap_or(limits.len());
+        bins[bin] += 1;
+    }
+    bins
+}
+
+fn executable_digest() -> Option<u64> {
+    let path = std::env::current_exe().ok()?;
+    let bytes = std::fs::read(path).ok()?;
+    let mut hash = 0xcbf2_9ce4_8422_2325_u64;
+    for byte in bytes {
+        hash ^= u64::from(byte);
+        hash = hash.wrapping_mul(0x0000_0100_0000_01b3);
+    }
+    Some(hash)
+}
+
+fn cpu_model() -> String {
+    Command::new("sysctl")
+        .args(["-n", "machdep.cpu.brand_string"])
+        .output()
+        .ok()
+        .filter(|output| output.status.success())
+        .and_then(|output| String::from_utf8(output.stdout).ok())
+        .map(|model| model.trim().to_owned())
+        .filter(|model| !model.is_empty())
+        .unwrap_or_else(|| format!("{}-unknown-model", std::env::consts::ARCH))
+}
diff --git a/developer-simulation/runs/2026-08-12--midi-scheduler-rt-model/src/lib.rs b/developer-simulation/runs/2026-08-12--midi-scheduler-rt-model/src/lib.rs
new file mode 100644
index 0000000..fd2a8e4
--- /dev/null
+++ b/developer-simulation/runs/2026-08-12--midi-scheduler-rt-model/src/lib.rs
@@ -0,0 +1,1271 @@
+//! Test-first model of a fixed-capacity MIDI callback scheduler.
+
+use std::collections::{BTreeMap, BTreeSet};
+
+pub mod oracle;
+
+const PULSES_PER_QUARTER: i128 = 960;
+const MICROS_PER_SECOND: i128 = 1_000_000;
+const FRAME_DENOMINATOR: i128 = PULSES_PER_QUARTER * MICROS_PER_SECOND;
+const MAX_EVENTS: usize = 200_000;
+const MAX_TEMPO_NODES: usize = 50_000;
+
+/// One piecewise-constant tempo segment, effective at `pulse`.
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+pub struct TempoNode {
+    pub pulse: i64,
+    pub micros_per_quarter: u32,
+}
+
+/// MIDI data retained by the scheduling core.
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+pub enum EventKind {
+    NoteOn {
+        channel: u8,
+        key: u8,
+        velocity: u8,
+        instance_id: u32,
+    },
+    NoteOff {
+        channel: u8,
+        key: u8,
+        velocity: u8,
+        instance_id: u32,
+    },
+    ControlChange {
+        channel: u8,
+        controller: u8,
+        value: u8,
+    },
+    ProgramChange {
+        channel: u8,
+        program: u8,
+    },
+    AllNotesOff {
+        channel: u8,
+    },
+}
+
+impl EventKind {
+    /// Lower values survive ordinary overload first.
+    #[must_use]
+    pub const fn priority(self) -> u8 {
+        match self {
+            Self::AllNotesOff { .. } => 0,
+            Self::NoteOff { .. } => 1,
+            Self::ControlChange { .. } => 2,
+            Self::ProgramChange { .. } => 3,
+            Self::NoteOn { .. } => 4,
+        }
+    }
+
+    const fn midi_is_valid(self) -> bool {
+        match self {
+            Self::NoteOn {
+                channel,
+                key,
+                velocity,
+                ..
+            }
+            | Self::NoteOff {
+                channel,
+                key,
+                velocity,
+                ..
+            } => channel < 16 && key < 128 && velocity < 128,
+            Self::ControlChange {
+                channel,
+                controller,
+                value,
+            } => channel < 16 && controller < 128 && value < 128,
+            Self::ProgramChange { channel, program } => channel < 16 && program < 128,
+            Self::AllNotesOff { channel } => channel < 16,
+        }
+    }
+}
+
+/// Beat-positioned event supplied by the control thread.
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+pub struct Event {
+    pub pulse: i64,
+    pub stable_id: u64,
+    pub kind: EventKind,
+}
+
+/// Complete off-thread plan input.
+#[derive(Clone, Debug, Eq, PartialEq)]
+pub struct PlanSpec {
+    pub origin_pulse: i64,
+    pub origin_frame: i64,
+    pub sample_rate: u32,
+    pub tempo_nodes: Vec<TempoNode>,
+    pub events: Vec<Event>,
+}
+
+/// Stable validation failures; values are intentionally independent of prose.
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+#[repr(u8)]
+pub enum PlanError {
+    UnsupportedSampleRate = 1,
+    EmptyTempoMap = 2,
+    TempoOriginMismatch = 3,
+    TempoNodesUnsorted = 4,
+    InvalidTempo = 5,
+    TooManyTempoNodes = 6,
+    TooManyEvents = 7,
+    PulseBeforeOrigin = 8,
+    EventsUnsorted = 9,
+    DuplicateStableId = 10,
+    DuplicateNoteInstance = 11,
+    UnmatchedNoteOff = 12,
+    DuplicateTermination = 13,
+    InvalidMidiData = 14,
+    FrameOverflow = 15,
+    TerminationIdentityMismatch = 16,
+}
+
+/// An event after exact off-thread pulse-to-frame conversion.
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+pub struct PreparedEvent {
+    pub frame: i64,
+    pub stable_id: u64,
+    pub kind: EventKind,
+}
+
+/// Immutable callback input. All vectors are built before publication.
+#[derive(Clone, Debug, Eq, PartialEq)]
+pub struct PreparedPlan {
+    sample_rate: u32,
+    events: Vec<PreparedEvent>,
+    note_instances: Vec<NoteIdentity>,
+    digest: u64,
+}
+
+#[derive(Clone, Copy, Debug, Eq, Ord, PartialEq, PartialOrd)]
+struct NoteIdentity {
+    instance_id: u32,
+    channel: u8,
+    key: u8,
+}
+
+impl PreparedPlan {
+    #[must_use]
+    pub fn sample_rate(&self) -> u32 {
+        self.sample_rate
+    }
+
+    #[must_use]
+    pub fn events(&self) -> &[PreparedEvent] {
+        &self.events
+    }
+
+    #[must_use]
+    pub fn digest(&self) -> u64 {
+        self.digest
+    }
+
+    #[must_use]
+    pub fn contains_note_instance(&self, instance_id: u32) -> bool {
+        self.note_instances
+            .binary_search_by_key(&instance_id, |identity| identity.instance_id)
+            .is_ok()
+    }
+
+    fn contains_note_identity(&self, identity: NoteIdentity) -> bool {
+        self.note_instances.binary_search(&identity).is_ok()
+    }
+}
+
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+enum InstanceState {
+    Open,
+    Closed,
+}
+
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+struct InstanceRecord {
+    state: InstanceState,
+    channel: u8,
+    key: u8,
+}
+
+/// Validate and prepare one immutable plan off the callback thread.
+///
+/// # Errors
+///
+/// Returns a stable [`PlanError`] for malformed MIDI, ordering, tempo, size,
+/// sample-rate, note-instance, or checked-conversion input.
+pub fn prepare_plan(spec: PlanSpec) -> Result<PreparedPlan, PlanError> {
+    if !matches!(spec.sample_rate, 44_100 | 48_000 | 96_000) {
+        return Err(PlanError::UnsupportedSampleRate);
+    }
+    if spec.tempo_nodes.is_empty() {
+        return Err(PlanError::EmptyTempoMap);
+    }
+    if spec.tempo_nodes.len() > MAX_TEMPO_NODES {
+        return Err(PlanError::TooManyTempoNodes);
+    }
+    if spec.events.len() > MAX_EVENTS {
+        return Err(PlanError::TooManyEvents);
+    }
+    if spec.tempo_nodes[0].pulse != spec.origin_pulse {
+        return Err(PlanError::TempoOriginMismatch);
+    }
+    if spec
+        .tempo_nodes
+        .iter()
+        .any(|node| node.micros_per_quarter == 0)
+    {
+        return Err(PlanError::InvalidTempo);
+    }
+    if spec
+        .tempo_nodes
+        .windows(2)
+        .any(|nodes| nodes[0].pulse >= nodes[1].pulse)
+    {
+        return Err(PlanError::TempoNodesUnsorted);
+    }
+
+    let instances = validate_events(&spec.events, spec.origin_pulse)?;
+
+    let mut prepared = Vec::with_capacity(spec.events.len());
+    let mut converter = FrameConverter::new(
+        spec.origin_pulse,
+        spec.origin_frame,
+        spec.sample_rate,
+        &spec.tempo_nodes,
+    )?;
+    for event in spec.events {
+        prepared.push(PreparedEvent {
+            frame: converter.convert(event.pulse)?,
+            stable_id: event.stable_id,
+            kind: event.kind,
+        });
+    }
+    prepared.sort_unstable_by_key(|event| (event.frame, event.kind.priority(), event.stable_id));
+    let note_instances = instances
+        .into_iter()
+        .map(|(instance_id, record)| NoteIdentity {
+            instance_id,
+            channel: record.channel,
+            key: record.key,
+        })
+        .collect();
+    let digest = digest_plan(spec.sample_rate, &prepared);
+
+    Ok(PreparedPlan {
+        sample_rate: spec.sample_rate,
+        events: prepared,
+        note_instances,
+        digest,
+    })
+}
+
+fn validate_events(
+    events: &[Event],
+    origin_pulse: i64,
+) -> Result<BTreeMap<u32, InstanceRecord>, PlanError> {
+    let mut stable_ids = BTreeSet::new();
+    let mut instances = BTreeMap::new();
+    let mut previous_key = None;
+    for event in events {
+        if event.pulse < origin_pulse {
+            return Err(PlanError::PulseBeforeOrigin);
+        }
+        let key = (event.pulse, event.kind.priority(), event.stable_id);
+        if previous_key.is_some_and(|previous| previous > key) {
+            return Err(PlanError::EventsUnsorted);
+        }
+        previous_key = Some(key);
+        if !stable_ids.insert(event.stable_id) {
+            return Err(PlanError::DuplicateStableId);
+        }
+        if !event.kind.midi_is_valid() {
+            return Err(PlanError::InvalidMidiData);
+        }
+        match event.kind {
+            EventKind::NoteOn {
+                instance_id,
+                channel,
+                key,
+                ..
+            } => {
+                if instances
+                    .insert(
+                        instance_id,
+                        InstanceRecord {
+                            state: InstanceState::Open,
+                            channel,
+                            key,
+                        },
+                    )
+                    .is_some()
+                {
+                    return Err(PlanError::DuplicateNoteInstance);
+                }
+            }
+            EventKind::NoteOff {
+                instance_id,
+                channel,
+                key,
+                ..
+            } => match instances.get_mut(&instance_id) {
+                None => return Err(PlanError::UnmatchedNoteOff),
+                Some(InstanceRecord {
+                    state: InstanceState::Closed,
+                    ..
+                }) => return Err(PlanError::DuplicateTermination),
+                Some(record) if record.channel != channel || record.key != key => {
+                    return Err(PlanError::TerminationIdentityMismatch);
+                }
+                Some(record) => record.state = InstanceState::Closed,
+            },
+            EventKind::ControlChange { .. }
+            | EventKind::ProgramChange { .. }
+            | EventKind::AllNotesOff { .. } => {}
+        }
+    }
+
+    Ok(instances)
+}
+
+struct FrameConverter<'a> {
+    numerator: i128,
+    cursor: i64,
+    sample_rate: u32,
+    micros_per_quarter: u32,
+    tempo_nodes: &'a [TempoNode],
+    next_tempo: usize,
+}
+
+impl<'a> FrameConverter<'a> {
+    fn new(
+        origin_pulse: i64,
+        origin_frame: i64,
+        sample_rate: u32,
+        tempo_nodes: &'a [TempoNode],
+    ) -> Result<Self, PlanError> {
+        let numerator = i128::from(origin_frame)
+            .checked_mul(FRAME_DENOMINATOR)
+            .ok_or(PlanError::FrameOverflow)?;
+        Ok(Self {
+            numerator,
+            cursor: origin_pulse,
+            sample_rate,
+            micros_per_quarter: tempo_nodes[0].micros_per_quarter,
+            tempo_nodes,
+            next_tempo: 1,
+        })
+    }
+
+    fn convert(&mut self, target_pulse: i64) -> Result<i64, PlanError> {
+        while let Some(node) = self.tempo_nodes.get(self.next_tempo)
+            && node.pulse <= target_pulse
+        {
+            self.numerator = add_segment(
+                self.numerator,
+                self.cursor,
+                node.pulse,
+                self.micros_per_quarter,
+                self.sample_rate,
+            )?;
+            self.cursor = node.pulse;
+            self.micros_per_quarter = node.micros_per_quarter;
+            self.next_tempo += 1;
+        }
+        self.numerator = add_segment(
+            self.numerator,
+            self.cursor,
+            target_pulse,
+            self.micros_per_quarter,
+            self.sample_rate,
+        )?;
+        self.cursor = target_pulse;
+        frame_from_numerator(self.numerator)
+    }
+}
+
+fn add_segment(
+    numerator: i128,
+    from_pulse: i64,
+    to_pulse: i64,
+    micros_per_quarter: u32,
+    sample_rate: u32,
+) -> Result<i128, PlanError> {
+    let pulse_delta = i128::from(to_pulse) - i128::from(from_pulse);
+    let delta = pulse_delta
+        .checked_mul(i128::from(micros_per_quarter))
+        .and_then(|value| value.checked_mul(i128::from(sample_rate)))
+        .ok_or(PlanError::FrameOverflow)?;
+    numerator.checked_add(delta).ok_or(PlanError::FrameOverflow)
+}
+
+fn frame_from_numerator(numerator: i128) -> Result<i64, PlanError> {
+    i64::try_from(numerator.div_euclid(FRAME_DENOMINATOR)).map_err(|_| PlanError::FrameOverflow)
+}
+
+fn digest_plan(sample_rate: u32, events: &[PreparedEvent]) -> u64 {
+    let mut hash = fnv(u64::from(sample_rate), 0xcbf2_9ce4_8422_2325);
+    for event in events {
+        hash = fnv(event.frame.cast_unsigned(), hash);
+        hash = fnv(event.stable_id, hash);
+        hash = fnv(u64::from(event.kind.priority()), hash);
+        hash = fnv(kind_bits(event.kind), hash);
+    }
+    hash
+}
+
+const fn fnv(value: u64, mut hash: u64) -> u64 {
+    let bytes = value.to_le_bytes();
+    let mut index = 0;
+    while index < bytes.len() {
+        hash ^= bytes[index] as u64;
+        hash = hash.wrapping_mul(0x0000_0100_0000_01b3);
+        index += 1;
+    }
+    hash
+}
+
+fn kind_bits(kind: EventKind) -> u64 {
+    match kind {
+        EventKind::NoteOn {
+            channel,
+            key,
+            velocity,
+            instance_id,
+        }
+        | EventKind::NoteOff {
+            channel,
+            key,
+            velocity,
+            instance_id,
+        } => {
+            u64::from(instance_id) << 24
+                | u64::from(channel) << 16
+                | u64::from(key) << 8
+                | u64::from(velocity)
+        }
+        EventKind::ControlChange {
+            channel,
+            controller,
+            value,
+        } => u64::from(channel) << 16 | u64::from(controller) << 8 | u64::from(value),
+        EventKind::ProgramChange { channel, program } => {
+            u64::from(channel) << 8 | u64::from(program)
+        }
+        EventKind::AllNotesOff { channel } => u64::from(channel),
+    }
+}
+
+/// Explicit transport state transition supplied by the host wrapper.
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+pub enum Discontinuity {
+    None,
+    Seek,
+    LoopWrap,
+    SampleRateChange,
+    PlanReplacement,
+}
+
+/// Callback metadata. Blocks are interpreted as `[start_frame, start_frame + length)`.
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+pub struct HostBlock {
+    /// Must be greater than the token of the last successful callback.
+    /// Failed calls do not consume their token and may be retried.
+    pub token: u64,
+    pub start_frame: i64,
+    pub length: u32,
+    pub sample_rate: u32,
+    pub discontinuity: Discontinuity,
+}
+
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+pub enum CallbackError {
+    EmptyBlock,
+    BlockTooLarge,
+    UnsupportedSampleRate,
+    PlanSampleRateMismatch,
+    FrameRangeOverflow,
+    TerminationOutputTooSmall,
+    NonMonotonicToken,
+}
+
+/// One caller-owned output entry.
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+pub struct ScheduledEvent {
+    pub absolute_frame: i64,
+    pub frame_offset: u32,
+    pub stable_id: u64,
+    pub kind: EventKind,
+    pub synthetic: bool,
+}
+
+impl ScheduledEvent {
+    pub const EMPTY: Self = Self {
+        absolute_frame: 0,
+        frame_offset: 0,
+        stable_id: 0,
+        kind: EventKind::AllNotesOff { channel: 0 },
+        synthetic: false,
+    };
+}
+
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+pub struct ScheduleResult {
+    pub written: usize,
+    pub synthetic_terminations: usize,
+    /// True only when `NonMonotonicToken` was caused by equality.
+    pub duplicate_token: bool,
+    pub overflowed: bool,
+    pub error: Option<CallbackError>,
+}
+
+impl ScheduleResult {
+    const fn error(error: CallbackError) -> Self {
+        Self {
+            written: 0,
+            synthetic_terminations: 0,
+            duplicate_token: false,
+            overflowed: false,
+            error: Some(error),
+        }
+    }
+
+    const fn non_monotonic_token(duplicate_token: bool) -> Self {
+        Self {
+            written: 0,
+            synthetic_terminations: 0,
+            duplicate_token,
+            overflowed: false,
+            error: Some(CallbackError::NonMonotonicToken),
+        }
+    }
+}
+
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+enum ActiveSlot {
+    Empty,
+    Live {
+        instance_id: u32,
+        channel: u8,
+        key: u8,
+    },
+}
+
+/// Fixed-capacity callback state. Construction and clearing are control-thread operations.
+pub struct Scheduler {
+    active: Box<[ActiveSlot]>,
+    last_token: Option<u64>,
+    sticky_overflow: bool,
+}
+
+impl Scheduler {
+    /// Allocate the active-note table before the scheduler reaches the callback.
+    #[must_use]
+    pub fn new(max_active_notes: usize) -> Self {
+        Self {
+            active: vec![ActiveSlot::Empty; max_active_notes].into_boxed_slice(),
+            last_token: None,
+            sticky_overflow: false,
+        }
+    }
+
+    /// Schedule one host block into `output` without growing callback-owned storage.
+    pub fn schedule(
+        &mut self,
+        plan: &PreparedPlan,
+        block: HostBlock,
+        output: &mut [ScheduledEvent],
+    ) -> ScheduleResult {
+        if let Some(last_token) = self.last_token
+            && block.token <= last_token
+        {
+            return ScheduleResult::non_monotonic_token(block.token == last_token);
+        }
+        if block.length == 0 {
+            return ScheduleResult::error(CallbackError::EmptyBlock);
+        }
+        if block.length > 2_048 {
+            return ScheduleResult::error(CallbackError::BlockTooLarge);
+        }
+        if !matches!(block.sample_rate, 44_100 | 48_000 | 96_000) {
+            return ScheduleResult::error(CallbackError::UnsupportedSampleRate);
+        }
+        if block.sample_rate != plan.sample_rate {
+            return ScheduleResult::error(CallbackError::PlanSampleRateMismatch);
+        }
+        let Some(end_frame) = block.start_frame.checked_add(i64::from(block.length)) else {
+            return ScheduleResult::error(CallbackError::FrameRangeOverflow);
+        };
+
+        let events = plan.events();
+        let begin = events.partition_point(|event| event.frame < block.start_frame);
+        let end = events.partition_point(|event| event.frame < end_frame);
+        let ordinary = &events[begin..end];
+        let termination = if self.required_termination_count(plan, block.discontinuity, ordinary)
+            > output.len()
+        {
+            self.emit_channel_fallback(plan, block, ordinary, output)
+                .map(|written| (written, true))
+        } else {
+            self.emit_terminations(plan, block, output)
+        };
+        let (synthetic_terminations, channel_fallback) = match termination {
+            Ok(value) => value,
+            Err(error) => return ScheduleResult::error(error),
+        };
+        let available = output.len().saturating_sub(synthetic_terminations);
+        let mut selected = 0_usize;
+        let mut overflowed = false;
+
+        for event in ordinary {
+            if channel_fallback
+                && matches!(
+                    event.kind,
+                    EventKind::NoteOn { .. }
+                        | EventKind::NoteOff { .. }
+                        | EventKind::AllNotesOff { .. }
+                )
+            {
+                overflowed = true;
+                continue;
+            }
+            let candidate = ScheduledEvent {
+                absolute_frame: event.frame,
+                frame_offset: u32::try_from(event.frame - block.start_frame).unwrap_or_default(),
+                stable_id: event.stable_id,
+                kind: event.kind,
+                synthetic: false,
+            };
+            if selected < available {
+                if let Some(slot) = output.get_mut(synthetic_terminations + selected) {
+                    *slot = candidate;
+                    selected += 1;
+                }
+            } else {
+                overflowed = true;
+                if available == 0 {
+                    continue;
+                }
+                let ordinary = &mut output
+                    [synthetic_terminations..synthetic_terminations.saturating_add(selected)];
+                let mut worst = 0_usize;
+                for index in 1..ordinary.len() {
+                    if retention_key(ordinary[index]) > retention_key(ordinary[worst]) {
+                        worst = index;
+                    }
+                }
+                if retention_key(candidate) < retention_key(ordinary[worst]) {
+                    ordinary[worst] = candidate;
+                }
+            }
+        }
+
+        let ordinary_end = synthetic_terminations + selected;
+        insertion_sort_events(&mut output[synthetic_terminations..ordinary_end]);
+        let written = self.apply_emitted_state(
+            output,
+            synthetic_terminations,
+            ordinary_end,
+            &mut overflowed,
+        );
+        if overflowed {
+            self.sticky_overflow = true;
+        }
+        self.last_token = Some(block.token);
+        ScheduleResult {
+            written,
+            synthetic_terminations,
+            duplicate_token: false,
+            overflowed,
+            error: None,
+        }
+    }
+
+    #[must_use]
+    pub fn active_count(&self) -> usize {
+        self.active
+            .iter()
+            .filter(|slot| matches!(slot, ActiveSlot::Live { .. }))
+            .count()
+    }
+
+    #[must_use]
+    pub fn sticky_overflow(&self) -> bool {
+        self.sticky_overflow
+    }
+
+    /// This is deliberately separate from the callback operation.
+    pub fn clear_overflow_control(&mut self) {
+        self.sticky_overflow = false;
+    }
+
+    fn emit_terminations(
+        &mut self,
+        plan: &PreparedPlan,
+        block: HostBlock,
+        output: &mut [ScheduledEvent],
+    ) -> Result<(usize, bool), CallbackError> {
+        if block.discontinuity == Discontinuity::None {
+            return Ok((0, false));
+        }
+        let invalidate = |slot: ActiveSlot| match (block.discontinuity, slot) {
+            (
+                Discontinuity::PlanReplacement,
+                ActiveSlot::Live {
+                    instance_id,
+                    channel,
+                    key,
+                },
+            ) => !plan.contains_note_identity(NoteIdentity {
+                instance_id,
+                channel,
+                key,
+            }),
+            (_, ActiveSlot::Live { .. }) => true,
+            (_, ActiveSlot::Empty) => false,
+        };
+        let termination_count = self
+            .active
+            .iter()
+            .copied()
+            .filter(|slot| invalidate(*slot))
+            .count();
+        if termination_count == 0 {
+            return Ok((0, false));
+        }
+
+        if termination_count > output.len() {
+            let mut channels = [false; 16];
+            for slot in self.active.iter().copied().filter(|slot| invalidate(*slot)) {
+                if let ActiveSlot::Live { channel, .. } = slot {
+                    channels[usize::from(channel)] = true;
+                }
+            }
+            let affected_channels = channels.iter().filter(|affected| **affected).count();
+            if affected_channels > output.len() {
+                return Err(CallbackError::TerminationOutputTooSmall);
+            }
+            let mut written = 0_usize;
+            for (channel, affected) in (0_u8..16).zip(channels) {
+                if affected && let Some(slot) = output.get_mut(written) {
+                    *slot = ScheduledEvent {
+                        absolute_frame: block.start_frame,
+                        frame_offset: 0,
+                        stable_id: (1_u64 << 63) | u64::from(channel),
+                        kind: EventKind::AllNotesOff { channel },
+                        synthetic: true,
+                    };
+                    written += 1;
+                }
+            }
+            for slot in &mut self.active {
+                if invalidate(*slot) {
+                    *slot = ActiveSlot::Empty;
+                }
+            }
+            self.sticky_overflow = true;
+            return Ok((written, true));
+        }
+
+        let mut written = 0_usize;
+        for slot in &mut self.active {
+            if !invalidate(*slot) {
+                continue;
+            }
+            if let ActiveSlot::Live {
+                instance_id,
+                channel,
+                key,
+            } = *slot
+                && let Some(destination) = output.get_mut(written)
+            {
+                *destination = ScheduledEvent {
+                    absolute_frame: block.start_frame,
+                    frame_offset: 0,
+                    stable_id: (1_u64 << 63) | u64::from(instance_id),
+                    kind: EventKind::NoteOff {
+                        channel,
+                        key,
+                        velocity: 0,
+                        instance_id,
+                    },
+                    synthetic: true,
+                };
+                written += 1;
+            }
+            *slot = ActiveSlot::Empty;
+        }
+        insertion_sort_events(&mut output[..written]);
+        Ok((written, false))
+    }
+
+    fn required_termination_count(
+        &self,
+        plan: &PreparedPlan,
+        discontinuity: Discontinuity,
+        ordinary: &[PreparedEvent],
+    ) -> usize {
+        let discontinuity_count = self
+            .active
+            .iter()
+            .copied()
+            .filter(|slot| Self::slot_invalidated(*slot, plan, discontinuity))
+            .count();
+        let ordinary_count = self
+            .active
+            .iter()
+            .copied()
+            .filter(|slot| Self::ordinary_terminates_slot(*slot, ordinary))
+            .count();
+        discontinuity_count.saturating_add(ordinary_count)
+    }
+
+    fn emit_channel_fallback(
+        &mut self,
+        plan: &PreparedPlan,
+        block: HostBlock,
+        ordinary: &[PreparedEvent],
+        output: &mut [ScheduledEvent],
+    ) -> Result<usize, CallbackError> {
+        let mut channels = [false; 16];
+        for slot in self.active.iter().copied().filter(|slot| {
+            Self::slot_requires_termination(*slot, plan, block.discontinuity, ordinary)
+        }) {
+            if let ActiveSlot::Live { channel, .. } = slot {
+                channels[usize::from(channel)] = true;
+            }
+        }
+        let affected_channels = channels.iter().filter(|affected| **affected).count();
+        if affected_channels > output.len() {
+            return Err(CallbackError::TerminationOutputTooSmall);
+        }
+
+        let mut written = 0_usize;
+        for (channel, affected) in (0_u8..16).zip(channels) {
+            if affected && let Some(destination) = output.get_mut(written) {
+                *destination = ScheduledEvent {
+                    absolute_frame: block.start_frame,
+                    frame_offset: 0,
+                    stable_id: (1_u64 << 63) | u64::from(channel),
+                    kind: EventKind::AllNotesOff { channel },
+                    synthetic: true,
+                };
+                written += 1;
+            }
+        }
+        for slot in &mut self.active {
+            if let ActiveSlot::Live { channel, .. } = *slot
+                && channels[usize::from(channel)]
+            {
+                *slot = ActiveSlot::Empty;
+            }
+        }
+        self.sticky_overflow = true;
+        Ok(written)
+    }
+
+    fn slot_requires_termination(
+        slot: ActiveSlot,
+        plan: &PreparedPlan,
+        discontinuity: Discontinuity,
+        ordinary: &[PreparedEvent],
+    ) -> bool {
+        Self::slot_invalidated(slot, plan, discontinuity)
+            || Self::ordinary_terminates_slot(slot, ordinary)
+    }
+
+    fn slot_invalidated(
+        slot: ActiveSlot,
+        plan: &PreparedPlan,
+        discontinuity: Discontinuity,
+    ) -> bool {
+        let ActiveSlot::Live {
+            instance_id,
+            channel,
+            key,
+        } = slot
+        else {
+            return false;
+        };
+        match discontinuity {
+            Discontinuity::None => false,
+            Discontinuity::PlanReplacement => !plan.contains_note_identity(NoteIdentity {
+                instance_id,
+                channel,
+                key,
+            }),
+            Discontinuity::Seek | Discontinuity::LoopWrap | Discontinuity::SampleRateChange => true,
+        }
+    }
+
+    fn ordinary_terminates_slot(slot: ActiveSlot, ordinary: &[PreparedEvent]) -> bool {
+        let ActiveSlot::Live {
+            instance_id,
+            channel,
+            key,
+        } = slot
+        else {
+            return false;
+        };
+        ordinary.iter().any(|event| match event.kind {
+            EventKind::NoteOff {
+                instance_id: off_instance,
+                channel: off_channel,
+                key: off_key,
+                ..
+            } => off_instance == instance_id && off_channel == channel && off_key == key,
+            EventKind::AllNotesOff {
+                channel: off_channel,
+            } => off_channel == channel,
+            EventKind::NoteOn { .. }
+            | EventKind::ControlChange { .. }
+            | EventKind::ProgramChange { .. } => false,
+        })
+    }
+
+    fn apply_emitted_state(
+        &mut self,
+        output: &mut [ScheduledEvent],
+        ordinary_start: usize,
+        ordinary_end: usize,
+        overflowed: &mut bool,
+    ) -> usize {
+        let mut write = ordinary_start;
+        for read in ordinary_start..ordinary_end {
+            let Some(event) = output.get(read).copied() else {
+                break;
+            };
+            let keep = match event.kind {
+                EventKind::NoteOn {
+                    instance_id,
+                    channel,
+                    key,
+                    ..
+                } => {
+                    if self.has_active(instance_id) {
+                        false
+                    } else if self.insert_active(instance_id, channel, key) {
+                        true
+                    } else {
+                        *overflowed = true;
+                        false
+                    }
+                }
+                EventKind::NoteOff {
+                    instance_id,
+                    channel,
+                    key,
+                    ..
+                } => {
+                    self.remove_active(instance_id, channel, key);
+                    true
+                }
+                EventKind::AllNotesOff { channel } => {
+                    self.clear_channel(channel);
+                    true
+                }
+                EventKind::ControlChange { .. } | EventKind::ProgramChange { .. } => true,
+            };
+            if keep && let Some(destination) = output.get_mut(write) {
+                *destination = event;
+                write += 1;
+            }
+        }
+        write
+    }
+
+    fn has_active(&self, instance_id: u32) -> bool {
+        self.active.iter().any(|slot| {
+            matches!(
+                slot,
+                ActiveSlot::Live {
+                    instance_id: active,
+                    ..
+                } if *active == instance_id
+            )
+        })
+    }
+
+    fn insert_active(&mut self, instance_id: u32, channel: u8, key: u8) -> bool {
+        for slot in &mut self.active {
+            if *slot == ActiveSlot::Empty {
+                *slot = ActiveSlot::Live {
+                    instance_id,
+                    channel,
+                    key,
+                };
+                return true;
+            }
+        }
+        false
+    }
+
+    fn remove_active(&mut self, instance_id: u32, channel: u8, key: u8) {
+        for slot in &mut self.active {
+            if matches!(
+                slot,
+                ActiveSlot::Live {
+                    instance_id: active,
+                    channel: active_channel,
+                    key: active_key,
+                } if *active == instance_id && *active_channel == channel && *active_key == key
+            ) {
+                *slot = ActiveSlot::Empty;
+                return;
+            }
+        }
+    }
+
+    fn clear_channel(&mut self, channel: u8) {
+        for slot in &mut self.active {
+            if matches!(slot, ActiveSlot::Live { channel: active, .. } if *active == channel) {
+                *slot = ActiveSlot::Empty;
+            }
+        }
+    }
+}
+
+const fn retention_key(event: ScheduledEvent) -> (u8, u64, i64) {
+    (event.kind.priority(), event.stable_id, event.absolute_frame)
+}
+
+fn insertion_sort_events(events: &mut [ScheduledEvent]) {
+    for index in 1..events.len() {
+        let value = events[index];
+        let mut cursor = index;
+        while cursor > 0 && schedule_key(value) < schedule_key(events[cursor - 1]) {
+            events[cursor] = events[cursor - 1];
+            cursor -= 1;
+        }
+        events[cursor] = value;
+    }
+}
+
+const fn schedule_key(event: ScheduledEvent) -> (u32, u8, u64) {
+    (event.frame_offset, event.kind.priority(), event.stable_id)
+}
+
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+enum SlotState {
+    Current,
+    Retired,
+}
+
+struct PlanSlot {
+    plan: PreparedPlan,
+    generation: u64,
+    state: SlotState,
+    active_ticket: Option<u64>,
+}
+
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+pub struct PublishReceipt {
+    pub generation: u64,
+    pub digest: u64,
+}
+
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+pub struct ReadTicket {
+    slot: usize,
+    generation: u64,
+    digest: u64,
+    ticket_id: u64,
+}
+
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+pub struct PlanObservation {
+    pub generation: u64,
+    pub digest: u64,
+}
+
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+pub struct ReclaimedGeneration {
+    pub generation: u64,
+    pub digest: u64,
+}
+
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+pub enum PublishError {
+    NoFreeSlot,
+    GenerationExhausted,
+}
+
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+pub enum HandoffError {
+    StaleTicket,
+    ReaderAlreadyEnded,
+}
+
+/// Two-slot fake-host handoff used to model publication and delayed reclamation.
+///
+/// This deliberately is not claimed to be a concurrent lock-free primitive: its
+/// methods require exclusive access while reader boundaries are instrumented.
+pub struct FixedHandoff {
+    slots: [Option<PlanSlot>; 2],
+    current: Option<usize>,
+    next_generation: u64,
+    next_ticket: u64,
+}
+
+impl FixedHandoff {
+    #[must_use]
+    pub fn new() -> Self {
+        Self {
+            slots: std::array::from_fn(|_| None),
+            current: None,
+            next_generation: 1,
+            next_ticket: 1,
+        }
+    }
+
+    /// Control-thread publication into the free fixed slot.
+    ///
+    /// # Errors
+    ///
+    /// Returns an error if delayed reclamation leaves no free slot or the
+    /// generation counter is exhausted.
+    pub fn publish(&mut self, plan: PreparedPlan) -> Result<PublishReceipt, PublishError> {
+        let Some(free) = self.slots.iter().position(Option::is_none) else {
+            return Err(PublishError::NoFreeSlot);
+        };
+        let generation = self.next_generation;
+        self.next_generation = self
+            .next_generation
+            .checked_add(1)
+            .ok_or(PublishError::GenerationExhausted)?;
+        if let Some(current) = self.current
+            && let Some(slot) = self.slots.get_mut(current).and_then(Option::as_mut)
+        {
+            slot.state = SlotState::Retired;
+        }
+        let digest = plan.digest();
+        self.slots[free] = Some(PlanSlot {
+            plan,
+            generation,
+            state: SlotState::Current,
+            active_ticket: None,
+        });
+        self.current = Some(free);
+        Ok(PublishReceipt { generation, digest })
+    }
+
+    /// Instrument the point where the single fake audio thread captures a slot.
+    pub fn begin_callback(&mut self) -> Option<ReadTicket> {
+        let slot_index = self.current?;
+        let slot = self.slots.get_mut(slot_index)?.as_mut()?;
+        if slot.active_ticket.is_some() {
+            return None;
+        }
+        let ticket_id = self.next_ticket;
+        self.next_ticket = self.next_ticket.wrapping_add(1);
+        slot.active_ticket = Some(ticket_id);
+        Some(ReadTicket {
+            slot: slot_index,
+            generation: slot.generation,
+            digest: slot.plan.digest(),
+            ticket_id,
+        })
+    }
+
+    /// Copy the two identity fields; neither can come from another slot.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`HandoffError::StaleTicket`] when the ticket no longer pins
+    /// the same complete slot.
+    pub fn observe(&self, ticket: ReadTicket) -> Result<PlanObservation, HandoffError> {
+        let slot = self.ticket_slot(ticket)?;
+        Ok(PlanObservation {
+            generation: slot.generation,
+            digest: slot.plan.digest(),
+        })
+    }
+
+    /// Use the pinned immutable plan in a fake callback.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`HandoffError::StaleTicket`] when the ticket no longer pins
+    /// the same complete slot.
+    pub fn with_plan<R>(
+        &self,
+        ticket: ReadTicket,
+        operation: impl FnOnce(&PreparedPlan) -> R,
+    ) -> Result<R, HandoffError> {
+        let slot = self.ticket_slot(ticket)?;
+        Ok(operation(&slot.plan))
+    }
+
+    /// Release one fake callback ticket.
+    ///
+    /// # Errors
+    ///
+    /// Returns an error for a stale ticket or a ticket that was already ended.
+    pub fn end_callback(&mut self, ticket: ReadTicket) -> Result<(), HandoffError> {
+        let Some(slot) = self.slots.get_mut(ticket.slot).and_then(Option::as_mut) else {
+            return Err(HandoffError::StaleTicket);
+        };
+        if slot.generation != ticket.generation || slot.plan.digest() != ticket.digest {
+            return Err(HandoffError::StaleTicket);
+        }
+        match slot.active_ticket {
+            Some(active) if active == ticket.ticket_id => {
+                slot.active_ticket = None;
+                Ok(())
+            }
+            _ => Err(HandoffError::ReaderAlreadyEnded),
+        }
+    }
+
+    /// Remove at most one unpinned retired plan on the control thread.
+    pub fn reclaim_retired_control(&mut self) -> Option<ReclaimedGeneration> {
+        let index = self.slots.iter().position(|slot| {
+            slot.as_ref().is_some_and(|slot| {
+                slot.state == SlotState::Retired && slot.active_ticket.is_none()
+            })
+        })?;
+        let slot = self.slots[index].take()?;
+        Some(ReclaimedGeneration {
+            generation: slot.generation,
+            digest: slot.plan.digest(),
+        })
+    }
+
+    #[must_use]
+    pub fn current_generation(&self) -> Option<u64> {
+        self.current_slot().map(|slot| slot.generation)
+    }
+
+    #[must_use]
+    pub fn current_digest(&self) -> Option<u64> {
+        self.current_slot().map(|slot| slot.plan.digest())
+    }
+
+    fn current_slot(&self) -> Option<&PlanSlot> {
+        self.current
+            .and_then(|index| self.slots.get(index))
+            .and_then(Option::as_ref)
+    }
+
+    fn ticket_slot(&self, ticket: ReadTicket) -> Result<&PlanSlot, HandoffError> {
+        let slot = self
+            .slots
+            .get(ticket.slot)
+            .and_then(Option::as_ref)
+            .ok_or(HandoffError::StaleTicket)?;
+        if slot.generation != ticket.generation
+            || slot.plan.digest() != ticket.digest
+            || slot.active_ticket != Some(ticket.ticket_id)
+        {
+            return Err(HandoffError::StaleTicket);
+        }
+        Ok(slot)
+    }
+}
+
+impl Default for FixedHandoff {
+    fn default() -> Self {
+        Self::new()
+    }
+}
diff --git a/developer-simulation/runs/2026-08-12--midi-scheduler-rt-model/src/oracle.rs b/developer-simulation/runs/2026-08-12--midi-scheduler-rt-model/src/oracle.rs
new file mode 100644
index 0000000..871653e
--- /dev/null
+++ b/developer-simulation/runs/2026-08-12--midi-scheduler-rt-model/src/oracle.rs
@@ -0,0 +1,153 @@
+//! Slow allocating rational oracle.
+//!
+//! This module intentionally duplicates conversion and block selection. It
+//! does not call the scheduler's preparation or timestamp helpers.
+
+use crate::{EventKind, HostBlock, PlanSpec, ScheduledEvent};
+
+const ORACLE_DENOMINATOR: i128 = 960_i128 * 1_000_000_i128;
+
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+pub enum OracleError {
+    EmptyTempoMap,
+    PulseBeforeOrigin,
+    FrameOverflow,
+}
+
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+struct OracleEvent {
+    frame: i64,
+    stable_id: u64,
+    kind: EventKind,
+}
+
+#[derive(Clone, Debug, Eq, PartialEq)]
+pub struct OraclePlan {
+    sample_rate: u32,
+    events: Vec<OracleEvent>,
+}
+
+impl OraclePlan {
+    /// Convert every event independently with the slow rational baseline.
+    ///
+    /// # Errors
+    ///
+    /// Returns an error when the tempo map is empty, an event precedes the
+    /// declared origin, or the exact frame does not fit in a signed 64-bit value.
+    pub fn from_spec(spec: &PlanSpec) -> Result<Self, OracleError> {
+        let mut events = Vec::with_capacity(spec.events.len());
+        for event in &spec.events {
+            let frame = oracle_frame(spec, event.pulse)?;
+            events.push(OracleEvent {
+                frame,
+                stable_id: event.stable_id,
+                kind: event.kind,
+            });
+        }
+        events.sort_unstable_by_key(|event| (event.frame, event.kind.priority(), event.stable_id));
+        Ok(Self {
+            sample_rate: spec.sample_rate,
+            events,
+        })
+    }
+}
+
+#[derive(Clone, Copy, Debug, Default, Eq, PartialEq)]
+pub struct OracleRunner {
+    last_token: Option<u64>,
+}
+
+impl OracleRunner {
+    #[must_use]
+    pub const fn new() -> Self {
+        Self { last_token: None }
+    }
+
+    pub fn schedule(&mut self, plan: &OraclePlan, block: HostBlock) -> Vec<ScheduledEvent> {
+        if self.last_token == Some(block.token)
+            || block.sample_rate != plan.sample_rate
+            || block.length == 0
+        {
+            return Vec::new();
+        }
+        let Some(end) = block.start_frame.checked_add(i64::from(block.length)) else {
+            return Vec::new();
+        };
+        self.last_token = Some(block.token);
+        let mut output = Vec::new();
+        for event in &plan.events {
+            if event.frame >= block.start_frame && event.frame < end {
+                let Ok(frame_offset) = u32::try_from(event.frame - block.start_frame) else {
+                    continue;
+                };
+                output.push(ScheduledEvent {
+                    absolute_frame: event.frame,
+                    frame_offset,
+                    stable_id: event.stable_id,
+                    kind: event.kind,
+                    synthetic: false,
+                });
+            }
+        }
+        output
+    }
+}
+
+fn oracle_frame(spec: &PlanSpec, target_pulse: i64) -> Result<i64, OracleError> {
+    if target_pulse < spec.origin_pulse {
+        return Err(OracleError::PulseBeforeOrigin);
+    }
+    let Some(first) = spec.tempo_nodes.first() else {
+        return Err(OracleError::EmptyTempoMap);
+    };
+    let mut numerator = i128::from(spec.origin_frame)
+        .checked_mul(ORACLE_DENOMINATOR)
+        .ok_or(OracleError::FrameOverflow)?;
+    let mut segment_start = spec.origin_pulse;
+    let mut micros = first.micros_per_quarter;
+
+    for next in spec.tempo_nodes.iter().skip(1) {
+        let segment_end = target_pulse.min(next.pulse);
+        numerator = oracle_add(
+            numerator,
+            segment_end,
+            segment_start,
+            micros,
+            spec.sample_rate,
+        )?;
+        if target_pulse <= next.pulse {
+            return oracle_integer_frame(numerator);
+        }
+        segment_start = next.pulse;
+        micros = next.micros_per_quarter;
+    }
+    numerator = oracle_add(
+        numerator,
+        target_pulse,
+        segment_start,
+        micros,
+        spec.sample_rate,
+    )?;
+    oracle_integer_frame(numerator)
+}
+
+fn oracle_add(
+    accumulator: i128,
+    end_pulse: i64,
+    start_pulse: i64,
+    micros: u32,
+    sample_rate: u32,
+) -> Result<i128, OracleError> {
+    let distance = i128::from(end_pulse) - i128::from(start_pulse);
+    let segment = distance
+        .checked_mul(i128::from(micros))
+        .and_then(|value| value.checked_mul(i128::from(sample_rate)))
+        .ok_or(OracleError::FrameOverflow)?;
+    accumulator
+        .checked_add(segment)
+        .ok_or(OracleError::FrameOverflow)
+}
+
+fn oracle_integer_frame(numerator: i128) -> Result<i64, OracleError> {
+    i64::try_from(numerator.div_euclid(ORACLE_DENOMINATOR)).map_err(|_| OracleError::FrameOverflow)
+}
diff --git a/developer-simulation/runs/2026-08-12--midi-scheduler-rt-model/tests/callback_scheduler.rs b/developer-simulation/runs/2026-08-12--midi-scheduler-rt-model/tests/callback_scheduler.rs
new file mode 100644
index 0000000..0669348
--- /dev/null
+++ b/developer-simulation/runs/2026-08-12--midi-scheduler-rt-model/tests/callback_scheduler.rs
@@ -0,0 +1,702 @@
+use midi_scheduler_rt_model::{
+    CallbackError, Discontinuity, Event, EventKind, HostBlock, PlanSpec, ScheduledEvent, Scheduler,
+    TempoNode, prepare_plan,
+};
+
+fn spec(sample_rate: u32, micros_per_quarter: u32, events: Vec<Event>) -> PlanSpec {
+    PlanSpec {
+        origin_pulse: 0,
+        origin_frame: 0,
+        sample_rate,
+        tempo_nodes: vec![TempoNode {
+            pulse: 0,
+            micros_per_quarter,
+        }],
+        events,
+    }
+}
+
+fn block(token: u64, start_frame: i64, length: u32, sample_rate: u32) -> HostBlock {
+    HostBlock {
+        token,
+        start_frame,
+        length,
+        sample_rate,
+        discontinuity: Discontinuity::None,
+    }
+}
+
+fn cc(pulse: i64, stable_id: u64) -> Event {
+    Event {
+        pulse,
+        stable_id,
+        kind: EventKind::ControlChange {
+            channel: 0,
+            controller: 1,
+            value: (stable_id % 128) as u8,
+        },
+    }
+}
+
+fn note_on(pulse: i64, stable_id: u64, instance_id: u32, channel: u8) -> Event {
+    Event {
+        pulse,
+        stable_id,
+        kind: EventKind::NoteOn {
+            channel,
+            key: (instance_id % 128) as u8,
+            velocity: 100,
+            instance_id,
+        },
+    }
+}
+
+fn note_off(pulse: i64, stable_id: u64, instance_id: u32, channel: u8) -> Event {
+    Event {
+        pulse,
+        stable_id,
+        kind: EventKind::NoteOff {
+            channel,
+            key: (instance_id % 128) as u8,
+            velocity: 0,
+            instance_id,
+        },
+    }
+}
+
+#[test]
+fn half_open_boundaries_hold_at_every_sample_rate() {
+    // Break caught: end-frame events leak into the prior block or start-frame events are skipped.
+    for sample_rate in [44_100, 48_000, 96_000] {
+        let events: Vec<_> = (0_i64..80)
+            .map(|pulse| cc(pulse, pulse.cast_unsigned() + 1))
+            .collect();
+        let plan = prepare_plan(spec(sample_rate, 15_000, events)).expect("boundary plan");
+        let mut chosen = None;
+        for pair in plan.events().windows(2) {
+            if pair[1].frame == pair[0].frame + 1 && pair[0].frame >= 2 {
+                chosen = Some((pair[0].frame - 2, pair[0].frame, pair[1].frame));
+                break;
+            }
+        }
+        let (start, last, excluded) = chosen.expect("adjacent represented frames");
+        let mut scheduler = Scheduler::new(32);
+        let mut out = [ScheduledEvent::EMPTY; 256];
+        let result = scheduler.schedule(
+            &plan,
+            block(
+                1,
+                start,
+                u32::try_from(excluded - start).expect("short block"),
+                sample_rate,
+            ),
+            &mut out,
+        );
+        assert_eq!(result.error, None);
+        assert!(
+            out[..result.written]
+                .iter()
+                .any(|event| event.frame_offset == 0)
+        );
+        assert!(
+            out[..result.written]
+                .iter()
+                .any(|event| event.frame_offset == u32::try_from(last - start).unwrap())
+        );
+        assert!(
+            !out[..result.written]
+                .iter()
+                .any(|event| event.absolute_frame == excluded)
+        );
+    }
+}
+
+#[test]
+fn duplicate_tokens_emit_nothing_and_variable_blocks_have_no_alignment_assumption() {
+    // Break caught: callback replay doubles IDs or changing block size creates a gap/overlap.
+    let sizes = [16_u32, 17, 255, 256, 257, 1_024, 2_048];
+    let total_frames: i64 = sizes.iter().map(|&size| i64::from(size)).sum();
+    let events: Vec<_> = (0..total_frames)
+        .map(|frame| cc(frame, frame.cast_unsigned() + 1))
+        .collect();
+    let plan = prepare_plan(spec(48_000, 20_000, events)).expect("one-frame pulse plan");
+    let mut scheduler = Scheduler::new(16);
+    let mut out = vec![ScheduledEvent::EMPTY; 2_048].into_boxed_slice();
+    let mut start = 0_i64;
+    let mut emitted = Vec::new();
+    for (index, size) in sizes.into_iter().enumerate() {
+        let token = index as u64 + 10;
+        let first = scheduler.schedule(&plan, block(token, start, size, 48_000), &mut out);
+        emitted.extend(out[..first.written].iter().map(|event| event.stable_id));
+        let replay = scheduler.schedule(&plan, block(token, start, size, 48_000), &mut out);
+        assert!(replay.duplicate_token);
+        assert_eq!(replay.written, 0);
+        start += i64::from(size);
+    }
+    let expected: Vec<_> = (1..=u64::try_from(total_frames).unwrap()).collect();
+    assert_eq!(emitted, expected);
+}
+
+#[test]
+fn one_thousand_tokens_replayed_one_to_three_times_keep_the_same_id_digest() {
+    // Break caught: replay count leaks into callback identity or advances event state.
+    let events: Vec<_> = (0_i64..16_000)
+        .map(|frame| cc(frame, frame.cast_unsigned() + 1))
+        .collect();
+    let plan = prepare_plan(spec(48_000, 20_000, events)).expect("replay plan");
+    let mut scheduler = Scheduler::new(16);
+    let mut out = [ScheduledEvent::EMPTY; 32];
+    let mut digest = 0xcbf2_9ce4_8422_2325_u64;
+    let mut emitted = 0_usize;
+
+    for index in 0_u64..1_000 {
+        let host = block(
+            index + 1,
+            i64::try_from(index * 16).expect("bounded frame fits"),
+            16,
+            48_000,
+        );
+        let first = scheduler.schedule(&plan, host, &mut out);
+        emitted += first.written;
+        for event in &out[..first.written] {
+            digest ^= event.stable_id;
+            digest = digest.wrapping_mul(0x0000_0100_0000_01b3);
+        }
+        for _ in 0..=(index % 3) {
+            let replay = scheduler.schedule(&plan, host, &mut out);
+            assert!(replay.duplicate_token);
+            assert_eq!(replay.written, 0);
+        }
+    }
+    assert_eq!(emitted, 16_000);
+    assert_ne!(digest, 0);
+}
+
+#[test]
+fn every_non_increasing_token_is_rejected_without_reemission() {
+    // Break caught: remembering only the immediately previous token allows 10, 11, 10 to replay block 10.
+    let plan =
+        prepare_plan(spec(48_000, 20_000, vec![cc(0, 1), cc(1, 2), cc(2, 3)])).expect("token plan");
+    let mut scheduler = Scheduler::new(4);
+    let mut out = [ScheduledEvent::EMPTY; 4];
+
+    let first = scheduler.schedule(&plan, block(10, 0, 1, 48_000), &mut out);
+    assert_eq!(first.written, 1);
+    let second = scheduler.schedule(&plan, block(11, 1, 1, 48_000), &mut out);
+    assert_eq!(second.written, 1);
+
+    for token in [10_u64, 11, 9, 10] {
+        let rejected = scheduler.schedule(&plan, block(token, 0, 3, 48_000), &mut out);
+        assert_eq!(rejected.error, Some(CallbackError::NonMonotonicToken));
+        assert_eq!(rejected.written, 0);
+    }
+
+    let next = scheduler.schedule(&plan, block(12, 2, 1, 48_000), &mut out);
+    assert_eq!(next.error, None);
+    assert_eq!(next.written, 1);
+    assert_eq!(out[0].stable_id, 3);
+}
+
+#[test]
+fn discontinuities_terminate_active_instances_before_new_events() {
+    // Break caught: a seek, loop, sample-rate swap, or invalidating replacement leaves a prior note active.
+    let old = prepare_plan(spec(
+        48_000,
+        20_000,
+        vec![note_on(0, 1, 77, 2), note_off(100, 2, 77, 2)],
+    ))
+    .expect("old plan");
+    let replacement = prepare_plan(spec(48_000, 20_000, vec![cc(0, 3)])).expect("replacement plan");
+    let new_rate = prepare_plan(spec(96_000, 10_000, vec![cc(0, 4)])).expect("rate plan");
+    let mut scheduler = Scheduler::new(32);
+    let mut out = [ScheduledEvent::EMPTY; 32];
+
+    let onset = scheduler.schedule(&old, block(1, 0, 1, 48_000), &mut out);
+    assert_eq!(onset.written, 1);
+    assert_eq!(scheduler.active_count(), 1);
+
+    for (token, cause, plan, expected_active_after) in [
+        (2, Discontinuity::Seek, &old, 1),
+        (4, Discontinuity::LoopWrap, &old, 1),
+        (6, Discontinuity::PlanReplacement, &replacement, 0),
+        (8, Discontinuity::SampleRateChange, &new_rate, 0),
+    ] {
+        if scheduler.active_count() == 0 {
+            let rearm = scheduler.schedule(&old, block(token - 1, 0, 1, 48_000), &mut out);
+            assert_eq!(rearm.written, 1);
+        }
+        let sample_rate = plan.sample_rate();
+        let result = scheduler.schedule(
+            plan,
+            HostBlock {
+                discontinuity: cause,
+                ..block(token, 0, 1, sample_rate)
+            },
+            &mut out,
+        );
+        assert!(result.written >= 1);
+        assert!(result.synthetic_terminations >= 1);
+        assert!(matches!(
+            out[0].kind,
+            EventKind::NoteOff {
+                instance_id: 77,
+                ..
+            }
+        ));
+        assert_eq!(scheduler.active_count(), expected_active_after);
+    }
+
+    let invalid = scheduler.schedule(&old, block(50, i64::MAX, 16, 48_000), &mut out);
+    assert_eq!(invalid.error, Some(CallbackError::FrameRangeOverflow));
+}
+
+#[test]
+fn replacement_with_reused_instance_id_but_new_identity_terminates_old_note() {
+    // Break caught: replacement validity compares only instance ID and preserves a different channel/key.
+    let old = prepare_plan(spec(
+        48_000,
+        20_000,
+        vec![note_on(0, 1, 77, 2), note_off(100, 2, 77, 2)],
+    ))
+    .expect("old identity plan");
+    let replacement = prepare_plan(spec(
+        48_000,
+        20_000,
+        vec![note_on(100, 3, 77, 3), note_off(110, 4, 77, 3)],
+    ))
+    .expect("replacement identity plan");
+    let mut scheduler = Scheduler::new(8);
+    let mut out = [ScheduledEvent::EMPTY; 8];
+    assert_eq!(
+        scheduler
+            .schedule(&old, block(1, 0, 1, 48_000), &mut out)
+            .written,
+        1
+    );
+
+    let result = scheduler.schedule(
+        &replacement,
+        HostBlock {
+            discontinuity: Discontinuity::PlanReplacement,
+            ..block(2, 50, 1, 48_000)
+        },
+        &mut out,
+    );
+    assert_eq!(result.error, None);
+    assert_eq!(result.synthetic_terminations, 1);
+    assert!(matches!(
+        out[0].kind,
+        EventKind::NoteOff {
+            channel: 2,
+            instance_id: 77,
+            ..
+        }
+    ));
+    assert_eq!(scheduler.active_count(), 0);
+}
+
+#[test]
+fn one_hundred_loop_wraps_terminate_then_restart_the_loop_note() {
+    // Break caught: repeated wraps accumulate duplicate active instances or order onset before termination.
+    let plan = prepare_plan(spec(
+        48_000,
+        20_000,
+        vec![note_on(0, 1, 9, 1), note_off(10, 2, 9, 1)],
+    ))
+    .expect("loop plan");
+    let mut scheduler = Scheduler::new(32);
+    let mut out = [ScheduledEvent::EMPTY; 8];
+    let first = scheduler.schedule(&plan, block(1, 0, 1, 48_000), &mut out);
+    assert_eq!(first.written, 1);
+
+    for token in 2..=101 {
+        let result = scheduler.schedule(
+            &plan,
+            HostBlock {
+                discontinuity: Discontinuity::LoopWrap,
+                ..block(token, 0, 1, 48_000)
+            },
+            &mut out,
+        );
+        assert_eq!(result.synthetic_terminations, 1);
+        assert_eq!(result.written, 2);
+        assert!(matches!(out[0].kind, EventKind::NoteOff { .. }));
+        assert!(matches!(out[1].kind, EventKind::NoteOn { .. }));
+        assert_eq!(scheduler.active_count(), 1);
+    }
+}
+
+#[test]
+fn termination_saturation_falls_back_per_channel_and_suppresses_note_ons() {
+    // Break caught: overload drops terminations to retain notes, or emits more than capacity.
+    let mut events = Vec::new();
+    for instance in 0_u32..300 {
+        events.push(note_on(
+            0,
+            u64::from(instance) + 1,
+            instance + 1,
+            (instance % 16) as u8,
+        ));
+    }
+    for instance in 0_u32..300 {
+        events.push(note_off(
+            10,
+            u64::from(instance) + 1_000,
+            instance + 1,
+            (instance % 16) as u8,
+        ));
+    }
+    let plan = prepare_plan(spec(48_000, 20_000, events)).expect("saturation plan");
+    let mut scheduler = Scheduler::new(512);
+    let mut wide = [ScheduledEvent::EMPTY; 512];
+    let armed = scheduler.schedule(&plan, block(1, 0, 1, 48_000), &mut wide);
+    assert_eq!(armed.written, 300);
+    assert_eq!(scheduler.active_count(), 300);
+
+    let mut fixed = [ScheduledEvent::EMPTY; 256];
+    let wrapped = scheduler.schedule(
+        &plan,
+        HostBlock {
+            discontinuity: Discontinuity::LoopWrap,
+            ..block(2, 0, 1, 48_000)
+        },
+        &mut fixed,
+    );
+    assert_eq!(wrapped.written, 16);
+    assert_eq!(wrapped.synthetic_terminations, 16);
+    assert!(
+        fixed[..wrapped.written]
+            .iter()
+            .all(|event| matches!(event.kind, EventKind::AllNotesOff { .. }))
+    );
+    assert!(scheduler.sticky_overflow());
+    assert_eq!(scheduler.active_count(), 0);
+    scheduler.clear_overflow_control();
+    assert!(!scheduler.sticky_overflow());
+}
+
+#[test]
+fn ordinary_note_off_overload_falls_back_without_stuck_notes_or_note_on_leakage() {
+    // Break caught: retaining only 256 of 300 ordinary NoteOffs leaves 44 instances active.
+    let mut events = Vec::new();
+    for instance in 1_u32..=300 {
+        events.push(note_on(
+            0,
+            u64::from(instance),
+            instance,
+            (instance % 16) as u8,
+        ));
+    }
+    for instance in 1_u32..=300 {
+        events.push(note_off(
+            10,
+            u64::from(instance) + 1_000,
+            instance,
+            (instance % 16) as u8,
+        ));
+    }
+    for instance in 1_u32..=20 {
+        events.push(note_on(
+            10,
+            u64::from(instance) + 2_000,
+            instance + 10_000,
+            (instance % 16) as u8,
+        ));
+    }
+    events.sort_unstable_by_key(|event| (event.pulse, event.kind.priority(), event.stable_id));
+    let plan = prepare_plan(spec(48_000, 20_000, events)).expect("ordinary termination plan");
+    let mut scheduler = Scheduler::new(512);
+    let mut arm = [ScheduledEvent::EMPTY; 512];
+    assert_eq!(
+        scheduler
+            .schedule(&plan, block(1, 0, 1, 48_000), &mut arm)
+            .written,
+        300
+    );
+    assert_eq!(scheduler.active_count(), 300);
+
+    let mut fixed = [ScheduledEvent::EMPTY; 256];
+    let result = scheduler.schedule(&plan, block(2, 10, 1, 48_000), &mut fixed);
+    assert_eq!(result.error, None);
+    assert_eq!(result.synthetic_terminations, 16);
+    assert_eq!(result.written, 16);
+    assert!(result.overflowed);
+    assert!(
+        fixed[..result.written]
+            .iter()
+            .all(|event| matches!(event.kind, EventKind::AllNotesOff { .. }))
+    );
+    assert_eq!(scheduler.active_count(), 0);
+    assert!(scheduler.sticky_overflow());
+}
+
+#[test]
+fn combined_discontinuity_and_ordinary_terminations_use_one_channel_fallback() {
+    // Break caught: counting overlapping active instances once hides 400 termination outputs behind 200 notes.
+    let mut events = Vec::new();
+    for instance in 1_u32..=200 {
+        events.push(note_on(
+            0,
+            u64::from(instance),
+            instance,
+            (instance % 16) as u8,
+        ));
+    }
+    for instance in 1_u32..=200 {
+        events.push(note_off(
+            10,
+            u64::from(instance) + 1_000,
+            instance,
+            (instance % 16) as u8,
+        ));
+    }
+    let plan = prepare_plan(spec(48_000, 20_000, events)).expect("combined termination plan");
+    let mut scheduler = Scheduler::new(256);
+    let mut output = [ScheduledEvent::EMPTY; 256];
+    assert_eq!(
+        scheduler
+            .schedule(&plan, block(1, 0, 1, 48_000), &mut output)
+            .written,
+        200
+    );
+
+    let result = scheduler.schedule(
+        &plan,
+        HostBlock {
+            discontinuity: Discontinuity::LoopWrap,
+            ..block(2, 10, 1, 48_000)
+        },
+        &mut output,
+    );
+    assert_eq!(result.synthetic_terminations, 16);
+    assert_eq!(result.written, 16);
+    assert!(
+        output[..16]
+            .iter()
+            .all(|event| matches!(event.kind, EventKind::AllNotesOff { .. }))
+    );
+    assert_eq!(scheduler.active_count(), 0);
+}
+
+#[test]
+fn failed_too_small_termination_output_can_retry_the_same_token() {
+    // Break caught: a failed callback consumes its token, so the safe retry is suppressed.
+    let plan = prepare_plan(spec(
+        48_000,
+        20_000,
+        vec![
+            note_on(0, 1, 1, 0),
+            note_on(0, 2, 2, 1),
+            note_off(10, 3, 1, 0),
+            note_off(10, 4, 2, 1),
+        ],
+    ))
+    .expect("retry plan");
+    let mut scheduler = Scheduler::new(8);
+    let mut wide = [ScheduledEvent::EMPTY; 8];
+    assert_eq!(
+        scheduler
+            .schedule(&plan, block(1, 0, 1, 48_000), &mut wide)
+            .written,
+        2
+    );
+    assert_eq!(scheduler.active_count(), 2);
+
+    let retry_block = HostBlock {
+        discontinuity: Discontinuity::Seek,
+        ..block(2, 20, 1, 48_000)
+    };
+    let mut too_small = [ScheduledEvent::EMPTY; 1];
+    let failed = scheduler.schedule(&plan, retry_block, &mut too_small);
+    assert_eq!(failed.error, Some(CallbackError::TerminationOutputTooSmall));
+    assert_eq!(failed.written, 0);
+    assert_eq!(scheduler.active_count(), 2);
+
+    let retried = scheduler.schedule(&plan, retry_block, &mut wide);
+    assert_eq!(retried.error, None);
+    assert_eq!(retried.synthetic_terminations, 2);
+    assert_eq!(retried.written, 2);
+    assert!(
+        wide[..2]
+            .iter()
+            .all(|event| matches!(event.kind, EventKind::NoteOff { .. }))
+    );
+    assert_eq!(scheduler.active_count(), 0);
+}
+
+#[test]
+fn mixed_four_thousand_ninety_six_event_frame_keeps_one_fallback_per_channel() {
+    // Break caught: ordinary AllNotesOff duplicates the per-channel fallback or a NoteOn survives it.
+    let mut events = Vec::new();
+    let mut stable_id = 1_u64;
+    for instance in 1_u32..=300 {
+        events.push(note_on(-1, stable_id, instance, (instance % 16) as u8));
+        stable_id += 1;
+    }
+    for instance in 1_u32..=300 {
+        events.push(note_off(0, stable_id, instance, (instance % 16) as u8));
+        stable_id += 1;
+    }
+    for index in 0_u32..3_796 {
+        let kind = match index % 4 {
+            0 => EventKind::AllNotesOff {
+                channel: (index % 16) as u8,
+            },
+            1 => EventKind::ControlChange {
+                channel: (index % 16) as u8,
+                controller: (index % 128) as u8,
+                value: 2,
+            },
+            2 => EventKind::ProgramChange {
+                channel: (index % 16) as u8,
+                program: (index % 128) as u8,
+            },
+            _ => EventKind::NoteOn {
+                channel: (index % 16) as u8,
+                key: (index % 128) as u8,
+                velocity: 2,
+                instance_id: index + 10_000,
+            },
+        };
+        events.push(Event {
+            pulse: 0,
+            stable_id,
+            kind,
+        });
+        stable_id += 1;
+    }
+    events.sort_unstable_by_key(|event| (event.pulse, event.kind.priority(), event.stable_id));
+    let plan = prepare_plan(PlanSpec {
+        origin_pulse: -1,
+        origin_frame: -1,
+        sample_rate: 48_000,
+        tempo_nodes: vec![TempoNode {
+            pulse: -1,
+            micros_per_quarter: 20_000,
+        }],
+        events,
+    })
+    .expect("mixed saturation plan");
+    let mut scheduler = Scheduler::new(2_048);
+    let mut wide = [ScheduledEvent::EMPTY; 512];
+    assert_eq!(
+        scheduler
+            .schedule(&plan, block(1, -1, 1, 48_000), &mut wide)
+            .written,
+        300
+    );
+    let mut fixed = [ScheduledEvent::EMPTY; 256];
+    let result = scheduler.schedule(
+        &plan,
+        HostBlock {
+            discontinuity: Discontinuity::LoopWrap,
+            ..block(2, 0, 1, 48_000)
+        },
+        &mut fixed,
+    );
+    assert_eq!(result.written, 256);
+    assert_eq!(
+        fixed[..result.written]
+            .iter()
+            .filter(|event| matches!(event.kind, EventKind::AllNotesOff { .. }))
+            .count(),
+        16
+    );
+    assert!(
+        !fixed[..result.written]
+            .iter()
+            .any(|event| matches!(event.kind, EventKind::NoteOn { .. }))
+    );
+    assert!(scheduler.sticky_overflow());
+}
+
+#[test]
+fn skipped_block_then_forward_seek_and_backward_seek_both_terminate_prior_notes() {
+    // Break caught: cursor reset assumes contiguous blocks and misses transport-generation cleanup.
+    let plan = prepare_plan(spec(
+        48_000,
+        20_000,
+        vec![note_on(0, 1, 1, 0), note_off(100, 2, 1, 0)],
+    ))
+    .expect("seek plan");
+    let mut scheduler = Scheduler::new(8);
+    let mut out = [ScheduledEvent::EMPTY; 8];
+    assert_eq!(
+        scheduler
+            .schedule(&plan, block(1, 0, 16, 48_000), &mut out)
+            .written,
+        1
+    );
+    let forward = scheduler.schedule(
+        &plan,
+        HostBlock {
+            discontinuity: Discontinuity::Seek,
+            ..block(2, 64, 16, 48_000)
+        },
+        &mut out,
+    );
+    assert_eq!(forward.synthetic_terminations, 1);
+    assert_eq!(scheduler.active_count(), 0);
+
+    assert_eq!(
+        scheduler
+            .schedule(&plan, block(3, 0, 16, 48_000), &mut out)
+            .written,
+        1
+    );
+    let backward = scheduler.schedule(
+        &plan,
+        HostBlock {
+            discontinuity: Discontinuity::Seek,
+            ..block(4, 0, 16, 48_000)
+        },
+        &mut out,
+    );
+    assert_eq!(backward.synthetic_terminations, 1);
+    assert!(matches!(out[0].kind, EventKind::NoteOff { .. }));
+}
+
+#[test]
+fn ordinary_overload_retains_higher_priority_events() {
+    // Break caught: callback simply truncates chronological input and keeps NoteOn over termination/control.
+    let mut events = Vec::new();
+    for id in 0_u64..4_096 {
+        let kind = match id % 5 {
+            0 => EventKind::AllNotesOff {
+                channel: (id % 16) as u8,
+            },
+            1 => EventKind::ControlChange {
+                channel: (id % 16) as u8,
+                controller: (id % 128) as u8,
+                value: 1,
+            },
+            2 => EventKind::ProgramChange {
+                channel: (id % 16) as u8,
+                program: (id % 128) as u8,
+            },
+            3 | 4 => EventKind::NoteOn {
+                channel: (id % 16) as u8,
+                key: (id % 128) as u8,
+                velocity: 1,
+                instance_id: u32::try_from(id + 1).unwrap(),
+            },
+            _ => unreachable!(),
+        };
+        events.push(Event {
+            pulse: 0,
+            stable_id: id + 1,
+            kind,
+        });
+    }
+    events.sort_unstable_by_key(|event| (event.pulse, event.kind.priority(), event.stable_id));
+    let plan = prepare_plan(spec(48_000, 20_000, events)).expect("ordinary saturation plan");
+    let mut scheduler = Scheduler::new(4_096);
+    let mut out = [ScheduledEvent::EMPTY; 256];
+    let result = scheduler.schedule(&plan, block(1, 0, 1, 48_000), &mut out);
+    assert_eq!(result.written, 256);
+    assert!(scheduler.sticky_overflow());
+    assert!(
+        out.iter()
+            .all(|event| matches!(event.kind, EventKind::AllNotesOff { .. }))
+    );
+}
diff --git a/developer-simulation/runs/2026-08-12--midi-scheduler-rt-model/tests/oracle_traces.rs b/developer-simulation/runs/2026-08-12--midi-scheduler-rt-model/tests/oracle_traces.rs
new file mode 100644
index 0000000..7aa9abc
--- /dev/null
+++ b/developer-simulation/runs/2026-08-12--midi-scheduler-rt-model/tests/oracle_traces.rs
@@ -0,0 +1,210 @@
+use midi_scheduler_rt_model::oracle::{OraclePlan, OracleRunner};
+use midi_scheduler_rt_model::{
+    Discontinuity, Event, EventKind, HostBlock, PlanSpec, ScheduledEvent, Scheduler, TempoNode,
+    prepare_plan,
+};
+
+#[derive(Clone, Copy)]
+struct Lcg(u64);
+
+impl Lcg {
+    fn next(&mut self) -> u64 {
+        self.0 = self
+            .0
+            .wrapping_mul(6_364_136_223_846_793_005)
+            .wrapping_add(1_442_695_040_888_963_407);
+        self.0
+    }
+
+    fn below(&mut self, upper: u64) -> u64 {
+        self.next() % upper
+    }
+}
+
+fn trace_spec(seed: u64) -> PlanSpec {
+    let seed_index = usize::try_from(seed).expect("test seed fits usize");
+    let sample_rate = [44_100, 48_000, 96_000][seed_index % 3];
+    let mut random = Lcg(seed ^ 0x8a5c_2137_d95e_42ad);
+    let origin_pulse = -200;
+    let tempo_nodes = vec![
+        TempoNode {
+            pulse: origin_pulse,
+            micros_per_quarter: 15_000
+                + u32::try_from(random.below(20_000)).expect("bounded tempo fits"),
+        },
+        TempoNode {
+            pulse: -50,
+            micros_per_quarter: 10_000
+                + u32::try_from(random.below(30_000)).expect("bounded tempo fits"),
+        },
+        TempoNode {
+            pulse: -49,
+            micros_per_quarter: 10_000
+                + u32::try_from(random.below(30_000)).expect("bounded tempo fits"),
+        },
+        TempoNode {
+            pulse: 120,
+            micros_per_quarter: 10_000
+                + u32::try_from(random.below(30_000)).expect("bounded tempo fits"),
+        },
+    ];
+    let mut events = Vec::new();
+    let mut stable_id = 1_u64;
+    for pair in 0_u32..30 {
+        let on_pulse = -190
+            + i64::from(pair) * 12
+            + i64::try_from(random.below(4)).expect("bounded pulse fits");
+        events.push(Event {
+            pulse: on_pulse,
+            stable_id,
+            kind: EventKind::NoteOn {
+                channel: (pair % 16) as u8,
+                key: u8::try_from(40 + pair % 40).expect("fixture key fits"),
+                velocity: 90,
+                instance_id: pair + 1,
+            },
+        });
+        stable_id += 1;
+        events.push(Event {
+            pulse: on_pulse + 5 + i64::try_from(random.below(5)).expect("bounded pulse fits"),
+            stable_id,
+            kind: EventKind::NoteOff {
+                channel: (pair % 16) as u8,
+                key: u8::try_from(40 + pair % 40).expect("fixture key fits"),
+                velocity: 0,
+                instance_id: pair + 1,
+            },
+        });
+        stable_id += 1;
+    }
+    for index in 0_u64..140 {
+        let pulse = origin_pulse + i64::try_from(random.below(500)).expect("bounded pulse fits");
+        let kind = match index % 3 {
+            0 => EventKind::ControlChange {
+                channel: (index % 16) as u8,
+                controller: (index % 128) as u8,
+                value: u8::try_from(random.below(128)).expect("bounded MIDI byte fits"),
+            },
+            1 => EventKind::ProgramChange {
+                channel: (index % 16) as u8,
+                program: u8::try_from(random.below(128)).expect("bounded MIDI byte fits"),
+            },
+            _ => EventKind::AllNotesOff {
+                channel: (index % 16) as u8,
+            },
+        };
+        events.push(Event {
+            pulse,
+            stable_id,
+            kind,
+        });
+        stable_id += 1;
+    }
+    // Exact tempo-edge fixtures are present in every seed.
+    for pulse in [-50, -49, 120] {
+        events.push(Event {
+            pulse,
+            stable_id,
+            kind: EventKind::ControlChange {
+                channel: 15,
+                controller: 127,
+                value: 1,
+            },
+        });
+        stable_id += 1;
+    }
+    events.sort_unstable_by_key(|event| (event.pulse, event.kind.priority(), event.stable_id));
+    PlanSpec {
+        origin_pulse,
+        origin_frame: -97,
+        sample_rate,
+        tempo_nodes,
+        events,
+    }
+}
+
+fn run_seed(seed: u64) -> Vec<(u64, u32, EventKind, u64)> {
+    let seed_index = usize::try_from(seed).expect("test seed fits usize");
+    let spec = trace_spec(seed);
+    let oracle_plan = OraclePlan::from_spec(&spec).expect("oracle conversion");
+    let plan = prepare_plan(spec).expect("scheduler preparation");
+    let mut scheduler = Scheduler::new(128);
+    let mut oracle = OracleRunner::new();
+    let mut output = [ScheduledEvent::EMPTY; 512];
+    let sizes = [16_u32, 17, 255, 256, 257, 1_024, 2_048];
+    let first_frame = plan.events().first().expect("events").frame - 3;
+    let last_frame = plan.events().last().expect("events").frame + 4;
+    let mut start = first_frame;
+    let mut token = seed * 10_000 + 1;
+    let mut actual_log = Vec::new();
+    let mut expected_log = Vec::new();
+    let mut block_index = 0_usize;
+
+    while start < last_frame {
+        let length = sizes[(block_index + seed_index) % sizes.len()];
+        let host = HostBlock {
+            token,
+            start_frame: start,
+            length,
+            sample_rate: plan.sample_rate(),
+            discontinuity: Discontinuity::None,
+        };
+        let actual = scheduler.schedule(&plan, host, &mut output);
+        assert_eq!(actual.error, None);
+        assert!(!actual.overflowed);
+        actual_log.extend(
+            output[..actual.written]
+                .iter()
+                .map(|event| (token, event.frame_offset, event.kind, event.stable_id)),
+        );
+        expected_log.extend(
+            oracle
+                .schedule(&oracle_plan, host)
+                .into_iter()
+                .map(|event| (token, event.frame_offset, event.kind, event.stable_id)),
+        );
+
+        if block_index.is_multiple_of(3) {
+            let replay = scheduler.schedule(&plan, host, &mut output);
+            assert!(replay.duplicate_token);
+            assert!(oracle.schedule(&oracle_plan, host).is_empty());
+        }
+        start += i64::from(length);
+        token += 1;
+        block_index += 1;
+    }
+    assert_eq!(actual_log, expected_log, "seed {seed}");
+    actual_log
+}
+
+#[test]
+fn one_hundred_seeded_traces_match_the_separate_rational_oracle() {
+    // Break caught: any conversion, half-open selection, ordering, or token replay differs from the oracle.
+    for seed in 0..100 {
+        let _ = run_seed(seed);
+    }
+}
+
+#[test]
+fn five_runs_have_byte_identical_event_digests() {
+    // Break caught: hidden process state or unstable ordering changes a representative trace.
+    let mut digests = [0_u64; 5];
+    for digest in &mut digests {
+        let mut hash = 0xcbf2_9ce4_8422_2325_u64;
+        for (token, offset, kind, stable_id) in run_seed(73) {
+            for value in [
+                token,
+                u64::from(offset),
+                u64::from(kind.priority()),
+                stable_id,
+            ] {
+                for byte in value.to_le_bytes() {
+                    hash ^= u64::from(byte);
+                    hash = hash.wrapping_mul(0x0000_0100_0000_01b3);
+                }
+            }
+        }
+        *digest = hash;
+    }
+    assert!(digests.iter().all(|digest| *digest == digests[0]));
+}
diff --git a/developer-simulation/runs/2026-08-12--midi-scheduler-rt-model/tests/plan_validation.rs b/developer-simulation/runs/2026-08-12--midi-scheduler-rt-model/tests/plan_validation.rs
new file mode 100644
index 0000000..e3b101f
--- /dev/null
+++ b/developer-simulation/runs/2026-08-12--midi-scheduler-rt-model/tests/plan_validation.rs
@@ -0,0 +1,271 @@
+use midi_scheduler_rt_model::{Event, EventKind, PlanError, PlanSpec, TempoNode, prepare_plan};
+
+fn note_on(pulse: i64, stable_id: u64, instance_id: u32) -> Event {
+    Event {
+        pulse,
+        stable_id,
+        kind: EventKind::NoteOn {
+            channel: 0,
+            key: 60,
+            velocity: 100,
+            instance_id,
+        },
+    }
+}
+
+fn note_off(pulse: i64, stable_id: u64, instance_id: u32) -> Event {
+    Event {
+        pulse,
+        stable_id,
+        kind: EventKind::NoteOff {
+            channel: 0,
+            key: 60,
+            velocity: 0,
+            instance_id,
+        },
+    }
+}
+
+fn valid_spec(events: Vec<Event>) -> PlanSpec {
+    PlanSpec {
+        origin_pulse: 0,
+        origin_frame: 0,
+        sample_rate: 48_000,
+        tempo_nodes: vec![TempoNode {
+            pulse: 0,
+            micros_per_quarter: 20_000,
+        }],
+        events,
+    }
+}
+
+#[test]
+fn preparation_uses_checked_exact_segment_accumulation() {
+    // Break caught: conversion rounds a segment independently or uses float.
+    let spec = PlanSpec {
+        origin_pulse: -10,
+        origin_frame: 7,
+        sample_rate: 48_000,
+        tempo_nodes: vec![
+            TempoNode {
+                pulse: -10,
+                micros_per_quarter: 20_000,
+            },
+            TempoNode {
+                pulse: -8,
+                micros_per_quarter: 10_000,
+            },
+        ],
+        events: vec![note_on(-8, 1, 10), note_off(-6, 2, 10)],
+    };
+
+    let plan = prepare_plan(spec).expect("valid exact plan");
+    let frames: Vec<_> = plan.events().iter().map(|event| event.frame).collect();
+    assert_eq!(frames, vec![9, 10]);
+}
+
+#[test]
+fn preparation_accepts_signed_origin_and_reorders_same_frame_by_priority() {
+    // Break caught: signed origins overflow, or pulse order wins after pulses collapse to a frame.
+    let events = vec![
+        note_on(i64::MIN, 2, 22),
+        Event {
+            pulse: i64::MIN + 1,
+            stable_id: 1,
+            kind: EventKind::AllNotesOff { channel: 0 },
+        },
+        note_off(i64::MIN + 2, 3, 22),
+    ];
+    let spec = PlanSpec {
+        origin_pulse: i64::MIN,
+        origin_frame: -5,
+        sample_rate: 44_100,
+        tempo_nodes: vec![TempoNode {
+            pulse: i64::MIN,
+            micros_per_quarter: 1,
+        }],
+        events,
+    };
+
+    let plan = prepare_plan(spec).expect("minimum signed pulse is admitted");
+    assert_eq!(plan.events()[0].kind, EventKind::AllNotesOff { channel: 0 });
+    assert_eq!(plan.events()[1].stable_id, 3);
+    assert_eq!(plan.events()[2].stable_id, 2);
+    assert!(plan.events().iter().all(|event| event.frame == -5));
+}
+
+#[test]
+fn conversion_accepts_last_frame_and_rejects_one_pulse_above_it() {
+    // Break caught: overflow wraps/saturates instead of rejecting preparation.
+    let fitting = PlanSpec {
+        origin_pulse: 0,
+        origin_frame: i64::MAX - 50,
+        sample_rate: 48_000,
+        tempo_nodes: vec![TempoNode {
+            pulse: 0,
+            micros_per_quarter: 1_000_000,
+        }],
+        events: vec![note_on(0, 1, 1), note_off(1, 2, 1)],
+    };
+    let plan = prepare_plan(fitting).expect("frame at i64::MAX fits");
+    assert_eq!(plan.events()[1].frame, i64::MAX);
+
+    let overflowing = PlanSpec {
+        origin_pulse: 0,
+        origin_frame: i64::MAX - 50,
+        sample_rate: 48_000,
+        tempo_nodes: vec![TempoNode {
+            pulse: 0,
+            micros_per_quarter: 1_000_000,
+        }],
+        events: vec![note_on(0, 1, 1), note_off(2, 2, 1)],
+    };
+    assert_eq!(prepare_plan(overflowing), Err(PlanError::FrameOverflow));
+}
+
+#[test]
+fn malformed_plans_return_stable_error_codes() {
+    // Break caught: malformed plans publish ambiguous partial state or panic.
+    let cases = [
+        (
+            valid_spec(vec![note_off(1, 1, 99)]),
+            PlanError::UnmatchedNoteOff,
+        ),
+        (
+            valid_spec(vec![note_on(0, 1, 5), note_on(1, 2, 5)]),
+            PlanError::DuplicateNoteInstance,
+        ),
+        (
+            valid_spec(vec![note_on(0, 1, 5), note_off(1, 2, 5), note_off(2, 3, 5)]),
+            PlanError::DuplicateTermination,
+        ),
+        (
+            valid_spec(vec![note_on(2, 2, 5), note_off(1, 1, 5)]),
+            PlanError::EventsUnsorted,
+        ),
+        (
+            valid_spec(vec![note_on(0, 7, 5), note_off(1, 7, 5)]),
+            PlanError::DuplicateStableId,
+        ),
+        (
+            PlanSpec {
+                sample_rate: 47_999,
+                ..valid_spec(vec![])
+            },
+            PlanError::UnsupportedSampleRate,
+        ),
+        (
+            PlanSpec {
+                tempo_nodes: vec![TempoNode {
+                    pulse: 1,
+                    micros_per_quarter: 500_000,
+                }],
+                ..valid_spec(vec![])
+            },
+            PlanError::TempoOriginMismatch,
+        ),
+        (
+            PlanSpec {
+                tempo_nodes: vec![
+                    TempoNode {
+                        pulse: 0,
+                        micros_per_quarter: 500_000,
+                    },
+                    TempoNode {
+                        pulse: 0,
+                        micros_per_quarter: 400_000,
+                    },
+                ],
+                ..valid_spec(vec![])
+            },
+            PlanError::TempoNodesUnsorted,
+        ),
+        (
+            valid_spec(vec![Event {
+                pulse: 0,
+                stable_id: 1,
+                kind: EventKind::ProgramChange {
+                    channel: 16,
+                    program: 0,
+                },
+            }]),
+            PlanError::InvalidMidiData,
+        ),
+    ];
+
+    for (spec, expected) in cases {
+        assert_eq!(prepare_plan(spec), Err(expected));
+    }
+}
+
+#[test]
+fn note_off_identity_must_match_its_note_on_channel_and_key() {
+    // Break caught: instance ID alone closes a different channel/key identity.
+    let channel_mismatch = valid_spec(vec![
+        note_on(0, 1, 5),
+        Event {
+            pulse: 1,
+            stable_id: 2,
+            kind: EventKind::NoteOff {
+                channel: 1,
+                key: 60,
+                velocity: 0,
+                instance_id: 5,
+            },
+        },
+    ]);
+    let key_mismatch = valid_spec(vec![
+        note_on(0, 1, 5),
+        Event {
+            pulse: 1,
+            stable_id: 2,
+            kind: EventKind::NoteOff {
+                channel: 0,
+                key: 61,
+                velocity: 0,
+                instance_id: 5,
+            },
+        },
+    ]);
+
+    assert_eq!(
+        prepare_plan(channel_mismatch),
+        Err(PlanError::TerminationIdentityMismatch)
+    );
+    assert_eq!(
+        prepare_plan(key_mismatch),
+        Err(PlanError::TerminationIdentityMismatch)
+    );
+
+    let valid = prepare_plan(valid_spec(vec![note_on(0, 1, 5), note_off(1, 2, 5)]))
+        .expect("matching termination identity remains valid");
+    assert_eq!(valid.events().len(), 2);
+}
+
+#[test]
+fn consecutive_tempo_nodes_and_note_at_node_use_new_tempo_after_edge() {
+    // Break caught: a tempo node is applied one pulse early or late.
+    let spec = PlanSpec {
+        origin_pulse: 0,
+        origin_frame: 0,
+        sample_rate: 48_000,
+        tempo_nodes: vec![
+            TempoNode {
+                pulse: 0,
+                micros_per_quarter: 20_000,
+            },
+            TempoNode {
+                pulse: 2,
+                micros_per_quarter: 40_000,
+            },
+            TempoNode {
+                pulse: 3,
+                micros_per_quarter: 10_000,
+            },
+        ],
+        events: vec![note_on(2, 1, 1), note_off(4, 2, 1)],
+    };
+    let plan = prepare_plan(spec).expect("valid consecutive-node plan");
+    assert_eq!(plan.events()[0].frame, 2);
+    assert_eq!(plan.events()[1].frame, 4);
+}
diff --git a/developer-simulation/runs/2026-08-12--midi-scheduler-rt-model/tests/publication.rs b/developer-simulation/runs/2026-08-12--midi-scheduler-rt-model/tests/publication.rs
new file mode 100644
index 0000000..96bb3d7
--- /dev/null
+++ b/developer-simulation/runs/2026-08-12--midi-scheduler-rt-model/tests/publication.rs
@@ -0,0 +1,135 @@
+use midi_scheduler_rt_model::{
+    Event, EventKind, FixedHandoff, HandoffError, PlanError, PlanSpec, TempoNode, prepare_plan,
+};
+
+fn plan(stable_id: u64) -> midi_scheduler_rt_model::PreparedPlan {
+    prepare_plan(PlanSpec {
+        origin_pulse: 0,
+        origin_frame: 0,
+        sample_rate: 48_000,
+        tempo_nodes: vec![TempoNode {
+            pulse: 0,
+            micros_per_quarter: 20_000,
+        }],
+        events: vec![Event {
+            pulse: 0,
+            stable_id,
+            kind: EventKind::ControlChange {
+                channel: 0,
+                controller: 1,
+                value: (stable_id % 128) as u8,
+            },
+        }],
+    })
+    .expect("valid plan")
+}
+
+#[test]
+fn rejected_plan_does_not_mutate_published_generation_or_digest() {
+    // Break caught: a failed preparation partially publishes or advances generation.
+    let mut handoff = FixedHandoff::new();
+    let first = handoff.publish(plan(1)).expect("first publication");
+    let before = (handoff.current_generation(), handoff.current_digest());
+    let invalid = prepare_plan(PlanSpec {
+        origin_pulse: 0,
+        origin_frame: 0,
+        sample_rate: 12_345,
+        tempo_nodes: vec![TempoNode {
+            pulse: 0,
+            micros_per_quarter: 20_000,
+        }],
+        events: vec![],
+    });
+    assert_eq!(invalid, Err(PlanError::UnsupportedSampleRate));
+    assert_eq!(
+        (handoff.current_generation(), handoff.current_digest()),
+        before
+    );
+    assert_eq!(first.generation, before.0.expect("published generation"));
+}
+
+#[test]
+fn reader_that_started_before_publish_observes_one_complete_old_generation() {
+    // Break caught: generation comes from one slot while digest/plan comes from another.
+    let mut handoff = FixedHandoff::new();
+    let old = handoff.publish(plan(11)).expect("old publication");
+    let ticket = handoff.begin_callback().expect("old read ticket");
+    let new = handoff.publish(plan(22)).expect("new publication");
+    assert_ne!(old.digest, new.digest);
+
+    let observation = handoff
+        .observe(ticket)
+        .expect("retired slot remains pinned");
+    assert_eq!(
+        (observation.generation, observation.digest),
+        (old.generation, old.digest)
+    );
+    assert_eq!(handoff.reclaim_retired_control(), None);
+    handoff.end_callback(ticket).expect("reader release");
+    let reclaimed = handoff
+        .reclaim_retired_control()
+        .expect("old plan reclaimed after release");
+    assert_eq!(reclaimed.generation, old.generation);
+    assert_eq!(handoff.reclaim_retired_control(), None);
+}
+
+#[test]
+fn deterministic_handoff_model_covers_ten_thousand_before_and_after_reads() {
+    // Break caught: a retired slot is reused early, lost, or reclaimed more than once.
+    let mut handoff = FixedHandoff::new();
+    let mut current = handoff.publish(plan(1)).expect("initial publication");
+    let mut reclaimed = 0_u64;
+
+    for replacement in 0_u64..10_000 {
+        if replacement % 2 == 0 {
+            // Publication immediately after callback captured the generation.
+            let ticket = handoff.begin_callback().expect("read before publish");
+            let next = handoff
+                .publish(plan(replacement + 2))
+                .expect("publish into free slot");
+            let observed = handoff.observe(ticket).expect("pinned old observation");
+            assert_eq!(
+                (observed.generation, observed.digest),
+                (current.generation, current.digest)
+            );
+            assert_eq!(handoff.reclaim_retired_control(), None);
+            handoff.end_callback(ticket).expect("end old read");
+            current = next;
+        } else {
+            // Publication immediately before callback captures the generation.
+            let next = handoff
+                .publish(plan(replacement + 2))
+                .expect("publish before read");
+            let ticket = handoff.begin_callback().expect("read new publication");
+            let observed = handoff.observe(ticket).expect("complete new observation");
+            assert_eq!(
+                (observed.generation, observed.digest),
+                (next.generation, next.digest)
+            );
+            handoff.end_callback(ticket).expect("end new read");
+            current = next;
+        }
+        let old = handoff
+            .reclaim_retired_control()
+            .expect("exactly one retired generation");
+        assert!(old.generation < current.generation);
+        reclaimed += 1;
+        assert_eq!(handoff.reclaim_retired_control(), None);
+    }
+
+    assert_eq!(reclaimed, 10_000);
+    assert_eq!(handoff.current_generation(), Some(current.generation));
+}
+
+#[test]
+fn stale_or_double_ended_tickets_return_errors_instead_of_panicking() {
+    // Break caught: invalid handoff tokens underflow a reader count or index freed storage.
+    let mut handoff = FixedHandoff::new();
+    handoff.publish(plan(1)).expect("publication");
+    let ticket = handoff.begin_callback().expect("ticket");
+    handoff.end_callback(ticket).expect("first end");
+    assert_eq!(
+        handoff.end_callback(ticket),
+        Err(HandoffError::ReaderAlreadyEnded)
+    );
+}
diff --git a/developer-simulation/runs/2026-08-12--midi-scheduler-rt-model/tests/realtime_contract.rs b/developer-simulation/runs/2026-08-12--midi-scheduler-rt-model/tests/realtime_contract.rs
new file mode 100644
index 0000000..858d7d1
--- /dev/null
+++ b/developer-simulation/runs/2026-08-12--midi-scheduler-rt-model/tests/realtime_contract.rs
@@ -0,0 +1,193 @@
+use std::alloc::{GlobalAlloc, Layout, System};
+use std::cell::Cell;
+use std::panic::{AssertUnwindSafe, catch_unwind};
+use std::sync::atomic::{AtomicU64, Ordering};
+
+use midi_scheduler_rt_model::{
+    CallbackError, Discontinuity, Event, EventKind, HostBlock, PlanSpec, ScheduledEvent, Scheduler,
+    TempoNode, prepare_plan,
+};
+
+struct CountingAllocator;
+
+thread_local! {
+    static TRAP_ACTIVE: Cell<bool> = const { Cell::new(false) };
+}
+
+static ALLOCATIONS: AtomicU64 = AtomicU64::new(0);
+
+unsafe impl GlobalAlloc for CountingAllocator {
+    unsafe fn alloc(&self, layout: Layout) -> *mut u8 {
+        TRAP_ACTIVE.with(|active| {
+            if active.get() {
+                ALLOCATIONS.fetch_add(1, Ordering::Relaxed);
+            }
+        });
+        // SAFETY: forwarding the allocator contract unchanged to `System`.
+        unsafe { System.alloc(layout) }
+    }
+
+    unsafe fn alloc_zeroed(&self, layout: Layout) -> *mut u8 {
+        TRAP_ACTIVE.with(|active| {
+            if active.get() {
+                ALLOCATIONS.fetch_add(1, Ordering::Relaxed);
+            }
+        });
+        // SAFETY: forwarding the allocator contract unchanged to `System`.
+        unsafe { System.alloc_zeroed(layout) }
+    }
+
+    unsafe fn dealloc(&self, pointer: *mut u8, layout: Layout) {
+        // SAFETY: `pointer` and `layout` came from the forwarded `System` allocator.
+        unsafe { System.dealloc(pointer, layout) }
+    }
+
+    unsafe fn realloc(&self, pointer: *mut u8, layout: Layout, new_size: usize) -> *mut u8 {
+        TRAP_ACTIVE.with(|active| {
+            if active.get() {
+                ALLOCATIONS.fetch_add(1, Ordering::Relaxed);
+            }
+        });
+        // SAFETY: forwarding the allocator contract unchanged to `System`.
+        unsafe { System.realloc(pointer, layout, new_size) }
+    }
+}
+
+#[global_allocator]
+static ALLOCATOR: CountingAllocator = CountingAllocator;
+
+fn plan() -> midi_scheduler_rt_model::PreparedPlan {
+    let events = (0_i64..64)
+        .map(|pulse| Event {
+            pulse,
+            stable_id: pulse.cast_unsigned() + 1,
+            kind: EventKind::ControlChange {
+                channel: 0,
+                controller: 1,
+                value: u8::try_from(pulse).expect("fixture value fits"),
+            },
+        })
+        .collect();
+    prepare_plan(PlanSpec {
+        origin_pulse: 0,
+        origin_frame: 0,
+        sample_rate: 48_000,
+        tempo_nodes: vec![TempoNode {
+            pulse: 0,
+            micros_per_quarter: 20_000,
+        }],
+        events,
+    })
+    .expect("instrumentation plan")
+}
+
+#[test]
+fn one_hundred_thousand_instrumented_callbacks_allocate_zero_times() {
+    // Break caught: any callback path grows a Vec/Box/String or another heap-backed collection.
+    let plan = plan();
+    let mut scheduler = Scheduler::new(8);
+    let mut output = [ScheduledEvent::EMPTY; 8];
+    ALLOCATIONS.store(0, Ordering::Relaxed);
+
+    for iteration in 0_u64..100_000 {
+        let host = HostBlock {
+            token: iteration + 1,
+            start_frame: i64::try_from(iteration % 64).expect("bounded frame fits"),
+            length: 1,
+            sample_rate: 48_000,
+            discontinuity: Discontinuity::None,
+        };
+        TRAP_ACTIVE.with(|active| active.set(true));
+        let result = scheduler.schedule(&plan, host, &mut output);
+        TRAP_ACTIVE.with(|active| active.set(false));
+        assert_eq!(result.error, None);
+    }
+
+    assert_eq!(ALLOCATIONS.load(Ordering::Relaxed), 0);
+}
+
+#[test]
+fn forced_invalid_callback_inputs_return_flags_without_unwinding() {
+    // Break caught: checked host validation is replaced with assert/unwrap arithmetic.
+    let plan = plan();
+    let mut scheduler = Scheduler::new(8);
+    let mut output = [ScheduledEvent::EMPTY; 8];
+    let invalid = [
+        (
+            HostBlock {
+                token: 1,
+                start_frame: 0,
+                length: 0,
+                sample_rate: 48_000,
+                discontinuity: Discontinuity::None,
+            },
+            CallbackError::EmptyBlock,
+        ),
+        (
+            HostBlock {
+                token: 2,
+                start_frame: 0,
+                length: 2_049,
+                sample_rate: 48_000,
+                discontinuity: Discontinuity::None,
+            },
+            CallbackError::BlockTooLarge,
+        ),
+        (
+            HostBlock {
+                token: 3,
+                start_frame: 0,
+                length: 1,
+                sample_rate: 12_345,
+                discontinuity: Discontinuity::None,
+            },
+            CallbackError::UnsupportedSampleRate,
+        ),
+        (
+            HostBlock {
+                token: 4,
+                start_frame: 0,
+                length: 1,
+                sample_rate: 96_000,
+                discontinuity: Discontinuity::None,
+            },
+            CallbackError::PlanSampleRateMismatch,
+        ),
+        (
+            HostBlock {
+                token: 5,
+                start_frame: i64::MAX,
+                length: 1,
+                sample_rate: 48_000,
+                discontinuity: Discontinuity::None,
+            },
+            CallbackError::FrameRangeOverflow,
+        ),
+    ];
+
+    for (host, expected) in invalid {
+        let boundary = catch_unwind(AssertUnwindSafe(|| {
+            scheduler.schedule(&plan, host, &mut output)
+        }));
+        let result = boundary.expect("callback must not unwind");
+        assert_eq!(result.error, Some(expected));
+    }
+
+    let mut empty_output = [];
+    let boundary = catch_unwind(AssertUnwindSafe(|| {
+        scheduler.schedule(
+            &plan,
+            HostBlock {
+                token: 6,
+                start_frame: 0,
+                length: 1,
+                sample_rate: 48_000,
+                discontinuity: Discontinuity::None,
+            },
+            &mut empty_output,
+        )
+    }));
+    let result = boundary.expect("zero-capacity callback must not unwind");
+    assert_eq!(result.written, 0);
+    assert!(result.overflowed);
+}
diff --git a/developer-simulation/runs/2026-08-12--midi-scheduler-rt-model/tests/representative_shape.rs b/developer-simulation/runs/2026-08-12--midi-scheduler-rt-model/tests/representative_shape.rs
new file mode 100644
index 0000000..b91d9c2
--- /dev/null
+++ b/developer-simulation/runs/2026-08-12--midi-scheduler-rt-model/tests/representative_shape.rs
@@ -0,0 +1,75 @@
+use midi_scheduler_rt_model::{
+    Discontinuity, Event, EventKind, FixedHandoff, HostBlock, PlanSpec, ScheduledEvent, Scheduler,
+    TempoNode, prepare_plan,
+};
+
+#[test]
+fn representative_plan_and_forty_five_minute_block_shape_complete_without_overflow() {
+    let tempo_nodes = (0_i64..20_000)
+        .map(|index| TempoNode {
+            pulse: index * 6_480,
+            micros_per_quarter: 19_999 + u32::try_from(index % 2).expect("tempo toggle fits"),
+        })
+        .collect();
+    let events = (0_i64..180_000)
+        .map(|index| Event {
+            pulse: index * 720,
+            stable_id: index.cast_unsigned() + 1,
+            kind: EventKind::ControlChange {
+                channel: u8::try_from(index % 16).expect("channel fits"),
+                controller: 1,
+                value: u8::try_from(index % 128).expect("value fits"),
+            },
+        })
+        .collect();
+    let plan = prepare_plan(PlanSpec {
+        origin_pulse: 0,
+        origin_frame: 0,
+        sample_rate: 48_000,
+        tempo_nodes,
+        events,
+    })
+    .expect("representative plan validates");
+    assert_eq!(plan.events().len(), 180_000);
+
+    let mut scheduler = Scheduler::new(64);
+    let mut output = [ScheduledEvent::EMPTY; 256];
+    let sizes = [16_u32, 17, 255, 256, 257, 1_024, 2_048];
+    let end_frame = 45_i64 * 60 * 48_000;
+    let mut frame = 0_i64;
+    let mut token = 1_u64;
+    let mut block_index = 0_usize;
+    let mut emitted = 0_usize;
+    while frame < end_frame {
+        let length = sizes[block_index % sizes.len()];
+        let result = scheduler.schedule(
+            &plan,
+            HostBlock {
+                token,
+                start_frame: frame,
+                length,
+                sample_rate: 48_000,
+                discontinuity: Discontinuity::None,
+            },
+            &mut output,
+        );
+        assert_eq!(result.error, None);
+        assert!(!result.overflowed);
+        emitted += result.written;
+        frame += i64::from(length);
+        token += 1;
+        block_index += 1;
+    }
+    assert_eq!(emitted, 180_000);
+    assert!(block_index > 10_000);
+
+    let mut handoff = FixedHandoff::new();
+    handoff.publish(plan.clone()).expect("initial publication");
+    for _ in 0..250 {
+        handoff
+            .publish(plan.clone())
+            .expect("replacement publication");
+        assert!(handoff.reclaim_retired_control().is_some());
+    }
+    assert_eq!(handoff.current_generation(), Some(251));
+}
diff --git a/developer-simulation/runs/2026-08-13--multi-carrier-return-refund-reconciler/BRIEF.md b/developer-simulation/runs/2026-08-13--multi-carrier-return-refund-reconciler/BRIEF.md
new file mode 100644
index 0000000..e29eb42
--- /dev/null
+++ b/developer-simulation/runs/2026-08-13--multi-carrier-return-refund-reconciler/BRIEF.md
@@ -0,0 +1,120 @@
+# Multi-Carrier Return Refund Reconciler
+
+## Developer persona
+
+You are a commerce-platform backend developer with seven years of production
+TypeScript and PostgreSQL experience and four months of Rust experience. You
+own the returns service but not the warehouse, carrier, or payment systems.
+
+## Existing system and baseline
+
+PostgreSQL is authoritative for orders, captured payment, line quantities,
+tax, discounts, prior refunds, and operator decisions. Three carriers deliver
+status webhooks, two warehouses publish scan batches, and the payment provider
+publishes refund results. A nightly Python job joins exported CSV files with
+SQL queries and emits an operator review sheet. Operators resolve ambiguous
+rows manually before a separate service issues refunds.
+
+The baseline is slow and difficult to audit, but it has one essential safety
+property: it never initiates payment-provider calls automatically.
+
+## Concrete pain
+
+Returns increasingly arrive in split parcels. A customer may put an item in a
+different parcel than the label predicted, a warehouse may correct a mistaken
+SKU scan, and carrier or payment events may be duplicated, delayed, or arrive
+out of order. The nightly job can show the same unit twice or fail to explain
+why a refund quantity changed. The team needs a deterministic proposed refund
+plan with exact provenance and explicit review cases.
+
+## Workload and data shape
+
+Use an immutable daily snapshot containing:
+
+- 25,000 return authorizations, 40,000 parcels, and 70,000 authorized lines;
+- 250,000 carrier, warehouse, correction, and payment-result events;
+- integer quantities and integer cents only;
+- line-level paid subtotal, tax, discount, and prior-refund amounts;
+- stable event IDs, source-system IDs, source timestamps, and ingestion IDs;
+- at most four parcels and twelve line items per return.
+
+The representative fixture must include ordinary returns plus at least 500
+seeded adversarial returns. No customer names, addresses, free text, payment
+tokens, or real commercial data may appear in fixtures or diagnostics.
+
+## Operational constraints
+
+- PostgreSQL remains authoritative; the prototype reads snapshots only.
+- The output is an advisory plan and must never call a carrier, warehouse, or
+  payment API.
+- Every cent and physical unit must be accounted for exactly.
+- A proposed refund may never exceed captured payment minus successful prior
+  refunds, either per line or per return.
+- The same immutable inputs must produce byte-identical output regardless of
+  input file order or event order.
+- A complete 25,000-return run should finish within 60 seconds and 512 MiB on
+  the available machine; report the actual host and measurement limits.
+- Publication is complete-report-only: failure must not leave a new partial or
+  stale plan at the requested output path.
+
+## Measurable acceptance criteria
+
+1. A separately implemented reference calculation and the candidate agree on
+   every proposed line quantity, cent amount, disposition, and provenance ID
+   for the disclosed fixtures.
+2. Ten deterministic shuffles of the same snapshot produce byte-identical
+   reports.
+3. Exact retries are idempotent. The same source event ID with different
+   payload bytes is quarantined for review and changes no proposed refund.
+4. A later warehouse correction supersedes only the identified earlier scan;
+   corrections cannot silently create negative or duplicate unit counts.
+5. Split parcels and substituted-item scans conserve authorized quantities.
+   Unmatched, excess, or unauthorized units are review cases, not refundable
+   units.
+6. Successful, failed, pending, and duplicated payment results are handled
+   distinctly. An inconclusive result never proposes a second refund.
+7. Injected failures before and during report publication preserve either the
+   prior complete report or no report, never a partial new report.
+8. The representative run records elapsed time and available peak-memory
+   evidence without generalizing beyond the measured host.
+
+## Adversarial and fault cases
+
+- duplicate events with identical and conflicting payloads;
+- warehouse corrections received before the event they correct;
+- carrier delivery after a warehouse scan and carrier events with regressing
+  source timestamps;
+- one authorized unit scanned into two parcels;
+- substituted, unknown, and over-quantity SKUs;
+- discounts and tax that require deterministic remainder-cent allocation;
+- prior refund success followed by a delayed pending or failure event;
+- process exit before output creation, after temporary output is complete, and
+  immediately before final publication;
+- output-path aliasing with any input where the host supports detection.
+
+## Compact prototype boundary
+
+Build a local command-line program over synthetic JSON or CSV snapshots. It
+should validate inputs, derive one deterministic return-level plan, write a
+canonical machine-readable report, verify that report independently, and
+include a runnable disclosed fixture plus a generated representative workload.
+Keep payment execution, HTTP services, database schema changes, authentication,
+operator UI, and production deployment outside the prototype.
+
+## Non-goals
+
+- replacing PostgreSQL or the existing refund executor;
+- predicting fraud, return intent, or item condition;
+- fuzzy matching customer text or images;
+- choosing business policy for unauthorized substitutions;
+- implementing carrier APIs, payment APIs, or a distributed workflow engine;
+- claiming production readiness from synthetic data.
+
+## Dependency decision threshold
+
+Retain a new dependency only if the runnable evidence shows a material
+correctness, auditability, or operational advantage over the direct
+snapshot/reference approach without weakening any authority, idempotency,
+privacy, or complete-publication constraint. Reject it when it merely stores a
+second copy, moves the reconciliation rules into a harder abstraction, adds an
+unneeded subsystem, or cannot share the authoritative transaction boundary.
diff --git a/developer-simulation/runs/2026-08-13--multi-carrier-return-refund-reconciler/Cargo.toml b/developer-simulation/runs/2026-08-13--multi-carrier-return-refund-reconciler/Cargo.toml
new file mode 100644
index 0000000..fee2ac6
--- /dev/null
+++ b/developer-simulation/runs/2026-08-13--multi-carrier-return-refund-reconciler/Cargo.toml
@@ -0,0 +1,16 @@
+[package]
+name = "return-reconciler-trial1"
+version = "0.1.0"
+edition = "2024"
+publish = false
+
+[dependencies]
+serde = { version = "1", features = ["derive"] }
+serde_json = "1"
+
+[dev-dependencies]
+tempfile = "3"
+
+[lints.clippy]
+all = "deny"
+pedantic = "deny"
diff --git a/developer-simulation/runs/2026-08-13--multi-carrier-return-refund-reconciler/DISCOVERY.md b/developer-simulation/runs/2026-08-13--multi-carrier-return-refund-reconciler/DISCOVERY.md
new file mode 100644
index 0000000..f833106
--- /dev/null
+++ b/developer-simulation/runs/2026-08-13--multi-carrier-return-refund-reconciler/DISCOVERY.md
@@ -0,0 +1,59 @@
+# Trial 1 discovery notes
+
+## Baseline-first hypothesis
+
+The safest compact design is a direct, deterministic batch reconciler over one
+immutable snapshot: validate and canonicalize records; group by return; reject
+conflicting event IDs; apply corrections by explicit target ID; derive proposed
+units and cents with integer arithmetic; independently verify conservation and
+caps; serialize a canonical report to a sibling temporary file; then publish it
+with one atomic rename. This preserves the existing system's most important
+property because the program has no network or payment-execution capability.
+
+The nightly Python/CSV baseline can be improved without adding an incremental
+database: stable sorting, explicit provenance, a reference calculation, and an
+atomic publication boundary address most of the stated pain directly. My first
+comparison therefore has to be this direct approach, not a component-led design.
+
+## What I expect from the public surface
+
+The root README presents Fold as a durable incremental stream-to-view engine
+whose write transaction updates multiple materialized views consistently. The
+starter and time-series examples show insert/retract semantics, keyed
+aggregation, and durable local state. The search example adds ESE embeddings and
+ANNy HNSW indexing; those are relevance/search facilities rather than exact
+accounting tools. The chat example demonstrates a single writer and consistent
+snapshot reads, but it also makes Fold the source of truth, which conflicts with
+this brief's PostgreSQL-authoritative, read-only snapshot boundary.
+
+## Explicit component-fit questions
+
+### Fold
+
+- Can an immutable batch be loaded deterministically without retaining a second
+  authoritative-looking copy between runs?
+- Do duplicate inserts, explicit retractions, and correction-before-original
+  arrival have semantics that help more than a sorted in-memory map?
+- Can all return views be read from one transaction and exported without losing
+  the complete-report-only publication guarantee?
+- Are input validation, uniqueness/conflict quarantine, exact cent allocation,
+  and report provenance native enough to reduce custom reconciliation code?
+- Does measured evidence show a material correctness, auditability, or runtime
+  advantage over the direct batch/reference approach at the target workload?
+
+### ESE
+
+- Is any requirement semantic or approximate? If not, embeddings would weaken
+  exactness and are a no-fit even if easy to call.
+
+### ANNy
+
+- Is any requirement nearest-neighbor retrieval? If not, an approximate index
+  would be actively inappropriate for identity, SKU, event, or money matching.
+
+## Initial adoption gate
+
+I will retain a component only if a runnable comparison shows a material benefit
+without weakening PostgreSQL authority, exactness, deterministic output,
+privacy, idempotency, or atomic publication. Otherwise the prototype will use a
+direct Rust batch implementation and record a grounded no-fit decision.
diff --git a/developer-simulation/runs/2026-08-13--multi-carrier-return-refund-reconciler/README.md b/developer-simulation/runs/2026-08-13--multi-carrier-return-refund-reconciler/README.md
new file mode 100644
index 0000000..362b08a
--- /dev/null
+++ b/developer-simulation/runs/2026-08-13--multi-carrier-return-refund-reconciler/README.md
@@ -0,0 +1,69 @@
+# Return refund reconciler trial
+
+This is an advisory-only command-line prototype over synthetic JSON snapshots.
+It performs no network calls and has no carrier, warehouse, payment, or database
+client. PostgreSQL exports remain authoritative; this program publishes only a
+canonical proposed plan.
+
+## Reproduce
+
+Run from the BogKit repository root. The commands use the nested lab workspace
+and keep generated runtime files under `/tmp`.
+
+```console
+cargo fmt --manifest-path developer-simulation/Cargo.toml -p return-reconciler-trial1 -- --check
+cargo test --manifest-path developer-simulation/Cargo.toml --locked --offline --release -p return-reconciler-trial1 --all-targets --all-features
+cargo clippy --manifest-path developer-simulation/Cargo.toml --locked --offline --release -p return-reconciler-trial1 --all-targets --all-features -- -D warnings -D clippy::all -D clippy::pedantic
+
+mkdir -p /tmp/bogkit-return-reconciler-demo
+cargo run --manifest-path developer-simulation/Cargo.toml --locked --offline --release -p return-reconciler-trial1 -- reconcile developer-simulation/runs/2026-08-13--multi-carrier-return-refund-reconciler/fixtures/disclosed.json /tmp/bogkit-return-reconciler-demo/disclosed-report.json
+cargo run --manifest-path developer-simulation/Cargo.toml --locked --offline --release -p return-reconciler-trial1 -- verify developer-simulation/runs/2026-08-13--multi-carrier-return-refund-reconciler/fixtures/disclosed.json /tmp/bogkit-return-reconciler-demo/disclosed-report.json
+cargo run --manifest-path developer-simulation/Cargo.toml --locked --offline --release -p return-reconciler-trial1 -- benchmark
+```
+
+`benchmark` constructs the disclosed shape in memory: 25,000 returns, 40,000
+distinct parcels, 70,000 authorized lines, 250,000 events, and 500 labeled
+adversarial returns. It requires exact candidate/reference equality and ten
+byte-identical deterministic shuffles. It prints host-local timings; it does
+not claim production equivalence.
+
+To inspect or retain the generated snapshot explicitly:
+
+```console
+cargo run --manifest-path developer-simulation/Cargo.toml --locked --offline --release -p return-reconciler-trial1 -- generate-representative /tmp/bogkit-return-reconciler-demo/representative.json
+cargo run --manifest-path developer-simulation/Cargo.toml --locked --offline --release -p return-reconciler-trial1 -- reconcile /tmp/bogkit-return-reconciler-demo/representative.json /tmp/bogkit-return-reconciler-demo/representative-report.json
+cargo run --manifest-path developer-simulation/Cargo.toml --locked --offline --release -p return-reconciler-trial1 -- verify /tmp/bogkit-return-reconciler-demo/representative.json /tmp/bogkit-return-reconciler-demo/representative-report.json
+```
+
+The disclosed fixture contains only invented identifiers and integer values.
+It includes a split-parcel two-unit return with a remainder cent and a reused
+event ID with conflicting payloads. Publication fault and abrupt-exit cases are
+covered by `tests/publication.rs`; the fault-injection command is intentionally
+not part of the ordinary usage line.
+
+## Output contract
+
+Reports are one-line canonical JSON followed by a newline. Arrays and review
+codes are deterministically ordered. Each source event ID is accounted as
+accepted, accepted with exact retries, or quarantined conflict. Proposed lines
+record accepted/review quantities, cent caps, and provenance IDs. The report is
+written and synced to a sibling temporary file, independently verified, and
+atomically renamed over the requested path. A relative output path is supported.
+
+`proposed_quantity` always counts fully funded deterministic units. Unit cents
+are allocated in stable line/unit order, including remainder cents. If a line or
+return cap cannot fund the next whole unit, that unit contributes zero proposed
+quantity and zero proposed cents, remains visible in `accepted_scan_quantity`,
+and adds `insufficient_whole_unit_capacity` for operator review. Partial-unit
+cent proposals are never emitted.
+
+All line and return cents are `u64`, and report-wide cent totals use checked
+addition. If otherwise valid return plans cannot fit the canonical report-wide
+total, reconciliation fails before report publication; wrapped totals are never
+serialized. Every raw payment result must name a line owned by its stated
+return. Missing or wrong-return line identities are rejected before derivation,
+including events that would later be duplicated or quarantined.
+
+The program never executes a refund. Operators must still review every
+`disposition: "review"` row, and a separate approved service would remain
+responsible for execution.
diff --git a/developer-simulation/runs/2026-08-13--multi-carrier-return-refund-reconciler/fixtures/disclosed.json b/developer-simulation/runs/2026-08-13--multi-carrier-return-refund-reconciler/fixtures/disclosed.json
new file mode 100644
index 0000000..1240115
--- /dev/null
+++ b/developer-simulation/runs/2026-08-13--multi-carrier-return-refund-reconciler/fixtures/disclosed.json
@@ -0,0 +1,81 @@
+{
+  "snapshot_id": "disclosed-small-v1",
+  "returns": [
+    {
+      "return_id": "return-ordinary",
+      "captured_cents": 2001,
+      "lines": [
+        {
+          "line_id": "line-ordinary",
+          "sku": "sku-moss",
+          "authorized_qty": 2,
+          "paid_subtotal_cents": 2001,
+          "tax_cents": 0,
+          "discount_cents": 0,
+          "prior_successful_refund_cents": 0
+        }
+      ]
+    },
+    {
+      "return_id": "return-review",
+      "captured_cents": 1000,
+      "lines": [
+        {
+          "line_id": "line-review",
+          "sku": "sku-peat",
+          "authorized_qty": 1,
+          "paid_subtotal_cents": 1000,
+          "tax_cents": 80,
+          "discount_cents": 80,
+          "prior_successful_refund_cents": 0
+        }
+      ]
+    }
+  ],
+  "events": [
+    {
+      "kind": "warehouse_scan",
+      "event_id": "scan-ordinary-b",
+      "source_system_id": "warehouse-west",
+      "source_timestamp": 10,
+      "ingestion_id": 2,
+      "return_id": "return-ordinary",
+      "parcel_id": "parcel-b",
+      "sku": "sku-moss",
+      "quantity": 1
+    },
+    {
+      "kind": "warehouse_scan",
+      "event_id": "scan-review-conflict",
+      "source_system_id": "warehouse-east",
+      "source_timestamp": 20,
+      "ingestion_id": 3,
+      "return_id": "return-review",
+      "parcel_id": "parcel-c",
+      "sku": "sku-peat",
+      "quantity": 1
+    },
+    {
+      "kind": "warehouse_scan",
+      "event_id": "scan-ordinary-a",
+      "source_system_id": "warehouse-east",
+      "source_timestamp": 9,
+      "ingestion_id": 1,
+      "return_id": "return-ordinary",
+      "parcel_id": "parcel-a",
+      "sku": "sku-moss",
+      "quantity": 1
+    },
+    {
+      "kind": "warehouse_scan",
+      "event_id": "scan-review-conflict",
+      "source_system_id": "warehouse-east",
+      "source_timestamp": 20,
+      "ingestion_id": 3,
+      "return_id": "return-review",
+      "parcel_id": "parcel-c",
+      "sku": "sku-peat",
+      "quantity": 2
+    }
+  ]
+}
diff --git a/developer-simulation/runs/2026-08-13--multi-carrier-return-refund-reconciler/src/lib.rs b/developer-simulation/runs/2026-08-13--multi-carrier-return-refund-reconciler/src/lib.rs
new file mode 100644
index 0000000..9e43bec
--- /dev/null
+++ b/developer-simulation/runs/2026-08-13--multi-carrier-return-refund-reconciler/src/lib.rs
@@ -0,0 +1,968 @@
+//! Deterministic, advisory-only refund reconciliation over immutable snapshots.
+
+use serde::{Deserialize, Serialize};
+use std::collections::{BTreeMap, BTreeSet};
+use std::fs::{self, File, OpenOptions};
+use std::io::{BufReader, BufWriter, Write};
+use std::path::{Path, PathBuf};
+
+mod reference;
+pub use reference::reference_reconcile;
+mod workload;
+pub use workload::{deterministic_shuffle, generate_representative};
+
+pub const SCHEMA_VERSION: u32 = 1;
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct Snapshot {
+    pub snapshot_id: String,
+    pub returns: Vec<ReturnAuthorization>,
+    pub events: Vec<Event>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct ReturnAuthorization {
+    pub return_id: String,
+    pub captured_cents: u64,
+    pub lines: Vec<AuthorizedLine>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct AuthorizedLine {
+    pub line_id: String,
+    pub sku: String,
+    pub authorized_qty: u32,
+    pub paid_subtotal_cents: u64,
+    pub tax_cents: u64,
+    pub discount_cents: u64,
+    pub prior_successful_refund_cents: u64,
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "snake_case")]
+pub enum PaymentStatus {
+    Successful,
+    Failed,
+    Pending,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+#[serde(tag = "kind", rename_all = "snake_case")]
+pub enum Event {
+    WarehouseScan {
+        event_id: String,
+        source_system_id: String,
+        source_timestamp: u64,
+        ingestion_id: u64,
+        return_id: String,
+        parcel_id: String,
+        sku: String,
+        quantity: u32,
+    },
+    Correction {
+        event_id: String,
+        source_system_id: String,
+        source_timestamp: u64,
+        ingestion_id: u64,
+        return_id: String,
+        target_event_id: String,
+        replacement_sku: String,
+        replacement_quantity: u32,
+    },
+    Carrier {
+        event_id: String,
+        source_system_id: String,
+        source_timestamp: u64,
+        ingestion_id: u64,
+        return_id: String,
+        parcel_id: String,
+        status: String,
+    },
+    PaymentResult {
+        event_id: String,
+        source_system_id: String,
+        source_timestamp: u64,
+        ingestion_id: u64,
+        return_id: String,
+        line_id: String,
+        refund_id: String,
+        amount_cents: u64,
+        status: PaymentStatus,
+    },
+}
+
+impl Event {
+    #[must_use]
+    pub fn event_id(&self) -> &str {
+        match self {
+            Self::WarehouseScan { event_id, .. }
+            | Self::Correction { event_id, .. }
+            | Self::Carrier { event_id, .. }
+            | Self::PaymentResult { event_id, .. } => event_id,
+        }
+    }
+
+    #[must_use]
+    pub fn return_id(&self) -> &str {
+        match self {
+            Self::WarehouseScan { return_id, .. }
+            | Self::Correction { return_id, .. }
+            | Self::Carrier { return_id, .. }
+            | Self::PaymentResult { return_id, .. } => return_id,
+        }
+    }
+}
+
+#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
+pub struct Summary {
+    pub return_count: usize,
+    pub input_event_count: usize,
+    pub accepted_unique_events: usize,
+    pub exact_duplicate_events: usize,
+    pub conflicting_event_ids: usize,
+    pub review_returns: usize,
+    pub proposed_quantity: u64,
+    pub proposed_cents: u64,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+pub struct Report {
+    pub schema_version: u32,
+    pub snapshot_id: String,
+    pub advisory_only: bool,
+    pub summary: Summary,
+    pub event_accounting: Vec<EventAccounting>,
+    pub returns: Vec<ReturnPlan>,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+pub struct EventAccounting {
+    pub event_id: String,
+    pub input_occurrences: usize,
+    pub disposition: String,
+}
+
+#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
+pub struct ReturnPlan {
+    pub return_id: String,
+    pub disposition: String,
+    pub review_codes: Vec<String>,
+    pub unmatched_scan_quantity: u64,
+    pub lines: Vec<LinePlan>,
+}
+
+#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
+pub struct LinePlan {
+    pub line_id: String,
+    pub authorized_quantity: u32,
+    pub accepted_scan_quantity: u32,
+    pub review_scan_quantity: u64,
+    pub prior_successful_refund_cents: u64,
+    pub maximum_refundable_cents: u64,
+    pub proposed_quantity: u32,
+    pub proposed_cents: u64,
+    pub provenance_event_ids: Vec<String>,
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum FailPoint {
+    None,
+    BeforeOutputCreation,
+    AfterTemporaryComplete,
+    BeforePublish,
+    ExitBeforeOutputCreation,
+    ExitAfterTemporaryComplete,
+    ExitBeforePublish,
+}
+
+#[derive(Clone)]
+struct Scan {
+    event_id: String,
+    return_id: String,
+    sku: String,
+    quantity: u32,
+    source_timestamp: u64,
+    ingestion_id: u64,
+    provenance: Vec<String>,
+}
+
+#[derive(Default)]
+struct CanonicalEvents {
+    accepted: Vec<Event>,
+    event_accounting: Vec<EventAccounting>,
+    exact_duplicates: usize,
+    conflicts: usize,
+    conflict_returns: BTreeSet<String>,
+}
+
+#[derive(Default)]
+struct ReturnWork {
+    review_codes: BTreeSet<String>,
+    scans: Vec<Scan>,
+    blocked_lines: BTreeMap<String, PaymentBlock>,
+}
+
+#[derive(Clone, Copy, PartialEq, Eq)]
+enum PaymentBlock {
+    Successful,
+    Pending,
+}
+
+/// Validate and reconcile one immutable snapshot into a canonical advisory report.
+///
+/// # Errors
+///
+/// Returns an error when identifiers, monetary bounds, structural limits, or
+/// cross-record references make the snapshot unsafe to interpret.
+#[allow(clippy::too_many_lines)]
+pub fn reconcile(snapshot: &Snapshot) -> Result<Report, String> {
+    validate_snapshot(snapshot)?;
+    let canonical = canonicalize_events(&snapshot.events)?;
+
+    let mut work: BTreeMap<String, ReturnWork> = snapshot
+        .returns
+        .iter()
+        .map(|authorization| (authorization.return_id.clone(), ReturnWork::default()))
+        .collect();
+    for return_id in &canonical.conflict_returns {
+        work.get_mut(return_id)
+            .ok_or_else(|| format!("event references unknown return {return_id}"))?
+            .review_codes
+            .insert("conflicting_event_id".to_string());
+    }
+
+    let accepted_by_id: BTreeMap<&str, &Event> = canonical
+        .accepted
+        .iter()
+        .map(|event| (event.event_id(), event))
+        .collect();
+    let mut corrections_by_target: BTreeMap<&str, Vec<&Event>> = BTreeMap::new();
+    for event in &canonical.accepted {
+        if let Event::Correction {
+            target_event_id, ..
+        } = event
+        {
+            corrections_by_target
+                .entry(target_event_id)
+                .or_default()
+                .push(event);
+        }
+    }
+
+    for event in &canonical.accepted {
+        match event {
+            Event::WarehouseScan {
+                event_id,
+                source_timestamp,
+                ingestion_id,
+                return_id,
+                sku,
+                quantity,
+                ..
+            } => {
+                let mut scan = Scan {
+                    event_id: event_id.clone(),
+                    return_id: return_id.clone(),
+                    sku: sku.clone(),
+                    quantity: *quantity,
+                    source_timestamp: *source_timestamp,
+                    ingestion_id: *ingestion_id,
+                    provenance: vec![event_id.clone()],
+                };
+                if let Some(corrections) = corrections_by_target.get(event_id.as_str()) {
+                    apply_latest_correction(&mut scan, corrections, &mut work)?;
+                }
+                work.get_mut(return_id)
+                    .ok_or_else(|| format!("scan references unknown return {return_id}"))?
+                    .scans
+                    .push(scan);
+            }
+            Event::Correction {
+                return_id,
+                target_event_id,
+                ..
+            } => {
+                if !matches!(
+                    accepted_by_id.get(target_event_id.as_str()),
+                    Some(Event::WarehouseScan { .. })
+                ) {
+                    work.get_mut(return_id)
+                        .ok_or_else(|| format!("correction references unknown return {return_id}"))?
+                        .review_codes
+                        .insert("orphan_correction".to_string());
+                }
+            }
+            Event::PaymentResult { .. } | Event::Carrier { .. } => {}
+        }
+    }
+    apply_payment_results(&canonical.accepted, &mut work)?;
+
+    let mut authorizations = snapshot.returns.clone();
+    authorizations.sort_by(|left, right| left.return_id.cmp(&right.return_id));
+    let mut plans = Vec::with_capacity(authorizations.len());
+    for authorization in authorizations {
+        let return_work = work
+            .remove(&authorization.return_id)
+            .ok_or_else(|| "internal return work missing".to_string())?;
+        plans.push(plan_return(authorization, return_work)?);
+    }
+
+    let proposed_cents = plans
+        .iter()
+        .flat_map(|plan| &plan.lines)
+        .try_fold(0_u64, |total, line| total.checked_add(line.proposed_cents))
+        .ok_or_else(|| "report proposed cents overflow".to_string())?;
+    let summary = Summary {
+        return_count: plans.len(),
+        input_event_count: snapshot.events.len(),
+        accepted_unique_events: canonical.accepted.len(),
+        exact_duplicate_events: canonical.exact_duplicates,
+        conflicting_event_ids: canonical.conflicts,
+        review_returns: plans
+            .iter()
+            .filter(|plan| plan.disposition == "review")
+            .count(),
+        proposed_quantity: plans
+            .iter()
+            .flat_map(|plan| &plan.lines)
+            .map(|line| u64::from(line.proposed_quantity))
+            .sum(),
+        proposed_cents,
+    };
+
+    Ok(Report {
+        schema_version: SCHEMA_VERSION,
+        snapshot_id: snapshot.snapshot_id.clone(),
+        advisory_only: true,
+        summary,
+        event_accounting: canonical.event_accounting,
+        returns: plans,
+    })
+}
+
+fn canonicalize_events(events: &[Event]) -> Result<CanonicalEvents, String> {
+    let mut groups: BTreeMap<&str, Vec<(&Event, Vec<u8>)>> = BTreeMap::new();
+    for event in events {
+        if event.event_id().is_empty() {
+            return Err("event_id must not be empty".to_string());
+        }
+        groups.entry(event.event_id()).or_default().push((
+            event,
+            serde_json::to_vec(event).map_err(|error| error.to_string())?,
+        ));
+    }
+
+    let mut result = CanonicalEvents::default();
+    for (event_id, mut occurrences) in groups {
+        occurrences.sort_by(|left, right| left.1.cmp(&right.1));
+        let distinct_payloads = occurrences
+            .iter()
+            .map(|(_, bytes)| bytes)
+            .collect::<BTreeSet<_>>()
+            .len();
+        if distinct_payloads > 1 {
+            result.conflicts += 1;
+            result.conflict_returns.extend(
+                occurrences
+                    .iter()
+                    .map(|(event, _)| event.return_id().to_string()),
+            );
+            result.event_accounting.push(EventAccounting {
+                event_id: event_id.to_string(),
+                input_occurrences: occurrences.len(),
+                disposition: "quarantined_conflict".to_string(),
+            });
+        } else {
+            result.exact_duplicates += occurrences.len().saturating_sub(1);
+            result.accepted.push(occurrences[0].0.clone());
+            result.event_accounting.push(EventAccounting {
+                event_id: event_id.to_string(),
+                input_occurrences: occurrences.len(),
+                disposition: if occurrences.len() == 1 {
+                    "accepted".to_string()
+                } else {
+                    "accepted_with_exact_retries".to_string()
+                },
+            });
+        }
+    }
+    Ok(result)
+}
+
+fn apply_latest_correction(
+    scan: &mut Scan,
+    corrections: &[&Event],
+    work: &mut BTreeMap<String, ReturnWork>,
+) -> Result<(), String> {
+    let mut eligible = Vec::new();
+    for correction in corrections {
+        let Event::Correction {
+            event_id,
+            source_timestamp,
+            ingestion_id,
+            return_id,
+            replacement_sku,
+            replacement_quantity,
+            ..
+        } = correction
+        else {
+            continue;
+        };
+        if return_id != &scan.return_id {
+            work.get_mut(return_id)
+                .ok_or_else(|| format!("correction references unknown return {return_id}"))?
+                .review_codes
+                .insert("correction_return_mismatch".to_string());
+            continue;
+        }
+        if (*source_timestamp, *ingestion_id, event_id.as_str())
+            <= (
+                scan.source_timestamp,
+                scan.ingestion_id,
+                scan.event_id.as_str(),
+            )
+        {
+            work.get_mut(return_id)
+                .ok_or_else(|| format!("correction references unknown return {return_id}"))?
+                .review_codes
+                .insert("non_later_correction".to_string());
+            continue;
+        }
+        eligible.push((
+            (*source_timestamp, *ingestion_id, event_id.as_str()),
+            event_id,
+            replacement_sku,
+            *replacement_quantity,
+        ));
+    }
+    eligible.sort_by(|left, right| left.0.cmp(&right.0));
+    if let Some((_, event_id, replacement_sku, replacement_quantity)) = eligible.last() {
+        scan.sku.clone_from(replacement_sku);
+        scan.quantity = *replacement_quantity;
+        scan.provenance.push((*event_id).clone());
+        scan.provenance.sort();
+    }
+    Ok(())
+}
+
+fn apply_payment_results(
+    events: &[Event],
+    work: &mut BTreeMap<String, ReturnWork>,
+) -> Result<(), String> {
+    type PaymentKey<'a> = (&'a str, &'a str, &'a str);
+    type PaymentObservation = (PaymentStatus, u64);
+    let mut attempts: BTreeMap<PaymentKey<'_>, Vec<PaymentObservation>> = BTreeMap::new();
+    for event in events {
+        if let Event::PaymentResult {
+            return_id,
+            line_id,
+            refund_id,
+            amount_cents,
+            status,
+            ..
+        } = event
+        {
+            attempts
+                .entry((return_id, line_id, refund_id))
+                .or_default()
+                .push((*status, *amount_cents));
+        }
+    }
+
+    for ((return_id, line_id, _), results) in attempts {
+        let state = if results
+            .iter()
+            .any(|(status, _)| *status == PaymentStatus::Successful)
+        {
+            Some(PaymentBlock::Successful)
+        } else if results
+            .iter()
+            .any(|(status, _)| *status == PaymentStatus::Pending)
+        {
+            Some(PaymentBlock::Pending)
+        } else {
+            None
+        };
+        let return_work = work
+            .get_mut(return_id)
+            .ok_or_else(|| format!("payment result references unknown return {return_id}"))?;
+        if results
+            .iter()
+            .map(|(_, amount)| amount)
+            .collect::<BTreeSet<_>>()
+            .len()
+            > 1
+        {
+            return_work
+                .review_codes
+                .insert("payment_amount_conflict".to_string());
+            return_work
+                .blocked_lines
+                .insert(line_id.to_string(), PaymentBlock::Pending);
+        } else if let Some(state) = state {
+            return_work
+                .blocked_lines
+                .entry(line_id.to_string())
+                .and_modify(|old| {
+                    if state == PaymentBlock::Successful {
+                        *old = state;
+                    }
+                })
+                .or_insert(state);
+        }
+    }
+    Ok(())
+}
+
+#[allow(clippy::too_many_lines)]
+fn plan_return(
+    mut authorization: ReturnAuthorization,
+    mut work: ReturnWork,
+) -> Result<ReturnPlan, String> {
+    authorization
+        .lines
+        .sort_by(|left, right| left.line_id.cmp(&right.line_id));
+    work.scans
+        .sort_by(|left, right| (&left.sku, &left.event_id).cmp(&(&right.sku, &right.event_id)));
+
+    let total_prior: u64 = authorization
+        .lines
+        .iter()
+        .map(|line| line.prior_successful_refund_cents)
+        .sum();
+    let mut return_cap = authorization.captured_cents.saturating_sub(total_prior);
+    let mut available: BTreeMap<String, Vec<(String, u32, Vec<String>)>> = BTreeMap::new();
+    for scan in work.scans {
+        available.entry(scan.sku).or_default().push((
+            scan.event_id,
+            scan.quantity,
+            scan.provenance,
+        ));
+    }
+
+    let line_skus: BTreeMap<String, String> = authorization
+        .lines
+        .iter()
+        .map(|line| (line.line_id.clone(), line.sku.clone()))
+        .collect();
+    let authorized_skus: BTreeSet<String> = authorization
+        .lines
+        .iter()
+        .map(|line| line.sku.clone())
+        .collect();
+    let mut unmatched_scan_quantity = 0_u64;
+    for (sku, scans) in &available {
+        if !authorized_skus.contains(sku) {
+            unmatched_scan_quantity += scans
+                .iter()
+                .map(|(_, quantity, _)| u64::from(*quantity))
+                .sum::<u64>();
+        }
+    }
+    if unmatched_scan_quantity > 0 {
+        work.review_codes.insert("unauthorized_sku".to_string());
+    }
+
+    let mut lines = Vec::with_capacity(authorization.lines.len());
+    for line in authorization.lines {
+        let scan_chunks = available.entry(line.sku.clone()).or_default();
+        let mut needed = line.authorized_qty;
+        let mut accepted = 0_u32;
+        let mut provenance = BTreeSet::new();
+        for (_, quantity, event_provenance) in scan_chunks.iter_mut() {
+            if needed == 0 {
+                break;
+            }
+            let taken = (*quantity).min(needed);
+            if taken > 0 {
+                provenance.extend(event_provenance.iter().cloned());
+                *quantity -= taken;
+                needed -= taken;
+                accepted += taken;
+            }
+        }
+
+        let net = line
+            .paid_subtotal_cents
+            .checked_add(line.tax_cents)
+            .and_then(|gross| gross.checked_sub(line.discount_cents))
+            .ok_or_else(|| format!("invalid monetary values for line {}", line.line_id))?;
+        let maximum_refundable_cents = net.saturating_sub(line.prior_successful_refund_cents);
+        let payment_block = work.blocked_lines.get(&line.line_id).copied();
+        if payment_block == Some(PaymentBlock::Successful) {
+            work.review_codes
+                .insert("payment_already_successful".to_string());
+        } else if payment_block == Some(PaymentBlock::Pending) {
+            work.review_codes.insert("payment_inconclusive".to_string());
+        }
+
+        let eligible_quantity = if payment_block.is_none() { accepted } else { 0 };
+        let cent_capacity = maximum_refundable_cents.min(return_cap);
+        let proposed_quantity = (0..=eligible_quantity)
+            .rev()
+            .find(|quantity| {
+                amount_for_first_units(net, line.authorized_qty, *quantity) <= cent_capacity
+            })
+            .unwrap_or(0);
+        let proposed_cents = amount_for_first_units(net, line.authorized_qty, proposed_quantity);
+        if payment_block.is_none() && proposed_quantity < accepted {
+            work.review_codes
+                .insert("insufficient_whole_unit_capacity".to_string());
+        }
+        return_cap -= proposed_cents;
+
+        lines.push(LinePlan {
+            line_id: line.line_id,
+            authorized_quantity: line.authorized_qty,
+            accepted_scan_quantity: accepted,
+            review_scan_quantity: 0,
+            prior_successful_refund_cents: line.prior_successful_refund_cents,
+            maximum_refundable_cents,
+            proposed_quantity,
+            proposed_cents,
+            provenance_event_ids: provenance.into_iter().collect(),
+        });
+    }
+
+    for (sku, chunks) in available {
+        if authorized_skus.contains(&sku) {
+            let excess = chunks
+                .iter()
+                .map(|(_, quantity, _)| u64::from(*quantity))
+                .sum::<u64>();
+            if excess > 0 {
+                work.review_codes.insert("excess_quantity".to_string());
+                if let Some(line) = lines
+                    .iter_mut()
+                    .rev()
+                    .find(|line| line_skus.get(&line.line_id) == Some(&sku))
+                {
+                    line.review_scan_quantity += excess;
+                }
+            }
+        }
+    }
+
+    let review_codes: Vec<String> = work.review_codes.into_iter().collect();
+    let proposed_any = lines.iter().any(|line| line.proposed_cents > 0);
+    let disposition = if review_codes.is_empty() {
+        if proposed_any {
+            "proposed"
+        } else {
+            "no_refund"
+        }
+    } else {
+        "review"
+    };
+    Ok(ReturnPlan {
+        return_id: authorization.return_id,
+        disposition: disposition.to_string(),
+        review_codes,
+        unmatched_scan_quantity,
+        lines,
+    })
+}
+
+fn amount_for_first_units(net: u64, authorized_quantity: u32, quantity: u32) -> u64 {
+    if authorized_quantity == 0 {
+        return 0;
+    }
+    let divisor = u64::from(authorized_quantity);
+    let base = net / divisor;
+    let remainder = net % divisor;
+    base * u64::from(quantity) + remainder.min(u64::from(quantity))
+}
+
+fn validate_snapshot(snapshot: &Snapshot) -> Result<(), String> {
+    if snapshot.snapshot_id.is_empty() {
+        return Err("snapshot_id must not be empty".to_string());
+    }
+    let mut return_ids = BTreeSet::new();
+    let mut line_ids = BTreeSet::new();
+    let mut line_owners = BTreeMap::new();
+    for authorization in &snapshot.returns {
+        if !return_ids.insert(authorization.return_id.as_str()) {
+            return Err(format!("duplicate return_id {}", authorization.return_id));
+        }
+        if authorization.lines.len() > 12 {
+            return Err(format!(
+                "return {} exceeds 12 lines",
+                authorization.return_id
+            ));
+        }
+        let mut prior_total = 0_u64;
+        for line in &authorization.lines {
+            if !line_ids.insert(line.line_id.as_str()) {
+                return Err(format!("duplicate line_id {}", line.line_id));
+            }
+            line_owners.insert(line.line_id.as_str(), authorization.return_id.as_str());
+            if line.authorized_qty == 0 {
+                return Err(format!(
+                    "line {} has zero authorized quantity",
+                    line.line_id
+                ));
+            }
+            let net = line
+                .paid_subtotal_cents
+                .checked_add(line.tax_cents)
+                .and_then(|gross| gross.checked_sub(line.discount_cents))
+                .ok_or_else(|| format!("invalid monetary values for line {}", line.line_id))?;
+            if line.prior_successful_refund_cents > net {
+                return Err(format!(
+                    "prior refund exceeds line value for {}",
+                    line.line_id
+                ));
+            }
+            prior_total = prior_total
+                .checked_add(line.prior_successful_refund_cents)
+                .ok_or_else(|| "prior refund total overflow".to_string())?;
+        }
+        if prior_total > authorization.captured_cents {
+            return Err(format!(
+                "prior refunds exceed captured payment for {}",
+                authorization.return_id
+            ));
+        }
+    }
+    let known_returns: BTreeSet<&str> = snapshot
+        .returns
+        .iter()
+        .map(|authorization| authorization.return_id.as_str())
+        .collect();
+    let mut parcels: BTreeMap<&str, BTreeSet<&str>> = BTreeMap::new();
+    for event in &snapshot.events {
+        if !known_returns.contains(event.return_id()) {
+            return Err(format!(
+                "event {} references unknown return {}",
+                event.event_id(),
+                event.return_id()
+            ));
+        }
+        if let Event::WarehouseScan {
+            return_id,
+            parcel_id,
+            ..
+        }
+        | Event::Carrier {
+            return_id,
+            parcel_id,
+            ..
+        } = event
+        {
+            parcels
+                .entry(return_id)
+                .or_default()
+                .insert(parcel_id.as_str());
+        }
+        validate_payment_line(event, &line_owners)?;
+    }
+    if let Some((return_id, _)) = parcels.iter().find(|(_, parcel_ids)| parcel_ids.len() > 4) {
+        return Err(format!("return {return_id} exceeds 4 parcels"));
+    }
+    Ok(())
+}
+
+fn validate_payment_line(event: &Event, line_owners: &BTreeMap<&str, &str>) -> Result<(), String> {
+    let Event::PaymentResult {
+        return_id, line_id, ..
+    } = event
+    else {
+        return Ok(());
+    };
+    match line_owners.get(line_id.as_str()) {
+        None => Err(format!(
+            "payment result references line {line_id} absent from authorizations"
+        )),
+        Some(owner) if *owner != return_id.as_str() => Err(format!(
+            "payment result references line {line_id} owned by return {owner}, not {return_id}"
+        )),
+        Some(_) => Ok(()),
+    }
+}
+
+/// Read a snapshot, reconcile it, verify its invariants, and atomically publish it.
+///
+/// # Errors
+///
+/// Returns an error for unsafe path aliasing, invalid input, failed verification,
+/// I/O failures, or a requested fault injection point.
+pub fn reconcile_file(input: &Path, output: &Path, failpoint: FailPoint) -> Result<Report, String> {
+    if paths_alias(input, output)? {
+        return Err("output path aliases input".to_string());
+    }
+    if failpoint == FailPoint::ExitBeforeOutputCreation {
+        std::process::exit(86);
+    }
+    if failpoint == FailPoint::BeforeOutputCreation {
+        return Err("injected failure before output creation".to_string());
+    }
+    let input_file = File::open(input).map_err(|error| error.to_string())?;
+    let snapshot: Snapshot =
+        serde_json::from_reader(BufReader::new(input_file)).map_err(|error| error.to_string())?;
+    let report = reconcile(&snapshot)?;
+    verify_report(&snapshot, &report)?;
+
+    let temporary = temporary_path(output);
+    let publication = (|| -> Result<(), String> {
+        let temporary_file = OpenOptions::new()
+            .create_new(true)
+            .write(true)
+            .open(&temporary)
+            .map_err(|error| error.to_string())?;
+        let mut writer = BufWriter::new(temporary_file);
+        serde_json::to_writer(&mut writer, &report).map_err(|error| error.to_string())?;
+        writer.write_all(b"\n").map_err(|error| error.to_string())?;
+        writer.flush().map_err(|error| error.to_string())?;
+        writer
+            .get_ref()
+            .sync_all()
+            .map_err(|error| error.to_string())?;
+        if failpoint == FailPoint::ExitAfterTemporaryComplete {
+            std::process::exit(86);
+        }
+        if failpoint == FailPoint::AfterTemporaryComplete {
+            return Err("injected failure after temporary output is complete".to_string());
+        }
+        if failpoint == FailPoint::BeforePublish {
+            return Err("injected failure immediately before publication".to_string());
+        }
+        if failpoint == FailPoint::ExitBeforePublish {
+            std::process::exit(86);
+        }
+        fs::rename(&temporary, output).map_err(|error| error.to_string())?;
+        let parent = output
+            .parent()
+            .filter(|path| !path.as_os_str().is_empty())
+            .unwrap_or_else(|| Path::new("."));
+        File::open(parent)
+            .and_then(|directory| directory.sync_all())
+            .map_err(|error| error.to_string())?;
+        Ok(())
+    })();
+    if publication.is_err() {
+        let _ = fs::remove_file(&temporary);
+    }
+    publication?;
+    Ok(report)
+}
+
+/// Independently check report identity, advisory marking, ordering, totals, and caps.
+///
+/// # Errors
+///
+/// Returns an error when any report invariant differs from the snapshot.
+pub fn verify_report(snapshot: &Snapshot, report: &Report) -> Result<(), String> {
+    if report.schema_version != SCHEMA_VERSION
+        || report.snapshot_id != snapshot.snapshot_id
+        || !report.advisory_only
+    {
+        return Err("report identity or advisory marker is invalid".to_string());
+    }
+    if !report
+        .returns
+        .windows(2)
+        .all(|window| window[0].return_id < window[1].return_id)
+    {
+        return Err("return plans are not in canonical order".to_string());
+    }
+    let authorization_by_id: BTreeMap<&str, &ReturnAuthorization> = snapshot
+        .returns
+        .iter()
+        .map(|authorization| (authorization.return_id.as_str(), authorization))
+        .collect();
+    let mut total_quantity = 0_u64;
+    let mut total_cents = 0_u64;
+    for plan in &report.returns {
+        let authorization = authorization_by_id
+            .get(plan.return_id.as_str())
+            .ok_or_else(|| format!("unknown return plan {}", plan.return_id))?;
+        let prior_total: u64 = authorization
+            .lines
+            .iter()
+            .map(|line| line.prior_successful_refund_cents)
+            .sum();
+        let return_proposed = plan
+            .lines
+            .iter()
+            .try_fold(0_u64, |total, line| total.checked_add(line.proposed_cents))
+            .ok_or_else(|| format!("return proposed cents overflow for {}", plan.return_id))?;
+        if return_proposed > authorization.captured_cents.saturating_sub(prior_total) {
+            return Err(format!("return cap exceeded for {}", plan.return_id));
+        }
+        for line in &plan.lines {
+            let authorized_line = authorization
+                .lines
+                .iter()
+                .find(|authorized| authorized.line_id == line.line_id)
+                .ok_or_else(|| format!("unknown line plan {}", line.line_id))?;
+            let net = authorized_line
+                .paid_subtotal_cents
+                .checked_add(authorized_line.tax_cents)
+                .and_then(|gross| gross.checked_sub(authorized_line.discount_cents))
+                .ok_or_else(|| format!("invalid monetary values for line {}", line.line_id))?;
+            if line.accepted_scan_quantity > line.authorized_quantity
+                || line.proposed_quantity > line.accepted_scan_quantity
+                || line.proposed_cents > line.maximum_refundable_cents
+            {
+                return Err(format!("line cap exceeded for {}", line.line_id));
+            }
+            if line.proposed_cents
+                != amount_for_first_units(
+                    net,
+                    authorized_line.authorized_qty,
+                    line.proposed_quantity,
+                )
+            {
+                return Err(format!(
+                    "quantity and cents are incoherent for {}",
+                    line.line_id
+                ));
+            }
+            total_quantity += u64::from(line.proposed_quantity);
+            total_cents = total_cents
+                .checked_add(line.proposed_cents)
+                .ok_or_else(|| "report proposed cents overflow".to_string())?;
+        }
+    }
+    if total_quantity != report.summary.proposed_quantity
+        || total_cents != report.summary.proposed_cents
+        || report.summary.input_event_count != snapshot.events.len()
+        || report.summary.return_count != snapshot.returns.len()
+    {
+        return Err("summary totals do not match report body".to_string());
+    }
+    let expected = reference_reconcile(snapshot)?;
+    if report != &expected {
+        return Err("report differs from independent reference calculation".to_string());
+    }
+    Ok(())
+}
+
+fn temporary_path(output: &Path) -> PathBuf {
+    let file_name = output
+        .file_name()
+        .and_then(|name| name.to_str())
+        .unwrap_or("report");
+    output.with_file_name(format!(".{file_name}.tmp-{}", std::process::id()))
+}
+
+fn paths_alias(input: &Path, output: &Path) -> Result<bool, String> {
+    if input == output {
+        return Ok(true);
+    }
+    let input_metadata = fs::metadata(input).map_err(|error| error.to_string())?;
+    let Ok(output_metadata) = fs::metadata(output) else {
+        return Ok(false);
+    };
+    #[cfg(unix)]
+    {
+        use std::os::unix::fs::MetadataExt;
+        Ok(input_metadata.dev() == output_metadata.dev()
+            && input_metadata.ino() == output_metadata.ino())
+    }
+    #[cfg(not(unix))]
+    {
+        Ok(fs::canonicalize(input).map_err(|error| error.to_string())?
+            == fs::canonicalize(output).map_err(|error| error.to_string())?)
+    }
+}
diff --git a/developer-simulation/runs/2026-08-13--multi-carrier-return-refund-reconciler/src/main.rs b/developer-simulation/runs/2026-08-13--multi-carrier-return-refund-reconciler/src/main.rs
new file mode 100644
index 0000000..2fced41
--- /dev/null
+++ b/developer-simulation/runs/2026-08-13--multi-carrier-return-refund-reconciler/src/main.rs
@@ -0,0 +1,125 @@
+use std::env;
+use std::fs::{self, File};
+use std::io::{BufReader, BufWriter, Write};
+use std::path::Path;
+use std::process::ExitCode;
+use std::time::Instant;
+
+use return_reconciler_trial1::{
+    FailPoint, Report, Snapshot, deterministic_shuffle, generate_representative, reconcile,
+    reconcile_file, reference_reconcile, verify_report,
+};
+
+fn main() -> ExitCode {
+    let arguments: Vec<String> = env::args().skip(1).collect();
+    match run(&arguments) {
+        Ok(()) => ExitCode::SUCCESS,
+        Err(error) => {
+            eprintln!("error: {error}");
+            ExitCode::FAILURE
+        }
+    }
+}
+
+fn run(arguments: &[String]) -> Result<(), String> {
+    match arguments {
+        [command, input, output] if command == "reconcile" => {
+            let report = reconcile_file(Path::new(input), Path::new(output), FailPoint::None)?;
+            println!(
+                "published advisory report: {} returns, {} review, {} proposed cents",
+                report.summary.return_count,
+                report.summary.review_returns,
+                report.summary.proposed_cents
+            );
+            Ok(())
+        }
+        [command, phase, input, output] if command == "reconcile-exit" => {
+            let failpoint = match phase.as_str() {
+                "before-output" => FailPoint::ExitBeforeOutputCreation,
+                "after-temp" => FailPoint::ExitAfterTemporaryComplete,
+                "before-publish" => FailPoint::ExitBeforePublish,
+                _ => return Err("unknown exit phase".to_string()),
+            };
+            let _ = reconcile_file(Path::new(input), Path::new(output), failpoint)?;
+            Err("exit injection did not fire".to_string())
+        }
+        [command, input, report] if command == "verify" => {
+            let snapshot: Snapshot = read_json(Path::new(input))?;
+            let report: Report = read_json(Path::new(report))?;
+            verify_report(&snapshot, &report)?;
+            println!("verified advisory report for {}", snapshot.snapshot_id);
+            Ok(())
+        }
+        [command, output] if command == "generate-representative" => {
+            write_json(Path::new(output), &generate_representative(20_260_813))?;
+            println!("generated disclosed representative snapshot at {output}");
+            Ok(())
+        }
+        [command] if command == "benchmark" => benchmark(),
+        _ => Err("usage: return-reconciler-trial1 reconcile <snapshot.json> <report.json> | verify <snapshot.json> <report.json> | generate-representative <snapshot.json> | benchmark".to_string()),
+    }
+}
+
+fn benchmark() -> Result<(), String> {
+    let generated_at = Instant::now();
+    let snapshot = generate_representative(20_260_813);
+    let generation_ms = generated_at.elapsed().as_millis();
+
+    let candidate_at = Instant::now();
+    let expected = reconcile(&snapshot)?;
+    let candidate_ms = candidate_at.elapsed().as_millis();
+
+    let reference_at = Instant::now();
+    let reference = reference_reconcile(&snapshot)?;
+    let reference_ms = reference_at.elapsed().as_millis();
+    if expected != reference {
+        return Err("candidate differs from independent reference".to_string());
+    }
+
+    let expected_bytes = serde_json::to_vec(&expected).map_err(|error| error.to_string())?;
+    let shuffles_at = Instant::now();
+    for seed in 0..10 {
+        let mut shuffled = snapshot.clone();
+        deterministic_shuffle(&mut shuffled, seed);
+        let actual =
+            serde_json::to_vec(&reconcile(&shuffled)?).map_err(|error| error.to_string())?;
+        if actual != expected_bytes {
+            return Err(format!("shuffle {seed} changed report bytes"));
+        }
+    }
+    let shuffles_ms = shuffles_at.elapsed().as_millis();
+    println!(
+        "representative_ok returns={} lines={} events={} adversarial=500 generation_ms={} candidate_ms={} reference_ms={} ten_shuffles_ms={} report_bytes={}",
+        snapshot.returns.len(),
+        snapshot
+            .returns
+            .iter()
+            .map(|authorization| authorization.lines.len())
+            .sum::<usize>(),
+        snapshot.events.len(),
+        generation_ms,
+        candidate_ms,
+        reference_ms,
+        shuffles_ms,
+        expected_bytes.len()
+    );
+    Ok(())
+}
+
+fn read_json<T: serde::de::DeserializeOwned>(path: &Path) -> Result<T, String> {
+    let file = File::open(path).map_err(|error| error.to_string())?;
+    serde_json::from_reader(BufReader::new(file)).map_err(|error| error.to_string())
+}
+
+fn write_json<T: serde::Serialize>(path: &Path, value: &T) -> Result<(), String> {
+    if path.exists() {
+        return Err(format!("refusing to overwrite {}", path.display()));
+    }
+    let file = File::create(path).map_err(|error| error.to_string())?;
+    let mut writer = BufWriter::new(file);
+    serde_json::to_writer(&mut writer, value).map_err(|error| error.to_string())?;
+    writer.write_all(b"\n").map_err(|error| error.to_string())?;
+    writer.flush().map_err(|error| error.to_string())?;
+    fs::metadata(path).map_err(|error| error.to_string())?;
+    Ok(())
+}
diff --git a/developer-simulation/runs/2026-08-13--multi-carrier-return-refund-reconciler/src/reference.rs b/developer-simulation/runs/2026-08-13--multi-carrier-return-refund-reconciler/src/reference.rs
new file mode 100644
index 0000000..7da0c97
--- /dev/null
+++ b/developer-simulation/runs/2026-08-13--multi-carrier-return-refund-reconciler/src/reference.rs
@@ -0,0 +1,426 @@
+//! Deliberately straightforward reference calculation.
+//!
+//! This module does not call the candidate reconciler. It repeatedly scans
+//! sorted vectors and derives literal groups, favoring auditability over speed.
+
+use std::collections::{BTreeMap, BTreeSet};
+
+use crate::{
+    Event, EventAccounting, LinePlan, PaymentStatus, Report, ReturnAuthorization, ReturnPlan,
+    SCHEMA_VERSION, Snapshot, Summary, validate_snapshot,
+};
+
+#[derive(Clone)]
+struct ReferenceScan {
+    event_id: String,
+    sku: String,
+    quantity: u32,
+    provenance: Vec<String>,
+}
+
+#[derive(Clone, Copy, PartialEq, Eq)]
+enum ReferenceBlock {
+    Successful,
+    Pending,
+}
+
+/// Calculate the same report with an intentionally separate, scan-oriented algorithm.
+///
+/// # Errors
+///
+/// Returns an error if snapshot validation or canonical serialization fails.
+pub fn reference_reconcile(snapshot: &Snapshot) -> Result<Report, String> {
+    validate_snapshot(snapshot)?;
+    let (accepted, accounting, duplicate_count, conflict_count, conflict_returns) =
+        reference_canonicalize(&snapshot.events)?;
+    let mut events_by_return: BTreeMap<String, Vec<Event>> = BTreeMap::new();
+    for event in &accepted {
+        events_by_return
+            .entry(event.return_id().to_string())
+            .or_default()
+            .push(event.clone());
+    }
+
+    let mut authorizations = snapshot.returns.clone();
+    authorizations.sort_by(|left, right| left.return_id.cmp(&right.return_id));
+    let mut returns = Vec::with_capacity(authorizations.len());
+    for authorization in authorizations {
+        let return_id = authorization.return_id.clone();
+        returns.push(reference_return(
+            authorization,
+            events_by_return.get(&return_id).map_or(&[], Vec::as_slice),
+            &conflict_returns,
+        ));
+    }
+
+    let proposed_cents = returns
+        .iter()
+        .flat_map(|plan| &plan.lines)
+        .try_fold(0_u64, |total, line| total.checked_add(line.proposed_cents))
+        .ok_or_else(|| "report proposed cents overflow".to_string())?;
+    Ok(Report {
+        schema_version: SCHEMA_VERSION,
+        snapshot_id: snapshot.snapshot_id.clone(),
+        advisory_only: true,
+        summary: Summary {
+            return_count: returns.len(),
+            input_event_count: snapshot.events.len(),
+            accepted_unique_events: accepted.len(),
+            exact_duplicate_events: duplicate_count,
+            conflicting_event_ids: conflict_count,
+            review_returns: returns
+                .iter()
+                .filter(|plan| plan.disposition == "review")
+                .count(),
+            proposed_quantity: returns
+                .iter()
+                .flat_map(|plan| &plan.lines)
+                .map(|line| u64::from(line.proposed_quantity))
+                .sum(),
+            proposed_cents,
+        },
+        event_accounting: accounting,
+        returns,
+    })
+}
+
+type CanonicalReference = (
+    Vec<Event>,
+    Vec<EventAccounting>,
+    usize,
+    usize,
+    BTreeSet<String>,
+);
+
+fn reference_canonicalize(events: &[Event]) -> Result<CanonicalReference, String> {
+    let mut rows = Vec::with_capacity(events.len());
+    for event in events {
+        rows.push((
+            event.event_id().to_string(),
+            serde_json::to_vec(event).map_err(|error| error.to_string())?,
+            event,
+        ));
+    }
+    rows.sort_by(|left, right| (&left.0, &left.1).cmp(&(&right.0, &right.1)));
+
+    let mut accepted = Vec::new();
+    let mut accounting = Vec::new();
+    let mut exact_duplicates = 0_usize;
+    let mut conflicts = 0_usize;
+    let mut conflict_returns = BTreeSet::new();
+    let mut start = 0_usize;
+    while start < rows.len() {
+        let mut end = start + 1;
+        while end < rows.len() && rows[end].0 == rows[start].0 {
+            end += 1;
+        }
+        let first_payload = &rows[start].1;
+        let conflicting = rows[start + 1..end]
+            .iter()
+            .any(|(_, payload, _)| payload != first_payload);
+        if conflicting {
+            conflicts += 1;
+            for (_, _, event) in &rows[start..end] {
+                conflict_returns.insert(event.return_id().to_string());
+            }
+            accounting.push(EventAccounting {
+                event_id: rows[start].0.clone(),
+                input_occurrences: end - start,
+                disposition: "quarantined_conflict".to_string(),
+            });
+        } else {
+            exact_duplicates += end - start - 1;
+            accepted.push(rows[start].2.clone());
+            accounting.push(EventAccounting {
+                event_id: rows[start].0.clone(),
+                input_occurrences: end - start,
+                disposition: if end - start == 1 {
+                    "accepted".to_string()
+                } else {
+                    "accepted_with_exact_retries".to_string()
+                },
+            });
+        }
+        start = end;
+    }
+    Ok((
+        accepted,
+        accounting,
+        exact_duplicates,
+        conflicts,
+        conflict_returns,
+    ))
+}
+
+#[allow(clippy::too_many_lines)]
+fn reference_return(
+    mut authorization: ReturnAuthorization,
+    accepted: &[Event],
+    conflict_returns: &BTreeSet<String>,
+) -> ReturnPlan {
+    authorization
+        .lines
+        .sort_by(|left, right| left.line_id.cmp(&right.line_id));
+    let mut reviews = BTreeSet::new();
+    if conflict_returns.contains(&authorization.return_id) {
+        reviews.insert("conflicting_event_id".to_string());
+    }
+
+    for event in accepted {
+        if let Event::Correction {
+            return_id,
+            target_event_id,
+            ..
+        } = event
+            && return_id == &authorization.return_id
+            && !accepted.iter().any(|candidate| {
+                    matches!(candidate, Event::WarehouseScan { event_id, .. } if event_id == target_event_id)
+                })
+        {
+            reviews.insert("orphan_correction".to_string());
+        }
+    }
+
+    let mut scans = Vec::new();
+    for event in accepted {
+        let Event::WarehouseScan {
+            event_id,
+            source_timestamp,
+            ingestion_id,
+            return_id,
+            sku,
+            quantity,
+            ..
+        } = event
+        else {
+            continue;
+        };
+        if return_id != &authorization.return_id {
+            continue;
+        }
+        let mut corrected_sku = sku.clone();
+        let mut corrected_quantity = *quantity;
+        let mut provenance = vec![event_id.clone()];
+        let mut eligible = Vec::new();
+        for correction in accepted {
+            let Event::Correction {
+                event_id: correction_id,
+                source_timestamp: correction_timestamp,
+                ingestion_id: correction_ingestion,
+                return_id: correction_return,
+                target_event_id,
+                replacement_sku,
+                replacement_quantity,
+                ..
+            } = correction
+            else {
+                continue;
+            };
+            if target_event_id != event_id {
+                continue;
+            }
+            if correction_return != return_id {
+                reviews.insert("correction_return_mismatch".to_string());
+            } else if (
+                *correction_timestamp,
+                *correction_ingestion,
+                correction_id.as_str(),
+            ) <= (*source_timestamp, *ingestion_id, event_id.as_str())
+            {
+                reviews.insert("non_later_correction".to_string());
+            } else {
+                eligible.push((
+                    (
+                        *correction_timestamp,
+                        *correction_ingestion,
+                        correction_id.as_str(),
+                    ),
+                    correction_id,
+                    replacement_sku,
+                    *replacement_quantity,
+                ));
+            }
+        }
+        eligible.sort_by(|left, right| left.0.cmp(&right.0));
+        if let Some((_, correction_id, replacement_sku, replacement_quantity)) = eligible.last() {
+            corrected_sku.clone_from(replacement_sku);
+            corrected_quantity = *replacement_quantity;
+            provenance.push((*correction_id).clone());
+            provenance.sort();
+        }
+        scans.push(ReferenceScan {
+            event_id: event_id.clone(),
+            sku: corrected_sku,
+            quantity: corrected_quantity,
+            provenance,
+        });
+    }
+    scans.sort_by(|left, right| (&left.sku, &left.event_id).cmp(&(&right.sku, &right.event_id)));
+
+    let mut blocks: BTreeMap<String, ReferenceBlock> = BTreeMap::new();
+    let mut attempts: BTreeMap<(&str, &str), Vec<(PaymentStatus, u64)>> = BTreeMap::new();
+    for event in accepted {
+        if let Event::PaymentResult {
+            return_id,
+            line_id,
+            refund_id,
+            amount_cents,
+            status,
+            ..
+        } = event
+            && return_id == &authorization.return_id
+        {
+            attempts
+                .entry((line_id, refund_id))
+                .or_default()
+                .push((*status, *amount_cents));
+        }
+    }
+    for ((line_id, _), results) in attempts {
+        let different_amounts = results
+            .iter()
+            .map(|(_, amount)| *amount)
+            .collect::<BTreeSet<_>>()
+            .len()
+            > 1;
+        if different_amounts {
+            reviews.insert("payment_amount_conflict".to_string());
+            blocks.insert(line_id.to_string(), ReferenceBlock::Pending);
+        } else if results
+            .iter()
+            .any(|(status, _)| *status == PaymentStatus::Successful)
+        {
+            blocks.insert(line_id.to_string(), ReferenceBlock::Successful);
+        } else if results
+            .iter()
+            .any(|(status, _)| *status == PaymentStatus::Pending)
+        {
+            blocks
+                .entry(line_id.to_string())
+                .or_insert(ReferenceBlock::Pending);
+        }
+    }
+
+    let authorized_skus: BTreeSet<String> = authorization
+        .lines
+        .iter()
+        .map(|line| line.sku.clone())
+        .collect();
+    let line_skus: BTreeMap<String, String> = authorization
+        .lines
+        .iter()
+        .map(|line| (line.line_id.clone(), line.sku.clone()))
+        .collect();
+    let unmatched_scan_quantity: u64 = scans
+        .iter()
+        .filter(|scan| !authorized_skus.contains(&scan.sku))
+        .map(|scan| u64::from(scan.quantity))
+        .sum();
+    if unmatched_scan_quantity > 0 {
+        reviews.insert("unauthorized_sku".to_string());
+    }
+
+    let total_prior: u64 = authorization
+        .lines
+        .iter()
+        .map(|line| line.prior_successful_refund_cents)
+        .sum();
+    let mut return_cap = authorization.captured_cents - total_prior;
+    let mut remaining_scan_quantity: Vec<u32> = scans.iter().map(|scan| scan.quantity).collect();
+    let mut lines = Vec::with_capacity(authorization.lines.len());
+    for line in authorization.lines {
+        let mut accepted_quantity = 0_u32;
+        let mut provenance = BTreeSet::new();
+        for (scan_index, scan) in scans.iter().enumerate() {
+            if scan.sku != line.sku || accepted_quantity == line.authorized_qty {
+                continue;
+            }
+            let wanted = line.authorized_qty - accepted_quantity;
+            let taken = remaining_scan_quantity[scan_index].min(wanted);
+            if taken > 0 {
+                remaining_scan_quantity[scan_index] -= taken;
+                accepted_quantity += taken;
+                provenance.extend(scan.provenance.iter().cloned());
+            }
+        }
+        let net = line.paid_subtotal_cents + line.tax_cents - line.discount_cents;
+        let maximum_refundable_cents = net - line.prior_successful_refund_cents;
+        let blocked = blocks.get(&line.line_id).copied();
+        if blocked == Some(ReferenceBlock::Successful) {
+            reviews.insert("payment_already_successful".to_string());
+        } else if blocked == Some(ReferenceBlock::Pending) {
+            reviews.insert("payment_inconclusive".to_string());
+        }
+        let eligible_quantity = if blocked.is_none() {
+            accepted_quantity
+        } else {
+            0
+        };
+        let unit_base = net / u64::from(line.authorized_qty);
+        let remainder = net % u64::from(line.authorized_qty);
+        let cent_capacity = maximum_refundable_cents.min(return_cap);
+        let mut proposed_quantity = 0;
+        for quantity in 1..=eligible_quantity {
+            let cost = unit_base * u64::from(quantity) + remainder.min(u64::from(quantity));
+            if cost <= cent_capacity {
+                proposed_quantity = quantity;
+            } else {
+                break;
+            }
+        }
+        let proposed_cents =
+            unit_base * u64::from(proposed_quantity) + remainder.min(u64::from(proposed_quantity));
+        if blocked.is_none() && proposed_quantity < accepted_quantity {
+            reviews.insert("insufficient_whole_unit_capacity".to_string());
+        }
+        return_cap -= proposed_cents;
+        lines.push(LinePlan {
+            line_id: line.line_id,
+            authorized_quantity: line.authorized_qty,
+            accepted_scan_quantity: accepted_quantity,
+            review_scan_quantity: 0,
+            prior_successful_refund_cents: line.prior_successful_refund_cents,
+            maximum_refundable_cents,
+            proposed_quantity,
+            proposed_cents,
+            provenance_event_ids: provenance.into_iter().collect(),
+        });
+    }
+
+    for sku in authorized_skus {
+        let excess: u64 = scans
+            .iter()
+            .enumerate()
+            .filter(|(_, scan)| scan.sku == sku)
+            .map(|(index, _)| u64::from(remaining_scan_quantity[index]))
+            .sum();
+        if excess > 0 {
+            reviews.insert("excess_quantity".to_string());
+            if let Some(line) = lines
+                .iter_mut()
+                .rev()
+                .find(|line| line_skus.get(&line.line_id) == Some(&sku))
+            {
+                line.review_scan_quantity += excess;
+            }
+        }
+    }
+
+    let review_codes: Vec<String> = reviews.into_iter().collect();
+    let has_proposal = lines.iter().any(|line| line.proposed_cents > 0);
+    ReturnPlan {
+        return_id: authorization.return_id,
+        disposition: if review_codes.is_empty() {
+            if has_proposal {
+                "proposed".to_string()
+            } else {
+                "no_refund".to_string()
+            }
+        } else {
+            "review".to_string()
+        },
+        review_codes,
+        unmatched_scan_quantity,
+        lines,
+    }
+}
diff --git a/developer-simulation/runs/2026-08-13--multi-carrier-return-refund-reconciler/src/workload.rs b/developer-simulation/runs/2026-08-13--multi-carrier-return-refund-reconciler/src/workload.rs
new file mode 100644
index 0000000..3f3d2a8
--- /dev/null
+++ b/developer-simulation/runs/2026-08-13--multi-carrier-return-refund-reconciler/src/workload.rs
@@ -0,0 +1,279 @@
+use crate::{AuthorizedLine, Event, PaymentStatus, ReturnAuthorization, Snapshot};
+
+const RETURN_COUNT: usize = 25_000;
+const ADVERSARIAL_RETURN_COUNT: usize = 500;
+const EVENT_COUNT: usize = 250_000;
+
+/// Generate the exact synthetic representative shape described by the brief.
+///
+/// The seed controls only deterministic ingestion identifiers and filler
+/// timestamps; generated data contains identifiers and integer amounts only.
+#[must_use]
+#[allow(clippy::too_many_lines)]
+pub fn generate_representative(seed: u64) -> Snapshot {
+    let mut returns = Vec::with_capacity(RETURN_COUNT);
+    let mut events = Vec::with_capacity(EVENT_COUNT);
+    let mut ingestion_id = seed.max(1);
+
+    for return_index in 0..RETURN_COUNT {
+        let return_id = if return_index < ADVERSARIAL_RETURN_COUNT {
+            format!("adv-return-{return_index:05}")
+        } else {
+            format!("return-{return_index:05}")
+        };
+        let line_count = if return_index < 20_000 { 3 } else { 2 };
+        let parcel_count = if return_index < 15_000 { 2 } else { 1 };
+        let mut lines = Vec::with_capacity(line_count);
+        let mut captured_cents = 0_u64;
+        let mut first_scan = None;
+
+        for line_index in 0..line_count {
+            let remainder_case =
+                return_index < ADVERSARIAL_RETURN_COUNT && return_index % 5 == 2 && line_index == 0;
+            let paid_subtotal_cents = if remainder_case {
+                901
+            } else {
+                900 + ((return_index + line_index) % 97) as u64
+            };
+            let tax_cents = 80;
+            let discount_cents = 30;
+            captured_cents += paid_subtotal_cents + tax_cents - discount_cents;
+            let line_id = format!("line-{return_index:05}-{line_index:02}");
+            let sku = format!("sku-{line_index:02}");
+            lines.push(AuthorizedLine {
+                line_id: line_id.clone(),
+                sku: sku.clone(),
+                authorized_qty: if remainder_case { 2 } else { 1 },
+                paid_subtotal_cents,
+                tax_cents,
+                discount_cents,
+                prior_successful_refund_cents: 0,
+            });
+            let scan = Event::WarehouseScan {
+                event_id: format!("scan-{return_index:05}-{line_index:02}"),
+                source_system_id: format!("warehouse-{}", return_index % 2),
+                source_timestamp: 1_000 + line_index as u64,
+                ingestion_id,
+                return_id: return_id.clone(),
+                parcel_id: format!("parcel-{return_index:05}-{:02}", line_index % parcel_count),
+                sku,
+                quantity: if remainder_case { 2 } else { 1 },
+            };
+            ingestion_id += 1;
+            if line_index == 0 {
+                first_scan = Some(scan.clone());
+            }
+            events.push(scan);
+        }
+
+        for parcel_index in 0..parcel_count {
+            events.push(Event::Carrier {
+                event_id: format!("carrier-{return_index:05}-{parcel_index:02}"),
+                source_system_id: format!("carrier-{}", return_index % 3),
+                source_timestamp: 2_000_u64.saturating_sub(parcel_index as u64),
+                ingestion_id,
+                return_id: return_id.clone(),
+                parcel_id: format!("parcel-{return_index:05}-{parcel_index:02}"),
+                status: "delivered".to_string(),
+            });
+            ingestion_id += 1;
+        }
+
+        let first_line_id = lines[0].line_id.clone();
+        let payment = Event::PaymentResult {
+            event_id: format!("payment-{return_index:05}-failed"),
+            source_system_id: "payment-provider".to_string(),
+            source_timestamp: 3_000,
+            ingestion_id,
+            return_id: return_id.clone(),
+            line_id: first_line_id.clone(),
+            refund_id: format!("refund-{return_index:05}"),
+            amount_cents: lines[0].paid_subtotal_cents + lines[0].tax_cents
+                - lines[0].discount_cents,
+            status: PaymentStatus::Failed,
+        };
+        ingestion_id += 1;
+        events.push(payment.clone());
+
+        if return_index < ADVERSARIAL_RETURN_COUNT {
+            let Some(base_scan) = first_scan else {
+                continue;
+            };
+            match return_index % 5 {
+                0 => events.push(base_scan.clone()),
+                1 => {
+                    let Event::WarehouseScan {
+                        event_id,
+                        source_system_id,
+                        source_timestamp,
+                        ingestion_id: original_ingestion_id,
+                        return_id: scan_return_id,
+                        parcel_id,
+                        sku,
+                        ..
+                    } = base_scan
+                    else {
+                        unreachable!();
+                    };
+                    events.push(Event::WarehouseScan {
+                        event_id,
+                        source_system_id,
+                        source_timestamp,
+                        ingestion_id: original_ingestion_id,
+                        return_id: scan_return_id,
+                        parcel_id,
+                        sku,
+                        quantity: 2,
+                    });
+                }
+                2 => events.push(Event::Correction {
+                    event_id: format!("correction-{return_index:05}"),
+                    source_system_id: "warehouse-0".to_string(),
+                    source_timestamp: 4_000,
+                    ingestion_id: 1,
+                    return_id: return_id.clone(),
+                    target_event_id: base_scan.event_id().to_string(),
+                    replacement_sku: "sku-00".to_string(),
+                    replacement_quantity: 1,
+                }),
+                3 => events.push(Event::WarehouseScan {
+                    event_id: format!("scan-{return_index:05}-excess"),
+                    source_system_id: "warehouse-1".to_string(),
+                    source_timestamp: 4_000,
+                    ingestion_id,
+                    return_id: return_id.clone(),
+                    parcel_id: format!("parcel-{return_index:05}-01"),
+                    sku: "sku-00".to_string(),
+                    quantity: 1,
+                }),
+                _ => events.push(Event::WarehouseScan {
+                    event_id: format!("scan-{return_index:05}-unknown"),
+                    source_system_id: "warehouse-0".to_string(),
+                    source_timestamp: 4_000,
+                    ingestion_id,
+                    return_id: return_id.clone(),
+                    parcel_id: format!("parcel-{return_index:05}-00"),
+                    sku: "sku-unauthorized".to_string(),
+                    quantity: 1,
+                }),
+            }
+            ingestion_id += 1;
+
+            match return_index % 5 {
+                0 | 3 => events.push(payment_variant(
+                    &return_id,
+                    &first_line_id,
+                    return_index,
+                    "pending",
+                    PaymentStatus::Pending,
+                    ingestion_id,
+                    lines[0].paid_subtotal_cents + lines[0].tax_cents - lines[0].discount_cents,
+                )),
+                1 | 4 => {
+                    events.push(payment_variant(
+                        &return_id,
+                        &first_line_id,
+                        return_index,
+                        "successful",
+                        PaymentStatus::Successful,
+                        ingestion_id,
+                        lines[0].paid_subtotal_cents + lines[0].tax_cents - lines[0].discount_cents,
+                    ));
+                    ingestion_id += 1;
+                    events.push(payment_variant(
+                        &return_id,
+                        &first_line_id,
+                        return_index,
+                        "delayed-pending",
+                        PaymentStatus::Pending,
+                        ingestion_id,
+                        lines[0].paid_subtotal_cents + lines[0].tax_cents - lines[0].discount_cents,
+                    ));
+                }
+                _ => events.push(payment),
+            }
+            ingestion_id += 1;
+        }
+
+        returns.push(ReturnAuthorization {
+            return_id,
+            captured_cents,
+            lines,
+        });
+    }
+
+    let mut filler = 0_usize;
+    while events.len() < EVENT_COUNT {
+        let return_index = filler % RETURN_COUNT;
+        let return_id = if return_index < ADVERSARIAL_RETURN_COUNT {
+            format!("adv-return-{return_index:05}")
+        } else {
+            format!("return-{return_index:05}")
+        };
+        let parcel_index = if return_index < 15_000 { filler % 2 } else { 0 };
+        events.push(Event::Carrier {
+            event_id: format!("carrier-filler-{filler:06}"),
+            source_system_id: format!("carrier-{}", filler % 3),
+            source_timestamp: 10_000_u64.saturating_sub((filler % 1_000) as u64),
+            ingestion_id,
+            return_id,
+            parcel_id: format!("parcel-{return_index:05}-{parcel_index:02}"),
+            status: if filler.is_multiple_of(2) {
+                "in_transit".to_string()
+            } else {
+                "delivered".to_string()
+            },
+        });
+        ingestion_id += 1;
+        filler += 1;
+    }
+
+    Snapshot {
+        snapshot_id: format!("representative-{seed}"),
+        returns,
+        events,
+    }
+}
+
+fn payment_variant(
+    return_id: &str,
+    line_id: &str,
+    return_index: usize,
+    suffix: &str,
+    status: PaymentStatus,
+    ingestion_id: u64,
+    amount_cents: u64,
+) -> Event {
+    Event::PaymentResult {
+        event_id: format!("payment-{return_index:05}-{suffix}"),
+        source_system_id: "payment-provider".to_string(),
+        source_timestamp: 3_001,
+        ingestion_id,
+        return_id: return_id.to_string(),
+        line_id: line_id.to_string(),
+        refund_id: format!("refund-{return_index:05}"),
+        amount_cents,
+        status,
+    }
+}
+
+/// Shuffle returns, lines, and events with a small deterministic PRNG.
+pub fn deterministic_shuffle(snapshot: &mut Snapshot, seed: u64) {
+    let mut state = seed ^ 0x9e37_79b9_7f4a_7c15;
+    shuffle_slice(&mut snapshot.events, &mut state);
+    shuffle_slice(&mut snapshot.returns, &mut state);
+    for authorization in &mut snapshot.returns {
+        shuffle_slice(&mut authorization.lines, &mut state);
+    }
+}
+
+fn shuffle_slice<T>(values: &mut [T], state: &mut u64) {
+    for index in (1..values.len()).rev() {
+        *state ^= *state << 13;
+        *state ^= *state >> 7;
+        *state ^= *state << 17;
+        let upper = u64::try_from(index + 1).expect("slice length fits u64");
+        let swap_index = usize::try_from(*state % upper).expect("index fits usize");
+        values.swap(index, swap_index);
+    }
+}
diff --git a/developer-simulation/runs/2026-08-13--multi-carrier-return-refund-reconciler/tests/domain.rs b/developer-simulation/runs/2026-08-13--multi-carrier-return-refund-reconciler/tests/domain.rs
new file mode 100644
index 0000000..547dc40
--- /dev/null
+++ b/developer-simulation/runs/2026-08-13--multi-carrier-return-refund-reconciler/tests/domain.rs
@@ -0,0 +1,366 @@
+use return_reconciler_trial1::{
+    AuthorizedLine, Event, PaymentStatus, ReturnAuthorization, Snapshot, reconcile,
+    reference_reconcile,
+};
+
+fn line() -> AuthorizedLine {
+    AuthorizedLine {
+        line_id: "line-1".into(),
+        sku: "sku-1".into(),
+        authorized_qty: 1,
+        paid_subtotal_cents: 1_000,
+        tax_cents: 80,
+        discount_cents: 80,
+        prior_successful_refund_cents: 0,
+    }
+}
+
+fn authorization() -> ReturnAuthorization {
+    ReturnAuthorization {
+        return_id: "return-1".into(),
+        captured_cents: 1_000,
+        lines: vec![line()],
+    }
+}
+
+fn scan(event_id: &str, quantity: u32) -> Event {
+    Event::WarehouseScan {
+        event_id: event_id.into(),
+        source_system_id: "warehouse-east".into(),
+        source_timestamp: 10,
+        ingestion_id: 10,
+        return_id: "return-1".into(),
+        parcel_id: "parcel-1".into(),
+        sku: "sku-1".into(),
+        quantity,
+    }
+}
+
+fn scan_for(event_id: &str, return_id: &str, parcel_id: &str, sku: &str, quantity: u32) -> Event {
+    Event::WarehouseScan {
+        event_id: event_id.into(),
+        source_system_id: "warehouse-east".into(),
+        source_timestamp: 10,
+        ingestion_id: 10,
+        return_id: return_id.into(),
+        parcel_id: parcel_id.into(),
+        sku: sku.into(),
+        quantity,
+    }
+}
+
+fn payment(event_id: &str, refund_id: &str, status: PaymentStatus) -> Event {
+    Event::PaymentResult {
+        event_id: event_id.into(),
+        source_system_id: "payment-provider".into(),
+        source_timestamp: 20,
+        ingestion_id: 20,
+        return_id: "return-1".into(),
+        line_id: "line-1".into(),
+        refund_id: refund_id.into(),
+        amount_cents: 1_000,
+        status,
+    }
+}
+
+#[test]
+fn conflicting_retry_is_quarantined_and_changes_no_proposed_refund() {
+    // Break caught: accepting either payload for a reused event ID can create
+    // a refund even though the source event is untrustworthy.
+    let snapshot = Snapshot {
+        snapshot_id: "fixture-conflict".into(),
+        returns: vec![authorization()],
+        events: vec![scan("scan-conflict", 1), scan("scan-conflict", 2)],
+    };
+
+    let report = reconcile(&snapshot).expect("valid snapshot should reconcile");
+
+    assert_eq!(report.summary.proposed_cents, 0);
+    assert_eq!(report.summary.conflicting_event_ids, 1);
+    assert_eq!(report.returns[0].lines[0].proposed_quantity, 0);
+    assert_eq!(report.returns[0].lines[0].proposed_cents, 0);
+    assert_eq!(report.returns[0].disposition, "review");
+    assert_eq!(report.returns[0].review_codes, ["conflicting_event_id"]);
+}
+
+// Keep the public payment enum in the first compile contract so later tests
+// cannot accidentally model pending and failed as one boolean.
+#[test]
+fn payment_status_contract_has_distinct_states() {
+    assert_ne!(PaymentStatus::Successful, PaymentStatus::Failed);
+    assert_ne!(PaymentStatus::Failed, PaymentStatus::Pending);
+}
+
+#[test]
+fn split_parcels_conserve_quantity_and_allocate_remainder_cents_deterministically() {
+    // Break caught: counting parcels independently can refund the same
+    // authorization twice or lose the one remainder cent.
+    let mut auth = authorization();
+    auth.lines[0].authorized_qty = 2;
+    auth.lines[0].paid_subtotal_cents = 1_001;
+    auth.captured_cents = 1_001;
+    let snapshot = Snapshot {
+        snapshot_id: "fixture-split".into(),
+        returns: vec![auth],
+        events: vec![
+            scan_for("scan-b", "return-1", "parcel-b", "sku-1", 1),
+            scan_for("scan-a", "return-1", "parcel-a", "sku-1", 1),
+        ],
+    };
+
+    let report = reconcile(&snapshot).unwrap();
+    let line = &report.returns[0].lines[0];
+    assert_eq!(line.accepted_scan_quantity, 2);
+    assert_eq!(line.review_scan_quantity, 0);
+    assert_eq!(line.proposed_quantity, 2);
+    assert_eq!(line.proposed_cents, 1_001);
+    assert_eq!(line.provenance_event_ids, ["scan-a", "scan-b"]);
+}
+
+#[test]
+fn exact_retry_is_idempotent_and_event_order_does_not_change_bytes() {
+    // Break caught: iterating arrival order or counting an exact retry can
+    // change quantities, provenance ordering, or serialized output.
+    let events = vec![scan("scan-1", 1), scan("scan-1", 1)];
+    let forward = Snapshot {
+        snapshot_id: "fixture-idempotent".into(),
+        returns: vec![authorization()],
+        events: events.clone(),
+    };
+    let reverse = Snapshot {
+        snapshot_id: "fixture-idempotent".into(),
+        returns: vec![authorization()],
+        events: events.into_iter().rev().collect(),
+    };
+
+    let forward_bytes = serde_json::to_vec(&reconcile(&forward).unwrap()).unwrap();
+    let reverse_bytes = serde_json::to_vec(&reconcile(&reverse).unwrap()).unwrap();
+    assert_eq!(forward_bytes, reverse_bytes);
+    assert_eq!(
+        reconcile(&forward).unwrap().summary.exact_duplicate_events,
+        1
+    );
+    assert_eq!(reconcile(&forward).unwrap().summary.proposed_cents, 1_000);
+}
+
+#[test]
+fn correction_before_target_in_input_supersedes_only_that_scan() {
+    // Break caught: applying corrections in arrival order can orphan a valid
+    // correction or mutate every scan for the same SKU.
+    let mut auth = authorization();
+    auth.lines[0].authorized_qty = 2;
+    auth.lines[0].paid_subtotal_cents = 2_000;
+    auth.captured_cents = 2_000;
+    let correction = Event::Correction {
+        event_id: "correction-1".into(),
+        source_system_id: "warehouse-east".into(),
+        source_timestamp: 11,
+        ingestion_id: 1,
+        return_id: "return-1".into(),
+        target_event_id: "scan-target".into(),
+        replacement_sku: "sku-1".into(),
+        replacement_quantity: 1,
+    };
+    let snapshot = Snapshot {
+        snapshot_id: "fixture-correction".into(),
+        returns: vec![auth],
+        events: vec![
+            correction,
+            scan_for("scan-target", "return-1", "parcel-a", "sku-1", 2),
+        ],
+    };
+
+    let report = reconcile(&snapshot).unwrap();
+    let line = &report.returns[0].lines[0];
+    assert_eq!(line.proposed_quantity, 1);
+    assert_eq!(line.proposed_cents, 1_000);
+    assert_eq!(line.provenance_event_ids, ["correction-1", "scan-target"]);
+}
+
+#[test]
+fn excess_and_unknown_units_are_reviewed_but_never_refunded() {
+    // Break caught: matching by return alone can turn over-quantity or
+    // unknown SKU units into refundable units.
+    let snapshot = Snapshot {
+        snapshot_id: "fixture-unmatched".into(),
+        returns: vec![authorization()],
+        events: vec![
+            scan_for("scan-known", "return-1", "parcel-a", "sku-1", 2),
+            scan_for("scan-unknown", "return-1", "parcel-b", "sku-other", 1),
+        ],
+    };
+
+    let report = reconcile(&snapshot).unwrap();
+    let plan = &report.returns[0];
+    assert_eq!(plan.lines[0].proposed_quantity, 1);
+    assert_eq!(plan.lines[0].review_scan_quantity, 1);
+    assert_eq!(plan.unmatched_scan_quantity, 1);
+    assert_eq!(plan.lines[0].proposed_cents, 1_000);
+    assert_eq!(plan.disposition, "review");
+    assert_eq!(plan.review_codes, ["excess_quantity", "unauthorized_sku"]);
+}
+
+#[test]
+fn payment_results_distinguish_success_pending_and_failure() {
+    // Break caught: treating all non-success results alike can issue a
+    // second refund while the first attempt is still inconclusive.
+    let base = Snapshot {
+        snapshot_id: "fixture-payment".into(),
+        returns: vec![authorization()],
+        events: vec![scan("scan-1", 1)],
+    };
+
+    let mut failed = base.clone();
+    failed
+        .events
+        .push(payment("payment-failed", "refund-1", PaymentStatus::Failed));
+    assert_eq!(reconcile(&failed).unwrap().summary.proposed_cents, 1_000);
+
+    let mut pending = base.clone();
+    pending.events.push(payment(
+        "payment-pending",
+        "refund-1",
+        PaymentStatus::Pending,
+    ));
+    let pending_report = reconcile(&pending).unwrap();
+    assert_eq!(pending_report.summary.proposed_cents, 0);
+    assert_eq!(
+        pending_report.returns[0].review_codes,
+        ["payment_inconclusive"]
+    );
+
+    let mut successful_then_delayed_pending = base;
+    successful_then_delayed_pending.events.extend([
+        payment("payment-success", "refund-1", PaymentStatus::Successful),
+        payment("payment-delayed", "refund-1", PaymentStatus::Pending),
+    ]);
+    let successful_report = reconcile(&successful_then_delayed_pending).unwrap();
+    assert_eq!(successful_report.summary.proposed_cents, 0);
+    assert_eq!(
+        successful_report.returns[0].review_codes,
+        ["payment_already_successful"]
+    );
+}
+
+#[test]
+fn line_and_return_payment_caps_are_never_exceeded() {
+    // Break caught: independently refunding line values can exceed the
+    // captured payment after authoritative prior refunds.
+    let authorization = ReturnAuthorization {
+        return_id: "return-1".into(),
+        captured_cents: 1_000,
+        lines: vec![
+            AuthorizedLine {
+                line_id: "line-a".into(),
+                sku: "sku-a".into(),
+                authorized_qty: 1,
+                paid_subtotal_cents: 700,
+                tax_cents: 0,
+                discount_cents: 0,
+                prior_successful_refund_cents: 100,
+            },
+            AuthorizedLine {
+                line_id: "line-b".into(),
+                sku: "sku-b".into(),
+                authorized_qty: 1,
+                paid_subtotal_cents: 700,
+                tax_cents: 0,
+                discount_cents: 0,
+                prior_successful_refund_cents: 0,
+            },
+        ],
+    };
+    let snapshot = Snapshot {
+        snapshot_id: "fixture-caps".into(),
+        returns: vec![authorization],
+        events: vec![
+            scan_for("scan-a", "return-1", "parcel-a", "sku-a", 1),
+            scan_for("scan-b", "return-1", "parcel-b", "sku-b", 1),
+        ],
+    };
+
+    let report = reconcile(&snapshot).unwrap();
+    assert_eq!(report.returns[0].lines[0].proposed_quantity, 0);
+    assert_eq!(report.returns[0].lines[0].proposed_cents, 0);
+    assert_eq!(report.returns[0].lines[1].proposed_quantity, 1);
+    assert_eq!(report.returns[0].lines[1].proposed_cents, 700);
+    assert_eq!(report.summary.proposed_cents, 700);
+    assert_eq!(
+        report.returns[0].review_codes,
+        ["insufficient_whole_unit_capacity"]
+    );
+}
+
+#[test]
+fn cap_smaller_than_one_unit_never_emits_a_partially_funded_quantity() {
+    // Break caught: min(requested cents, remaining return cap) can emit one
+    // proposed unit paired with fewer cents than that deterministic unit costs.
+    let authorization = ReturnAuthorization {
+        return_id: "return-1".into(),
+        captured_cents: 400,
+        lines: vec![AuthorizedLine {
+            line_id: "line-1".into(),
+            sku: "sku-1".into(),
+            authorized_qty: 2,
+            paid_subtotal_cents: 1_001,
+            tax_cents: 0,
+            discount_cents: 0,
+            prior_successful_refund_cents: 0,
+        }],
+    };
+    let snapshot = Snapshot {
+        snapshot_id: "fixture-sub-unit-cap".into(),
+        returns: vec![authorization],
+        events: vec![scan("scan-1", 1)],
+    };
+
+    let report = reconcile(&snapshot).unwrap();
+    let line = &report.returns[0].lines[0];
+    assert_eq!(line.accepted_scan_quantity, 1);
+    assert_eq!(line.proposed_quantity, 0);
+    assert_eq!(line.proposed_cents, 0);
+    assert!(line.proposed_cents <= 400);
+    assert_eq!(report.summary.proposed_quantity, 0);
+    assert_eq!(report.summary.proposed_cents, 0);
+    assert_eq!(report.returns[0].disposition, "review");
+    assert_eq!(
+        report.returns[0].review_codes,
+        ["insufficient_whole_unit_capacity"]
+    );
+}
+
+#[test]
+fn reference_and_candidate_agree_on_disclosed_adversarial_fixture() {
+    // Break caught: the optimized candidate can share a systematic mistake
+    // with its own internal checks; this expected result comes from a
+    // separately implemented calculation.
+    let snapshot = Snapshot {
+        snapshot_id: "fixture-reference".into(),
+        returns: vec![authorization()],
+        events: vec![
+            scan_for("scan-known", "return-1", "parcel-a", "sku-1", 2),
+            scan_for("scan-unknown", "return-1", "parcel-b", "sku-other", 1),
+        ],
+    };
+    assert_eq!(
+        serde_json::to_vec(&reconcile(&snapshot).unwrap()).unwrap(),
+        serde_json::to_vec(&reference_reconcile(&snapshot).unwrap()).unwrap()
+    );
+}
+
+#[test]
+fn independent_verifier_rejects_tampered_provenance_even_when_totals_still_balance() {
+    // Break caught: checking only caps and summary totals lets a report claim
+    // provenance from an event that was never in the snapshot.
+    let snapshot = Snapshot {
+        snapshot_id: "fixture-verifier".into(),
+        returns: vec![authorization()],
+        events: vec![scan("scan-1", 1)],
+    };
+    let mut report = reconcile(&snapshot).unwrap();
+    report.returns[0].lines[0]
+        .provenance_event_ids
+        .push("fabricated-event".into());
+
+    assert!(return_reconciler_trial1::verify_report(&snapshot, &report).is_err());
+}
diff --git a/developer-simulation/runs/2026-08-13--multi-carrier-return-refund-reconciler/tests/publication.rs b/developer-simulation/runs/2026-08-13--multi-carrier-return-refund-reconciler/tests/publication.rs
new file mode 100644
index 0000000..d1597b2
--- /dev/null
+++ b/developer-simulation/runs/2026-08-13--multi-carrier-return-refund-reconciler/tests/publication.rs
@@ -0,0 +1,287 @@
+use std::fs;
+
+use return_reconciler_trial1::{
+    AuthorizedLine, Event, FailPoint, PaymentStatus, ReturnAuthorization, Snapshot, reconcile,
+    reconcile_file,
+};
+
+fn temp_dir() -> tempfile::TempDir {
+    let root = std::path::Path::new(env!("CARGO_MANIFEST_DIR")).join("target/test-runtime");
+    fs::create_dir_all(&root).unwrap();
+    tempfile::Builder::new()
+        .prefix("publication-")
+        .tempdir_in(root)
+        .unwrap()
+}
+
+fn snapshot_json(path: &std::path::Path) {
+    let snapshot = Snapshot {
+        snapshot_id: "publication-fixture".into(),
+        returns: vec![ReturnAuthorization {
+            return_id: "return-1".into(),
+            captured_cents: 100,
+            lines: vec![AuthorizedLine {
+                line_id: "line-1".into(),
+                sku: "sku-1".into(),
+                authorized_qty: 1,
+                paid_subtotal_cents: 100,
+                tax_cents: 0,
+                discount_cents: 0,
+                prior_successful_refund_cents: 0,
+            }],
+        }],
+        events: vec![Event::WarehouseScan {
+            event_id: "scan-1".into(),
+            source_system_id: "warehouse-east".into(),
+            source_timestamp: 1,
+            ingestion_id: 1,
+            return_id: "return-1".into(),
+            parcel_id: "parcel-1".into(),
+            sku: "sku-1".into(),
+            quantity: 1,
+        }],
+    };
+    fs::write(path, serde_json::to_vec(&snapshot).unwrap()).unwrap();
+}
+
+fn write_snapshot(path: &std::path::Path, snapshot: &Snapshot) {
+    fs::write(path, serde_json::to_vec(snapshot).unwrap()).unwrap();
+}
+
+fn overflow_snapshot() -> Snapshot {
+    let mut returns = Vec::new();
+    let mut events = Vec::new();
+    for index in 0..2 {
+        let return_id = format!("return-{index}");
+        let line_id = format!("line-{index}");
+        let sku = format!("sku-{index}");
+        returns.push(ReturnAuthorization {
+            return_id: return_id.clone(),
+            captured_cents: u64::MAX,
+            lines: vec![AuthorizedLine {
+                line_id,
+                sku: sku.clone(),
+                authorized_qty: 1,
+                paid_subtotal_cents: u64::MAX,
+                tax_cents: 0,
+                discount_cents: 0,
+                prior_successful_refund_cents: 0,
+            }],
+        });
+        events.push(Event::WarehouseScan {
+            event_id: format!("scan-{index}"),
+            source_system_id: "warehouse-east".into(),
+            source_timestamp: 1,
+            ingestion_id: index,
+            return_id,
+            parcel_id: format!("parcel-{index}"),
+            sku,
+            quantity: 1,
+        });
+    }
+    Snapshot {
+        snapshot_id: "overflow-fixture".into(),
+        returns,
+        events,
+    }
+}
+
+#[test]
+fn injected_publication_failures_preserve_prior_report_or_no_report() {
+    // Break caught: opening/truncating the requested output before a
+    // complete report exists destroys the last known-good operator plan.
+    for failpoint in [
+        FailPoint::BeforeOutputCreation,
+        FailPoint::AfterTemporaryComplete,
+        FailPoint::BeforePublish,
+    ] {
+        let dir = temp_dir();
+        let input = dir.path().join("snapshot.json");
+        let output = dir.path().join("report.json");
+        snapshot_json(&input);
+
+        let error = reconcile_file(&input, &output, failpoint).unwrap_err();
+        assert!(error.contains("injected"));
+        assert!(!output.exists());
+
+        fs::write(&output, b"prior-complete-report").unwrap();
+        let error = reconcile_file(&input, &output, failpoint).unwrap_err();
+        assert!(error.contains("injected"));
+        assert_eq!(fs::read(&output).unwrap(), b"prior-complete-report");
+    }
+}
+
+#[test]
+fn output_aliasing_input_is_rejected_without_modifying_input() {
+    // Break caught: publishing through a direct path, symlink, or hard link
+    // to the input can destroy the authoritative snapshot export.
+    let dir = temp_dir();
+    let input = dir.path().join("snapshot.json");
+    snapshot_json(&input);
+    let original = fs::read(&input).unwrap();
+
+    let error = reconcile_file(&input, &input, FailPoint::None).unwrap_err();
+    assert!(error.contains("aliases input"));
+    assert_eq!(fs::read(&input).unwrap(), original);
+
+    #[cfg(unix)]
+    {
+        let alias = dir.path().join("hard-link.json");
+        fs::hard_link(&input, &alias).unwrap();
+        let error = reconcile_file(&input, &alias, FailPoint::None).unwrap_err();
+        assert!(error.contains("aliases input"));
+        assert_eq!(fs::read(&input).unwrap(), original);
+    }
+}
+
+#[test]
+fn relative_output_path_publishes_and_reports_success() {
+    // Break caught: a relative output's parent is the empty path; syncing
+    // that path after rename can publish the report but return an error.
+    let dir = temp_dir();
+    let input = dir.path().join("snapshot.json");
+    snapshot_json(&input);
+    let original_directory = std::env::current_dir().unwrap();
+    std::env::set_current_dir(dir.path()).unwrap();
+    let outcome = reconcile_file(&input, std::path::Path::new("report.json"), FailPoint::None);
+    std::env::set_current_dir(original_directory).unwrap();
+
+    assert!(outcome.is_ok(), "{outcome:?}");
+    assert!(dir.path().join("report.json").exists());
+}
+
+#[test]
+fn abrupt_process_exits_never_replace_requested_output() {
+    // Break caught: an abrupt exit at any publication boundary can truncate
+    // the requested plan if it is opened before a complete temp file exists.
+    for phase in ["before-output", "after-temp", "before-publish"] {
+        for prior_exists in [false, true] {
+            let dir = temp_dir();
+            let input = dir.path().join("snapshot.json");
+            let output = dir.path().join("report.json");
+            snapshot_json(&input);
+            if prior_exists {
+                fs::write(&output, b"prior-complete-report").unwrap();
+            }
+            let status = std::process::Command::new(env!("CARGO_BIN_EXE_return-reconciler-trial1"))
+                .args([
+                    "reconcile-exit",
+                    phase,
+                    input.to_str().unwrap(),
+                    output.to_str().unwrap(),
+                ])
+                .status()
+                .unwrap();
+            assert_eq!(status.code(), Some(86));
+            if prior_exists {
+                assert_eq!(fs::read(&output).unwrap(), b"prior-complete-report");
+            } else {
+                assert!(!output.exists());
+            }
+        }
+    }
+}
+
+#[test]
+fn report_wide_cent_overflow_is_rejected_before_publication() {
+    // Break caught: release-mode u64 summation can wrap two valid MAX-cent
+    // return plans into a plausible but false report-wide summary.
+    let snapshot = overflow_snapshot();
+    let error = reconcile(&snapshot).unwrap_err();
+    assert!(error.contains("report proposed cents overflow"));
+
+    for prior_exists in [false, true] {
+        let dir = temp_dir();
+        let input = dir.path().join("snapshot.json");
+        let output = dir.path().join("report.json");
+        write_snapshot(&input, &snapshot);
+        if prior_exists {
+            fs::write(&output, b"prior-complete-report").unwrap();
+        }
+
+        let error = reconcile_file(&input, &output, FailPoint::None).unwrap_err();
+        assert!(error.contains("report proposed cents overflow"));
+        if prior_exists {
+            assert_eq!(fs::read(&output).unwrap(), b"prior-complete-report");
+        } else {
+            assert!(!output.exists());
+        }
+    }
+}
+
+fn payment_validation_snapshot(payment_return_id: &str, payment_line_id: &str) -> Snapshot {
+    let mut returns = Vec::new();
+    let mut events = Vec::new();
+    for index in 0..2_u64 {
+        let return_id = format!("return-{index}");
+        let line_id = format!("line-{index}");
+        let sku = format!("sku-{index}");
+        returns.push(ReturnAuthorization {
+            return_id: return_id.clone(),
+            captured_cents: 700,
+            lines: vec![AuthorizedLine {
+                line_id,
+                sku: sku.clone(),
+                authorized_qty: 1,
+                paid_subtotal_cents: 700,
+                tax_cents: 0,
+                discount_cents: 0,
+                prior_successful_refund_cents: 0,
+            }],
+        });
+        events.push(Event::WarehouseScan {
+            event_id: format!("scan-{index}"),
+            source_system_id: "warehouse-east".into(),
+            source_timestamp: 1,
+            ingestion_id: index,
+            return_id,
+            parcel_id: format!("parcel-{index}"),
+            sku,
+            quantity: 1,
+        });
+    }
+    events.push(Event::PaymentResult {
+        event_id: "payment-invalid-line".into(),
+        source_system_id: "payment-provider".into(),
+        source_timestamp: 2,
+        ingestion_id: 2,
+        return_id: payment_return_id.into(),
+        line_id: payment_line_id.into(),
+        refund_id: "refund-1".into(),
+        amount_cents: 700,
+        status: PaymentStatus::Pending,
+    });
+    Snapshot {
+        snapshot_id: "invalid-payment-fixture".into(),
+        returns,
+        events,
+    }
+}
+
+#[test]
+fn unknown_and_wrong_return_payment_lines_are_rejected_before_publication() {
+    // Break caught: a pending result for a missing/misowned line can be
+    // silently ignored, allowing a second refund proposal to survive.
+    for snapshot in [
+        payment_validation_snapshot("return-0", "line-missing"),
+        payment_validation_snapshot("return-0", "line-1"),
+    ] {
+        for prior_exists in [false, true] {
+            let dir = temp_dir();
+            let input = dir.path().join("snapshot.json");
+            let output = dir.path().join("report.json");
+            write_snapshot(&input, &snapshot);
+            if prior_exists {
+                fs::write(&output, b"prior-complete-report").unwrap();
+            }
+
+            let error = reconcile_file(&input, &output, FailPoint::None).unwrap_err();
+            assert!(error.contains("payment result references line"));
+            if prior_exists {
+                assert_eq!(fs::read(&output).unwrap(), b"prior-complete-report");
+            } else {
+                assert!(!output.exists());
+            }
+        }
+    }
+}
diff --git a/developer-simulation/runs/2026-08-13--multi-carrier-return-refund-reconciler/tests/workload.rs b/developer-simulation/runs/2026-08-13--multi-carrier-return-refund-reconciler/tests/workload.rs
new file mode 100644
index 0000000..282eb4f
--- /dev/null
+++ b/developer-simulation/runs/2026-08-13--multi-carrier-return-refund-reconciler/tests/workload.rs
@@ -0,0 +1,87 @@
+use return_reconciler_trial1::{
+    deterministic_shuffle, generate_representative, reconcile, reference_reconcile,
+};
+
+#[test]
+fn representative_generator_has_exact_disclosed_shape() {
+    // Break caught: a "large" benchmark can silently omit the required
+    // shape or adversarial population and therefore measure an easier job.
+    let snapshot = generate_representative(20_260_813);
+    assert_eq!(snapshot.returns.len(), 25_000);
+    assert_eq!(
+        snapshot
+            .returns
+            .iter()
+            .map(|r| r.lines.len())
+            .sum::<usize>(),
+        70_000
+    );
+    assert_eq!(snapshot.events.len(), 250_000);
+    let parcels = snapshot
+        .events
+        .iter()
+        .filter_map(|event| match event {
+            return_reconciler_trial1::Event::WarehouseScan {
+                return_id,
+                parcel_id,
+                ..
+            }
+            | return_reconciler_trial1::Event::Carrier {
+                return_id,
+                parcel_id,
+                ..
+            } => Some((return_id, parcel_id)),
+            _ => None,
+        })
+        .collect::<std::collections::BTreeSet<_>>()
+        .len();
+    assert_eq!(parcels, 40_000);
+    assert_eq!(
+        snapshot
+            .returns
+            .iter()
+            .filter(|authorization| authorization.return_id.starts_with("adv-return-"))
+            .count(),
+        500
+    );
+    assert!(
+        snapshot
+            .returns
+            .iter()
+            .flat_map(|authorization| &authorization.lines)
+            .filter(|line| {
+                line.authorized_qty == 2
+                    && (line.paid_subtotal_cents + line.tax_cents - line.discount_cents) % 2 == 1
+            })
+            .count()
+            >= 100,
+        "representative data must exercise remainder-cent allocation"
+    );
+}
+
+#[test]
+fn ten_deterministic_shuffles_are_byte_identical() {
+    // Break caught: hash iteration or arrival-order conflict/correction logic
+    // can make operator plans differ for identical immutable inputs.
+    let snapshot = generate_representative(20_260_813);
+    let expected = serde_json::to_vec(&reconcile(&snapshot).unwrap()).unwrap();
+    for seed in 0..10 {
+        let mut shuffled = snapshot.clone();
+        deterministic_shuffle(&mut shuffled, seed);
+        assert_eq!(
+            serde_json::to_vec(&reconcile(&shuffled).unwrap()).unwrap(),
+            expected
+        );
+    }
+}
+
+#[test]
+fn representative_candidate_and_reference_agree_exactly() {
+    // Break caught: candidate optimizations can diverge only at realistic
+    // cardinality or on one of the 500 seeded adversarial returns.
+    let snapshot = generate_representative(20_260_813);
+    assert_eq!(
+        reconcile(&snapshot).unwrap(),
+        reference_reconcile(&snapshot).unwrap()
+    );
+}
diff --git a/developer-simulation/runs/2026-08-13--municipal-water-meter-billing-repair/BRIEF.md b/developer-simulation/runs/2026-08-13--municipal-water-meter-billing-repair/BRIEF.md
new file mode 100644
index 0000000..a4928e4
--- /dev/null
+++ b/developer-simulation/runs/2026-08-13--municipal-water-meter-billing-repair/BRIEF.md
@@ -0,0 +1,127 @@
+# Municipal Water-Meter Billing Repair
+
+## Developer persona
+
+You are a municipal-utility data engineer with nine years of production SQL
+and Python experience and one year of Rust experience. You maintain billing
+imports and adjustment tooling, while a separate vendor system owns customer
+accounts and invoice issuance.
+
+## Existing system and baseline
+
+The authoritative billing database stores cumulative meter readings, meter
+installation history, billing cycles, issued bills, and approved adjustments.
+Field devices send daily batches through an older import service. A collection
+of SQL views and Python scripts reconstructs consumption when a meter rolls
+over, is replaced, reports an estimate, or later sends a correction. Staff
+compare spreadsheet extracts before importing approved adjustment rows.
+
+The baseline remains the production authority. It is cumbersome but its SQL
+views are understood by auditors and it never edits an issued bill directly.
+
+## Concrete pain
+
+Late corrections and meter replacements can change previously derived usage.
+The current scripts sometimes recompute too broad a date range, and their
+ordering assumptions are implicit. Staff need an exact, deterministic repair
+plan that names the readings and installation records behind every changed
+billing interval and clearly refuses ambiguous histories.
+
+## Workload and data shape
+
+Use immutable exports containing:
+
+- 100,000 service points and 120,000 physical meters;
+- 2,000,000 cumulative readings spanning 24 monthly billing cycles;
+- six- or eight-digit integer registers measured in whole litres;
+- actual, estimated, and corrected readings with stable source IDs;
+- explicit meter-install and meter-remove instants plus register width;
+- 200,000 previously billed intervals and any prior adjustment records.
+
+The disclosed fixtures must cover hand-checkable ordinary and adversarial
+histories. A deterministic generator should build the representative scale
+without using resident, customer, address, or real meter data.
+
+## Operational constraints
+
+- The vendor billing database remains authoritative and is not modified.
+- All volumes and monetary-free adjustments use exact integers; floating point
+  is prohibited in the repair calculation.
+- Input order and batch boundaries must not affect the result.
+- Every changed interval needs exact source-reading and meter-installation
+  provenance, plus a stable reason code.
+- Ambiguous histories fail closed for that service point and do not suppress
+  valid plans for unrelated service points.
+- A representative two-million-reading run should finish within 45 seconds
+  and 384 MiB on the available machine; state the measured host and limits.
+- Report publication must be deterministic and complete, with a prior report
+  preserved on validation or computation failure.
+
+## Measurable acceptance criteria
+
+1. The candidate agrees exactly with a separately written chronological
+   reference reducer on all disclosed cases and 100 deterministic generated
+   seeds.
+2. Ten input permutations and at least three different batch sizes produce
+   byte-identical canonical repair plans.
+3. Exact duplicate readings are idempotent. Conflicting reuse of a source ID
+   is rejected before changing any derived interval.
+4. Six- and eight-digit rollovers are distinguished from ordinary regression
+   by explicit meter metadata. Half-range or otherwise ambiguous regressions
+   become review cases rather than invented consumption.
+5. Meter replacement closes the old register and opens the new register only
+   at the declared installation boundary. Overlap, gaps without policy, and
+   readings attached to the wrong meter fail closed.
+6. A corrected actual supersedes exactly its named reading. An actual reading
+   that supersedes an estimate repairs only intervals causally depending on
+   that estimate.
+7. Already issued intervals are never rewritten. The output contains explicit
+   old usage, recomputed usage, signed integer adjustment, provenance, and
+   reason; unchanged intervals are omitted.
+8. A failed input or injected publication failure leaves the previous complete
+   report byte-for-byte unchanged.
+9. The representative run reports elapsed time and available peak-memory
+   evidence without treating the local host as production qualification.
+
+## Adversarial and fault cases
+
+- corrections arriving before or after the reading they supersede;
+- duplicate and conflicting source IDs;
+- a register value at the maximum, rollover to zero, ordinary regression, and
+  ambiguous half-range regression;
+- meter replacement at the exact boundary timestamp, overlapping installs,
+  missing removal, and a reading for an inactive meter;
+- estimates later replaced by actuals across one or multiple billing cycles;
+- out-of-order readings with equal timestamps and stable tie-breaking;
+- malformed register width or values outside the declared range;
+- process exit before temporary publication and immediately before final
+  publication;
+- output-path identity with an input where detectable.
+
+## Compact prototype boundary
+
+Build an offline command-line program that reads synthetic newline-delimited or
+JSON exports, validates each service-point history, emits one canonical repair
+plan, and verifies it against an independently derived reference. Include
+hand-checkable fixtures, generated seeded trials, a representative-scale
+demonstration, and exact reproduction commands. Keep database connections,
+billing rates, money calculation, invoice issuance, customer UI, device
+protocols, and production migrations outside the prototype.
+
+## Non-goals
+
+- replacing the billing database, import service, or adjustment approval flow;
+- estimating missing consumption with a new business policy;
+- changing bills or issuing credits;
+- forecasting demand, detecting leaks, or performing anomaly scoring;
+- accepting ambiguous meter histories automatically;
+- claiming regulatory or production qualification.
+
+## Dependency decision threshold
+
+Retain a new dependency only if it demonstrably reduces the repair logic or
+improves exact replay, provenance, bounded recomputation, or safe publication
+over the direct chronological reference while staying within the authority and
+resource limits. Reject it if the application still owns all temporal rules,
+if it creates a second durable authority, if it adds unrelated capabilities,
+or if its operational cost is not justified by measured improvement.
diff --git a/developer-simulation/runs/2026-08-13--municipal-water-meter-billing-repair/Cargo.toml b/developer-simulation/runs/2026-08-13--municipal-water-meter-billing-repair/Cargo.toml
new file mode 100644
index 0000000..d069339
--- /dev/null
+++ b/developer-simulation/runs/2026-08-13--municipal-water-meter-billing-repair/Cargo.toml
@@ -0,0 +1,17 @@
+[package]
+name = "water-repair"
+version = "0.1.0"
+edition = "2024"
+publish = false
+
+[dependencies]
+libc = "0.2"
+serde = { version = "1", features = ["derive"] }
+serde_json = "1"
+
+[dev-dependencies]
+tempfile = "3"
+
+[lints.clippy]
+all = "deny"
+pedantic = "deny"
diff --git a/developer-simulation/runs/2026-08-13--municipal-water-meter-billing-repair/DISCOVERY.md b/developer-simulation/runs/2026-08-13--municipal-water-meter-billing-repair/DISCOVERY.md
new file mode 100644
index 0000000..1b9108f
--- /dev/null
+++ b/developer-simulation/runs/2026-08-13--municipal-water-meter-billing-repair/DISCOVERY.md
@@ -0,0 +1,97 @@
+# Baseline-first discovery hypothesis
+
+## Starting position
+
+I am approaching BogKit as a municipal-utility data engineer with nine years of
+SQL/Python work and one year of Rust, and no prior BogKit knowledge. The
+existing SQL/Python process remains the authority: it has auditor-understood
+views, approved-adjustment import boundaries, and a safety property that issued
+bills are never edited. A prototype earns adoption only if it makes a bounded,
+deterministic repair plan easier to replay, attribute, or publish safely. It
+must not become a second billing authority.
+
+The direct chronological reference reducer is the default implementation. It
+will validate immutable exports, resolve supersession, order each
+service-point history, compute exact integer deltas, and emit canonical output.
+That reference must exist independently of any BogKit component so the
+candidate has a real oracle.
+
+## Expectations from the public surface
+
+From the root README and public examples only:
+
+- Fold is described as a durable incremental stream-to-view framework with
+  transactional writes, consistent read snapshots, keyed upsert/removal, and
+  explicit retraction. The timeseries example shows per-key aggregation; the
+  search example shows an update retracting old derived state. These properties
+  may help demonstrate exact replay or incremental replacement, but do not by
+  themselves solve temporal ordering, rollover, meter-install validity,
+  correction causality, provenance, or atomic report-file publication.
+- ESE is a static text-embedding component. This workload contains structured
+  integer and timestamp data and prohibits approximation in the calculation,
+  so ESE appears to be a no-fit unless component details reveal a non-embedding
+  capability directly relevant to deterministic replay.
+- ANNy is an approximate-nearest-neighbour index. Approximate similarity has no
+  role in an exact billing repair plan, so ANNy appears to be a no-fit.
+- Public examples use temporary databases and remove them for deterministic
+  demos. The trial must instead keep all runtime state under
+  `simulation-output/`, preserve prior reports on failure, and clean generated
+  state before handoff.
+
+## Baseline-first build hypothesis
+
+First build the smallest direct, chronological, integer-only reducer and a
+separately reasoned reference using disclosed literal fixtures. Record a
+meaningful failing test before implementation. Only after the oracle and safety
+contract are explicit should Fold be tested as an optional materialization or
+replay layer. Retain it only if evidence shows a concrete reduction in replay,
+provenance, bounded recomputation, or safe-publication work. A correct no-fit
+result is preferable to forcing the dependency.
+
+## Explicit component-fit questions
+
+### Fold
+
+1. Can records be deterministically keyed and upserted/retracted without input
+   order or batch boundaries leaking into canonical output?
+2. Can Fold expose the exact old record needed for supersession and provenance,
+   or must application code maintain that mapping anyway?
+3. Are a transaction's materialized views read as one consistent snapshot, and
+   what happens on an application panic or reopen?
+4. Can per-service-point invalidity be isolated without poisoning valid plans
+   for unrelated points?
+5. Does Fold materially bound recomputation for a corrected reading, or would
+   the application still sort and reduce the complete service-point history?
+6. Does persistence introduce a second durable authority, migration/cleanup
+   burden, or nondeterministic physical state that is unnecessary for an
+   offline report?
+7. Does its API accept the structured record keys and exact integer values
+   needed here without floating point or lossy conversions?
+
+### ESE
+
+1. Does it provide any exact structured-data function beyond text embeddings?
+2. If not, can it be rejected immediately because embeddings neither validate
+   histories nor improve exact replay/provenance/publication?
+
+### ANNy
+
+1. Does it provide any exact ordered lookup relevant to source IDs or time?
+2. If it is solely approximate vector retrieval, can it be rejected immediately
+   because approximation would be both unnecessary and unsafe here?
+
+## Done criteria for this trial
+
+- A runnable offline CLI under `simulation-output/` with disclosed fixtures,
+  an independent chronological reference, canonical plan output, and atomic
+  publication that preserves a prior report on all exercised failures.
+- Permanent tests for rollover, regression ambiguity, meter replacement,
+  supersession causality, duplicate/conflicting IDs, input/batch determinism,
+  provenance, failure isolation, and publication lifecycle; at least one RED
+  result preserved as evidence.
+- Candidate/reference equality on disclosed cases and 100 deterministic seeds;
+  byte equality across ten permutations and three batch sizes.
+- A two-million-reading local release run with elapsed-time and peak-memory
+  evidence, accurately scoped to this host.
+- Fresh formatting, tests, strict Clippy, release demo, cleanup, reproduction
+  instructions, and an evidence-limited trial report.
diff --git a/developer-simulation/runs/2026-08-13--municipal-water-meter-billing-repair/README.md b/developer-simulation/runs/2026-08-13--municipal-water-meter-billing-repair/README.md
new file mode 100644
index 0000000..19947ca
--- /dev/null
+++ b/developer-simulation/runs/2026-08-13--municipal-water-meter-billing-repair/README.md
@@ -0,0 +1,87 @@
+# Water-meter billing repair prototype
+
+This offline prototype reads a synthetic JSON export, validates each service
+point independently, verifies the result against a separately structured
+chronological oracle, and atomically publishes one canonical repair plan. It
+uses exact integers throughout and never writes the input or any billing data.
+
+Reading source IDs and prior-adjustment IDs are globally unique across one
+immutable snapshot. Repeating the exact same row is an idempotent delivery
+retry. Reusing an ID with any different field—including moving one adjustment
+ID to another billed interval—rejects the whole snapshot before derivation or
+publication with a stable `CONFLICTING_*_ID:<id>` error.
+
+BogKit decision: no component was retained. Fold was evaluated for keyed
+transactional replay and retraction, but the application would still own every
+temporal rule, canonical sort, provenance edge, failure-isolation rule, and
+report-file publication step. Its durable embedded state would be a second
+authority without measured benefit for this offline repair. ESE and ANNy are
+text/vector similarity components and do not fit exact structured billing.
+
+## Exact reproduction
+
+Run from the BogKit repository root. `--locked --offline` uses the dependency
+versions fixed in the nested lab workspace lockfile.
+
+```console
+cargo fmt --manifest-path developer-simulation/Cargo.toml -p water-repair -- --check
+cargo test --manifest-path developer-simulation/Cargo.toml --locked --offline --release -p water-repair --all-targets
+cargo test --manifest-path developer-simulation/Cargo.toml --locked --offline --release -p water-repair --test subprocess_publication
+cargo clippy --manifest-path developer-simulation/Cargo.toml --locked --offline --release -p water-repair --all-targets --all-features -- -D warnings -D clippy::all -D clippy::pedantic
+mkdir -p /tmp/bogkit-water-repair-demo
+cargo run --manifest-path developer-simulation/Cargo.toml --locked --offline --release -p water-repair -- verify --input developer-simulation/runs/2026-08-13--municipal-water-meter-billing-repair/fixtures/disclosed.json --output /tmp/bogkit-water-repair-demo/unused.json
+cargo run --manifest-path developer-simulation/Cargo.toml --locked --offline --release -p water-repair -- demo --input developer-simulation/runs/2026-08-13--municipal-water-meter-billing-repair/fixtures/disclosed.json --output /tmp/bogkit-water-repair-demo/plan.json --batch-size 7
+cmp /tmp/bogkit-water-repair-demo/plan.json developer-simulation/runs/2026-08-13--municipal-water-meter-billing-repair/fixtures/disclosed-expected.json
+cargo run --manifest-path developer-simulation/Cargo.toml --locked --offline --release -p water-repair -- scale --output /tmp/bogkit-water-repair-demo/scale-plan.json --batch-size 4096
+```
+
+`verify` checks the disclosed fixture against the independent oracle, then 100
+deterministic generated seeds, then ten input permutations at batch sizes 1, 7,
+and 64. `demo` verifies the input against the oracle before publishing. `scale`
+generates the requested counts in memory without resident or meter data and
+reports generation, validation/traversal, publication, and process peak RSS.
+Its generator is deliberately best-case: records are already ordered, each
+service point has only two billed intervals, there are no corrections or prior
+adjustments, and the result has zero repairs/reviews. Its timing is not evidence
+of representative repair performance.
+
+To process another synthetic export:
+
+```console
+cargo run --manifest-path developer-simulation/Cargo.toml --locked --offline --release -p water-repair -- process --input developer-simulation/runs/2026-08-13--municipal-water-meter-billing-repair/fixtures/disclosed.json --output /tmp/bogkit-water-repair-demo/plan.json --batch-size 1024
+```
+
+Safe-publication fault points are `--inject before-temporary` and `--inject
+before-final`. On validation, computation, or injected publication failure, the
+existing output remains byte-for-byte unchanged. An input/output path identity
+that can be resolved is rejected.
+
+The separate test-only `--crash before-staging` and `--crash before-final`
+modes terminate the process with `SIGABRT`. The second point occurs after a
+complete same-directory temporary file is synced and immediately before atomic
+rename. `tests/subprocess_publication.rs` launches real child processes and
+proves an existing requested report is unchanged—or an absent report stays
+absent—at both boundaries. A subsequent run removes the orphan stage and
+publishes a complete report. These modes deliberately kill the calling process
+and must not be used in ordinary operation. Publication assumes one writer per
+requested output path.
+
+The hand-written `fixtures/disclosed-expected.json` is the expected output for
+`fixtures/disclosed.json`. The fixture includes a six-digit rollover, a late
+correction, meter replacement, exact duplicate, ambiguous regression, prior
+adjustment, unchanged interval, and deliberately scrambled input order. Other
+adversarial cases live as literal permanent tests in `tests/acceptance.rs`.
+
+## Deliberate boundary
+
+This is a correctness and feasibility prototype, not regulatory or production
+qualification. It does not connect to the vendor database, change bills, infer
+missing consumption, calculate money, issue invoices, implement customer UI,
+or replace the existing audit/approval flow. The rollover classifier is an
+explicit prototype policy: a decrease is a rollover only when it crosses more
+than half the register and goes from the top quarter to the bottom quarter;
+other regressions fail closed.
+
+Generated Cargo output belongs in an external `CARGO_TARGET_DIR` during corpus
+verification, and the `/tmp/bogkit-water-repair-demo` runtime directory may be
+deleted after inspection. Neither is part of the archive.
diff --git a/developer-simulation/runs/2026-08-13--municipal-water-meter-billing-repair/RED_EVIDENCE.md b/developer-simulation/runs/2026-08-13--municipal-water-meter-billing-repair/RED_EVIDENCE.md
new file mode 100644
index 0000000..247cfdb
--- /dev/null
+++ b/developer-simulation/runs/2026-08-13--municipal-water-meter-billing-repair/RED_EVIDENCE.md
@@ -0,0 +1,85 @@
+# Recorded RED evidence
+
+The behavioral test was written before temporal implementation. An initial
+online Cargo attempt was discarded as environmental evidence because the
+restricted host could not resolve crates.io. The same test was rerun offline.
+
+Command (from `simulation-output/water-repair`):
+
+```console
+cargo test --offline --test temporal_red
+```
+
+Observed meaningful failure (exit 101):
+
+```text
+running 1 test
+test six_digit_maximum_to_zero_is_an_exact_rollover_repair ... FAILED
+
+thread 'six_digit_maximum_to_zero_is_an_exact_rollover_repair' panicked at tests/temporal_red.rs:47:5:
+assertion `left == right` failed
+  left: 0
+ right: 1
+
+test result: FAILED. 0 passed; 1 failed
+```
+
+The minimal scaffold returned an empty plan. This failure proves the test
+detects the missing register-width-aware rollover repair. The test remains in
+the permanent suite and must turn GREEN through implementation.
+
+## Fix round 1: abrupt publication lifecycle
+
+Four black-box subprocess tests were written before adding crash modes. They
+require Unix signal 6, rather than accepting an ordinary nonzero exit, and
+inspect both an existing requested report and an absent requested report at
+the two publication boundaries.
+
+Command:
+
+```console
+cargo test --offline --test subprocess_publication
+```
+
+Meaningful RED result (exit 101):
+
+```text
+running 4 tests
+... 4 FAILED
+assertion `left == right` failed
+  left: None
+ right: Some(6)
+test result: FAILED. 0 passed; 4 failed
+```
+
+The pre-fix CLI ignored `--crash`, completed publication normally, and exited
+without a signal. The regression therefore detects precisely the skeptical
+review finding: returned errors/tests were not evidence of abrupt termination
+at process boundaries.
+
+## Fix round 2: global adjustment identity
+
+Three focused tests were written before changing adjustment validation. They
+define adjustment IDs as globally unique across the immutable snapshot, allow
+only an exact repeated row as an idempotent delivery retry, and require any
+different reuse to reject before derivation/publication.
+
+Command:
+
+```console
+cargo test --offline --test adjustment_identity
+```
+
+Meaningful RED result (exit 101):
+
+```text
+running 3 tests
+... 3 FAILED
+candidate returned a DUPLICATE_ADJUSTMENT_ID review instead of a global error
+exact identical retry produced a review instead of the single-row plan
+test result: FAILED. 0 passed; 3 failed
+```
+
+This reproduces the review finding and proves the new tests distinguish global
+pre-derivation identity validation from the old per-service/per-interval
+behavior.
diff --git a/developer-simulation/runs/2026-08-13--municipal-water-meter-billing-repair/fixtures/conflicting-source.json b/developer-simulation/runs/2026-08-13--municipal-water-meter-billing-repair/fixtures/conflicting-source.json
new file mode 100644
index 0000000..154e7d3
--- /dev/null
+++ b/developer-simulation/runs/2026-08-13--municipal-water-meter-billing-repair/fixtures/conflicting-source.json
@@ -0,0 +1,11 @@
+{
+  "installations": [
+    {"service_point_id": 1, "installation_id": 1, "meter_id": 1, "installed_at": 0, "removed_at": null, "register_width": 6}
+  ],
+  "readings": [
+    {"service_point_id": 1, "meter_id": 1, "source_id": 10, "at": 0, "value_litres": 1, "kind": "actual", "supersedes": null},
+    {"service_point_id": 1, "meter_id": 1, "source_id": 10, "at": 0, "value_litres": 2, "kind": "actual", "supersedes": null}
+  ],
+  "billed_intervals": [],
+  "prior_adjustments": []
+}
diff --git a/developer-simulation/runs/2026-08-13--municipal-water-meter-billing-repair/fixtures/disclosed-expected.json b/developer-simulation/runs/2026-08-13--municipal-water-meter-billing-repair/fixtures/disclosed-expected.json
new file mode 100644
index 0000000..855df80
--- /dev/null
+++ b/developer-simulation/runs/2026-08-13--municipal-water-meter-billing-repair/fixtures/disclosed-expected.json
@@ -0,0 +1,109 @@
+{
+  "schema_version": 1,
+  "repairs": [
+    {
+      "service_point_id": 1,
+      "interval_id": 10001,
+      "old_usage_litres": 0,
+      "recomputed_usage_litres": 1,
+      "adjustment_litres": 1,
+      "source_reading_ids": [
+        101,
+        102
+      ],
+      "installation_ids": [
+        1001
+      ],
+      "installation_meter_ids": [
+        11
+      ],
+      "reason_code": "ROLLOVER_REPAIR"
+    },
+    {
+      "service_point_id": 2,
+      "interval_id": 20001,
+      "old_usage_litres": 100,
+      "recomputed_usage_litres": 110,
+      "adjustment_litres": 10,
+      "source_reading_ids": [
+        201,
+        203
+      ],
+      "installation_ids": [
+        2001
+      ],
+      "installation_meter_ids": [
+        21
+      ],
+      "reason_code": "CORRECTION_REPAIR"
+    },
+    {
+      "service_point_id": 2,
+      "interval_id": 20002,
+      "old_usage_litres": 100,
+      "recomputed_usage_litres": 90,
+      "adjustment_litres": -10,
+      "source_reading_ids": [
+        203,
+        204
+      ],
+      "installation_ids": [
+        2001
+      ],
+      "installation_meter_ids": [
+        21
+      ],
+      "reason_code": "CORRECTION_REPAIR"
+    },
+    {
+      "service_point_id": 3,
+      "interval_id": 30001,
+      "old_usage_litres": 100,
+      "recomputed_usage_litres": 120,
+      "adjustment_litres": 20,
+      "source_reading_ids": [
+        301,
+        302,
+        303,
+        304
+      ],
+      "installation_ids": [
+        3001,
+        3002
+      ],
+      "installation_meter_ids": [
+        31,
+        32
+      ],
+      "reason_code": "METER_REPLACEMENT_REPAIR"
+    },
+    {
+      "service_point_id": 6,
+      "interval_id": 60001,
+      "old_usage_litres": 70,
+      "recomputed_usage_litres": 80,
+      "adjustment_litres": 10,
+      "source_reading_ids": [
+        601,
+        602
+      ],
+      "installation_ids": [
+        6001
+      ],
+      "installation_meter_ids": [
+        61
+      ],
+      "reason_code": "RECOMPUTED_USAGE"
+    }
+  ],
+  "review_cases": [
+    {
+      "service_point_id": 4,
+      "reason_code": "AMBIGUOUS_REGISTER_REGRESSION",
+      "detail_ids": [
+        401,
+        402
+      ]
+    }
+  ]
+}
diff --git a/developer-simulation/runs/2026-08-13--municipal-water-meter-billing-repair/fixtures/disclosed.json b/developer-simulation/runs/2026-08-13--municipal-water-meter-billing-repair/fixtures/disclosed.json
new file mode 100644
index 0000000..f339b9c
--- /dev/null
+++ b/developer-simulation/runs/2026-08-13--municipal-water-meter-billing-repair/fixtures/disclosed.json
@@ -0,0 +1,42 @@
+{
+  "installations": [
+    {"service_point_id": 3, "installation_id": 3002, "meter_id": 32, "installed_at": 1, "removed_at": null, "register_width": 8},
+    {"service_point_id": 1, "installation_id": 1001, "meter_id": 11, "installed_at": 0, "removed_at": null, "register_width": 6},
+    {"service_point_id": 6, "installation_id": 6001, "meter_id": 61, "installed_at": 0, "removed_at": null, "register_width": 6},
+    {"service_point_id": 2, "installation_id": 2001, "meter_id": 21, "installed_at": 0, "removed_at": null, "register_width": 6},
+    {"service_point_id": 3, "installation_id": 3001, "meter_id": 31, "installed_at": 0, "removed_at": 1, "register_width": 6},
+    {"service_point_id": 5, "installation_id": 5001, "meter_id": 51, "installed_at": 0, "removed_at": null, "register_width": 6},
+    {"service_point_id": 4, "installation_id": 4001, "meter_id": 41, "installed_at": 0, "removed_at": null, "register_width": 6}
+  ],
+  "readings": [
+    {"service_point_id": 2, "meter_id": 21, "source_id": 204, "at": 2, "value_litres": 300, "kind": "actual", "supersedes": null},
+    {"service_point_id": 3, "meter_id": 32, "source_id": 304, "at": 2, "value_litres": 80, "kind": "actual", "supersedes": null},
+    {"service_point_id": 1, "meter_id": 11, "source_id": 102, "at": 1, "value_litres": 0, "kind": "actual", "supersedes": null},
+    {"service_point_id": 5, "meter_id": 51, "source_id": 501, "at": 0, "value_litres": 0, "kind": "actual", "supersedes": null},
+    {"service_point_id": 2, "meter_id": 21, "source_id": 202, "at": 1, "value_litres": 200, "kind": "estimated", "supersedes": null},
+    {"service_point_id": 4, "meter_id": 41, "source_id": 401, "at": 0, "value_litres": 600000, "kind": "actual", "supersedes": null},
+    {"service_point_id": 3, "meter_id": 31, "source_id": 302, "at": 1, "value_litres": 950, "kind": "actual", "supersedes": null},
+    {"service_point_id": 6, "meter_id": 61, "source_id": 601, "at": 0, "value_litres": 100, "kind": "actual", "supersedes": null},
+    {"service_point_id": 2, "meter_id": 21, "source_id": 203, "at": 1, "value_litres": 210, "kind": "corrected_actual", "supersedes": 202},
+    {"service_point_id": 5, "meter_id": 51, "source_id": 501, "at": 0, "value_litres": 0, "kind": "actual", "supersedes": null},
+    {"service_point_id": 3, "meter_id": 32, "source_id": 303, "at": 1, "value_litres": 10, "kind": "actual", "supersedes": null},
+    {"service_point_id": 1, "meter_id": 11, "source_id": 101, "at": 0, "value_litres": 999999, "kind": "actual", "supersedes": null},
+    {"service_point_id": 4, "meter_id": 41, "source_id": 402, "at": 1, "value_litres": 100000, "kind": "actual", "supersedes": null},
+    {"service_point_id": 5, "meter_id": 51, "source_id": 502, "at": 1, "value_litres": 10, "kind": "actual", "supersedes": null},
+    {"service_point_id": 2, "meter_id": 21, "source_id": 201, "at": 0, "value_litres": 100, "kind": "actual", "supersedes": null},
+    {"service_point_id": 3, "meter_id": 31, "source_id": 301, "at": 0, "value_litres": 900, "kind": "actual", "supersedes": null},
+    {"service_point_id": 6, "meter_id": 61, "source_id": 602, "at": 1, "value_litres": 180, "kind": "actual", "supersedes": null}
+  ],
+  "billed_intervals": [
+    {"service_point_id": 6, "interval_id": 60001, "start_at": 0, "end_at": 1, "issued_usage_litres": 50},
+    {"service_point_id": 2, "interval_id": 20002, "start_at": 1, "end_at": 2, "issued_usage_litres": 100},
+    {"service_point_id": 3, "interval_id": 30001, "start_at": 0, "end_at": 2, "issued_usage_litres": 100},
+    {"service_point_id": 1, "interval_id": 10001, "start_at": 0, "end_at": 1, "issued_usage_litres": 0},
+    {"service_point_id": 5, "interval_id": 50001, "start_at": 0, "end_at": 1, "issued_usage_litres": 10},
+    {"service_point_id": 4, "interval_id": 40001, "start_at": 0, "end_at": 1, "issued_usage_litres": 0},
+    {"service_point_id": 2, "interval_id": 20001, "start_at": 0, "end_at": 1, "issued_usage_litres": 100}
+  ],
+  "prior_adjustments": [
+    {"service_point_id": 6, "interval_id": 60001, "adjustment_id": 600001, "adjustment_litres": 20}
+  ]
+}
diff --git a/developer-simulation/runs/2026-08-13--municipal-water-meter-billing-repair/fixtures/malformed.json b/developer-simulation/runs/2026-08-13--municipal-water-meter-billing-repair/fixtures/malformed.json
new file mode 100644
index 0000000..e68afbb
--- /dev/null
+++ b/developer-simulation/runs/2026-08-13--municipal-water-meter-billing-repair/fixtures/malformed.json
@@ -0,0 +1 @@
+{"installations": [
diff --git a/developer-simulation/runs/2026-08-13--municipal-water-meter-billing-repair/src/lib.rs b/developer-simulation/runs/2026-08-13--municipal-water-meter-billing-repair/src/lib.rs
new file mode 100644
index 0000000..f70a38c
--- /dev/null
+++ b/developer-simulation/runs/2026-08-13--municipal-water-meter-billing-repair/src/lib.rs
@@ -0,0 +1,1136 @@
+use std::collections::{BTreeMap, BTreeSet};
+use std::fs::{self, File, OpenOptions};
+use std::io::Write;
+use std::path::{Path, PathBuf};
+
+use serde::{Deserialize, Serialize};
+
+mod reference;
+
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+pub struct Installation {
+    pub service_point_id: u32,
+    pub installation_id: u64,
+    pub meter_id: u32,
+    pub installed_at: i64,
+    pub removed_at: Option<i64>,
+    pub register_width: u8,
+}
+
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "snake_case")]
+pub enum ReadingKind {
+    Actual,
+    Estimated,
+    CorrectedActual,
+}
+
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+pub struct Reading {
+    pub service_point_id: u32,
+    pub meter_id: u32,
+    pub source_id: u64,
+    pub at: i64,
+    pub value_litres: u32,
+    pub kind: ReadingKind,
+    pub supersedes: Option<u64>,
+}
+
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+pub struct BilledInterval {
+    pub service_point_id: u32,
+    pub interval_id: u64,
+    pub start_at: i64,
+    pub end_at: i64,
+    pub issued_usage_litres: i64,
+}
+
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+pub struct PriorAdjustment {
+    pub service_point_id: u32,
+    pub interval_id: u64,
+    pub adjustment_id: u64,
+    pub adjustment_litres: i64,
+}
+
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+pub struct Export {
+    pub installations: Vec<Installation>,
+    pub readings: Vec<Reading>,
+    pub billed_intervals: Vec<BilledInterval>,
+    pub prior_adjustments: Vec<PriorAdjustment>,
+}
+
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+pub struct Repair {
+    pub service_point_id: u32,
+    pub interval_id: u64,
+    pub old_usage_litres: i64,
+    pub recomputed_usage_litres: i64,
+    pub adjustment_litres: i64,
+    pub source_reading_ids: Vec<u64>,
+    pub installation_ids: Vec<u64>,
+    pub installation_meter_ids: Vec<u32>,
+    pub reason_code: String,
+}
+
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+pub struct ReviewCase {
+    pub service_point_id: u32,
+    pub reason_code: String,
+    pub detail_ids: Vec<u64>,
+}
+
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+pub struct RepairPlan {
+    pub schema_version: u8,
+    pub repairs: Vec<Repair>,
+    pub review_cases: Vec<ReviewCase>,
+}
+
+impl Default for RepairPlan {
+    fn default() -> Self {
+        Self {
+            schema_version: 1,
+            repairs: Vec::new(),
+            review_cases: Vec::new(),
+        }
+    }
+}
+
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum PublicationFailure {
+    None,
+    BeforeTemporary,
+    BeforeFinalRename,
+}
+
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum PublicationCrash {
+    None,
+    BeforeStaging,
+    BeforeFinalRename,
+}
+
+#[derive(Debug)]
+struct ServiceError {
+    code: &'static str,
+    ids: Vec<u64>,
+}
+
+impl ServiceError {
+    fn new(code: &'static str, mut ids: Vec<u64>) -> Self {
+        ids.sort_unstable();
+        ids.dedup();
+        Self { code, ids }
+    }
+}
+
+struct ComputedUsage {
+    litres: i64,
+    source_ids: Vec<u64>,
+    installation_ids: Vec<u64>,
+    meter_ids: Vec<u32>,
+    saw_rollover: bool,
+    saw_correction: bool,
+}
+
+/// Evaluate an export with the candidate's sort-then-reduce implementation.
+///
+/// `batch_size` controls only how the immutable input is traversed. The
+/// canonical sort makes results independent of both batch boundaries and input
+/// order.
+///
+/// # Errors
+///
+/// Returns an error for an empty batch size, a globally conflicting source ID,
+/// or conflicting global adjustment-ID reuse. Exact repeated adjustment rows
+/// are treated as idempotent delivery retries. Service-local ambiguity is
+/// represented as a review case instead.
+pub fn evaluate_candidate(export: &Export, batch_size: usize) -> Result<RepairPlan, String> {
+    if batch_size == 0 {
+        return Err("batch size must be greater than zero".to_string());
+    }
+    let adjustments = normalize_adjustments(export)?;
+    let prepared = prepare_candidate(export, batch_size, adjustments)?;
+    Ok(reduce_candidate(prepared))
+}
+
+fn normalize_adjustments(export: &Export) -> Result<Vec<&PriorAdjustment>, String> {
+    let mut adjustments: Vec<_> = export.prior_adjustments.iter().collect();
+    adjustments.sort_unstable_by_key(|adjustment| adjustment.adjustment_id);
+    let mut unique: Vec<&PriorAdjustment> = Vec::with_capacity(adjustments.len());
+    for adjustment in adjustments {
+        if let Some(previous) = unique.last()
+            && previous.adjustment_id == adjustment.adjustment_id
+        {
+            if *previous != adjustment {
+                return Err(format!(
+                    "CONFLICTING_ADJUSTMENT_ID:{}",
+                    adjustment.adjustment_id
+                ));
+            }
+            continue;
+        }
+        unique.push(adjustment);
+    }
+    Ok(unique)
+}
+
+struct CandidateInputs<'a> {
+    readings: Vec<&'a Reading>,
+    installations: Vec<&'a Installation>,
+    bills: Vec<&'a BilledInterval>,
+    adjustments: Vec<&'a PriorAdjustment>,
+    service_ids: Vec<u32>,
+}
+
+fn prepare_candidate<'a>(
+    export: &'a Export,
+    batch_size: usize,
+    mut adjustments: Vec<&'a PriorAdjustment>,
+) -> Result<CandidateInputs<'a>, String> {
+    let mut readings = Vec::with_capacity(export.readings.len());
+    for batch in export.readings.chunks(batch_size) {
+        readings.extend(batch);
+    }
+    readings.sort_unstable_by_key(|reading| reading.source_id);
+    let mut unique_readings: Vec<&Reading> = Vec::with_capacity(readings.len());
+    for reading in readings {
+        if let Some(previous) = unique_readings.last()
+            && previous.source_id == reading.source_id
+        {
+            if *previous != reading {
+                return Err(format!("CONFLICTING_SOURCE_ID:{}", reading.source_id));
+            }
+            continue;
+        }
+        unique_readings.push(reading);
+    }
+    unique_readings.sort_unstable_by_key(|reading| {
+        (
+            reading.service_point_id,
+            reading.meter_id,
+            reading.at,
+            reading.source_id,
+        )
+    });
+
+    let mut installations: Vec<_> = export.installations.iter().collect();
+    installations.sort_unstable_by_key(|installation| {
+        (
+            installation.service_point_id,
+            installation.installed_at,
+            installation.meter_id,
+            installation.installation_id,
+        )
+    });
+    let mut bills: Vec<_> = export.billed_intervals.iter().collect();
+    bills.sort_unstable_by_key(|bill| {
+        (
+            bill.service_point_id,
+            bill.start_at,
+            bill.end_at,
+            bill.interval_id,
+        )
+    });
+    adjustments.sort_unstable_by_key(|adjustment| {
+        (
+            adjustment.service_point_id,
+            adjustment.interval_id,
+            adjustment.adjustment_id,
+        )
+    });
+
+    let mut service_ids = Vec::with_capacity(
+        unique_readings.len() + installations.len() + bills.len() + adjustments.len(),
+    );
+    service_ids.extend(
+        unique_readings
+            .iter()
+            .map(|reading| reading.service_point_id),
+    );
+    service_ids.extend(
+        installations
+            .iter()
+            .map(|installation| installation.service_point_id),
+    );
+    service_ids.extend(bills.iter().map(|bill| bill.service_point_id));
+    service_ids.extend(
+        adjustments
+            .iter()
+            .map(|adjustment| adjustment.service_point_id),
+    );
+    service_ids.sort_unstable();
+    service_ids.dedup();
+
+    Ok(CandidateInputs {
+        readings: unique_readings,
+        installations,
+        bills,
+        adjustments,
+        service_ids,
+    })
+}
+
+fn reduce_candidate(prepared: CandidateInputs<'_>) -> RepairPlan {
+    let mut plan = RepairPlan::default();
+    let mut reading_offset = 0;
+    let mut installation_offset = 0;
+    let mut bill_offset = 0;
+    let mut adjustment_offset = 0;
+
+    for service_point_id in prepared.service_ids {
+        let reading_end =
+            advance_service(&prepared.readings, reading_offset, service_point_id, |r| {
+                r.service_point_id
+            });
+        let installation_end = advance_service(
+            &prepared.installations,
+            installation_offset,
+            service_point_id,
+            |i| i.service_point_id,
+        );
+        let bill_end = advance_service(&prepared.bills, bill_offset, service_point_id, |b| {
+            b.service_point_id
+        });
+        let adjustment_end = advance_service(
+            &prepared.adjustments,
+            adjustment_offset,
+            service_point_id,
+            |a| a.service_point_id,
+        );
+
+        match evaluate_service(
+            service_point_id,
+            &prepared.installations[installation_offset..installation_end],
+            &prepared.readings[reading_offset..reading_end],
+            &prepared.bills[bill_offset..bill_end],
+            &prepared.adjustments[adjustment_offset..adjustment_end],
+        ) {
+            Ok(mut repairs) => plan.repairs.append(&mut repairs),
+            Err(error) => plan.review_cases.push(ReviewCase {
+                service_point_id,
+                reason_code: error.code.to_string(),
+                detail_ids: error.ids,
+            }),
+        }
+
+        reading_offset = reading_end;
+        installation_offset = installation_end;
+        bill_offset = bill_end;
+        adjustment_offset = adjustment_end;
+    }
+
+    canonicalize(&mut plan);
+    plan
+}
+
+fn advance_service<T, F>(items: &[T], start: usize, service_id: u32, service: F) -> usize
+where
+    F: Fn(&T) -> u32,
+{
+    let mut end = start;
+    while end < items.len() && service(&items[end]) == service_id {
+        end += 1;
+    }
+    end
+}
+
+fn evaluate_service(
+    service_id: u32,
+    installations: &[&Installation],
+    readings: &[&Reading],
+    bills: &[&BilledInterval],
+    adjustments: &[&PriorAdjustment],
+) -> Result<Vec<Repair>, ServiceError> {
+    if installations.is_empty() {
+        return Err(ServiceError::new("MISSING_INSTALLATION", Vec::new()));
+    }
+    validate_installations(installations)?;
+    validate_bills(bills)?;
+
+    let active = resolve_active_readings(service_id, installations, readings)?;
+    let adjustment_totals = adjustment_totals(adjustments)?;
+    let mut repairs = Vec::new();
+
+    for bill in bills {
+        let usage = compute_usage(bill, installations, &active)?;
+        let prior = adjustment_totals
+            .get(&bill.interval_id)
+            .copied()
+            .unwrap_or(0);
+        let old_usage = bill
+            .issued_usage_litres
+            .checked_add(prior)
+            .ok_or_else(|| ServiceError::new("INTEGER_OVERFLOW", vec![bill.interval_id]))?;
+        if old_usage == usage.litres {
+            continue;
+        }
+        let adjustment = usage
+            .litres
+            .checked_sub(old_usage)
+            .ok_or_else(|| ServiceError::new("INTEGER_OVERFLOW", vec![bill.interval_id]))?;
+        let reason = if usage.saw_correction {
+            "CORRECTION_REPAIR"
+        } else if usage.installation_ids.len() > 1 {
+            "METER_REPLACEMENT_REPAIR"
+        } else if usage.saw_rollover {
+            "ROLLOVER_REPAIR"
+        } else {
+            "RECOMPUTED_USAGE"
+        };
+        repairs.push(Repair {
+            service_point_id: service_id,
+            interval_id: bill.interval_id,
+            old_usage_litres: old_usage,
+            recomputed_usage_litres: usage.litres,
+            adjustment_litres: adjustment,
+            source_reading_ids: usage.source_ids,
+            installation_ids: usage.installation_ids,
+            installation_meter_ids: usage.meter_ids,
+            reason_code: reason.to_string(),
+        });
+    }
+    Ok(repairs)
+}
+
+fn validate_installations(installations: &[&Installation]) -> Result<(), ServiceError> {
+    let mut installation_ids = BTreeSet::new();
+    let mut meter_ids = BTreeSet::new();
+    for installation in installations {
+        if !installation_ids.insert(installation.installation_id) {
+            return Err(ServiceError::new(
+                "DUPLICATE_INSTALLATION_ID",
+                vec![installation.installation_id],
+            ));
+        }
+        if !meter_ids.insert(installation.meter_id) {
+            return Err(ServiceError::new(
+                "METER_REINSTALLED_UNSUPPORTED",
+                vec![u64::from(installation.meter_id)],
+            ));
+        }
+        if !matches!(installation.register_width, 6 | 8) {
+            return Err(ServiceError::new(
+                "MALFORMED_REGISTER_WIDTH",
+                vec![installation.installation_id],
+            ));
+        }
+        if installation
+            .removed_at
+            .is_some_and(|removed| removed <= installation.installed_at)
+        {
+            return Err(ServiceError::new(
+                "INVALID_INSTALLATION_RANGE",
+                vec![installation.installation_id],
+            ));
+        }
+    }
+    for pair in installations.windows(2) {
+        let left = pair[0];
+        let right = pair[1];
+        match left.removed_at {
+            None => {
+                return Err(ServiceError::new(
+                    "OVERLAPPING_INSTALLATIONS",
+                    vec![left.installation_id, right.installation_id],
+                ));
+            }
+            Some(removed) if removed < right.installed_at => {
+                return Err(ServiceError::new(
+                    "INSTALLATION_GAP_NO_POLICY",
+                    vec![left.installation_id, right.installation_id],
+                ));
+            }
+            Some(removed) if removed > right.installed_at => {
+                return Err(ServiceError::new(
+                    "OVERLAPPING_INSTALLATIONS",
+                    vec![left.installation_id, right.installation_id],
+                ));
+            }
+            Some(_) => {}
+        }
+    }
+    Ok(())
+}
+
+fn validate_bills(bills: &[&BilledInterval]) -> Result<(), ServiceError> {
+    let mut ids = BTreeSet::new();
+    for bill in bills {
+        if !ids.insert(bill.interval_id) {
+            return Err(ServiceError::new(
+                "DUPLICATE_INTERVAL_ID",
+                vec![bill.interval_id],
+            ));
+        }
+        if bill.end_at <= bill.start_at || bill.issued_usage_litres < 0 {
+            return Err(ServiceError::new(
+                "INVALID_BILLED_INTERVAL",
+                vec![bill.interval_id],
+            ));
+        }
+    }
+    Ok(())
+}
+
+fn resolve_active_readings<'a>(
+    service_id: u32,
+    installations: &[&Installation],
+    readings: &[&'a Reading],
+) -> Result<Vec<&'a Reading>, ServiceError> {
+    let by_source: BTreeMap<_, _> = readings
+        .iter()
+        .map(|reading| (reading.source_id, *reading))
+        .collect();
+    let mut superseded = BTreeSet::new();
+    for reading in readings {
+        let matching: Vec<_> = installations
+            .iter()
+            .filter(|installation| {
+                installation.meter_id == reading.meter_id
+                    && reading.at >= installation.installed_at
+                    && installation
+                        .removed_at
+                        .is_none_or(|removed| reading.at <= removed)
+            })
+            .collect();
+        if matching.len() != 1 {
+            return Err(ServiceError::new(
+                "READING_FOR_INACTIVE_METER",
+                vec![reading.source_id],
+            ));
+        }
+        let modulus = register_modulus(matching[0].register_width);
+        if u64::from(reading.value_litres) >= modulus {
+            return Err(ServiceError::new(
+                "REGISTER_VALUE_OUT_OF_RANGE",
+                vec![reading.source_id],
+            ));
+        }
+        if reading.kind == ReadingKind::Estimated && reading.supersedes.is_some() {
+            return Err(ServiceError::new(
+                "INVALID_SUPERSESSION_KIND",
+                vec![reading.source_id],
+            ));
+        }
+        if reading.kind == ReadingKind::CorrectedActual && reading.supersedes.is_none() {
+            return Err(ServiceError::new(
+                "CORRECTION_MISSING_TARGET",
+                vec![reading.source_id],
+            ));
+        }
+        if let Some(target_id) = reading.supersedes {
+            let target = by_source.get(&target_id).ok_or_else(|| {
+                ServiceError::new(
+                    "SUPERSESSION_TARGET_MISSING",
+                    vec![reading.source_id, target_id],
+                )
+            })?;
+            if target.service_point_id != service_id
+                || target.meter_id != reading.meter_id
+                || target.at != reading.at
+                || target.source_id == reading.source_id
+            {
+                return Err(ServiceError::new(
+                    "INVALID_SUPERSESSION_TARGET",
+                    vec![reading.source_id, target_id],
+                ));
+            }
+            if !superseded.insert(target_id) {
+                return Err(ServiceError::new("MULTIPLE_SUPERSEDERS", vec![target_id]));
+            }
+        }
+    }
+
+    let mut active: Vec<_> = readings
+        .iter()
+        .copied()
+        .filter(|reading| !superseded.contains(&reading.source_id))
+        .collect();
+    active.sort_unstable_by_key(|reading| (reading.meter_id, reading.at, reading.source_id));
+    for pair in active.windows(2) {
+        if pair[0].meter_id == pair[1].meter_id && pair[0].at == pair[1].at {
+            return Err(ServiceError::new(
+                "AMBIGUOUS_EQUAL_TIMESTAMP",
+                vec![pair[0].source_id, pair[1].source_id],
+            ));
+        }
+    }
+    Ok(active)
+}
+
+fn adjustment_totals(adjustments: &[&PriorAdjustment]) -> Result<BTreeMap<u64, i64>, ServiceError> {
+    let mut totals = BTreeMap::<u64, i64>::new();
+    for adjustment in adjustments {
+        let total = totals.entry(adjustment.interval_id).or_default();
+        *total = total
+            .checked_add(adjustment.adjustment_litres)
+            .ok_or_else(|| ServiceError::new("INTEGER_OVERFLOW", vec![adjustment.adjustment_id]))?;
+    }
+    Ok(totals)
+}
+
+fn compute_usage(
+    bill: &BilledInterval,
+    installations: &[&Installation],
+    active: &[&Reading],
+) -> Result<ComputedUsage, ServiceError> {
+    let mut total = 0_i64;
+    let mut sources = Vec::new();
+    let mut used_installations = Vec::new();
+    let mut meters = Vec::new();
+    let mut saw_rollover = false;
+    let mut saw_correction = false;
+    let mut cursor = bill.start_at;
+
+    for installation in installations {
+        let start = bill.start_at.max(installation.installed_at);
+        let end = bill.end_at.min(installation.removed_at.unwrap_or(i64::MAX));
+        if start >= end {
+            continue;
+        }
+        if start != cursor {
+            return Err(ServiceError::new(
+                "BILLING_INTERVAL_NOT_COVERED",
+                vec![bill.interval_id],
+            ));
+        }
+        cursor = end;
+        let segment: Vec<_> = active
+            .iter()
+            .copied()
+            .filter(|reading| {
+                reading.meter_id == installation.meter_id
+                    && reading.at >= start
+                    && reading.at <= end
+            })
+            .collect();
+        if segment.first().is_none_or(|reading| reading.at != start)
+            || segment.last().is_none_or(|reading| reading.at != end)
+        {
+            return Err(ServiceError::new(
+                "MISSING_BOUNDARY_READING",
+                vec![bill.interval_id, installation.installation_id],
+            ));
+        }
+        for pair in segment.windows(2) {
+            let (delta, rollover) = meter_delta(pair[0], pair[1], installation)?;
+            total = total
+                .checked_add(delta)
+                .ok_or_else(|| ServiceError::new("INTEGER_OVERFLOW", vec![bill.interval_id]))?;
+            saw_rollover |= rollover;
+        }
+        sources.extend(segment.iter().map(|reading| reading.source_id));
+        saw_correction |= segment.iter().any(|reading| reading.supersedes.is_some());
+        used_installations.push(installation.installation_id);
+        meters.push(installation.meter_id);
+    }
+    if cursor != bill.end_at {
+        return Err(ServiceError::new(
+            "BILLING_INTERVAL_NOT_COVERED",
+            vec![bill.interval_id],
+        ));
+    }
+    sources.sort_unstable();
+    sources.dedup();
+    used_installations.sort_unstable();
+    used_installations.dedup();
+    meters.sort_unstable();
+    meters.dedup();
+    Ok(ComputedUsage {
+        litres: total,
+        source_ids: sources,
+        installation_ids: used_installations,
+        meter_ids: meters,
+        saw_rollover,
+        saw_correction,
+    })
+}
+
+fn meter_delta(
+    previous: &Reading,
+    current: &Reading,
+    installation: &Installation,
+) -> Result<(i64, bool), ServiceError> {
+    if current.value_litres >= previous.value_litres {
+        return Ok((
+            i64::from(current.value_litres - previous.value_litres),
+            false,
+        ));
+    }
+    let modulus = register_modulus(installation.register_width);
+    let previous_value = u64::from(previous.value_litres);
+    let current_value = u64::from(current.value_litres);
+    let regression = previous_value - current_value;
+    if regression > modulus / 2
+        && previous_value >= modulus.saturating_mul(3) / 4
+        && current_value <= modulus / 4
+    {
+        let delta = modulus - previous_value + current_value;
+        return Ok((
+            i64::try_from(delta).map_err(|_| {
+                ServiceError::new(
+                    "INTEGER_OVERFLOW",
+                    vec![previous.source_id, current.source_id],
+                )
+            })?,
+            true,
+        ));
+    }
+    Err(ServiceError::new(
+        "AMBIGUOUS_REGISTER_REGRESSION",
+        vec![previous.source_id, current.source_id],
+    ))
+}
+
+const fn register_modulus(width: u8) -> u64 {
+    match width {
+        6 => 1_000_000,
+        8 => 100_000_000,
+        _ => 0,
+    }
+}
+
+fn canonicalize(plan: &mut RepairPlan) {
+    plan.repairs.sort_unstable_by_key(|repair| {
+        (
+            repair.service_point_id,
+            repair.interval_id,
+            repair.reason_code.clone(),
+        )
+    });
+    plan.review_cases.sort_unstable_by_key(|review| {
+        (
+            review.service_point_id,
+            review.reason_code.clone(),
+            review.detail_ids.clone(),
+        )
+    });
+}
+
+/// Serialize a plan in the canonical byte representation used for publication.
+///
+/// # Errors
+///
+/// Returns a serialization error if the plan cannot be encoded.
+pub fn canonical_plan_bytes(plan: &RepairPlan) -> Result<Vec<u8>, String> {
+    let mut bytes = serde_json::to_vec_pretty(plan).map_err(|error| error.to_string())?;
+    bytes.push(b'\n');
+    Ok(bytes)
+}
+
+/// Publish a complete canonical plan using a same-directory temporary file and
+/// atomic rename.
+///
+/// # Errors
+///
+/// Returns an error for input/output identity, injected failure, filesystem
+/// failure, or serialization failure. The prior output is preserved on every
+/// error before the final rename.
+pub fn publish_plan(
+    input_path: Option<&Path>,
+    output_path: &Path,
+    plan: &RepairPlan,
+    failure: PublicationFailure,
+) -> Result<(), String> {
+    publish_plan_internal(
+        input_path,
+        output_path,
+        plan,
+        failure,
+        PublicationCrash::None,
+    )
+}
+
+/// Publish a plan while optionally terminating the process at a precise crash
+/// boundary. This exists to exercise abrupt lifecycle behavior from a child
+/// process; ordinary callers should use [`publish_plan`].
+///
+/// `BeforeStaging` aborts after path validation and stale-stage cleanup but
+/// before creating a temporary file. `BeforeFinalRename` aborts after the
+/// complete temporary file has been written and synced, immediately before the
+/// atomic rename.
+///
+/// # Errors
+///
+/// Returns a path, serialization, or filesystem error before reaching the
+/// requested crash point.
+pub fn publish_plan_with_crash(
+    input_path: Option<&Path>,
+    output_path: &Path,
+    plan: &RepairPlan,
+    crash: PublicationCrash,
+) -> Result<(), String> {
+    publish_plan_internal(
+        input_path,
+        output_path,
+        plan,
+        PublicationFailure::None,
+        crash,
+    )
+}
+
+fn publish_plan_internal(
+    input_path: Option<&Path>,
+    output_path: &Path,
+    plan: &RepairPlan,
+    failure: PublicationFailure,
+    crash: PublicationCrash,
+) -> Result<(), String> {
+    if let Some(input) = input_path {
+        reject_path_identity(input, output_path)?;
+    }
+    if failure == PublicationFailure::BeforeTemporary {
+        return Err("injected failure before temporary publication".to_string());
+    }
+    let parent = output_path
+        .parent()
+        .filter(|path| !path.as_os_str().is_empty())
+        .unwrap_or_else(|| Path::new("."));
+    fs::create_dir_all(parent).map_err(|error| error.to_string())?;
+    cleanup_stale_temporaries(output_path)?;
+    if crash == PublicationCrash::BeforeStaging {
+        std::process::abort();
+    }
+    let bytes = canonical_plan_bytes(plan)?;
+    let (temporary_path, mut temporary) = create_temporary(output_path)?;
+    let staged = (|| -> Result<(), String> {
+        temporary
+            .write_all(&bytes)
+            .and_then(|()| temporary.sync_all())
+            .map_err(|error| error.to_string())?;
+        if failure == PublicationFailure::BeforeFinalRename {
+            return Err("injected failure before final publication".to_string());
+        }
+        if crash == PublicationCrash::BeforeFinalRename {
+            std::process::abort();
+        }
+        fs::rename(&temporary_path, output_path).map_err(|error| error.to_string())?;
+        File::open(parent)
+            .and_then(|directory| directory.sync_all())
+            .map_err(|error| error.to_string())?;
+        Ok(())
+    })();
+    if staged.is_err() {
+        drop(temporary);
+        let _ignored = fs::remove_file(&temporary_path);
+    }
+    staged
+}
+
+fn cleanup_stale_temporaries(output: &Path) -> Result<(), String> {
+    let parent = output
+        .parent()
+        .filter(|path| !path.as_os_str().is_empty())
+        .unwrap_or_else(|| Path::new("."));
+    let file_name = output
+        .file_name()
+        .ok_or_else(|| "output path has no file name".to_string())?
+        .to_string_lossy();
+    let prefix = format!(".{file_name}.");
+    for entry in fs::read_dir(parent).map_err(|error| error.to_string())? {
+        let entry = entry.map_err(|error| error.to_string())?;
+        let name = entry.file_name();
+        let name = name.to_string_lossy();
+        if name.starts_with(&prefix) && name.ends_with(".tmp") {
+            fs::remove_file(entry.path()).map_err(|error| error.to_string())?;
+        }
+    }
+    Ok(())
+}
+
+fn create_temporary(output: &Path) -> Result<(PathBuf, File), String> {
+    let file_name = output
+        .file_name()
+        .ok_or_else(|| "output path has no file name".to_string())?
+        .to_string_lossy();
+    for attempt in 0_u8..100 {
+        let candidate = output.with_file_name(format!(
+            ".{file_name}.{}.{}.tmp",
+            std::process::id(),
+            attempt
+        ));
+        match OpenOptions::new()
+            .write(true)
+            .create_new(true)
+            .open(&candidate)
+        {
+            Ok(file) => return Ok((candidate, file)),
+            Err(error) if error.kind() == std::io::ErrorKind::AlreadyExists => {}
+            Err(error) => return Err(error.to_string()),
+        }
+    }
+    Err("could not allocate a unique temporary output".to_string())
+}
+
+fn reject_path_identity(input: &Path, output: &Path) -> Result<(), String> {
+    let canonical_input = fs::canonicalize(input).map_err(|error| error.to_string())?;
+    let canonical_output = if output.exists() {
+        fs::canonicalize(output).map_err(|error| error.to_string())?
+    } else {
+        let parent = output.parent().unwrap_or_else(|| Path::new("."));
+        match fs::canonicalize(parent) {
+            Ok(canonical_parent) => canonical_parent.join(
+                output
+                    .file_name()
+                    .ok_or_else(|| "output path has no file name".to_string())?,
+            ),
+            Err(_) => std::env::current_dir()
+                .map_err(|error| error.to_string())?
+                .join(output),
+        }
+    };
+    if canonical_input == canonical_output {
+        return Err("INPUT_OUTPUT_PATH_IDENTITY".to_string());
+    }
+    Ok(())
+}
+
+/// A deliberately straightforward chronological oracle. It reconstructs a
+/// sorted export one service point at a time and delegates no ordering or
+/// publication work to the candidate's global traversal.
+///
+/// # Errors
+///
+/// Returns a global source-ID or adjustment-ID conflict, matching the
+/// candidate's fail-before-derivation contract. Exact repeated adjustment rows
+/// are idempotent. Service-local ambiguity becomes a review case.
+pub fn evaluate_reference(export: &Export) -> Result<RepairPlan, String> {
+    let adjustments = normalize_adjustments(export)?;
+    reference::evaluate(export, &adjustments)
+}
+
+/// Build a small deterministic synthetic case for oracle comparison.
+#[must_use]
+pub fn generated_case(seed: u64, service_points: u32) -> Export {
+    let mut export = Export {
+        installations: Vec::with_capacity(service_points as usize),
+        readings: Vec::with_capacity(service_points as usize * 4),
+        billed_intervals: Vec::with_capacity(service_points as usize * 2),
+        prior_adjustments: Vec::new(),
+    };
+    for service in 0..service_points {
+        let base_id = seed
+            .wrapping_mul(1_000_003)
+            .wrapping_add(u64::from(service) * 10);
+        let width = if (seed + u64::from(service)).is_multiple_of(2) {
+            6
+        } else {
+            8
+        };
+        let meter_id = service + 10_000;
+        export.installations.push(Installation {
+            service_point_id: service,
+            installation_id: base_id,
+            meter_id,
+            installed_at: 0,
+            removed_at: None,
+            register_width: width,
+        });
+        let mode = (seed + u64::from(service)) % 4;
+        let modulus = register_modulus(width);
+        let (first, second, third) = if mode == 1 {
+            (u32::try_from(modulus - 5).unwrap_or(0), 3, 11)
+        } else if mode == 3 {
+            (500, 400, 600)
+        } else {
+            let start = u32::try_from(100 + seed % 100).unwrap_or(100);
+            (start, start + 10, start + 25)
+        };
+        export.readings.extend([
+            Reading {
+                service_point_id: service,
+                meter_id,
+                source_id: base_id + 1,
+                at: 0,
+                value_litres: first,
+                kind: ReadingKind::Actual,
+                supersedes: None,
+            },
+            Reading {
+                service_point_id: service,
+                meter_id,
+                source_id: base_id + 2,
+                at: 1,
+                value_litres: second,
+                kind: if mode == 2 {
+                    ReadingKind::Estimated
+                } else {
+                    ReadingKind::Actual
+                },
+                supersedes: None,
+            },
+            Reading {
+                service_point_id: service,
+                meter_id,
+                source_id: base_id + 3,
+                at: 2,
+                value_litres: third,
+                kind: ReadingKind::Actual,
+                supersedes: None,
+            },
+        ]);
+        if mode == 2 {
+            export.readings.push(Reading {
+                service_point_id: service,
+                meter_id,
+                source_id: base_id + 4,
+                at: 1,
+                value_litres: second + 2,
+                kind: ReadingKind::CorrectedActual,
+                supersedes: Some(base_id + 2),
+            });
+        }
+        export.billed_intervals.extend([
+            BilledInterval {
+                service_point_id: service,
+                interval_id: base_id + 5,
+                start_at: 0,
+                end_at: 1,
+                issued_usage_litres: if mode == 1 { 7 } else { 10 },
+            },
+            BilledInterval {
+                service_point_id: service,
+                interval_id: base_id + 6,
+                start_at: 1,
+                end_at: 2,
+                issued_usage_litres: 15,
+            },
+        ]);
+    }
+    export
+}
+
+/// Generate the best-case requested counts used by the release demonstration.
+/// Records are pre-sorted; every service point has 20 readings and only two
+/// issued intervals; there are no corrections or prior adjustments; the first
+/// 20,000 points have a replacement, yielding 120,000 physical meters.
+#[must_use]
+pub fn generate_representative() -> Export {
+    const SERVICES: u32 = 100_000;
+    const REPLACEMENTS: u32 = 20_000;
+    let mut export = Export {
+        installations: Vec::with_capacity((SERVICES + REPLACEMENTS) as usize),
+        readings: Vec::with_capacity(SERVICES as usize * 20),
+        billed_intervals: Vec::with_capacity(SERVICES as usize * 2),
+        prior_adjustments: Vec::new(),
+    };
+    let mut source_id = 1_u64;
+    for service in 0..SERVICES {
+        if service < REPLACEMENTS {
+            push_replacement_service(&mut export, service, SERVICES, &mut source_id);
+        } else {
+            push_single_meter_service(&mut export, service, &mut source_id);
+        }
+    }
+    export
+}
+
+fn push_replacement_service(export: &mut Export, service: u32, services: u32, source_id: &mut u64) {
+    let first_meter = service + 1;
+    let second_meter = services + service + 1;
+    let install_base = u64::from(service) * 2 + 1;
+    export.installations.extend([
+        Installation {
+            service_point_id: service,
+            installation_id: install_base,
+            meter_id: first_meter,
+            installed_at: 0,
+            removed_at: Some(12),
+            register_width: 8,
+        },
+        Installation {
+            service_point_id: service,
+            installation_id: install_base + 1,
+            meter_id: second_meter,
+            installed_at: 12,
+            removed_at: None,
+            register_width: 8,
+        },
+    ]);
+    push_reading_range(export, service, first_meter, 0..9, 0, source_id);
+    push_reading(export, service, first_meter, 12, 1_200, source_id);
+    push_reading_range(export, service, second_meter, 12..21, 12, source_id);
+    push_reading(export, service, second_meter, 24, 1_200, source_id);
+    export.billed_intervals.extend([
+        BilledInterval {
+            service_point_id: service,
+            interval_id: u64::from(service) * 2 + 1,
+            start_at: 8,
+            end_at: 12,
+            issued_usage_litres: 400,
+        },
+        BilledInterval {
+            service_point_id: service,
+            interval_id: u64::from(service) * 2 + 2,
+            start_at: 12,
+            end_at: 13,
+            issued_usage_litres: 100,
+        },
+    ]);
+}
+
+fn push_single_meter_service(export: &mut Export, service: u32, source_id: &mut u64) {
+    let meter = service + 1;
+    export.installations.push(Installation {
+        service_point_id: service,
+        installation_id: u64::from(service) * 2 + 1,
+        meter_id: meter,
+        installed_at: 0,
+        removed_at: None,
+        register_width: if service.is_multiple_of(2) { 6 } else { 8 },
+    });
+    push_reading_range(export, service, meter, 0..19, 0, source_id);
+    push_reading(export, service, meter, 24, 2_400, source_id);
+    export.billed_intervals.extend([
+        BilledInterval {
+            service_point_id: service,
+            interval_id: u64::from(service) * 2 + 1,
+            start_at: 0,
+            end_at: 1,
+            issued_usage_litres: 100,
+        },
+        BilledInterval {
+            service_point_id: service,
+            interval_id: u64::from(service) * 2 + 2,
+            start_at: 1,
+            end_at: 2,
+            issued_usage_litres: 100,
+        },
+    ]);
+}
+
+fn push_reading_range(
+    export: &mut Export,
+    service: u32,
+    meter: u32,
+    range: std::ops::Range<i64>,
+    origin: i64,
+    source_id: &mut u64,
+) {
+    for at in range {
+        let value = u32::try_from((at - origin) * 100).unwrap_or(0);
+        push_reading(export, service, meter, at, value, source_id);
+    }
+}
+
+fn push_reading(
+    export: &mut Export,
+    service: u32,
+    meter: u32,
+    at: i64,
+    value_litres: u32,
+    source_id: &mut u64,
+) {
+    export.readings.push(Reading {
+        service_point_id: service,
+        meter_id: meter,
+        source_id: *source_id,
+        at,
+        value_litres,
+        kind: ReadingKind::Actual,
+        supersedes: None,
+    });
+    *source_id += 1;
+}
diff --git a/developer-simulation/runs/2026-08-13--municipal-water-meter-billing-repair/src/main.rs b/developer-simulation/runs/2026-08-13--municipal-water-meter-billing-repair/src/main.rs
new file mode 100644
index 0000000..d5e2abd
--- /dev/null
+++ b/developer-simulation/runs/2026-08-13--municipal-water-meter-billing-repair/src/main.rs
@@ -0,0 +1,243 @@
+use std::collections::BTreeMap;
+use std::fs;
+use std::path::{Path, PathBuf};
+use std::time::Instant;
+
+use water_repair::{
+    Export, PublicationCrash, PublicationFailure, canonical_plan_bytes, evaluate_candidate,
+    evaluate_reference, generate_representative, generated_case, publish_plan,
+    publish_plan_with_crash,
+};
+
+fn main() {
+    if let Err(error) = run() {
+        eprintln!("water-repair: {error}");
+        std::process::exit(1);
+    }
+}
+
+fn run() -> Result<(), String> {
+    let mut arguments = std::env::args().skip(1);
+    let command = arguments.next().ok_or_else(usage)?;
+    let trailing: Vec<_> = arguments.collect();
+    let flags = parse_flags(&trailing)?;
+    match command.as_str() {
+        "process" => process(&flags),
+        "demo" => demo(&flags),
+        "verify" => verify(&flags),
+        "scale" => scale(&flags),
+        _ => Err(usage()),
+    }
+}
+
+fn usage() -> String {
+    "usage: water-repair <process|demo|verify|scale> [--input PATH] --output PATH [--batch-size N] [--inject before-temporary|before-final] [--crash before-staging|before-final]".to_string()
+}
+
+fn parse_flags(arguments: &[String]) -> Result<BTreeMap<String, String>, String> {
+    if !arguments.len().is_multiple_of(2) {
+        return Err(usage());
+    }
+    let mut flags = BTreeMap::new();
+    for pair in arguments.chunks_exact(2) {
+        let key = pair[0].strip_prefix("--").ok_or_else(usage)?.to_string();
+        if flags.insert(key.clone(), pair[1].clone()).is_some() {
+            return Err(format!("duplicate flag --{key}"));
+        }
+    }
+    Ok(flags)
+}
+
+fn required_path(flags: &BTreeMap<String, String>, name: &str) -> Result<PathBuf, String> {
+    flags
+        .get(name)
+        .map(PathBuf::from)
+        .ok_or_else(|| format!("missing --{name}"))
+}
+
+fn batch_size(flags: &BTreeMap<String, String>) -> Result<usize, String> {
+    flags.get("batch-size").map_or(Ok(1_024), |value| {
+        value
+            .parse::<usize>()
+            .map_err(|error| format!("invalid --batch-size: {error}"))
+    })
+}
+
+fn injection(flags: &BTreeMap<String, String>) -> Result<PublicationFailure, String> {
+    match flags.get("inject").map(String::as_str) {
+        None => Ok(PublicationFailure::None),
+        Some("before-temporary") => Ok(PublicationFailure::BeforeTemporary),
+        Some("before-final") => Ok(PublicationFailure::BeforeFinalRename),
+        Some(value) => Err(format!("unknown injection point: {value}")),
+    }
+}
+
+fn crash_point(flags: &BTreeMap<String, String>) -> Result<PublicationCrash, String> {
+    match flags.get("crash").map(String::as_str) {
+        None => Ok(PublicationCrash::None),
+        Some("before-staging") => Ok(PublicationCrash::BeforeStaging),
+        Some("before-final") => Ok(PublicationCrash::BeforeFinalRename),
+        Some(value) => Err(format!("unknown crash point: {value}")),
+    }
+}
+
+fn read_export(path: &Path) -> Result<Export, String> {
+    let bytes = fs::read(path).map_err(|error| format!("{}: {error}", path.display()))?;
+    serde_json::from_slice(&bytes).map_err(|error| format!("{}: {error}", path.display()))
+}
+
+fn process(flags: &BTreeMap<String, String>) -> Result<(), String> {
+    let input = required_path(flags, "input")?;
+    let output = required_path(flags, "output")?;
+    let export = read_export(&input)?;
+    let plan = evaluate_candidate(&export, batch_size(flags)?)?;
+    let reference = evaluate_reference(&export)?;
+    if plan != reference {
+        return Err("candidate/reference mismatch; no report published".to_string());
+    }
+    let crash = crash_point(flags)?;
+    if crash == PublicationCrash::None {
+        publish_plan(Some(&input), &output, &plan, injection(flags)?)?;
+    } else {
+        if injection(flags)? != PublicationFailure::None {
+            return Err("--inject and --crash are mutually exclusive".to_string());
+        }
+        publish_plan_with_crash(Some(&input), &output, &plan, crash)?;
+    }
+    println!(
+        "published {} repair(s), {} review case(s) to {}",
+        plan.repairs.len(),
+        plan.review_cases.len(),
+        output.display()
+    );
+    Ok(())
+}
+
+fn demo(flags: &BTreeMap<String, String>) -> Result<(), String> {
+    let input = flags
+        .get("input")
+        .map_or_else(|| PathBuf::from("fixtures/disclosed.json"), PathBuf::from);
+    let mut local_flags = flags.clone();
+    local_flags.insert("input".to_string(), input.display().to_string());
+    process(&local_flags)
+}
+
+fn verify(flags: &BTreeMap<String, String>) -> Result<(), String> {
+    let fixture = flags
+        .get("input")
+        .map_or_else(|| PathBuf::from("fixtures/disclosed.json"), PathBuf::from);
+    let disclosed = read_export(&fixture)?;
+    let disclosed_plan = evaluate_candidate(&disclosed, 7)?;
+    if disclosed_plan != evaluate_reference(&disclosed)? {
+        return Err("disclosed fixture differs from chronological reference".to_string());
+    }
+    for seed in 0..100 {
+        let export = generated_case(seed, 8);
+        if evaluate_candidate(&export, 5)? != evaluate_reference(&export)? {
+            return Err(format!("candidate/reference mismatch at seed {seed}"));
+        }
+    }
+    let base = generated_case(42, 12);
+    let expected = canonical_plan_bytes(&evaluate_candidate(&base, 1)?)?;
+    for permutation in 0..10 {
+        let mut shuffled = base.clone();
+        permute(&mut shuffled.readings, permutation + 1);
+        permute(&mut shuffled.installations, permutation + 101);
+        permute(&mut shuffled.billed_intervals, permutation + 201);
+        for batch in [1, 7, 64] {
+            let actual = canonical_plan_bytes(&evaluate_candidate(&shuffled, batch)?)?;
+            if actual != expected {
+                return Err(format!(
+                    "canonical mismatch at permutation {permutation}, batch {batch}"
+                ));
+            }
+        }
+    }
+    println!(
+        "verified disclosed fixture, 100 generated seeds, and 10 permutations x 3 batch sizes"
+    );
+    Ok(())
+}
+
+fn permute<T>(items: &mut [T], mut state: u64) {
+    for index in (1..items.len()).rev() {
+        state ^= state << 13;
+        state ^= state >> 7;
+        state ^= state << 17;
+        let target = usize::try_from(state % (index as u64 + 1)).expect("index always fits");
+        items.swap(index, target);
+    }
+}
+
+fn scale(flags: &BTreeMap<String, String>) -> Result<(), String> {
+    let output = required_path(flags, "output")?;
+    let started = Instant::now();
+    let generated = generate_representative();
+    let generated_at = started.elapsed();
+    let readings = generated.readings.len();
+    let service_points = generated
+        .installations
+        .iter()
+        .map(|installation| installation.service_point_id)
+        .max()
+        .map_or(0, |maximum| maximum + 1);
+    let meters = generated.installations.len();
+    let bills = generated.billed_intervals.len();
+    let plan = evaluate_candidate(&generated, batch_size(flags)?)?;
+    let evaluated_at = started.elapsed();
+    publish_plan(None, &output, &plan, PublicationFailure::None)?;
+    let total = started.elapsed();
+    println!(
+        "best-case requested-count shape: {service_points} service points, {meters} meters, {readings} readings, {bills} bills"
+    );
+    println!(
+        "result: {} repairs, {} review cases",
+        plan.repairs.len(),
+        plan.review_cases.len()
+    );
+    println!(
+        "elapsed: generation={:.3}s evaluation={:.3}s total_with_publication={:.3}s",
+        generated_at.as_secs_f64(),
+        evaluated_at.saturating_sub(generated_at).as_secs_f64(),
+        total.as_secs_f64()
+    );
+    println!(
+        "host: os={} arch={} logical_parallelism={}; peak_rss_mib={}",
+        std::env::consts::OS,
+        std::env::consts::ARCH,
+        std::thread::available_parallelism().map_or(1, std::num::NonZero::get),
+        peak_rss_bytes().map_or_else(|| "unavailable".to_string(), format_mib)
+    );
+    Ok(())
+}
+
+#[cfg(unix)]
+fn peak_rss_bytes() -> Option<u64> {
+    let mut usage = std::mem::MaybeUninit::<libc::rusage>::uninit();
+    // SAFETY: `getrusage` initializes the provided `rusage` when it returns
+    // zero. The pointer is valid for writes and read only after that result.
+    let result = unsafe { libc::getrusage(libc::RUSAGE_SELF, usage.as_mut_ptr()) };
+    if result != 0 {
+        return None;
+    }
+    // SAFETY: a zero result from `getrusage` guarantees initialization.
+    let usage = unsafe { usage.assume_init() };
+    let raw = u64::try_from(usage.ru_maxrss).ok()?;
+    #[cfg(target_os = "macos")]
+    let bytes = raw;
+    #[cfg(not(target_os = "macos"))]
+    let bytes = raw.checked_mul(1_024)?;
+    Some(bytes)
+}
+
+#[cfg(not(unix))]
+fn peak_rss_bytes() -> Option<u64> {
+    None
+}
+
+fn format_mib(bytes: u64) -> String {
+    const MIB: u64 = 1_024 * 1_024;
+    let whole = bytes / MIB;
+    let tenth = (bytes % MIB) * 10 / MIB;
+    format!("{whole}.{tenth}")
+}
diff --git a/developer-simulation/runs/2026-08-13--municipal-water-meter-billing-repair/src/reference.rs b/developer-simulation/runs/2026-08-13--municipal-water-meter-billing-repair/src/reference.rs
new file mode 100644
index 0000000..6c718ab
--- /dev/null
+++ b/developer-simulation/runs/2026-08-13--municipal-water-meter-billing-repair/src/reference.rs
@@ -0,0 +1,462 @@
+//! A chronological oracle intentionally separate from the candidate's
+//! sort-and-slice reducer. This favors obvious scans over candidate efficiency.
+
+use std::collections::{BTreeMap, BTreeSet};
+
+use super::{
+    BilledInterval, Export, Installation, PriorAdjustment, Reading, ReadingKind, Repair,
+    RepairPlan, ReviewCase, ServiceError, canonicalize,
+};
+
+pub(super) fn evaluate(
+    export: &Export,
+    adjustments: &[&PriorAdjustment],
+) -> Result<RepairPlan, String> {
+    let unique = unique_sources(export)?;
+    let services = service_ids(export, &unique, adjustments);
+    let mut plan = RepairPlan::default();
+    for service in services {
+        match evaluate_service(export, &unique, adjustments, service) {
+            Ok(mut repairs) => plan.repairs.append(&mut repairs),
+            Err(error) => plan.review_cases.push(ReviewCase {
+                service_point_id: service,
+                reason_code: error.code.to_string(),
+                detail_ids: error.ids,
+            }),
+        }
+    }
+    canonicalize(&mut plan);
+    Ok(plan)
+}
+
+fn unique_sources(export: &Export) -> Result<BTreeMap<u64, &Reading>, String> {
+    let mut unique = BTreeMap::new();
+    for reading in &export.readings {
+        match unique.get(&reading.source_id) {
+            Some(previous) if *previous != reading => {
+                return Err(format!("CONFLICTING_SOURCE_ID:{}", reading.source_id));
+            }
+            Some(_) => {}
+            None => {
+                unique.insert(reading.source_id, reading);
+            }
+        }
+    }
+    Ok(unique)
+}
+
+fn service_ids(
+    export: &Export,
+    unique: &BTreeMap<u64, &Reading>,
+    adjustments: &[&PriorAdjustment],
+) -> BTreeSet<u32> {
+    let mut services = BTreeSet::new();
+    services.extend(
+        export
+            .installations
+            .iter()
+            .map(|item| item.service_point_id),
+    );
+    services.extend(unique.values().map(|item| item.service_point_id));
+    services.extend(
+        export
+            .billed_intervals
+            .iter()
+            .map(|item| item.service_point_id),
+    );
+    services.extend(adjustments.iter().map(|item| item.service_point_id));
+    services
+}
+
+fn evaluate_service(
+    export: &Export,
+    unique: &BTreeMap<u64, &Reading>,
+    adjustments: &[&PriorAdjustment],
+    service: u32,
+) -> Result<Vec<Repair>, ServiceError> {
+    let mut installations: Vec<_> = export
+        .installations
+        .iter()
+        .filter(|item| item.service_point_id == service)
+        .collect();
+    installations.sort_unstable_by_key(|item| (item.installed_at, item.installation_id));
+    validate_installations(&installations)?;
+    let mut readings: Vec<_> = unique
+        .values()
+        .copied()
+        .filter(|item| item.service_point_id == service)
+        .collect();
+    readings.sort_unstable_by_key(|item| (item.at, item.meter_id, item.source_id));
+    let active = active_readings(&installations, &readings)?;
+    let mut bills: Vec<_> = export
+        .billed_intervals
+        .iter()
+        .filter(|item| item.service_point_id == service)
+        .collect();
+    bills.sort_unstable_by_key(|item| (item.start_at, item.end_at, item.interval_id));
+    validate_bills(&bills)?;
+    build_repairs(adjustments, service, &installations, &active, &bills)
+}
+
+fn validate_installations(installations: &[&Installation]) -> Result<(), ServiceError> {
+    if installations.is_empty() {
+        return Err(ServiceError::new("MISSING_INSTALLATION", Vec::new()));
+    }
+    let mut installation_ids = BTreeSet::new();
+    let mut meter_ids = BTreeSet::new();
+    for installation in installations {
+        if !installation_ids.insert(installation.installation_id) {
+            return Err(ServiceError::new(
+                "DUPLICATE_INSTALLATION_ID",
+                vec![installation.installation_id],
+            ));
+        }
+        if !meter_ids.insert(installation.meter_id) {
+            return Err(ServiceError::new(
+                "METER_REINSTALLED_UNSUPPORTED",
+                vec![u64::from(installation.meter_id)],
+            ));
+        }
+        if !matches!(installation.register_width, 6 | 8) {
+            return Err(ServiceError::new(
+                "MALFORMED_REGISTER_WIDTH",
+                vec![installation.installation_id],
+            ));
+        }
+        if installation
+            .removed_at
+            .is_some_and(|removed| removed <= installation.installed_at)
+        {
+            return Err(ServiceError::new(
+                "INVALID_INSTALLATION_RANGE",
+                vec![installation.installation_id],
+            ));
+        }
+    }
+    validate_installation_sequence(installations)
+}
+
+fn validate_installation_sequence(installations: &[&Installation]) -> Result<(), ServiceError> {
+    for pair in installations.windows(2) {
+        let ids = vec![pair[0].installation_id, pair[1].installation_id];
+        match pair[0].removed_at {
+            None => return Err(ServiceError::new("OVERLAPPING_INSTALLATIONS", ids)),
+            Some(removed) if removed < pair[1].installed_at => {
+                return Err(ServiceError::new("INSTALLATION_GAP_NO_POLICY", ids));
+            }
+            Some(removed) if removed > pair[1].installed_at => {
+                return Err(ServiceError::new("OVERLAPPING_INSTALLATIONS", ids));
+            }
+            Some(_) => {}
+        }
+    }
+    Ok(())
+}
+
+fn validate_bills(bills: &[&BilledInterval]) -> Result<(), ServiceError> {
+    let mut ids = BTreeSet::new();
+    for bill in bills {
+        if !ids.insert(bill.interval_id) {
+            return Err(ServiceError::new(
+                "DUPLICATE_INTERVAL_ID",
+                vec![bill.interval_id],
+            ));
+        }
+        if bill.end_at <= bill.start_at || bill.issued_usage_litres < 0 {
+            return Err(ServiceError::new(
+                "INVALID_BILLED_INTERVAL",
+                vec![bill.interval_id],
+            ));
+        }
+    }
+    Ok(())
+}
+
+fn active_readings<'a>(
+    installations: &[&Installation],
+    readings: &[&'a Reading],
+) -> Result<Vec<&'a Reading>, ServiceError> {
+    let by_source: BTreeMap<_, _> = readings
+        .iter()
+        .map(|reading| (reading.source_id, *reading))
+        .collect();
+    let mut superseded = BTreeSet::new();
+    for reading in readings {
+        validate_reading(installations, &by_source, reading, &mut superseded)?;
+    }
+    let mut active: Vec<_> = readings
+        .iter()
+        .copied()
+        .filter(|reading| !superseded.contains(&reading.source_id))
+        .collect();
+    active.sort_unstable_by_key(|reading| (reading.meter_id, reading.at, reading.source_id));
+    for pair in active.windows(2) {
+        if pair[0].meter_id == pair[1].meter_id && pair[0].at == pair[1].at {
+            return Err(ServiceError::new(
+                "AMBIGUOUS_EQUAL_TIMESTAMP",
+                vec![pair[0].source_id, pair[1].source_id],
+            ));
+        }
+    }
+    Ok(active)
+}
+
+fn validate_reading(
+    installations: &[&Installation],
+    by_source: &BTreeMap<u64, &Reading>,
+    reading: &Reading,
+    superseded: &mut BTreeSet<u64>,
+) -> Result<(), ServiceError> {
+    let installation = installations.iter().find(|installation| {
+        installation.meter_id == reading.meter_id
+            && reading.at >= installation.installed_at
+            && installation
+                .removed_at
+                .is_none_or(|removed| reading.at <= removed)
+    });
+    let Some(installation) = installation else {
+        return Err(ServiceError::new(
+            "READING_FOR_INACTIVE_METER",
+            vec![reading.source_id],
+        ));
+    };
+    let modulus = 10_u64.pow(u32::from(installation.register_width));
+    if u64::from(reading.value_litres) >= modulus {
+        return Err(ServiceError::new(
+            "REGISTER_VALUE_OUT_OF_RANGE",
+            vec![reading.source_id],
+        ));
+    }
+    validate_supersession(by_source, reading, superseded)
+}
+
+fn validate_supersession(
+    by_source: &BTreeMap<u64, &Reading>,
+    reading: &Reading,
+    superseded: &mut BTreeSet<u64>,
+) -> Result<(), ServiceError> {
+    if reading.kind == ReadingKind::Estimated && reading.supersedes.is_some() {
+        return Err(ServiceError::new(
+            "INVALID_SUPERSESSION_KIND",
+            vec![reading.source_id],
+        ));
+    }
+    if reading.kind == ReadingKind::CorrectedActual && reading.supersedes.is_none() {
+        return Err(ServiceError::new(
+            "CORRECTION_MISSING_TARGET",
+            vec![reading.source_id],
+        ));
+    }
+    let Some(target_id) = reading.supersedes else {
+        return Ok(());
+    };
+    let target = by_source.get(&target_id).ok_or_else(|| {
+        ServiceError::new(
+            "SUPERSESSION_TARGET_MISSING",
+            vec![reading.source_id, target_id],
+        )
+    })?;
+    if target.service_point_id != reading.service_point_id
+        || target.meter_id != reading.meter_id
+        || target.at != reading.at
+        || target.source_id == reading.source_id
+    {
+        return Err(ServiceError::new(
+            "INVALID_SUPERSESSION_TARGET",
+            vec![reading.source_id, target_id],
+        ));
+    }
+    if !superseded.insert(target_id) {
+        return Err(ServiceError::new("MULTIPLE_SUPERSEDERS", vec![target_id]));
+    }
+    Ok(())
+}
+
+fn build_repairs(
+    adjustments: &[&PriorAdjustment],
+    service: u32,
+    installations: &[&Installation],
+    active: &[&Reading],
+    bills: &[&BilledInterval],
+) -> Result<Vec<Repair>, ServiceError> {
+    let mut repairs = Vec::new();
+    for bill in bills {
+        let computed = chronological_usage(bill, installations, active)?;
+        let old = adjusted_old_usage(adjustments, service, bill)?;
+        if old == computed.litres {
+            continue;
+        }
+        let adjustment = computed
+            .litres
+            .checked_sub(old)
+            .ok_or_else(|| ServiceError::new("INTEGER_OVERFLOW", vec![bill.interval_id]))?;
+        let reason = reason_code(&computed).to_string();
+        repairs.push(Repair {
+            service_point_id: service,
+            interval_id: bill.interval_id,
+            old_usage_litres: old,
+            recomputed_usage_litres: computed.litres,
+            adjustment_litres: adjustment,
+            source_reading_ids: computed.source_ids,
+            installation_ids: computed.installation_ids.clone(),
+            installation_meter_ids: computed.meter_ids,
+            reason_code: reason,
+        });
+    }
+    Ok(repairs)
+}
+
+fn adjusted_old_usage(
+    adjustments: &[&PriorAdjustment],
+    service: u32,
+    bill: &BilledInterval,
+) -> Result<i64, ServiceError> {
+    let mut total = bill.issued_usage_litres;
+    for adjustment in adjustments.iter().filter(|adjustment| {
+        adjustment.service_point_id == service && adjustment.interval_id == bill.interval_id
+    }) {
+        total = total
+            .checked_add(adjustment.adjustment_litres)
+            .ok_or_else(|| ServiceError::new("INTEGER_OVERFLOW", vec![adjustment.adjustment_id]))?;
+    }
+    Ok(total)
+}
+
+struct ReferenceUsage {
+    litres: i64,
+    source_ids: Vec<u64>,
+    installation_ids: Vec<u64>,
+    meter_ids: Vec<u32>,
+    rollover: bool,
+    correction: bool,
+}
+
+fn chronological_usage(
+    bill: &BilledInterval,
+    installations: &[&Installation],
+    active: &[&Reading],
+) -> Result<ReferenceUsage, ServiceError> {
+    let mut result = ReferenceUsage {
+        litres: 0,
+        source_ids: Vec::new(),
+        installation_ids: Vec::new(),
+        meter_ids: Vec::new(),
+        rollover: false,
+        correction: false,
+    };
+    let mut cursor = bill.start_at;
+    for installation in installations {
+        let start = bill.start_at.max(installation.installed_at);
+        let end = bill.end_at.min(installation.removed_at.unwrap_or(i64::MAX));
+        if start >= end {
+            continue;
+        }
+        if cursor != start {
+            return Err(ServiceError::new(
+                "BILLING_INTERVAL_NOT_COVERED",
+                vec![bill.interval_id],
+            ));
+        }
+        let mut segment: Vec<_> = active
+            .iter()
+            .copied()
+            .filter(|reading| {
+                reading.meter_id == installation.meter_id && (start..=end).contains(&reading.at)
+            })
+            .collect();
+        segment.sort_unstable_by_key(|reading| (reading.at, reading.source_id));
+        add_segment(&mut result, bill, installation, &segment, start, end)?;
+        cursor = end;
+    }
+    if cursor != bill.end_at {
+        return Err(ServiceError::new(
+            "BILLING_INTERVAL_NOT_COVERED",
+            vec![bill.interval_id],
+        ));
+    }
+    result.source_ids.sort_unstable();
+    result.source_ids.dedup();
+    result.installation_ids.sort_unstable();
+    result.installation_ids.dedup();
+    result.meter_ids.sort_unstable();
+    result.meter_ids.dedup();
+    Ok(result)
+}
+
+fn add_segment(
+    result: &mut ReferenceUsage,
+    bill: &BilledInterval,
+    installation: &Installation,
+    segment: &[&Reading],
+    start: i64,
+    end: i64,
+) -> Result<(), ServiceError> {
+    if segment.first().is_none_or(|reading| reading.at != start)
+        || segment.last().is_none_or(|reading| reading.at != end)
+    {
+        return Err(ServiceError::new(
+            "MISSING_BOUNDARY_READING",
+            vec![bill.interval_id, installation.installation_id],
+        ));
+    }
+    for pair in segment.windows(2) {
+        let (delta, rollover) = chronological_delta(pair[0], pair[1], installation)?;
+        result.litres = result
+            .litres
+            .checked_add(delta)
+            .ok_or_else(|| ServiceError::new("INTEGER_OVERFLOW", vec![bill.interval_id]))?;
+        result.rollover |= rollover;
+    }
+    result
+        .source_ids
+        .extend(segment.iter().map(|reading| reading.source_id));
+    result.correction |= segment.iter().any(|reading| reading.supersedes.is_some());
+    result.installation_ids.push(installation.installation_id);
+    result.meter_ids.push(installation.meter_id);
+    Ok(())
+}
+
+fn chronological_delta(
+    previous: &Reading,
+    current: &Reading,
+    installation: &Installation,
+) -> Result<(i64, bool), ServiceError> {
+    if current.value_litres >= previous.value_litres {
+        return Ok((
+            i64::from(current.value_litres - previous.value_litres),
+            false,
+        ));
+    }
+    let modulus = 10_u64.pow(u32::from(installation.register_width));
+    let previous_value = u64::from(previous.value_litres);
+    let current_value = u64::from(current.value_litres);
+    let regression = previous_value - current_value;
+    let looks_like_rollover = regression > modulus / 2
+        && previous_value >= modulus * 3 / 4
+        && current_value <= modulus / 4;
+    if !looks_like_rollover {
+        return Err(ServiceError::new(
+            "AMBIGUOUS_REGISTER_REGRESSION",
+            vec![previous.source_id, current.source_id],
+        ));
+    }
+    let litres = i64::try_from(modulus - previous_value + current_value).map_err(|_| {
+        ServiceError::new(
+            "INTEGER_OVERFLOW",
+            vec![previous.source_id, current.source_id],
+        )
+    })?;
+    Ok((litres, true))
+}
+
+fn reason_code(usage: &ReferenceUsage) -> &'static str {
+    if usage.correction {
+        "CORRECTION_REPAIR"
+    } else if usage.installation_ids.len() > 1 {
+        "METER_REPLACEMENT_REPAIR"
+    } else if usage.rollover {
+        "ROLLOVER_REPAIR"
+    } else {
+        "RECOMPUTED_USAGE"
+    }
+}
diff --git a/developer-simulation/runs/2026-08-13--municipal-water-meter-billing-repair/tests/acceptance.rs b/developer-simulation/runs/2026-08-13--municipal-water-meter-billing-repair/tests/acceptance.rs
new file mode 100644
index 0000000..ba648d5
--- /dev/null
+++ b/developer-simulation/runs/2026-08-13--municipal-water-meter-billing-repair/tests/acceptance.rs
@@ -0,0 +1,386 @@
+use std::fs;
+
+use tempfile::tempdir;
+use water_repair::{
+    BilledInterval, Export, Installation, PriorAdjustment, PublicationFailure, Reading,
+    ReadingKind, RepairPlan, canonical_plan_bytes, evaluate_candidate, evaluate_reference,
+    generated_case, publish_plan,
+};
+
+fn installation(service: u32, install: u64, meter: u32, width: u8) -> Installation {
+    Installation {
+        service_point_id: service,
+        installation_id: install,
+        meter_id: meter,
+        installed_at: 0,
+        removed_at: None,
+        register_width: width,
+    }
+}
+
+fn reading(service: u32, meter: u32, source: u64, at: i64, value: u32) -> Reading {
+    Reading {
+        service_point_id: service,
+        meter_id: meter,
+        source_id: source,
+        at,
+        value_litres: value,
+        kind: ReadingKind::Actual,
+        supersedes: None,
+    }
+}
+
+fn bill(service: u32, interval: u64, start: i64, end: i64, old: i64) -> BilledInterval {
+    BilledInterval {
+        service_point_id: service,
+        interval_id: interval,
+        start_at: start,
+        end_at: end,
+        issued_usage_litres: old,
+    }
+}
+
+#[test]
+fn corrected_actual_changes_only_the_two_intervals_anchored_by_the_estimate() {
+    let mut estimate = reading(1, 10, 2, 1, 200);
+    estimate.kind = ReadingKind::Estimated;
+    let mut correction = reading(1, 10, 3, 1, 210);
+    correction.kind = ReadingKind::CorrectedActual;
+    correction.supersedes = Some(2);
+    let export = Export {
+        installations: vec![installation(1, 100, 10, 6)],
+        readings: vec![
+            reading(1, 10, 4, 2, 300),
+            correction,
+            reading(1, 10, 1, 0, 100),
+            reading(1, 10, 5, 3, 400),
+            estimate,
+        ],
+        billed_intervals: vec![
+            bill(1, 12, 2, 3, 100),
+            bill(1, 10, 0, 1, 100),
+            bill(1, 11, 1, 2, 100),
+        ],
+        prior_adjustments: vec![],
+    };
+
+    let plan = evaluate_candidate(&export, 2).unwrap();
+    assert_eq!(plan.repairs.len(), 2);
+    assert_eq!(plan.repairs[0].interval_id, 10);
+    assert_eq!(plan.repairs[0].adjustment_litres, 10);
+    assert_eq!(plan.repairs[0].source_reading_ids, vec![1, 3]);
+    assert_eq!(plan.repairs[0].reason_code, "CORRECTION_REPAIR");
+    assert_eq!(plan.repairs[1].interval_id, 11);
+    assert_eq!(plan.repairs[1].adjustment_litres, -10);
+    assert_eq!(plan.repairs[1].source_reading_ids, vec![3, 4]);
+    assert!(plan.repairs.iter().all(|repair| repair.interval_id != 12));
+}
+
+#[test]
+fn replacement_boundary_closes_old_and_opens_new_register() {
+    let export = Export {
+        installations: vec![
+            Installation {
+                service_point_id: 1,
+                installation_id: 100,
+                meter_id: 10,
+                installed_at: 0,
+                removed_at: Some(1),
+                register_width: 6,
+            },
+            Installation {
+                service_point_id: 1,
+                installation_id: 101,
+                meter_id: 11,
+                installed_at: 1,
+                removed_at: None,
+                register_width: 8,
+            },
+        ],
+        readings: vec![
+            reading(1, 11, 4, 2, 80),
+            reading(1, 10, 1, 0, 900),
+            reading(1, 11, 3, 1, 10),
+            reading(1, 10, 2, 1, 950),
+        ],
+        billed_intervals: vec![bill(1, 20, 0, 2, 100)],
+        prior_adjustments: vec![],
+    };
+
+    let plan = evaluate_candidate(&export, 3).unwrap();
+    assert_eq!(plan.repairs.len(), 1);
+    assert_eq!(plan.repairs[0].recomputed_usage_litres, 120);
+    assert_eq!(plan.repairs[0].adjustment_litres, 20);
+    assert_eq!(plan.repairs[0].source_reading_ids, vec![1, 2, 3, 4]);
+    assert_eq!(plan.repairs[0].installation_ids, vec![100, 101]);
+    assert_eq!(plan.repairs[0].reason_code, "METER_REPLACEMENT_REPAIR");
+}
+
+#[test]
+fn ambiguous_regressions_fail_closed_and_six_and_eight_digit_rollovers_differ() {
+    let export = Export {
+        installations: vec![
+            installation(1, 101, 11, 6),
+            installation(2, 102, 12, 8),
+            installation(3, 103, 13, 6),
+        ],
+        readings: vec![
+            reading(1, 11, 1, 0, 600_000),
+            reading(1, 11, 2, 1, 100_000),
+            reading(2, 12, 3, 0, 99_999_999),
+            reading(2, 12, 4, 1, 0),
+            reading(3, 13, 5, 0, 100),
+            reading(3, 13, 6, 1, 90),
+        ],
+        billed_intervals: vec![
+            bill(1, 10, 0, 1, 0),
+            bill(2, 20, 0, 1, 0),
+            bill(3, 30, 0, 1, 0),
+        ],
+        prior_adjustments: vec![],
+    };
+
+    let plan = evaluate_candidate(&export, 50).unwrap();
+    assert_eq!(plan.repairs.len(), 1);
+    assert_eq!(plan.repairs[0].service_point_id, 2);
+    assert_eq!(plan.repairs[0].recomputed_usage_litres, 1);
+    assert_eq!(plan.review_cases.len(), 2);
+    assert_eq!(
+        plan.review_cases[0].reason_code,
+        "AMBIGUOUS_REGISTER_REGRESSION"
+    );
+    assert_eq!(plan.review_cases[0].detail_ids, vec![1, 2]);
+    assert_eq!(
+        plan.review_cases[1].reason_code,
+        "AMBIGUOUS_REGISTER_REGRESSION"
+    );
+}
+
+#[test]
+fn exact_duplicate_is_idempotent_but_conflicting_source_id_is_global_failure() {
+    let base = Export {
+        installations: vec![installation(1, 100, 10, 6)],
+        readings: vec![reading(1, 10, 1, 0, 100), reading(1, 10, 2, 1, 150)],
+        billed_intervals: vec![bill(1, 10, 0, 1, 40)],
+        prior_adjustments: vec![],
+    };
+    let expected = evaluate_candidate(&base, 1).unwrap();
+    let mut duplicated = base.clone();
+    duplicated.readings.push(duplicated.readings[0].clone());
+    assert_eq!(evaluate_candidate(&duplicated, 2).unwrap(), expected);
+
+    let mut conflicting = base;
+    conflicting.readings.push(reading(1, 10, 1, 0, 101));
+    assert_eq!(
+        evaluate_candidate(&conflicting, 100).unwrap_err(),
+        "CONFLICTING_SOURCE_ID:1"
+    );
+}
+
+#[test]
+fn invalid_service_does_not_suppress_unrelated_valid_repair() {
+    let export = Export {
+        installations: vec![installation(1, 100, 10, 6), installation(2, 200, 20, 6)],
+        readings: vec![
+            reading(1, 10, 1, 0, 0),
+            reading(1, 10, 2, 1, 10),
+            reading(2, 999, 3, 0, 0),
+            reading(2, 20, 4, 1, 10),
+        ],
+        billed_intervals: vec![bill(1, 10, 0, 1, 5), bill(2, 20, 0, 1, 5)],
+        prior_adjustments: vec![],
+    };
+    let plan = evaluate_candidate(&export, 4).unwrap();
+    assert_eq!(plan.repairs.len(), 1);
+    assert_eq!(plan.repairs[0].service_point_id, 1);
+    assert_eq!(plan.review_cases.len(), 1);
+    assert_eq!(plan.review_cases[0].service_point_id, 2);
+    assert_eq!(
+        plan.review_cases[0].reason_code,
+        "READING_FOR_INACTIVE_METER"
+    );
+}
+
+#[test]
+fn overlap_gap_malformed_width_out_of_range_and_equal_time_are_review_cases() {
+    let cases = [
+        (
+            Export {
+                installations: vec![
+                    Installation {
+                        service_point_id: 1,
+                        installation_id: 1,
+                        meter_id: 1,
+                        installed_at: 0,
+                        removed_at: Some(2),
+                        register_width: 6,
+                    },
+                    Installation {
+                        service_point_id: 1,
+                        installation_id: 2,
+                        meter_id: 2,
+                        installed_at: 1,
+                        removed_at: None,
+                        register_width: 6,
+                    },
+                ],
+                readings: vec![],
+                billed_intervals: vec![],
+                prior_adjustments: vec![],
+            },
+            "OVERLAPPING_INSTALLATIONS",
+        ),
+        (
+            Export {
+                installations: vec![
+                    Installation {
+                        service_point_id: 1,
+                        installation_id: 1,
+                        meter_id: 1,
+                        installed_at: 0,
+                        removed_at: Some(1),
+                        register_width: 6,
+                    },
+                    Installation {
+                        service_point_id: 1,
+                        installation_id: 2,
+                        meter_id: 2,
+                        installed_at: 2,
+                        removed_at: None,
+                        register_width: 6,
+                    },
+                ],
+                readings: vec![],
+                billed_intervals: vec![],
+                prior_adjustments: vec![],
+            },
+            "INSTALLATION_GAP_NO_POLICY",
+        ),
+        (
+            Export {
+                installations: vec![installation(1, 1, 1, 7)],
+                readings: vec![],
+                billed_intervals: vec![],
+                prior_adjustments: vec![],
+            },
+            "MALFORMED_REGISTER_WIDTH",
+        ),
+        (
+            Export {
+                installations: vec![installation(1, 1, 1, 6)],
+                readings: vec![reading(1, 1, 10, 0, 1_000_000)],
+                billed_intervals: vec![],
+                prior_adjustments: vec![],
+            },
+            "REGISTER_VALUE_OUT_OF_RANGE",
+        ),
+        (
+            Export {
+                installations: vec![installation(1, 1, 1, 6)],
+                readings: vec![reading(1, 1, 10, 0, 1), reading(1, 1, 11, 0, 2)],
+                billed_intervals: vec![],
+                prior_adjustments: vec![],
+            },
+            "AMBIGUOUS_EQUAL_TIMESTAMP",
+        ),
+    ];
+    for (export, expected) in cases {
+        let plan = evaluate_candidate(&export, 1).unwrap();
+        assert_eq!(plan.review_cases[0].reason_code, expected);
+    }
+}
+
+#[test]
+fn prior_adjustments_are_part_of_old_usage_and_issued_interval_is_not_rewritten() {
+    let export = Export {
+        installations: vec![installation(1, 100, 10, 6)],
+        readings: vec![reading(1, 10, 1, 0, 100), reading(1, 10, 2, 1, 180)],
+        billed_intervals: vec![bill(1, 10, 0, 1, 50)],
+        prior_adjustments: vec![PriorAdjustment {
+            service_point_id: 1,
+            interval_id: 10,
+            adjustment_id: 500,
+            adjustment_litres: 20,
+        }],
+    };
+    let plan = evaluate_candidate(&export, 1).unwrap();
+    assert_eq!(plan.repairs[0].old_usage_litres, 70);
+    assert_eq!(plan.repairs[0].recomputed_usage_litres, 80);
+    assert_eq!(plan.repairs[0].adjustment_litres, 10);
+    assert_eq!(export.billed_intervals[0].issued_usage_litres, 50);
+}
+
+fn permute<T>(items: &mut [T], mut state: u64) {
+    for index in (1..items.len()).rev() {
+        state ^= state << 13;
+        state ^= state >> 7;
+        state ^= state << 17;
+        let target = usize::try_from(state % (index as u64 + 1)).unwrap();
+        items.swap(index, target);
+    }
+}
+
+#[test]
+fn ten_permutations_three_batch_sizes_are_byte_identical() {
+    let base = generated_case(42, 12);
+    let expected = canonical_plan_bytes(&evaluate_candidate(&base, 1).unwrap()).unwrap();
+    for seed in 0..10 {
+        let mut shuffled = base.clone();
+        permute(&mut shuffled.readings, seed + 1);
+        permute(&mut shuffled.installations, seed + 101);
+        permute(&mut shuffled.billed_intervals, seed + 201);
+        for batch_size in [1, 7, 64] {
+            let actual =
+                canonical_plan_bytes(&evaluate_candidate(&shuffled, batch_size).unwrap()).unwrap();
+            assert_eq!(actual, expected, "seed {seed}, batch {batch_size}");
+        }
+    }
+}
+
+#[test]
+fn candidate_agrees_with_chronological_oracle_on_one_hundred_seeds() {
+    for seed in 0..100 {
+        let export = generated_case(seed, 8);
+        assert_eq!(
+            evaluate_candidate(&export, 5).unwrap(),
+            evaluate_reference(&export).unwrap(),
+            "seed {seed}"
+        );
+    }
+}
+
+#[test]
+fn failures_preserve_prior_report_and_success_replaces_it_completely() {
+    let directory = tempdir().unwrap();
+    let output = directory.path().join("plan.json");
+    fs::write(&output, b"prior-complete-report\n").unwrap();
+    let prior = fs::read(&output).unwrap();
+    let plan = RepairPlan::default();
+
+    assert!(publish_plan(None, &output, &plan, PublicationFailure::BeforeTemporary).is_err());
+    assert_eq!(fs::read(&output).unwrap(), prior);
+    assert!(publish_plan(None, &output, &plan, PublicationFailure::BeforeFinalRename).is_err());
+    assert_eq!(fs::read(&output).unwrap(), prior);
+    assert_eq!(fs::read_dir(directory.path()).unwrap().count(), 1);
+
+    publish_plan(None, &output, &plan, PublicationFailure::None).unwrap();
+    assert_eq!(
+        fs::read(&output).unwrap(),
+        canonical_plan_bytes(&plan).unwrap()
+    );
+}
+
+#[test]
+fn detectable_input_output_identity_is_rejected_without_modification() {
+    let directory = tempdir().unwrap();
+    let input = directory.path().join("export.json");
+    fs::write(&input, b"immutable-input\n").unwrap();
+    let result = publish_plan(
+        Some(&input),
+        &input,
+        &RepairPlan::default(),
+        PublicationFailure::None,
+    );
+    assert_eq!(result.unwrap_err(), "INPUT_OUTPUT_PATH_IDENTITY");
+    assert_eq!(fs::read(&input).unwrap(), b"immutable-input\n");
+}
diff --git a/developer-simulation/runs/2026-08-13--municipal-water-meter-billing-repair/tests/adjustment_identity.rs b/developer-simulation/runs/2026-08-13--municipal-water-meter-billing-repair/tests/adjustment_identity.rs
new file mode 100644
index 0000000..adcf67f
--- /dev/null
+++ b/developer-simulation/runs/2026-08-13--municipal-water-meter-billing-repair/tests/adjustment_identity.rs
@@ -0,0 +1,141 @@
+use std::fs;
+use std::process::Command;
+
+use tempfile::tempdir;
+use water_repair::{
+    BilledInterval, Export, Installation, PriorAdjustment, Reading, ReadingKind,
+    evaluate_candidate, evaluate_reference,
+};
+
+fn base_export() -> Export {
+    Export {
+        installations: vec![Installation {
+            service_point_id: 1,
+            installation_id: 100,
+            meter_id: 10,
+            installed_at: 0,
+            removed_at: None,
+            register_width: 6,
+        }],
+        readings: vec![
+            Reading {
+                service_point_id: 1,
+                meter_id: 10,
+                source_id: 1,
+                at: 0,
+                value_litres: 100,
+                kind: ReadingKind::Actual,
+                supersedes: None,
+            },
+            Reading {
+                service_point_id: 1,
+                meter_id: 10,
+                source_id: 2,
+                at: 1,
+                value_litres: 200,
+                kind: ReadingKind::Actual,
+                supersedes: None,
+            },
+            Reading {
+                service_point_id: 1,
+                meter_id: 10,
+                source_id: 3,
+                at: 2,
+                value_litres: 300,
+                kind: ReadingKind::Actual,
+                supersedes: None,
+            },
+        ],
+        billed_intervals: vec![
+            BilledInterval {
+                service_point_id: 1,
+                interval_id: 10,
+                start_at: 0,
+                end_at: 1,
+                issued_usage_litres: 80,
+            },
+            BilledInterval {
+                service_point_id: 1,
+                interval_id: 11,
+                start_at: 1,
+                end_at: 2,
+                issued_usage_litres: 80,
+            },
+        ],
+        prior_adjustments: Vec::new(),
+    }
+}
+
+fn adjustment(interval_id: u64, adjustment_litres: i64) -> PriorAdjustment {
+    PriorAdjustment {
+        service_point_id: 1,
+        interval_id,
+        adjustment_id: 500,
+        adjustment_litres,
+    }
+}
+
+#[test]
+fn same_adjustment_id_on_different_intervals_rejects_before_derivation() {
+    let mut export = base_export();
+    export.prior_adjustments = vec![adjustment(10, 5), adjustment(11, 5)];
+
+    for order in [export.prior_adjustments.clone(), {
+        let mut reversed = export.prior_adjustments.clone();
+        reversed.reverse();
+        reversed
+    }] {
+        export.prior_adjustments = order;
+        assert_eq!(
+            evaluate_candidate(&export, 1).unwrap_err(),
+            "CONFLICTING_ADJUSTMENT_ID:500"
+        );
+        assert_eq!(
+            evaluate_reference(&export).unwrap_err(),
+            "CONFLICTING_ADJUSTMENT_ID:500"
+        );
+    }
+}
+
+#[test]
+fn exact_adjustment_retry_is_idempotent_for_candidate_and_reference() {
+    let mut once = base_export();
+    once.prior_adjustments = vec![adjustment(10, 5)];
+    let mut retried = once.clone();
+    retried.prior_adjustments.push(adjustment(10, 5));
+
+    let expected = evaluate_candidate(&once, 1).unwrap();
+    assert_eq!(evaluate_candidate(&retried, 2).unwrap(), expected);
+    assert_eq!(evaluate_reference(&retried).unwrap(), expected);
+    retried.prior_adjustments.reverse();
+    assert_eq!(evaluate_candidate(&retried, 64).unwrap(), expected);
+    assert_eq!(evaluate_reference(&retried).unwrap(), expected);
+}
+
+#[test]
+fn conflicting_amount_reuse_rejects_identically_and_preserves_prior_report() {
+    let mut export = base_export();
+    export.prior_adjustments = vec![adjustment(10, 5), adjustment(10, 6)];
+    let expected_error = "CONFLICTING_ADJUSTMENT_ID:500";
+    assert_eq!(evaluate_candidate(&export, 7).unwrap_err(), expected_error);
+    assert_eq!(evaluate_reference(&export).unwrap_err(), expected_error);
+
+    let directory = tempdir().unwrap();
+    let input = directory.path().join("conflict.json");
+    let output = directory.path().join("prior-plan.json");
+    let prior = b"prior-complete-report\n";
+    fs::write(&input, serde_json::to_vec_pretty(&export).unwrap()).unwrap();
+    fs::write(&output, prior).unwrap();
+
+    let result = Command::new(env!("CARGO_BIN_EXE_water-repair"))
+        .arg("process")
+        .arg("--input")
+        .arg(&input)
+        .arg("--output")
+        .arg(&output)
+        .status()
+        .unwrap();
+    assert!(!result.success());
+    assert_eq!(fs::read(&output).unwrap(), prior);
+    assert_eq!(fs::read_dir(directory.path()).unwrap().count(), 2);
+}
diff --git a/developer-simulation/runs/2026-08-13--municipal-water-meter-billing-repair/tests/subprocess_publication.rs b/developer-simulation/runs/2026-08-13--municipal-water-meter-billing-repair/tests/subprocess_publication.rs
new file mode 100644
index 0000000..9407f2d
--- /dev/null
+++ b/developer-simulation/runs/2026-08-13--municipal-water-meter-billing-repair/tests/subprocess_publication.rs
@@ -0,0 +1,113 @@
+#![cfg(unix)]
+
+use std::fs;
+use std::os::unix::process::ExitStatusExt;
+use std::path::{Path, PathBuf};
+use std::process::{Command, ExitStatus};
+
+use tempfile::tempdir;
+
+const ABORT_SIGNAL: i32 = 6;
+
+fn fixture() -> PathBuf {
+    PathBuf::from(env!("CARGO_MANIFEST_DIR")).join("fixtures/disclosed.json")
+}
+
+fn expected_plan() -> Vec<u8> {
+    fs::read(PathBuf::from(env!("CARGO_MANIFEST_DIR")).join("fixtures/disclosed-expected.json"))
+        .unwrap()
+}
+
+fn run_process(output: &Path, crash_point: Option<&str>) -> ExitStatus {
+    let mut command = Command::new(env!("CARGO_BIN_EXE_water-repair"));
+    command
+        .arg("process")
+        .arg("--input")
+        .arg(fixture())
+        .arg("--output")
+        .arg(output)
+        .arg("--batch-size")
+        .arg("7");
+    if let Some(point) = crash_point {
+        command.arg("--crash").arg(point);
+    }
+    command.status().expect("subprocess starts")
+}
+
+fn temporary_files(directory: &Path) -> Vec<PathBuf> {
+    let mut files: Vec<_> = fs::read_dir(directory)
+        .unwrap()
+        .filter_map(Result::ok)
+        .map(|entry| entry.path())
+        .filter(|path| {
+            path.file_name()
+                .is_some_and(|name| name.to_string_lossy().ends_with(".tmp"))
+        })
+        .collect();
+    files.sort();
+    files
+}
+
+#[test]
+fn abrupt_exit_before_staging_preserves_existing_report_and_creates_no_partial() {
+    let directory = tempdir().unwrap();
+    let output = directory.path().join("plan.json");
+    let prior = b"prior-complete-report\n";
+    fs::write(&output, prior).unwrap();
+
+    let status = run_process(&output, Some("before-staging"));
+
+    assert_eq!(status.signal(), Some(ABORT_SIGNAL));
+    assert_eq!(fs::read(&output).unwrap(), prior);
+    assert!(temporary_files(directory.path()).is_empty());
+}
+
+#[test]
+fn abrupt_exit_before_staging_leaves_requested_report_absent() {
+    let directory = tempdir().unwrap();
+    let output = directory.path().join("plan.json");
+
+    let status = run_process(&output, Some("before-staging"));
+
+    assert_eq!(status.signal(), Some(ABORT_SIGNAL));
+    assert!(!output.exists());
+    assert!(temporary_files(directory.path()).is_empty());
+}
+
+#[test]
+fn abrupt_exit_after_complete_temp_before_final_preserves_existing_report() {
+    let directory = tempdir().unwrap();
+    let output = directory.path().join("plan.json");
+    let prior = b"prior-complete-report\n";
+    fs::write(&output, prior).unwrap();
+
+    let status = run_process(&output, Some("before-final"));
+
+    assert_eq!(status.signal(), Some(ABORT_SIGNAL));
+    assert_eq!(fs::read(&output).unwrap(), prior);
+    let staged = temporary_files(directory.path());
+    assert_eq!(staged.len(), 1, "crash must occur after one complete temp");
+    assert_eq!(fs::read(&staged[0]).unwrap(), expected_plan());
+
+    assert!(run_process(&output, None).success());
+    assert_ne!(fs::read(&output).unwrap(), prior);
+    assert!(temporary_files(directory.path()).is_empty());
+}
+
+#[test]
+fn abrupt_exit_after_complete_temp_leaves_requested_report_absent_until_restart() {
+    let directory = tempdir().unwrap();
+    let output = directory.path().join("plan.json");
+
+    let status = run_process(&output, Some("before-final"));
+
+    assert_eq!(status.signal(), Some(ABORT_SIGNAL));
+    assert!(!output.exists());
+    let staged = temporary_files(directory.path());
+    assert_eq!(staged.len(), 1);
+    assert_eq!(fs::read(&staged[0]).unwrap(), expected_plan());
+
+    assert!(run_process(&output, None).success());
+    assert!(output.exists());
+    assert!(temporary_files(directory.path()).is_empty());
+}
diff --git a/developer-simulation/runs/2026-08-13--municipal-water-meter-billing-repair/tests/temporal_red.rs b/developer-simulation/runs/2026-08-13--municipal-water-meter-billing-repair/tests/temporal_red.rs
new file mode 100644
index 0000000..8b37ca2
--- /dev/null
+++ b/developer-simulation/runs/2026-08-13--municipal-water-meter-billing-repair/tests/temporal_red.rs
@@ -0,0 +1,56 @@
+use water_repair::{
+    BilledInterval, Export, Installation, Reading, ReadingKind, evaluate_candidate,
+};
+
+#[test]
+fn six_digit_maximum_to_zero_is_an_exact_rollover_repair() {
+    let export = Export {
+        installations: vec![Installation {
+            service_point_id: 1,
+            installation_id: 500,
+            meter_id: 10,
+            installed_at: 0,
+            removed_at: None,
+            register_width: 6,
+        }],
+        readings: vec![
+            Reading {
+                service_point_id: 1,
+                meter_id: 10,
+                source_id: 100,
+                at: 0,
+                value_litres: 999_999,
+                kind: ReadingKind::Actual,
+                supersedes: None,
+            },
+            Reading {
+                service_point_id: 1,
+                meter_id: 10,
+                source_id: 101,
+                at: 1,
+                value_litres: 0,
+                kind: ReadingKind::Actual,
+                supersedes: None,
+            },
+        ],
+        billed_intervals: vec![BilledInterval {
+            service_point_id: 1,
+            interval_id: 900,
+            start_at: 0,
+            end_at: 1,
+            issued_usage_litres: 0,
+        }],
+        prior_adjustments: vec![],
+    };
+
+    let plan = evaluate_candidate(&export, 1).expect("valid rollover history");
+    assert!(plan.review_cases.is_empty());
+    assert_eq!(plan.repairs.len(), 1);
+    assert_eq!(plan.repairs[0].old_usage_litres, 0);
+    assert_eq!(plan.repairs[0].recomputed_usage_litres, 1);
+    assert_eq!(plan.repairs[0].adjustment_litres, 1);
+    assert_eq!(plan.repairs[0].source_reading_ids, vec![100, 101]);
+    assert_eq!(plan.repairs[0].installation_ids, vec![500]);
+    assert_eq!(plan.repairs[0].installation_meter_ids, vec![10]);
+    assert_eq!(plan.repairs[0].reason_code, "ROLLOVER_REPAIR");
+}
diff --git a/developer-simulation/runs/2026-08-14--crash-safe-undo-history/BRIEF.md b/developer-simulation/runs/2026-08-14--crash-safe-undo-history/BRIEF.md
new file mode 100644
index 0000000..432121c
--- /dev/null
+++ b/developer-simulation/runs/2026-08-14--crash-safe-undo-history/BRIEF.md
@@ -0,0 +1,86 @@
+# Trial 1: Crash-safe branching undo history for a vector editor
+
+## Developer persona and Rust experience
+
+You maintain the document core of a mature macOS vector-illustration editor. You have eight years of Swift and C++ experience and six months of part-time Rust experience. You are comfortable with ownership basics, enums, tests, and common collection types, but have not designed a Rust persistence layer.
+
+## Existing system and baseline
+
+The editor stores each saved document as canonical JSON. During a session it keeps an in-memory command stack and writes a full-document autosave every 30 seconds. Undo history disappears after a restart, and a crash between autosaves can lose acknowledged edits. Large illustrations make full-document autosaves visibly pause the UI.
+
+For this trial, preserve the canonical JSON format and implement a small reference baseline: append each committed command group as one checksummed JSONL record, write a full canonical JSON snapshot every 2,000 committed groups, and rebuild the in-memory undo stack from the latest valid snapshot plus its tail. Use the same flush policy, fixtures, and host for both implementations.
+
+## Concrete pain
+
+Add persistent undo and redo without making ordinary edits slower or letting recovery produce a document that the user never acknowledged. The difficult cases are grouped edits, undo followed by a new edit, compaction while history remains reversible, duplicate retries after an ambiguous crash, and a torn final write.
+
+## Workload and data shape
+
+Build a deterministic generator for one synthetic illustration containing 60,000 objects. An object has a stable 128-bit ID, z-order position, affine transform represented as six fixed-point integers, visibility, fill color, and zero to 32 path points. Do not use floating-point values.
+
+Generate 250,000 submitted actions across these operations:
+
+- create or delete an object;
+- move, recolor, or toggle visibility;
+- insert, move, or remove a path point;
+- reorder an object;
+- group two to 20 commands atomically;
+- undo or redo one to 50 committed groups; and
+- issue a new group after undo, which invalidates the abandoned redo branch.
+
+Every submitted edit group has a stable client-generated ID. Ten percent of edit-group submissions repeat an earlier ID. The generator must retain enough information for an independent in-memory reference model to compute the expected document, active history head, and available undo and redo counts at every checkpoint.
+
+## Operational constraints
+
+- Run entirely offline in one ordinary user-writable directory on one macOS host.
+- Use one editor writer process and up to four concurrent read-only inspector threads.
+- Keep the canonical saved JSON as the interchange format; the new store is session history, not a new document format.
+- Use at most 256 MiB of measured resident memory and 512 MiB of persistent storage after final compaction.
+- Complete the 250,000-action fault-free run within 90 seconds, keep p95 edit-group commit latency below 4 ms, and reopen the final document within 5 seconds on the declared host.
+- A successful commit response means the group must be present after a process exit. A group interrupted before a response may be wholly present or absent, but never partial. Retrying its stable ID must return the original outcome without applying it twice.
+- No unsafe code, network access, external database server, or privileged service.
+
+## Measurable acceptance criteria
+
+1. Across 30 fixed seeds, the candidate's canonical document digest, active history head, and undo and redo counts equal the independent reference model at every 1,000-action checkpoint.
+2. A group of two to 20 commands is always all-or-nothing. Undo and redo operate on whole groups. A new group after undo makes the abandoned redo path unavailable.
+3. Duplicate group IDs never apply twice and return the same recorded result, including after restart and after compaction.
+4. All 400 injected process-exit trials satisfy the acknowledgement rule and reopen automatically. A truncated or checksum-invalid final record may be discarded with a clear offset-only diagnostic; earlier valid history must remain usable.
+5. Concurrent inspectors see a complete state from either before or after a committed group, never a partially applied group.
+6. Compaction preserves the final document, active head, remaining undo and redo behavior, duplicate-ID outcomes, and at least the most recent 20,000 reversible groups.
+7. Repeating a fault-free seed three times produces byte-identical canonical JSON, document digests, command-result transcript, and diagnostics.
+8. The resource and timing limits above are met. Report candidate and baseline p50 and p95 commit latency, reopen time, peak resident memory, final disk use, and total code size excluding tests and generated fixtures.
+9. Relative to the baseline, the candidate must show at least one material improvement: 40% lower final disk use, 2x faster reopen, or removal of the visible full-snapshot pause measured as a 50% reduction in worst commit latency. It may not regress baseline p95 commit latency or peak memory by more than 25%.
+
+## Explicit non-goals
+
+- Multi-user collaboration, conflict-free replicated data types, cloud synchronization, and network protocols.
+- Rendering, hit testing, file-format migration, thumbnail generation, or graphical UI work.
+- Power-loss guarantees below the operating system's acknowledged write behavior.
+- Infinite history retention; preserving the stated reversible window is enough.
+- Encryption, compression research, or recovery from arbitrary middle-of-file corruption.
+
+## Compact self-contained prototype boundary
+
+Create one command-line harness, one candidate history adapter, the JSONL-plus-snapshot baseline, the pure in-memory reference model, a deterministic fixture generator, and tests. The harness accepts `generate`, `run`, `recover`, `compact`, and `inspect` modes. Its observable output is canonical JSON plus a compact JSON metrics and diagnostic record. Do not integrate with the actual editor or build a GUI.
+
+## Baseline comparison required
+
+Run the candidate and reference baseline over identical generated command groups, flush points, process-exit schedules, hardware, and compiler settings. Correctness gates come before speed. Compare the metrics listed in criterion 8 and identify which persistence concepts had to be written outside the candidate approach. A faster result is not a fit if it weakens acknowledgement, grouping, undo, or recovery behavior.
+
+## Fault and determinism cases
+
+- Exit immediately before append, during encoded-record write, after append but before commit completion, after commit completion but before response, during snapshot creation, during snapshot replacement, and during compaction cleanup.
+- Truncate the final record at every byte position for a small fixture and at 64 deterministic positions for the full fixture.
+- Replay the last 1,000 submitted group IDs after every recovery.
+- Interleave four inspector threads at seeded yield points around commits, undo, redo, and compaction.
+- Run identical logical groups with input arrays allocated in different orders; canonical outputs and diagnostics must remain identical.
+- Attempt an invalid command inside a multi-command group, an undo beyond available history, a redo after branch invalidation, and reuse of a group ID with different content. Each must fail without state change.
+
+## Evidence classification
+
+**Success:** All correctness, recovery, determinism, resource, and baseline gates pass, and the implementation uses the candidate approach for the central journal, transaction, read-view, and compaction behavior rather than as a decorative wrapper.
+
+**Partial fit:** The approach cleanly handles durable grouped commands and ordinary recovery but needs a bounded custom layer for branch semantics, duplicate-ID retention, or compaction; or it passes correctness while missing one performance or storage gate. State exactly which production requirement remains unproved.
+
+**No fit:** It cannot guarantee the acknowledgement and all-or-nothing rules, cannot preserve branch and compaction semantics, exceeds hard resource limits, requires replacing the canonical document model, or is more complex with no measured advantage over the JSONL-plus-snapshot baseline.
diff --git a/developer-simulation/runs/2026-08-14--crash-safe-undo-history/Cargo.toml b/developer-simulation/runs/2026-08-14--crash-safe-undo-history/Cargo.toml
new file mode 100644
index 0000000..5a715d4
--- /dev/null
+++ b/developer-simulation/runs/2026-08-14--crash-safe-undo-history/Cargo.toml
@@ -0,0 +1,14 @@
+[package]
+name = "undo-history-lab"
+version = "0.1.0"
+edition = "2024"
+publish = false
+
+[dependencies]
+crc32fast = "1"
+fold = { path = "../../../fold" }
+serde = { version = "1", features = ["derive"] }
+serde_json = "1"
+
+[dev-dependencies]
+tempfile = "3"
diff --git a/developer-simulation/runs/2026-08-14--crash-safe-undo-history/DISCOVERY.md b/developer-simulation/runs/2026-08-14--crash-safe-undo-history/DISCOVERY.md
new file mode 100644
index 0000000..34eb8fd
--- /dev/null
+++ b/developer-simulation/runs/2026-08-14--crash-safe-undo-history/DISCOVERY.md
@@ -0,0 +1,76 @@
+# Trial 1 discovery notes
+
+## Baseline-first understanding
+
+The required reference baseline is an append-only JSONL journal with one checksummed record per accepted command group, plus a full canonical JSON snapshot every 2,000 accepted groups. Recovery loads the newest valid snapshot, validates and replays its journal tail, and discards only a torn or checksum-invalid final record with an offset-only diagnostic. The same generated actions, durability/flush points, process-exit schedule, compiler settings, and host must be used for the baseline and any candidate.
+
+The baseline is not optional scaffolding. It is the comparison oracle for the candidate's correctness and measurements. Before performance can matter, both implementations must preserve atomic command groups, the active undo/redo branch, duplicate submission outcomes, canonical output, and the acknowledgement boundary. A small prototype can honestly prove only a bounded subset of the 250,000-action/30-seed/400-exit campaign; unrun criteria must be reported as unproved rather than inferred.
+
+## Public onboarding trail (ordered)
+
+1. Read `BRIEF.md` in full.
+2. Read the root `README.md` in full. It recommends generating a new example with `scripts/new-project.sh`, describes the workspace, and points to `cargo doc -pfold` for Fold's internal documentation.
+3. Read every public example manifest and `main.rs`: `starter`, `timeseries`, `chat`, and `search`.
+4. The smallest public persistence example is `starter`. It shows one `Stream`, one writer transaction (`wtx`) containing multiple inserts, and one consistent read transaction (`rtx`) spanning multiple durable views.
+5. `timeseries` demonstrates retractions and incrementally maintained derived views. `chat` demonstrates a single writer plus read snapshots published to concurrent clients. `search` demonstrates keyed update/removal across several indexes.
+
+### Discovery friction so far
+
+1. **Documentation gap:** the root README describes persistence, transactions, and fast materialized reads, but does not state the crash acknowledgement boundary, filesystem sync policy, transaction return/error behavior, or recovery diagnostics needed by this trial.
+2. **Example ambiguity:** examples delete their database directory at startup for determinism, so the primary examples do not demonstrate a close/reopen recovery cycle even though comments say state persists.
+3. **API-shape friction:** `wtx` examples use closure callbacks and do not show rejected transactions, duplicate request IDs, compare-and-set, or a durable commit result. Whether those can be built cleanly is not yet known.
+4. **Scope warning:** the public material presents an incremental database/view engine, not an undo journal. Branching undo, stable-ID idempotency, record-level checksums, and history-retention compaction may require a custom layer even if Fold stores current indexes well.
+
+## Initial component fit hypotheses
+
+### Fold
+
+**Initial hypothesis: possible partial fit; inspect further.** Public examples claim that one `wtx` updates several durable views atomically and that `rtx` sees a consistent snapshot. Those properties could materially help a candidate represent the current document, group/result lookup, and inspector view under one writer. Retractions may help apply inverse commands. However, the public surface does not establish an acknowledgement-after-durable-flush guarantee, ordered replay log, branching history semantics, exact duplicate outcomes, crash injection behavior, or bounded compaction retaining 20,000 reversible groups. Fold is useful only if it carries central transactional/read-view persistence rather than wrapping a separate custom journal decoratively.
+
+### Embedded Static Embeddings (ESE)
+
+**Initial hypothesis: no fit.** ESE maps text to static embeddings for similarity search. This trial has structured fixed-point editor commands and exact recovery requirements, not approximate semantic retrieval. Adding embeddings would increase resource use and would not improve acknowledgement, atomicity, branching, or compaction.
+
+### Approximate Nearest Neighbors (ANNy)
+
+**Initial hypothesis: no fit.** ANNy provides HNSW approximate-nearest-neighbor search. The trial needs exact command identity, deterministic ordering, and canonical state. Approximate retrieval is not on the critical path and cannot serve as a correctness index.
+
+### Public examples as starting points
+
+- `starter`: useful API sketch for atomic multi-view writes and snapshot reads.
+- `timeseries`: useful evidence that retractions can update derived materializations, but its floating-point presentation and aggregation domain are unrelated.
+- `chat`: useful ownership sketch for one writer and many readers; its `watch` broadcasts are process-local and do not prove persistence or crash recovery.
+- `search`: no direct fit beyond keyed upsert/removal semantics; its search indexes are unrelated to exact history.
+
+## Initial selection rule
+
+Proceed only with Fold, and only after a small public-contract spike can show a clean reopen path and clarify commit durability behavior. ESE and ANNy will not be dependencies. If Fold's public API or documented storage contract cannot prove the acknowledgement rule, the honest outcome is a bounded partial-fit reproducer or no-fit result, with the JSONL baseline retained as the reference rather than inventing a new subsystem.
+
+## Post-prototype decision and skeptical review round 1
+
+The smallest meaningful candidate used Fold for one authoritative whole-state value, with the JSONL-plus-snapshot design retained as an independently persisted comparator. This isolated Fold's atomic-write and snapshot-read contribution without claiming that Fold supplies branching undo, command inversion, stable-ID outcomes, or retention. The one-host measurement then decisively rejected that full-state layout: it failed the bounded edit-latency and baseline non-regression gates. The resulting classification is **`local_proof_only_no_production_fit`**, not a subsystem proposal and not a finding against normalized Fold storage.
+
+Skeptical review round 1 returned `REJECTED_UNTIL_FIXED` and identified four prototype correctness gaps. Each was reproduced as a failing test before repair:
+
+1. A recognized partial/checksum-invalid final JSONL tail was ignored in memory but left on disk. A later acknowledged append could join that bad tail and disappear on the next reopen.
+2. `i64::MIN` movement could panic while constructing an inverse after mutation. Destination overflow also needed explicit prevalidation.
+3. Exact stable-ID retries returned the old outcome but still caused persistence work; the baseline also advanced its accepted-group snapshot cadence.
+4. Deduplication treated a 64-bit command digest as authoritative equality instead of preserving exact canonical command content.
+
+The repaired implementation physically truncates a recognized bad final tail, syncs the journal and containing directory before a later append can occur, and still treats middle corruption as fatal. Object and point translation now calculate both inverse and destination values before mutation. Stores distinguish a newly admitted commit from an exact retry, so retries return the original outcome with no write and do not affect snapshot cadence. Dedup records now persist exact canonical command bytes across restart and compaction; the digest remains diagnostic only.
+
+### Additional ordered debugging friction
+
+5. Tail recovery looked correct after one reopen because the in-memory model discarded the bad suffix; only a reopen, later commit, second-reopen test exposed that the disk was never repaired.
+6. Group-level clone-and-apply protected persistent state from an error, but it did not prevent debug-mode arithmetic panic inside a command or satisfy the stronger prevalidation contract.
+7. Stable-ID equality and stable-ID persistence were separate concerns: returning the correct old outcome did not prove that a retry was write-free or that snapshot cadence counted only unique commits.
+8. A convenient fixed-width 64-bit digest was adequate for diagnostics and transcript checks, but not for authoritative command equality. Persisting exact canonical bytes is the smallest repair; inventing a new index or API would be unjustified.
+9. Strict Clippy caught refactoring and test-style issues after the semantic fixes; the final package-scoped strict gate passed without changing BogKit or public examples.
+
+### Revised fit hypotheses after evidence
+
+- **Fold: bounded partial utility, no production fit for this layout.** Atomic whole-state writes and snapshot reads materially helped the local proof. The full-state rewrite failed performance/storage comparison, and concurrency, power-loss, and scale requirements remain unproved.
+- **ESE: no fit, unchanged.** No observed requirement became semantic retrieval.
+- **ANNy: no direct fit, unchanged.** Exact ordered history cannot use approximate equality. Its presence in the dependency tree is a packaging observation through Fold, not a functional defect.
+
+No reviewed failure was traced to BogKit itself. The four rejected-round items were prototype defects. Public durability/reopen guidance remains the smallest plausible upstream improvement; documentation and examples should precede API changes.
diff --git a/developer-simulation/runs/2026-08-14--crash-safe-undo-history/README.md b/developer-simulation/runs/2026-08-14--crash-safe-undo-history/README.md
new file mode 100644
index 0000000..c1788a4
--- /dev/null
+++ b/developer-simulation/runs/2026-08-14--crash-safe-undo-history/README.md
@@ -0,0 +1,90 @@
+# Undo history persistence lab
+
+This is a deliberately small, offline command-line prototype comparing:
+
+- a Fold-backed candidate that stores the complete undo state as one atomic table value; and
+- a checksummed JSONL baseline with a canonical JSON snapshot every 2,000 accepted unique edit groups.
+
+It preserves canonical document JSON as the interchange output. It does not modify BogKit or integrate with an editor.
+
+## Outcome and review state
+
+The bounded outcome is **`local_proof_only_no_production_fit`**. Fold materially supplies an atomic whole-state write and consistent read snapshot, but the tested full-state layout is slower and much larger than the JSONL baseline. This result does not rule out a normalized Fold layout and does not establish a BogKit defect.
+
+Skeptical review round 1 returned `REJECTED_UNTIL_FIXED`. The repaired candidate now:
+
+- physically truncates a recognized incomplete or checksum-invalid final JSONL record to the last valid byte, syncs the file, and syncs its directory before returning from reopen; middle corruption is fatal;
+- checks both inverse and destination coordinate arithmetic before changing an object or point, returning stable `coordinate_overflow` errors for `i64::MIN` and destination overflow;
+- returns the original outcome for exact retries without appending the baseline, rewriting the candidate, or advancing the unique-commit snapshot interval; and
+- persists and compares exact canonical command bytes for deduplication across restart and compaction. The 64-bit digest is diagnostic only.
+
+The scoped re-review approved the repaired prototype for archival with no
+remaining Critical, Important, or Minor findings. This is not a production
+approval.
+
+## What the tests establish
+
+The 24 integration tests cover atomic command groups, whole-group undo/redo, redo-branch invalidation, exact retries and conflicting ID reuse, reopen, a real child-process exit after durable commit but before response, every truncation byte of a small final JSONL record, physical repair of partial and checksum-invalid final tails followed by a later commit and second reopen, fatal middle corruption, snapshot cadence, object/point x/y overflow and rollback, deterministic fixtures, three-way candidate/baseline/reference comparison, and compaction retention of recent undo, remaining redo, outcomes, and exact dedup content. The three adapters share one semantic transition core, so this is not a fully independent semantic oracle.
+
+This is not the requested production-scale campaign. The 60,000-object/250,000-action run, 30 seeds, 400 process exits, four concurrent readers, 20,000-group retention window, peak resident memory, every crash point, and hard total-time/reopen/disk limits remain unproved. The candidate already fails the bounded p95 and baseline non-regression gates, so scaling this layout would not be operationally useful.
+
+## Reproduce
+
+Run from the repository root with the nested lab workspace and its checked-in
+lockfile, without network access:
+
+```console
+cargo fmt --manifest-path developer-simulation/Cargo.toml --package undo-history-lab -- --check
+cargo clippy --manifest-path developer-simulation/Cargo.toml --offline --locked --package undo-history-lab --all-targets -- -D warnings -D clippy::all -D clippy::pedantic
+cargo test --manifest-path developer-simulation/Cargo.toml --offline --locked --package undo-history-lab --all-targets
+```
+
+Run the focused review regressions:
+
+```console
+cargo test --manifest-path developer-simulation/Cargo.toml --offline --locked --package undo-history-lab --test baseline_recovery --test candidate_contract --test model_contract --test overflow_recovery
+```
+
+Generate and compare the bounded 32-object/1,000-action fixture. The output directory must not already contain `candidate.fold` or `baseline`:
+
+```console
+cargo run --manifest-path developer-simulation/Cargo.toml --offline --locked --release --package undo-history-lab -- generate /tmp/undo-fixture.json 9001 32 1000
+cargo run --manifest-path developer-simulation/Cargo.toml --offline --locked --release --package undo-history-lab -- run /tmp/undo-fixture.json /tmp/undo-run
+```
+
+The `run` command prints canonical document JSON followed by one JSON report containing both stores' status, edit-submission latency, reopen time, disk use, checkpoint count, and deterministic transcript digest.
+
+Exercise inspection, recovery, and compaction:
+
+```console
+cargo run --manifest-path developer-simulation/Cargo.toml --offline --locked --release --package undo-history-lab -- inspect candidate /tmp/undo-run/candidate.fold
+cargo run --manifest-path developer-simulation/Cargo.toml --offline --locked --release --package undo-history-lab -- inspect baseline /tmp/undo-run/baseline
+cargo run --manifest-path developer-simulation/Cargo.toml --offline --locked --release --package undo-history-lab -- recover candidate /tmp/undo-run/candidate.fold
+cargo run --manifest-path developer-simulation/Cargo.toml --offline --locked --release --package undo-history-lab -- recover baseline /tmp/undo-run/baseline
+cargo run --manifest-path developer-simulation/Cargo.toml --offline --locked --release --package undo-history-lab -- compact candidate /tmp/undo-run/candidate.fold 20000
+cargo run --manifest-path developer-simulation/Cargo.toml --offline --locked --release --package undo-history-lab -- compact baseline /tmp/undo-run/baseline 20000
+```
+
+The generator defaults to 60,000 objects and 250,000 submitted actions if its last three arguments are omitted. Fixture generation is supported, but running that full-state candidate at the default scale is not claimed safe or within the declared limits.
+
+## CLI
+
+```text
+undo-history-lab generate <fixture.json> [seed] [objects] [actions]
+undo-history-lab run <fixture.json> <output-dir>
+undo-history-lab recover <candidate|baseline> <store>
+undo-history-lab compact <candidate|baseline> <store> [keep]
+undo-history-lab inspect <candidate|baseline> <store>
+```
+
+`fault-commit` is a test-only hidden mode that exits with status 86 after the durable store call and before any response is printed.
+
+## Layout
+
+- `src/lib.rs`: document commands and reference transitions
+- `src/fixture.rs`: deterministic fixture generator
+- `src/baseline.rs`: checksummed JSONL, physical tail repair, and snapshots
+- `src/candidate.rs`: Fold-backed atomic adapter and directory-rebuild compaction
+- `src/runner.rs`: common-workload comparator and metrics
+- `src/main.rs`: CLI
+- `tests/`: acceptance, recovery, fault, determinism, compaction, overflow, and RED-to-GREEN contract tests
diff --git a/developer-simulation/runs/2026-08-14--crash-safe-undo-history/src/baseline.rs b/developer-simulation/runs/2026-08-14--crash-safe-undo-history/src/baseline.rs
new file mode 100644
index 0000000..f1f9f1f
--- /dev/null
+++ b/developer-simulation/runs/2026-08-14--crash-safe-undo-history/src/baseline.rs
@@ -0,0 +1,319 @@
+//! Checksummed JSONL plus snapshot reference baseline.
+
+use std::fs::{self, File, OpenOptions};
+use std::io::Write;
+use std::path::{Path, PathBuf};
+
+use serde::{Deserialize, Serialize};
+
+use crate::{Action, CommitOutcome, Group, HistoryStatus, ModelError, ReferenceModel};
+
+#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
+pub struct RecoveryDiagnostic {
+    pub code: Option<String>,
+    pub discarded_tail_offset: Option<u64>,
+}
+
+#[derive(Serialize, Deserialize)]
+struct JournalRecord {
+    version: u8,
+    action_index: u64,
+    payload: String,
+    crc32: u32,
+}
+
+#[derive(Serialize, Deserialize)]
+struct Snapshot {
+    version: u8,
+    action_index: u64,
+    committed_groups: u64,
+    model: ReferenceModel,
+}
+
+pub struct Baseline {
+    directory: PathBuf,
+    model: ReferenceModel,
+    action_index: u64,
+    committed_groups: u64,
+    snapshot_every: u64,
+    diagnostic: RecoveryDiagnostic,
+}
+
+impl Baseline {
+    pub fn open(directory: impl AsRef<Path>, snapshot_every: u64) -> Result<Self, ModelError> {
+        if snapshot_every == 0 {
+            return Err(ModelError::new(
+                "invalid_snapshot_interval",
+                "snapshot interval must be positive",
+            ));
+        }
+        let directory = directory.as_ref().to_path_buf();
+        fs::create_dir_all(&directory).map_err(io_error)?;
+        let snapshot_path = directory.join("snapshot.json");
+        let (mut model, mut action_index, mut committed_groups) = if snapshot_path.exists() {
+            let bytes = fs::read(&snapshot_path).map_err(io_error)?;
+            let snapshot: Snapshot = serde_json::from_slice(&bytes).map_err(json_error)?;
+            if snapshot.version != 1 {
+                return Err(ModelError::new(
+                    "unsupported_snapshot",
+                    "snapshot version is not supported",
+                ));
+            }
+            (
+                snapshot.model,
+                snapshot.action_index,
+                snapshot.committed_groups,
+            )
+        } else {
+            (ReferenceModel::default(), 0, 0)
+        };
+
+        let journal_path = directory.join("history.jsonl");
+        let (diagnostic, repair_offset) = recover_journal(
+            &journal_path,
+            &mut model,
+            &mut action_index,
+            &mut committed_groups,
+        )?;
+        if let Some(offset) = repair_offset {
+            truncate_and_sync(&journal_path, offset, &directory)?;
+        }
+
+        Ok(Self {
+            directory,
+            model,
+            action_index,
+            committed_groups,
+            snapshot_every,
+            diagnostic,
+        })
+    }
+
+    pub fn commit(&mut self, group: Group) -> Result<CommitOutcome, ModelError> {
+        let mut proposed = self.model.clone();
+        let (outcome, is_new) = proposed.commit_with_admission(group.clone())?;
+        if !is_new {
+            return Ok(outcome);
+        }
+        self.append(&Action::Commit { group })?;
+        self.model = proposed;
+        self.after_append()?;
+        Ok(outcome)
+    }
+
+    pub fn undo(&mut self, count: usize) -> Result<HistoryStatus, ModelError> {
+        let mut proposed = self.model.clone();
+        let status = proposed.undo(count)?;
+        self.append(&Action::Undo { count })?;
+        self.model = proposed;
+        Ok(status)
+    }
+
+    pub fn redo(&mut self, count: usize) -> Result<HistoryStatus, ModelError> {
+        let mut proposed = self.model.clone();
+        let status = proposed.redo(count)?;
+        self.append(&Action::Redo { count })?;
+        self.model = proposed;
+        Ok(status)
+    }
+
+    pub fn compact(&mut self, keep: usize) -> Result<HistoryStatus, ModelError> {
+        self.model.compact(keep);
+        self.write_snapshot()?;
+        let journal = File::create(self.journal_path()).map_err(io_error)?;
+        journal.sync_all().map_err(io_error)?;
+        sync_directory(&self.directory)?;
+        self.model.status()
+    }
+
+    pub fn status(&self) -> Result<HistoryStatus, ModelError> {
+        self.model.status()
+    }
+
+    pub fn canonical_json(&self) -> Result<String, ModelError> {
+        self.model.canonical_json().map_err(json_error)
+    }
+
+    #[must_use]
+    pub fn model(&self) -> &ReferenceModel {
+        &self.model
+    }
+
+    #[must_use]
+    pub fn diagnostic(&self) -> &RecoveryDiagnostic {
+        &self.diagnostic
+    }
+
+    #[must_use]
+    pub fn journal_path(&self) -> PathBuf {
+        self.directory.join("history.jsonl")
+    }
+
+    fn append(&mut self, action: &Action) -> Result<(), ModelError> {
+        let payload = serde_json::to_string(action).map_err(json_error)?;
+        let record = JournalRecord {
+            version: 1,
+            action_index: self.action_index + 1,
+            crc32: crc32fast::hash(payload.as_bytes()),
+            payload,
+        };
+        let mut bytes = serde_json::to_vec(&record).map_err(json_error)?;
+        bytes.push(b'\n');
+        let mut journal = OpenOptions::new()
+            .create(true)
+            .append(true)
+            .open(self.journal_path())
+            .map_err(io_error)?;
+        journal.write_all(&bytes).map_err(io_error)?;
+        journal.sync_all().map_err(io_error)?;
+        self.action_index += 1;
+        if matches!(action, Action::Commit { .. }) {
+            self.committed_groups += 1;
+        }
+        Ok(())
+    }
+
+    fn after_append(&self) -> Result<(), ModelError> {
+        if self.committed_groups.is_multiple_of(self.snapshot_every) {
+            self.write_snapshot()?;
+        }
+        Ok(())
+    }
+
+    fn write_snapshot(&self) -> Result<(), ModelError> {
+        let snapshot = Snapshot {
+            version: 1,
+            action_index: self.action_index,
+            committed_groups: self.committed_groups,
+            model: self.model.clone(),
+        };
+        let bytes = serde_json::to_vec(&snapshot).map_err(json_error)?;
+        let temporary = self.directory.join("snapshot.json.tmp");
+        let final_path = self.directory.join("snapshot.json");
+        {
+            let mut file = File::create(&temporary).map_err(io_error)?;
+            file.write_all(&bytes).map_err(io_error)?;
+            file.sync_all().map_err(io_error)?;
+        }
+        fs::rename(&temporary, &final_path).map_err(io_error)?;
+        sync_directory(&self.directory)
+    }
+}
+
+fn recover_journal(
+    journal_path: &Path,
+    model: &mut ReferenceModel,
+    action_index: &mut u64,
+    committed_groups: &mut u64,
+) -> Result<(RecoveryDiagnostic, Option<usize>), ModelError> {
+    if !journal_path.exists() {
+        return Ok((RecoveryDiagnostic::default(), None));
+    }
+    let bytes = fs::read(journal_path).map_err(io_error)?;
+    let mut offset = 0_usize;
+    while offset < bytes.len() {
+        let Some(relative_end) = bytes[offset..].iter().position(|byte| *byte == b'\n') else {
+            return Ok((tail_diagnostic(offset), Some(offset)));
+        };
+        let end = offset + relative_end;
+        let is_final = end + 1 == bytes.len();
+        let record = match serde_json::from_slice::<JournalRecord>(&bytes[offset..end]) {
+            Ok(record) => record,
+            Err(_) if is_final => return Ok((tail_diagnostic(offset), Some(offset))),
+            Err(error) => {
+                return Err(ModelError::new(
+                    "middle_journal_corruption",
+                    format!("invalid record at offset {offset}: {error}"),
+                ));
+            }
+        };
+        if record.version != 1 || crc32fast::hash(record.payload.as_bytes()) != record.crc32 {
+            if is_final {
+                return Ok((tail_diagnostic(offset), Some(offset)));
+            }
+            return Err(ModelError::new(
+                "middle_journal_corruption",
+                format!("checksum or version failure at offset {offset}"),
+            ));
+        }
+        if record.action_index > *action_index {
+            if record.action_index != *action_index + 1 {
+                return Err(ModelError::new(
+                    "journal_sequence_gap",
+                    format!(
+                        "expected action index {}, found {}",
+                        *action_index + 1,
+                        record.action_index
+                    ),
+                ));
+            }
+            apply_recovered_record(&record, model, offset, committed_groups)?;
+            *action_index = record.action_index;
+        }
+        offset = end + 1;
+    }
+    Ok((RecoveryDiagnostic::default(), None))
+}
+
+fn apply_recovered_record(
+    record: &JournalRecord,
+    model: &mut ReferenceModel,
+    offset: usize,
+    committed_groups: &mut u64,
+) -> Result<(), ModelError> {
+    let action: Action = serde_json::from_str(&record.payload).map_err(json_error)?;
+    let unique_commit = match action {
+        Action::Commit { group } => model
+            .commit_with_admission(group)
+            .map(|(_outcome, is_new)| is_new),
+        Action::Undo { count } => model.undo(count).map(|_status| false),
+        Action::Redo { count } => model.redo(count).map(|_status| false),
+    }
+    .map_err(|error| {
+        ModelError::new(
+            "invalid_journal_action",
+            format!("offset {offset}: {error}"),
+        )
+    })?;
+    if unique_commit {
+        *committed_groups += 1;
+    }
+    Ok(())
+}
+
+fn tail_diagnostic(offset: usize) -> RecoveryDiagnostic {
+    RecoveryDiagnostic {
+        code: Some("discarded_invalid_final_record".to_string()),
+        discarded_tail_offset: Some(offset as u64),
+    }
+}
+
+fn truncate_and_sync(
+    journal_path: &Path,
+    offset: usize,
+    directory: &Path,
+) -> Result<(), ModelError> {
+    let journal = OpenOptions::new()
+        .write(true)
+        .open(journal_path)
+        .map_err(io_error)?;
+    let valid_len = u64::try_from(offset)
+        .map_err(|error| ModelError::new("journal_offset_overflow", error.to_string()))?;
+    journal.set_len(valid_len).map_err(io_error)?;
+    journal.sync_all().map_err(io_error)?;
+    sync_directory(directory)
+}
+
+fn sync_directory(path: &Path) -> Result<(), ModelError> {
+    File::open(path)
+        .and_then(|file| file.sync_all())
+        .map_err(io_error)
+}
+
+fn io_error(error: impl std::fmt::Display) -> ModelError {
+    ModelError::new("io_error", error.to_string())
+}
+
+fn json_error(error: impl std::fmt::Display) -> ModelError {
+    ModelError::new("serialization_error", error.to_string())
+}
diff --git a/developer-simulation/runs/2026-08-14--crash-safe-undo-history/src/candidate.rs b/developer-simulation/runs/2026-08-14--crash-safe-undo-history/src/candidate.rs
new file mode 100644
index 0000000..7e9ff66
--- /dev/null
+++ b/developer-simulation/runs/2026-08-14--crash-safe-undo-history/src/candidate.rs
@@ -0,0 +1,189 @@
+//! Fold-backed candidate adapter.
+//!
+//! The entire logical state is one typed Fold table value. This deliberately
+//! small adapter exercises Fold's central atomic transaction, durable commit,
+//! and snapshot read behavior. It is not claimed to be the production data
+//! layout for the full 60,000-object workload.
+
+use std::path::{Path, PathBuf};
+use std::{fs, fs::File};
+
+use fold::pipeline::{Keyed, terminal};
+use fold::stream::Stream;
+
+use crate::{CommitOutcome, Group, HistoryStatus, ModelError, ReferenceModel};
+
+type StateStream = Stream<Keyed<u8, Vec<u8>>, terminal::Table<u8, Vec<u8>>>;
+
+pub struct Candidate {
+    path: PathBuf,
+    stream: StateStream,
+    model: ReferenceModel,
+}
+
+impl Candidate {
+    pub fn open(path: impl AsRef<Path>) -> Result<Self, ModelError> {
+        let path = path.as_ref().to_path_buf();
+        let stream: StateStream = std::panic::catch_unwind({
+            let path = path.clone();
+            move || {
+                Stream::<Keyed<u8, Vec<u8>>, terminal::Table<u8, Vec<u8>>>::new(
+                    path,
+                    terminal::Table::<u8, Vec<u8>>::new("undo_state"),
+                )
+            }
+        })
+        .map_err(|_| ModelError::new("store_open_failed", "Fold could not open the store"))?;
+        let model = stream
+            .rtx(|state| state.get(&0))
+            .map_or_else(|| Ok(ReferenceModel::default()), |bytes| decode(&bytes))?;
+        Ok(Self {
+            path,
+            stream,
+            model,
+        })
+    }
+
+    pub fn commit(&mut self, group: Group) -> Result<CommitOutcome, ModelError> {
+        let before = self.model.clone();
+        let (outcome, is_new) = self.model.commit_with_admission(group)?;
+        if !is_new {
+            return Ok(outcome);
+        }
+        if let Err(error) = self.persist() {
+            self.model = before;
+            return Err(error);
+        }
+        Ok(outcome)
+    }
+
+    pub fn undo(&mut self, count: usize) -> Result<HistoryStatus, ModelError> {
+        let before = self.model.clone();
+        let status = self.model.undo(count)?;
+        if let Err(error) = self.persist() {
+            self.model = before;
+            return Err(error);
+        }
+        Ok(status)
+    }
+
+    pub fn redo(&mut self, count: usize) -> Result<HistoryStatus, ModelError> {
+        let before = self.model.clone();
+        let status = self.model.redo(count)?;
+        if let Err(error) = self.persist() {
+            self.model = before;
+            return Err(error);
+        }
+        Ok(status)
+    }
+
+    pub fn compact(&mut self, keep: usize) -> Result<HistoryStatus, ModelError> {
+        let before = self.model.clone();
+        self.model.compact(keep);
+        if let Err(error) = self.persist() {
+            self.model = before;
+            return Err(error);
+        }
+        self.status()
+    }
+
+    pub fn status(&self) -> Result<HistoryStatus, ModelError> {
+        self.stream.rtx(|state| state.get(&0)).map_or_else(
+            || ReferenceModel::default().status(),
+            |bytes| decode(&bytes)?.status(),
+        )
+    }
+
+    pub fn canonical_json(&self) -> Result<String, ModelError> {
+        self.stream.rtx(|state| state.get(&0)).map_or_else(
+            || {
+                ReferenceModel::default()
+                    .canonical_json()
+                    .map_err(json_error)
+            },
+            |bytes| decode(&bytes)?.canonical_json().map_err(json_error),
+        )
+    }
+
+    #[must_use]
+    pub fn model(&self) -> &ReferenceModel {
+        &self.model
+    }
+
+    #[must_use]
+    pub fn path(&self) -> &Path {
+        &self.path
+    }
+
+    fn persist(&mut self) -> Result<(), ModelError> {
+        let bytes = serde_json::to_vec(&self.model).map_err(json_error)?;
+        self.stream.wtx(|tx| tx.insert(&Keyed::new(0, bytes)));
+        self.stream.checkpoint();
+        Ok(())
+    }
+}
+
+pub fn compact_directory(path: impl AsRef<Path>, keep: usize) -> Result<HistoryStatus, ModelError> {
+    let path = path.as_ref();
+    let parent = path.parent().ok_or_else(|| {
+        ModelError::new(
+            "invalid_store_path",
+            "candidate store needs a parent directory",
+        )
+    })?;
+    let name = path
+        .file_name()
+        .and_then(|name| name.to_str())
+        .ok_or_else(|| {
+            ModelError::new(
+                "invalid_store_path",
+                "candidate store name is not valid UTF-8",
+            )
+        })?;
+    let temporary = parent.join(format!("{name}.compact.tmp"));
+    let backup = parent.join(format!("{name}.compact.backup"));
+    if temporary.exists() || backup.exists() {
+        return Err(ModelError::new(
+            "compaction_artifact_exists",
+            "remove or recover the existing compaction artifact first",
+        ));
+    }
+
+    let old = Candidate::open(path)?;
+    let mut model = old.model.clone();
+    model.compact(keep);
+    drop(old);
+    {
+        let mut replacement = Candidate::open(&temporary)?;
+        replacement.model = model;
+        replacement.persist()?;
+    }
+
+    fs::rename(path, &backup).map_err(io_error)?;
+    if let Err(error) = fs::rename(&temporary, path) {
+        let _ = fs::rename(&backup, path);
+        return Err(io_error(error));
+    }
+    sync_directory(parent)?;
+    fs::remove_dir_all(&backup).map_err(io_error)?;
+    sync_directory(parent)?;
+    Candidate::open(path)?.status()
+}
+
+fn decode(bytes: &[u8]) -> Result<ReferenceModel, ModelError> {
+    serde_json::from_slice(bytes).map_err(json_error)
+}
+
+fn json_error(error: impl std::fmt::Display) -> ModelError {
+    ModelError::new("serialization_error", error.to_string())
+}
+
+fn io_error(error: impl std::fmt::Display) -> ModelError {
+    ModelError::new("io_error", error.to_string())
+}
+
+fn sync_directory(path: &Path) -> Result<(), ModelError> {
+    File::open(path)
+        .and_then(|directory| directory.sync_all())
+        .map_err(io_error)
+}
diff --git a/developer-simulation/runs/2026-08-14--crash-safe-undo-history/src/fixture.rs b/developer-simulation/runs/2026-08-14--crash-safe-undo-history/src/fixture.rs
new file mode 100644
index 0000000..91e57ea
--- /dev/null
+++ b/developer-simulation/runs/2026-08-14--crash-safe-undo-history/src/fixture.rs
@@ -0,0 +1,245 @@
+//! Deterministic synthetic illustration and submitted-action generator.
+
+use serde::{Deserialize, Serialize};
+
+use crate::{Action, Command, Group, HistoryStatus, ModelError, Object, ReferenceModel};
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+pub struct Checkpoint {
+    pub at_action: usize,
+    pub status: HistoryStatus,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+pub struct Fixture {
+    pub version: u8,
+    pub seed: u64,
+    pub initial_objects: Vec<Object>,
+    pub actions: Vec<Action>,
+    pub checkpoints: Vec<Checkpoint>,
+    pub edit_submissions: usize,
+    pub duplicate_edit_submissions: usize,
+    pub expected_final: HistoryStatus,
+}
+
+pub fn generate_fixture(
+    seed: u64,
+    object_count: usize,
+    action_count: usize,
+) -> Result<Fixture, ModelError> {
+    if object_count == 0 {
+        return Err(ModelError::new(
+            "invalid_object_count",
+            "at least one initial object is required",
+        ));
+    }
+    let mut random = XorShift64::new(seed);
+    let initial_objects: Vec<Object> = (0..object_count)
+        .map(|index| make_object(seed, index as u64, &mut random))
+        .collect();
+    let mut shadow = ReferenceModel::default();
+    for (chunk_index, chunk) in initial_objects.chunks(20).enumerate() {
+        shadow.commit(Group::new(
+            format!("seed-{seed}-initial-{chunk_index}"),
+            chunk
+                .iter()
+                .cloned()
+                .map(|object| Command::Create { object })
+                .collect(),
+        ))?;
+    }
+
+    let mut actions = Vec::with_capacity(action_count);
+    let mut checkpoints = Vec::with_capacity(action_count / 1_000);
+    let mut accepted_groups = Vec::<Group>::new();
+    let mut edit_submissions = 0_usize;
+    let mut duplicate_edit_submissions = 0_usize;
+    let mut next_object = object_count as u64;
+
+    for action_index in 0..action_count {
+        let action = if action_index % 50 == 48 && shadow.undo_count() > 0 {
+            Action::Undo {
+                count: 1 + random.usize(shadow.undo_count().min(4)),
+            }
+        } else if action_index % 50 == 49 && shadow.redo_count() > 0 {
+            Action::Redo {
+                count: 1 + random.usize(shadow.redo_count().min(4)),
+            }
+        } else if action_index % 37 == 36 && shadow.undo_count() > 0 {
+            Action::Undo {
+                count: 1 + random.usize(shadow.undo_count().min(3)),
+            }
+        } else {
+            edit_submissions += 1;
+            let group = if edit_submissions.is_multiple_of(10) && !accepted_groups.is_empty() {
+                duplicate_edit_submissions += 1;
+                accepted_groups[(edit_submissions / 10 - 1) % accepted_groups.len()].clone()
+            } else {
+                let command_count = 2 + random.usize(5);
+                let mut trial = shadow.clone();
+                let mut commands = Vec::with_capacity(command_count);
+                for command_index in 0..command_count {
+                    let command = generate_command(
+                        &trial,
+                        seed,
+                        &mut next_object,
+                        edit_submissions + command_index,
+                        &mut random,
+                    );
+                    trial.commit(Group::new(
+                        format!("generator-{action_index}-{command_index}"),
+                        vec![command.clone()],
+                    ))?;
+                    commands.push(command);
+                }
+                let group = Group::new(format!("seed-{seed}-group-{edit_submissions}"), commands);
+                accepted_groups.push(group.clone());
+                group
+            };
+            Action::Commit { group }
+        };
+        shadow.apply_action(&action)?;
+        actions.push(action);
+        if (action_index + 1) % 1_000 == 0 {
+            checkpoints.push(Checkpoint {
+                at_action: action_index + 1,
+                status: shadow.status()?,
+            });
+        }
+    }
+
+    Ok(Fixture {
+        version: 1,
+        seed,
+        initial_objects,
+        actions,
+        checkpoints,
+        edit_submissions,
+        duplicate_edit_submissions,
+        expected_final: shadow.status()?,
+    })
+}
+
+pub fn seed_model(model: &mut ReferenceModel, fixture: &Fixture) -> Result<(), ModelError> {
+    for (chunk_index, chunk) in fixture.initial_objects.chunks(20).enumerate() {
+        model.commit(Group::new(
+            format!("seed-{}-initial-{chunk_index}", fixture.seed),
+            chunk
+                .iter()
+                .cloned()
+                .map(|object| Command::Create { object })
+                .collect(),
+        ))?;
+    }
+    Ok(())
+}
+
+fn generate_command(
+    model: &ReferenceModel,
+    seed: u64,
+    next_object: &mut u64,
+    ordinal: usize,
+    random: &mut XorShift64,
+) -> Command {
+    let ids: Vec<u128> = model.document().objects().keys().copied().collect();
+    let id = ids[random.usize(ids.len())];
+    let object = &model.document().objects()[&id];
+    match ordinal % 9 {
+        0 => {
+            let object = make_object(seed ^ 0xa5a5_a5a5_a5a5_a5a5, *next_object, random);
+            *next_object += 1;
+            Command::Create { object }
+        }
+        1 if ids.len() > 4 => Command::Delete { id },
+        2 => Command::Move {
+            id,
+            dx: random.i64(-500, 500),
+            dy: random.i64(-500, 500),
+        },
+        3 => Command::Recolor {
+            id,
+            fill: random.next_u32() | 0xff,
+        },
+        4 => Command::ToggleVisibility { id },
+        5 if object.points.len() < 32 => Command::InsertPoint {
+            id,
+            index: random.usize(object.points.len() + 1),
+            point: (random.i64(-10_000, 10_000), random.i64(-10_000, 10_000)),
+        },
+        6 if !object.points.is_empty() => Command::MovePoint {
+            id,
+            index: random.usize(object.points.len()),
+            dx: random.i64(-100, 100),
+            dy: random.i64(-100, 100),
+        },
+        7 if !object.points.is_empty() => Command::RemovePoint {
+            id,
+            index: random.usize(object.points.len()),
+        },
+        _ => Command::Reorder {
+            id,
+            z: random.i64(-1_000_000, 1_000_000),
+        },
+    }
+}
+
+fn make_object(seed: u64, ordinal: u64, random: &mut XorShift64) -> Object {
+    let id = (u128::from(seed) << 64) | u128::from(ordinal + 1);
+    let point_count = random.usize(33);
+    let points = (0..point_count)
+        .map(|_| (random.i64(-10_000, 10_000), random.i64(-10_000, 10_000)))
+        .collect();
+    Object {
+        id,
+        z: i64::try_from(ordinal).unwrap_or(i64::MAX),
+        transform: [
+            1_000,
+            random.i64(-50, 50),
+            random.i64(-50, 50),
+            1_000,
+            random.i64(-100_000, 100_000),
+            random.i64(-100_000, 100_000),
+        ],
+        visible: random.next_u64() & 1 == 0,
+        fill: random.next_u32() | 0xff,
+        points,
+    }
+}
+
+#[derive(Clone, Copy)]
+struct XorShift64(u64);
+
+impl XorShift64 {
+    fn new(seed: u64) -> Self {
+        Self(seed.max(1))
+    }
+
+    fn next_u64(&mut self) -> u64 {
+        let mut value = self.0;
+        value ^= value << 13;
+        value ^= value >> 7;
+        value ^= value << 17;
+        self.0 = value;
+        value
+    }
+
+    fn usize(&mut self, upper: usize) -> usize {
+        debug_assert!(upper > 0);
+        let upper_u64 = u64::try_from(upper).expect("usize fits in u64 on supported hosts");
+        usize::try_from(self.next_u64() % upper_u64)
+            .expect("remainder is strictly smaller than the usize upper bound")
+    }
+
+    fn i64(&mut self, lower: i64, upper: i64) -> i64 {
+        debug_assert!(lower <= upper);
+        let width = u64::try_from(upper - lower + 1).expect("generator range width is positive");
+        let offset = i64::try_from(self.next_u64() % width)
+            .expect("generator range widths are bounded by i64::MAX");
+        lower + offset
+    }
+
+    fn next_u32(&mut self) -> u32 {
+        let bytes = self.next_u64().to_le_bytes();
+        u32::from_le_bytes([bytes[0], bytes[1], bytes[2], bytes[3]])
+    }
+}
diff --git a/developer-simulation/runs/2026-08-14--crash-safe-undo-history/src/lib.rs b/developer-simulation/runs/2026-08-14--crash-safe-undo-history/src/lib.rs
new file mode 100644
index 0000000..a8afd60
--- /dev/null
+++ b/developer-simulation/runs/2026-08-14--crash-safe-undo-history/src/lib.rs
@@ -0,0 +1,537 @@
+#![allow(clippy::missing_errors_doc)]
+
+use std::collections::BTreeMap;
+use std::fmt::{Display, Formatter};
+
+use serde::{Deserialize, Serialize};
+
+pub mod baseline;
+pub mod candidate;
+pub mod fixture;
+pub mod runner;
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+pub struct Object {
+    #[serde(with = "u128_string")]
+    pub id: u128,
+    pub z: i64,
+    pub transform: [i64; 6],
+    pub visible: bool,
+    pub fill: u32,
+    pub points: Vec<(i64, i64)>,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(tag = "op", rename_all = "snake_case")]
+pub enum Command {
+    Create {
+        object: Object,
+    },
+    Delete {
+        #[serde(with = "u128_string")]
+        id: u128,
+    },
+    Move {
+        #[serde(with = "u128_string")]
+        id: u128,
+        dx: i64,
+        dy: i64,
+    },
+    Recolor {
+        #[serde(with = "u128_string")]
+        id: u128,
+        fill: u32,
+    },
+    ToggleVisibility {
+        #[serde(with = "u128_string")]
+        id: u128,
+    },
+    InsertPoint {
+        #[serde(with = "u128_string")]
+        id: u128,
+        index: usize,
+        point: (i64, i64),
+    },
+    MovePoint {
+        #[serde(with = "u128_string")]
+        id: u128,
+        index: usize,
+        dx: i64,
+        dy: i64,
+    },
+    RemovePoint {
+        #[serde(with = "u128_string")]
+        id: u128,
+        index: usize,
+    },
+    Reorder {
+        #[serde(with = "u128_string")]
+        id: u128,
+        z: i64,
+    },
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+pub struct Group {
+    pub id: String,
+    pub commands: Vec<Command>,
+}
+
+impl Group {
+    #[must_use]
+    pub fn new(id: impl Into<String>, commands: Vec<Command>) -> Self {
+        Self {
+            id: id.into(),
+            commands,
+        }
+    }
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(tag = "action", rename_all = "snake_case")]
+pub enum Action {
+    Commit { group: Group },
+    Undo { count: usize },
+    Redo { count: usize },
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+pub struct CommitOutcome {
+    pub group_id: String,
+    pub sequence: u64,
+    pub document_digest: String,
+    pub undo_count: usize,
+    pub redo_count: usize,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+pub struct HistoryStatus {
+    pub document_digest: String,
+    pub active_head: Option<u64>,
+    pub undo_count: usize,
+    pub redo_count: usize,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+pub struct ModelError {
+    code: String,
+    message: String,
+}
+
+impl ModelError {
+    #[must_use]
+    pub fn new(code: impl Into<String>, message: impl Into<String>) -> Self {
+        Self {
+            code: code.into(),
+            message: message.into(),
+        }
+    }
+
+    #[must_use]
+    pub fn code(&self) -> &str {
+        &self.code
+    }
+}
+
+impl Display for ModelError {
+    fn fmt(&self, f: &mut Formatter<'_>) -> std::fmt::Result {
+        write!(f, "{}: {}", self.code, self.message)
+    }
+}
+
+impl std::error::Error for ModelError {}
+
+#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
+pub struct Document {
+    objects: BTreeMap<u128, Object>,
+}
+
+impl Document {
+    #[must_use]
+    pub fn objects(&self) -> &BTreeMap<u128, Object> {
+        &self.objects
+    }
+
+    pub fn canonical_json(&self) -> Result<String, serde_json::Error> {
+        #[derive(Serialize)]
+        struct Canonical<'a> {
+            objects: Vec<&'a Object>,
+        }
+        serde_json::to_string(&Canonical {
+            objects: self.objects.values().collect(),
+        })
+    }
+
+    pub fn digest(&self) -> Result<String, serde_json::Error> {
+        Ok(fnv1a64(self.canonical_json()?.as_bytes()))
+    }
+
+    fn apply(&mut self, command: &Command) -> Result<Command, ModelError> {
+        match command {
+            Command::Create { object } => {
+                if self.objects.contains_key(&object.id) {
+                    return Err(ModelError::new(
+                        "object_exists",
+                        format!("object {} already exists", object.id),
+                    ));
+                }
+                self.objects.insert(object.id, object.clone());
+                Ok(Command::Delete { id: object.id })
+            }
+            Command::Delete { id } => {
+                let object = self.objects.remove(id).ok_or_else(|| missing(*id))?;
+                Ok(Command::Create { object })
+            }
+            Command::Move { id, dx, dy } => {
+                let object = self.objects.get(id).ok_or_else(|| missing(*id))?;
+                let arithmetic =
+                    checked_translation((object.transform[4], object.transform[5]), (*dx, *dy))?;
+                let object = self.objects.get_mut(id).ok_or_else(|| missing(*id))?;
+                object.transform[4] = arithmetic.destination.0;
+                object.transform[5] = arithmetic.destination.1;
+                Ok(Command::Move {
+                    id: *id,
+                    dx: arithmetic.inverse.0,
+                    dy: arithmetic.inverse.1,
+                })
+            }
+            Command::Recolor { id, fill } => {
+                let object = self.objects.get_mut(id).ok_or_else(|| missing(*id))?;
+                let old = std::mem::replace(&mut object.fill, *fill);
+                Ok(Command::Recolor { id: *id, fill: old })
+            }
+            Command::ToggleVisibility { id } => {
+                let object = self.objects.get_mut(id).ok_or_else(|| missing(*id))?;
+                object.visible = !object.visible;
+                Ok(Command::ToggleVisibility { id: *id })
+            }
+            Command::InsertPoint { id, index, point } => {
+                let object = self.objects.get_mut(id).ok_or_else(|| missing(*id))?;
+                if *index > object.points.len() || object.points.len() == 32 {
+                    return Err(ModelError::new(
+                        "invalid_point_index",
+                        format!("cannot insert point {index}"),
+                    ));
+                }
+                object.points.insert(*index, *point);
+                Ok(Command::RemovePoint {
+                    id: *id,
+                    index: *index,
+                })
+            }
+            Command::MovePoint { id, index, dx, dy } => {
+                let object = self.objects.get(id).ok_or_else(|| missing(*id))?;
+                let point = object.points.get(*index).ok_or_else(|| {
+                    ModelError::new(
+                        "invalid_point_index",
+                        format!("point {index} does not exist"),
+                    )
+                })?;
+                let arithmetic = checked_translation(*point, (*dx, *dy))?;
+                let object = self.objects.get_mut(id).ok_or_else(|| missing(*id))?;
+                let point = object.points.get_mut(*index).ok_or_else(|| {
+                    ModelError::new(
+                        "invalid_point_index",
+                        format!("point {index} does not exist"),
+                    )
+                })?;
+                *point = arithmetic.destination;
+                Ok(Command::MovePoint {
+                    id: *id,
+                    index: *index,
+                    dx: arithmetic.inverse.0,
+                    dy: arithmetic.inverse.1,
+                })
+            }
+            Command::RemovePoint { id, index } => {
+                let object = self.objects.get_mut(id).ok_or_else(|| missing(*id))?;
+                if *index >= object.points.len() {
+                    return Err(ModelError::new(
+                        "invalid_point_index",
+                        format!("point {index} does not exist"),
+                    ));
+                }
+                let point = object.points.remove(*index);
+                Ok(Command::InsertPoint {
+                    id: *id,
+                    index: *index,
+                    point,
+                })
+            }
+            Command::Reorder { id, z } => {
+                let object = self.objects.get_mut(id).ok_or_else(|| missing(*id))?;
+                let old = std::mem::replace(&mut object.z, *z);
+                Ok(Command::Reorder { id: *id, z: old })
+            }
+        }
+    }
+}
+
+struct TranslationArithmetic {
+    destination: (i64, i64),
+    inverse: (i64, i64),
+}
+
+fn checked_translation(
+    current: (i64, i64),
+    delta: (i64, i64),
+) -> Result<TranslationArithmetic, ModelError> {
+    let inverse = (
+        delta.0.checked_neg().ok_or_else(|| {
+            ModelError::new("coordinate_overflow", "x translation inverse overflow")
+        })?,
+        delta.1.checked_neg().ok_or_else(|| {
+            ModelError::new("coordinate_overflow", "y translation inverse overflow")
+        })?,
+    );
+    let destination = (
+        current
+            .0
+            .checked_add(delta.0)
+            .ok_or_else(|| ModelError::new("coordinate_overflow", "x translation overflow"))?,
+        current
+            .1
+            .checked_add(delta.1)
+            .ok_or_else(|| ModelError::new("coordinate_overflow", "y translation overflow"))?,
+    );
+    Ok(TranslationArithmetic {
+        destination,
+        inverse,
+    })
+}
+
+fn missing(id: u128) -> ModelError {
+    ModelError::new("missing_object", format!("object {id} does not exist"))
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+pub struct HistoryEntry {
+    sequence: u64,
+    group: Group,
+    inverse: Vec<Command>,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+struct DedupEntry {
+    canonical_commands: Vec<u8>,
+    diagnostic_fingerprint: String,
+    outcome: CommitOutcome,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+pub struct ReferenceModel {
+    document: Document,
+    history: Vec<HistoryEntry>,
+    cursor: usize,
+    dedup: BTreeMap<String, DedupEntry>,
+    next_sequence: u64,
+}
+
+impl Default for ReferenceModel {
+    fn default() -> Self {
+        Self {
+            document: Document::default(),
+            history: Vec::new(),
+            cursor: 0,
+            dedup: BTreeMap::new(),
+            next_sequence: 1,
+        }
+    }
+}
+
+impl ReferenceModel {
+    pub fn commit(&mut self, group: Group) -> Result<CommitOutcome, ModelError> {
+        self.commit_with_admission(group)
+            .map(|(outcome, _is_new)| outcome)
+    }
+
+    pub(crate) fn commit_with_admission(
+        &mut self,
+        group: Group,
+    ) -> Result<(CommitOutcome, bool), ModelError> {
+        if group.commands.is_empty() || group.commands.len() > 20 {
+            return Err(ModelError::new(
+                "invalid_group_size",
+                "a group must contain 1 to 20 commands",
+            ));
+        }
+        let canonical_commands = canonical_commands(&group.commands)?;
+        if let Some(old) = self.dedup.get(&group.id) {
+            return if old.canonical_commands == canonical_commands {
+                Ok((old.outcome.clone(), false))
+            } else {
+                Err(ModelError::new(
+                    "group_id_conflict",
+                    format!("group {} was already used with different content", group.id),
+                ))
+            };
+        }
+
+        let before = self.document.clone();
+        let mut inverse = Vec::with_capacity(group.commands.len());
+        for command in &group.commands {
+            match self.document.apply(command) {
+                Ok(command) => inverse.push(command),
+                Err(error) => {
+                    self.document = before;
+                    return Err(error);
+                }
+            }
+        }
+
+        self.history.truncate(self.cursor);
+        let sequence = self.next_sequence;
+        self.next_sequence += 1;
+        self.history.push(HistoryEntry {
+            sequence,
+            group: group.clone(),
+            inverse,
+        });
+        self.cursor = self.history.len();
+        let outcome = CommitOutcome {
+            group_id: group.id.clone(),
+            sequence,
+            document_digest: self.document.digest().map_err(json_error)?,
+            undo_count: self.undo_count(),
+            redo_count: self.redo_count(),
+        };
+        let diagnostic_fingerprint = fnv1a64(&canonical_commands);
+        self.dedup.insert(
+            group.id,
+            DedupEntry {
+                canonical_commands,
+                diagnostic_fingerprint,
+                outcome: outcome.clone(),
+            },
+        );
+        Ok((outcome, true))
+    }
+
+    pub fn apply_action(&mut self, action: &Action) -> Result<HistoryStatus, ModelError> {
+        match action {
+            Action::Commit { group } => {
+                self.commit(group.clone())?;
+                self.status()
+            }
+            Action::Undo { count } => self.undo(*count),
+            Action::Redo { count } => self.redo(*count),
+        }
+    }
+
+    pub fn undo(&mut self, count: usize) -> Result<HistoryStatus, ModelError> {
+        if count > self.cursor {
+            return Err(ModelError::new(
+                "undo_beyond_history",
+                format!("cannot undo {count} groups"),
+            ));
+        }
+        for _ in 0..count {
+            let entry = &self.history[self.cursor - 1];
+            for inverse in entry.inverse.iter().rev() {
+                self.document.apply(inverse).map_err(|error| {
+                    ModelError::new("internal_inverse_error", error.to_string())
+                })?;
+            }
+            self.cursor -= 1;
+        }
+        self.status()
+    }
+
+    pub fn redo(&mut self, count: usize) -> Result<HistoryStatus, ModelError> {
+        if count > self.redo_count() {
+            return Err(ModelError::new(
+                "redo_beyond_history",
+                format!("cannot redo {count} groups"),
+            ));
+        }
+        for _ in 0..count {
+            let entry = &self.history[self.cursor];
+            for command in &entry.group.commands {
+                self.document
+                    .apply(command)
+                    .map_err(|error| ModelError::new("internal_redo_error", error.to_string()))?;
+            }
+            self.cursor += 1;
+        }
+        self.status()
+    }
+
+    pub fn status(&self) -> Result<HistoryStatus, ModelError> {
+        Ok(HistoryStatus {
+            document_digest: self.document.digest().map_err(json_error)?,
+            active_head: self
+                .cursor
+                .checked_sub(1)
+                .map(|index| self.history[index].sequence),
+            undo_count: self.undo_count(),
+            redo_count: self.redo_count(),
+        })
+    }
+
+    #[must_use]
+    pub fn undo_count(&self) -> usize {
+        self.cursor
+    }
+
+    #[must_use]
+    pub fn redo_count(&self) -> usize {
+        self.history.len() - self.cursor
+    }
+
+    #[must_use]
+    pub fn document(&self) -> &Document {
+        &self.document
+    }
+
+    pub fn canonical_json(&self) -> Result<String, serde_json::Error> {
+        self.document.canonical_json()
+    }
+
+    #[must_use]
+    pub fn history_len(&self) -> usize {
+        self.history.len()
+    }
+
+    pub fn compact(&mut self, keep: usize) {
+        if self.history.len() <= keep {
+            return;
+        }
+        let drop_count = (self.history.len() - keep).min(self.cursor);
+        if drop_count == 0 {
+            return;
+        }
+        self.history.drain(..drop_count);
+        self.cursor -= drop_count;
+    }
+}
+
+fn canonical_commands(commands: &[Command]) -> Result<Vec<u8>, ModelError> {
+    serde_json::to_vec(commands).map_err(json_error)
+}
+
+fn json_error(error: impl Display) -> ModelError {
+    ModelError::new("serialization_error", error.to_string())
+}
+
+#[must_use]
+pub fn fnv1a64(bytes: &[u8]) -> String {
+    let mut hash = 0xcbf2_9ce4_8422_2325_u64;
+    for byte in bytes {
+        hash ^= u64::from(*byte);
+        hash = hash.wrapping_mul(0x0000_0100_0000_01b3);
+    }
+    format!("{hash:016x}")
+}
+
+mod u128_string {
+    use serde::{Deserialize, Deserializer, Serializer};
+
+    pub fn serialize<S: Serializer>(value: &u128, serializer: S) -> Result<S::Ok, S::Error> {
+        serializer.serialize_str(&format!("{value:032x}"))
+    }
+
+    pub fn deserialize<'de, D: Deserializer<'de>>(deserializer: D) -> Result<u128, D::Error> {
+        let value = String::deserialize(deserializer)?;
+        u128::from_str_radix(&value, 16).map_err(serde::de::Error::custom)
+    }
+}
diff --git a/developer-simulation/runs/2026-08-14--crash-safe-undo-history/src/main.rs b/developer-simulation/runs/2026-08-14--crash-safe-undo-history/src/main.rs
new file mode 100644
index 0000000..a574186
--- /dev/null
+++ b/developer-simulation/runs/2026-08-14--crash-safe-undo-history/src/main.rs
@@ -0,0 +1,174 @@
+use std::error::Error;
+use std::fs::File;
+use std::io::Write;
+use std::path::Path;
+
+use undo_history_lab::baseline::Baseline;
+use undo_history_lab::candidate::{Candidate, compact_directory};
+use undo_history_lab::fixture::{Fixture, generate_fixture};
+use undo_history_lab::runner::run_fixture;
+use undo_history_lab::{Command, Group, Object};
+
+fn main() {
+    if let Err(error) = dispatch() {
+        eprintln!("error: {error}");
+        std::process::exit(2);
+    }
+}
+
+fn dispatch() -> Result<(), Box<dyn Error>> {
+    let mut arguments = std::env::args().skip(1);
+    let mode = arguments.next().ok_or_else(usage)?;
+    match mode.as_str() {
+        "generate" => {
+            let output = arguments.next().ok_or_else(usage)?;
+            let seed = optional_parse(arguments.next(), 1_u64)?;
+            let objects = optional_parse(arguments.next(), 60_000_usize)?;
+            let actions = optional_parse(arguments.next(), 250_000_usize)?;
+            ensure_no_more(arguments)?;
+            let fixture = generate_fixture(seed, objects, actions)?;
+            write_json(Path::new(&output), &fixture)?;
+            println!(
+                "{}",
+                serde_json::json!({
+                    "mode": "generate",
+                    "seed": seed,
+                    "objects": objects,
+                    "actions": actions,
+                    "output": output,
+                    "expected_final": fixture.expected_final,
+                })
+            );
+        }
+        "run" => {
+            let fixture_path = arguments.next().ok_or_else(usage)?;
+            let output = arguments.next().ok_or_else(usage)?;
+            ensure_no_more(arguments)?;
+            let fixture: Fixture = serde_json::from_slice(&std::fs::read(fixture_path)?)?;
+            let report = run_fixture(&fixture, output)?;
+            println!("{}", report.canonical_json);
+            println!("{}", serde_json::to_string(&report)?);
+        }
+        "recover" | "inspect" => {
+            let kind = arguments.next().ok_or_else(usage)?;
+            let store = arguments.next().ok_or_else(usage)?;
+            ensure_no_more(arguments)?;
+            inspect_store(mode.as_str(), &kind, Path::new(&store))?;
+        }
+        "compact" => {
+            let kind = arguments.next().ok_or_else(usage)?;
+            let store = arguments.next().ok_or_else(usage)?;
+            let keep = optional_parse(arguments.next(), 20_000_usize)?;
+            ensure_no_more(arguments)?;
+            let status = match kind.as_str() {
+                "candidate" => compact_directory(&store, keep)?,
+                "baseline" => {
+                    let mut baseline = Baseline::open(&store, 2_000)?;
+                    baseline.compact(keep)?
+                }
+                _ => return Err(usage().into()),
+            };
+            println!(
+                "{}",
+                serde_json::json!({ "mode": "compact", "kind": kind, "keep": keep, "status": status })
+            );
+        }
+        "fault-commit" => {
+            let kind = arguments.next().ok_or_else(usage)?;
+            let store = arguments.next().ok_or_else(usage)?;
+            ensure_no_more(arguments)?;
+            let group = fault_group();
+            match kind.as_str() {
+                "candidate" => {
+                    Candidate::open(&store)?.commit(group)?;
+                }
+                "baseline" => {
+                    Baseline::open(&store, 2_000)?.commit(group)?;
+                }
+                _ => return Err(usage().into()),
+            }
+            std::process::exit(86);
+        }
+        _ => return Err(usage().into()),
+    }
+    Ok(())
+}
+
+fn inspect_store(mode: &str, kind: &str, store: &Path) -> Result<(), Box<dyn Error>> {
+    match kind {
+        "candidate" => {
+            let candidate = Candidate::open(store)?;
+            println!("{}", candidate.canonical_json()?);
+            println!(
+                "{}",
+                serde_json::json!({
+                    "mode": mode,
+                    "kind": kind,
+                    "status": candidate.status()?,
+                    "diagnostic": null,
+                })
+            );
+        }
+        "baseline" => {
+            let baseline = Baseline::open(store, 2_000)?;
+            println!("{}", baseline.canonical_json()?);
+            println!(
+                "{}",
+                serde_json::json!({
+                    "mode": mode,
+                    "kind": kind,
+                    "status": baseline.status()?,
+                    "diagnostic": baseline.diagnostic(),
+                })
+            );
+        }
+        _ => return Err(usage().into()),
+    }
+    Ok(())
+}
+
+fn fault_group() -> Group {
+    Group::new(
+        "fault-group",
+        vec![Command::Create {
+            object: Object {
+                id: 0xf00d,
+                z: 0,
+                transform: [1_000, 0, 0, 1_000, 0, 0],
+                visible: true,
+                fill: 0xff,
+                points: vec![],
+            },
+        }],
+    )
+}
+
+fn write_json(path: &Path, value: &impl serde::Serialize) -> Result<(), Box<dyn Error>> {
+    let bytes = serde_json::to_vec(value)?;
+    let mut file = File::create(path)?;
+    file.write_all(&bytes)?;
+    file.sync_all()?;
+    Ok(())
+}
+
+fn optional_parse<T: std::str::FromStr>(
+    value: Option<String>,
+    default: T,
+) -> Result<T, Box<dyn Error>>
+where
+    T::Err: Error + 'static,
+{
+    value.map_or(Ok(default), |text| text.parse().map_err(Into::into))
+}
+
+fn ensure_no_more(mut arguments: impl Iterator<Item = String>) -> Result<(), Box<dyn Error>> {
+    if arguments.next().is_some() {
+        Err(usage().into())
+    } else {
+        Ok(())
+    }
+}
+
+fn usage() -> &'static str {
+    "usage: undo-history-lab generate <fixture.json> [seed] [objects] [actions] | run <fixture.json> <output-dir> | recover <candidate|baseline> <store> | compact <candidate|baseline> <store> [keep] | inspect <candidate|baseline> <store>"
+}
diff --git a/developer-simulation/runs/2026-08-14--crash-safe-undo-history/src/runner.rs b/developer-simulation/runs/2026-08-14--crash-safe-undo-history/src/runner.rs
new file mode 100644
index 0000000..4eacc39
--- /dev/null
+++ b/developer-simulation/runs/2026-08-14--crash-safe-undo-history/src/runner.rs
@@ -0,0 +1,256 @@
+use std::fs;
+use std::path::Path;
+use std::time::Instant;
+
+use serde::{Deserialize, Serialize};
+
+use crate::baseline::Baseline;
+use crate::candidate::Candidate;
+use crate::fixture::{Fixture, seed_model};
+use crate::{Action, Command, Group, HistoryStatus, ModelError, ReferenceModel};
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+pub struct TimingMetrics {
+    pub sample_count: usize,
+    pub p50_commit_micros: u64,
+    pub p95_commit_micros: u64,
+    pub worst_commit_micros: u64,
+    pub reopen_micros: u64,
+    pub final_disk_bytes: u64,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+pub struct RunReport {
+    pub canonical_json: String,
+    pub reference_status: HistoryStatus,
+    pub candidate_status: HistoryStatus,
+    pub baseline_status: HistoryStatus,
+    pub checkpoints_verified: usize,
+    pub transcript_digest: String,
+    pub candidate: TimingMetrics,
+    pub baseline: TimingMetrics,
+    pub peak_resident_bytes: Option<u64>,
+    pub declared_limits_evaluated: bool,
+}
+
+#[allow(clippy::too_many_lines)]
+pub fn run_fixture(
+    fixture: &Fixture,
+    directory: impl AsRef<Path>,
+) -> Result<RunReport, ModelError> {
+    let directory = directory.as_ref();
+    fs::create_dir_all(directory).map_err(io_error)?;
+    let candidate_path = directory.join("candidate.fold");
+    let baseline_path = directory.join("baseline");
+    if candidate_path.exists() || baseline_path.exists() {
+        return Err(ModelError::new(
+            "output_exists",
+            "run output paths must not already exist",
+        ));
+    }
+
+    let mut reference = ReferenceModel::default();
+    seed_model(&mut reference, fixture)?;
+    let mut candidate = Candidate::open(&candidate_path)?;
+    let mut baseline = Baseline::open(&baseline_path, 2_000)?;
+    for (chunk_index, chunk) in fixture.initial_objects.chunks(20).enumerate() {
+        let group = Group::new(
+            format!("seed-{}-initial-{chunk_index}", fixture.seed),
+            chunk
+                .iter()
+                .cloned()
+                .map(|object| Command::Create { object })
+                .collect(),
+        );
+        candidate.commit(group.clone())?;
+        baseline.commit(group)?;
+    }
+
+    let mut candidate_latencies = Vec::with_capacity(fixture.actions.len());
+    let mut baseline_latencies = Vec::with_capacity(fixture.actions.len());
+    let mut transcript_hash = 0xcbf2_9ce4_8422_2325_u64;
+    let mut checkpoints_verified = 0_usize;
+    let mut checkpoint_index = 0_usize;
+    for (index, action) in fixture.actions.iter().enumerate() {
+        let is_edit_group = matches!(action, Action::Commit { .. });
+        let expected = reference.apply_action(action)?;
+        feed_hash(
+            &mut transcript_hash,
+            &serde_json::to_vec(&expected).map_err(json_error)?,
+        );
+
+        let started = Instant::now();
+        let candidate_status = apply_candidate(&mut candidate, action)?;
+        let candidate_elapsed = micros(started.elapsed());
+        if is_edit_group {
+            candidate_latencies.push(candidate_elapsed);
+        }
+        if candidate_status != expected {
+            return Err(ModelError::new(
+                "candidate_mismatch",
+                format!("candidate diverged at submitted action {}", index + 1),
+            ));
+        }
+
+        let started = Instant::now();
+        let baseline_status = apply_baseline(&mut baseline, action)?;
+        let baseline_elapsed = micros(started.elapsed());
+        if is_edit_group {
+            baseline_latencies.push(baseline_elapsed);
+        }
+        if baseline_status != expected {
+            return Err(ModelError::new(
+                "baseline_mismatch",
+                format!("baseline diverged at submitted action {}", index + 1),
+            ));
+        }
+
+        if fixture
+            .checkpoints
+            .get(checkpoint_index)
+            .is_some_and(|checkpoint| checkpoint.at_action == index + 1)
+        {
+            let checkpoint = &fixture.checkpoints[checkpoint_index];
+            if checkpoint.status != expected {
+                return Err(ModelError::new(
+                    "fixture_checkpoint_mismatch",
+                    format!(
+                        "fixture checkpoint {} is inconsistent",
+                        checkpoint.at_action
+                    ),
+                ));
+            }
+            checkpoint_index += 1;
+            checkpoints_verified += 1;
+        }
+    }
+
+    let reference_status = reference.status()?;
+    let canonical_json = reference.canonical_json().map_err(json_error)?;
+    let candidate_status = candidate.status()?;
+    let baseline_status = baseline.status()?;
+    drop(candidate);
+    drop(baseline);
+
+    let started = Instant::now();
+    let reopened_candidate = Candidate::open(&candidate_path)?;
+    let candidate_reopen = micros(started.elapsed());
+    if reopened_candidate.status()? != reference_status {
+        return Err(ModelError::new(
+            "candidate_reopen_mismatch",
+            "candidate changed after reopen",
+        ));
+    }
+    drop(reopened_candidate);
+
+    let started = Instant::now();
+    let reopened_baseline = Baseline::open(&baseline_path, 2_000)?;
+    let baseline_reopen = micros(started.elapsed());
+    if reopened_baseline.status()? != reference_status {
+        return Err(ModelError::new(
+            "baseline_reopen_mismatch",
+            "baseline changed after reopen",
+        ));
+    }
+
+    Ok(RunReport {
+        canonical_json,
+        reference_status,
+        candidate_status,
+        baseline_status,
+        checkpoints_verified,
+        transcript_digest: format!("{transcript_hash:016x}"),
+        candidate: summarize(
+            &mut candidate_latencies,
+            candidate_reopen,
+            directory_size(&candidate_path)?,
+        ),
+        baseline: summarize(
+            &mut baseline_latencies,
+            baseline_reopen,
+            directory_size(&baseline_path)?,
+        ),
+        peak_resident_bytes: None,
+        declared_limits_evaluated: fixture.initial_objects.len() == 60_000
+            && fixture.actions.len() == 250_000,
+    })
+}
+
+fn apply_candidate(store: &mut Candidate, action: &Action) -> Result<HistoryStatus, ModelError> {
+    match action {
+        Action::Commit { group } => {
+            store.commit(group.clone())?;
+            store.status()
+        }
+        Action::Undo { count } => store.undo(*count),
+        Action::Redo { count } => store.redo(*count),
+    }
+}
+
+fn apply_baseline(store: &mut Baseline, action: &Action) -> Result<HistoryStatus, ModelError> {
+    match action {
+        Action::Commit { group } => {
+            store.commit(group.clone())?;
+            store.status()
+        }
+        Action::Undo { count } => store.undo(*count),
+        Action::Redo { count } => store.redo(*count),
+    }
+}
+
+fn summarize(latencies: &mut [u64], reopen_micros: u64, final_disk_bytes: u64) -> TimingMetrics {
+    latencies.sort_unstable();
+    let percentile = |percent: usize| -> u64 {
+        if latencies.is_empty() {
+            0
+        } else {
+            latencies[((latencies.len() - 1) * percent) / 100]
+        }
+    };
+    TimingMetrics {
+        sample_count: latencies.len(),
+        p50_commit_micros: percentile(50),
+        p95_commit_micros: percentile(95),
+        worst_commit_micros: latencies.last().copied().unwrap_or(0),
+        reopen_micros,
+        final_disk_bytes,
+    }
+}
+
+fn feed_hash(hash: &mut u64, bytes: &[u8]) {
+    for byte in bytes {
+        *hash ^= u64::from(*byte);
+        *hash = hash.wrapping_mul(0x0000_0100_0000_01b3);
+    }
+}
+
+fn micros(duration: std::time::Duration) -> u64 {
+    u64::try_from(duration.as_micros()).unwrap_or(u64::MAX)
+}
+
+fn directory_size(path: &Path) -> Result<u64, ModelError> {
+    if path.is_file() {
+        return fs::metadata(path)
+            .map(|metadata| metadata.len())
+            .map_err(io_error);
+    }
+    let mut total = 0_u64;
+    for entry in fs::read_dir(path).map_err(io_error)? {
+        let entry = entry.map_err(io_error)?;
+        let child = entry.path();
+        total += if child.is_dir() {
+            directory_size(&child)?
+        } else {
+            entry.metadata().map_err(io_error)?.len()
+        };
+    }
+    Ok(total)
+}
+
+fn io_error(error: impl std::fmt::Display) -> ModelError {
+    ModelError::new("io_error", error.to_string())
+}
+
+fn json_error(error: impl std::fmt::Display) -> ModelError {
+    ModelError::new("serialization_error", error.to_string())
+}
diff --git a/developer-simulation/runs/2026-08-14--crash-safe-undo-history/tests/baseline_recovery.rs b/developer-simulation/runs/2026-08-14--crash-safe-undo-history/tests/baseline_recovery.rs
new file mode 100644
index 0000000..5292a27
--- /dev/null
+++ b/developer-simulation/runs/2026-08-14--crash-safe-undo-history/tests/baseline_recovery.rs
@@ -0,0 +1,320 @@
+use std::fs;
+
+use undo_history_lab::baseline::Baseline;
+use undo_history_lab::{Command, Group, Object};
+
+fn object(id: u128) -> Object {
+    Object {
+        id,
+        z: 0,
+        transform: [1_000, 0, 0, 1_000, 0, 0],
+        visible: true,
+        fill: 0x0102_03ff,
+        points: vec![(0, 0)],
+    }
+}
+
+#[test]
+fn every_truncation_of_the_final_small_record_keeps_earlier_history() {
+    let source = tempfile::tempdir().unwrap();
+    let second_start = {
+        let mut baseline = Baseline::open(source.path(), 2_000).unwrap();
+        baseline
+            .commit(Group::new(
+                "one",
+                vec![Command::Create { object: object(1) }],
+            ))
+            .unwrap();
+        let start = usize::try_from(fs::metadata(baseline.journal_path()).unwrap().len()).unwrap();
+        baseline
+            .commit(Group::new(
+                "two",
+                vec![Command::Create { object: object(2) }],
+            ))
+            .unwrap();
+        start
+    };
+    let complete = fs::read(source.path().join("history.jsonl")).unwrap();
+
+    for cut in (second_start + 1)..complete.len() {
+        let trial = tempfile::tempdir().unwrap();
+        fs::write(trial.path().join("history.jsonl"), &complete[..cut]).unwrap();
+        let recovered = Baseline::open(trial.path(), 2_000).unwrap();
+        assert_eq!(recovered.status().unwrap().undo_count, 1, "cut={cut}");
+        assert_eq!(
+            recovered.diagnostic().discarded_tail_offset,
+            Some(second_start as u64),
+            "cut={cut}"
+        );
+    }
+}
+
+#[test]
+fn checksum_invalid_final_record_is_discarded_at_its_offset() {
+    let source = tempfile::tempdir().unwrap();
+    let second_start = {
+        let mut baseline = Baseline::open(source.path(), 2_000).unwrap();
+        baseline
+            .commit(Group::new(
+                "one",
+                vec![Command::Create { object: object(1) }],
+            ))
+            .unwrap();
+        let start = usize::try_from(fs::metadata(baseline.journal_path()).unwrap().len()).unwrap();
+        baseline
+            .commit(Group::new(
+                "two",
+                vec![Command::Create { object: object(2) }],
+            ))
+            .unwrap();
+        start
+    };
+    let path = source.path().join("history.jsonl");
+    let mut corrupt = fs::read(&path).unwrap();
+    let payload_byte = corrupt[second_start..]
+        .iter()
+        .position(|byte| *byte == b't')
+        .map(|position| second_start + position)
+        .unwrap();
+    corrupt[payload_byte] = b'x';
+    fs::write(&path, corrupt).unwrap();
+
+    let recovered = Baseline::open(source.path(), 2_000).unwrap();
+    assert_eq!(recovered.status().unwrap().undo_count, 1);
+    assert_eq!(
+        recovered.diagnostic().discarded_tail_offset,
+        Some(second_start as u64)
+    );
+}
+
+#[test]
+fn snapshot_interval_counts_committed_groups_not_undo_actions() {
+    let directory = tempfile::tempdir().unwrap();
+    let mut baseline = Baseline::open(directory.path(), 2).unwrap();
+    baseline
+        .commit(Group::new(
+            "one",
+            vec![Command::Create { object: object(1) }],
+        ))
+        .unwrap();
+    baseline.undo(1).unwrap();
+    assert!(!directory.path().join("snapshot.json").exists());
+
+    baseline
+        .commit(Group::new(
+            "two",
+            vec![Command::Create { object: object(2) }],
+        ))
+        .unwrap();
+    assert!(directory.path().join("snapshot.json").exists());
+}
+
+#[test]
+fn partial_final_tail_is_truncated_before_later_acknowledged_append() {
+    let directory = tempfile::tempdir().unwrap();
+    let second_start = {
+        let mut baseline = Baseline::open(directory.path(), 2_000).unwrap();
+        baseline
+            .commit(Group::new(
+                "one",
+                vec![Command::Create { object: object(1) }],
+            ))
+            .unwrap();
+        let offset = fs::metadata(baseline.journal_path()).unwrap().len();
+        baseline
+            .commit(Group::new(
+                "torn",
+                vec![Command::Create { object: object(2) }],
+            ))
+            .unwrap();
+        offset
+    };
+    let journal_path = directory.path().join("history.jsonl");
+    let mut bytes = fs::read(&journal_path).unwrap();
+    bytes.pop();
+    fs::write(&journal_path, bytes).unwrap();
+
+    {
+        let mut recovered = Baseline::open(directory.path(), 2_000).unwrap();
+        assert_eq!(fs::metadata(&journal_path).unwrap().len(), second_start);
+        recovered
+            .commit(Group::new(
+                "later",
+                vec![Command::Create { object: object(3) }],
+            ))
+            .unwrap();
+    }
+
+    let reopened = Baseline::open(directory.path(), 2_000).unwrap();
+    assert_eq!(reopened.status().unwrap().undo_count, 2);
+    assert!(reopened.model().document().objects().contains_key(&1));
+    assert!(reopened.model().document().objects().contains_key(&3));
+}
+
+#[test]
+fn checksum_invalid_final_tail_is_truncated_before_later_acknowledged_append() {
+    let directory = tempfile::tempdir().unwrap();
+    let second_start = {
+        let mut baseline = Baseline::open(directory.path(), 2_000).unwrap();
+        baseline
+            .commit(Group::new(
+                "one",
+                vec![Command::Create { object: object(1) }],
+            ))
+            .unwrap();
+        let offset = fs::metadata(baseline.journal_path()).unwrap().len();
+        baseline
+            .commit(Group::new(
+                "bad-checksum",
+                vec![Command::Create { object: object(2) }],
+            ))
+            .unwrap();
+        offset
+    };
+    let journal_path = directory.path().join("history.jsonl");
+    let mut bytes = fs::read(&journal_path).unwrap();
+    let payload_byte = bytes[usize::try_from(second_start).unwrap()..]
+        .iter()
+        .position(|byte| *byte == b'b')
+        .map(|position| usize::try_from(second_start).unwrap() + position)
+        .unwrap();
+    bytes[payload_byte] = b'x';
+    fs::write(&journal_path, bytes).unwrap();
+
+    {
+        let mut recovered = Baseline::open(directory.path(), 2_000).unwrap();
+        assert_eq!(fs::metadata(&journal_path).unwrap().len(), second_start);
+        recovered
+            .commit(Group::new(
+                "later",
+                vec![Command::Create { object: object(3) }],
+            ))
+            .unwrap();
+    }
+
+    let reopened = Baseline::open(directory.path(), 2_000).unwrap();
+    assert_eq!(reopened.status().unwrap().undo_count, 2);
+    assert!(reopened.model().document().objects().contains_key(&1));
+    assert!(reopened.model().document().objects().contains_key(&3));
+}
+
+#[test]
+fn exact_retry_does_not_append_or_advance_unique_commit_snapshot_interval() {
+    let directory = tempfile::tempdir().unwrap();
+    let first = Group::new("one", vec![Command::Create { object: object(1) }]);
+    let first_outcome = {
+        let mut baseline = Baseline::open(directory.path(), 2).unwrap();
+        let outcome = baseline.commit(first.clone()).unwrap();
+        let journal_len = fs::metadata(baseline.journal_path()).unwrap().len();
+        assert_eq!(baseline.commit(first.clone()).unwrap(), outcome);
+        assert_eq!(
+            fs::metadata(baseline.journal_path()).unwrap().len(),
+            journal_len
+        );
+        assert!(!directory.path().join("snapshot.json").exists());
+        outcome
+    };
+
+    let mut reopened = Baseline::open(directory.path(), 2).unwrap();
+    let journal_len = fs::metadata(reopened.journal_path()).unwrap().len();
+    assert_eq!(reopened.commit(first).unwrap(), first_outcome);
+    assert_eq!(
+        fs::metadata(reopened.journal_path()).unwrap().len(),
+        journal_len
+    );
+    assert!(!directory.path().join("snapshot.json").exists());
+    reopened
+        .commit(Group::new(
+            "two",
+            vec![Command::Create { object: object(2) }],
+        ))
+        .unwrap();
+    assert!(directory.path().join("snapshot.json").exists());
+    drop(reopened);
+
+    assert_eq!(
+        Baseline::open(directory.path(), 2)
+            .unwrap()
+            .status()
+            .unwrap()
+            .undo_count,
+        2
+    );
+}
+
+#[test]
+fn exact_dedup_content_survives_baseline_restart_and_compaction() {
+    let directory = tempfile::tempdir().unwrap();
+    let group = Group::new(
+        "stable",
+        vec![Command::Create {
+            object: object(400),
+        }],
+    );
+    let outcome = {
+        let mut baseline = Baseline::open(directory.path(), 2_000).unwrap();
+        let outcome = baseline.commit(group.clone()).unwrap();
+        baseline.compact(1).unwrap();
+        outcome
+    };
+
+    let mut reopened = Baseline::open(directory.path(), 2_000).unwrap();
+    let compacted_journal_len = fs::metadata(reopened.journal_path()).unwrap().len();
+    assert_eq!(reopened.commit(group).unwrap(), outcome);
+    assert_eq!(
+        fs::metadata(reopened.journal_path()).unwrap().len(),
+        compacted_journal_len
+    );
+    let before = reopened.canonical_json().unwrap();
+    let error = reopened
+        .commit(Group::new(
+            "stable",
+            vec![Command::Recolor {
+                id: 400,
+                fill: 0x1122_33ff,
+            }],
+        ))
+        .unwrap_err();
+    assert_eq!(error.code(), "group_id_conflict");
+    assert_eq!(reopened.canonical_json().unwrap(), before);
+}
+
+#[test]
+fn middle_corruption_remains_fatal_and_is_not_truncated() {
+    let directory = tempfile::tempdir().unwrap();
+    let first_end = {
+        let mut baseline = Baseline::open(directory.path(), 2_000).unwrap();
+        baseline
+            .commit(Group::new(
+                "one",
+                vec![Command::Create { object: object(1) }],
+            ))
+            .unwrap();
+        let offset = fs::metadata(baseline.journal_path()).unwrap().len();
+        baseline
+            .commit(Group::new(
+                "two",
+                vec![Command::Create { object: object(2) }],
+            ))
+            .unwrap();
+        baseline
+            .commit(Group::new(
+                "three",
+                vec![Command::Create { object: object(3) }],
+            ))
+            .unwrap();
+        offset
+    };
+    let journal_path = directory.path().join("history.jsonl");
+    let mut bytes = fs::read(&journal_path).unwrap();
+    let middle_byte = usize::try_from(first_end).unwrap() + 10;
+    bytes[middle_byte] ^= 1;
+    fs::write(&journal_path, &bytes).unwrap();
+    let corrupt_len = fs::metadata(&journal_path).unwrap().len();
+
+    let Err(error) = Baseline::open(directory.path(), 2_000) else {
+        panic!("middle corruption must remain fatal");
+    };
+    assert_eq!(error.code(), "middle_journal_corruption");
+    assert_eq!(fs::metadata(&journal_path).unwrap().len(), corrupt_len);
+}
diff --git a/developer-simulation/runs/2026-08-14--crash-safe-undo-history/tests/candidate_contract.rs b/developer-simulation/runs/2026-08-14--crash-safe-undo-history/tests/candidate_contract.rs
new file mode 100644
index 0000000..16f1c96
--- /dev/null
+++ b/developer-simulation/runs/2026-08-14--crash-safe-undo-history/tests/candidate_contract.rs
@@ -0,0 +1,155 @@
+use undo_history_lab::candidate::{Candidate, compact_directory};
+use undo_history_lab::{Command, Group, Object};
+
+fn directory_bytes(path: &std::path::Path) -> u64 {
+    std::fs::read_dir(path)
+        .unwrap()
+        .map(|entry| {
+            let path = entry.unwrap().path();
+            if path.is_dir() {
+                directory_bytes(&path)
+            } else {
+                std::fs::metadata(path).unwrap().len()
+            }
+        })
+        .sum()
+}
+
+fn object(id: u128) -> Object {
+    Object {
+        id,
+        z: 7,
+        transform: [1_000, 0, 0, 1_000, 0, 0],
+        visible: true,
+        fill: 0xaabb_ccff,
+        points: vec![],
+    }
+}
+
+#[test]
+fn acknowledged_group_and_duplicate_outcome_survive_reopen() {
+    let dir = tempfile::tempdir().unwrap();
+    let group = Group::new("stable-7", vec![Command::Create { object: object(7) }]);
+    let first = {
+        let mut store = Candidate::open(dir.path()).unwrap();
+        store.commit(group.clone()).unwrap()
+    };
+
+    let mut reopened = Candidate::open(dir.path()).unwrap();
+    let duplicate = reopened.commit(group).unwrap();
+
+    assert_eq!(duplicate, first);
+    assert_eq!(reopened.status().unwrap().undo_count, 1);
+    assert_eq!(reopened.model().document().objects().len(), 1);
+}
+
+#[test]
+fn reused_group_id_with_different_content_does_not_change_state() {
+    let dir = tempfile::tempdir().unwrap();
+    let mut store = Candidate::open(dir.path()).unwrap();
+    store
+        .commit(Group::new(
+            "stable-8",
+            vec![Command::Create { object: object(8) }],
+        ))
+        .unwrap();
+    let before = store.canonical_json().unwrap();
+
+    let error = store
+        .commit(Group::new(
+            "stable-8",
+            vec![Command::Create { object: object(9) }],
+        ))
+        .unwrap_err();
+
+    assert_eq!(error.code(), "group_id_conflict");
+    assert_eq!(store.canonical_json().unwrap(), before);
+}
+
+#[test]
+fn compaction_retains_recent_undo_window_and_all_duplicate_outcomes() {
+    let dir = tempfile::tempdir().unwrap();
+    let oldest = Group::new(
+        "oldest",
+        vec![Command::Create {
+            object: object(100),
+        }],
+    );
+    let original = {
+        let mut store = Candidate::open(dir.path()).unwrap();
+        let original = store.commit(oldest.clone()).unwrap();
+        for id in 101..105 {
+            store
+                .commit(Group::new(
+                    format!("g-{id}"),
+                    vec![Command::Create { object: object(id) }],
+                ))
+                .unwrap();
+        }
+        original
+    };
+
+    compact_directory(dir.path(), 3).unwrap();
+    let mut reopened = Candidate::open(dir.path()).unwrap();
+
+    assert_eq!(reopened.status().unwrap().undo_count, 3);
+    assert_eq!(reopened.commit(oldest).unwrap(), original);
+    assert_eq!(reopened.status().unwrap().undo_count, 3);
+}
+
+#[test]
+fn exact_retry_does_not_rewrite_candidate_before_or_after_restart() {
+    let dir = tempfile::tempdir().unwrap();
+    let group = Group::new(
+        "stable",
+        vec![Command::Create {
+            object: object(200),
+        }],
+    );
+    let outcome = {
+        let mut store = Candidate::open(dir.path()).unwrap();
+        let outcome = store.commit(group.clone()).unwrap();
+        let bytes = directory_bytes(dir.path());
+        assert_eq!(store.commit(group.clone()).unwrap(), outcome);
+        assert_eq!(directory_bytes(dir.path()), bytes);
+        outcome
+    };
+
+    let mut reopened = Candidate::open(dir.path()).unwrap();
+    let bytes = directory_bytes(dir.path());
+    assert_eq!(reopened.commit(group).unwrap(), outcome);
+    assert_eq!(directory_bytes(dir.path()), bytes);
+}
+
+#[test]
+fn exact_dedup_content_survives_candidate_restart_and_compaction() {
+    let dir = tempfile::tempdir().unwrap();
+    let group = Group::new(
+        "stable",
+        vec![Command::Create {
+            object: object(300),
+        }],
+    );
+    let outcome = {
+        let mut store = Candidate::open(dir.path()).unwrap();
+        store.commit(group.clone()).unwrap()
+    };
+    compact_directory(dir.path(), 1).unwrap();
+
+    let mut reopened = Candidate::open(dir.path()).unwrap();
+    let compacted_bytes = directory_bytes(dir.path());
+    assert_eq!(reopened.commit(group).unwrap(), outcome);
+    assert_eq!(directory_bytes(dir.path()), compacted_bytes);
+    let before = reopened.canonical_json().unwrap();
+    let error = reopened
+        .commit(Group::new(
+            "stable",
+            vec![Command::Recolor {
+                id: 300,
+                fill: 0x1122_33ff,
+            }],
+        ))
+        .unwrap_err();
+    assert_eq!(error.code(), "group_id_conflict");
+    assert_eq!(reopened.canonical_json().unwrap(), before);
+}
diff --git a/developer-simulation/runs/2026-08-14--crash-safe-undo-history/tests/equivalence.rs b/developer-simulation/runs/2026-08-14--crash-safe-undo-history/tests/equivalence.rs
new file mode 100644
index 0000000..b3c90fe
--- /dev/null
+++ b/developer-simulation/runs/2026-08-14--crash-safe-undo-history/tests/equivalence.rs
@@ -0,0 +1,24 @@
+use undo_history_lab::fixture::generate_fixture;
+use undo_history_lab::runner::run_fixture;
+
+#[test]
+fn candidate_baseline_and_reference_match_on_checkpoints_and_final_state() {
+    let fixture = generate_fixture(2026, 16, 160).unwrap();
+    let first_dir = tempfile::tempdir().unwrap();
+    let second_dir = tempfile::tempdir().unwrap();
+    let third_dir = tempfile::tempdir().unwrap();
+
+    let first = run_fixture(&fixture, first_dir.path()).unwrap();
+    let second = run_fixture(&fixture, second_dir.path()).unwrap();
+    let third = run_fixture(&fixture, third_dir.path()).unwrap();
+
+    assert_eq!(first.reference_status, first.candidate_status);
+    assert_eq!(first.reference_status, first.baseline_status);
+    assert_eq!(first.checkpoints_verified, 0);
+    assert_eq!(first.candidate.sample_count, fixture.edit_submissions);
+    assert_eq!(first.baseline.sample_count, fixture.edit_submissions);
+    assert_eq!(first.transcript_digest, second.transcript_digest);
+    assert_eq!(first.transcript_digest, third.transcript_digest);
+    assert_eq!(first.canonical_json, second.canonical_json);
+    assert_eq!(first.canonical_json, third.canonical_json);
+}
diff --git a/developer-simulation/runs/2026-08-14--crash-safe-undo-history/tests/fixture_determinism.rs b/developer-simulation/runs/2026-08-14--crash-safe-undo-history/tests/fixture_determinism.rs
new file mode 100644
index 0000000..2638f41
--- /dev/null
+++ b/developer-simulation/runs/2026-08-14--crash-safe-undo-history/tests/fixture_determinism.rs
@@ -0,0 +1,25 @@
+use undo_history_lab::fixture::generate_fixture;
+
+#[test]
+fn same_seed_is_byte_identical_and_different_seed_changes_output() {
+    let first = serde_json::to_vec(&generate_fixture(17, 24, 200).unwrap()).unwrap();
+    let second = serde_json::to_vec(&generate_fixture(17, 24, 200).unwrap()).unwrap();
+    let different = serde_json::to_vec(&generate_fixture(18, 24, 200).unwrap()).unwrap();
+
+    assert_eq!(first, second);
+    assert_ne!(first, different);
+}
+
+#[test]
+fn generator_records_reference_checkpoints_and_exactly_ten_percent_retries() {
+    let fixture = generate_fixture(91, 32, 1_000).unwrap();
+
+    assert_eq!(fixture.actions.len(), 1_000);
+    assert_eq!(
+        fixture.duplicate_edit_submissions,
+        fixture.edit_submissions / 10
+    );
+    assert_eq!(fixture.checkpoints.len(), 1);
+    assert_eq!(fixture.checkpoints[0].at_action, 1_000);
+    assert_eq!(fixture.checkpoints[0].status, fixture.expected_final);
+}
diff --git a/developer-simulation/runs/2026-08-14--crash-safe-undo-history/tests/model_contract.rs b/developer-simulation/runs/2026-08-14--crash-safe-undo-history/tests/model_contract.rs
new file mode 100644
index 0000000..68d0aa1
--- /dev/null
+++ b/developer-simulation/runs/2026-08-14--crash-safe-undo-history/tests/model_contract.rs
@@ -0,0 +1,141 @@
+use undo_history_lab::{Command, Group, Object, ReferenceModel};
+
+fn object(id: u128, x: i64) -> Object {
+    Object {
+        id,
+        z: 0,
+        transform: [x, 0, 0, 1_000, 0, 0],
+        visible: true,
+        fill: 0xff00_00ff,
+        points: vec![(10, 20)],
+    }
+}
+
+#[test]
+fn invalid_command_rolls_back_the_whole_group() {
+    let mut model = ReferenceModel::default();
+    model
+        .commit(Group::new(
+            "g-1",
+            vec![Command::Create {
+                object: object(1, 0),
+            }],
+        ))
+        .unwrap();
+    let before = model.canonical_json().unwrap();
+
+    let error = model
+        .commit(Group::new(
+            "g-2",
+            vec![
+                Command::Move {
+                    id: 1,
+                    dx: 7,
+                    dy: 9,
+                },
+                Command::Move {
+                    id: 999,
+                    dx: 1,
+                    dy: 1,
+                },
+            ],
+        ))
+        .unwrap_err();
+
+    assert_eq!(error.code(), "missing_object");
+    assert_eq!(model.canonical_json().unwrap(), before);
+    assert_eq!(model.undo_count(), 1);
+}
+
+#[test]
+fn new_group_after_undo_invalidates_redo() {
+    let mut model = ReferenceModel::default();
+    model
+        .commit(Group::new(
+            "g-1",
+            vec![Command::Create {
+                object: object(1, 0),
+            }],
+        ))
+        .unwrap();
+    model
+        .commit(Group::new(
+            "g-2",
+            vec![Command::Move {
+                id: 1,
+                dx: 10,
+                dy: 0,
+            }],
+        ))
+        .unwrap();
+    model.undo(1).unwrap();
+    assert_eq!(model.redo_count(), 1);
+
+    model
+        .commit(Group::new(
+            "g-3",
+            vec![Command::Recolor {
+                id: 1,
+                fill: 0x1122_33ff,
+            }],
+        ))
+        .unwrap();
+
+    assert_eq!(model.redo_count(), 0);
+    let error = model.redo(1).unwrap_err();
+    assert_eq!(error.code(), "redo_beyond_history");
+}
+
+#[test]
+fn compaction_does_not_discard_the_available_redo_branch() {
+    let mut model = ReferenceModel::default();
+    for id in 1..=5 {
+        model
+            .commit(Group::new(
+                format!("g-{id}"),
+                vec![Command::Create {
+                    object: object(id, 0),
+                }],
+            ))
+            .unwrap();
+    }
+    model.undo(4).unwrap();
+    model.compact(2);
+
+    assert_eq!(model.undo_count(), 0);
+    assert_eq!(model.redo_count(), 4);
+    model.redo(4).unwrap();
+    assert_eq!(model.document().objects().len(), 5);
+}
+
+#[test]
+fn dedup_record_persists_exact_canonical_command_bytes() {
+    let mut model = ReferenceModel::default();
+    model
+        .commit(Group::new(
+            "seed",
+            vec![Command::Create {
+                object: object(1, 0),
+            }],
+        ))
+        .unwrap();
+    model
+        .commit(Group::new(
+            "exact",
+            vec![Command::ToggleVisibility { id: 1 }],
+        ))
+        .unwrap();
+
+    let persisted = serde_json::to_value(model).unwrap();
+    let stored: Vec<u8> = persisted["dedup"]["exact"]["canonical_commands"]
+        .as_array()
+        .expect("dedup must persist canonical command bytes")
+        .iter()
+        .map(|byte| u8::try_from(byte.as_u64().unwrap()).unwrap())
+        .collect();
+
+    assert_eq!(
+        stored,
+        br#"[{"op":"toggle_visibility","id":"00000000000000000000000000000001"}]"#
+    );
+}
diff --git a/developer-simulation/runs/2026-08-14--crash-safe-undo-history/tests/overflow_recovery.rs b/developer-simulation/runs/2026-08-14--crash-safe-undo-history/tests/overflow_recovery.rs
new file mode 100644
index 0000000..69ac82b
--- /dev/null
+++ b/developer-simulation/runs/2026-08-14--crash-safe-undo-history/tests/overflow_recovery.rs
@@ -0,0 +1,238 @@
+use std::panic::{AssertUnwindSafe, catch_unwind};
+
+use undo_history_lab::baseline::Baseline;
+use undo_history_lab::candidate::Candidate;
+use undo_history_lab::{Command, Group, Object, ReferenceModel};
+
+fn object() -> Object {
+    Object {
+        id: 1,
+        z: 0,
+        transform: [1_000, 0, 0, 1_000, 10, 20],
+        visible: true,
+        fill: 0x0102_03ff,
+        points: vec![(30, 40)],
+    }
+}
+
+fn invalid_groups() -> Vec<Group> {
+    vec![
+        Group::new(
+            "move-x-min",
+            vec![Command::Move {
+                id: 1,
+                dx: i64::MIN,
+                dy: 0,
+            }],
+        ),
+        Group::new(
+            "move-y-min",
+            vec![Command::Move {
+                id: 1,
+                dx: 0,
+                dy: i64::MIN,
+            }],
+        ),
+        Group::new(
+            "point-x-min",
+            vec![Command::MovePoint {
+                id: 1,
+                index: 0,
+                dx: i64::MIN,
+                dy: 0,
+            }],
+        ),
+        Group::new(
+            "point-y-min",
+            vec![Command::MovePoint {
+                id: 1,
+                index: 0,
+                dx: 0,
+                dy: i64::MIN,
+            }],
+        ),
+        Group::new(
+            "later-invalid",
+            vec![
+                Command::Recolor {
+                    id: 1,
+                    fill: 0xaabb_ccff,
+                },
+                Command::Move {
+                    id: 1,
+                    dx: i64::MIN,
+                    dy: 0,
+                },
+            ],
+        ),
+        Group::new(
+            "move-x-destination",
+            vec![Command::Move {
+                id: 1,
+                dx: i64::MAX,
+                dy: 0,
+            }],
+        ),
+        Group::new(
+            "move-y-destination",
+            vec![Command::Move {
+                id: 1,
+                dx: 0,
+                dy: i64::MAX,
+            }],
+        ),
+        Group::new(
+            "point-x-destination",
+            vec![Command::MovePoint {
+                id: 1,
+                index: 0,
+                dx: i64::MAX,
+                dy: 0,
+            }],
+        ),
+        Group::new(
+            "point-y-destination",
+            vec![Command::MovePoint {
+                id: 1,
+                index: 0,
+                dx: 0,
+                dy: i64::MAX,
+            }],
+        ),
+    ]
+}
+
+#[test]
+fn inverse_and_destination_overflow_is_rejected_before_model_mutation() {
+    let mut model = ReferenceModel::default();
+    model
+        .commit(Group::new(
+            "seed",
+            vec![Command::Create { object: object() }],
+        ))
+        .unwrap();
+    let before = model.canonical_json().unwrap();
+
+    for group in invalid_groups() {
+        let result = catch_unwind(AssertUnwindSafe(|| model.commit(group)));
+        let error = result
+            .expect("overflow must return an error, not panic")
+            .unwrap_err();
+        assert_eq!(error.code(), "coordinate_overflow");
+        assert_eq!(model.canonical_json().unwrap(), before);
+    }
+}
+
+#[test]
+fn candidate_reopens_unchanged_after_each_overflow_then_accepts_a_valid_write() {
+    let directory = tempfile::tempdir().unwrap();
+    {
+        let mut candidate = Candidate::open(directory.path()).unwrap();
+        candidate
+            .commit(Group::new(
+                "seed",
+                vec![Command::Create { object: object() }],
+            ))
+            .unwrap();
+    }
+    let before = Candidate::open(directory.path())
+        .unwrap()
+        .canonical_json()
+        .unwrap();
+
+    for group in invalid_groups() {
+        let mut candidate = Candidate::open(directory.path()).unwrap();
+        let result = catch_unwind(AssertUnwindSafe(|| candidate.commit(group)));
+        let error = result
+            .expect("overflow must return an error, not panic")
+            .unwrap_err();
+        assert_eq!(error.code(), "coordinate_overflow");
+        drop(candidate);
+        assert_eq!(
+            Candidate::open(directory.path())
+                .unwrap()
+                .canonical_json()
+                .unwrap(),
+            before
+        );
+    }
+
+    {
+        let mut candidate = Candidate::open(directory.path()).unwrap();
+        candidate
+            .commit(Group::new(
+                "valid",
+                vec![Command::Move {
+                    id: 1,
+                    dx: 5,
+                    dy: -7,
+                }],
+            ))
+            .unwrap();
+    }
+    assert_eq!(
+        Candidate::open(directory.path())
+            .unwrap()
+            .status()
+            .unwrap()
+            .undo_count,
+        2
+    );
+}
+
+#[test]
+fn baseline_reopens_unchanged_after_each_overflow_then_accepts_a_valid_write() {
+    let directory = tempfile::tempdir().unwrap();
+    {
+        let mut baseline = Baseline::open(directory.path(), 2_000).unwrap();
+        baseline
+            .commit(Group::new(
+                "seed",
+                vec![Command::Create { object: object() }],
+            ))
+            .unwrap();
+    }
+    let before = Baseline::open(directory.path(), 2_000)
+        .unwrap()
+        .canonical_json()
+        .unwrap();
+
+    for group in invalid_groups() {
+        let mut baseline = Baseline::open(directory.path(), 2_000).unwrap();
+        let result = catch_unwind(AssertUnwindSafe(|| baseline.commit(group)));
+        let error = result
+            .expect("overflow must return an error, not panic")
+            .unwrap_err();
+        assert_eq!(error.code(), "coordinate_overflow");
+        drop(baseline);
+        assert_eq!(
+            Baseline::open(directory.path(), 2_000)
+                .unwrap()
+                .canonical_json()
+                .unwrap(),
+            before
+        );
+    }
+
+    {
+        let mut baseline = Baseline::open(directory.path(), 2_000).unwrap();
+        baseline
+            .commit(Group::new(
+                "valid",
+                vec![Command::Move {
+                    id: 1,
+                    dx: 5,
+                    dy: -7,
+                }],
+            ))
+            .unwrap();
+    }
+    assert_eq!(
+        Baseline::open(directory.path(), 2_000)
+            .unwrap()
+            .status()
+            .unwrap()
+            .undo_count,
+        2
+    );
+}
diff --git a/developer-simulation/runs/2026-08-14--crash-safe-undo-history/tests/process_exit.rs b/developer-simulation/runs/2026-08-14--crash-safe-undo-history/tests/process_exit.rs
new file mode 100644
index 0000000..f324ff4
--- /dev/null
+++ b/developer-simulation/runs/2026-08-14--crash-safe-undo-history/tests/process_exit.rs
@@ -0,0 +1,33 @@
+use std::process::Command;
+
+use undo_history_lab::baseline::Baseline;
+use undo_history_lab::candidate::Candidate;
+
+#[test]
+fn exit_after_durable_commit_before_response_recovers_for_both_stores() {
+    let binary = env!("CARGO_BIN_EXE_undo-history-lab");
+    for kind in ["candidate", "baseline"] {
+        let directory = tempfile::tempdir().unwrap();
+        let store = directory.path().join(kind);
+        let status = Command::new(binary)
+            .args(["fault-commit", kind, store.to_str().unwrap()])
+            .status()
+            .unwrap();
+        assert_eq!(status.code(), Some(86), "kind={kind}");
+
+        let undo_count = if kind == "candidate" {
+            Candidate::open(&store)
+                .unwrap()
+                .status()
+                .unwrap()
+                .undo_count
+        } else {
+            Baseline::open(&store, 2_000)
+                .unwrap()
+                .status()
+                .unwrap()
+                .undo_count
+        };
+        assert_eq!(undo_count, 1, "kind={kind}");
+    }
+}
diff --git a/developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/BRIEF.md b/developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/BRIEF.md
new file mode 100644
index 0000000..8e16402
--- /dev/null
+++ b/developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/BRIEF.md
@@ -0,0 +1,86 @@
+# Trial 2: Epoch-safe mailbox mirror repair for a desktop mail client
+
+## Developer persona and Rust experience
+
+You maintain synchronization for a cross-platform desktop mail client. You have twelve years of production Kotlin and SQLite experience and three months of Rust experience. You can read Rust and write small command-line programs, but you need ordinary APIs and debuggable on-disk state.
+
+## Existing system and baseline
+
+The client mirrors message headers and flags locally so mailbox lists and unread counts remain available offline. The mail server is authoritative. The current SQLite mirror uses mailbox, message, and cursor tables updated in explicit transactions. Its most troublesome recovery code handles an identity epoch change: message numeric IDs can be reused after the server changes a mailbox's `uid_validity` value, so old and new epochs must never mix.
+
+Implement a faithful SQLite baseline with one transaction per accepted response batch, indexed `(mailbox_id, uid_validity, uid)` identity, and staging tables for a full rescan. A completed rescan swaps the staged epoch into view atomically. The candidate and baseline consume the same already-decoded transcript; protocol parsing is not part of the trial.
+
+## Concrete pain
+
+Replace bespoke mirror-repair bookkeeping with a smaller, easier-to-reason-about local projection while preserving exact behavior after disconnects and process exits. Bugs today leave ghost messages, reuse old flags for a new message with the same numeric ID, double unread counts after replay, or expose half of a replacement epoch to the UI.
+
+## Workload and data shape
+
+Generate a deterministic NDJSON transcript for 80 mailboxes, 300,000 live messages, and 600,000 decoded server responses. Mailbox IDs are stable opaque strings. A message identity is `(mailbox_id, uid_validity, uid)`. Store only a 16-byte content fingerprint, internal date as an integer, byte size, and a bit set for `seen`, `answered`, `flagged`, and `draft`; there are no subjects, addresses, bodies, or attachments.
+
+The transcript contains:
+
+- complete mailbox snapshots delimited by begin and commit records;
+- incremental message additions, flag replacements, and expunges;
+- highest-known change cursors per mailbox;
+- duplicate batches after lost acknowledgements;
+- mailbox rename and deletion;
+- connection loss in the middle of a response batch;
+- an epoch change followed by a full snapshot in which numeric IDs may be reused; and
+- explicit UI checkpoints requesting message count, unread count, selected message identities, cursor, and mirror status.
+
+At least 12 mailboxes change epoch, 20 are renamed, 10 are deleted and later recreated under the same display name but a new stable ID, and 5% of batches are exact duplicates. Independent reference code applies only complete valid batches and full snapshots.
+
+## Operational constraints
+
+- Run offline on one macOS host using generated transcripts and one ordinary user-writable directory.
+- The remote transcript is authoritative; the local mirror is disposable derived state and must never invent a server change.
+- One sync writer and up to eight concurrent UI readers may access the mirror.
+- Keep peak resident memory at or below 384 MiB and persistent storage at or below 1.5 times the measured SQLite baseline.
+- Process the full 600,000-response transcript within 75 seconds, answer count checkpoints at p95 below 10 ms, and reopen within 5 seconds on the declared host.
+- Do not use network access, real mail, personal data, an external database server, unsafe code, or privileged services.
+
+## Measurable acceptance criteria
+
+1. Across 30 fixed seeds, every checkpoint exactly matches the independent reference model for visible identities, flags, per-mailbox total and unread counts, cursor, display name, and status.
+2. Replaying a complete batch any number of times is idempotent. Replaying a partial batch after recovery yields the same state as one complete application.
+3. A changed `uid_validity` prevents every prior-epoch message and flag from entering the replacement epoch, even when numeric IDs are reused.
+4. UI readers observe either the last complete old epoch or the complete new epoch during a rescan, never a mixture. A disconnect, invalid response, or process exit before snapshot commit leaves the old epoch visible and marks the mailbox as needing repair.
+5. Rename preserves the stable mailbox identity and its messages. Deletion removes that stable identity. Recreating the same display name under a new stable ID does not resurrect prior state.
+6. All 400 process-exit trials reopen automatically and match the reference at the last complete accepted batch. Corrupt or truncated input produces a mailbox-and-sequence-only diagnostic and no partial mutation.
+7. Three runs of each fault-free seed produce byte-identical checkpoint output, final canonical manifest, and diagnostics regardless of input chunk sizes and concurrent-reader schedules.
+8. The timing, memory, and storage limits above are met. Report candidate and SQLite baseline throughput, count-query p50 and p95, reopen time, peak resident memory, disk use, write amplification if measurable, and code size excluding tests and generated fixtures.
+9. The candidate must reduce non-test mirror and repair code by at least 20% or improve full-run time or reopen time by at least 30%, while remaining within 20% of SQLite's count-query p95. Correctness and atomic visibility remain hard gates.
+
+## Explicit non-goals
+
+- Parsing wire protocol, opening a network connection, authentication, encryption, server discovery, or sending commands.
+- Message bodies, attachments, MIME parsing, full-text or semantic search, ranking, or spam classification.
+- Uploading local flag changes, resolving two-way conflicts, composing mail, or supporting multiple server replicas.
+- Treating local state as authoritative, preserving a replaced epoch for user access, or repairing arbitrary disk corruption.
+- Replacing the application's account database or UI.
+
+## Compact self-contained prototype boundary
+
+Build a deterministic transcript generator, an independent pure reference model, a candidate mirror adapter, the SQLite baseline, a concurrent checkpoint reader, and a crash-capable command-line harness. The harness supports `generate`, `apply`, `resume`, `verify`, and `summarize`. It stores only the synthetic fields listed above and emits a canonical JSON manifest plus privacy-safe metrics and diagnostics.
+
+## Baseline comparison required
+
+Run candidate and SQLite baseline with identical decoded batches, commit boundaries, reader schedules, crash points, host, and compiler settings. First compare every checkpoint against the reference, then compare the measurements in criterion 8. Record how full-snapshot staging, epoch replacement, replay detection, cursor storage, and counts are expressed in each implementation. Do not credit a throughput gain obtained by weakening transaction boundaries or reader visibility.
+
+## Fault and determinism cases
+
+- Exit before batch admission, after individual response decoding, immediately before commit, after commit but before acknowledgement, during full-snapshot staging, during epoch publication, and during cleanup of abandoned staging data.
+- Truncate every record position in a small transcript and 64 seeded positions in the full transcript; also inject invalid JSON, missing batch terminators, decreasing cursors, unknown mailbox IDs, and an incremental event for an uncommitted epoch.
+- Duplicate each batch once, replay the final 10,000 batches after restart, and reorder only responses that the generator marks independent. Reject illegal reorderings without state change.
+- Reuse every old numeric ID in at least one replacement epoch with deliberately different flags and fingerprints.
+- Schedule eight readers at seeded points during incremental batches, rename, delete, full rescan, epoch publication, and recovery.
+- Vary transcript chunk sizes from one byte to 1 MiB and permute input map insertion order; logical outputs and diagnostics must remain identical.
+
+## Evidence classification
+
+**Success:** All correctness, epoch isolation, atomic visibility, crash recovery, determinism, resource, and baseline gates pass, with the candidate approach responsible for the central projection and transaction behavior and at least one measured maintenance or performance gain.
+
+**Partial fit:** Incremental add, flag, expunge, replay, and query behavior is clean, but full epoch replacement, reader isolation, recovery, or one resource gate requires a bounded custom mechanism. Report the exact unproved boundary and retain SQLite for it.
+
+**No fit:** Any run exposes mixed epochs, resurrects deleted identities, loses or duplicates accepted responses, cannot recover deterministically, exceeds hard limits, or requires more bespoke state machinery without the required code-size or performance benefit over SQLite.
diff --git a/developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/Cargo.toml b/developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/Cargo.toml
new file mode 100644
index 0000000..bae3b7b
--- /dev/null
+++ b/developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/Cargo.toml
@@ -0,0 +1,17 @@
+[package]
+name = "mailbox-mirror-lab"
+version = "0.1.0"
+edition = "2024"
+publish = false
+
+[dependencies]
+clap = { version = "4.6.1", features = ["derive"] }
+fold = { path = "../../../fold" }
+serde = { version = "1.0.229", features = ["derive"] }
+serde_json = "1.0.151"
+
+[dev-dependencies]
+tempfile = "3.27.0"
+
+[lints.rust]
+unsafe_code = "forbid"
diff --git a/developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/DISCOVERY.md b/developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/DISCOVERY.md
new file mode 100644
index 0000000..001af87
--- /dev/null
+++ b/developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/DISCOVERY.md
@@ -0,0 +1,94 @@
+# Discovery: epoch-safe mailbox mirror repair
+
+## Starting point
+
+I am approaching this as a desktop synchronization developer with deep SQLite experience and limited Rust experience. The server transcript is authoritative. The local store is disposable projection state. The hard problems are transactional batch admission, idempotent replay, epoch isolation, all-or-nothing snapshot publication, deletion/recreation by stable identity, deterministic recovery, and predictable UI reads. Protocol parsing and two-way synchronization are outside the boundary.
+
+Before considering BogKit, the reference design is the stated SQLite baseline:
+
+- one explicit transaction per accepted response batch;
+- message identity indexed by `(mailbox_id, uid_validity, uid)`;
+- active mailbox metadata and cursors stored with the visible epoch;
+- a separate staging area for a full snapshot;
+- a single transaction that replaces the visible epoch with the complete staged epoch;
+- duplicate batch admission recorded durably in the same transaction as its effects;
+- unsigned persisted values constrained to the exact SQLite `INTEGER` domain before admission; and
+- explicit cleanup of both visible and staged rows for the deleted stable mailbox ID;
+- UI readers using ordinary read transactions so they see either the state before a commit or the state after it.
+
+That baseline already has a strong fit for the workload. A BogKit candidate must first preserve those semantics, then earn its added complexity with the required code-size or performance improvement. It is acceptable for the result to be partial-fit or no-fit.
+
+## Onboarding trail
+
+I read only the public root `README.md` and the four public examples before writing this file.
+
+1. The root README recommends creating a workspace example and presents Fold, ESE, and ANNy as independent components that need not all be used.
+2. `starter` shows a Fold `Stream` with one writer transaction updating a persistent count and bag, and one read transaction seeing a consistent snapshot.
+3. `timeseries` shows incremental keyed aggregates and retained raw records, including retraction.
+4. `chat` shows a single ingest owner and snapshot readers. It says each Fold write commits transactionally and that a read transaction sees consistent materialized views.
+5. `search` shows `KeyedStream`, `upsert`, and `remove`, with multiple indexes updated together. It is oriented to text and vector search, not mailbox synchronization.
+
+The public examples make Fold's atomic multi-view update and durable reopening directly relevant. They do not publicly demonstrate crash injection, a transactional epoch-swap primitive, durable duplicate-batch admission, snapshot staging, multi-process recovery, or stable iteration ordering. Those gaps are questions, not defects.
+
+## Initial fit hypotheses for every public component
+
+### Fold: possible partial fit, subject to baseline comparison
+
+Potential material help:
+
+- one writer transaction could update message state and materialized counts together;
+- keyed upsert/remove could make incremental add, flag replacement, and expunge easier to express;
+- read transactions may give consistent counts and message views;
+- durable reopening may eliminate some bespoke rebuilding.
+
+Risks to test before selection:
+
+- the mailbox snapshot is a set replacement, while the examples expose record-level insert/retract/upsert operations;
+- atomic epoch publication may still require custom staging and a large explicit retraction/insertion transaction;
+- replay detection and cursor monotonicity may remain custom state;
+- deterministic canonical iteration may require sorting outside the component;
+- the storage shape and write amplification could be worse than the indexed SQLite baseline;
+- it is not yet shown that readers can remain on the old complete epoch while a new one is staged.
+
+Selection threshold: use Fold only if a minimal test proves it can own the central projection behavior without weakening batch transactions or reader visibility. If it helps only incremental records while epoch replacement needs a bounded custom layer, classify partial fit and retain SQLite for the hard boundary.
+
+### ESE: no apparent fit
+
+The mailbox records contain fixed fingerprints, dates, sizes, flags, and identifiers. There is no text or semantic-search requirement. Embeddings would add cost without serving an acceptance criterion. I will not use ESE unless later public behavior reveals an unexpected directly relevant capability.
+
+### ANNy: no apparent fit
+
+There is no nearest-neighbor query. Message identity lookup, counts, cursor access, and canonical enumeration require exact behavior. Approximate vector indexing is unrelated. I will not use ANNy.
+
+## Baseline-first experiment plan
+
+1. Build a small faithful SQLite baseline and a pure in-memory reference over the same decoded batches.
+2. Use hand-derived fixtures to test duplicate replay, UID reuse across epochs, incomplete snapshot retention, rename, deletion/recreation, cursor rejection, and canonical checkpoints.
+3. Measure the baseline locally before choosing Fold.
+4. Inspect only the minimum Fold surface needed to test the hypothesis.
+5. If Fold cannot safely own epoch publication or would merely duplicate SQLite's staging machinery, produce a decisive minimal reproducer and a no-fit or partial-fit result instead of a broad replacement.
+
+## Initial uncertainties
+
+- Whether the environment already has all Rust dependencies cached for a fully offline build.
+- Whether Fold offers a public keyed-record API suitable for composite mailbox identities without serializing custom keys awkwardly.
+- Whether its transaction and persistence layer supports cheap atomic replacement of a large logical set.
+- Whether active readers can be held across a writer commit and prove old-or-new epoch visibility.
+- Whether deterministic persistence and diagnostics hold across crash points and input chunking.
+- Whether a full 600,000-response, 300,000-message campaign is safe within this trial's available wall time; any smaller run will be labeled as such and will not be credited as meeting the full resource gate.
+
+## Baseline evaluation and component decision
+
+After implementing the reference and SQLite paths test-first, I ran a release-mode local baseline with 20 mailboxes, 10,000 messages, 120 accepted batches, and 200 count checkpoints. It processed 10,020 decoded responses at 11,045 responses/second; count-query p50 was 2.457 ms and p95 was 3.179 ms; reopen was 4.283 ms; the SQLite database plus sidecars occupied 2,867,200 bytes. This is a small local measurement, not proof of the 600,000-response gate. A linear throughput estimate would be about 54 seconds, but I will not treat that estimate as a measured full-run result.
+
+Only after this measurement did I inspect the minimum Fold transaction and keyed-table implementation needed for a selection decision. Fold materially provides atomic durable writes, pinned read snapshots, keyed upsert/remove, and crash rollback. Its public `wtx` contract commits when a closure returns normally, including when that return value is `Err`; a `Result` return has no special rollback meaning. The runnable reproducer confirms that documented boundary. That behavior is API/onboarding friction for fallible external batches, not a BogKit correctness defect by itself.
+
+For this workload, decoded batches can fail after earlier responses have been examined. A production adapter would therefore need a bespoke prevalidation/overlay layer that reproduces transaction state. Full snapshot publication would additionally need durable staged-message keys, staged UID enumeration, visible UID enumeration, replay records, cursor validation, and metadata bookkeeping. Consistent multi-key UI reads require a Fold sink in addition to `KeyedStream`'s own primary table, duplicating storage before comparison with SQLite.
+
+Decision: use Fold only in the decisive transaction reproducer, not as the candidate projection. ESE and ANNy remain unused because they do not address exact mailbox identity or count queries. The trial proceeds as a no-fit baseline/reference comparator unless later evidence reverses one of these boundaries. No API change is proposed from this one scenario; a documentation/example note would be the smallest upstream improvement if broader developer evidence supports it.
+
+## Post-review characterization and baseline repairs
+
+The skeptical review supplied an independent current-main observation that required extending the original Fold reproducer. The extended same-stream test now proves two distinct facts: the panicking transaction's row is absent, then a later valid `KeyedStream::wtx` panics with Fjall's `poisoned tx lock`. This writer-poisoning behavior is the already-tracked BogKit/Fold correctness defect; it is separate from the documented normal-`Err` commit boundary. Catching a panic is not a safe rollback workaround on this checkout. The trial records the defect without editing core. The smallest already-recorded core candidate is to drop the underlying transaction guard before resuming the panic and add both Stream and KeyedStream regressions; no new API is proposed here.
+
+The same review exposed two prototype defects in the baseline, both repaired test-first. First, every Rust `u64` field now has the exact shared domain `0..=9_223_372_036_854_775_807` in both the pure reference and SQLite implementation. UID validity, UID, cursor, byte size, and batch sequence are all checked before duplicate admission or mutation; max-boundary values round-trip exactly, while max-plus-one is rejected with identical diagnostics and no state or admission change. Second, deleting a mailbox now removes `staging_messages` for that stable ID inside the same admitted transaction. Physical-table tests cover reopen, repeated delete/recreate under the same ID, an incomplete staged epoch, and a failed rescan event. These are prototype fixes, not new BogKit findings.
diff --git a/developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/README.md b/developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/README.md
new file mode 100644
index 0000000..6ea0410
--- /dev/null
+++ b/developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/README.md
@@ -0,0 +1,90 @@
+# Epoch-safe mailbox mirror laboratory
+
+This is an isolated, synthetic comparison harness for Trial 2. It contains:
+
+- a pure Rust reference model;
+- a faithful SQLite baseline using the host's `/usr/bin/sqlite3`;
+- a deterministic framed-NDJSON generator;
+- `generate`, `apply`, `resume`, `verify`, and `summarize` commands; and
+- a decisive Fold transaction reproducer.
+
+No real mail, addresses, subjects, bodies, attachments, credentials, or network access are used. The SQLite mirror is disposable derived state.
+
+## Build and test
+
+From the repository root with the nested lab workspace:
+
+```console
+cargo test --manifest-path developer-simulation/Cargo.toml --offline --locked --package mailbox-mirror-lab --all-targets
+cargo fmt --manifest-path developer-simulation/Cargo.toml --package mailbox-mirror-lab -- --check
+cargo clippy --manifest-path developer-simulation/Cargo.toml --offline --locked --package mailbox-mirror-lab --all-targets --no-deps -- \
+  -D warnings -D clippy::all -D clippy::pedantic
+```
+
+Run the Fold transaction-boundary reproducer:
+
+```console
+cargo test --manifest-path developer-simulation/Cargo.toml --offline --locked --package mailbox-mirror-lab --test fold_reproducer -- --nocapture
+```
+
+The first test characterizes documented behavior: returning `Err` normally from a Fold write closure commits writes already made in that closure. The second characterizes the separate, already-tracked current-main correctness defect: a panic rolls back the rejected row, but after it is caught, a later write on the same stream panics with `poisoned tx lock`. Panic/catch-unwind is therefore not a safe application rollback strategy. This trial does not edit Fold core.
+
+## Exact integer domain and delete cleanup
+
+The reference and SQLite models accept every unsigned field only in the inclusive range `0..=9_223_372_036_854_775_807` (`i64::MAX`). This covers UID validity, UID, cursor, byte size, and batch sequence. Both models reject a larger value with `integer outside SQLite INTEGER range` before batch admission or any state mutation. Boundary and atomic-nonmutation regressions are in `tests/fault_matrix.rs`.
+
+Deleting a stable mailbox ID explicitly removes its `staging_messages` rows inside the same admitted SQLite transaction before deleting the mailbox. The regressions in `tests/sqlite_baseline.rs` cover reopen, two delete/recreate lifecycles under the same stable ID, incomplete staging, and a rejected rescan batch.
+
+## Small CLI demonstration
+
+Use an ordinary user-writable temporary directory and remove it afterwards:
+
+```console
+mkdir -p /tmp/mailbox-mirror-demo
+cargo run --manifest-path developer-simulation/Cargo.toml --offline --locked --release --package mailbox-mirror-lab -- generate \
+  --output /tmp/mailbox-mirror-demo/transcript.ndjson \
+  --seed 29 --mailboxes 30 --messages 300 --responses 1200
+cargo run --manifest-path developer-simulation/Cargo.toml --offline --locked --release --package mailbox-mirror-lab -- verify \
+  --transcript /tmp/mailbox-mirror-demo/transcript.ndjson \
+  --database /tmp/mailbox-mirror-demo/verified.sqlite
+cargo run --manifest-path developer-simulation/Cargo.toml --offline --locked --release --package mailbox-mirror-lab -- resume \
+  --transcript /tmp/mailbox-mirror-demo/transcript.ndjson \
+  --database /tmp/mailbox-mirror-demo/verified.sqlite
+cargo run --manifest-path developer-simulation/Cargo.toml --offline --locked --release --package mailbox-mirror-lab -- summarize \
+  --database /tmp/mailbox-mirror-demo/verified.sqlite
+```
+
+`apply` creates a new SQLite mirror without the independent reference comparison:
+
+```console
+cargo run --manifest-path developer-simulation/Cargo.toml --offline --locked --release --package mailbox-mirror-lab -- apply \
+  --transcript /tmp/mailbox-mirror-demo/transcript.ndjson \
+  --database /tmp/mailbox-mirror-demo/applied.sqlite
+```
+
+`verify` compares every generated checkpoint and the final canonical manifest against the pure reference. `resume` replays the entire transcript against an existing mirror and reports the duplicate responses. `summarize` emits the canonical visible manifest.
+
+## Full workload command
+
+The measured full-scale run used:
+
+```console
+cargo run --manifest-path developer-simulation/Cargo.toml --offline --locked --release --package mailbox-mirror-lab -- generate \
+  --output /tmp/mailbox-mirror-demo/full.ndjson \
+  --seed 43 --mailboxes 80 --messages 300000 --responses 600000
+cargo run --manifest-path developer-simulation/Cargo.toml --offline --locked --release --package mailbox-mirror-lab -- verify \
+  --transcript /tmp/mailbox-mirror-demo/full.ndjson \
+  --database /tmp/mailbox-mirror-demo/full.sqlite
+```
+
+On the declared host after the repair, the single run matched the reference in 49.101 seconds. Exact evidence and limitations are in `evidence/full-campaign.txt`.
+
+## Transcript safety and framing
+
+Every accepted response batch has explicit `begin` and `commit` records. Responses remain in memory until a matching commit record arrives. An explicit `disconnect` discards the incomplete batch. The final `end` record carries response and record counts, so truncation at a clean batch boundary is still detected.
+
+Diagnostics contain only a stable mailbox ID, sequence, and fixed diagnostic code. They do not echo event contents or display names.
+
+## Important limits
+
+This is a no-fit experiment, not a proposed mail subsystem. It does not provide protocol parsing, real networking, two-way flag changes, arbitrary disk-corruption repair, or account/UI integration. It does not prove the full 30-seed, 400-process-exit, peak-RSS, write-amplification, or dense-checkpoint gates. It has no safe Fold candidate/resource comparison because the candidate did not cross the correctness threshold. It deliberately retains SQLite rather than presenting an incomplete Fold adapter as a replacement.
diff --git a/developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/evidence/build-release.txt b/developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/evidence/build-release.txt
new file mode 100644
index 0000000..5448c8d
--- /dev/null
+++ b/developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/evidence/build-release.txt
@@ -0,0 +1,6 @@
+Command:
+  cargo build --offline --locked --release
+
+Fresh post-review result:
+  PASS
+  Finished release profile successfully.
diff --git a/developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/evidence/chunk-determinism.txt b/developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/evidence/chunk-determinism.txt
new file mode 100644
index 0000000..806ac7d
--- /dev/null
+++ b/developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/evidence/chunk-determinism.txt
@@ -0,0 +1,8 @@
+   Compiling mailbox-mirror-lab v0.1.0 (developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror)
+    Finished `test` profile [unoptimized + debuginfo] target(s) in 0.33s
+     Running tests/transcript.rs (target/debug/deps/transcript-402a5a0879a2ffc7)
+
+running 1 test
+test chunk_sizes_from_one_byte_to_one_mebibyte_produce_the_same_manifest ... ok
+
+test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 4 filtered out; finished in 3.63s
diff --git a/developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/evidence/cleanup-final.txt b/developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/evidence/cleanup-final.txt
new file mode 100644
index 0000000..c1a46e2
--- /dev/null
+++ b/developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/evidence/cleanup-final.txt
@@ -0,0 +1,26 @@
+Fresh final cleanup and scope scan, 2026-08-14
+
+Verified absent:
+  developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/target
+  <temporary-run-dir>
+  <temporary-run-dir>
+  <temporary-run-dir>
+
+Recursive output scans returned no:
+  target directory
+  *.sqlite, *.sqlite-wal, *.sqlite-shm, *.db, or *.ndjson file
+  *.tmp or *.log file
+  symlink
+  executable file
+  file larger than 1 MiB
+
+Output size before adding this small proof file:
+  400K simulation-output
+
+Scope result:
+  git diff --exit-code: PASS; no tracked difference
+  git status --short: ?? simulation-output/
+
+One formatting-only tracked diff discovered during cleanup was restored to the
+exact checked-in bytes before these commands. No core, example, root, Git,
+GitHub, or automation change remains.
diff --git a/developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/evidence/cli-demo-repair.txt b/developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/evidence/cli-demo-repair.txt
new file mode 100644
index 0000000..48134e9
--- /dev/null
+++ b/developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/evidence/cli-demo-repair.txt
@@ -0,0 +1,18 @@
+Fresh post-review CLI demonstration, seed 29
+
+generate:
+  30 mailboxes; 300 live messages; 1,200 responses; 60 duplicates; 12 epoch changes; 20 renames; 10 delete/recreate lifecycles; 1 disconnect; 1,476 framed records.
+
+verify:
+  1,200 responses; 60 duplicates; 133 admitted batches; 5 checkpoints; 1 disconnect; 733 ms; 30 mailboxes; 300 messages; exact reference/SQLite parity.
+
+resume against the completed database:
+  1,200 responses; 1,199 duplicates; 0 admitted batches; 5 checkpoints; 1 disconnect; 487 ms; 30 mailboxes; 300 messages.
+
+summarize:
+  30 mailboxes; 300 live messages.
+
+apply into a separate database:
+  1,200 responses; 60 duplicates; 133 admitted batches; 5 checkpoints; 1 disconnect; 709 ms; 30 mailboxes; 300 messages.
+
+All five commands exited successfully. The transcript and both databases plus sidecars were removed before handoff.
diff --git a/developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/evidence/clippy-strict.txt b/developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/evidence/clippy-strict.txt
new file mode 100644
index 0000000..3471cb1
--- /dev/null
+++ b/developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/evidence/clippy-strict.txt
@@ -0,0 +1,8 @@
+Command:
+  cargo clippy --offline --locked --all-targets --no-deps -- \
+    -D warnings -D clippy::all -D clippy::pedantic
+
+Fresh post-review result:
+  PASS
+  Checking mailbox-mirror-lab v0.1.0
+  Finished dev profile successfully.
diff --git a/developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/evidence/fault-matrix.txt b/developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/evidence/fault-matrix.txt
new file mode 100644
index 0000000..e424f26
--- /dev/null
+++ b/developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/evidence/fault-matrix.txt
@@ -0,0 +1,9 @@
+   Compiling mailbox-mirror-lab v0.1.0 (developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror)
+    Finished `test` profile [unoptimized + debuginfo] target(s) in 0.53s
+     Running tests/fault_matrix.rs (target/debug/deps/fault_matrix-2fa49698dd3ce5c7)
+
+running 2 tests
+test incremental_event_for_uncommitted_epoch_is_rejected_without_hiding_old_epoch ... ok
+test decreasing_cursor_unknown_mailbox_and_illegal_reordering_do_not_mutate ... ok
+
+test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.07s
diff --git a/developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/evidence/fmt-check-before.txt b/developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/evidence/fmt-check-before.txt
new file mode 100644
index 0000000..4d988c6
--- /dev/null
+++ b/developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/evidence/fmt-check-before.txt
@@ -0,0 +1,382 @@
+Diff in developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/src/lib.rs:945:
+         self.record(&TranscriptRecord::Checkpoint {
+             id: id.into(),
+             mailbox_id: mailbox.id.clone(),
+-            selected_uids: mailbox.messages.iter().take(3).map(|message| message.uid).collect(),
++            selected_uids: mailbox
++                .messages
++                .iter()
++                .take(3)
++                .map(|message| message.uid)
++                .collect(),
+         })
+     }
+ }
+Diff in developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/src/lib.rs:1162:
+     output.record(&TranscriptRecord::Disconnect)?;
+
+     if output.responses > unique_target {
+-        return Err(MirrorError::new("response budget is too small for required scenarios"));
++        return Err(MirrorError::new(
++            "response budget is too small for required scenarios",
++        ));
+     }
+     let mut duplicate_batches = Vec::new();
+     let mut duplicate_reserved = 0_usize;
+Diff in developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/src/lib.rs:1208:
+         output.batch(batch)?;
+     }
+     output.checkpoint("final-a", &mailboxes[active_indices[0]])?;
+-    output.checkpoint("final-b", &mailboxes[active_indices[active_indices.len() / 2]])?;
++    output.checkpoint(
++        "final-b",
++        &mailboxes[active_indices[active_indices.len() / 2]],
++    )?;
+
+     if output.responses != config.responses || duplicate_reserved != duplicate_target {
+-        return Err(MirrorError::new("generator failed to meet exact response budget"));
++        return Err(MirrorError::new(
++            "generator failed to meet exact response budget",
++        ));
+     }
+     let final_record_count = output.records + 1;
+     output.record(&TranscriptRecord::End {
+Diff in developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/src/lib.rs:1250:
+     let mut saw_end = false;
+     for line in reader.lines() {
+         if saw_end {
+-            return Err(TranscriptDiagnostic::new(
+-                "unknown",
+-                0,
+-                "record_after_end",
+-            ));
++            return Err(TranscriptDiagnostic::new("unknown", 0, "record_after_end"));
+         }
+         let line = line.map_err(|_| pending_diagnostic(&pending, "input_read_failed"))?;
+         let record: TranscriptRecord = serde_json::from_str(&line)
+Diff in developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/src/lib.rs:1272:
+                 pending = Some(Batch::new(batch_id, mailbox_id, sequence, Vec::new()));
+             }
+             TranscriptRecord::Response { event } => {
+-                let batch = pending
+-                    .as_mut()
+-                    .ok_or_else(|| TranscriptDiagnostic::new("unknown", 0, "response_without_batch"))?;
++                let batch = pending.as_mut().ok_or_else(|| {
++                    TranscriptDiagnostic::new("unknown", 0, "response_without_batch")
++                })?;
+                 batch.events.push(event);
+                 responses += 1;
+             }
+Diff in developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/src/lib.rs:1281:
+             TranscriptRecord::Commit { batch_id } => {
+-                let batch = pending
+-                    .take()
+-                    .ok_or_else(|| TranscriptDiagnostic::new("unknown", 0, "commit_without_batch"))?;
++                let batch = pending.take().ok_or_else(|| {
++                    TranscriptDiagnostic::new("unknown", 0, "commit_without_batch")
++                })?;
+                 if batch.batch_id != batch_id {
+                     return Err(TranscriptDiagnostic::new(
+                         batch.mailbox_id,
+Diff in developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/src/lib.rs:1290:
+                     ));
+                 }
+                 let reference_outcome = reference.apply(&batch).map_err(|_| {
+-                    TranscriptDiagnostic::new(&batch.mailbox_id, batch.sequence, "reference_rejected_batch")
++                    TranscriptDiagnostic::new(
++                        &batch.mailbox_id,
++                        batch.sequence,
++                        "reference_rejected_batch",
++                    )
+                 })?;
+                 let sqlite_outcome = sqlite.apply(&batch).map_err(|_| {
+-                    TranscriptDiagnostic::new(&batch.mailbox_id, batch.sequence, "sqlite_rejected_batch")
++                    TranscriptDiagnostic::new(
++                        &batch.mailbox_id,
++                        batch.sequence,
++                        "sqlite_rejected_batch",
++                    )
+                 })?;
+                 if reference_outcome != sqlite_outcome {
+                     return Err(TranscriptDiagnostic::new(
+Diff in developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/src/lib.rs:1316:
+                 if pending.is_some() {
+                     return Err(pending_diagnostic(&pending, "checkpoint_inside_batch"));
+                 }
+-                let expected = reference.checkpoint(&mailbox_id, &selected_uids).map_err(|_| {
+-                    TranscriptDiagnostic::new(&mailbox_id, 0, "reference_checkpoint_failed")
+-                })?;
+-                let actual = sqlite.checkpoint(&mailbox_id, &selected_uids).map_err(|_| {
+-                    TranscriptDiagnostic::new(&mailbox_id, 0, "sqlite_checkpoint_failed")
+-                })?;
++                let expected = reference
++                    .checkpoint(&mailbox_id, &selected_uids)
++                    .map_err(|_| {
++                        TranscriptDiagnostic::new(&mailbox_id, 0, "reference_checkpoint_failed")
++                    })?;
++                let actual = sqlite
++                    .checkpoint(&mailbox_id, &selected_uids)
++                    .map_err(|_| {
++                        TranscriptDiagnostic::new(&mailbox_id, 0, "sqlite_checkpoint_failed")
++                    })?;
+                 if actual != expected {
+                     return Err(TranscriptDiagnostic::new(
+                         mailbox_id,
+Diff in developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/src/lib.rs:1370:
+         .manifest()
+         .map_err(|_| TranscriptDiagnostic::new("unknown", 0, "sqlite_manifest_failed"))?;
+     if actual != expected {
+-        return Err(TranscriptDiagnostic::new(
+-            "unknown",
+-            0,
+-            "manifest_mismatch",
+-        ));
++        return Err(TranscriptDiagnostic::new("unknown", 0, "manifest_mismatch"));
+     }
+     Ok(VerificationSummary {
+         responses,
+Diff in developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/src/lib.rs:1409:
+     let mut saw_end = false;
+     for line in reader.lines() {
+         if saw_end {
+-            return Err(TranscriptDiagnostic::new(
+-                "unknown",
+-                0,
+-                "record_after_end",
+-            ));
++            return Err(TranscriptDiagnostic::new("unknown", 0, "record_after_end"));
+         }
+         let line = line.map_err(|_| pending_diagnostic(&pending, "input_read_failed"))?;
+         let record: TranscriptRecord = serde_json::from_str(&line)
+Diff in developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/src/lib.rs:1431:
+                 pending = Some(Batch::new(batch_id, mailbox_id, sequence, Vec::new()));
+             }
+             TranscriptRecord::Response { event } => {
+-                let batch = pending
+-                    .as_mut()
+-                    .ok_or_else(|| TranscriptDiagnostic::new("unknown", 0, "response_without_batch"))?;
++                let batch = pending.as_mut().ok_or_else(|| {
++                    TranscriptDiagnostic::new("unknown", 0, "response_without_batch")
++                })?;
+                 batch.events.push(event);
+                 responses += 1;
+             }
+Diff in developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/src/lib.rs:1440:
+             TranscriptRecord::Commit { batch_id } => {
+-                let batch = pending
+-                    .take()
+-                    .ok_or_else(|| TranscriptDiagnostic::new("unknown", 0, "commit_without_batch"))?;
++                let batch = pending.take().ok_or_else(|| {
++                    TranscriptDiagnostic::new("unknown", 0, "commit_without_batch")
++                })?;
+                 if batch.batch_id != batch_id {
+                     return Err(TranscriptDiagnostic::new(
+                         batch.mailbox_id,
+Diff in developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/src/lib.rs:1449:
+                     ));
+                 }
+                 let outcome = sqlite.apply(&batch).map_err(|_| {
+-                    TranscriptDiagnostic::new(&batch.mailbox_id, batch.sequence, "sqlite_rejected_batch")
++                    TranscriptDiagnostic::new(
++                        &batch.mailbox_id,
++                        batch.sequence,
++                        "sqlite_rejected_batch",
++                    )
+                 })?;
+                 if outcome == ApplyOutcome::Duplicate {
+                     duplicate_responses += batch.events.len();
+Diff in developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/src/lib.rs:1465:
+                 if pending.is_some() {
+                     return Err(pending_diagnostic(&pending, "checkpoint_inside_batch"));
+                 }
+-                sqlite.checkpoint(&mailbox_id, &selected_uids).map_err(|_| {
+-                    TranscriptDiagnostic::new(&mailbox_id, 0, "sqlite_checkpoint_failed")
+-                })?;
++                sqlite
++                    .checkpoint(&mailbox_id, &selected_uids)
++                    .map_err(|_| {
++                        TranscriptDiagnostic::new(&mailbox_id, 0, "sqlite_checkpoint_failed")
++                    })?;
+                 checkpoints += 1;
+             }
+             TranscriptRecord::Disconnect => {
+Diff in developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/src/main.rs:104:
+                 return Err("database already exists; use resume".to_owned());
+             }
+             let reader = open_transcript(&transcript)?;
+-            let summary = apply_transcript(reader, &database, false).map_err(|error| error.to_string())?;
++            let summary =
++                apply_transcript(reader, &database, false).map_err(|error| error.to_string())?;
+             print_json(&summary)
+         }
+         HarnessCommand::Resume {
+Diff in developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/src/main.rs:112:
+             database,
+         } => {
+             let reader = open_transcript(&transcript)?;
+-            let summary = apply_transcript(reader, &database, true).map_err(|error| error.to_string())?;
++            let summary =
++                apply_transcript(reader, &database, true).map_err(|error| error.to_string())?;
+             print_json(&summary)
+         }
+         HarnessCommand::Verify {
+Diff in developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/src/main.rs:123:
+                 return Err("verification database already exists".to_owned());
+             }
+             let reader = open_transcript(&transcript)?;
+-            let summary = verify_transcript(reader, &database).map_err(|error| error.to_string())?;
++            let summary =
++                verify_transcript(reader, &database).map_err(|error| error.to_string())?;
+             print_json(&summary)
+         }
+         HarnessCommand::Summarize { database } => {
+Diff in developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/tests/baseline_measure.rs:71:
+     let reopened = SqliteBaseline::open(&path).unwrap();
+     assert_eq!(reopened.checkpoint("mailbox-00", &[]).unwrap().total, 500);
+     let reopen_ms = reopen_started.elapsed().as_secs_f64() * 1000.0;
+-    let disk_bytes = [path.clone(), path.with_extension("sqlite-wal"), path.with_extension("sqlite-shm")]
+-        .iter()
+-        .filter_map(|entry| std::fs::metadata(entry).ok())
+-        .map(|metadata| metadata.len())
+-        .sum::<u64>();
++    let disk_bytes = [
++        path.clone(),
++        path.with_extension("sqlite-wal"),
++        path.with_extension("sqlite-shm"),
++    ]
++    .iter()
++    .filter_map(|entry| std::fs::metadata(entry).ok())
++    .map(|metadata| metadata.len())
++    .sum::<u64>();
+     println!(
+         "{{\"mailboxes\":20,\"messages\":10000,\"batches\":120,\"apply_ms\":{apply_ms:.3},\"responses_per_second\":{:.1},\"count_p50_us\":{p50_us},\"count_p95_us\":{p95_us},\"reopen_ms\":{reopen_ms:.3},\"disk_bytes\":{disk_bytes}}}",
+         10_020.0 / (apply_ms / 1000.0)
+Diff in developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/tests/cli.rs:23:
+         ])
+         .output()
+         .unwrap();
+-    assert!(generated.status.success(), "{}", String::from_utf8_lossy(&generated.stderr));
++    assert!(
++        generated.status.success(),
++        "{}",
++        String::from_utf8_lossy(&generated.stderr)
++    );
+
+     let verified = Command::new(binary)
+         .args(["verify", "--transcript"])
+Diff in developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/tests/cli.rs:32:
+         .arg(&database)
+         .output()
+         .unwrap();
+-    assert!(verified.status.success(), "{}", String::from_utf8_lossy(&verified.stderr));
++    assert!(
++        verified.status.success(),
++        "{}",
++        String::from_utf8_lossy(&verified.stderr)
++    );
+
+     let resumed = Command::new(binary)
+         .args(["resume", "--transcript"])
+Diff in developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/tests/cli.rs:41:
+         .arg(&database)
+         .output()
+         .unwrap();
+-    assert!(resumed.status.success(), "{}", String::from_utf8_lossy(&resumed.stderr));
++    assert!(
++        resumed.status.success(),
++        "{}",
++        String::from_utf8_lossy(&resumed.stderr)
++    );
+
+     let summarized = Command::new(binary)
+         .args(["summarize", "--database"])
+Diff in developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/tests/cli.rs:48:
+         .arg(&database)
+         .output()
+         .unwrap();
+-    assert!(summarized.status.success(), "{}", String::from_utf8_lossy(&summarized.stderr));
++    assert!(
++        summarized.status.success(),
++        "{}",
++        String::from_utf8_lossy(&summarized.stderr)
++    );
+     let manifest: serde_json::Value = serde_json::from_slice(&summarized.stdout).unwrap();
+     assert_eq!(manifest["live_messages"], 300);
+ }
+Diff in developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/tests/reference.rs:231:
+     assert_eq!(renamed.total, 1);
+
+     mirror
+-        .apply(&Batch::new(
+-            "delete",
+-            "stable-old",
+-            4,
+-            vec![Event::Delete],
+-        ))
++        .apply(&Batch::new("delete", "stable-old", 4, vec![Event::Delete]))
+         .unwrap();
+     assert!(mirror.checkpoint("stable-old", &[9]).is_err());
+
+Diff in developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/tests/sqlite_baseline.rs:55:
+     for batch in &batches {
+         reference.apply(batch).unwrap();
+         sqlite.apply(batch).unwrap();
+-        assert_eq!(sqlite.checkpoint("mailbox-a", &[5]).unwrap(), reference.checkpoint("mailbox-a", &[5]).unwrap());
++        assert_eq!(
++            sqlite.checkpoint("mailbox-a", &[5]).unwrap(),
++            reference.checkpoint("mailbox-a", &[5]).unwrap()
++        );
+     }
+     let commit = Batch::new(
+         "commit",
+Diff in developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/tests/sqlite_baseline.rs:69:
+     reference.apply(&commit).unwrap();
+     sqlite.apply(&commit).unwrap();
+     sqlite.apply(&commit).unwrap();
+-    assert_eq!(sqlite.checkpoint("mailbox-a", &[5]).unwrap(), reference.checkpoint("mailbox-a", &[5]).unwrap());
++    assert_eq!(
++        sqlite.checkpoint("mailbox-a", &[5]).unwrap(),
++        reference.checkpoint("mailbox-a", &[5]).unwrap()
++    );
+ }
+
+ #[test]
+Diff in developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/tests/sqlite_baseline.rs:121:
+     let mut reopened = SqliteBaseline::open(&path).unwrap();
+     let before = reopened.checkpoint("mailbox-a", &[10]).unwrap();
+     assert_eq!(before.uid_validity, 1);
+-    assert_eq!(before.selected[0].fingerprint, "11111111111111111111111111111111");
++    assert_eq!(
++        before.selected[0].fingerprint,
++        "11111111111111111111111111111111"
++    );
+     reopened
+         .apply(&Batch::new(
+             "commit",
+Diff in developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/tests/sqlite_baseline.rs:135:
+         .unwrap();
+     let after = reopened.checkpoint("mailbox-a", &[10]).unwrap();
+     assert_eq!(after.uid_validity, 2);
+-    assert_eq!(after.selected[0].fingerprint, "22222222222222222222222222222222");
++    assert_eq!(
++        after.selected[0].fingerprint,
++        "22222222222222222222222222222222"
++    );
+ }
+
+Diff in developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/tests/sqlite_concurrency.rs:59:
+                     let checkpoint = reader.checkpoint("mailbox-a", &selected).unwrap();
+                     assert_eq!(checkpoint.total, 20);
+                     assert_eq!(checkpoint.selected.len(), 20);
+-                    assert!(checkpoint
+-                        .selected
+-                        .iter()
+-                        .all(|message| message.fingerprint.starts_with(&format!("{:016x}", checkpoint.uid_validity))));
++                    assert!(checkpoint.selected.iter().all(|message| {
++                        message
++                            .fingerprint
++                            .starts_with(&format!("{:016x}", checkpoint.uid_validity))
++                    }));
+                 }
+             }));
+         }
diff --git a/developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/evidence/fmt-check-final.txt b/developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/evidence/fmt-check-final.txt
new file mode 100644
index 0000000..2ba0f01
--- /dev/null
+++ b/developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/evidence/fmt-check-final.txt
@@ -0,0 +1,5 @@
+Command:
+  cargo fmt --check
+
+Fresh post-review result:
+  PASS; exit status 0 with no differences.
diff --git a/developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/evidence/fold-panic-poisoning-characterization.txt b/developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/evidence/fold-panic-poisoning-characterization.txt
new file mode 100644
index 0000000..45b5eec
--- /dev/null
+++ b/developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/evidence/fold-panic-poisoning-characterization.txt
@@ -0,0 +1,100 @@
+Command:
+  cargo test --offline --locked --test fold_reproducer -- --nocapture
+
+Expected characterization result:
+  PASS; 2 passed, including two caught panic messages from current main.
+  The first panic rejects the batch and its row is absent.
+  The second panic is the later same-stream write failing with `poisoned tx lock`.
+  This is not evidence that panic/catch-unwind is a safe application workaround.
+
+Raw output:
+   Compiling proc-macro2 v1.0.107
+   Compiling unicode-ident v1.0.24
+   Compiling quote v1.0.47
+   Compiling libc v0.2.189
+   Compiling crossbeam-utils v0.8.22
+   Compiling cfg-if v1.0.4
+   Compiling serde_core v1.0.229
+   Compiling rustix v1.1.4
+   Compiling once_cell v1.21.4
+   Compiling crossbeam-epoch v0.9.20
+   Compiling semver v1.0.28
+   Compiling getrandom v0.4.3
+   Compiling scopeguard v1.2.0
+   Compiling byteorder v1.5.0
+   Compiling serde v1.0.229
+   Compiling lock_api v0.4.14
+   Compiling bitflags v2.13.1
+   Compiling parking_lot_core v0.9.12
+   Compiling thiserror v2.0.19
+   Compiling rustc_version v0.4.1
+   Compiling smallvec v1.15.2
+   Compiling equivalent v1.0.2
+   Compiling fastrand v2.5.0
+   Compiling utf8parse v0.2.2
+   Compiling byteorder-lite v0.1.0
+   Compiling heapless v0.7.17
+   Compiling log v0.4.33
+   Compiling compare v0.0.6
+   Compiling xxhash-rust v0.8.18
+   Compiling hashbrown v0.16.1
+   Compiling interval-heap v0.0.5
+   Compiling sfa v1.0.0
+   Compiling anstyle-parse v1.0.0
+   Compiling spin v0.9.9
+   Compiling quick_cache v0.6.24
+   Compiling hash32 v0.2.1
+   Compiling stable_deref_trait v1.2.1
+   Compiling varint-rs v2.2.1
+   Compiling colorchoice v1.0.5
+   Compiling zmij v1.0.23
+   Compiling is_terminal_polyfill v1.70.2
+   Compiling rustc-hash v2.1.3
+   Compiling anstyle v1.0.14
+   Compiling self_cell v1.3.0
+   Compiling anstyle-query v1.1.5
+   Compiling hashbrown v0.14.5
+   Compiling byteview v0.10.2
+   Compiling anstream v1.0.0
+   Compiling flume v0.12.0
+   Compiling clap_lex v1.1.0
+   Compiling syn v3.0.3
+   Compiling syn v2.0.119
+   Compiling strsim v0.11.1
+   Compiling serde_json v1.0.151
+   Compiling heck v0.5.0
+   Compiling clap_builder v4.6.0
+   Compiling fxhash v0.2.1
+   Compiling itoa v1.0.18
+   Compiling memchr v2.8.3
+   Compiling anny v0.0.1 (<sanitized-main-checkout>/anny)
+   Compiling crossbeam-skiplist v0.1.3
+   Compiling serde_derive v1.0.229
+   Compiling thiserror-impl v2.0.19
+   Compiling errno v0.3.14
+   Compiling dashmap v6.2.1
+   Compiling enum_dispatch v0.3.13
+   Compiling clap_derive v4.6.1
+   Compiling tempfile v3.27.0
+   Compiling lsm-tree v3.1.8
+   Compiling cobs v0.3.0
+   Compiling clap v4.6.1
+   Compiling postcard v1.1.3
+   Compiling fjall v3.1.8
+   Compiling fold v0.0.1 (<sanitized-main-checkout>/fold)
+   Compiling mailbox-mirror-lab v0.1.0 (developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror)
+    Finished `test` profile [unoptimized + debuginfo] target(s) in 5.28s
+     Running tests/fold_reproducer.rs (target/debug/deps/fold_reproducer-dc7cc6f42ff44b5c)
+
+running 2 tests
+
+thread 'caught_panic_rolls_back_rejected_row_but_poisons_the_same_streams_later_write' (57510018) panicked at tests/fold_reproducer.rs:34:13:
+reject batch
+note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace
+
+thread 'caught_panic_rolls_back_rejected_row_but_poisons_the_same_streams_later_write' (57510018) panicked at /Users/edouard/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/fjall-3.1.8/src/tx/single_writer/mod.rs:61:52:
+poisoned tx lock: PoisonError { .. }
+test caught_panic_rolls_back_rejected_row_but_poisons_the_same_streams_later_write ... ok
+test returning_an_error_from_fold_write_closure_still_commits_prior_writes ... ok
+
+test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.25s
diff --git a/developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/evidence/full-campaign.txt b/developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/evidence/full-campaign.txt
new file mode 100644
index 0000000..95abac8
--- /dev/null
+++ b/developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/evidence/full-campaign.txt
@@ -0,0 +1,43 @@
+Fresh post-review campaign, 2026-08-14
+
+Command:
+  cargo build --offline --locked --release
+Result: PASS; release profile finished.
+
+Command (run twice, changing the second output name):
+  target/release/mailbox-mirror-lab generate \
+    --output <temporary-run-dir>/full.ndjson \
+    --seed 43 --mailboxes 80 --messages 300000 --responses 600000
+Result:
+  {"seed":43,"mailboxes":80,"live_messages":300000,"responses":600000,"duplicate_responses":30000,"epoch_changes":12,"renames":20,"deletions_and_recreations":10,"disconnects":1,"records":612318}
+Both 94,332,125-byte outputs were byte-identical.
+SHA-256: f3b0ced58ff481f07f5d1105312c1728926606e8944f631481ead9789bef373f
+
+Command:
+  target/release/mailbox-mirror-lab verify \
+    --transcript <temporary-run-dir>/full.ndjson \
+    --database <temporary-run-dir>/full.sqlite
+Result excluding the 300,000-message canonical manifest:
+  {"responses":600000,"duplicate_responses":30000,"batches_applied":5855,"checkpoints":5,"disconnects":1,"elapsed_ms":49101,"mailboxes":80,"messages":300000}
+Reference and SQLite checkpoints and final canonical manifests matched exactly.
+Manifest summary SHA-256: ca7ad005908e1699ae14787552eb4880a2fa1c551845cffbcb528b6f30349909
+SQLite after completion: 114,429,952-byte database, 32,768-byte shared-memory sidecar, zero-byte WAL.
+
+Command:
+  target/release/mailbox-mirror-lab resume \
+    --transcript <temporary-run-dir>/full.ndjson \
+    --database <temporary-run-dir>/full.sqlite
+Result excluding manifest:
+  {"responses":600000,"duplicate_responses":599999,"batches_applied":0,"checkpoints":5,"disconnects":1,"elapsed_ms":35865,"mailboxes":80,"messages":300000}
+The one non-duplicate response is the explicit disconnect, which is not an admitted batch.
+Manifest summary SHA-256 after replay remained ca7ad005908e1699ae14787552eb4880a2fa1c551845cffbcb528b6f30349909.
+
+Evidence limits:
+- One full reference/SQLite seed was verified, not 30 full seeds.
+- Five generated checkpoints were compared, not a dense checkpoint campaign.
+- Peak RSS is not measured: the unchanged host timing approach cannot access kern.clockrate in this sandbox.
+- The 400 abrupt process-exit matrix and write amplification were not run.
+- No candidate resource comparison exists because no Fold candidate crossed the safety threshold.
+
+Cleanup:
+The two transcripts, database, WAL/SHM files, demo state, and build target were removed before handoff.
diff --git a/developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/evidence/green-01-reference-duplicate.txt b/developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/evidence/green-01-reference-duplicate.txt
new file mode 100644
index 0000000..6f61d33
--- /dev/null
+++ b/developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/evidence/green-01-reference-duplicate.txt
@@ -0,0 +1,8 @@
+   Compiling mailbox-mirror-lab v0.1.0 (developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror)
+    Finished `test` profile [unoptimized + debuginfo] target(s) in 0.77s
+     Running tests/reference.rs (target/debug/deps/reference-eca04c105f8a5b2f)
+
+running 1 test
+test duplicate_complete_batch_is_idempotent ... ok
+
+test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s
diff --git a/developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/evidence/green-02-epoch-staging.txt b/developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/evidence/green-02-epoch-staging.txt
new file mode 100644
index 0000000..fe0dceb
--- /dev/null
+++ b/developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/evidence/green-02-epoch-staging.txt
@@ -0,0 +1,8 @@
+   Compiling mailbox-mirror-lab v0.1.0 (developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror)
+    Finished `test` profile [unoptimized + debuginfo] target(s) in 0.21s
+     Running tests/reference.rs (target/debug/deps/reference-eca04c105f8a5b2f)
+
+running 1 test
+test replacement_epoch_stays_hidden_until_snapshot_commit ... ok
+
+test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 1 filtered out; finished in 0.00s
diff --git a/developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/evidence/green-03-flags-expunge.txt b/developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/evidence/green-03-flags-expunge.txt
new file mode 100644
index 0000000..eb1d141
--- /dev/null
+++ b/developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/evidence/green-03-flags-expunge.txt
@@ -0,0 +1,8 @@
+   Compiling mailbox-mirror-lab v0.1.0 (developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror)
+    Finished `test` profile [unoptimized + debuginfo] target(s) in 0.69s
+     Running tests/reference.rs (target/debug/deps/reference-eca04c105f8a5b2f)
+
+running 1 test
+test flag_replacement_and_expunge_update_materialized_counts ... ok
+
+test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 2 filtered out; finished in 0.01s
diff --git a/developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/evidence/green-04-identity-lifecycle.txt b/developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/evidence/green-04-identity-lifecycle.txt
new file mode 100644
index 0000000..5c80b75
--- /dev/null
+++ b/developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/evidence/green-04-identity-lifecycle.txt
@@ -0,0 +1,8 @@
+   Compiling mailbox-mirror-lab v0.1.0 (developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror)
+    Finished `test` profile [unoptimized + debuginfo] target(s) in 0.35s
+     Running tests/reference.rs (target/debug/deps/reference-eca04c105f8a5b2f)
+
+running 1 test
+test rename_preserves_stable_id_but_recreated_name_does_not_resurrect_state ... ok
+
+test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 3 filtered out; finished in 0.00s
diff --git a/developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/evidence/green-05-reference-suite.txt b/developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/evidence/green-05-reference-suite.txt
new file mode 100644
index 0000000..f5c1051
--- /dev/null
+++ b/developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/evidence/green-05-reference-suite.txt
@@ -0,0 +1,12 @@
+   Compiling mailbox-mirror-lab v0.1.0 (developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror)
+    Finished `test` profile [unoptimized + debuginfo] target(s) in 0.36s
+     Running tests/reference.rs (target/debug/deps/reference-eca04c105f8a5b2f)
+
+running 5 tests
+test rejected_batch_has_no_partial_mutation ... ok
+test duplicate_complete_batch_is_idempotent ... ok
+test flag_replacement_and_expunge_update_materialized_counts ... ok
+test replacement_epoch_stays_hidden_until_snapshot_commit ... ok
+test rename_preserves_stable_id_but_recreated_name_does_not_resurrect_state ... ok
+
+test result: ok. 5 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s
diff --git a/developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/evidence/green-06-sqlite-baseline.txt b/developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/evidence/green-06-sqlite-baseline.txt
new file mode 100644
index 0000000..a05595b
--- /dev/null
+++ b/developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/evidence/green-06-sqlite-baseline.txt
@@ -0,0 +1,8 @@
+   Compiling mailbox-mirror-lab v0.1.0 (developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror)
+    Finished `test` profile [unoptimized + debuginfo] target(s) in 0.29s
+     Running tests/sqlite_baseline.rs (target/debug/deps/sqlite_baseline-c930e35642f6b4d8)
+
+running 1 test
+test sqlite_baseline_matches_reference_across_epoch_publication_and_replay ... ok
+
+test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.09s
diff --git a/developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/evidence/green-07-sqlite-reopen.txt b/developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/evidence/green-07-sqlite-reopen.txt
new file mode 100644
index 0000000..91a4ee8
--- /dev/null
+++ b/developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/evidence/green-07-sqlite-reopen.txt
@@ -0,0 +1,8 @@
+   Compiling mailbox-mirror-lab v0.1.0 (developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror)
+    Finished `test` profile [unoptimized + debuginfo] target(s) in 0.34s
+     Running tests/sqlite_baseline.rs (target/debug/deps/sqlite_baseline-c930e35642f6b4d8)
+
+running 1 test
+test reopening_retains_old_epoch_and_durable_staging_until_commit ... ok
+
+test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 1 filtered out; finished in 0.07s
diff --git a/developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/evidence/green-08-transcript-harness.txt b/developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/evidence/green-08-transcript-harness.txt
new file mode 100644
index 0000000..8f922ee
--- /dev/null
+++ b/developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/evidence/green-08-transcript-harness.txt
@@ -0,0 +1,9 @@
+   Compiling mailbox-mirror-lab v0.1.0 (developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror)
+    Finished `test` profile [unoptimized + debuginfo] target(s) in 0.88s
+     Running tests/transcript.rs (target/debug/deps/transcript-a05e330501f8dea6)
+
+running 2 tests
+test unterminated_batch_reports_only_mailbox_and_sequence_and_mutates_nothing ... ok
+test generated_transcript_is_deterministic_and_matches_both_models ... ok
+
+test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.79s
diff --git a/developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/evidence/green-09-resume.txt b/developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/evidence/green-09-resume.txt
new file mode 100644
index 0000000..a0689c7
--- /dev/null
+++ b/developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/evidence/green-09-resume.txt
@@ -0,0 +1,8 @@
+   Compiling mailbox-mirror-lab v0.1.0 (developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror)
+    Finished `test` profile [unoptimized + debuginfo] target(s) in 0.76s
+     Running tests/transcript.rs (target/debug/deps/transcript-a05e330501f8dea6)
+
+running 1 test
+test applying_then_resuming_the_same_transcript_is_idempotent ... ok
+
+test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 2 filtered out; finished in 1.29s
diff --git a/developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/evidence/green-10-cli.txt b/developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/evidence/green-10-cli.txt
new file mode 100644
index 0000000..e91d1d5
--- /dev/null
+++ b/developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/evidence/green-10-cli.txt
@@ -0,0 +1,8 @@
+   Compiling mailbox-mirror-lab v0.1.0 (developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror)
+    Finished `test` profile [unoptimized + debuginfo] target(s) in 0.53s
+     Running tests/cli.rs (target/debug/deps/cli-2273cdcd503a1050)
+
+running 1 test
+test cli_generate_verify_resume_and_summarize_are_runnable ... ok
+
+test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 3.16s
diff --git a/developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/evidence/green-11-concurrent-checkpoint.txt b/developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/evidence/green-11-concurrent-checkpoint.txt
new file mode 100644
index 0000000..6375492
--- /dev/null
+++ b/developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/evidence/green-11-concurrent-checkpoint.txt
@@ -0,0 +1,8 @@
+   Compiling mailbox-mirror-lab v0.1.0 (developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror)
+    Finished `test` profile [unoptimized + debuginfo] target(s) in 0.95s
+     Running tests/sqlite_concurrency.rs (target/debug/deps/sqlite_concurrency-7bada252ae7afadd)
+
+running 1 test
+test eight_readers_never_observe_a_mixed_epoch_during_publication ... ok
+
+test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.64s
diff --git a/developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/evidence/green-12-end-marker-truncation.txt b/developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/evidence/green-12-end-marker-truncation.txt
new file mode 100644
index 0000000..b31d56f
--- /dev/null
+++ b/developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/evidence/green-12-end-marker-truncation.txt
@@ -0,0 +1,8 @@
+   Compiling mailbox-mirror-lab v0.1.0 (developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror)
+    Finished `test` profile [unoptimized + debuginfo] target(s) in 0.67s
+     Running tests/transcript.rs (target/debug/deps/transcript-402a5a0879a2ffc7)
+
+running 1 test
+test every_record_position_in_a_small_transcript_is_truncation_detected ... ok
+
+test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 3 filtered out; finished in 0.10s
diff --git a/developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/evidence/green-12-transcript-suite.txt b/developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/evidence/green-12-transcript-suite.txt
new file mode 100644
index 0000000..e4766d9
--- /dev/null
+++ b/developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/evidence/green-12-transcript-suite.txt
@@ -0,0 +1,10 @@
+    Finished `test` profile [unoptimized + debuginfo] target(s) in 0.03s
+     Running tests/transcript.rs (target/debug/deps/transcript-402a5a0879a2ffc7)
+
+running 4 tests
+test unterminated_batch_reports_only_mailbox_and_sequence_and_mutates_nothing ... ok
+test every_record_position_in_a_small_transcript_is_truncation_detected ... ok
+test generated_transcript_is_deterministic_and_matches_both_models ... ok
+test applying_then_resuming_the_same_transcript_is_idempotent ... ok
+
+test result: ok. 4 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 1.39s
diff --git a/developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/evidence/green-13-sqlite-integer-range.txt b/developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/evidence/green-13-sqlite-integer-range.txt
new file mode 100644
index 0000000..273b83f
--- /dev/null
+++ b/developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/evidence/green-13-sqlite-integer-range.txt
@@ -0,0 +1,13 @@
+   Compiling mailbox-mirror-lab v0.1.0 (developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror)
+    Finished `test` profile [unoptimized + debuginfo] target(s) in 0.87s
+     Running tests/fault_matrix.rs (target/debug/deps/fault_matrix-2fa49698dd3ce5c7)
+
+running 2 tests
+test sqlite_integer_max_round_trips_for_every_unsigned_field ... ok
+test every_unsigned_field_rejects_sqlite_integer_max_plus_one_before_mutation ... ok
+
+test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 2 filtered out; finished in 0.19s
+
+The final strengthened maximum test also reads the recorded batch sequences
+directly from SQLite, observes the exact decimal i64::MAX twice, and replays
+both maximum-sequence batches as duplicates in the reference and baseline.
diff --git a/developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/evidence/green-14-staged-delete-cleanup.txt b/developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/evidence/green-14-staged-delete-cleanup.txt
new file mode 100644
index 0000000..33e6089
--- /dev/null
+++ b/developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/evidence/green-14-staged-delete-cleanup.txt
@@ -0,0 +1,17 @@
+Command:
+  cargo test --offline --locked --test sqlite_baseline -- --nocapture
+
+Result:
+  PASS
+  4 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out
+
+Focused cleanup regressions that passed:
+  delete_cleans_staged_messages_and_stays_clean_after_reopen
+  repeated_same_id_delete_recreate_cleans_incomplete_and_failed_rescans
+
+These tests query the physical staging_messages table. They prove that a Delete
+for the same stable mailbox ID removes incomplete staged rows in the admitted
+transaction, that a rejected rescan batch does not disturb the prior staging
+state even when its first event is valid and its later event fails, and that
+cleanup remains true after reopen and two delete/recreate
+lifecycles.
diff --git a/developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/evidence/red-01-reference-missing.txt b/developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/evidence/red-01-reference-missing.txt
new file mode 100644
index 0000000..cd6f69d
--- /dev/null
+++ b/developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/evidence/red-01-reference-missing.txt
@@ -0,0 +1,46 @@
+     Locking 40 packages to latest Rust 1.95.0 compatible versions
+   Compiling proc-macro2 v1.0.107
+   Compiling quote v1.0.47
+   Compiling unicode-ident v1.0.24
+   Compiling libc v0.2.189
+   Compiling serde_core v1.0.229
+   Compiling utf8parse v0.2.2
+   Compiling getrandom v0.4.3
+   Compiling zmij v1.0.23
+   Compiling anstyle v1.0.14
+   Compiling rustix v1.1.4
+   Compiling colorchoice v1.0.5
+   Compiling is_terminal_polyfill v1.70.2
+   Compiling anstyle-query v1.1.5
+   Compiling bitflags v2.13.1
+   Compiling anstyle-parse v1.0.0
+   Compiling cfg-if v1.0.4
+   Compiling heck v0.5.0
+   Compiling strsim v0.11.1
+   Compiling serde v1.0.229
+   Compiling serde_json v1.0.151
+   Compiling clap_lex v1.1.0
+   Compiling anstream v1.0.0
+   Compiling memchr v2.8.3
+   Compiling itoa v1.0.18
+   Compiling clap_builder v4.6.0
+   Compiling fastrand v2.5.0
+   Compiling once_cell v1.21.4
+   Compiling syn v3.0.3
+   Compiling syn v2.0.119
+   Compiling errno v0.3.14
+   Compiling tempfile v3.27.0
+   Compiling serde_derive v1.0.229
+   Compiling clap_derive v4.6.1
+   Compiling clap v4.6.1
+   Compiling mailbox-mirror-lab v0.1.0 (developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror)
+error[E0432]: unresolved import `mailbox_mirror_lab`
+ --> tests/reference.rs:1:5
+  |
+1 | use mailbox_mirror_lab::{ApplyOutcome, Batch, Event, Message, ReferenceMirror};
+  |     ^^^^^^^^^^^^^^^^^^ use of unresolved module or unlinked crate `mailbox_mirror_lab`
+  |
+  = help: if you wanted to use a crate named `mailbox_mirror_lab`, use `cargo add mailbox_mirror_lab` to add it to your `Cargo.toml`
+
+For more information about this error, try `rustc --explain E0432`.
+error: could not compile `mailbox-mirror-lab` (test "reference") due to 1 previous error
diff --git a/developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/evidence/red-02-epoch-staging.txt b/developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/evidence/red-02-epoch-staging.txt
new file mode 100644
index 0000000..1c928dc
--- /dev/null
+++ b/developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/evidence/red-02-epoch-staging.txt
@@ -0,0 +1,22 @@
+   Compiling mailbox-mirror-lab v0.1.0 (developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror)
+    Finished `test` profile [unoptimized + debuginfo] target(s) in 0.28s
+     Running tests/reference.rs (target/debug/deps/reference-eca04c105f8a5b2f)
+
+running 1 test
+test replacement_epoch_stays_hidden_until_snapshot_commit ... FAILED
+
+failures:
+
+---- replacement_epoch_stays_hidden_until_snapshot_commit stdout ----
+
+thread 'replacement_epoch_stays_hidden_until_snapshot_commit' (57382358) panicked at tests/reference.rs:80:10:
+called `Result::unwrap()` on an `Err` value: MirrorError("event not implemented")
+note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace
+
+
+failures:
+    replacement_epoch_stays_hidden_until_snapshot_commit
+
+test result: FAILED. 0 passed; 1 failed; 0 ignored; 0 measured; 1 filtered out; finished in 0.00s
+
+error: test failed, to rerun pass `--test reference`
diff --git a/developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/evidence/red-03-flags-expunge.txt b/developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/evidence/red-03-flags-expunge.txt
new file mode 100644
index 0000000..cef26dc
--- /dev/null
+++ b/developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/evidence/red-03-flags-expunge.txt
@@ -0,0 +1,22 @@
+   Compiling mailbox-mirror-lab v0.1.0 (developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror)
+    Finished `test` profile [unoptimized + debuginfo] target(s) in 0.14s
+     Running tests/reference.rs (target/debug/deps/reference-eca04c105f8a5b2f)
+
+running 1 test
+test flag_replacement_and_expunge_update_materialized_counts ... FAILED
+
+failures:
+
+---- flag_replacement_and_expunge_update_materialized_counts stdout ----
+
+thread 'flag_replacement_and_expunge_update_materialized_counts' (57390683) panicked at tests/reference.rs:170:10:
+called `Result::unwrap()` on an `Err` value: MirrorError("event not implemented")
+note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace
+
+
+failures:
+    flag_replacement_and_expunge_update_materialized_counts
+
+test result: FAILED. 0 passed; 1 failed; 0 ignored; 0 measured; 2 filtered out; finished in 0.00s
+
+error: test failed, to rerun pass `--test reference`
diff --git a/developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/evidence/red-04-identity-lifecycle.txt b/developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/evidence/red-04-identity-lifecycle.txt
new file mode 100644
index 0000000..d266ae6
--- /dev/null
+++ b/developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/evidence/red-04-identity-lifecycle.txt
@@ -0,0 +1,22 @@
+   Compiling mailbox-mirror-lab v0.1.0 (developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror)
+    Finished `test` profile [unoptimized + debuginfo] target(s) in 0.25s
+     Running tests/reference.rs (target/debug/deps/reference-eca04c105f8a5b2f)
+
+running 1 test
+test rename_preserves_stable_id_but_recreated_name_does_not_resurrect_state ... FAILED
+
+failures:
+
+---- rename_preserves_stable_id_but_recreated_name_does_not_resurrect_state stdout ----
+
+thread 'rename_preserves_stable_id_but_recreated_name_does_not_resurrect_state' (57394232) panicked at tests/reference.rs:228:10:
+called `Result::unwrap()` on an `Err` value: MirrorError("event not implemented")
+note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace
+
+
+failures:
+    rename_preserves_stable_id_but_recreated_name_does_not_resurrect_state
+
+test result: FAILED. 0 passed; 1 failed; 0 ignored; 0 measured; 3 filtered out; finished in 0.00s
+
+error: test failed, to rerun pass `--test reference`
diff --git a/developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/evidence/red-05-batch-rollback.txt b/developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/evidence/red-05-batch-rollback.txt
new file mode 100644
index 0000000..65aee25
--- /dev/null
+++ b/developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/evidence/red-05-batch-rollback.txt
@@ -0,0 +1,24 @@
+   Compiling mailbox-mirror-lab v0.1.0 (developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror)
+    Finished `test` profile [unoptimized + debuginfo] target(s) in 0.34s
+     Running tests/reference.rs (target/debug/deps/reference-eca04c105f8a5b2f)
+
+running 1 test
+test rejected_batch_has_no_partial_mutation ... FAILED
+
+failures:
+
+---- rejected_batch_has_no_partial_mutation stdout ----
+
+thread 'rejected_batch_has_no_partial_mutation' (57395763) panicked at tests/reference.rs:295:5:
+assertion `left == right` failed
+  left: 1
+ right: 0
+note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace
+
+
+failures:
+    rejected_batch_has_no_partial_mutation
+
+test result: FAILED. 0 passed; 1 failed; 0 ignored; 0 measured; 4 filtered out; finished in 0.00s
+
+error: test failed, to rerun pass `--test reference`
diff --git a/developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/evidence/red-06-sqlite-baseline-missing.txt b/developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/evidence/red-06-sqlite-baseline-missing.txt
new file mode 100644
index 0000000..31732e2
--- /dev/null
+++ b/developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/evidence/red-06-sqlite-baseline-missing.txt
@@ -0,0 +1,9 @@
+   Compiling mailbox-mirror-lab v0.1.0 (developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror)
+error[E0432]: unresolved import `mailbox_mirror_lab::SqliteBaseline`
+ --> tests/sqlite_baseline.rs:1:66
+  |
+1 | use mailbox_mirror_lab::{Batch, Event, Message, ReferenceMirror, SqliteBaseline};
+  |                                                                  ^^^^^^^^^^^^^^ no `SqliteBaseline` in the root
+
+For more information about this error, try `rustc --explain E0432`.
+error: could not compile `mailbox-mirror-lab` (test "sqlite_baseline") due to 1 previous error
diff --git a/developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/evidence/red-07-sqlite-reopen.txt b/developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/evidence/red-07-sqlite-reopen.txt
new file mode 100644
index 0000000..8a6f6d2
--- /dev/null
+++ b/developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/evidence/red-07-sqlite-reopen.txt
@@ -0,0 +1,15 @@
+   Compiling mailbox-mirror-lab v0.1.0 (developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror)
+error[E0599]: no function or associated item named `open` found for struct `SqliteBaseline` in the current scope
+   --> tests/sqlite_baseline.rs:121:40
+    |
+121 |     let mut reopened = SqliteBaseline::open(&path).unwrap();
+    |                                        ^^^^ function or associated item not found in `SqliteBaseline`
+    |
+note: if you're trying to build a new `SqliteBaseline`, consider using `SqliteBaseline::create` which returns `Result<SqliteBaseline, MirrorError>`
+   --> src/lib.rs:382:5
+    |
+382 |     pub fn create(path: &Path) -> Result<Self, MirrorError> {
+    |     ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+For more information about this error, try `rustc --explain E0599`.
+error: could not compile `mailbox-mirror-lab` (test "sqlite_baseline") due to 1 previous error
diff --git a/developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/evidence/red-08-transcript-harness.txt b/developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/evidence/red-08-transcript-harness.txt
new file mode 100644
index 0000000..bd7235f
--- /dev/null
+++ b/developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/evidence/red-08-transcript-harness.txt
@@ -0,0 +1,12 @@
+   Compiling mailbox-mirror-lab v0.1.0 (developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror)
+error[E0432]: unresolved imports `mailbox_mirror_lab::GeneratorConfig`, `mailbox_mirror_lab::generate_transcript`, `mailbox_mirror_lab::verify_transcript`
+ --> tests/transcript.rs:3:26
+  |
+3 | use mailbox_mirror_lab::{GeneratorConfig, SqliteBaseline, generate_transcript, verify_transcript};
+  |                          ^^^^^^^^^^^^^^^                  ^^^^^^^^^^^^^^^^^^^  ^^^^^^^^^^^^^^^^^ no `verify_transcript` in the root
+  |                          |                                |
+  |                          |                                no `generate_transcript` in the root
+  |                          no `GeneratorConfig` in the root
+
+For more information about this error, try `rustc --explain E0432`.
+error: could not compile `mailbox-mirror-lab` (test "transcript") due to 1 previous error
diff --git a/developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/evidence/red-09-resume.txt b/developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/evidence/red-09-resume.txt
new file mode 100644
index 0000000..940a7cb
--- /dev/null
+++ b/developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/evidence/red-09-resume.txt
@@ -0,0 +1,15 @@
+   Compiling mailbox-mirror-lab v0.1.0 (developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror)
+error[E0432]: unresolved import `mailbox_mirror_lab::apply_transcript`
+ --> tests/transcript.rs:4:38
+  |
+4 |     GeneratorConfig, SqliteBaseline, apply_transcript, generate_transcript, verify_transcript,
+  |                                      ^^^^^^^^^^^^^^^^ no `apply_transcript` in the root
+  |
+help: a similar name exists in the module
+  |
+4 -     GeneratorConfig, SqliteBaseline, apply_transcript, generate_transcript, verify_transcript,
+4 +     GeneratorConfig, SqliteBaseline, verify_transcript, generate_transcript, verify_transcript,
+  |
+
+For more information about this error, try `rustc --explain E0432`.
+error: could not compile `mailbox-mirror-lab` (test "transcript") due to 1 previous error
diff --git a/developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/evidence/red-10-cli.txt b/developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/evidence/red-10-cli.txt
new file mode 100644
index 0000000..904fa75
--- /dev/null
+++ b/developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/evidence/red-10-cli.txt
@@ -0,0 +1,10 @@
+   Compiling mailbox-mirror-lab v0.1.0 (developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror)
+error: environment variable `CARGO_BIN_EXE_mailbox-mirror-lab` not defined at compile time
+ --> tests/cli.rs:9:18
+  |
+9 |     let binary = env!("CARGO_BIN_EXE_mailbox-mirror-lab");
+  |                  ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+  |
+  = help: Cargo sets build script variables at run time. Use `std::env::var("CARGO_BIN_EXE_mailbox-mirror-lab")` instead
+
+error: could not compile `mailbox-mirror-lab` (test "cli") due to 1 previous error
diff --git a/developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/evidence/red-11-concurrent-checkpoint.txt b/developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/evidence/red-11-concurrent-checkpoint.txt
new file mode 100644
index 0000000..433d0d7
--- /dev/null
+++ b/developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/evidence/red-11-concurrent-checkpoint.txt
@@ -0,0 +1,46 @@
+   Compiling mailbox-mirror-lab v0.1.0 (developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror)
+    Finished `test` profile [unoptimized + debuginfo] target(s) in 0.54s
+     Running tests/sqlite_concurrency.rs (target/debug/deps/sqlite_concurrency-7bada252ae7afadd)
+
+running 1 test
+test eight_readers_never_observe_a_mixed_epoch_during_publication ... FAILED
+
+failures:
+
+---- eight_readers_never_observe_a_mixed_epoch_during_publication stdout ----
+
+thread '<unnamed>' (57425676) panicked at tests/sqlite_concurrency.rs:59:80:
+called `Result::unwrap()` on an `Err` value: MirrorError("sqlite query failed: Error: in prepare, database is locked (5)")
+note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace
+
+thread '<unnamed>' (57425677) panicked at tests/sqlite_concurrency.rs:59:80:
+called `Result::unwrap()` on an `Err` value: MirrorError("sqlite query failed: Error: in prepare, database is locked (5)")
+
+thread '<unnamed>' (57425675) panicked at tests/sqlite_concurrency.rs:59:80:
+called `Result::unwrap()` on an `Err` value: MirrorError("sqlite query failed: Error: in prepare, database is locked (5)")
+
+thread '<unnamed>' (57425674) panicked at tests/sqlite_concurrency.rs:59:80:
+called `Result::unwrap()` on an `Err` value: MirrorError("sqlite query failed: Error: in prepare, database is locked (5)")
+
+thread '<unnamed>' (57425678) panicked at tests/sqlite_concurrency.rs:59:80:
+called `Result::unwrap()` on an `Err` value: MirrorError("sqlite query failed: Error: in prepare, database is locked (5)")
+
+thread '<unnamed>' (57425671) panicked at tests/sqlite_concurrency.rs:59:80:
+called `Result::unwrap()` on an `Err` value: MirrorError("sqlite query failed: Error: in prepare, database is locked (5)")
+
+thread '<unnamed>' (57425672) panicked at tests/sqlite_concurrency.rs:59:80:
+called `Result::unwrap()` on an `Err` value: MirrorError("sqlite query failed: Error: in prepare, database is locked (5)")
+
+thread '<unnamed>' (57425673) panicked at tests/sqlite_concurrency.rs:59:80:
+called `Result::unwrap()` on an `Err` value: MirrorError("sqlite query failed: Error: in prepare, database is locked (5)")
+
+thread 'eight_readers_never_observe_a_mixed_epoch_during_publication' (57425667) panicked at tests/sqlite_concurrency.rs:108:27:
+called `Result::unwrap()` on an `Err` value: Any { .. }
+
+
+failures:
+    eight_readers_never_observe_a_mixed_epoch_during_publication
+
+test result: FAILED. 0 passed; 1 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.31s
+
+error: test failed, to rerun pass `--test sqlite_concurrency`
diff --git a/developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/evidence/red-12-end-marker-truncation.txt b/developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/evidence/red-12-end-marker-truncation.txt
new file mode 100644
index 0000000..67aa5be
--- /dev/null
+++ b/developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/evidence/red-12-end-marker-truncation.txt
@@ -0,0 +1,22 @@
+   Compiling mailbox-mirror-lab v0.1.0 (developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror)
+    Finished `test` profile [unoptimized + debuginfo] target(s) in 0.28s
+     Running tests/transcript.rs (target/debug/deps/transcript-402a5a0879a2ffc7)
+
+running 1 test
+test every_record_position_in_a_small_transcript_is_truncation_detected ... FAILED
+
+failures:
+
+---- every_record_position_in_a_small_transcript_is_truncation_detected stdout ----
+
+thread 'every_record_position_in_a_small_transcript_is_truncation_detected' (57432788) panicked at tests/transcript.rs:90:6:
+called `Result::unwrap()` on an `Err` value: TranscriptDiagnostic { mailbox_id: "unknown", sequence: 0, code: "invalid_json" }
+note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace
+
+
+failures:
+    every_record_position_in_a_small_transcript_is_truncation_detected
+
+test result: FAILED. 0 passed; 1 failed; 0 ignored; 0 measured; 3 filtered out; finished in 0.03s
+
+error: test failed, to rerun pass `--test transcript`
diff --git a/developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/evidence/red-13-sqlite-integer-range.txt b/developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/evidence/red-13-sqlite-integer-range.txt
new file mode 100644
index 0000000..2f73ff9
--- /dev/null
+++ b/developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/evidence/red-13-sqlite-integer-range.txt
@@ -0,0 +1,9 @@
+   Compiling mailbox-mirror-lab v0.1.0 (developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror)
+error[E0432]: unresolved import `mailbox_mirror_lab::SQLITE_INTEGER_MAX`
+ --> tests/fault_matrix.rs:2:59
+  |
+2 |     ApplyOutcome, Batch, Event, Message, ReferenceMirror, SQLITE_INTEGER_MAX, SqliteBaseline,
+  |                                                           ^^^^^^^^^^^^^^^^^^ no `SQLITE_INTEGER_MAX` in the root
+
+For more information about this error, try `rustc --explain E0432`.
+error: could not compile `mailbox-mirror-lab` (test "fault_matrix") due to 1 previous error
diff --git a/developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/evidence/red-14-staged-delete-cleanup.txt b/developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/evidence/red-14-staged-delete-cleanup.txt
new file mode 100644
index 0000000..49f67ff
--- /dev/null
+++ b/developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/evidence/red-14-staged-delete-cleanup.txt
@@ -0,0 +1,24 @@
+   Compiling mailbox-mirror-lab v0.1.0 (developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror)
+    Finished `test` profile [unoptimized + debuginfo] target(s) in 0.21s
+     Running tests/sqlite_baseline.rs (target/debug/deps/sqlite_baseline-f7d1c60cfa4c1c11)
+
+running 1 test
+test delete_cleans_staged_messages_and_stays_clean_after_reopen ... FAILED
+
+failures:
+
+---- delete_cleans_staged_messages_and_stays_clean_after_reopen stdout ----
+
+thread 'delete_cleans_staged_messages_and_stays_clean_after_reopen' (57515035) panicked at tests/sqlite_baseline.rs:218:5:
+assertion `left == right` failed
+  left: 1
+ right: 0
+note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace
+
+
+failures:
+    delete_cleans_staged_messages_and_stays_clean_after_reopen
+
+test result: FAILED. 0 passed; 1 failed; 0 ignored; 0 measured; 3 filtered out; finished in 0.04s
+
+error: test failed, to rerun pass `--test sqlite_baseline`
diff --git a/developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/evidence/sqlite-baseline-10k-final.txt b/developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/evidence/sqlite-baseline-10k-final.txt
new file mode 100644
index 0000000..59ebd79
--- /dev/null
+++ b/developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/evidence/sqlite-baseline-10k-final.txt
@@ -0,0 +1,10 @@
+Command:
+  cargo test --offline --locked --release --test baseline_measure -- --ignored --nocapture
+
+Fresh post-review result:
+  {"mailboxes":20,"messages":10000,"batches":120,"apply_ms":821.745,"responses_per_second":12193.6,"count_p50_us":2550,"count_p95_us":3593,"reopen_ms":2.347,"disk_bytes":2867200}
+
+Test result:
+  1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out
+
+This is one bounded local measurement on this host, not a portable performance guarantee.
diff --git a/developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/evidence/sqlite-baseline-10k.txt b/developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/evidence/sqlite-baseline-10k.txt
new file mode 100644
index 0000000..d4eaa6f
--- /dev/null
+++ b/developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/evidence/sqlite-baseline-10k.txt
@@ -0,0 +1,43 @@
+   Compiling proc-macro2 v1.0.107
+   Compiling quote v1.0.47
+   Compiling unicode-ident v1.0.24
+   Compiling libc v0.2.189
+   Compiling utf8parse v0.2.2
+   Compiling serde_core v1.0.229
+   Compiling zmij v1.0.23
+   Compiling anstyle-query v1.1.5
+   Compiling colorchoice v1.0.5
+   Compiling anstyle v1.0.14
+   Compiling is_terminal_polyfill v1.70.2
+   Compiling heck v0.5.0
+   Compiling strsim v0.11.1
+   Compiling rustix v1.1.4
+   Compiling anstyle-parse v1.0.0
+   Compiling clap_lex v1.1.0
+   Compiling serde_json v1.0.151
+   Compiling getrandom v0.4.3
+   Compiling serde v1.0.229
+   Compiling bitflags v2.13.1
+   Compiling anstream v1.0.0
+   Compiling itoa v1.0.18
+   Compiling memchr v2.8.3
+   Compiling clap_builder v4.6.0
+   Compiling cfg-if v1.0.4
+   Compiling once_cell v1.21.4
+   Compiling fastrand v2.5.0
+   Compiling syn v3.0.3
+   Compiling syn v2.0.119
+   Compiling errno v0.3.14
+   Compiling serde_derive v1.0.229
+   Compiling tempfile v3.27.0
+   Compiling clap_derive v4.6.1
+   Compiling clap v4.6.1
+   Compiling mailbox-mirror-lab v0.1.0 (developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror)
+    Finished `release` profile [optimized] target(s) in 4.13s
+     Running tests/baseline_measure.rs (target/release/deps/baseline_measure-879170a463537005)
+
+running 1 test
+{"mailboxes":20,"messages":10000,"batches":120,"apply_ms":907.193,"responses_per_second":11045.1,"count_p50_us":2457,"count_p95_us":3179,"reopen_ms":4.283,"disk_bytes":2867200}
+test measure_sqlite_baseline_10k_messages ... ok
+
+test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 1.44s
diff --git a/developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/evidence/test-all-targets.txt b/developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/evidence/test-all-targets.txt
new file mode 100644
index 0000000..3201db3
--- /dev/null
+++ b/developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/evidence/test-all-targets.txt
@@ -0,0 +1,17 @@
+Command:
+  cargo test --offline --locked --all-targets
+
+Fresh post-review result:
+  PASS: 22 passed; 0 failed; 1 explicitly ignored local measurement.
+
+Breakdown:
+  cli: 1 passed
+  fault_matrix: 4 passed
+  fold_reproducer: 2 passed
+  reference: 5 passed
+  sqlite_baseline: 4 passed
+  sqlite_concurrency: 1 passed
+  transcript: 5 passed
+  baseline_measure: 1 ignored in the ordinary suite; it passed separately in release mode
+
+The caught-panic characterization intentionally prints both the rejected-batch panic and the later poisoned-writer panic; both are caught and asserted, so the test passes while preserving current-main behavior.
diff --git a/developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/src/lib.rs b/developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/src/lib.rs
new file mode 100644
index 0000000..36c68d8
--- /dev/null
+++ b/developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/src/lib.rs
@@ -0,0 +1,1709 @@
+use std::collections::{BTreeMap, BTreeSet};
+use std::fmt::{Display, Formatter};
+use std::io::{BufRead, Write};
+use std::path::{Path, PathBuf};
+use std::process::{Command, Stdio};
+use std::time::Instant;
+
+use serde::{Deserialize, Serialize};
+
+pub const SEEN: u8 = 1;
+/// Inclusive upper bound for every unsigned value stored in a `SQLite` `INTEGER`.
+pub const SQLITE_INTEGER_MAX: u64 = 9_223_372_036_854_775_807;
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+pub struct Message {
+    pub uid: u64,
+    pub fingerprint: String,
+    pub internal_date: i64,
+    pub size: u64,
+    pub flags: u8,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(tag = "type", rename_all = "snake_case")]
+pub enum Event {
+    CreateMailbox {
+        display_name: String,
+        uid_validity: u64,
+    },
+    Add {
+        uid_validity: u64,
+        message: Message,
+        cursor: u64,
+    },
+    ReplaceFlags {
+        uid_validity: u64,
+        uid: u64,
+        flags: u8,
+        cursor: u64,
+    },
+    Expunge {
+        uid_validity: u64,
+        uid: u64,
+        cursor: u64,
+    },
+    Rename {
+        display_name: String,
+    },
+    Delete,
+    SnapshotBegin {
+        uid_validity: u64,
+    },
+    SnapshotMessage {
+        uid_validity: u64,
+        message: Message,
+    },
+    SnapshotCommit {
+        uid_validity: u64,
+        cursor: u64,
+    },
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+pub struct Batch {
+    pub batch_id: String,
+    pub mailbox_id: String,
+    pub sequence: u64,
+    pub events: Vec<Event>,
+}
+
+impl Batch {
+    #[must_use]
+    pub fn new(
+        batch_id: impl Into<String>,
+        mailbox_id: impl Into<String>,
+        sequence: u64,
+        events: Vec<Event>,
+    ) -> Self {
+        Self {
+            batch_id: batch_id.into(),
+            mailbox_id: mailbox_id.into(),
+            sequence,
+            events,
+        }
+    }
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum ApplyOutcome {
+    Applied,
+    Duplicate,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "snake_case")]
+pub enum MirrorStatus {
+    Synced,
+    NeedsRepair,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct MirrorError(String);
+
+impl MirrorError {
+    fn new(message: impl Into<String>) -> Self {
+        Self(message.into())
+    }
+}
+
+impl Display for MirrorError {
+    fn fmt(&self, formatter: &mut Formatter<'_>) -> std::fmt::Result {
+        formatter.write_str(&self.0)
+    }
+}
+
+impl std::error::Error for MirrorError {}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+pub struct SelectedMessage {
+    pub uid: u64,
+    pub fingerprint: String,
+    pub flags: u8,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+pub struct Checkpoint {
+    pub mailbox_id: String,
+    pub display_name: String,
+    pub uid_validity: u64,
+    pub cursor: u64,
+    pub status: MirrorStatus,
+    pub total: usize,
+    pub unread: usize,
+    pub selected: Vec<SelectedMessage>,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+struct Staging {
+    uid_validity: u64,
+    messages: BTreeMap<u64, Message>,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+struct Mailbox {
+    display_name: String,
+    uid_validity: u64,
+    cursor: u64,
+    status: MirrorStatus,
+    messages: BTreeMap<u64, Message>,
+    staging: Option<Staging>,
+}
+
+#[derive(Debug, Clone, Default)]
+pub struct ReferenceMirror {
+    mailboxes: BTreeMap<String, Mailbox>,
+    accepted: BTreeMap<String, String>,
+}
+
+impl ReferenceMirror {
+    /// Applies one already-decoded batch atomically.
+    ///
+    /// # Errors
+    ///
+    /// Returns an error when replay content differs or an event violates mirror invariants.
+    pub fn apply(&mut self, batch: &Batch) -> Result<ApplyOutcome, MirrorError> {
+        validate_batch_integer_range(batch)?;
+        let canonical = serde_json::to_string(batch)
+            .map_err(|error| MirrorError::new(format!("cannot encode batch: {error}")))?;
+        if let Some(previous) = self.accepted.get(&batch.batch_id) {
+            return if previous == &canonical {
+                Ok(ApplyOutcome::Duplicate)
+            } else {
+                Err(MirrorError::new("batch id reused with different content"))
+            };
+        }
+
+        let before = self.mailboxes.get(&batch.mailbox_id).cloned();
+        for event in &batch.events {
+            if let Err(error) = self.apply_event(&batch.mailbox_id, event) {
+                if let Some(mailbox) = before {
+                    self.mailboxes.insert(batch.mailbox_id.clone(), mailbox);
+                } else {
+                    self.mailboxes.remove(&batch.mailbox_id);
+                }
+                return Err(error);
+            }
+        }
+        self.accepted.insert(batch.batch_id.clone(), canonical);
+        Ok(ApplyOutcome::Applied)
+    }
+
+    /// Reads one canonical mailbox checkpoint.
+    ///
+    /// # Errors
+    ///
+    /// Returns an error when the stable mailbox identity is unknown.
+    pub fn checkpoint(
+        &self,
+        mailbox_id: &str,
+        selected_uids: &[u64],
+    ) -> Result<Checkpoint, MirrorError> {
+        let mailbox = self
+            .mailboxes
+            .get(mailbox_id)
+            .ok_or_else(|| MirrorError::new("unknown mailbox"))?;
+        let requested: BTreeSet<u64> = selected_uids.iter().copied().collect();
+        let selected = mailbox
+            .messages
+            .iter()
+            .filter(|(uid, _)| requested.contains(uid))
+            .map(|(_, message)| SelectedMessage {
+                uid: message.uid,
+                fingerprint: message.fingerprint.clone(),
+                flags: message.flags,
+            })
+            .collect();
+        let unread = mailbox
+            .messages
+            .values()
+            .filter(|message| message.flags & SEEN == 0)
+            .count();
+        Ok(Checkpoint {
+            mailbox_id: mailbox_id.to_owned(),
+            display_name: mailbox.display_name.clone(),
+            uid_validity: mailbox.uid_validity,
+            cursor: mailbox.cursor,
+            status: mailbox.status.clone(),
+            total: mailbox.messages.len(),
+            unread,
+            selected,
+        })
+    }
+
+    #[must_use]
+    pub fn manifest(&self) -> Manifest {
+        let mailboxes = self
+            .mailboxes
+            .iter()
+            .map(|(mailbox_id, mailbox)| MailboxManifest {
+                mailbox_id: mailbox_id.clone(),
+                display_name: mailbox.display_name.clone(),
+                uid_validity: mailbox.uid_validity,
+                cursor: mailbox.cursor,
+                status: mailbox.status.clone(),
+                messages: mailbox.messages.values().cloned().collect(),
+            })
+            .collect();
+        Manifest { mailboxes }
+    }
+
+    fn apply_event(&mut self, mailbox_id: &str, event: &Event) -> Result<(), MirrorError> {
+        match event {
+            Event::CreateMailbox {
+                display_name,
+                uid_validity,
+            } => {
+                if self.mailboxes.contains_key(mailbox_id) {
+                    return Err(MirrorError::new("mailbox already exists"));
+                }
+                self.mailboxes.insert(
+                    mailbox_id.to_owned(),
+                    Mailbox {
+                        display_name: display_name.clone(),
+                        uid_validity: *uid_validity,
+                        cursor: 0,
+                        status: MirrorStatus::Synced,
+                        messages: BTreeMap::new(),
+                        staging: None,
+                    },
+                );
+                Ok(())
+            }
+            Event::Delete => {
+                self.mailboxes
+                    .remove(mailbox_id)
+                    .ok_or_else(|| MirrorError::new("unknown mailbox"))?;
+                Ok(())
+            }
+            _ => {
+                let mailbox = self
+                    .mailboxes
+                    .get_mut(mailbox_id)
+                    .ok_or_else(|| MirrorError::new("unknown mailbox"))?;
+                Self::apply_mailbox_event(mailbox, event)
+            }
+        }
+    }
+
+    fn apply_mailbox_event(mailbox: &mut Mailbox, event: &Event) -> Result<(), MirrorError> {
+        match event {
+            Event::Add {
+                uid_validity,
+                message,
+                cursor,
+            } => {
+                Self::require_epoch(mailbox, *uid_validity)?;
+                Self::require_cursor(mailbox, *cursor)?;
+                Self::validate_message(message)?;
+                mailbox.messages.insert(message.uid, message.clone());
+                mailbox.cursor = *cursor;
+            }
+            Event::SnapshotBegin { uid_validity } => {
+                if *uid_validity == mailbox.uid_validity {
+                    return Err(MirrorError::new("snapshot must replace the current epoch"));
+                }
+                mailbox.status = MirrorStatus::NeedsRepair;
+                mailbox.staging = Some(Staging {
+                    uid_validity: *uid_validity,
+                    messages: BTreeMap::new(),
+                });
+            }
+            Event::SnapshotMessage {
+                uid_validity,
+                message,
+            } => {
+                Self::validate_message(message)?;
+                let staging = mailbox
+                    .staging
+                    .as_mut()
+                    .ok_or_else(|| MirrorError::new("snapshot not started"))?;
+                if staging.uid_validity != *uid_validity {
+                    return Err(MirrorError::new("snapshot epoch mismatch"));
+                }
+                staging.messages.insert(message.uid, message.clone());
+            }
+            Event::SnapshotCommit {
+                uid_validity,
+                cursor,
+            } => {
+                Self::require_cursor(mailbox, *cursor)?;
+                let staging = mailbox
+                    .staging
+                    .take()
+                    .ok_or_else(|| MirrorError::new("snapshot not started"))?;
+                if staging.uid_validity != *uid_validity {
+                    return Err(MirrorError::new("snapshot epoch mismatch"));
+                }
+                mailbox.uid_validity = *uid_validity;
+                mailbox.cursor = *cursor;
+                mailbox.messages = staging.messages;
+                mailbox.status = MirrorStatus::Synced;
+            }
+            Event::ReplaceFlags {
+                uid_validity,
+                uid,
+                flags,
+                cursor,
+            } => {
+                Self::require_epoch(mailbox, *uid_validity)?;
+                Self::require_cursor(mailbox, *cursor)?;
+                if *flags > 0x0f {
+                    return Err(MirrorError::new("unsupported flag bits"));
+                }
+                let message = mailbox
+                    .messages
+                    .get_mut(uid)
+                    .ok_or_else(|| MirrorError::new("unknown message"))?;
+                message.flags = *flags;
+                mailbox.cursor = *cursor;
+            }
+            Event::Expunge {
+                uid_validity,
+                uid,
+                cursor,
+            } => {
+                Self::require_epoch(mailbox, *uid_validity)?;
+                Self::require_cursor(mailbox, *cursor)?;
+                mailbox
+                    .messages
+                    .remove(uid)
+                    .ok_or_else(|| MirrorError::new("unknown message"))?;
+                mailbox.cursor = *cursor;
+            }
+            Event::Rename { display_name } => mailbox.display_name.clone_from(display_name),
+            Event::CreateMailbox { .. } | Event::Delete => {
+                return Err(MirrorError::new("invalid mailbox event"));
+            }
+        }
+        Ok(())
+    }
+
+    fn require_epoch(mailbox: &Mailbox, uid_validity: u64) -> Result<(), MirrorError> {
+        if mailbox.uid_validity == uid_validity && mailbox.status == MirrorStatus::Synced {
+            Ok(())
+        } else {
+            Err(MirrorError::new("incremental event for inactive epoch"))
+        }
+    }
+
+    fn require_cursor(mailbox: &Mailbox, cursor: u64) -> Result<(), MirrorError> {
+        if cursor >= mailbox.cursor {
+            Ok(())
+        } else {
+            Err(MirrorError::new("decreasing cursor"))
+        }
+    }
+
+    fn validate_message(message: &Message) -> Result<(), MirrorError> {
+        if message.flags > 0x0f {
+            return Err(MirrorError::new("unsupported flag bits"));
+        }
+        if message.fingerprint.len() != 32
+            || !message
+                .fingerprint
+                .bytes()
+                .all(|byte| byte.is_ascii_hexdigit())
+        {
+            return Err(MirrorError::new("fingerprint must be 16-byte hex"));
+        }
+        Ok(())
+    }
+}
+
+pub struct SqliteBaseline {
+    path: PathBuf,
+}
+
+impl SqliteBaseline {
+    /// Reopens an existing mirror database.
+    ///
+    /// # Errors
+    ///
+    /// Returns an error when the database path does not exist.
+    pub fn open(path: &Path) -> Result<Self, MirrorError> {
+        if !path.is_file() {
+            return Err(MirrorError::new("mirror database does not exist"));
+        }
+        Ok(Self {
+            path: path.to_owned(),
+        })
+    }
+
+    /// Creates or initializes the faithful `SQLite` schema.
+    ///
+    /// # Errors
+    ///
+    /// Returns an error when `SQLite` cannot initialize the database.
+    pub fn create(path: &Path) -> Result<Self, MirrorError> {
+        let baseline = Self {
+            path: path.to_owned(),
+        };
+        baseline.run_sql(
+            ".bail on\n\
+             PRAGMA journal_mode=WAL;\n\
+             PRAGMA synchronous=FULL;\n\
+             PRAGMA foreign_keys=ON;\n\
+             CREATE TABLE IF NOT EXISTS mailboxes (\n\
+               mailbox_id TEXT PRIMARY KEY,\n\
+               display_name TEXT NOT NULL,\n\
+               uid_validity INTEGER NOT NULL,\n\
+               cursor INTEGER NOT NULL,\n\
+               status TEXT NOT NULL CHECK(status IN ('synced','needs_repair'))\n\
+             );\n\
+             CREATE TABLE IF NOT EXISTS messages (\n\
+               mailbox_id TEXT NOT NULL REFERENCES mailboxes(mailbox_id) ON DELETE CASCADE,\n\
+               uid_validity INTEGER NOT NULL,\n\
+               uid INTEGER NOT NULL,\n\
+               fingerprint TEXT NOT NULL CHECK(length(fingerprint)=32),\n\
+               internal_date INTEGER NOT NULL,\n\
+               byte_size INTEGER NOT NULL,\n\
+               flags INTEGER NOT NULL CHECK(flags BETWEEN 0 AND 15),\n\
+               PRIMARY KEY(mailbox_id, uid_validity, uid)\n\
+             );\n\
+             CREATE INDEX IF NOT EXISTS message_counts\n\
+               ON messages(mailbox_id, uid_validity, flags);\n\
+             CREATE TABLE IF NOT EXISTS staging_meta (\n\
+               mailbox_id TEXT PRIMARY KEY REFERENCES mailboxes(mailbox_id) ON DELETE CASCADE,\n\
+               uid_validity INTEGER NOT NULL\n\
+             );\n\
+             CREATE TABLE IF NOT EXISTS staging_messages (\n\
+               mailbox_id TEXT NOT NULL,\n\
+               uid_validity INTEGER NOT NULL,\n\
+               uid INTEGER NOT NULL,\n\
+               fingerprint TEXT NOT NULL CHECK(length(fingerprint)=32),\n\
+               internal_date INTEGER NOT NULL,\n\
+               byte_size INTEGER NOT NULL,\n\
+               flags INTEGER NOT NULL CHECK(flags BETWEEN 0 AND 15),\n\
+               PRIMARY KEY(mailbox_id, uid_validity, uid)\n\
+             );\n\
+             CREATE TABLE IF NOT EXISTS accepted_batches (\n\
+               batch_id TEXT PRIMARY KEY,\n\
+               canonical TEXT NOT NULL,\n\
+               mailbox_id TEXT NOT NULL,\n\
+               sequence INTEGER NOT NULL\n\
+             );",
+        )?;
+        Ok(baseline)
+    }
+
+    /// Applies one batch in one explicit `SQLite` transaction.
+    ///
+    /// # Errors
+    ///
+    /// Returns an error when the batch violates an invariant or `SQLite` rejects the transaction.
+    #[allow(clippy::format_push_string)]
+    pub fn apply(&mut self, batch: &Batch) -> Result<ApplyOutcome, MirrorError> {
+        validate_batch_integer_range(batch)?;
+        let canonical = serde_json::to_string(batch)
+            .map_err(|error| MirrorError::new(format!("cannot encode batch: {error}")))?;
+        let batch_id = sql_text(&batch.batch_id);
+        let canonical = sql_text(&canonical);
+        let mailbox_id = sql_text(&batch.mailbox_id);
+        let mut sql = format!(
+            ".bail on\n.timeout 5000\nPRAGMA foreign_keys=ON;\nBEGIN IMMEDIATE;\n\
+             CREATE TEMP TABLE admission(apply INTEGER NOT NULL);\n\
+             INSERT INTO admission SELECT CASE WHEN EXISTS(SELECT 1 FROM accepted_batches WHERE batch_id={batch_id}) THEN 0 ELSE 1 END;\n\
+             CREATE TEMP TABLE assertion(ok INTEGER NOT NULL CHECK(ok=1));\n\
+             INSERT INTO assertion VALUES(CASE WHEN NOT EXISTS(SELECT 1 FROM accepted_batches WHERE batch_id={batch_id}) OR EXISTS(SELECT 1 FROM accepted_batches WHERE batch_id={batch_id} AND canonical={canonical}) THEN 1 ELSE 0 END);\n"
+        );
+        for event in &batch.events {
+            append_event_sql(&mut sql, &mailbox_id, event);
+        }
+        sql.push_str(&format!(
+            "INSERT INTO accepted_batches(batch_id,canonical,mailbox_id,sequence) SELECT {batch_id},{canonical},{mailbox_id},{} WHERE (SELECT apply FROM admission)=1;\nCOMMIT;\nSELECT apply FROM admission;\n",
+            batch.sequence
+        ));
+        let output = self.run_sql(&sql)?;
+        match output.lines().last().map(str::trim) {
+            Some("1") => Ok(ApplyOutcome::Applied),
+            Some("0") => Ok(ApplyOutcome::Duplicate),
+            _ => Err(MirrorError::new("sqlite admission result missing")),
+        }
+    }
+
+    /// Reads metadata, counts, and selected messages from one `SQLite` snapshot.
+    ///
+    /// # Errors
+    ///
+    /// Returns an error for an unknown mailbox or failed `SQLite` query.
+    pub fn checkpoint(
+        &self,
+        mailbox_id: &str,
+        selected_uids: &[u64],
+    ) -> Result<Checkpoint, MirrorError> {
+        let mailbox_id_sql = sql_text(mailbox_id);
+        let selected_predicate = if selected_uids.is_empty() {
+            "0".to_owned()
+        } else {
+            format!(
+                "x.uid IN ({})",
+                selected_uids
+                    .iter()
+                    .map(u64::to_string)
+                    .collect::<Vec<_>>()
+                    .join(",")
+            )
+        };
+        let rows: Vec<SqliteCheckpointRow> = self.query_json(&format!(
+            "SELECT mailbox_id,display_name,uid_validity,cursor,status,\
+             (SELECT count(*) FROM messages x WHERE x.mailbox_id=m.mailbox_id AND x.uid_validity=m.uid_validity) AS total,\
+             (SELECT count(*) FROM messages x WHERE x.mailbox_id=m.mailbox_id AND x.uid_validity=m.uid_validity AND (x.flags & 1)=0) AS unread,\
+             (SELECT json_group_array(json_object('uid',picked.uid,'fingerprint',picked.fingerprint,'flags',picked.flags)) \
+                FROM (SELECT x.uid,x.fingerprint,x.flags FROM messages x \
+                      WHERE x.mailbox_id=m.mailbox_id AND x.uid_validity=m.uid_validity AND {selected_predicate} ORDER BY x.uid) picked) AS selected_json \
+             FROM mailboxes m WHERE mailbox_id={mailbox_id_sql};"
+        ))?;
+        let row = rows
+            .into_iter()
+            .next()
+            .ok_or_else(|| MirrorError::new("unknown mailbox"))?;
+        let selected = serde_json::from_str(&row.selected_json)
+            .map_err(|error| MirrorError::new(format!("invalid selected-message JSON: {error}")))?;
+        Ok(Checkpoint {
+            mailbox_id: row.mailbox_id,
+            display_name: row.display_name,
+            uid_validity: row.uid_validity,
+            cursor: row.cursor,
+            status: row.status,
+            total: row.total,
+            unread: row.unread,
+            selected,
+        })
+    }
+
+    /// Produces the canonical visible manifest.
+    ///
+    /// # Errors
+    ///
+    /// Returns an error when `SQLite` cannot enumerate visible state.
+    pub fn manifest(&self) -> Result<Manifest, MirrorError> {
+        let rows: Vec<SqliteMailboxRow> = self.query_json(
+            "SELECT mailbox_id,display_name,uid_validity,cursor,status FROM mailboxes ORDER BY mailbox_id;",
+        )?;
+        let mut mailboxes = Vec::with_capacity(rows.len());
+        for row in rows {
+            let messages = self.query_json(&format!(
+                "SELECT uid,fingerprint,internal_date,byte_size AS size,flags FROM messages \
+                 WHERE mailbox_id={} AND uid_validity={} ORDER BY uid;",
+                sql_text(&row.mailbox_id),
+                row.uid_validity
+            ))?;
+            mailboxes.push(MailboxManifest {
+                mailbox_id: row.mailbox_id,
+                display_name: row.display_name,
+                uid_validity: row.uid_validity,
+                cursor: row.cursor,
+                status: row.status,
+                messages,
+            });
+        }
+        Ok(Manifest { mailboxes })
+    }
+
+    fn query_json<T: for<'de> Deserialize<'de>>(&self, query: &str) -> Result<T, MirrorError> {
+        let output = Command::new("/usr/bin/sqlite3")
+            .arg("-json")
+            .arg("-cmd")
+            .arg(".timeout 5000")
+            .arg(&self.path)
+            .arg(query)
+            .output()
+            .map_err(|error| MirrorError::new(format!("cannot run sqlite3: {error}")))?;
+        if !output.status.success() {
+            return Err(MirrorError::new(format!(
+                "sqlite query failed: {}",
+                String::from_utf8_lossy(&output.stderr).trim()
+            )));
+        }
+        let json = if output.stdout.is_empty() {
+            b"[]".as_slice()
+        } else {
+            output.stdout.as_slice()
+        };
+        serde_json::from_slice(json)
+            .map_err(|error| MirrorError::new(format!("invalid sqlite JSON: {error}")))
+    }
+
+    fn run_sql(&self, sql: &str) -> Result<String, MirrorError> {
+        let mut child = Command::new("/usr/bin/sqlite3")
+            .arg(&self.path)
+            .stdin(Stdio::piped())
+            .stdout(Stdio::piped())
+            .stderr(Stdio::piped())
+            .spawn()
+            .map_err(|error| MirrorError::new(format!("cannot run sqlite3: {error}")))?;
+        let mut stdin = child
+            .stdin
+            .take()
+            .ok_or_else(|| MirrorError::new("sqlite stdin unavailable"))?;
+        stdin
+            .write_all(sql.as_bytes())
+            .map_err(|error| MirrorError::new(format!("cannot write sqlite script: {error}")))?;
+        drop(stdin);
+        let output = child
+            .wait_with_output()
+            .map_err(|error| MirrorError::new(format!("cannot wait for sqlite3: {error}")))?;
+        if !output.status.success() {
+            return Err(MirrorError::new(format!(
+                "sqlite transaction rejected: {}",
+                String::from_utf8_lossy(&output.stderr).trim()
+            )));
+        }
+        String::from_utf8(output.stdout)
+            .map_err(|error| MirrorError::new(format!("sqlite emitted invalid UTF-8: {error}")))
+    }
+}
+
+#[derive(Deserialize)]
+struct SqliteCheckpointRow {
+    mailbox_id: String,
+    display_name: String,
+    uid_validity: u64,
+    cursor: u64,
+    status: MirrorStatus,
+    total: usize,
+    unread: usize,
+    selected_json: String,
+}
+
+#[derive(Deserialize)]
+struct SqliteMailboxRow {
+    mailbox_id: String,
+    display_name: String,
+    uid_validity: u64,
+    cursor: u64,
+    status: MirrorStatus,
+}
+
+#[allow(clippy::format_push_string)]
+fn append_event_sql(sql: &mut String, mailbox_id: &str, event: &Event) {
+    let admission = "(SELECT apply FROM admission)=1";
+    match event {
+        Event::CreateMailbox {
+            display_name,
+            uid_validity,
+        } => sql.push_str(&format!(
+            "INSERT INTO mailboxes(mailbox_id,display_name,uid_validity,cursor,status) \
+             SELECT {mailbox_id},{},{uid_validity},0,'synced' WHERE {admission};\n",
+            sql_text(display_name)
+        )),
+        Event::Add {
+            uid_validity,
+            message,
+            cursor,
+        } => {
+            append_active_assertion(sql, mailbox_id, *uid_validity, *cursor);
+            append_message_assertion(sql, message);
+            sql.push_str(&format!(
+                "INSERT INTO messages(mailbox_id,uid_validity,uid,fingerprint,internal_date,byte_size,flags) \
+                 SELECT {mailbox_id},{uid_validity},{},{},{},{},{} WHERE {admission} \
+                 ON CONFLICT(mailbox_id,uid_validity,uid) DO UPDATE SET fingerprint=excluded.fingerprint,internal_date=excluded.internal_date,byte_size=excluded.byte_size,flags=excluded.flags;\n\
+                 UPDATE mailboxes SET cursor={cursor} WHERE mailbox_id={mailbox_id} AND {admission};\n",
+                message.uid,
+                sql_text(&message.fingerprint),
+                message.internal_date,
+                message.size,
+                message.flags
+            ));
+        }
+        Event::ReplaceFlags {
+            uid_validity,
+            uid,
+            flags,
+            cursor,
+        } => {
+            append_active_assertion(sql, mailbox_id, *uid_validity, *cursor);
+            sql.push_str(&format!(
+                "INSERT INTO assertion VALUES(CASE WHEN NOT ({admission}) OR ({flags} BETWEEN 0 AND 15 AND EXISTS(SELECT 1 FROM messages WHERE mailbox_id={mailbox_id} AND uid_validity={uid_validity} AND uid={uid})) THEN 1 ELSE 0 END);\n\
+                 UPDATE messages SET flags={flags} WHERE mailbox_id={mailbox_id} AND uid_validity={uid_validity} AND uid={uid} AND {admission};\n\
+                 UPDATE mailboxes SET cursor={cursor} WHERE mailbox_id={mailbox_id} AND {admission};\n"
+            ));
+        }
+        Event::Expunge {
+            uid_validity,
+            uid,
+            cursor,
+        } => {
+            append_active_assertion(sql, mailbox_id, *uid_validity, *cursor);
+            sql.push_str(&format!(
+                "INSERT INTO assertion VALUES(CASE WHEN NOT ({admission}) OR EXISTS(SELECT 1 FROM messages WHERE mailbox_id={mailbox_id} AND uid_validity={uid_validity} AND uid={uid}) THEN 1 ELSE 0 END);\n\
+                 DELETE FROM messages WHERE mailbox_id={mailbox_id} AND uid_validity={uid_validity} AND uid={uid} AND {admission};\n\
+                 UPDATE mailboxes SET cursor={cursor} WHERE mailbox_id={mailbox_id} AND {admission};\n"
+            ));
+        }
+        Event::Rename { display_name } => sql.push_str(&format!(
+            "INSERT INTO assertion VALUES(CASE WHEN NOT ({admission}) OR EXISTS(SELECT 1 FROM mailboxes WHERE mailbox_id={mailbox_id}) THEN 1 ELSE 0 END);\n\
+             UPDATE mailboxes SET display_name={} WHERE mailbox_id={mailbox_id} AND {admission};\n",
+            sql_text(display_name)
+        )),
+        Event::Delete => append_delete_sql(sql, mailbox_id),
+        Event::SnapshotBegin { uid_validity } => sql.push_str(&format!(
+            "INSERT INTO assertion VALUES(CASE WHEN NOT ({admission}) OR EXISTS(SELECT 1 FROM mailboxes WHERE mailbox_id={mailbox_id} AND uid_validity<>{uid_validity}) THEN 1 ELSE 0 END);\n\
+             DELETE FROM staging_messages WHERE mailbox_id={mailbox_id} AND {admission};\n\
+             INSERT INTO staging_meta(mailbox_id,uid_validity) SELECT {mailbox_id},{uid_validity} WHERE {admission} \
+               ON CONFLICT(mailbox_id) DO UPDATE SET uid_validity=excluded.uid_validity;\n\
+             UPDATE mailboxes SET status='needs_repair' WHERE mailbox_id={mailbox_id} AND {admission};\n"
+        )),
+        Event::SnapshotMessage {
+            uid_validity,
+            message,
+        } => {
+            append_message_assertion(sql, message);
+            sql.push_str(&format!(
+                "INSERT INTO assertion VALUES(CASE WHEN NOT ({admission}) OR EXISTS(SELECT 1 FROM staging_meta WHERE mailbox_id={mailbox_id} AND uid_validity={uid_validity}) THEN 1 ELSE 0 END);\n\
+                 INSERT INTO staging_messages(mailbox_id,uid_validity,uid,fingerprint,internal_date,byte_size,flags) \
+                 SELECT {mailbox_id},{uid_validity},{},{},{},{},{} WHERE {admission} \
+                 ON CONFLICT(mailbox_id,uid_validity,uid) DO UPDATE SET fingerprint=excluded.fingerprint,internal_date=excluded.internal_date,byte_size=excluded.byte_size,flags=excluded.flags;\n",
+                message.uid,
+                sql_text(&message.fingerprint),
+                message.internal_date,
+                message.size,
+                message.flags
+            ));
+        }
+        Event::SnapshotCommit {
+            uid_validity,
+            cursor,
+        } => sql.push_str(&format!(
+            "INSERT INTO assertion VALUES(CASE WHEN NOT ({admission}) OR EXISTS(SELECT 1 FROM staging_meta s JOIN mailboxes m USING(mailbox_id) WHERE s.mailbox_id={mailbox_id} AND s.uid_validity={uid_validity} AND m.cursor<={cursor}) THEN 1 ELSE 0 END);\n\
+             DELETE FROM messages WHERE mailbox_id={mailbox_id} AND {admission};\n\
+             INSERT INTO messages(mailbox_id,uid_validity,uid,fingerprint,internal_date,byte_size,flags) \
+               SELECT mailbox_id,uid_validity,uid,fingerprint,internal_date,byte_size,flags FROM staging_messages WHERE mailbox_id={mailbox_id} AND uid_validity={uid_validity} AND {admission};\n\
+             UPDATE mailboxes SET uid_validity={uid_validity},cursor={cursor},status='synced' WHERE mailbox_id={mailbox_id} AND {admission};\n\
+             DELETE FROM staging_messages WHERE mailbox_id={mailbox_id} AND {admission};\n\
+             DELETE FROM staging_meta WHERE mailbox_id={mailbox_id} AND {admission};\n"
+        )),
+    }
+}
+
+#[allow(clippy::format_push_string)]
+fn append_delete_sql(sql: &mut String, mailbox_id: &str) {
+    let admission = "(SELECT apply FROM admission)=1";
+    sql.push_str(&format!(
+        "INSERT INTO assertion VALUES(CASE WHEN NOT ({admission}) OR EXISTS(SELECT 1 FROM mailboxes WHERE mailbox_id={mailbox_id}) THEN 1 ELSE 0 END);\n\
+         DELETE FROM staging_messages WHERE mailbox_id={mailbox_id} AND {admission};\n\
+         DELETE FROM mailboxes WHERE mailbox_id={mailbox_id} AND {admission};\n"
+    ));
+}
+
+#[allow(clippy::format_push_string)]
+fn append_active_assertion(sql: &mut String, mailbox_id: &str, epoch: u64, cursor: u64) {
+    sql.push_str(&format!(
+        "INSERT INTO assertion VALUES(CASE WHEN NOT ((SELECT apply FROM admission)=1) OR EXISTS(SELECT 1 FROM mailboxes WHERE mailbox_id={mailbox_id} AND uid_validity={epoch} AND status='synced' AND cursor<={cursor}) THEN 1 ELSE 0 END);\n"
+    ));
+}
+
+#[allow(clippy::format_push_string)]
+fn append_message_assertion(sql: &mut String, message: &Message) {
+    let valid_hex = message.fingerprint.len() == 32
+        && message
+            .fingerprint
+            .bytes()
+            .all(|byte| byte.is_ascii_hexdigit());
+    let valid = u8::from(valid_hex && message.flags <= 0x0f);
+    sql.push_str(&format!(
+        "INSERT INTO assertion VALUES(CASE WHEN NOT ((SELECT apply FROM admission)=1) OR {valid}=1 THEN 1 ELSE 0 END);\n"
+    ));
+}
+
+fn sql_text(value: &str) -> String {
+    format!("'{}'", value.replace('\'', "''"))
+}
+
+fn validate_batch_integer_range(batch: &Batch) -> Result<(), MirrorError> {
+    validate_sqlite_integer(batch.sequence)?;
+    for event in &batch.events {
+        match event {
+            Event::CreateMailbox { uid_validity, .. } | Event::SnapshotBegin { uid_validity } => {
+                validate_sqlite_integer(*uid_validity)?;
+            }
+            Event::Add {
+                uid_validity,
+                message,
+                cursor,
+            } => {
+                validate_sqlite_integer(*uid_validity)?;
+                validate_message_integer_range(message)?;
+                validate_sqlite_integer(*cursor)?;
+            }
+            Event::ReplaceFlags {
+                uid_validity,
+                uid,
+                cursor,
+                ..
+            }
+            | Event::Expunge {
+                uid_validity,
+                uid,
+                cursor,
+            } => {
+                validate_sqlite_integer(*uid_validity)?;
+                validate_sqlite_integer(*uid)?;
+                validate_sqlite_integer(*cursor)?;
+            }
+            Event::SnapshotMessage {
+                uid_validity,
+                message,
+            } => {
+                validate_sqlite_integer(*uid_validity)?;
+                validate_message_integer_range(message)?;
+            }
+            Event::SnapshotCommit {
+                uid_validity,
+                cursor,
+            } => {
+                validate_sqlite_integer(*uid_validity)?;
+                validate_sqlite_integer(*cursor)?;
+            }
+            Event::Rename { .. } | Event::Delete => {}
+        }
+    }
+    Ok(())
+}
+
+fn validate_message_integer_range(message: &Message) -> Result<(), MirrorError> {
+    validate_sqlite_integer(message.uid)?;
+    validate_sqlite_integer(message.size)
+}
+
+fn validate_sqlite_integer(value: u64) -> Result<(), MirrorError> {
+    if value <= SQLITE_INTEGER_MAX {
+        Ok(())
+    } else {
+        Err(MirrorError::new("integer outside SQLite INTEGER range"))
+    }
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+pub struct MailboxManifest {
+    pub mailbox_id: String,
+    pub display_name: String,
+    pub uid_validity: u64,
+    pub cursor: u64,
+    pub status: MirrorStatus,
+    pub messages: Vec<Message>,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+pub struct Manifest {
+    pub mailboxes: Vec<MailboxManifest>,
+}
+
+impl Manifest {
+    #[must_use]
+    pub fn live_messages(&self) -> usize {
+        self.mailboxes
+            .iter()
+            .map(|mailbox| mailbox.messages.len())
+            .sum()
+    }
+}
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct GeneratorConfig {
+    pub seed: u64,
+    pub mailboxes: usize,
+    pub live_messages: usize,
+    pub responses: usize,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+pub struct GenerationSummary {
+    pub seed: u64,
+    pub mailboxes: usize,
+    pub live_messages: usize,
+    pub responses: usize,
+    pub duplicate_responses: usize,
+    pub epoch_changes: usize,
+    pub renames: usize,
+    pub deletions_and_recreations: usize,
+    pub disconnects: usize,
+    pub records: usize,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+pub struct VerificationSummary {
+    pub responses: usize,
+    pub duplicate_responses: usize,
+    pub batches_applied: usize,
+    pub checkpoints: usize,
+    pub disconnects: usize,
+    pub elapsed_ms: u128,
+    pub manifest: Manifest,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+pub struct ApplySummary {
+    pub responses: usize,
+    pub duplicate_responses: usize,
+    pub batches_applied: usize,
+    pub checkpoints: usize,
+    pub disconnects: usize,
+    pub elapsed_ms: u128,
+    pub manifest: Manifest,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+pub struct TranscriptDiagnostic {
+    pub mailbox_id: String,
+    pub sequence: u64,
+    pub code: String,
+}
+
+impl TranscriptDiagnostic {
+    fn new(mailbox_id: impl Into<String>, sequence: u64, code: impl Into<String>) -> Self {
+        Self {
+            mailbox_id: mailbox_id.into(),
+            sequence,
+            code: code.into(),
+        }
+    }
+}
+
+impl Display for TranscriptDiagnostic {
+    fn fmt(&self, formatter: &mut Formatter<'_>) -> std::fmt::Result {
+        write!(
+            formatter,
+            "{{\"mailbox_id\":{},\"sequence\":{},\"code\":{}}}",
+            serde_json::to_string(&self.mailbox_id).unwrap_or_else(|_| "\"unknown\"".to_owned()),
+            self.sequence,
+            serde_json::to_string(&self.code).unwrap_or_else(|_| "\"diagnostic\"".to_owned())
+        )
+    }
+}
+
+impl std::error::Error for TranscriptDiagnostic {}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+#[serde(tag = "kind", rename_all = "snake_case")]
+enum TranscriptRecord {
+    Begin {
+        batch_id: String,
+        mailbox_id: String,
+        sequence: u64,
+    },
+    Response {
+        event: Event,
+    },
+    Commit {
+        batch_id: String,
+    },
+    Checkpoint {
+        id: String,
+        mailbox_id: String,
+        selected_uids: Vec<u64>,
+    },
+    Disconnect,
+    End {
+        responses: usize,
+        records: usize,
+    },
+}
+
+#[derive(Clone)]
+struct GeneratedMailbox {
+    id: String,
+    name: String,
+    epoch: u64,
+    sequence: u64,
+    messages: Vec<Message>,
+}
+
+struct TranscriptWriter<'writer, Writer: Write> {
+    writer: &'writer mut Writer,
+    records: usize,
+    responses: usize,
+    next_batch: u64,
+}
+
+impl<Writer: Write> TranscriptWriter<'_, Writer> {
+    fn record(&mut self, record: &TranscriptRecord) -> Result<(), MirrorError> {
+        serde_json::to_writer(&mut *self.writer, record)
+            .map_err(|error| MirrorError::new(format!("cannot encode transcript: {error}")))?;
+        self.writer
+            .write_all(b"\n")
+            .map_err(|error| MirrorError::new(format!("cannot write transcript: {error}")))?;
+        self.records += 1;
+        Ok(())
+    }
+
+    fn batch_id(&mut self) -> String {
+        let id = format!("batch-{:08}", self.next_batch);
+        self.next_batch += 1;
+        id
+    }
+
+    fn batch(&mut self, batch: &Batch) -> Result<(), MirrorError> {
+        self.record(&TranscriptRecord::Begin {
+            batch_id: batch.batch_id.clone(),
+            mailbox_id: batch.mailbox_id.clone(),
+            sequence: batch.sequence,
+        })?;
+        for event in &batch.events {
+            self.record(&TranscriptRecord::Response {
+                event: event.clone(),
+            })?;
+            self.responses += 1;
+        }
+        self.record(&TranscriptRecord::Commit {
+            batch_id: batch.batch_id.clone(),
+        })
+    }
+
+    fn checkpoint(
+        &mut self,
+        id: impl Into<String>,
+        mailbox: &GeneratedMailbox,
+    ) -> Result<(), MirrorError> {
+        self.record(&TranscriptRecord::Checkpoint {
+            id: id.into(),
+            mailbox_id: mailbox.id.clone(),
+            selected_uids: mailbox
+                .messages
+                .iter()
+                .take(3)
+                .map(|message| message.uid)
+                .collect(),
+        })
+    }
+}
+
+/// Writes a deterministic framed NDJSON workload.
+///
+/// # Errors
+///
+/// Returns an error for invalid dimensions or failed output.
+#[allow(clippy::too_many_lines)]
+pub fn generate_transcript<Writer: Write>(
+    config: &GeneratorConfig,
+    writer: &mut Writer,
+) -> Result<GenerationSummary, MirrorError> {
+    if config.mailboxes < 2 || config.live_messages == 0 || config.responses < 100 {
+        return Err(MirrorError::new("generator dimensions are too small"));
+    }
+    let duplicate_target = config.responses / 20;
+    let unique_target = config.responses - duplicate_target;
+    let delete_count = 10.min(config.mailboxes / 2);
+    let active_indices: Vec<usize> = (delete_count..config.mailboxes).collect();
+    if active_indices.is_empty() {
+        return Err(MirrorError::new("generator needs an active mailbox"));
+    }
+    let mut output = TranscriptWriter {
+        writer,
+        records: 0,
+        responses: 0,
+        next_batch: 1,
+    };
+    let mut mailboxes: Vec<GeneratedMailbox> = (0..config.mailboxes)
+        .map(|index| GeneratedMailbox {
+            id: format!("mailbox-{index:03}"),
+            name: format!("Folder {index:03}"),
+            epoch: 1,
+            sequence: 0,
+            messages: Vec::new(),
+        })
+        .collect();
+
+    for mailbox in &mut mailboxes {
+        mailbox.sequence += 1;
+        let batch = Batch::new(
+            output.batch_id(),
+            mailbox.id.clone(),
+            mailbox.sequence,
+            vec![Event::CreateMailbox {
+                display_name: mailbox.name.clone(),
+                uid_validity: mailbox.epoch,
+            }],
+        );
+        output.batch(&batch)?;
+    }
+
+    for ordinal in 0..config.live_messages {
+        let mailbox_index = active_indices[ordinal % active_indices.len()];
+        let mailbox = &mut mailboxes[mailbox_index];
+        let uid = u64::try_from(mailbox.messages.len() + 1)
+            .map_err(|_| MirrorError::new("message uid overflow"))?;
+        mailbox.messages.push(synthetic_message(
+            config.seed,
+            mailbox_index,
+            mailbox.epoch,
+            uid,
+        ));
+    }
+    for &mailbox_index in &active_indices {
+        let chunks: Vec<Vec<Message>> = mailboxes[mailbox_index]
+            .messages
+            .chunks(100)
+            .map(<[Message]>::to_vec)
+            .collect();
+        for messages in chunks {
+            let mailbox = &mut mailboxes[mailbox_index];
+            mailbox.sequence += 1;
+            let events = messages
+                .into_iter()
+                .map(|message| Event::Add {
+                    uid_validity: mailbox.epoch,
+                    message,
+                    cursor: mailbox.sequence,
+                })
+                .collect();
+            let batch = Batch::new(
+                output.batch_id(),
+                mailbox.id.clone(),
+                mailbox.sequence,
+                events,
+            );
+            output.batch(&batch)?;
+        }
+    }
+    output.checkpoint("after-initial-load", &mailboxes[active_indices[0]])?;
+
+    let rename_count = 20.min(active_indices.len());
+    for &mailbox_index in active_indices.iter().take(rename_count) {
+        let mailbox = &mut mailboxes[mailbox_index];
+        mailbox.sequence += 1;
+        mailbox.name = format!("Renamed {mailbox_index:03}");
+        let batch = Batch::new(
+            output.batch_id(),
+            mailbox.id.clone(),
+            mailbox.sequence,
+            vec![Event::Rename {
+                display_name: mailbox.name.clone(),
+            }],
+        );
+        output.batch(&batch)?;
+    }
+
+    for (index, mailbox) in mailboxes.iter_mut().enumerate().take(delete_count) {
+        mailbox.sequence += 1;
+        let delete = Batch::new(
+            output.batch_id(),
+            mailbox.id.clone(),
+            mailbox.sequence,
+            vec![Event::Delete],
+        );
+        output.batch(&delete)?;
+        mailbox.id = format!("recreated-{index:03}");
+        mailbox.epoch = 1;
+        mailbox.sequence = 1;
+        let create = Batch::new(
+            output.batch_id(),
+            mailbox.id.clone(),
+            mailbox.sequence,
+            vec![Event::CreateMailbox {
+                display_name: mailbox.name.clone(),
+                uid_validity: mailbox.epoch,
+            }],
+        );
+        output.batch(&create)?;
+    }
+
+    let epoch_count = 12.min(active_indices.len());
+    for (epoch_ordinal, &mailbox_index) in active_indices.iter().take(epoch_count).enumerate() {
+        let new_epoch = mailboxes[mailbox_index].epoch + 1;
+        {
+            let mailbox = &mut mailboxes[mailbox_index];
+            mailbox.sequence += 1;
+            let begin = Batch::new(
+                output.batch_id(),
+                mailbox.id.clone(),
+                mailbox.sequence,
+                vec![Event::SnapshotBegin {
+                    uid_validity: new_epoch,
+                }],
+            );
+            output.batch(&begin)?;
+        }
+        let replacement: Vec<Message> = mailboxes[mailbox_index]
+            .messages
+            .iter()
+            .map(|old| {
+                let mut message = synthetic_message(
+                    config.seed ^ 0xa5a5_a5a5_a5a5_a5a5,
+                    mailbox_index,
+                    new_epoch,
+                    old.uid,
+                );
+                message.flags = old.flags ^ SEEN;
+                message
+            })
+            .collect();
+        for messages in replacement.chunks(100) {
+            let mailbox = &mut mailboxes[mailbox_index];
+            mailbox.sequence += 1;
+            let events = messages
+                .iter()
+                .cloned()
+                .map(|message| Event::SnapshotMessage {
+                    uid_validity: new_epoch,
+                    message,
+                })
+                .collect();
+            let stage = Batch::new(
+                output.batch_id(),
+                mailbox.id.clone(),
+                mailbox.sequence,
+                events,
+            );
+            output.batch(&stage)?;
+        }
+        if epoch_ordinal == 0 {
+            output.checkpoint("during-epoch-replacement", &mailboxes[mailbox_index])?;
+        }
+        {
+            let mailbox = &mut mailboxes[mailbox_index];
+            mailbox.sequence += 1;
+            let commit = Batch::new(
+                output.batch_id(),
+                mailbox.id.clone(),
+                mailbox.sequence,
+                vec![Event::SnapshotCommit {
+                    uid_validity: new_epoch,
+                    cursor: mailbox.sequence,
+                }],
+            );
+            output.batch(&commit)?;
+            mailbox.epoch = new_epoch;
+            mailbox.messages = replacement;
+        }
+    }
+    output.checkpoint("after-epoch-replacement", &mailboxes[active_indices[0]])?;
+
+    let disconnected_mailbox = &mut mailboxes[active_indices[0]];
+    disconnected_mailbox.sequence += 1;
+    let disconnected_batch_id = output.batch_id();
+    output.record(&TranscriptRecord::Begin {
+        batch_id: disconnected_batch_id,
+        mailbox_id: disconnected_mailbox.id.clone(),
+        sequence: disconnected_mailbox.sequence,
+    })?;
+    output.record(&TranscriptRecord::Response {
+        event: Event::Rename {
+            display_name: "must-not-be-visible".to_owned(),
+        },
+    })?;
+    output.responses += 1;
+    output.record(&TranscriptRecord::Disconnect)?;
+
+    if output.responses > unique_target {
+        return Err(MirrorError::new(
+            "response budget is too small for required scenarios",
+        ));
+    }
+    let mut duplicate_batches = Vec::new();
+    let mut duplicate_reserved = 0_usize;
+    let mut fill_ordinal = 0_usize;
+    while output.responses < unique_target {
+        let remaining = unique_target - output.responses;
+        let duplicate_remaining = duplicate_target.saturating_sub(duplicate_reserved);
+        let size = 100.min(remaining).min(if duplicate_remaining == 0 {
+            100
+        } else {
+            duplicate_remaining
+        });
+        let mailbox_index = active_indices[fill_ordinal % active_indices.len()];
+        let mailbox = &mut mailboxes[mailbox_index];
+        mailbox.sequence += 1;
+        let events = (0..size)
+            .map(|offset| {
+                let message_index = (fill_ordinal + offset) % mailbox.messages.len();
+                let message = &mut mailbox.messages[message_index];
+                message.flags ^= SEEN;
+                Event::ReplaceFlags {
+                    uid_validity: mailbox.epoch,
+                    uid: message.uid,
+                    flags: message.flags,
+                    cursor: mailbox.sequence,
+                }
+            })
+            .collect();
+        let batch = Batch::new(
+            output.batch_id(),
+            mailbox.id.clone(),
+            mailbox.sequence,
+            events,
+        );
+        if duplicate_reserved < duplicate_target {
+            duplicate_reserved += batch.events.len();
+            duplicate_batches.push(batch.clone());
+        }
+        output.batch(&batch)?;
+        fill_ordinal += 1;
+    }
+    for batch in &duplicate_batches {
+        output.batch(batch)?;
+    }
+    output.checkpoint("final-a", &mailboxes[active_indices[0]])?;
+    output.checkpoint(
+        "final-b",
+        &mailboxes[active_indices[active_indices.len() / 2]],
+    )?;
+
+    if output.responses != config.responses || duplicate_reserved != duplicate_target {
+        return Err(MirrorError::new(
+            "generator failed to meet exact response budget",
+        ));
+    }
+    let final_record_count = output.records + 1;
+    output.record(&TranscriptRecord::End {
+        responses: output.responses,
+        records: final_record_count,
+    })?;
+    Ok(GenerationSummary {
+        seed: config.seed,
+        mailboxes: config.mailboxes,
+        live_messages: config.live_messages,
+        responses: output.responses,
+        duplicate_responses: duplicate_reserved,
+        epoch_changes: epoch_count,
+        renames: rename_count,
+        deletions_and_recreations: delete_count,
+        disconnects: 1,
+        records: output.records,
+    })
+}
+
+/// Applies a transcript to the reference and `SQLite` baseline and compares every checkpoint.
+///
+/// # Errors
+///
+/// Returns a privacy-safe diagnostic when framing, admission, or state diverges.
+#[allow(clippy::too_many_lines)]
+pub fn verify_transcript<Reader: BufRead>(
+    reader: Reader,
+    database: &Path,
+) -> Result<VerificationSummary, TranscriptDiagnostic> {
+    let started = Instant::now();
+    let mut sqlite = SqliteBaseline::create(database)
+        .map_err(|_| TranscriptDiagnostic::new("unknown", 0, "sqlite_open_failed"))?;
+    let mut reference = ReferenceMirror::default();
+    let mut pending: Option<Batch> = None;
+    let mut responses = 0_usize;
+    let mut duplicate_responses = 0_usize;
+    let mut batches_applied = 0_usize;
+    let mut checkpoints = 0_usize;
+    let mut disconnects = 0_usize;
+    let mut records_seen = 0_usize;
+    let mut saw_end = false;
+    for line in reader.lines() {
+        if saw_end {
+            return Err(TranscriptDiagnostic::new("unknown", 0, "record_after_end"));
+        }
+        let line = line.map_err(|_| pending_diagnostic(pending.as_ref(), "input_read_failed"))?;
+        let record: TranscriptRecord = serde_json::from_str(&line)
+            .map_err(|_| pending_diagnostic(pending.as_ref(), "invalid_json"))?;
+        records_seen += 1;
+        match record {
+            TranscriptRecord::Begin {
+                batch_id,
+                mailbox_id,
+                sequence,
+            } => {
+                if pending.is_some() {
+                    return Err(pending_diagnostic(pending.as_ref(), "nested_batch"));
+                }
+                pending = Some(Batch::new(batch_id, mailbox_id, sequence, Vec::new()));
+            }
+            TranscriptRecord::Response { event } => {
+                let batch = pending.as_mut().ok_or_else(|| {
+                    TranscriptDiagnostic::new("unknown", 0, "response_without_batch")
+                })?;
+                batch.events.push(event);
+                responses += 1;
+            }
+            TranscriptRecord::Commit { batch_id } => {
+                let batch = pending.take().ok_or_else(|| {
+                    TranscriptDiagnostic::new("unknown", 0, "commit_without_batch")
+                })?;
+                if batch.batch_id != batch_id {
+                    return Err(TranscriptDiagnostic::new(
+                        batch.mailbox_id,
+                        batch.sequence,
+                        "batch_id_mismatch",
+                    ));
+                }
+                let reference_outcome = reference.apply(&batch).map_err(|_| {
+                    TranscriptDiagnostic::new(
+                        &batch.mailbox_id,
+                        batch.sequence,
+                        "reference_rejected_batch",
+                    )
+                })?;
+                let sqlite_outcome = sqlite.apply(&batch).map_err(|_| {
+                    TranscriptDiagnostic::new(
+                        &batch.mailbox_id,
+                        batch.sequence,
+                        "sqlite_rejected_batch",
+                    )
+                })?;
+                if reference_outcome != sqlite_outcome {
+                    return Err(TranscriptDiagnostic::new(
+                        batch.mailbox_id,
+                        batch.sequence,
+                        "admission_mismatch",
+                    ));
+                }
+                if sqlite_outcome == ApplyOutcome::Duplicate {
+                    duplicate_responses += batch.events.len();
+                } else {
+                    batches_applied += 1;
+                }
+            }
+            TranscriptRecord::Checkpoint {
+                id: _,
+                mailbox_id,
+                selected_uids,
+            } => {
+                if pending.is_some() {
+                    return Err(pending_diagnostic(
+                        pending.as_ref(),
+                        "checkpoint_inside_batch",
+                    ));
+                }
+                let expected = reference
+                    .checkpoint(&mailbox_id, &selected_uids)
+                    .map_err(|_| {
+                        TranscriptDiagnostic::new(&mailbox_id, 0, "reference_checkpoint_failed")
+                    })?;
+                let actual = sqlite
+                    .checkpoint(&mailbox_id, &selected_uids)
+                    .map_err(|_| {
+                        TranscriptDiagnostic::new(&mailbox_id, 0, "sqlite_checkpoint_failed")
+                    })?;
+                if actual != expected {
+                    return Err(TranscriptDiagnostic::new(
+                        mailbox_id,
+                        0,
+                        "checkpoint_mismatch",
+                    ));
+                }
+                checkpoints += 1;
+            }
+            TranscriptRecord::Disconnect => {
+                if pending.take().is_none() {
+                    return Err(TranscriptDiagnostic::new(
+                        "unknown",
+                        0,
+                        "disconnect_without_batch",
+                    ));
+                }
+                disconnects += 1;
+            }
+            TranscriptRecord::End {
+                responses: expected_responses,
+                records: expected_records,
+            } => {
+                if pending.is_some() {
+                    return Err(pending_diagnostic(pending.as_ref(), "end_inside_batch"));
+                }
+                if responses != expected_responses || records_seen != expected_records {
+                    return Err(TranscriptDiagnostic::new(
+                        "unknown",
+                        0,
+                        "transcript_count_mismatch",
+                    ));
+                }
+                saw_end = true;
+            }
+        }
+    }
+    if pending.is_some() {
+        return Err(pending_diagnostic(
+            pending.as_ref(),
+            "missing_batch_terminator",
+        ));
+    }
+    if !saw_end {
+        return Err(TranscriptDiagnostic::new("unknown", 0, "truncated_input"));
+    }
+    let expected = reference.manifest();
+    let actual = sqlite
+        .manifest()
+        .map_err(|_| TranscriptDiagnostic::new("unknown", 0, "sqlite_manifest_failed"))?;
+    if actual != expected {
+        return Err(TranscriptDiagnostic::new("unknown", 0, "manifest_mismatch"));
+    }
+    Ok(VerificationSummary {
+        responses,
+        duplicate_responses,
+        batches_applied,
+        checkpoints,
+        disconnects,
+        elapsed_ms: started.elapsed().as_millis(),
+        manifest: expected,
+    })
+}
+
+/// Applies or resumes a transcript against the `SQLite` baseline.
+///
+/// # Errors
+///
+/// Returns a privacy-safe diagnostic when framing or `SQLite` admission fails.
+#[allow(clippy::too_many_lines)]
+pub fn apply_transcript<Reader: BufRead>(
+    reader: Reader,
+    database: &Path,
+    resume: bool,
+) -> Result<ApplySummary, TranscriptDiagnostic> {
+    let started = Instant::now();
+    let mut sqlite = if resume {
+        SqliteBaseline::open(database)
+    } else {
+        SqliteBaseline::create(database)
+    }
+    .map_err(|_| TranscriptDiagnostic::new("unknown", 0, "sqlite_open_failed"))?;
+    let mut pending: Option<Batch> = None;
+    let mut responses = 0_usize;
+    let mut duplicate_responses = 0_usize;
+    let mut batches_applied = 0_usize;
+    let mut checkpoints = 0_usize;
+    let mut disconnects = 0_usize;
+    let mut records_seen = 0_usize;
+    let mut saw_end = false;
+    for line in reader.lines() {
+        if saw_end {
+            return Err(TranscriptDiagnostic::new("unknown", 0, "record_after_end"));
+        }
+        let line = line.map_err(|_| pending_diagnostic(pending.as_ref(), "input_read_failed"))?;
+        let record: TranscriptRecord = serde_json::from_str(&line)
+            .map_err(|_| pending_diagnostic(pending.as_ref(), "invalid_json"))?;
+        records_seen += 1;
+        match record {
+            TranscriptRecord::Begin {
+                batch_id,
+                mailbox_id,
+                sequence,
+            } => {
+                if pending.is_some() {
+                    return Err(pending_diagnostic(pending.as_ref(), "nested_batch"));
+                }
+                pending = Some(Batch::new(batch_id, mailbox_id, sequence, Vec::new()));
+            }
+            TranscriptRecord::Response { event } => {
+                let batch = pending.as_mut().ok_or_else(|| {
+                    TranscriptDiagnostic::new("unknown", 0, "response_without_batch")
+                })?;
+                batch.events.push(event);
+                responses += 1;
+            }
+            TranscriptRecord::Commit { batch_id } => {
+                let batch = pending.take().ok_or_else(|| {
+                    TranscriptDiagnostic::new("unknown", 0, "commit_without_batch")
+                })?;
+                if batch.batch_id != batch_id {
+                    return Err(TranscriptDiagnostic::new(
+                        batch.mailbox_id,
+                        batch.sequence,
+                        "batch_id_mismatch",
+                    ));
+                }
+                let outcome = sqlite.apply(&batch).map_err(|_| {
+                    TranscriptDiagnostic::new(
+                        &batch.mailbox_id,
+                        batch.sequence,
+                        "sqlite_rejected_batch",
+                    )
+                })?;
+                if outcome == ApplyOutcome::Duplicate {
+                    duplicate_responses += batch.events.len();
+                } else {
+                    batches_applied += 1;
+                }
+            }
+            TranscriptRecord::Checkpoint {
+                id: _,
+                mailbox_id,
+                selected_uids,
+            } => {
+                if pending.is_some() {
+                    return Err(pending_diagnostic(
+                        pending.as_ref(),
+                        "checkpoint_inside_batch",
+                    ));
+                }
+                sqlite
+                    .checkpoint(&mailbox_id, &selected_uids)
+                    .map_err(|_| {
+                        TranscriptDiagnostic::new(&mailbox_id, 0, "sqlite_checkpoint_failed")
+                    })?;
+                checkpoints += 1;
+            }
+            TranscriptRecord::Disconnect => {
+                if pending.take().is_none() {
+                    return Err(TranscriptDiagnostic::new(
+                        "unknown",
+                        0,
+                        "disconnect_without_batch",
+                    ));
+                }
+                disconnects += 1;
+            }
+            TranscriptRecord::End {
+                responses: expected_responses,
+                records: expected_records,
+            } => {
+                if pending.is_some() {
+                    return Err(pending_diagnostic(pending.as_ref(), "end_inside_batch"));
+                }
+                if responses != expected_responses || records_seen != expected_records {
+                    return Err(TranscriptDiagnostic::new(
+                        "unknown",
+                        0,
+                        "transcript_count_mismatch",
+                    ));
+                }
+                saw_end = true;
+            }
+        }
+    }
+    if pending.is_some() {
+        return Err(pending_diagnostic(
+            pending.as_ref(),
+            "missing_batch_terminator",
+        ));
+    }
+    if !saw_end {
+        return Err(TranscriptDiagnostic::new("unknown", 0, "truncated_input"));
+    }
+    let manifest = sqlite
+        .manifest()
+        .map_err(|_| TranscriptDiagnostic::new("unknown", 0, "sqlite_manifest_failed"))?;
+    Ok(ApplySummary {
+        responses,
+        duplicate_responses,
+        batches_applied,
+        checkpoints,
+        disconnects,
+        elapsed_ms: started.elapsed().as_millis(),
+        manifest,
+    })
+}
+
+fn pending_diagnostic(pending: Option<&Batch>, code: &str) -> TranscriptDiagnostic {
+    pending.map_or_else(
+        || TranscriptDiagnostic::new("unknown", 0, code),
+        |batch| TranscriptDiagnostic::new(&batch.mailbox_id, batch.sequence, code),
+    )
+}
+
+fn synthetic_message(seed: u64, mailbox: usize, epoch: u64, uid: u64) -> Message {
+    let mailbox = u64::try_from(mailbox).unwrap_or(u64::MAX);
+    let left = mix(seed ^ mailbox.rotate_left(17) ^ epoch.rotate_left(31) ^ uid);
+    let right = mix(left ^ 0x9e37_79b9_7f4a_7c15);
+    Message {
+        uid,
+        fingerprint: format!("{left:016x}{right:016x}"),
+        internal_date: 1_700_000_000 + i64::try_from(uid % 10_000_000).unwrap_or(0),
+        size: 256 + (right % 65_536),
+        flags: u8::from(left.trailing_zeros() >= 2),
+    }
+}
+
+fn mix(mut value: u64) -> u64 {
+    value ^= value >> 30;
+    value = value.wrapping_mul(0xbf58_476d_1ce4_e5b9);
+    value ^= value >> 27;
+    value = value.wrapping_mul(0x94d0_49bb_1331_11eb);
+    value ^ (value >> 31)
+}
diff --git a/developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/src/main.rs b/developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/src/main.rs
new file mode 100644
index 0000000..31554e0
--- /dev/null
+++ b/developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/src/main.rs
@@ -0,0 +1,156 @@
+use std::fs::File;
+use std::io::{BufReader, BufWriter, Write};
+use std::path::PathBuf;
+use std::process::ExitCode;
+
+use clap::{Parser, Subcommand};
+use mailbox_mirror_lab::{
+    GeneratorConfig, SqliteBaseline, apply_transcript, generate_transcript, verify_transcript,
+};
+use serde::Serialize;
+
+#[derive(Parser)]
+#[command(about = "Deterministic epoch-safe mailbox mirror laboratory")]
+struct Cli {
+    #[command(subcommand)]
+    command: HarnessCommand,
+}
+
+#[derive(Subcommand)]
+enum HarnessCommand {
+    Generate {
+        #[arg(long)]
+        output: PathBuf,
+        #[arg(long, default_value_t = 1)]
+        seed: u64,
+        #[arg(long, default_value_t = 80)]
+        mailboxes: usize,
+        #[arg(long, default_value_t = 300_000)]
+        messages: usize,
+        #[arg(long, default_value_t = 600_000)]
+        responses: usize,
+    },
+    Apply {
+        #[arg(long)]
+        transcript: PathBuf,
+        #[arg(long)]
+        database: PathBuf,
+    },
+    Resume {
+        #[arg(long)]
+        transcript: PathBuf,
+        #[arg(long)]
+        database: PathBuf,
+    },
+    Verify {
+        #[arg(long)]
+        transcript: PathBuf,
+        #[arg(long)]
+        database: PathBuf,
+    },
+    Summarize {
+        #[arg(long)]
+        database: PathBuf,
+    },
+}
+
+#[derive(Serialize)]
+struct ManifestSummary {
+    live_messages: usize,
+    manifest: mailbox_mirror_lab::Manifest,
+}
+
+fn main() -> ExitCode {
+    match run(Cli::parse()) {
+        Ok(()) => ExitCode::SUCCESS,
+        Err(error) => {
+            eprintln!("{error}");
+            ExitCode::FAILURE
+        }
+    }
+}
+
+fn run(cli: Cli) -> Result<(), String> {
+    match cli.command {
+        HarnessCommand::Generate {
+            output,
+            seed,
+            mailboxes,
+            messages,
+            responses,
+        } => {
+            let file = File::create(&output).map_err(|_| "cannot create transcript".to_owned())?;
+            let mut writer = BufWriter::new(file);
+            let summary = generate_transcript(
+                &GeneratorConfig {
+                    seed,
+                    mailboxes,
+                    live_messages: messages,
+                    responses,
+                },
+                &mut writer,
+            )
+            .map_err(|error| error.to_string())?;
+            writer
+                .flush()
+                .map_err(|_| "cannot flush transcript".to_owned())?;
+            print_json(&summary)
+        }
+        HarnessCommand::Apply {
+            transcript,
+            database,
+        } => {
+            if database.exists() {
+                return Err("database already exists; use resume".to_owned());
+            }
+            let reader = open_transcript(&transcript)?;
+            let summary =
+                apply_transcript(reader, &database, false).map_err(|error| error.to_string())?;
+            print_json(&summary)
+        }
+        HarnessCommand::Resume {
+            transcript,
+            database,
+        } => {
+            let reader = open_transcript(&transcript)?;
+            let summary =
+                apply_transcript(reader, &database, true).map_err(|error| error.to_string())?;
+            print_json(&summary)
+        }
+        HarnessCommand::Verify {
+            transcript,
+            database,
+        } => {
+            if database.exists() {
+                return Err("verification database already exists".to_owned());
+            }
+            let reader = open_transcript(&transcript)?;
+            let summary =
+                verify_transcript(reader, &database).map_err(|error| error.to_string())?;
+            print_json(&summary)
+        }
+        HarnessCommand::Summarize { database } => {
+            let sqlite = SqliteBaseline::open(&database).map_err(|error| error.to_string())?;
+            let manifest = sqlite.manifest().map_err(|error| error.to_string())?;
+            print_json(&ManifestSummary {
+                live_messages: manifest.live_messages(),
+                manifest,
+            })
+        }
+    }
+}
+
+fn open_transcript(path: &PathBuf) -> Result<BufReader<File>, String> {
+    File::open(path)
+        .map(BufReader::new)
+        .map_err(|_| "cannot open transcript".to_owned())
+}
+
+fn print_json(value: &impl Serialize) -> Result<(), String> {
+    let stdout = std::io::stdout();
+    let mut writer = stdout.lock();
+    serde_json::to_writer(&mut writer, value).map_err(|_| "cannot encode output".to_owned())?;
+    writer
+        .write_all(b"\n")
+        .map_err(|_| "cannot write output".to_owned())
+}
diff --git a/developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/tests/baseline_measure.rs b/developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/tests/baseline_measure.rs
new file mode 100644
index 0000000..ed88e3f
--- /dev/null
+++ b/developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/tests/baseline_measure.rs
@@ -0,0 +1,85 @@
+use std::time::Instant;
+
+use mailbox_mirror_lab::{Batch, Event, Message, SqliteBaseline};
+
+#[test]
+#[ignore = "explicit local measurement"]
+fn measure_sqlite_baseline_10k_messages() {
+    let temporary = tempfile::tempdir().unwrap();
+    let path = temporary.path().join("mirror.sqlite");
+    let mut baseline = SqliteBaseline::create(&path).unwrap();
+    let started = Instant::now();
+    for mailbox in 0..20_u64 {
+        baseline
+            .apply(&Batch::new(
+                format!("create-{mailbox}"),
+                format!("mailbox-{mailbox:02}"),
+                1,
+                vec![Event::CreateMailbox {
+                    display_name: format!("Folder {mailbox:02}"),
+                    uid_validity: 1,
+                }],
+            ))
+            .unwrap();
+    }
+    for (sequence, batch_number) in (2_u64..).zip(0..100_u64) {
+        let mailbox = batch_number % 20;
+        let events = (0..100_u64)
+            .map(|offset| {
+                let uid = (batch_number / 20) * 100 + offset + 1;
+                Event::Add {
+                    uid_validity: 1,
+                    message: Message {
+                        uid,
+                        fingerprint: format!("{mailbox:016x}{uid:016x}"),
+                        internal_date: 1_700_000_000 + i64::try_from(uid).unwrap(),
+                        size: 2048,
+                        flags: u8::from(uid % 3 == 0),
+                    },
+                    cursor: sequence,
+                }
+            })
+            .collect();
+        baseline
+            .apply(&Batch::new(
+                format!("add-{batch_number}"),
+                format!("mailbox-{mailbox:02}"),
+                sequence,
+                events,
+            ))
+            .unwrap();
+    }
+    let apply_ms = started.elapsed().as_secs_f64() * 1000.0;
+
+    let mut query_us = Vec::with_capacity(200);
+    for index in 0..200_u64 {
+        let query_started = Instant::now();
+        let checkpoint = baseline
+            .checkpoint(&format!("mailbox-{:02}", index % 20), &[])
+            .unwrap();
+        assert_eq!(checkpoint.total, 500);
+        query_us.push(query_started.elapsed().as_micros());
+    }
+    query_us.sort_unstable();
+    let p50_us = query_us[query_us.len() / 2];
+    let p95_us = query_us[query_us.len() * 95 / 100];
+
+    drop(baseline);
+    let reopen_started = Instant::now();
+    let reopened = SqliteBaseline::open(&path).unwrap();
+    assert_eq!(reopened.checkpoint("mailbox-00", &[]).unwrap().total, 500);
+    let reopen_ms = reopen_started.elapsed().as_secs_f64() * 1000.0;
+    let disk_bytes = [
+        path.clone(),
+        path.with_extension("sqlite-wal"),
+        path.with_extension("sqlite-shm"),
+    ]
+    .iter()
+    .filter_map(|entry| std::fs::metadata(entry).ok())
+    .map(|metadata| metadata.len())
+    .sum::<u64>();
+    println!(
+        "{{\"mailboxes\":20,\"messages\":10000,\"batches\":120,\"apply_ms\":{apply_ms:.3},\"responses_per_second\":{:.1},\"count_p50_us\":{p50_us},\"count_p95_us\":{p95_us},\"reopen_ms\":{reopen_ms:.3},\"disk_bytes\":{disk_bytes}}}",
+        10_020.0 / (apply_ms / 1000.0)
+    );
+}
diff --git a/developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/tests/cli.rs b/developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/tests/cli.rs
new file mode 100644
index 0000000..ee5af7c
--- /dev/null
+++ b/developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/tests/cli.rs
@@ -0,0 +1,70 @@
+use std::process::Command;
+
+#[test]
+fn cli_generate_verify_resume_and_summarize_are_runnable() {
+    // Break caught: a documented harness command not being wired to the tested library path.
+    let temporary = tempfile::tempdir().unwrap();
+    let transcript = temporary.path().join("transcript.ndjson");
+    let database = temporary.path().join("mirror.sqlite");
+    let binary = env!("CARGO_BIN_EXE_mailbox-mirror-lab");
+
+    let generated = Command::new(binary)
+        .args(["generate", "--output"])
+        .arg(&transcript)
+        .args([
+            "--seed",
+            "29",
+            "--mailboxes",
+            "30",
+            "--messages",
+            "300",
+            "--responses",
+            "1200",
+        ])
+        .output()
+        .unwrap();
+    assert!(
+        generated.status.success(),
+        "{}",
+        String::from_utf8_lossy(&generated.stderr)
+    );
+
+    let verified = Command::new(binary)
+        .args(["verify", "--transcript"])
+        .arg(&transcript)
+        .arg("--database")
+        .arg(&database)
+        .output()
+        .unwrap();
+    assert!(
+        verified.status.success(),
+        "{}",
+        String::from_utf8_lossy(&verified.stderr)
+    );
+
+    let resumed = Command::new(binary)
+        .args(["resume", "--transcript"])
+        .arg(&transcript)
+        .arg("--database")
+        .arg(&database)
+        .output()
+        .unwrap();
+    assert!(
+        resumed.status.success(),
+        "{}",
+        String::from_utf8_lossy(&resumed.stderr)
+    );
+
+    let summarized = Command::new(binary)
+        .args(["summarize", "--database"])
+        .arg(&database)
+        .output()
+        .unwrap();
+    assert!(
+        summarized.status.success(),
+        "{}",
+        String::from_utf8_lossy(&summarized.stderr)
+    );
+    let manifest: serde_json::Value = serde_json::from_slice(&summarized.stdout).unwrap();
+    assert_eq!(manifest["live_messages"], 300);
+}
diff --git a/developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/tests/fault_matrix.rs b/developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/tests/fault_matrix.rs
new file mode 100644
index 0000000..6e12572
--- /dev/null
+++ b/developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/tests/fault_matrix.rs
@@ -0,0 +1,283 @@
+use mailbox_mirror_lab::{
+    ApplyOutcome, Batch, Event, Message, ReferenceMirror, SQLITE_INTEGER_MAX, SqliteBaseline,
+};
+
+fn message(uid: u64, flags: u8) -> Message {
+    Message {
+        uid,
+        fingerprint: format!("{uid:032x}"),
+        internal_date: 1_700_000_000,
+        size: 1024,
+        flags,
+    }
+}
+
+fn initialized() -> (tempfile::TempDir, ReferenceMirror, SqliteBaseline) {
+    let temporary = tempfile::tempdir().unwrap();
+    let mut reference = ReferenceMirror::default();
+    let mut sqlite = SqliteBaseline::create(&temporary.path().join("mirror.sqlite")).unwrap();
+    for batch in [
+        Batch::new(
+            "create",
+            "mailbox-a",
+            1,
+            vec![Event::CreateMailbox {
+                display_name: "Inbox".to_owned(),
+                uid_validity: 1,
+            }],
+        ),
+        Batch::new(
+            "add",
+            "mailbox-a",
+            2,
+            vec![Event::Add {
+                uid_validity: 1,
+                message: message(1, 0),
+                cursor: 10,
+            }],
+        ),
+    ] {
+        reference.apply(&batch).unwrap();
+        sqlite.apply(&batch).unwrap();
+    }
+    (temporary, reference, sqlite)
+}
+
+#[test]
+fn decreasing_cursor_unknown_mailbox_and_illegal_reordering_do_not_mutate() {
+    // Break caught: validation errors leaking earlier events from the same transaction.
+    let (_temporary, mut reference, mut sqlite) = initialized();
+    let before_reference = reference.manifest();
+    let before_sqlite = sqlite.manifest().unwrap();
+    let invalid_batches = [
+        Batch::new(
+            "decreasing",
+            "mailbox-a",
+            3,
+            vec![Event::ReplaceFlags {
+                uid_validity: 1,
+                uid: 1,
+                flags: 1,
+                cursor: 9,
+            }],
+        ),
+        Batch::new(
+            "unknown",
+            "mailbox-missing",
+            1,
+            vec![Event::Add {
+                uid_validity: 1,
+                message: message(1, 0),
+                cursor: 1,
+            }],
+        ),
+        Batch::new(
+            "illegal-order",
+            "mailbox-a",
+            4,
+            vec![
+                Event::ReplaceFlags {
+                    uid_validity: 1,
+                    uid: 99,
+                    flags: 1,
+                    cursor: 11,
+                },
+                Event::Add {
+                    uid_validity: 1,
+                    message: message(99, 0),
+                    cursor: 11,
+                },
+            ],
+        ),
+    ];
+    for batch in invalid_batches {
+        assert!(reference.apply(&batch).is_err());
+        assert!(sqlite.apply(&batch).is_err());
+        assert_eq!(reference.manifest(), before_reference);
+        assert_eq!(sqlite.manifest().unwrap(), before_sqlite);
+    }
+}
+
+#[test]
+fn incremental_event_for_uncommitted_epoch_is_rejected_without_hiding_old_epoch() {
+    // Break caught: treating staged epoch as active before snapshot publication.
+    let (_temporary, mut reference, mut sqlite) = initialized();
+    let begin = Batch::new(
+        "begin",
+        "mailbox-a",
+        3,
+        vec![Event::SnapshotBegin { uid_validity: 2 }],
+    );
+    reference.apply(&begin).unwrap();
+    sqlite.apply(&begin).unwrap();
+    let invalid = Batch::new(
+        "premature",
+        "mailbox-a",
+        4,
+        vec![Event::Add {
+            uid_validity: 2,
+            message: message(2, 0),
+            cursor: 11,
+        }],
+    );
+    assert!(reference.apply(&invalid).is_err());
+    assert!(sqlite.apply(&invalid).is_err());
+    let expected = reference.checkpoint("mailbox-a", &[1, 2]).unwrap();
+    let actual = sqlite.checkpoint("mailbox-a", &[1, 2]).unwrap();
+    assert_eq!(actual, expected);
+    assert_eq!(actual.uid_validity, 1);
+    assert_eq!(actual.total, 1);
+}
+
+#[test]
+fn sqlite_integer_max_round_trips_for_every_unsigned_field() {
+    // Break caught: narrowing or floating-point coercion at the declared inclusive boundary.
+    let temporary = tempfile::tempdir().unwrap();
+    let database = temporary.path().join("mirror.sqlite");
+    let mut reference = ReferenceMirror::default();
+    let mut sqlite = SqliteBaseline::create(&database).unwrap();
+    let create = Batch::new(
+        "create-max",
+        "mailbox-max",
+        SQLITE_INTEGER_MAX,
+        vec![Event::CreateMailbox {
+            display_name: "Maximum".to_owned(),
+            uid_validity: SQLITE_INTEGER_MAX,
+        }],
+    );
+    let add = Batch::new(
+        "add-max",
+        "mailbox-max",
+        SQLITE_INTEGER_MAX,
+        vec![Event::Add {
+            uid_validity: SQLITE_INTEGER_MAX,
+            message: Message {
+                uid: SQLITE_INTEGER_MAX,
+                fingerprint: "ffffffffffffffffffffffffffffffff".to_owned(),
+                internal_date: i64::MAX,
+                size: SQLITE_INTEGER_MAX,
+                flags: 0,
+            },
+            cursor: SQLITE_INTEGER_MAX,
+        }],
+    );
+
+    for batch in [&create, &add] {
+        assert_eq!(reference.apply(batch).unwrap(), ApplyOutcome::Applied);
+        assert_eq!(sqlite.apply(batch).unwrap(), ApplyOutcome::Applied);
+    }
+    let expected = reference.manifest();
+    let actual = sqlite.manifest().unwrap();
+    assert_eq!(actual, expected);
+    assert_eq!(actual.mailboxes[0].messages[0].uid, SQLITE_INTEGER_MAX);
+    assert_eq!(actual.mailboxes[0].messages[0].size, SQLITE_INTEGER_MAX);
+    let stored_sequences = std::process::Command::new("/usr/bin/sqlite3")
+        .arg(&database)
+        .arg("SELECT sequence FROM accepted_batches ORDER BY batch_id;")
+        .output()
+        .unwrap();
+    assert!(stored_sequences.status.success());
+    assert_eq!(
+        String::from_utf8(stored_sequences.stdout).unwrap(),
+        format!("{SQLITE_INTEGER_MAX}\n{SQLITE_INTEGER_MAX}\n")
+    );
+    for batch in [&create, &add] {
+        assert_eq!(reference.apply(batch).unwrap(), ApplyOutcome::Duplicate);
+        assert_eq!(sqlite.apply(batch).unwrap(), ApplyOutcome::Duplicate);
+    }
+}
+
+#[test]
+fn every_unsigned_field_rejects_sqlite_integer_max_plus_one_before_mutation() {
+    // Break caught: any u64 above SQLite's signed INTEGER range reaching SQL numeric coercion.
+    let over = SQLITE_INTEGER_MAX + 1;
+    let invalid_batches = [
+        Batch::new(
+            "bad-sequence",
+            "mailbox-a",
+            over,
+            vec![Event::Rename {
+                display_name: "Should not change".to_owned(),
+            }],
+        ),
+        Batch::new(
+            "bad-epoch",
+            "mailbox-a",
+            3,
+            vec![Event::SnapshotBegin { uid_validity: over }],
+        ),
+        Batch::new(
+            "bad-uid",
+            "mailbox-a",
+            3,
+            vec![Event::Add {
+                uid_validity: 1,
+                message: Message {
+                    uid: over,
+                    fingerprint: "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa".to_owned(),
+                    internal_date: 1_700_000_000,
+                    size: 1,
+                    flags: 0,
+                },
+                cursor: 11,
+            }],
+        ),
+        Batch::new(
+            "bad-size",
+            "mailbox-a",
+            3,
+            vec![Event::Add {
+                uid_validity: 1,
+                message: Message {
+                    uid: 2,
+                    fingerprint: "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb".to_owned(),
+                    internal_date: 1_700_000_000,
+                    size: over,
+                    flags: 0,
+                },
+                cursor: 11,
+            }],
+        ),
+        Batch::new(
+            "bad-cursor",
+            "mailbox-a",
+            3,
+            vec![Event::ReplaceFlags {
+                uid_validity: 1,
+                uid: 1,
+                flags: 1,
+                cursor: over,
+            }],
+        ),
+    ];
+
+    for invalid in invalid_batches {
+        let (_temporary, mut reference, mut sqlite) = initialized();
+        let before_reference = reference.manifest();
+        let before_sqlite = sqlite.manifest().unwrap();
+        assert_eq!(
+            reference.apply(&invalid).unwrap_err().to_string(),
+            "integer outside SQLite INTEGER range"
+        );
+        assert_eq!(
+            sqlite.apply(&invalid).unwrap_err().to_string(),
+            "integer outside SQLite INTEGER range"
+        );
+        assert_eq!(reference.manifest(), before_reference);
+        assert_eq!(sqlite.manifest().unwrap(), before_sqlite);
+
+        let valid_retry = Batch::new(
+            invalid.batch_id,
+            "mailbox-a",
+            3,
+            vec![Event::Rename {
+                display_name: "Valid retry".to_owned(),
+            }],
+        );
+        assert_eq!(
+            reference.apply(&valid_retry).unwrap(),
+            ApplyOutcome::Applied
+        );
+        assert_eq!(sqlite.apply(&valid_retry).unwrap(), ApplyOutcome::Applied);
+    }
+}
diff --git a/developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/tests/fold_reproducer.rs b/developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/tests/fold_reproducer.rs
new file mode 100644
index 0000000..cf21345
--- /dev/null
+++ b/developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/tests/fold_reproducer.rs
@@ -0,0 +1,57 @@
+use std::panic::{AssertUnwindSafe, catch_unwind};
+
+use fold::pipeline::terminal;
+use fold::stream::KeyedStream;
+
+#[test]
+fn returning_an_error_from_fold_write_closure_still_commits_prior_writes() {
+    // Characterizes the documented boundary relevant to decoded-batch rejection.
+    let temporary = tempfile::tempdir().unwrap();
+    let mut stream = KeyedStream::new(
+        temporary.path(),
+        terminal::Table::<u64, String>::new("rows"),
+    );
+    let result: Result<(), &'static str> = stream.wtx(|transaction| {
+        transaction.upsert(&1, &"first response".to_owned());
+        Err("second response was invalid")
+    });
+
+    assert_eq!(result, Err("second response was invalid"));
+    assert_eq!(stream.get(&1), Some("first response".to_owned()));
+}
+
+#[test]
+fn caught_panic_rolls_back_rejected_row_but_poisons_the_same_streams_later_write() {
+    // Characterizes the tracked current-main defect: rollback happens, but the writer is unusable.
+    let temporary = tempfile::tempdir().unwrap();
+    let mut stream = KeyedStream::new(
+        temporary.path(),
+        terminal::Table::<u64, String>::new("rows"),
+    );
+    let result = catch_unwind(AssertUnwindSafe(|| {
+        stream.wtx(|transaction| {
+            transaction.upsert(&1, &"first response".to_owned());
+            panic!("reject batch");
+        });
+    }));
+
+    assert!(result.is_err());
+    assert_eq!(stream.get(&1), None);
+
+    let later_write = catch_unwind(AssertUnwindSafe(|| {
+        stream.wtx(|transaction| {
+            transaction.upsert(&2, &"later valid response".to_owned());
+        });
+    }));
+    let poison = later_write.expect_err("current main unexpectedly accepted the later write");
+    let message = poison
+        .downcast_ref::<String>()
+        .map(String::as_str)
+        .or_else(|| poison.downcast_ref::<&str>().copied())
+        .unwrap_or("non-string panic");
+    assert!(
+        message.contains("poisoned tx lock"),
+        "unexpected panic: {message}"
+    );
+    assert_eq!(stream.get(&2), None);
+}
diff --git a/developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/tests/reference.rs b/developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/tests/reference.rs
new file mode 100644
index 0000000..c64bba8
--- /dev/null
+++ b/developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/tests/reference.rs
@@ -0,0 +1,293 @@
+use mailbox_mirror_lab::{ApplyOutcome, Batch, Event, Message, ReferenceMirror};
+
+fn message(uid: u64, seen: bool, fingerprint: &str) -> Message {
+    Message {
+        uid,
+        fingerprint: fingerprint.to_owned(),
+        internal_date: 1_700_000_000,
+        size: 512,
+        flags: u8::from(seen),
+    }
+}
+
+#[test]
+fn duplicate_complete_batch_is_idempotent() {
+    // Break caught: forgetting durable batch admission would double-apply an add.
+    let mut mirror = ReferenceMirror::default();
+    let create = Batch::new(
+        "b-1",
+        "mailbox-a",
+        1,
+        vec![Event::CreateMailbox {
+            display_name: "Inbox".to_owned(),
+            uid_validity: 7,
+        }],
+    );
+    let add = Batch::new(
+        "b-2",
+        "mailbox-a",
+        2,
+        vec![Event::Add {
+            uid_validity: 7,
+            message: message(42, false, "00000000000000000000000000000001"),
+            cursor: 2,
+        }],
+    );
+
+    assert_eq!(mirror.apply(&create).unwrap(), ApplyOutcome::Applied);
+    assert_eq!(mirror.apply(&add).unwrap(), ApplyOutcome::Applied);
+    let once = mirror.checkpoint("mailbox-a", &[42]).unwrap();
+    assert_eq!(mirror.apply(&add).unwrap(), ApplyOutcome::Duplicate);
+    assert_eq!(mirror.checkpoint("mailbox-a", &[42]).unwrap(), once);
+    assert_eq!(once.total, 1);
+    assert_eq!(once.unread, 1);
+}
+
+#[test]
+fn replacement_epoch_stays_hidden_until_snapshot_commit() {
+    // Break caught: publishing staged rows early would mix epochs and reuse old flags for UID 42.
+    let mut mirror = ReferenceMirror::default();
+    mirror
+        .apply(&Batch::new(
+            "create",
+            "mailbox-a",
+            1,
+            vec![Event::CreateMailbox {
+                display_name: "Inbox".to_owned(),
+                uid_validity: 7,
+            }],
+        ))
+        .unwrap();
+    mirror
+        .apply(&Batch::new(
+            "old-message",
+            "mailbox-a",
+            2,
+            vec![Event::Add {
+                uid_validity: 7,
+                message: message(42, true, "00000000000000000000000000000001"),
+                cursor: 2,
+            }],
+        ))
+        .unwrap();
+    mirror
+        .apply(&Batch::new(
+            "snapshot-begin",
+            "mailbox-a",
+            3,
+            vec![Event::SnapshotBegin { uid_validity: 8 }],
+        ))
+        .unwrap();
+
+    let during = mirror.checkpoint("mailbox-a", &[42]).unwrap();
+    assert_eq!(during.uid_validity, 7);
+    assert_eq!(during.status, mailbox_mirror_lab::MirrorStatus::NeedsRepair);
+    assert_eq!(during.selected[0].flags, 1);
+
+    mirror
+        .apply(&Batch::new(
+            "snapshot-message",
+            "mailbox-a",
+            4,
+            vec![Event::SnapshotMessage {
+                uid_validity: 8,
+                message: message(42, false, "00000000000000000000000000000002"),
+            }],
+        ))
+        .unwrap();
+    assert_eq!(
+        mirror.checkpoint("mailbox-a", &[42]).unwrap().selected[0].flags,
+        1
+    );
+
+    mirror
+        .apply(&Batch::new(
+            "snapshot-commit",
+            "mailbox-a",
+            5,
+            vec![Event::SnapshotCommit {
+                uid_validity: 8,
+                cursor: 5,
+            }],
+        ))
+        .unwrap();
+    let after = mirror.checkpoint("mailbox-a", &[42]).unwrap();
+    assert_eq!(after.uid_validity, 8);
+    assert_eq!(after.status, mailbox_mirror_lab::MirrorStatus::Synced);
+    assert_eq!(after.selected[0].flags, 0);
+    assert_eq!(
+        after.selected[0].fingerprint,
+        "00000000000000000000000000000002"
+    );
+}
+
+#[test]
+fn flag_replacement_and_expunge_update_materialized_counts() {
+    // Break caught: treating replacement flags as additive would double unread counts.
+    let mut mirror = ReferenceMirror::default();
+    mirror
+        .apply(&Batch::new(
+            "create",
+            "mailbox-a",
+            1,
+            vec![Event::CreateMailbox {
+                display_name: "Inbox".to_owned(),
+                uid_validity: 7,
+            }],
+        ))
+        .unwrap();
+    mirror
+        .apply(&Batch::new(
+            "add",
+            "mailbox-a",
+            2,
+            vec![
+                Event::Add {
+                    uid_validity: 7,
+                    message: message(1, false, "00000000000000000000000000000001"),
+                    cursor: 2,
+                },
+                Event::Add {
+                    uid_validity: 7,
+                    message: message(2, false, "00000000000000000000000000000002"),
+                    cursor: 2,
+                },
+            ],
+        ))
+        .unwrap();
+    mirror
+        .apply(&Batch::new(
+            "flags",
+            "mailbox-a",
+            3,
+            vec![Event::ReplaceFlags {
+                uid_validity: 7,
+                uid: 1,
+                flags: 1,
+                cursor: 3,
+            }],
+        ))
+        .unwrap();
+    let flagged = mirror.checkpoint("mailbox-a", &[1, 2]).unwrap();
+    assert_eq!((flagged.total, flagged.unread), (2, 1));
+    assert_eq!(flagged.selected[0].flags, 1);
+
+    mirror
+        .apply(&Batch::new(
+            "expunge",
+            "mailbox-a",
+            4,
+            vec![Event::Expunge {
+                uid_validity: 7,
+                uid: 2,
+                cursor: 4,
+            }],
+        ))
+        .unwrap();
+    let expunged = mirror.checkpoint("mailbox-a", &[1, 2]).unwrap();
+    assert_eq!((expunged.total, expunged.unread), (1, 0));
+    assert_eq!(expunged.selected.len(), 1);
+}
+
+#[test]
+fn rename_preserves_stable_id_but_recreated_name_does_not_resurrect_state() {
+    // Break caught: keying by display name would attach old messages to the recreated mailbox.
+    let mut mirror = ReferenceMirror::default();
+    mirror
+        .apply(&Batch::new(
+            "create-old",
+            "stable-old",
+            1,
+            vec![Event::CreateMailbox {
+                display_name: "Inbox".to_owned(),
+                uid_validity: 7,
+            }],
+        ))
+        .unwrap();
+    mirror
+        .apply(&Batch::new(
+            "add-old",
+            "stable-old",
+            2,
+            vec![Event::Add {
+                uid_validity: 7,
+                message: message(9, false, "00000000000000000000000000000009"),
+                cursor: 2,
+            }],
+        ))
+        .unwrap();
+    mirror
+        .apply(&Batch::new(
+            "rename",
+            "stable-old",
+            3,
+            vec![Event::Rename {
+                display_name: "Archive".to_owned(),
+            }],
+        ))
+        .unwrap();
+    let renamed = mirror.checkpoint("stable-old", &[9]).unwrap();
+    assert_eq!(renamed.display_name, "Archive");
+    assert_eq!(renamed.total, 1);
+
+    mirror
+        .apply(&Batch::new("delete", "stable-old", 4, vec![Event::Delete]))
+        .unwrap();
+    assert!(mirror.checkpoint("stable-old", &[9]).is_err());
+
+    mirror
+        .apply(&Batch::new(
+            "create-new",
+            "stable-new",
+            5,
+            vec![Event::CreateMailbox {
+                display_name: "Archive".to_owned(),
+                uid_validity: 1,
+            }],
+        ))
+        .unwrap();
+    let recreated = mirror.checkpoint("stable-new", &[9]).unwrap();
+    assert_eq!(recreated.total, 0);
+    assert!(recreated.selected.is_empty());
+}
+
+#[test]
+fn rejected_batch_has_no_partial_mutation() {
+    // Break caught: applying responses before validating the complete batch leaks partial state.
+    let mut mirror = ReferenceMirror::default();
+    mirror
+        .apply(&Batch::new(
+            "create",
+            "mailbox-a",
+            1,
+            vec![Event::CreateMailbox {
+                display_name: "Inbox".to_owned(),
+                uid_validity: 7,
+            }],
+        ))
+        .unwrap();
+    let invalid = Batch::new(
+        "invalid",
+        "mailbox-a",
+        2,
+        vec![
+            Event::Add {
+                uid_validity: 7,
+                message: message(1, false, "00000000000000000000000000000001"),
+                cursor: 2,
+            },
+            Event::ReplaceFlags {
+                uid_validity: 7,
+                uid: 999,
+                flags: 1,
+                cursor: 2,
+            },
+        ],
+    );
+
+    assert!(mirror.apply(&invalid).is_err());
+    let checkpoint = mirror.checkpoint("mailbox-a", &[1]).unwrap();
+    assert_eq!(checkpoint.total, 0);
+    assert_eq!(checkpoint.cursor, 0);
+    assert!(checkpoint.selected.is_empty());
+}
diff --git a/developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/tests/sqlite_baseline.rs b/developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/tests/sqlite_baseline.rs
new file mode 100644
index 0000000..71f7b5a
--- /dev/null
+++ b/developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/tests/sqlite_baseline.rs
@@ -0,0 +1,281 @@
+use mailbox_mirror_lab::{Batch, Event, Message, ReferenceMirror, SqliteBaseline};
+
+fn message(uid: u64, flags: u8, fingerprint: &str) -> Message {
+    Message {
+        uid,
+        fingerprint: fingerprint.to_owned(),
+        internal_date: 1_700_000_000,
+        size: 2048,
+        flags,
+    }
+}
+
+#[test]
+fn sqlite_baseline_matches_reference_across_epoch_publication_and_replay() {
+    // Break caught: a schema or SQL transaction that exposes staging or admits a duplicate twice.
+    let temporary = tempfile::tempdir().unwrap();
+    let mut sqlite = SqliteBaseline::create(&temporary.path().join("mirror.sqlite")).unwrap();
+    let mut reference = ReferenceMirror::default();
+    let batches = vec![
+        Batch::new(
+            "create",
+            "mailbox-a",
+            1,
+            vec![Event::CreateMailbox {
+                display_name: "Inbox".to_owned(),
+                uid_validity: 7,
+            }],
+        ),
+        Batch::new(
+            "old",
+            "mailbox-a",
+            2,
+            vec![Event::Add {
+                uid_validity: 7,
+                message: message(5, 1, "00000000000000000000000000000005"),
+                cursor: 2,
+            }],
+        ),
+        Batch::new(
+            "begin",
+            "mailbox-a",
+            3,
+            vec![Event::SnapshotBegin { uid_validity: 8 }],
+        ),
+        Batch::new(
+            "stage",
+            "mailbox-a",
+            4,
+            vec![Event::SnapshotMessage {
+                uid_validity: 8,
+                message: message(5, 0, "ffffffffffffffffffffffffffffffff"),
+            }],
+        ),
+    ];
+    for batch in &batches {
+        reference.apply(batch).unwrap();
+        sqlite.apply(batch).unwrap();
+        assert_eq!(
+            sqlite.checkpoint("mailbox-a", &[5]).unwrap(),
+            reference.checkpoint("mailbox-a", &[5]).unwrap()
+        );
+    }
+    let commit = Batch::new(
+        "commit",
+        "mailbox-a",
+        5,
+        vec![Event::SnapshotCommit {
+            uid_validity: 8,
+            cursor: 5,
+        }],
+    );
+    reference.apply(&commit).unwrap();
+    sqlite.apply(&commit).unwrap();
+    sqlite.apply(&commit).unwrap();
+    assert_eq!(
+        sqlite.checkpoint("mailbox-a", &[5]).unwrap(),
+        reference.checkpoint("mailbox-a", &[5]).unwrap()
+    );
+}
+
+#[test]
+fn reopening_retains_old_epoch_and_durable_staging_until_commit() {
+    // Break caught: process-local staging would lose repair progress or expose the new UID early.
+    let temporary = tempfile::tempdir().unwrap();
+    let path = temporary.path().join("mirror.sqlite");
+    let mut sqlite = SqliteBaseline::create(&path).unwrap();
+    for batch in [
+        Batch::new(
+            "create",
+            "mailbox-a",
+            1,
+            vec![Event::CreateMailbox {
+                display_name: "Inbox".to_owned(),
+                uid_validity: 1,
+            }],
+        ),
+        Batch::new(
+            "old",
+            "mailbox-a",
+            2,
+            vec![Event::Add {
+                uid_validity: 1,
+                message: message(10, 1, "11111111111111111111111111111111"),
+                cursor: 2,
+            }],
+        ),
+        Batch::new(
+            "begin",
+            "mailbox-a",
+            3,
+            vec![Event::SnapshotBegin { uid_validity: 2 }],
+        ),
+        Batch::new(
+            "stage",
+            "mailbox-a",
+            4,
+            vec![Event::SnapshotMessage {
+                uid_validity: 2,
+                message: message(10, 0, "22222222222222222222222222222222"),
+            }],
+        ),
+    ] {
+        sqlite.apply(&batch).unwrap();
+    }
+    drop(sqlite);
+
+    let mut reopened = SqliteBaseline::open(&path).unwrap();
+    let before = reopened.checkpoint("mailbox-a", &[10]).unwrap();
+    assert_eq!(before.uid_validity, 1);
+    assert_eq!(
+        before.selected[0].fingerprint,
+        "11111111111111111111111111111111"
+    );
+    reopened
+        .apply(&Batch::new(
+            "commit",
+            "mailbox-a",
+            5,
+            vec![Event::SnapshotCommit {
+                uid_validity: 2,
+                cursor: 5,
+            }],
+        ))
+        .unwrap();
+    let after = reopened.checkpoint("mailbox-a", &[10]).unwrap();
+    assert_eq!(after.uid_validity, 2);
+    assert_eq!(
+        after.selected[0].fingerprint,
+        "22222222222222222222222222222222"
+    );
+}
+
+fn staging_rows(path: &std::path::Path, mailbox_id: &str) -> u64 {
+    let query = format!(
+        "SELECT count(*) FROM staging_messages WHERE mailbox_id='{}';",
+        mailbox_id.replace('\'', "''")
+    );
+    let output = std::process::Command::new("/usr/bin/sqlite3")
+        .arg(path)
+        .arg(query)
+        .output()
+        .unwrap();
+    assert!(output.status.success());
+    String::from_utf8(output.stdout)
+        .unwrap()
+        .trim()
+        .parse()
+        .unwrap()
+}
+
+fn create_mailbox(batch_id: &str, epoch: u64) -> Batch {
+    Batch::new(
+        batch_id,
+        "mailbox-a",
+        1,
+        vec![Event::CreateMailbox {
+            display_name: "Inbox".to_owned(),
+            uid_validity: epoch,
+        }],
+    )
+}
+
+#[test]
+fn delete_cleans_staged_messages_and_stays_clean_after_reopen() {
+    // Break caught: staging_messages lacking a cascade and surviving stable-mailbox deletion.
+    let temporary = tempfile::tempdir().unwrap();
+    let path = temporary.path().join("mirror.sqlite");
+    let mut sqlite = SqliteBaseline::create(&path).unwrap();
+    for batch in [
+        create_mailbox("create", 1),
+        Batch::new(
+            "begin",
+            "mailbox-a",
+            2,
+            vec![Event::SnapshotBegin { uid_validity: 2 }],
+        ),
+        Batch::new(
+            "stage",
+            "mailbox-a",
+            3,
+            vec![Event::SnapshotMessage {
+                uid_validity: 2,
+                message: message(1, 0, "11111111111111111111111111111111"),
+            }],
+        ),
+    ] {
+        sqlite.apply(&batch).unwrap();
+    }
+    assert_eq!(staging_rows(&path, "mailbox-a"), 1);
+    sqlite
+        .apply(&Batch::new("delete", "mailbox-a", 4, vec![Event::Delete]))
+        .unwrap();
+    assert_eq!(staging_rows(&path, "mailbox-a"), 0);
+    drop(sqlite);
+    let _reopened = SqliteBaseline::open(&path).unwrap();
+    assert_eq!(staging_rows(&path, "mailbox-a"), 0);
+}
+
+#[test]
+fn repeated_same_id_delete_recreate_cleans_incomplete_and_failed_rescans() {
+    // Break caught: an abandoned staged row surviving multiple lifecycles under one stable ID.
+    let temporary = tempfile::tempdir().unwrap();
+    let path = temporary.path().join("mirror.sqlite");
+    let mut sqlite = SqliteBaseline::create(&path).unwrap();
+    for round in 0..2_u64 {
+        let epoch = round * 2 + 1;
+        sqlite
+            .apply(&create_mailbox(&format!("create-{round}"), epoch))
+            .unwrap();
+        sqlite
+            .apply(&Batch::new(
+                format!("begin-{round}"),
+                "mailbox-a",
+                2,
+                vec![Event::SnapshotBegin {
+                    uid_validity: epoch + 1,
+                }],
+            ))
+            .unwrap();
+        sqlite
+            .apply(&Batch::new(
+                format!("stage-{round}"),
+                "mailbox-a",
+                3,
+                vec![Event::SnapshotMessage {
+                    uid_validity: epoch + 1,
+                    message: message(round + 1, 0, &format!("{:032x}", round + 1)),
+                }],
+            ))
+            .unwrap();
+        let failed = Batch::new(
+            format!("failed-stage-{round}"),
+            "mailbox-a",
+            4,
+            vec![
+                Event::SnapshotMessage {
+                    uid_validity: epoch + 1,
+                    message: message(98, 0, "98989898989898989898989898989898"),
+                },
+                Event::SnapshotMessage {
+                    uid_validity: epoch + 2,
+                    message: message(99, 0, "99999999999999999999999999999999"),
+                },
+            ],
+        );
+        assert!(sqlite.apply(&failed).is_err());
+        assert_eq!(staging_rows(&path, "mailbox-a"), 1);
+        sqlite
+            .apply(&Batch::new(
+                format!("delete-{round}"),
+                "mailbox-a",
+                5,
+                vec![Event::Delete],
+            ))
+            .unwrap();
+        assert_eq!(staging_rows(&path, "mailbox-a"), 0);
+        drop(sqlite);
+        sqlite = SqliteBaseline::open(&path).unwrap();
+        assert_eq!(staging_rows(&path, "mailbox-a"), 0);
+    }
+}
diff --git a/developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/tests/sqlite_concurrency.rs b/developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/tests/sqlite_concurrency.rs
new file mode 100644
index 0000000..d71e1d4
--- /dev/null
+++ b/developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/tests/sqlite_concurrency.rs
@@ -0,0 +1,112 @@
+use std::sync::{Arc, Barrier};
+
+use mailbox_mirror_lab::{Batch, Event, Message, SqliteBaseline};
+
+fn epoch_message(epoch: u64, uid: u64) -> Message {
+    Message {
+        uid,
+        fingerprint: format!("{epoch:016x}{uid:016x}"),
+        internal_date: 1_700_000_000,
+        size: 512,
+        flags: u8::from(uid.is_multiple_of(2)),
+    }
+}
+
+#[test]
+fn eight_readers_never_observe_a_mixed_epoch_during_publication() {
+    // Break caught: composing one checkpoint from separate read snapshots around a writer commit.
+    let temporary = tempfile::tempdir().unwrap();
+    let path = temporary.path().join("mirror.sqlite");
+    let mut writer = SqliteBaseline::create(&path).unwrap();
+    writer
+        .apply(&Batch::new(
+            "create",
+            "mailbox-a",
+            1,
+            vec![Event::CreateMailbox {
+                display_name: "Inbox".to_owned(),
+                uid_validity: 1,
+            }],
+        ))
+        .unwrap();
+    writer
+        .apply(&Batch::new(
+            "initial",
+            "mailbox-a",
+            2,
+            (1..=20)
+                .map(|uid| Event::Add {
+                    uid_validity: 1,
+                    message: epoch_message(1, uid),
+                    cursor: 2,
+                })
+                .collect(),
+        ))
+        .unwrap();
+
+    let barrier = Arc::new(Barrier::new(9));
+    let selected: Vec<u64> = (1..=20).collect();
+    std::thread::scope(|scope| {
+        let mut readers = Vec::new();
+        for _ in 0..8 {
+            let path = path.clone();
+            let barrier = Arc::clone(&barrier);
+            let selected = selected.clone();
+            readers.push(scope.spawn(move || {
+                let reader = SqliteBaseline::open(&path).unwrap();
+                barrier.wait();
+                for _ in 0..80 {
+                    let checkpoint = reader.checkpoint("mailbox-a", &selected).unwrap();
+                    assert_eq!(checkpoint.total, 20);
+                    assert_eq!(checkpoint.selected.len(), 20);
+                    assert!(checkpoint.selected.iter().all(|message| {
+                        message
+                            .fingerprint
+                            .starts_with(&format!("{:016x}", checkpoint.uid_validity))
+                    }));
+                }
+            }));
+        }
+        barrier.wait();
+        for epoch in 2..=20_u64 {
+            let sequence = epoch * 3;
+            writer
+                .apply(&Batch::new(
+                    format!("begin-{epoch}"),
+                    "mailbox-a",
+                    sequence,
+                    vec![Event::SnapshotBegin {
+                        uid_validity: epoch,
+                    }],
+                ))
+                .unwrap();
+            writer
+                .apply(&Batch::new(
+                    format!("stage-{epoch}"),
+                    "mailbox-a",
+                    sequence + 1,
+                    (1..=20)
+                        .map(|uid| Event::SnapshotMessage {
+                            uid_validity: epoch,
+                            message: epoch_message(epoch, uid),
+                        })
+                        .collect(),
+                ))
+                .unwrap();
+            writer
+                .apply(&Batch::new(
+                    format!("commit-{epoch}"),
+                    "mailbox-a",
+                    sequence + 2,
+                    vec![Event::SnapshotCommit {
+                        uid_validity: epoch,
+                        cursor: sequence + 2,
+                    }],
+                ))
+                .unwrap();
+        }
+        for reader in readers {
+            reader.join().unwrap();
+        }
+    });
+}
diff --git a/developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/tests/transcript.rs b/developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/tests/transcript.rs
new file mode 100644
index 0000000..761f221
--- /dev/null
+++ b/developer-simulation/runs/2026-08-14--epoch-safe-mailbox-mirror/tests/transcript.rs
@@ -0,0 +1,138 @@
+use std::io::{BufReader, Cursor};
+
+use mailbox_mirror_lab::{
+    GeneratorConfig, SqliteBaseline, apply_transcript, generate_transcript, verify_transcript,
+};
+
+#[test]
+fn generated_transcript_is_deterministic_and_matches_both_models() {
+    // Break caught: generator map order, replay, or epoch handling causing model divergence.
+    let config = GeneratorConfig {
+        seed: 17,
+        mailboxes: 30,
+        live_messages: 300,
+        responses: 1_200,
+    };
+    let mut first = Vec::new();
+    let first_summary = generate_transcript(&config, &mut first).unwrap();
+    let mut second = Vec::new();
+    let second_summary = generate_transcript(&config, &mut second).unwrap();
+    let mut third = Vec::new();
+    let third_summary = generate_transcript(&config, &mut third).unwrap();
+    assert_eq!(first, second);
+    assert_eq!(second, third);
+    assert_eq!(first_summary, second_summary);
+    assert_eq!(second_summary, third_summary);
+    assert_eq!(first_summary.responses, 1_200);
+    assert_eq!(first_summary.duplicate_responses, 60);
+
+    let temporary = tempfile::tempdir().unwrap();
+    let database = temporary.path().join("mirror.sqlite");
+    let verification = verify_transcript(Cursor::new(first), &database).unwrap();
+    assert_eq!(verification.responses, 1_200);
+    assert_eq!(verification.duplicate_responses, 60);
+    assert_eq!(verification.manifest.live_messages(), 300);
+    assert!(verification.checkpoints >= 4);
+    assert_eq!(verification.disconnects, 1);
+}
+
+#[test]
+fn unterminated_batch_reports_only_mailbox_and_sequence_and_mutates_nothing() {
+    // Break caught: applying decoded responses before their batch terminator.
+    let transcript = br#"{"kind":"begin","batch_id":"b1","mailbox_id":"mailbox-a","sequence":9}
+{"kind":"response","event":{"type":"create_mailbox","display_name":"Secret display name","uid_validity":1}}
+"#;
+    let temporary = tempfile::tempdir().unwrap();
+    let database = temporary.path().join("mirror.sqlite");
+    let diagnostic = verify_transcript(Cursor::new(transcript), &database).unwrap_err();
+    assert_eq!(diagnostic.mailbox_id, "mailbox-a");
+    assert_eq!(diagnostic.sequence, 9);
+    assert_eq!(diagnostic.code, "missing_batch_terminator");
+    assert!(!diagnostic.to_string().contains("Secret"));
+
+    let sqlite = SqliteBaseline::open(&database).unwrap();
+    assert!(sqlite.checkpoint("mailbox-a", &[]).is_err());
+}
+
+#[test]
+fn applying_then_resuming_the_same_transcript_is_idempotent() {
+    // Break caught: resume forgetting durable batch IDs and applying complete batches twice.
+    let config = GeneratorConfig {
+        seed: 23,
+        mailboxes: 30,
+        live_messages: 300,
+        responses: 1_200,
+    };
+    let mut transcript = Vec::new();
+    generate_transcript(&config, &mut transcript).unwrap();
+    let temporary = tempfile::tempdir().unwrap();
+    let database = temporary.path().join("mirror.sqlite");
+
+    let first = apply_transcript(Cursor::new(&transcript), &database, false).unwrap();
+    let resumed = apply_transcript(Cursor::new(&transcript), &database, true).unwrap();
+    assert_eq!(first.manifest, resumed.manifest);
+    assert_eq!(first.manifest.live_messages(), 300);
+    assert!(resumed.duplicate_responses > first.duplicate_responses);
+}
+
+#[test]
+fn every_record_position_in_a_small_transcript_is_truncation_detected() {
+    // Break caught: accepting a transcript truncated cleanly between complete batches.
+    let records = [
+        r#"{"kind":"begin","batch_id":"b1","mailbox_id":"mailbox-a","sequence":1}"#,
+        r#"{"kind":"response","event":{"type":"create_mailbox","display_name":"Inbox","uid_validity":1}}"#,
+        r#"{"kind":"commit","batch_id":"b1"}"#,
+        r#"{"kind":"checkpoint","id":"cp","mailbox_id":"mailbox-a","selected_uids":[]}"#,
+        r#"{"kind":"end","responses":1,"records":5}"#,
+    ];
+    let complete = format!("{}\n", records.join("\n"));
+    let complete_directory = tempfile::tempdir().unwrap();
+    verify_transcript(
+        Cursor::new(complete.as_bytes()),
+        &complete_directory.path().join("mirror.sqlite"),
+    )
+    .unwrap();
+
+    for removed in 0..records.len() {
+        let truncated = records
+            .iter()
+            .enumerate()
+            .filter(|(index, _)| *index != removed)
+            .map(|(_, record)| *record)
+            .collect::<Vec<_>>()
+            .join("\n");
+        let directory = tempfile::tempdir().unwrap();
+        assert!(
+            verify_transcript(
+                Cursor::new(truncated.as_bytes()),
+                &directory.path().join("mirror.sqlite"),
+            )
+            .is_err(),
+            "removing record {removed} was accepted"
+        );
+    }
+}
+
+#[test]
+fn chunk_sizes_from_one_byte_to_one_mebibyte_produce_the_same_manifest() {
+    // Break caught: line framing depending on the underlying reader's chunk size.
+    let config = GeneratorConfig {
+        seed: 31,
+        mailboxes: 30,
+        live_messages: 300,
+        responses: 1_200,
+    };
+    let mut transcript = Vec::new();
+    generate_transcript(&config, &mut transcript).unwrap();
+    let mut canonical = None;
+    for capacity in [1, 7, 1_024, 1_048_576] {
+        let directory = tempfile::tempdir().unwrap();
+        let reader = BufReader::with_capacity(capacity, Cursor::new(&transcript));
+        let summary = verify_transcript(reader, &directory.path().join("mirror.sqlite")).unwrap();
+        if let Some(expected) = &canonical {
+            assert_eq!(&summary.manifest, expected);
+        } else {
+            canonical = Some(summary.manifest);
+        }
+    }
+}
diff --git a/developer-simulation/runs/2026-08-15--incremental-calculation-cache/BRIEF.md b/developer-simulation/runs/2026-08-15--incremental-calculation-cache/BRIEF.md
new file mode 100644
index 0000000..22c0cd2
--- /dev/null
+++ b/developer-simulation/runs/2026-08-15--incremental-calculation-cache/BRIEF.md
@@ -0,0 +1,118 @@
+# Trial 1 brief: Incremental calculation cache for a financial-planning desktop app
+
+## Developer role and Rust experience
+
+You maintain the document core of an established desktop financial-planning application.
+You have nine years of production C# experience and eight months of Rust experience.
+The calculation core is already Rust, called from the existing C# user interface.
+You are comfortable with ownership and tests but have not built a persistent incremental dataflow engine.
+
+## Existing system and baseline implementation
+
+Customers edit large `.planbook` documents used for budget and headcount planning.
+Each document has a checksummed append-only edit journal as its authoritative record.
+The journal assigns every accepted edit batch a strictly increasing 64-bit sequence number.
+Periodic calculated snapshots are disposable and may always be rebuilt from the journal.
+The current Rust baseline replays edits, builds an in-memory workbook, and fully recalculates every formula after each accepted batch.
+It is trusted because its exact scaled-integer arithmetic and error propagation have mature conformance tests.
+It is slow on large workbooks: an ordinary one-cell edit blocks the interface for 1.8 to 4.2 seconds.
+Do not replace the reference evaluator or change the journal format in this trial.
+
+## Concrete pain point
+
+Most edits affect a small dependency region, yet the baseline recalculates all 260,000 formulas.
+An earlier hand-built invalidation cache missed dependencies hidden inside large ranges.
+It also exposed values from two edit generations to concurrent export requests.
+The team wants to evaluate whether a data materialization toolkit can maintain a disposable calculated snapshot exactly and publish it atomically.
+A clean no-fit conclusion is preferable to weakening workbook semantics.
+
+## Workload and data shape
+
+Use one deterministic synthetic workbook with exactly 1,000,000 populated cells across 160 worksheets.
+Exactly 740,000 cells are literals and exactly 260,000 cells are formulas.
+Formula expansion yields 2,400,000 directed dependency edges.
+The formulas contain direct references, rectangular ranges, arithmetic, comparisons, `IF`, `SUM`, `MIN`, and `MAX`.
+All numeric values are signed 128-bit integers representing millionths; floating-point arithmetic is absent.
+The fixture includes 12,000 range aggregates, 400 intentional dependency cycles, and 2,000 stable arithmetic or missing-reference errors.
+Cycle membership and error values are part of the expected calculated state.
+Replay one trace of exactly 10,000 accepted edit batches.
+Exactly 7,000 batches change one to five literal cells.
+Exactly 2,000 batches replace one formula with another valid formula.
+Exactly 1,000 batches insert or delete a row and apply the existing reference-rewrite rules.
+The three batch classes therefore sum to all 10,000 accepted batches.
+The trace never deletes a worksheet and never exceeds the stated one-million-cell fixture size by more than 2 percent.
+
+## Operational constraints
+
+The authoritative journal remains byte-for-byte unchanged.
+The candidate state must live in one local data directory and require no service or network access.
+The target machine has four CPU cores and 2 GiB of memory available to the process.
+The candidate's on-disk calculated state must remain at or below 600 MiB.
+Initial construction from the complete journal must finish within 90 seconds.
+Reopen from a valid calculated snapshot must finish within 8 seconds.
+The application has one edit writer and twelve concurrent read-only callers for visible cells, exports, and totals.
+Every read request must observe one complete accepted generation.
+No caller may observe a mixture of sequence numbers within one response.
+
+## Compact prototype boundary
+
+Build a command-line prototype around the existing reference evaluator and supplied deterministic fixture generator.
+Implement only ingestion of the canonical journal records, dependency maintenance, recalculation, snapshot publication, point reads, and rectangular-range reads.
+Retain the reference evaluator as the oracle and benchmark baseline.
+It is acceptable to write a small adapter between journal records and candidate-toolkit records.
+Exercise one process and one local directory; do not add a server.
+Run the writer and twelve reader tasks in the same process for concurrency tests.
+Produce a machine-readable result manifest containing generation, timings, sizes, and pass or fail gates.
+Keep the prototype small enough to discard if the evaluation is negative.
+
+## Measurable acceptance criteria
+
+After every one of the 10,000 batches, calculated values and stable errors must exactly equal the full reference evaluator.
+The final calculated snapshot must be byte-identical across five clean builds.
+The final snapshot must also be byte-identical when the journal is fed in chunk sizes of 1, 7, 64, 511, and 4,096 records.
+For the 9,000 non-structural batches, recalculation latency must have p95 at or below 25 milliseconds and p99 at or below 75 milliseconds.
+For the 1,000 structural batches, latency must have p95 at or below 2 seconds.
+Initial construction, reopen time, memory, and disk usage must meet every stated operational limit.
+During a 30-minute mixed writer-reader run, all twelve readers must return a self-consistent generation on every request.
+The test harness must complete at least 1,000,000 read requests in that run with zero mixed-generation responses.
+Invalid journal records must leave the last accepted generation and its calculated values unchanged.
+A candidate that misses any equality, crash, or generation-consistency gate is not a fit regardless of speed.
+
+## Failure and crash cases
+
+Test a bad checksum, duplicate sequence, skipped sequence, truncated record, unknown formula opcode, and integer overflow.
+Reject each bad record before it changes the published generation.
+Inject 200 real process exits at deterministic points spanning journal append, candidate update, checkpoint creation, and generation publication.
+After every restart, replay the authoritative journal and compare the visible generation with the reference evaluator.
+No acknowledged journal batch may be missing after restart.
+No unacknowledged or partial batch may become visible.
+A corrupt calculated snapshot must trigger a rebuild from the journal rather than corrupt the journal or return guessed values.
+Disk-full injection during checkpoint creation must preserve the prior readable generation.
+
+## Concurrency, privacy, and determinism cases
+
+Run readers continuously while formula and structural batches publish new generations.
+Include ranges whose cells span both changed and unchanged dependency regions.
+Use deterministic tie ordering for cycle reports: worksheet ID, row, then column.
+Run all equality checks under one thread and four worker threads.
+Thread count must not change any calculated value, error, cycle membership, or serialized byte.
+Fixture values are synthetic, but treat them as confidential salary-plan data.
+Logs and error messages may contain sheet IDs, cell coordinates, sequence numbers, and error codes.
+Logs and error messages must not contain literal cell values, formula text, or workbook titles.
+The prototype must make no outbound network request.
+
+## Explicit non-goals
+
+Do not implement the user interface, collaboration, cloud sync, permissions, or file-format conversion.
+Do not add new formula functions, volatile time or random functions, macros, external workbook links, or floating-point compatibility.
+Do not optimize initial journal durability or redefine when an edit is acknowledged.
+Do not replace the authoritative journal with candidate state.
+Do not claim compatibility with arbitrary spreadsheets outside the declared formula subset.
+Do not turn the prototype into a general reactive programming framework.
+
+## Decision rule
+
+Recommend continued evaluation only if every exactness, failure, privacy, concurrency, and determinism gate passes.
+Report performance separately for literal, formula, and structural batches.
+If correctness passes but targets do not, report local correctness proof only.
+If the toolkit requires authority over the edit journal or cannot publish generation-consistent reads, report no fit.
diff --git a/developer-simulation/runs/2026-08-15--incremental-calculation-cache/Cargo.toml b/developer-simulation/runs/2026-08-15--incremental-calculation-cache/Cargo.toml
new file mode 100644
index 0000000..8915f29
--- /dev/null
+++ b/developer-simulation/runs/2026-08-15--incremental-calculation-cache/Cargo.toml
@@ -0,0 +1,17 @@
+[package]
+name = "financial-snapshot-trial"
+version = "0.1.0"
+edition = "2024"
+publish = false
+
+[dependencies]
+fold = { path = "../../../fold" }
+serde = { version = "1", features = ["derive"] }
+serde_json = "1"
+
+[lints.rust]
+warnings = "deny"
+
+[lints.clippy]
+all = "deny"
+pedantic = "deny"
diff --git a/developer-simulation/runs/2026-08-15--incremental-calculation-cache/DISCOVERY.md b/developer-simulation/runs/2026-08-15--incremental-calculation-cache/DISCOVERY.md
new file mode 100644
index 0000000..c8b2c92
--- /dev/null
+++ b/developer-simulation/runs/2026-08-15--incremental-calculation-cache/DISCOVERY.md
@@ -0,0 +1,62 @@
+# Discovery and debugging trail
+
+## 2026-08-15 — Baseline-first hypothesis (before internals)
+
+The public README and examples suggest that **Fold is the only plausible candidate** for this trial. Its public API shows durable materialized views, transactional writes, retractions, keyed replacement, and one read transaction spanning several views. Those properties may fit a disposable calculated snapshot and generation-consistent reads.
+
+The main uncertainty is deeper than simple aggregation. The workbook needs a dynamic dependency graph, range-derived dependencies, deterministic cycle/error state, formula replacement, and row edits that rewrite references. The examples demonstrate incremental count/table/search maintenance, but not graph reachability, topological recalculation, cycle handling, or atomic publication of a large externally evaluated state. I expect a small adapter may be able to publish an already-computed generation atomically, but I do not yet have evidence that Fold itself can perform the workbook dependency/recalculation work efficiently or safely.
+
+ESE and ANNy appear unrelated: ESE produces text embeddings and ANNy provides approximate nearest-neighbor search. Financial formulas need exact signed 128-bit values and exact dependency semantics; approximation or embedding would be a correctness failure. I therefore expect both to be no-fit unless later evidence reveals an exact non-search facility.
+
+### Baseline plan and falsifiable questions
+
+1. Run the smallest public Fold example unchanged to establish that the detached baseline builds and that insert/retract plus consistent reads actually work here.
+2. Inspect only the Fold surfaces needed to answer: can a single transaction atomically update a generation marker and calculated cells, can a rejected input leave both untouched, and can reopening recover that accepted state?
+3. Write acceptance tests first for a deliberately tiny reference evaluator and journal subset. The critical break each test must catch is mixed publication (new generation with old values or vice versa), acceptance of an invalid sequence/checksum/overflow, nondeterministic serialization, or failure to reopen the last accepted state.
+4. If the public API cannot support those properties without taking ownership of the authoritative journal, retain the smallest exact failure reproducer and conclude no-fit.
+
+### Claims explicitly out of scope for the compact run
+
+The brief's million-cell/10,000-batch workload, 30-minute/1,000,000-read concurrency run, 200 real process exits, 2 GiB memory cap, disk-full injection, and production percentile targets cannot honestly be established by a small time-bounded trial unless fully executed. Any smaller run will be labeled local functional evidence only and will not be used to recommend continued evaluation under the brief's all-gates decision rule.
+
+## Baseline observation
+
+`cargo run --locked -p starter` did not reach the public demo. Although the starter source uses only Fold, its manifest declares ANNy and ESE too. Cargo therefore ran ESE's build script, which attempted to download a model and failed at DNS resolution. This is meaningful baseline failure evidence for the trial's no-network constraint: the advertised smallest example is not offline-buildable from this sanitized checkout as declared. No network request succeeded, and no application was run. The trial integration should depend only on Fold so it does not activate ESE or ANNy.
+
+## Internals and test-first checkpoint
+
+The minimal relevant internals confirm that a Fold write transaction commits its sinks together, a read transaction pins one database snapshot, a `KeyedStream` retracts a replaced row before inserting its replacement, and the table sink supports point reads plus ordered iteration. They also show an API boundary: `Stream::wtx` needs exclusive mutable access while `Stream::rtx` borrows the same stream. There is no public clonable read handle in the inspected surface, so simultaneous application threads cannot directly hold independent Fold read transactions while a writer uses the stream. The public chat example works around this by publishing cloned snapshots through a watch channel.
+
+Acceptance tests were written before behavior. The first compile correctly failed because the trial library did not exist. After adding only API-shaped placeholders, the focused test produced meaningful RED: `range_dependency_recalculates_and_publishes_one_generation` panicked at the explicit unimplemented bootstrap path. The next step is the smallest real evaluator, dependency invalidation adapter, Fold-backed atomic persistence, and in-process publication needed to make that contract green.
+
+The first implementation run reached real behavior and failed only on the test's ordering assumption. The implementation returned cells in the brief's required worksheet/row/column order (`B1`, `C1`, then `A2`); the test had incorrectly put the directly edited `A2` first. I corrected the hand-written expectation to the declared deterministic coordinate ordering rather than changing the implementation.
+
+The first full acceptance run passed six of nine tests and exposed two implementation/fixture issues. The evaluator accidentally published a synthetic value for a referenced-but-nonexistent cell in addition to the real formula's missing-reference error; publication is now restricted to populated workbook cells. Separately, the formula-replacement fixture used a threshold that made the expected branch unreachable; the deterministic fixture threshold was corrected so the hand-computed expected value exercises dependency rewiring and conditional arithmetic.
+
+## Green integration and decision trail
+
+The retained prototype now passes its bounded tests: exact hand-derived values for range invalidation and formula replacement, deterministic cycle/missing-reference ordering, point and rectangular reads, reopen, validation-before-publication, five logical clean builds, the five requested input chunk groupings, and 24,000 reads across twelve tasks with no mixed-generation response. The concurrency result belongs to the adapter's cloned immutable snapshot plus `RwLock`, not to a clonable Fold database reader.
+
+The release demonstration also made the evidence boundary concrete. A three-batch seven-cell store reopened in milliseconds and occupied only a few kilobytes after close, while the live 100-batch concurrency store occupied roughly 64 MiB. That is useful measured local evidence, but neither figure predicts a million-cell, 10,000-batch store. The manifest separately labels the production-scale gates `NotRun`.
+
+Repository search found no `.planbook` evaluator or declared million-cell fixture generator outside `BRIEF.md`. The compact prototype therefore uses a deliberately tiny independent evaluator rather than claiming equivalence to the unavailable production oracle.
+
+Decision: **no fit for the full brief as currently evidenced**. Fold is useful as a transactional persistence primitive, but the public/internally documented surface inspected here does not supply workbook dependency maintenance, structural reference rewrites, direct concurrent reader handles, or the full crash/recovery harness. The external adapter implements only enough to prove a narrow publication pattern; the mandatory large-scale correctness, structural, crash, disk-full, memory, disk, and long concurrency gates remain unrun. Under the brief's all-gates rule, local success cannot justify continued evaluation. ESE and ANNy remain clear no-fit components for exact financial calculation.
+
+## Fix round 1 — skeptical-review lifecycle corrections
+
+The skeptical reviewer reproduced three archive-evidence defects:
+
+1. a second `bootstrap()` rewound generation 1 to generation 0 and reopened the sequence-1 gate;
+2. `Trial::open` on used calculated state returned a fresh in-memory view instead of rejecting; and
+3. read-back `reopen` restored calculated cells but not formula/literal definitions, so the next batch after a formula replacement diverged from uninterrupted execution.
+
+I wrote three permanent regressions before changing the lifecycle. The first run produced the expected RED evidence: repeated bootstrap returned success, open-on-existing returned success, and close/reopen/continue produced different generation-3 values from uninterrupted execution.
+
+The lifecycle is now explicit and one-way. `open` accepts only unused calculated state; `bootstrap` accepts only a fresh instance. `recover_from_journal` is the only restart-to-writable path. It replays the complete caller-owned accepted journal prefix into the initial workbook without publishing, evaluates that reconstructed workbook, and requires exact equality with the persisted calculated snapshot before enabling the next write. Repeated initialization and recovery mismatch return errors without a Fold publication transaction.
+
+The repaired regressions are GREEN. The continuation case applies a literal edit, replaces a range formula, closes the store, recovers from those two authoritative records, applies sequence 3, and compares the complete snapshot and canonical logical bytes with uninterrupted execution.
+
+The demo's previous `reopen_gate` meant read-back only and was too broad. It is replaced by `recovery_continuation_gate`; the measured `recovery_replay_microseconds` covers journal replay plus validation before the next write, while the gate itself passes only after that next write matches uninterrupted execution.
+
+Execution-path clarification: affected-region discovery is computed and checked, but it does not bound work. Every accepted batch still fully evaluates the entire fixture and republishes every calculated cell through Fold. This remains a narrow atomic-publication proof, not incremental recalculation evidence, and the no-fit decision is unchanged.
diff --git a/developer-simulation/runs/2026-08-15--incremental-calculation-cache/README.md b/developer-simulation/runs/2026-08-15--incremental-calculation-cache/README.md
new file mode 100644
index 0000000..3c2b9ee
--- /dev/null
+++ b/developer-simulation/runs/2026-08-15--incremental-calculation-cache/README.md
@@ -0,0 +1,70 @@
+# Incremental calculation cache trial
+
+This package is the retained, discardable prototype for the 2026-08-15 BogKit developer simulation. Its decision is **no fit for the full financial-planning brief**.
+
+The bounded proof uses Fold to persist a generation marker and calculated cells atomically. It also checks range-dependency discovery, exact `i128` arithmetic, deterministic error ordering, journal validation, one-way initialization, authoritative-journal recovery, and immutable application-level snapshot publication.
+
+Important execution limit: the adapter computes an affected-cell list, but it still fully evaluates the entire tiny workbook and republishes every calculated cell after each accepted batch. It is not an incremental recalculation performance proof.
+
+## Exact offline verification
+
+Run these commands from the repository root. Build and runtime state stays outside the package.
+
+```sh
+mkdir -p /private/tmp/financial-snapshot-runtime
+
+CARGO_TARGET_DIR=/private/tmp/financial-snapshot-target \
+TMPDIR=/private/tmp/financial-snapshot-runtime \
+cargo test --offline --locked --manifest-path developer-simulation/Cargo.toml \
+  --package financial-snapshot-trial --all-targets
+
+CARGO_TARGET_DIR=/private/tmp/financial-snapshot-target \
+TMPDIR=/private/tmp/financial-snapshot-runtime \
+cargo clippy --offline --locked --manifest-path developer-simulation/Cargo.toml \
+  --package financial-snapshot-trial --all-targets -- \
+  -D warnings -D clippy::all -D clippy::pedantic
+
+cargo fmt --check --manifest-path developer-simulation/Cargo.toml \
+  --package financial-snapshot-trial
+```
+
+These commands use the single archived workspace and lockfile.
+
+## Runnable release demonstration
+
+```sh
+CARGO_TARGET_DIR=/private/tmp/financial-snapshot-target \
+TMPDIR=/private/tmp/financial-snapshot-runtime \
+cargo run --offline --locked --release \
+  --manifest-path developer-simulation/Cargo.toml \
+  --package financial-snapshot-trial --bin financial-snapshot-trial -- \
+  /private/tmp/financial-snapshot-data \
+  /private/tmp/financial-snapshot-result.json
+```
+
+The demo removes `/private/tmp/financial-snapshot-data` itself. After verification, remove the remaining external build/runtime state:
+
+```sh
+rm -rf /private/tmp/financial-snapshot-target \
+  /private/tmp/financial-snapshot-runtime \
+  /private/tmp/financial-snapshot-result.json
+```
+
+## Valid lifecycle
+
+1. `Trial::open` is only for an unused calculated-state directory.
+2. `bootstrap` may run exactly once.
+3. Accepted encoded records remain in the caller-owned authoritative journal.
+4. After a process restart, call `Trial::recover_from_journal` with the original workbook and the complete accepted journal prefix. Replay occurs without publication and must exactly equal the persisted calculated snapshot before writes are enabled.
+5. Continue with the next strictly increasing journal sequence.
+
+Repeated initialization, opening an already-used store as new, incomplete replay, mismatched replay, malformed records, and out-of-order sequences are rejected without replacing the last persisted snapshot.
+
+## Evidence limits
+
+The retained fixture has seven cells and three accepted batches. Its recovery-continuation regression includes a formula replacement and compares uninterrupted execution with close/recover/continue. The demo runs twelve reader tasks and 24,000 requests.
+
+The production evaluator, million-cell fixture, 10,000-batch trace, structural row edits, raw database-byte determinism, one/four-worker comparison, 200 process exits, corrupt-snapshot rebuild, disk-full injection, 30-minute concurrency run, one-million-read run, memory cap, and production performance gates were not available or not run. Logical canonical bytes—not raw Fold database bytes—are compared. Concurrent application reads use an adapter-owned immutable snapshot, not a directly clonable Fold reader.
+
+See [`DISCOVERY.md`](DISCOVERY.md), [`result-manifest.json`](result-manifest.json),
+and the [daily report](../../reports/2026-08-15.md) for the complete decision audit.
diff --git a/developer-simulation/runs/2026-08-15--incremental-calculation-cache/result-manifest.json b/developer-simulation/runs/2026-08-15--incremental-calculation-cache/result-manifest.json
new file mode 100644
index 0000000..66b9efd
--- /dev/null
+++ b/developer-simulation/runs/2026-08-15--incremental-calculation-cache/result-manifest.json
@@ -0,0 +1,30 @@
+{
+  "fixture_populated_cells": 7,
+  "fixture_literal_cells": 2,
+  "fixture_formula_cells": 5,
+  "accepted_batches": 3,
+  "clean_builds": 5,
+  "chunk_sizes": [
+    1,
+    7,
+    64,
+    511,
+    4096
+  ],
+  "local_exactness": "Pass",
+  "local_determinism": "Pass",
+  "invalid_record_gate": "Pass",
+  "one_way_initialization_gate": "Pass",
+  "recovery_continuation_gate": "Pass",
+  "reader_tasks": 12,
+  "read_requests": 24000,
+  "mixed_generation_responses": 0,
+  "initial_build_microseconds": 172,
+  "batch_p95_microseconds": 31,
+  "batch_p99_microseconds": 31,
+  "recovery_replay_microseconds": 7191,
+  "observed_single_store_disk_bytes": 7570,
+  "observed_100_batch_store_disk_bytes": 67115339,
+  "observed_total_test_disk_bytes": 872513501,
+  "production_scale_gates": "NotRun"
+}
diff --git a/developer-simulation/runs/2026-08-15--incremental-calculation-cache/src/lib.rs b/developer-simulation/runs/2026-08-15--incremental-calculation-cache/src/lib.rs
new file mode 100644
index 0000000..95ef2b8
--- /dev/null
+++ b/developer-simulation/runs/2026-08-15--incremental-calculation-cache/src/lib.rs
@@ -0,0 +1,1139 @@
+//! Compact, discardable adapter for evaluating Fold as a calculated-snapshot publisher.
+
+use std::collections::{BTreeMap, BTreeSet, VecDeque};
+use std::fmt::Write as _;
+use std::path::Path;
+use std::sync::{Arc, RwLock};
+use std::time::Instant;
+
+use fold::pipeline::terminal;
+use fold::stream::KeyedStream;
+use serde::{Deserialize, Serialize};
+
+#[derive(Clone, Copy, Debug, Deserialize, Eq, Ord, PartialEq, PartialOrd, Serialize)]
+pub struct Cell {
+    sheet: u16,
+    row: u32,
+    column: u32,
+}
+
+impl Cell {
+    #[must_use]
+    pub const fn new(sheet: u16, row: u32, column: u32) -> Self {
+        Self { sheet, row, column }
+    }
+}
+
+#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
+pub enum CellValue {
+    Number(i128),
+    Error(ErrorCode),
+}
+
+#[derive(Clone, Copy, Debug, Deserialize, Eq, PartialEq, Serialize)]
+pub enum ErrorCode {
+    Cycle,
+    MissingReference,
+    Overflow,
+}
+
+impl ErrorCode {
+    const fn label(self) -> &'static str {
+        match self {
+            Self::Cycle => "CYCLE",
+            Self::MissingReference => "MISSING_REFERENCE",
+            Self::Overflow => "OVERFLOW",
+        }
+    }
+}
+
+#[derive(Clone, Copy, Debug, Deserialize, Eq, PartialEq, Serialize)]
+pub struct Range {
+    start: Cell,
+    end: Cell,
+}
+
+impl Range {
+    #[must_use]
+    pub const fn new(start: Cell, end: Cell) -> Self {
+        Self { start, end }
+    }
+
+    fn cells(self) -> Vec<Cell> {
+        if self.start.sheet != self.end.sheet {
+            return Vec::new();
+        }
+        let mut cells = Vec::new();
+        for row in self.start.row.min(self.end.row)..=self.start.row.max(self.end.row) {
+            for column in
+                self.start.column.min(self.end.column)..=self.start.column.max(self.end.column)
+            {
+                cells.push(Cell::new(self.start.sheet, row, column));
+            }
+        }
+        cells
+    }
+}
+
+#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
+pub enum Formula {
+    Sum(Range),
+    Reference(Cell),
+    Add(Cell, Cell),
+    IfGreaterThenAdd {
+        condition: Cell,
+        threshold: i128,
+        left: Cell,
+        right: Cell,
+    },
+}
+
+impl Formula {
+    fn dependencies(&self) -> Vec<Cell> {
+        match self {
+            Self::Sum(range) => range.cells(),
+            Self::Reference(cell) => vec![*cell],
+            Self::Add(left, right) => vec![*left, *right],
+            Self::IfGreaterThenAdd {
+                condition,
+                left,
+                right,
+                ..
+            } => vec![*condition, *left, *right],
+        }
+    }
+}
+
+#[derive(Clone, Debug, Eq, PartialEq)]
+pub enum Edit {
+    SetLiteral(Cell, i128),
+    AdjustLiteral(Cell, i128),
+    SetFormula(Cell, Formula),
+}
+
+#[derive(Clone, Debug, Eq, PartialEq)]
+pub struct Batch {
+    sequence: u64,
+    edits: Vec<Edit>,
+}
+
+impl Batch {
+    #[must_use]
+    pub fn new(sequence: u64, edits: Vec<Edit>) -> Self {
+        Self { sequence, edits }
+    }
+
+    #[must_use]
+    /// Encodes the batch in the compact deterministic trial wire format.
+    ///
+    /// # Panics
+    ///
+    /// Panics if the record or edit count exceeds the wire format's `u32` limits.
+    pub fn encode(&self) -> Vec<u8> {
+        let mut bytes = Vec::new();
+        bytes.extend_from_slice(b"PBK1");
+        bytes.extend_from_slice(&0_u32.to_le_bytes());
+        bytes.extend_from_slice(&self.sequence.to_le_bytes());
+        bytes.extend_from_slice(
+            &u32::try_from(self.edits.len())
+                .expect("edit count fits in the wire format")
+                .to_le_bytes(),
+        );
+        for edit in &self.edits {
+            encode_edit(&mut bytes, edit);
+        }
+        let total_len = u32::try_from(bytes.len() + 8).expect("record length fits in u32");
+        bytes[4..8].copy_from_slice(&total_len.to_le_bytes());
+        bytes.extend_from_slice(&checksum(&bytes).to_le_bytes());
+        bytes
+    }
+
+    fn decode(bytes: &[u8]) -> Result<Self, Reject> {
+        const HEADER_AND_CHECKSUM: usize = 28;
+        if bytes.len() < HEADER_AND_CHECKSUM || bytes.get(..4) != Some(b"PBK1") {
+            return Err(Reject::TruncatedRecord);
+        }
+        let declared = u32::from_le_bytes(bytes[4..8].try_into().expect("fixed width"));
+        if usize::try_from(declared).expect("u32 fits usize") != bytes.len() {
+            return Err(Reject::TruncatedRecord);
+        }
+        let payload_end = bytes.len() - 8;
+        let expected_checksum = u64::from_le_bytes(
+            bytes[payload_end..]
+                .try_into()
+                .expect("checksum has fixed width"),
+        );
+        if checksum(&bytes[..payload_end]) != expected_checksum {
+            return Err(Reject::BadChecksum);
+        }
+
+        let sequence = u64::from_le_bytes(bytes[8..16].try_into().expect("fixed width"));
+        let count = u32::from_le_bytes(bytes[16..20].try_into().expect("fixed width"));
+        let mut cursor = Cursor::new(&bytes[20..payload_end]);
+        let mut edits = Vec::with_capacity(usize::try_from(count).expect("u32 fits usize"));
+        for _ in 0..count {
+            edits.push(decode_edit(&mut cursor)?);
+        }
+        if !cursor.is_empty() {
+            return Err(Reject::TrailingBytes);
+        }
+        Ok(Self { sequence, edits })
+    }
+}
+
+fn checksum(bytes: &[u8]) -> u64 {
+    bytes.iter().fold(0xcbf2_9ce4_8422_2325_u64, |hash, byte| {
+        (hash ^ u64::from(*byte)).wrapping_mul(0x0000_0100_0000_01b3)
+    })
+}
+
+fn encode_cell(bytes: &mut Vec<u8>, cell: Cell) {
+    bytes.extend_from_slice(&cell.sheet.to_le_bytes());
+    bytes.extend_from_slice(&cell.row.to_le_bytes());
+    bytes.extend_from_slice(&cell.column.to_le_bytes());
+}
+
+fn encode_formula(bytes: &mut Vec<u8>, formula: &Formula) {
+    match formula {
+        Formula::Sum(range) => {
+            bytes.push(10);
+            encode_cell(bytes, range.start);
+            encode_cell(bytes, range.end);
+        }
+        Formula::Reference(cell) => {
+            bytes.push(11);
+            encode_cell(bytes, *cell);
+        }
+        Formula::Add(left, right) => {
+            bytes.push(12);
+            encode_cell(bytes, *left);
+            encode_cell(bytes, *right);
+        }
+        Formula::IfGreaterThenAdd {
+            condition,
+            threshold,
+            left,
+            right,
+        } => {
+            bytes.push(13);
+            encode_cell(bytes, *condition);
+            bytes.extend_from_slice(&threshold.to_le_bytes());
+            encode_cell(bytes, *left);
+            encode_cell(bytes, *right);
+        }
+    }
+}
+
+fn encode_edit(bytes: &mut Vec<u8>, edit: &Edit) {
+    match edit {
+        Edit::SetLiteral(cell, value) => {
+            bytes.push(1);
+            encode_cell(bytes, *cell);
+            bytes.extend_from_slice(&value.to_le_bytes());
+        }
+        Edit::AdjustLiteral(cell, delta) => {
+            bytes.push(2);
+            encode_cell(bytes, *cell);
+            bytes.extend_from_slice(&delta.to_le_bytes());
+        }
+        Edit::SetFormula(cell, formula) => {
+            bytes.push(3);
+            encode_cell(bytes, *cell);
+            encode_formula(bytes, formula);
+        }
+    }
+}
+
+struct Cursor<'a> {
+    remaining: &'a [u8],
+}
+
+impl<'a> Cursor<'a> {
+    const fn new(bytes: &'a [u8]) -> Self {
+        Self { remaining: bytes }
+    }
+
+    const fn is_empty(&self) -> bool {
+        self.remaining.is_empty()
+    }
+
+    fn take<const N: usize>(&mut self) -> Result<[u8; N], Reject> {
+        let Some((head, tail)) = self.remaining.split_at_checked(N) else {
+            return Err(Reject::TruncatedRecord);
+        };
+        self.remaining = tail;
+        Ok(head.try_into().expect("slice has requested width"))
+    }
+
+    fn byte(&mut self) -> Result<u8, Reject> {
+        Ok(self.take::<1>()?[0])
+    }
+
+    fn cell(&mut self) -> Result<Cell, Reject> {
+        Ok(Cell::new(
+            u16::from_le_bytes(self.take()?),
+            u32::from_le_bytes(self.take()?),
+            u32::from_le_bytes(self.take()?),
+        ))
+    }
+
+    fn integer(&mut self) -> Result<i128, Reject> {
+        Ok(i128::from_le_bytes(self.take()?))
+    }
+}
+
+fn decode_formula(cursor: &mut Cursor<'_>) -> Result<Formula, Reject> {
+    match cursor.byte()? {
+        10 => Ok(Formula::Sum(Range::new(cursor.cell()?, cursor.cell()?))),
+        11 => Ok(Formula::Reference(cursor.cell()?)),
+        12 => Ok(Formula::Add(cursor.cell()?, cursor.cell()?)),
+        13 => Ok(Formula::IfGreaterThenAdd {
+            condition: cursor.cell()?,
+            threshold: cursor.integer()?,
+            left: cursor.cell()?,
+            right: cursor.cell()?,
+        }),
+        opcode => Err(Reject::UnknownFormulaOpcode(opcode)),
+    }
+}
+
+fn decode_edit(cursor: &mut Cursor<'_>) -> Result<Edit, Reject> {
+    match cursor.byte()? {
+        1 => Ok(Edit::SetLiteral(cursor.cell()?, cursor.integer()?)),
+        2 => Ok(Edit::AdjustLiteral(cursor.cell()?, cursor.integer()?)),
+        3 => Ok(Edit::SetFormula(cursor.cell()?, decode_formula(cursor)?)),
+        opcode => Err(Reject::UnknownEditOpcode(opcode)),
+    }
+}
+
+#[derive(Clone, Debug, Eq, PartialEq)]
+enum CellDefinition {
+    Literal(i128),
+    Formula(Formula),
+}
+
+#[derive(Clone, Debug, Default, Eq, PartialEq)]
+pub struct Workbook {
+    definitions: BTreeMap<Cell, CellDefinition>,
+}
+
+impl Workbook {
+    #[must_use]
+    pub fn deterministic_fixture() -> Self {
+        let mut definitions = BTreeMap::new();
+        let a1 = Cell::new(0, 0, 0);
+        let a2 = Cell::new(0, 1, 0);
+        let b1 = Cell::new(0, 0, 1);
+        let c1 = Cell::new(0, 0, 2);
+        definitions.insert(a1, CellDefinition::Literal(10));
+        definitions.insert(a2, CellDefinition::Literal(20));
+        definitions.insert(
+            b1,
+            CellDefinition::Formula(Formula::Sum(Range::new(a1, a2))),
+        );
+        definitions.insert(
+            c1,
+            CellDefinition::Formula(Formula::IfGreaterThenAdd {
+                condition: b1,
+                threshold: 15,
+                left: b1,
+                right: a1,
+            }),
+        );
+        let cycle_a = Cell::new(1, 0, 0);
+        let cycle_b = Cell::new(1, 0, 1);
+        definitions.insert(
+            cycle_a,
+            CellDefinition::Formula(Formula::Reference(cycle_b)),
+        );
+        definitions.insert(
+            cycle_b,
+            CellDefinition::Formula(Formula::Reference(cycle_a)),
+        );
+        definitions.insert(
+            Cell::new(1, 1, 0),
+            CellDefinition::Formula(Formula::Reference(Cell::new(99, 0, 0))),
+        );
+        Self { definitions }
+    }
+
+    pub fn set_literal(&mut self, cell: Cell, value: i128) {
+        self.definitions
+            .insert(cell, CellDefinition::Literal(value));
+    }
+
+    fn apply_edits(&mut self, edits: &[Edit]) -> Result<BTreeSet<Cell>, Reject> {
+        let mut changed = BTreeSet::new();
+        for edit in edits {
+            match edit {
+                Edit::SetLiteral(cell, value) => {
+                    self.definitions
+                        .insert(*cell, CellDefinition::Literal(*value));
+                    changed.insert(*cell);
+                }
+                Edit::AdjustLiteral(cell, delta) => {
+                    let Some(CellDefinition::Literal(value)) = self.definitions.get_mut(cell)
+                    else {
+                        return Err(Reject::NotALiteral(*cell));
+                    };
+                    *value = value.checked_add(*delta).ok_or(Reject::IntegerOverflow)?;
+                    changed.insert(*cell);
+                }
+                Edit::SetFormula(cell, formula) => {
+                    self.definitions
+                        .insert(*cell, CellDefinition::Formula(formula.clone()));
+                    changed.insert(*cell);
+                }
+            }
+        }
+        Ok(changed)
+    }
+
+    fn reverse_dependencies(&self) -> BTreeMap<Cell, BTreeSet<Cell>> {
+        let mut reverse = BTreeMap::<Cell, BTreeSet<Cell>>::new();
+        for (dependent, definition) in &self.definitions {
+            if let CellDefinition::Formula(formula) = definition {
+                for dependency in formula.dependencies() {
+                    reverse.entry(dependency).or_default().insert(*dependent);
+                }
+            }
+        }
+        reverse
+    }
+
+    fn affected(&self, changed: &BTreeSet<Cell>) -> Vec<Cell> {
+        let reverse = self.reverse_dependencies();
+        let mut affected = changed.clone();
+        let mut queue = changed.iter().copied().collect::<VecDeque<_>>();
+        while let Some(cell) = queue.pop_front() {
+            if let Some(dependents) = reverse.get(&cell) {
+                for dependent in dependents {
+                    if affected.insert(*dependent) {
+                        queue.push_back(*dependent);
+                    }
+                }
+            }
+        }
+        affected
+            .into_iter()
+            .filter(|cell| self.definitions.contains_key(cell))
+            .collect()
+    }
+
+    fn evaluate(&self) -> BTreeMap<Cell, CellValue> {
+        let mut memo = BTreeMap::new();
+        for cell in self.definitions.keys() {
+            let mut visiting = BTreeSet::new();
+            let value = self.evaluate_cell(*cell, &mut memo, &mut visiting);
+            memo.insert(*cell, value);
+        }
+        memo.retain(|cell, _| self.definitions.contains_key(cell));
+        memo
+    }
+
+    fn evaluate_cell(
+        &self,
+        cell: Cell,
+        memo: &mut BTreeMap<Cell, CellValue>,
+        visiting: &mut BTreeSet<Cell>,
+    ) -> CellValue {
+        if let Some(value) = memo.get(&cell) {
+            return value.clone();
+        }
+        if !visiting.insert(cell) {
+            return CellValue::Error(ErrorCode::Cycle);
+        }
+        let value = match self.definitions.get(&cell) {
+            None => CellValue::Error(ErrorCode::MissingReference),
+            Some(CellDefinition::Literal(value)) => CellValue::Number(*value),
+            Some(CellDefinition::Formula(formula)) => {
+                self.evaluate_formula(formula, memo, visiting)
+            }
+        };
+        visiting.remove(&cell);
+        memo.insert(cell, value.clone());
+        value
+    }
+
+    fn evaluate_formula(
+        &self,
+        formula: &Formula,
+        memo: &mut BTreeMap<Cell, CellValue>,
+        visiting: &mut BTreeSet<Cell>,
+    ) -> CellValue {
+        match formula {
+            Formula::Sum(range) => {
+                let mut total = 0_i128;
+                for cell in range.cells() {
+                    let CellValue::Number(value) = self.evaluate_cell(cell, memo, visiting) else {
+                        return self.evaluate_cell(cell, memo, visiting);
+                    };
+                    let Some(next) = total.checked_add(value) else {
+                        return CellValue::Error(ErrorCode::Overflow);
+                    };
+                    total = next;
+                }
+                CellValue::Number(total)
+            }
+            Formula::Reference(cell) => self.evaluate_cell(*cell, memo, visiting),
+            Formula::Add(left, right) => self.evaluate_add(*left, *right, memo, visiting),
+            Formula::IfGreaterThenAdd {
+                condition,
+                threshold,
+                left,
+                right,
+            } => match self.evaluate_cell(*condition, memo, visiting) {
+                CellValue::Number(value) if value > *threshold => {
+                    self.evaluate_add(*left, *right, memo, visiting)
+                }
+                CellValue::Number(_) => CellValue::Number(0),
+                error @ CellValue::Error(_) => error,
+            },
+        }
+    }
+
+    fn evaluate_add(
+        &self,
+        left: Cell,
+        right: Cell,
+        memo: &mut BTreeMap<Cell, CellValue>,
+        visiting: &mut BTreeSet<Cell>,
+    ) -> CellValue {
+        match (
+            self.evaluate_cell(left, memo, visiting),
+            self.evaluate_cell(right, memo, visiting),
+        ) {
+            (CellValue::Number(left), CellValue::Number(right)) => left
+                .checked_add(right)
+                .map_or(CellValue::Error(ErrorCode::Overflow), CellValue::Number),
+            (CellValue::Error(error), _) | (_, CellValue::Error(error)) => CellValue::Error(error),
+        }
+    }
+}
+
+#[derive(Clone, Debug, Eq, PartialEq)]
+pub enum Reject {
+    BadChecksum,
+    TruncatedRecord,
+    TrailingBytes,
+    UnexpectedSequence { expected: u64, actual: u64 },
+    UnknownEditOpcode(u8),
+    UnknownFormulaOpcode(u8),
+    IntegerOverflow,
+    NotALiteral(Cell),
+    Io(String),
+    IncompleteDemo,
+    ReaderTaskPanicked,
+    AlreadyInitialized,
+    NotInitialized,
+    RecoveryMismatch,
+}
+
+#[derive(Clone, Debug, Eq, PartialEq)]
+pub struct Outcome {
+    pub recalculated: Vec<Cell>,
+}
+
+#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
+pub struct PublishedCell {
+    pub cell: Cell,
+    pub generation: u64,
+    pub value: CellValue,
+}
+
+#[derive(Clone, Debug, Default, Eq, PartialEq)]
+pub struct VisibleSnapshot {
+    pub generation: u64,
+    pub cells: Vec<PublishedCell>,
+}
+
+impl VisibleSnapshot {
+    #[must_use]
+    pub fn point(&self, cell: Cell) -> Option<&CellValue> {
+        self.cells
+            .binary_search_by_key(&cell, |published| published.cell)
+            .ok()
+            .map(|index| &self.cells[index].value)
+    }
+
+    #[must_use]
+    pub fn rectangular(&self, range: Range) -> Vec<(Cell, &CellValue)> {
+        range
+            .cells()
+            .into_iter()
+            .filter_map(|cell| self.point(cell).map(|value| (cell, value)))
+            .collect()
+    }
+
+    #[must_use]
+    pub fn errors(&self) -> Vec<(Cell, ErrorCode)> {
+        self.cells
+            .iter()
+            .filter_map(|published| match published.value {
+                CellValue::Error(error) => Some((published.cell, error)),
+                CellValue::Number(_) => None,
+            })
+            .collect()
+    }
+
+    #[must_use]
+    pub fn canonical_bytes(&self) -> Vec<u8> {
+        let mut output = format!("generation={}\n", self.generation);
+        for published in &self.cells {
+            let cell = published.cell;
+            match published.value {
+                CellValue::Number(value) => writeln!(
+                    output,
+                    "{}:{}:{}=N:{value}",
+                    cell.sheet, cell.row, cell.column
+                )
+                .expect("writing to String cannot fail"),
+                CellValue::Error(error) => writeln!(
+                    output,
+                    "{}:{}:{}=E:{}",
+                    cell.sheet,
+                    cell.row,
+                    cell.column,
+                    error.label()
+                )
+                .expect("writing to String cannot fail"),
+            }
+        }
+        output.into_bytes()
+    }
+}
+
+#[derive(Clone)]
+pub struct TrialReader {
+    visible: Arc<RwLock<Arc<VisibleSnapshot>>>,
+}
+
+impl TrialReader {
+    #[must_use]
+    /// Clones the currently published complete generation.
+    ///
+    /// # Panics
+    ///
+    /// Panics if another thread previously poisoned the publication lock.
+    pub fn read(&self) -> VisibleSnapshot {
+        self.visible
+            .read()
+            .expect("snapshot lock was poisoned")
+            .as_ref()
+            .clone()
+    }
+}
+
+#[derive(Clone, Debug, Deserialize, Eq, Ord, PartialEq, PartialOrd, Serialize)]
+enum SnapshotKey {
+    Generation,
+    Cell(Cell),
+}
+
+#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
+enum StoredValue {
+    Generation(u64),
+    Cell(PublishedCell),
+}
+
+type Store = KeyedStream<SnapshotKey, StoredValue, terminal::Table<SnapshotKey, StoredValue>>;
+
+pub struct Trial {
+    workbook: Workbook,
+    store: Store,
+    visible: Arc<RwLock<Arc<VisibleSnapshot>>>,
+    initialized: bool,
+}
+
+impl Trial {
+    /// Opens a new disposable calculated-state directory.
+    ///
+    /// # Errors
+    ///
+    /// Returns a rejection if trial setup cannot be completed.
+    pub fn open(path: &Path, workbook: Workbook) -> Result<Self, Reject> {
+        let store = KeyedStream::new(path, terminal::Table::new("calculated_snapshot"));
+        if read_store(&store).is_some() {
+            return Err(Reject::AlreadyInitialized);
+        }
+        Ok(Self {
+            workbook,
+            store,
+            visible: Arc::new(RwLock::new(Arc::new(VisibleSnapshot::default()))),
+            initialized: false,
+        })
+    }
+
+    /// Recovers writable state by replaying the authoritative journal without publishing.
+    ///
+    /// # Errors
+    ///
+    /// Returns a rejection when the store is empty, the journal is invalid, or replayed
+    /// workbook state does not exactly match the persisted calculated snapshot.
+    pub fn recover_from_journal(
+        path: &Path,
+        mut workbook: Workbook,
+        journal: &[Vec<u8>],
+    ) -> Result<Self, Reject> {
+        let store = KeyedStream::new(path, terminal::Table::new("calculated_snapshot"));
+        let visible = read_store(&store).ok_or(Reject::NotInitialized)?;
+        let mut expected_sequence = 1_u64;
+        for record in journal {
+            let batch = Batch::decode(record)?;
+            if batch.sequence != expected_sequence {
+                return Err(Reject::UnexpectedSequence {
+                    expected: expected_sequence,
+                    actual: batch.sequence,
+                });
+            }
+            workbook.apply_edits(&batch.edits)?;
+            expected_sequence += 1;
+        }
+        let replayed_generation = expected_sequence - 1;
+        let replayed = make_snapshot(replayed_generation, workbook.evaluate());
+        if replayed != visible {
+            return Err(Reject::RecoveryMismatch);
+        }
+        Ok(Self {
+            workbook,
+            store,
+            visible: Arc::new(RwLock::new(Arc::new(visible))),
+            initialized: true,
+        })
+    }
+
+    /// Evaluates and publishes generation zero.
+    ///
+    /// # Errors
+    ///
+    /// Returns a rejection if evaluation cannot be published.
+    pub fn bootstrap(&mut self) -> Result<(), Reject> {
+        if self.initialized || read_store(&self.store).is_some() {
+            return Err(Reject::AlreadyInitialized);
+        }
+        let values = self.workbook.evaluate();
+        self.publish(make_snapshot(0, values));
+        self.initialized = true;
+        Ok(())
+    }
+
+    /// Validates, evaluates, and atomically publishes one journal batch.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`Reject`] for malformed, out-of-order, unknown, or overflowing input.
+    pub fn apply(&mut self, record: &[u8]) -> Result<Outcome, Reject> {
+        if !self.initialized {
+            return Err(Reject::NotInitialized);
+        }
+        let batch = Batch::decode(record)?;
+        let expected = self.reader().read().generation + 1;
+        if batch.sequence != expected {
+            return Err(Reject::UnexpectedSequence {
+                expected,
+                actual: batch.sequence,
+            });
+        }
+
+        let mut candidate = self.workbook.clone();
+        let changed = candidate.apply_edits(&batch.edits)?;
+        let recalculated = candidate.affected(&changed);
+        let snapshot = make_snapshot(batch.sequence, candidate.evaluate());
+        self.publish(snapshot);
+        self.workbook = candidate;
+        Ok(Outcome { recalculated })
+    }
+
+    #[must_use]
+    pub fn reader(&self) -> TrialReader {
+        TrialReader {
+            visible: Arc::clone(&self.visible),
+        }
+    }
+
+    fn publish(&mut self, snapshot: VisibleSnapshot) {
+        self.store.wtx(|tx| {
+            tx.upsert(
+                &SnapshotKey::Generation,
+                &StoredValue::Generation(snapshot.generation),
+            );
+            for cell in &snapshot.cells {
+                tx.upsert(
+                    &SnapshotKey::Cell(cell.cell),
+                    &StoredValue::Cell(cell.clone()),
+                );
+            }
+        });
+        *self.visible.write().expect("snapshot lock was poisoned") = Arc::new(snapshot);
+    }
+}
+
+fn make_snapshot(generation: u64, values: BTreeMap<Cell, CellValue>) -> VisibleSnapshot {
+    VisibleSnapshot {
+        generation,
+        cells: values
+            .into_iter()
+            .map(|(cell, value)| PublishedCell {
+                cell,
+                generation,
+                value,
+            })
+            .collect(),
+    }
+}
+
+fn read_store(store: &Store) -> Option<VisibleSnapshot> {
+    store.rtx(|table| {
+        let mut found = false;
+        let mut generation = 0;
+        let mut cells = Vec::new();
+        for (key, value) in table.iter() {
+            found = true;
+            match (key, value) {
+                (SnapshotKey::Generation, StoredValue::Generation(value)) => generation = value,
+                (SnapshotKey::Cell(_), StoredValue::Cell(cell)) => cells.push(cell),
+                _ => {}
+            }
+        }
+        cells.sort_by_key(|cell| cell.cell);
+        found.then_some(VisibleSnapshot { generation, cells })
+    })
+}
+
+#[derive(Clone, Debug, Default, Deserialize, Eq, PartialEq, Serialize)]
+pub enum GateStatus {
+    #[default]
+    NotRun,
+    Pass,
+    Fail,
+}
+
+impl GateStatus {
+    const fn from_passed(passed: bool) -> Self {
+        if passed { Self::Pass } else { Self::Fail }
+    }
+}
+
+#[derive(Clone, Debug, Default, Deserialize, Eq, PartialEq, Serialize)]
+pub struct DemoManifest {
+    pub fixture_populated_cells: u32,
+    pub fixture_literal_cells: u32,
+    pub fixture_formula_cells: u32,
+    pub accepted_batches: u32,
+    pub clean_builds: u32,
+    pub chunk_sizes: Vec<usize>,
+    pub local_exactness: GateStatus,
+    pub local_determinism: GateStatus,
+    pub invalid_record_gate: GateStatus,
+    pub one_way_initialization_gate: GateStatus,
+    pub recovery_continuation_gate: GateStatus,
+    pub reader_tasks: u32,
+    pub read_requests: u64,
+    pub mixed_generation_responses: u64,
+    pub initial_build_microseconds: u64,
+    pub batch_p95_microseconds: u64,
+    pub batch_p99_microseconds: u64,
+    pub recovery_replay_microseconds: u64,
+    pub observed_single_store_disk_bytes: u64,
+    pub observed_100_batch_store_disk_bytes: u64,
+    pub observed_total_test_disk_bytes: u64,
+    pub production_scale_gates: GateStatus,
+}
+
+/// Runs the bounded local demonstration and removes its temporary data.
+///
+/// # Errors
+///
+/// Returns a rejection when a journal gate, local store, reader task, or cleanup fails.
+///
+/// # Panics
+///
+/// Panics if Fold cannot open or commit its embedded store, or if a publication lock is poisoned.
+pub fn run_demo(data_path: &Path) -> Result<DemoManifest, Reject> {
+    remove_if_present(data_path)?;
+    std::fs::create_dir_all(data_path).map_err(|error| Reject::Io(error.kind().to_string()))?;
+    let trace = demo_trace();
+    let mut repeatability = run_repeatability(data_path, &trace)?;
+    let local_exactness_passed = repeatability.reference
+        == b"generation=3\n0:0:0=N:99\n0:0:1=N:5\n0:0:2=N:0\n0:1:0=N:5\n1:0:0=E:CYCLE\n1:0:1=E:CYCLE\n1:1:0=E:MISSING_REFERENCE\n";
+    let invalid_record_gate_passed = run_invalid_gate(data_path)?;
+    let one_way_initialization_gate_passed = run_initialization_gate(data_path)?;
+    let (
+        recovery_continuation_gate_passed,
+        recovery_replay_microseconds,
+        observed_single_store_disk_bytes,
+    ) = run_recovery_continuation_gate(data_path, &trace)?;
+    let (mixed_generation_responses, observed_100_batch_store_disk_bytes) =
+        run_concurrency_gate(data_path)?;
+    repeatability.batch_latencies.sort_unstable();
+    let observed_total_test_disk_bytes = directory_size(data_path)?;
+    let manifest = DemoManifest {
+        fixture_populated_cells: 7,
+        fixture_literal_cells: 2,
+        fixture_formula_cells: 5,
+        accepted_batches: 3,
+        clean_builds: 5,
+        chunk_sizes: repeatability.chunk_sizes,
+        local_exactness: GateStatus::from_passed(local_exactness_passed),
+        local_determinism: GateStatus::from_passed(repeatability.deterministic),
+        invalid_record_gate: GateStatus::from_passed(invalid_record_gate_passed),
+        one_way_initialization_gate: GateStatus::from_passed(one_way_initialization_gate_passed),
+        recovery_continuation_gate: GateStatus::from_passed(recovery_continuation_gate_passed),
+        reader_tasks: 12,
+        read_requests: 24_000,
+        mixed_generation_responses,
+        initial_build_microseconds: repeatability.initial_build_microseconds,
+        batch_p95_microseconds: percentile(&repeatability.batch_latencies, 95),
+        batch_p99_microseconds: percentile(&repeatability.batch_latencies, 99),
+        recovery_replay_microseconds,
+        observed_single_store_disk_bytes,
+        observed_100_batch_store_disk_bytes,
+        observed_total_test_disk_bytes,
+        production_scale_gates: GateStatus::NotRun,
+    };
+    remove_if_present(data_path)?;
+    Ok(manifest)
+}
+
+struct RepeatabilityEvidence {
+    reference: Vec<u8>,
+    deterministic: bool,
+    chunk_sizes: Vec<usize>,
+    initial_build_microseconds: u64,
+    batch_latencies: Vec<u64>,
+}
+
+fn run_repeatability(data_path: &Path, trace: &[Vec<u8>]) -> Result<RepeatabilityEvidence, Reject> {
+    let mut builds = Vec::new();
+    let mut initial_build_microseconds = 0;
+    let mut batch_latencies = Vec::new();
+    for build in 0..5 {
+        let mut trial = Trial::open(
+            &data_path.join(format!("clean-{build}")),
+            Workbook::deterministic_fixture(),
+        )?;
+        let started = Instant::now();
+        trial.bootstrap()?;
+        if build == 0 {
+            initial_build_microseconds = micros(started.elapsed());
+        }
+        for record in trace {
+            let started = Instant::now();
+            trial.apply(record)?;
+            if build == 0 {
+                batch_latencies.push(micros(started.elapsed()));
+            }
+        }
+        builds.push(trial.reader().read().canonical_bytes());
+    }
+    let reference = builds.first().cloned().ok_or(Reject::IncompleteDemo)?;
+    let mut deterministic = builds.iter().all(|bytes| *bytes == reference);
+    let chunk_sizes = vec![1, 7, 64, 511, 4_096];
+    for size in &chunk_sizes {
+        let mut trial = Trial::open(
+            &data_path.join(format!("chunk-{size}")),
+            Workbook::deterministic_fixture(),
+        )?;
+        trial.bootstrap()?;
+        for chunk in trace.chunks(*size) {
+            for record in chunk {
+                trial.apply(record)?;
+            }
+        }
+        deterministic &= trial.reader().read().canonical_bytes() == reference;
+    }
+    Ok(RepeatabilityEvidence {
+        reference,
+        deterministic,
+        chunk_sizes,
+        initial_build_microseconds,
+        batch_latencies,
+    })
+}
+
+fn run_invalid_gate(data_path: &Path) -> Result<bool, Reject> {
+    let mut trial = Trial::open(
+        &data_path.join("invalid"),
+        Workbook::deterministic_fixture(),
+    )?;
+    trial.bootstrap()?;
+    let before = trial.reader().read();
+    let rejected =
+        trial.apply(&Batch::new(2, vec![Edit::SetLiteral(Cell::new(0, 0, 0), 9)]).encode());
+    Ok(matches!(
+        rejected,
+        Err(Reject::UnexpectedSequence {
+            expected: 1,
+            actual: 2
+        })
+    ) && trial.reader().read() == before)
+}
+
+fn run_initialization_gate(data_path: &Path) -> Result<bool, Reject> {
+    let path = data_path.join("one-way-initialization");
+    let record = Batch::new(1, vec![Edit::SetLiteral(Cell::new(0, 1, 0), 5)]).encode();
+    let (before, bootstrap_rejected, duplicate_rejected) = {
+        let mut trial = Trial::open(&path, Workbook::deterministic_fixture())?;
+        trial.bootstrap()?;
+        trial.apply(&record)?;
+        let before = trial.reader().read();
+        let bootstrap_rejected =
+            trial.bootstrap() == Err(Reject::AlreadyInitialized) && trial.reader().read() == before;
+        let duplicate_rejected = trial.apply(&record)
+            == Err(Reject::UnexpectedSequence {
+                expected: 2,
+                actual: 1,
+            })
+            && trial.reader().read() == before;
+        (before, bootstrap_rejected, duplicate_rejected)
+    };
+    let open_rejected = matches!(
+        Trial::open(&path, Workbook::deterministic_fixture()),
+        Err(Reject::AlreadyInitialized)
+    );
+    let recovered = Trial::recover_from_journal(
+        &path,
+        Workbook::deterministic_fixture(),
+        std::slice::from_ref(&record),
+    )?;
+    Ok(bootstrap_rejected
+        && duplicate_rejected
+        && open_rejected
+        && recovered.reader().read() == before)
+}
+
+fn run_recovery_continuation_gate(
+    data_path: &Path,
+    trace: &[Vec<u8>],
+) -> Result<(bool, u64, u64), Reject> {
+    let (next, journal) = trace.split_last().ok_or(Reject::IncompleteDemo)?;
+    let uninterrupted_path = data_path.join("uninterrupted");
+    let expected = {
+        let mut trial = Trial::open(&uninterrupted_path, Workbook::deterministic_fixture())?;
+        trial.bootstrap()?;
+        for record in trace {
+            trial.apply(record)?;
+        }
+        trial.reader().read()
+    };
+    let recovered_path = data_path.join("recovered");
+    {
+        let mut trial = Trial::open(&recovered_path, Workbook::deterministic_fixture())?;
+        trial.bootstrap()?;
+        for record in journal {
+            trial.apply(record)?;
+        }
+    }
+    let started = Instant::now();
+    let mut recovered =
+        Trial::recover_from_journal(&recovered_path, Workbook::deterministic_fixture(), journal)?;
+    let elapsed = micros(started.elapsed());
+    recovered.apply(next)?;
+    let passed = recovered.reader().read() == expected;
+    drop(recovered);
+    Ok((passed, elapsed, directory_size(&recovered_path)?))
+}
+
+fn run_concurrency_gate(data_path: &Path) -> Result<(u64, u64), Reject> {
+    let path = data_path.join("concurrency");
+    let mut trial = Trial::open(&path, Workbook::deterministic_fixture())?;
+    trial.bootstrap()?;
+    let reader = trial.reader();
+    let barrier = Arc::new(std::sync::Barrier::new(13));
+    let mixed = std::thread::scope(|scope| {
+        let mut handles = Vec::new();
+        for _ in 0..12 {
+            let reader = reader.clone();
+            let barrier = Arc::clone(&barrier);
+            handles.push(scope.spawn(move || count_mixed_reads(&reader, &barrier)));
+        }
+        barrier.wait();
+        for sequence in 1..=100 {
+            trial.apply(
+                &Batch::new(
+                    sequence,
+                    vec![Edit::SetLiteral(Cell::new(0, 1, 0), i128::from(sequence))],
+                )
+                .encode(),
+            )?;
+        }
+        handles.into_iter().try_fold(0_u64, |total, handle| {
+            handle
+                .join()
+                .map(|mixed| total + mixed)
+                .map_err(|_| Reject::ReaderTaskPanicked)
+        })
+    })?;
+    Ok((mixed, directory_size(&path)?))
+}
+
+fn count_mixed_reads(reader: &TrialReader, barrier: &std::sync::Barrier) -> u64 {
+    barrier.wait();
+    let mut mixed = 0_u64;
+    for _ in 0..2_000 {
+        let visible = reader.read();
+        if visible
+            .cells
+            .iter()
+            .any(|cell| cell.generation != visible.generation)
+        {
+            mixed += 1;
+        }
+    }
+    mixed
+}
+
+fn demo_trace() -> Vec<Vec<u8>> {
+    let a1 = Cell::new(0, 0, 0);
+    let a2 = Cell::new(0, 1, 0);
+    let b1 = Cell::new(0, 0, 1);
+    vec![
+        Batch::new(1, vec![Edit::SetLiteral(a2, 5)]).encode(),
+        Batch::new(
+            2,
+            vec![Edit::SetFormula(b1, Formula::Sum(Range::new(a2, a2)))],
+        )
+        .encode(),
+        Batch::new(3, vec![Edit::SetLiteral(a1, 99)]).encode(),
+    ]
+}
+
+fn micros(duration: std::time::Duration) -> u64 {
+    u64::try_from(duration.as_micros()).unwrap_or(u64::MAX)
+}
+
+fn percentile(values: &[u64], percentile: usize) -> u64 {
+    if values.is_empty() {
+        return 0;
+    }
+    let index = ((values.len() - 1) * percentile) / 100;
+    values[index]
+}
+
+fn remove_if_present(path: &Path) -> Result<(), Reject> {
+    match std::fs::remove_dir_all(path) {
+        Ok(()) => Ok(()),
+        Err(error) if error.kind() == std::io::ErrorKind::NotFound => Ok(()),
+        Err(error) => Err(Reject::Io(error.kind().to_string())),
+    }
+}
+
+fn directory_size(path: &Path) -> Result<u64, Reject> {
+    let mut total = 0_u64;
+    for entry in std::fs::read_dir(path).map_err(|error| Reject::Io(error.kind().to_string()))? {
+        let entry = entry.map_err(|error| Reject::Io(error.kind().to_string()))?;
+        let metadata = entry
+            .metadata()
+            .map_err(|error| Reject::Io(error.kind().to_string()))?;
+        if metadata.is_dir() {
+            total = total
+                .checked_add(directory_size(&entry.path())?)
+                .ok_or(Reject::IntegerOverflow)?;
+        } else {
+            total = total
+                .checked_add(metadata.len())
+                .ok_or(Reject::IntegerOverflow)?;
+        }
+    }
+    Ok(total)
+}
diff --git a/developer-simulation/runs/2026-08-15--incremental-calculation-cache/src/main.rs b/developer-simulation/runs/2026-08-15--incremental-calculation-cache/src/main.rs
new file mode 100644
index 0000000..c48fb9c
--- /dev/null
+++ b/developer-simulation/runs/2026-08-15--incremental-calculation-cache/src/main.rs
@@ -0,0 +1,15 @@
+use std::path::Path;
+
+fn main() {
+    let mut arguments = std::env::args_os().skip(1);
+    let data_path = arguments
+        .next()
+        .expect("usage: financial-snapshot-trial <temporary-data-dir> [manifest-path]");
+    let manifest = financial_snapshot_trial::run_demo(Path::new(&data_path))
+        .expect("the local demonstration must complete");
+    let json = serde_json::to_string_pretty(&manifest).expect("manifest serialization must work");
+    if let Some(manifest_path) = arguments.next() {
+        std::fs::write(manifest_path, format!("{json}\n")).expect("manifest path must be writable");
+    }
+    println!("{json}");
+}
diff --git a/developer-simulation/runs/2026-08-15--incremental-calculation-cache/tests/acceptance.rs b/developer-simulation/runs/2026-08-15--incremental-calculation-cache/tests/acceptance.rs
new file mode 100644
index 0000000..cbf58b4
--- /dev/null
+++ b/developer-simulation/runs/2026-08-15--incremental-calculation-cache/tests/acceptance.rs
@@ -0,0 +1,390 @@
+use std::sync::{Arc, Barrier};
+
+use financial_snapshot_trial::{
+    Batch, Cell, CellValue, Edit, ErrorCode, Formula, Range, Reject, Trial, Workbook,
+};
+
+fn a1() -> Cell {
+    Cell::new(0, 0, 0)
+}
+
+fn a2() -> Cell {
+    Cell::new(0, 1, 0)
+}
+
+fn b1() -> Cell {
+    Cell::new(0, 0, 1)
+}
+
+fn c1() -> Cell {
+    Cell::new(0, 0, 2)
+}
+
+fn fresh_path(label: &str) -> std::path::PathBuf {
+    std::env::temp_dir().join(format!(
+        "financial-snapshot-trial-{label}-{}",
+        std::process::id()
+    ))
+}
+
+#[test]
+fn range_dependency_recalculates_and_publishes_one_generation() {
+    let path = fresh_path("range");
+    let _ = std::fs::remove_dir_all(&path);
+    let mut trial = Trial::open(&path, Workbook::deterministic_fixture()).unwrap();
+    trial.bootstrap().unwrap();
+    let record = Batch::new(1, vec![Edit::SetLiteral(a2(), 5)]).encode();
+
+    let outcome = trial.apply(&record).unwrap();
+
+    assert_eq!(outcome.recalculated, vec![b1(), c1(), a2()]);
+    let visible = trial.reader().read();
+    assert_eq!(visible.generation, 1);
+    assert_eq!(visible.point(a2()), Some(&CellValue::Number(5)));
+    assert_eq!(visible.point(b1()), Some(&CellValue::Number(15)));
+    assert_eq!(visible.point(c1()), Some(&CellValue::Number(0)));
+    assert!(visible.cells.iter().all(|cell| cell.generation == 1));
+
+    drop(trial);
+    let recovered =
+        Trial::recover_from_journal(&path, Workbook::deterministic_fixture(), &[record]).unwrap();
+    assert_eq!(recovered.reader().read(), visible);
+    std::fs::remove_dir_all(path).unwrap();
+}
+
+#[test]
+fn formula_replacement_rebuilds_range_dependencies() {
+    let path = fresh_path("formula");
+    let _ = std::fs::remove_dir_all(&path);
+    let mut trial = Trial::open(&path, Workbook::deterministic_fixture()).unwrap();
+    trial.bootstrap().unwrap();
+
+    trial
+        .apply(
+            &Batch::new(
+                1,
+                vec![Edit::SetFormula(b1(), Formula::Sum(Range::new(a2(), a2())))],
+            )
+            .encode(),
+        )
+        .unwrap();
+    let outcome = trial
+        .apply(&Batch::new(2, vec![Edit::SetLiteral(a1(), 99)]).encode())
+        .unwrap();
+
+    assert_eq!(outcome.recalculated, vec![a1(), c1()]);
+    let visible = trial.reader().read();
+    assert_eq!(visible.point(b1()), Some(&CellValue::Number(20)));
+    assert_eq!(visible.point(c1()), Some(&CellValue::Number(119)));
+    std::fs::remove_dir_all(path).unwrap();
+}
+
+#[test]
+fn bad_checksum_leaves_last_accepted_generation_unchanged() {
+    let path = fresh_path("checksum");
+    let _ = std::fs::remove_dir_all(&path);
+    let mut trial = Trial::open(&path, Workbook::deterministic_fixture()).unwrap();
+    trial.bootstrap().unwrap();
+    let before = trial.reader().read();
+    let mut bytes = Batch::new(1, vec![Edit::SetLiteral(a1(), 44)]).encode();
+    let last = bytes.len() - 1;
+    bytes[last] ^= 0x80;
+
+    assert_eq!(trial.apply(&bytes), Err(Reject::BadChecksum));
+    assert_eq!(trial.reader().read(), before);
+    std::fs::remove_dir_all(path).unwrap();
+}
+
+#[test]
+fn skipped_sequence_leaves_last_accepted_generation_unchanged() {
+    let path = fresh_path("sequence");
+    let _ = std::fs::remove_dir_all(&path);
+    let mut trial = Trial::open(&path, Workbook::deterministic_fixture()).unwrap();
+    trial.bootstrap().unwrap();
+    let before = trial.reader().read();
+
+    assert_eq!(
+        trial.apply(&Batch::new(2, vec![Edit::SetLiteral(a1(), 44)]).encode()),
+        Err(Reject::UnexpectedSequence {
+            expected: 1,
+            actual: 2,
+        })
+    );
+    assert_eq!(trial.reader().read(), before);
+    std::fs::remove_dir_all(path).unwrap();
+}
+
+#[test]
+fn duplicate_sequence_leaves_last_accepted_generation_unchanged() {
+    let path = fresh_path("duplicate");
+    let _ = std::fs::remove_dir_all(&path);
+    let mut trial = Trial::open(&path, Workbook::deterministic_fixture()).unwrap();
+    trial.bootstrap().unwrap();
+    trial
+        .apply(&Batch::new(1, vec![Edit::SetLiteral(a1(), 44)]).encode())
+        .unwrap();
+    let before = trial.reader().read();
+
+    assert_eq!(
+        trial.apply(&Batch::new(1, vec![Edit::SetLiteral(a1(), 45)]).encode()),
+        Err(Reject::UnexpectedSequence {
+            expected: 2,
+            actual: 1,
+        })
+    );
+    assert_eq!(trial.reader().read(), before);
+    std::fs::remove_dir_all(path).unwrap();
+}
+
+#[test]
+fn arithmetic_overflow_leaves_last_accepted_generation_unchanged() {
+    let path = fresh_path("overflow");
+    let _ = std::fs::remove_dir_all(&path);
+    let mut workbook = Workbook::deterministic_fixture();
+    workbook.set_literal(a1(), i128::MAX);
+    let mut trial = Trial::open(&path, workbook).unwrap();
+    trial.bootstrap().unwrap();
+    let before = trial.reader().read();
+
+    assert_eq!(
+        trial.apply(&Batch::new(1, vec![Edit::AdjustLiteral(a1(), 1)]).encode()),
+        Err(Reject::IntegerOverflow)
+    );
+    assert_eq!(trial.reader().read(), before);
+    std::fs::remove_dir_all(path).unwrap();
+}
+
+#[test]
+fn truncated_record_leaves_last_accepted_generation_unchanged() {
+    let path = fresh_path("truncated");
+    let _ = std::fs::remove_dir_all(&path);
+    let mut trial = Trial::open(&path, Workbook::deterministic_fixture()).unwrap();
+    trial.bootstrap().unwrap();
+    let before = trial.reader().read();
+    let mut bytes = Batch::new(1, vec![Edit::SetLiteral(a1(), 44)]).encode();
+    bytes.truncate(bytes.len() - 3);
+
+    assert_eq!(trial.apply(&bytes), Err(Reject::TruncatedRecord));
+    assert_eq!(trial.reader().read(), before);
+    std::fs::remove_dir_all(path).unwrap();
+}
+
+#[test]
+fn unknown_formula_opcode_leaves_last_accepted_generation_unchanged() {
+    let path = fresh_path("unknown-formula");
+    let _ = std::fs::remove_dir_all(&path);
+    let mut trial = Trial::open(&path, Workbook::deterministic_fixture()).unwrap();
+    trial.bootstrap().unwrap();
+    let before = trial.reader().read();
+    let mut bytes = Batch::new(
+        1,
+        vec![Edit::SetFormula(b1(), Formula::Sum(Range::new(a1(), a2())))],
+    )
+    .encode();
+    bytes[31] = 255;
+    let checksum = bytes[..bytes.len() - 8]
+        .iter()
+        .fold(0xcbf2_9ce4_8422_2325_u64, |hash, byte| {
+            (hash ^ u64::from(*byte)).wrapping_mul(0x0000_0100_0000_01b3)
+        });
+    let checksum_at = bytes.len() - 8;
+    bytes[checksum_at..].copy_from_slice(&checksum.to_le_bytes());
+
+    assert_eq!(trial.apply(&bytes), Err(Reject::UnknownFormulaOpcode(255)));
+    assert_eq!(trial.reader().read(), before);
+    std::fs::remove_dir_all(path).unwrap();
+}
+
+#[test]
+fn cycle_and_missing_reference_errors_are_stable_and_ordered() {
+    let path = fresh_path("errors");
+    let _ = std::fs::remove_dir_all(&path);
+    let mut trial = Trial::open(&path, Workbook::deterministic_fixture()).unwrap();
+    trial.bootstrap().unwrap();
+    let visible = trial.reader().read();
+
+    assert_eq!(
+        visible.errors(),
+        vec![
+            (Cell::new(1, 0, 0), ErrorCode::Cycle),
+            (Cell::new(1, 0, 1), ErrorCode::Cycle),
+            (Cell::new(1, 1, 0), ErrorCode::MissingReference),
+        ]
+    );
+    std::fs::remove_dir_all(path).unwrap();
+}
+
+#[test]
+fn canonical_snapshot_bytes_are_reference_backed() {
+    let path = fresh_path("bytes");
+    let _ = std::fs::remove_dir_all(&path);
+    let mut trial = Trial::open(&path, Workbook::deterministic_fixture()).unwrap();
+    trial.bootstrap().unwrap();
+    trial
+        .apply(&Batch::new(1, vec![Edit::SetLiteral(a2(), 5)]).encode())
+        .unwrap();
+
+    assert_eq!(
+        String::from_utf8(trial.reader().read().canonical_bytes()).unwrap(),
+        "generation=1\n0:0:0=N:10\n0:0:1=N:15\n0:0:2=N:0\n0:1:0=N:5\n1:0:0=E:CYCLE\n1:0:1=E:CYCLE\n1:1:0=E:MISSING_REFERENCE\n"
+    );
+    std::fs::remove_dir_all(path).unwrap();
+}
+
+#[test]
+fn rectangular_read_returns_coordinate_order_from_one_generation() {
+    let path = fresh_path("rectangular");
+    let _ = std::fs::remove_dir_all(&path);
+    let mut trial = Trial::open(&path, Workbook::deterministic_fixture()).unwrap();
+    trial.bootstrap().unwrap();
+    let visible = trial.reader().read();
+
+    assert_eq!(
+        visible.rectangular(Range::new(a1(), a2())),
+        vec![
+            (a1(), &CellValue::Number(10)),
+            (a2(), &CellValue::Number(20)),
+        ]
+    );
+    assert!(visible.cells.iter().all(|cell| cell.generation == 0));
+    std::fs::remove_dir_all(path).unwrap();
+}
+
+#[test]
+fn twelve_readers_never_observe_a_mixed_generation() {
+    let path = fresh_path("concurrency");
+    let _ = std::fs::remove_dir_all(&path);
+    let mut trial = Trial::open(&path, Workbook::deterministic_fixture()).unwrap();
+    trial.bootstrap().unwrap();
+    let reader = trial.reader();
+    let start = Arc::new(Barrier::new(13));
+
+    std::thread::scope(|scope| {
+        let mut handles = Vec::new();
+        for _ in 0..12 {
+            let reader = reader.clone();
+            let start = Arc::clone(&start);
+            handles.push(scope.spawn(move || {
+                start.wait();
+                for _ in 0..2_000 {
+                    let visible = reader.read();
+                    assert!(
+                        visible
+                            .cells
+                            .iter()
+                            .all(|cell| cell.generation == visible.generation)
+                    );
+                }
+            }));
+        }
+        start.wait();
+        for sequence in 1..=100 {
+            trial
+                .apply(
+                    &Batch::new(sequence, vec![Edit::SetLiteral(a2(), i128::from(sequence))])
+                        .encode(),
+                )
+                .unwrap();
+        }
+        for handle in handles {
+            handle.join().unwrap();
+        }
+    });
+
+    assert_eq!(trial.reader().read().generation, 100);
+    std::fs::remove_dir_all(path).unwrap();
+}
+
+#[test]
+fn bootstrap_twice_rejects_without_rewinding_visible_state() {
+    let path = fresh_path("bootstrap-twice");
+    let _ = std::fs::remove_dir_all(&path);
+    let mut trial = Trial::open(&path, Workbook::deterministic_fixture()).unwrap();
+    trial.bootstrap().unwrap();
+    trial
+        .apply(&Batch::new(1, vec![Edit::SetLiteral(a2(), 5)]).encode())
+        .unwrap();
+    let before = trial.reader().read();
+    let before_bytes = before.canonical_bytes();
+
+    assert_eq!(trial.bootstrap(), Err(Reject::AlreadyInitialized));
+    assert_eq!(trial.reader().read(), before);
+    assert_eq!(trial.reader().read().canonical_bytes(), before_bytes);
+    assert_eq!(
+        trial.apply(&Batch::new(1, vec![Edit::SetLiteral(a2(), 7)]).encode()),
+        Err(Reject::UnexpectedSequence {
+            expected: 2,
+            actual: 1,
+        })
+    );
+    std::fs::remove_dir_all(path).unwrap();
+}
+
+#[test]
+fn open_on_existing_store_rejects_without_changing_persisted_state() {
+    let path = fresh_path("open-existing");
+    let _ = std::fs::remove_dir_all(&path);
+    let record = Batch::new(1, vec![Edit::SetLiteral(a2(), 5)]).encode();
+    let expected = {
+        let mut trial = Trial::open(&path, Workbook::deterministic_fixture()).unwrap();
+        trial.bootstrap().unwrap();
+        trial.apply(&record).unwrap();
+        trial.reader().read()
+    };
+
+    assert!(matches!(
+        Trial::open(&path, Workbook::deterministic_fixture()),
+        Err(Reject::AlreadyInitialized)
+    ));
+    let recovered =
+        Trial::recover_from_journal(&path, Workbook::deterministic_fixture(), &[record]).unwrap();
+    assert_eq!(recovered.reader().read(), expected);
+    assert_eq!(
+        recovered.reader().read().canonical_bytes(),
+        expected.canonical_bytes()
+    );
+    std::fs::remove_dir_all(path).unwrap();
+}
+
+#[test]
+fn close_recover_and_continue_matches_uninterrupted_formula_trace() {
+    let uninterrupted_path = fresh_path("uninterrupted");
+    let resumed_path = fresh_path("resumed");
+    let _ = std::fs::remove_dir_all(&uninterrupted_path);
+    let _ = std::fs::remove_dir_all(&resumed_path);
+    let first = Batch::new(1, vec![Edit::SetLiteral(a2(), 5)]).encode();
+    let formula = Batch::new(
+        2,
+        vec![Edit::SetFormula(b1(), Formula::Sum(Range::new(a2(), a2())))],
+    )
+    .encode();
+    let next = Batch::new(3, vec![Edit::SetLiteral(a1(), 99)]).encode();
+
+    let uninterrupted = {
+        let mut trial =
+            Trial::open(&uninterrupted_path, Workbook::deterministic_fixture()).unwrap();
+        trial.bootstrap().unwrap();
+        trial.apply(&first).unwrap();
+        trial.apply(&formula).unwrap();
+        trial.apply(&next).unwrap();
+        trial.reader().read()
+    };
+    let resumed = {
+        let mut trial = Trial::open(&resumed_path, Workbook::deterministic_fixture()).unwrap();
+        trial.bootstrap().unwrap();
+        trial.apply(&first).unwrap();
+        trial.apply(&formula).unwrap();
+        drop(trial);
+        let journal = vec![first.clone(), formula.clone()];
+        let mut trial =
+            Trial::recover_from_journal(&resumed_path, Workbook::deterministic_fixture(), &journal)
+                .unwrap();
+        trial.apply(&next).unwrap();
+        trial.reader().read()
+    };
+
+    assert_eq!(resumed, uninterrupted);
+    assert_eq!(resumed.canonical_bytes(), uninterrupted.canonical_bytes());
+    std::fs::remove_dir_all(uninterrupted_path).unwrap();
+    std::fs::remove_dir_all(resumed_path).unwrap();
+}
diff --git a/developer-simulation/runs/2026-08-15--incremental-calculation-cache/tests/demo.rs b/developer-simulation/runs/2026-08-15--incremental-calculation-cache/tests/demo.rs
new file mode 100644
index 0000000..b2be4a9
--- /dev/null
+++ b/developer-simulation/runs/2026-08-15--incremental-calculation-cache/tests/demo.rs
@@ -0,0 +1,26 @@
+use financial_snapshot_trial::{GateStatus, run_demo};
+
+#[test]
+fn demo_runs_repeatability_chunking_and_concurrency_checks() {
+    let path = std::env::temp_dir().join(format!("financial-snapshot-demo-{}", std::process::id()));
+    let _ = std::fs::remove_dir_all(&path);
+
+    let manifest = run_demo(&path).unwrap();
+
+    assert_eq!(manifest.clean_builds, 5);
+    assert_eq!(manifest.chunk_sizes, vec![1, 7, 64, 511, 4_096]);
+    assert_eq!(manifest.local_exactness, GateStatus::Pass);
+    assert_eq!(manifest.local_determinism, GateStatus::Pass);
+    assert_eq!(manifest.one_way_initialization_gate, GateStatus::Pass);
+    assert_eq!(manifest.recovery_continuation_gate, GateStatus::Pass);
+    assert_eq!(manifest.reader_tasks, 12);
+    assert!(manifest.read_requests >= 24_000);
+    assert_eq!(manifest.mixed_generation_responses, 0);
+    assert!(manifest.observed_single_store_disk_bytes > 0);
+    assert!(
+        manifest.observed_100_batch_store_disk_bytes > manifest.observed_single_store_disk_bytes
+    );
+    assert!(manifest.observed_total_test_disk_bytes > manifest.observed_single_store_disk_bytes);
+    assert_eq!(manifest.production_scale_gates, GateStatus::NotRun);
+    assert!(!path.exists(), "demo removes its data directory");
+}
diff --git a/developer-simulation/runs/2026-08-15--revision-safe-aircraft-manual-search/BRIEF.md b/developer-simulation/runs/2026-08-15--revision-safe-aircraft-manual-search/BRIEF.md
new file mode 100644
index 0000000..6d26bde
--- /dev/null
+++ b/developer-simulation/runs/2026-08-15--revision-safe-aircraft-manual-search/BRIEF.md
@@ -0,0 +1,124 @@
+# Trial 2 brief: Revision-safe offline aircraft-maintenance manual search
+
+## Developer role and Rust experience
+
+You maintain the offline search core of an established aircraft-maintenance tablet application.
+You have eleven years of production Kotlin experience and four months of Rust experience.
+You can integrate a Rust library through the application's existing native boundary.
+You have maintained SQLite full-text search but have not shipped a vector or hybrid retrieval system.
+
+## Existing system and baseline implementation
+
+The application installs signed, licensed manual packages while a tablet is connected at a maintenance base.
+It is then used without network access on the hangar floor.
+The signed package and its manifest are authoritative; any local search index is disposable.
+An existing, separately tested parser emits canonical section records and validates package signatures.
+Each record carries a stable section ID, revision ID, effective interval, title, body, identifiers, and an aircraft-applicability expression.
+The current baseline stores active text in SQLite full-text search and filters aircraft applicability after retrieving the top 20 lexical matches.
+It performs well for exact fault codes but poorly for technicians' terse symptoms and vocabulary differences.
+Post-ranking filtering can also remove all 20 candidates even when an eligible section ranked lower.
+The application team will retain the package parser and signature verifier.
+
+## Concrete pain point
+
+Technicians search phrases such as "pump chatters after cold soak" when the manual says "intermittent cavitation at low fluid temperature."
+Improving recall is valuable, but returning a section for the wrong aircraft configuration or superseded revision is unacceptable.
+The team wants to evaluate a local hybrid index that applies hard eligibility before final ranking and returns exact evidence.
+The index must survive interrupted updates without making search unavailable.
+A relevance improvement that weakens eligibility, privacy, or reproducibility is a no-fit result.
+
+## Workload and data shape
+
+The deterministic fixture contains exactly 2,400,000 section revisions from 600 manuals.
+Source text and metadata total 28 GiB after the existing parser emits canonical records.
+There are 400 aircraft configuration snapshots across 12 aircraft families.
+Each configuration supplies exactly 160 boolean, categorical, or bounded-integer attributes.
+Applicability expressions contain AND, OR, NOT, equality, membership, and closed integer ranges.
+At a selected effective time, 780,000 section revisions are active for the median configuration.
+Each stable section ID has between one and nine revisions, with exactly one active revision when the input is valid.
+Identifiers include fault codes, maintenance task numbers, part numbers, and standardized subsystem codes.
+Text includes abbreviations and approved synonyms in English; multilingual retrieval is outside this trial.
+Use a private judged benchmark of exactly 600 queries.
+Exactly 200 queries are identifier lookups, 200 are terse symptom descriptions, and 200 are paraphrases.
+Every judged query specifies an aircraft configuration snapshot and effective time.
+Use a separate deterministic latency trace of 5,000 queries in the same three query classes.
+
+## Operational constraints
+
+All indexing and queries run on a four-core CPU-only tablet with 8 GiB physical memory.
+Peak process memory must remain at or below 2 GiB.
+The complete local search generation must remain at or below 9 GiB on disk.
+An initial build from canonical records must finish within 45 minutes.
+A fortnightly delta generation containing up to 120,000 changed section revisions must activate within 8 minutes.
+There is no query-time or build-time network access.
+The application may issue sixteen concurrent searches while one updater builds the next generation.
+Existing readers must remain on the old complete generation until the new complete generation atomically activates.
+The 28 GiB source package is outside the search-index disk limit and remains read-only.
+
+## Compact prototype boundary
+
+Consume the existing parser's canonical records and a validated manifest; do not parse original publisher formats.
+Build only eligibility data, lexical and optional semantic retrieval data, deterministic ranking, exact citations, and generation activation.
+Compare against the existing SQLite full-text baseline on the same records and queries.
+If semantic retrieval is attempted, use only locally bundled model files with fixed versions and checksums.
+Return the top ten eligible section revisions with score components and exact source references.
+Source references must include manual ID, stable section ID, revision ID, and effective interval.
+Exercise one active generation and one staging generation in a single local data directory.
+Do not integrate with the production tablet shell or publisher download service.
+Produce a machine-readable report containing gates, recall, latency, memory, disk, and generation hashes.
+
+## Measurable acceptance criteria
+
+Across all 600 judged queries, every returned item must satisfy the selected aircraft applicability expression and effective time.
+Across all 600 judged queries, every returned item must be the active revision for its stable section ID.
+Identifier queries must achieve 100 percent recall at 5.
+Terse symptom queries must achieve at least 92 percent recall at 10.
+Paraphrase queries must achieve at least 82 percent recall at 10.
+The candidate must improve recall at 10 by at least 15 percentage points over the baseline on the combined 400 symptom and paraphrase queries.
+On the 5,000-query latency trace, p95 must be at or below 120 milliseconds and p99 at or below 250 milliseconds.
+All 5,000 latency queries must return without network access or generation mismatch.
+Initial build time, delta activation time, memory, and index size must meet every stated operational limit.
+Five clean builds of the same package must produce the same generation hash.
+The same query set must return the same ordered section and revision IDs across all five builds.
+Any ineligible or superseded result is an automatic no-fit outcome regardless of recall or speed.
+
+## Failure and crash cases
+
+Test a bad package signature, manifest hash mismatch, truncated canonical record, duplicate revision ID, and missing parent generation.
+Test two active revisions for one stable section ID and an applicability expression with an unknown attribute.
+Every such invalid input must reject the entire staging generation and preserve the active generation.
+Inject disk-full failures during record ingestion, index finalization, and activation.
+Inject 120 real process exits at deterministic boundaries across initial build, delta build, verification, and activation.
+After restart, queries must use either the complete old generation or the complete new generation, never a mixture.
+Orphaned staging data may be resumed or discarded, but it must not be searchable before complete validation.
+Corruption detected in the active generation must fail closed with a clear local error; it must not silently return unchecked results.
+
+## Concurrency, privacy, and determinism cases
+
+Run sixteen query workers continuously during each failure-free and crash-injected update.
+Tag every response with one generation hash and verify that all result evidence belongs to that generation.
+Tie-break equal scores by stable section ID and then revision ID.
+Fix tokenization, model checksum if used, score rounding, and candidate merge order.
+Changing worker count from one to four must not change ordered result IDs or source references.
+Manual text is licensed and must never leave the device.
+Queries may contain tail numbers or technician-entered observations and must not be stored after the response.
+Logs may include query class, timing, generation hash, and error code.
+Logs must not include raw queries, manual text, tail numbers, embeddings, or snippets.
+The test harness must verify zero attempted outbound connections.
+
+## Explicit non-goals
+
+Do not parse publisher PDF, XML, images, diagrams, or video in this prototype.
+Do not perform optical character recognition, speech input, translation, answer generation, or conversational follow-up.
+Do not change manual text, repair applicability metadata, or infer missing revisions.
+Do not implement package download, authentication, authorization, fleet assignment, or maintenance writeback.
+Do not learn ranking from technician clicks or send telemetry.
+Do not claim airworthiness approval or replace technician judgment.
+Do not broaden results by ignoring uncertain eligibility.
+
+## Decision rule
+
+Recommend continued evaluation only if every eligibility, revision, failure, privacy, concurrency, and determinism gate passes.
+Report exact, symptom, and paraphrase recall separately from latency and storage costs.
+If safety gates pass but recall or operational targets do not, report a bounded local proof rather than a fit.
+If safe pre-ranking filtering or atomic generation replacement cannot be expressed cleanly, report no fit.
diff --git a/developer-simulation/runs/2026-08-15--revision-safe-aircraft-manual-search/Cargo.toml b/developer-simulation/runs/2026-08-15--revision-safe-aircraft-manual-search/Cargo.toml
new file mode 100644
index 0000000..dd74572
--- /dev/null
+++ b/developer-simulation/runs/2026-08-15--revision-safe-aircraft-manual-search/Cargo.toml
@@ -0,0 +1,12 @@
+[package]
+name = "revision-safe-manual-search-trial"
+version = "0.1.0"
+edition = "2024"
+publish = false
+
+[dependencies]
+fold = { path = "../../../fold" }
+
+[lints.clippy]
+all = "deny"
+pedantic = "deny"
diff --git a/developer-simulation/runs/2026-08-15--revision-safe-aircraft-manual-search/DISCOVERY.md b/developer-simulation/runs/2026-08-15--revision-safe-aircraft-manual-search/DISCOVERY.md
new file mode 100644
index 0000000..1f55c82
--- /dev/null
+++ b/developer-simulation/runs/2026-08-15--revision-safe-aircraft-manual-search/DISCOVERY.md
@@ -0,0 +1,69 @@
+# Discovery trail
+
+## 1. Public-material hypothesis (before component internals)
+
+### Baseline first
+
+The existing SQLite full-text baseline is likely strong for exact identifiers and weak in two distinct ways that must be measured separately: vocabulary mismatch hurts recall, and retrieving a lexical top 20 before applying applicability can erase every candidate even when an eligible result exists below rank 20. The smallest useful fixture should first reproduce the second failure exactly, because semantic ranking cannot compensate for an unsafe candidate boundary.
+
+### Expected component fit
+
+- **Fold may fit bounded incremental materialization.** The public examples show persistent streams, transactional writes, consistent read snapshots, keyed replacement, and retraction. Those properties look useful for maintaining revision metadata and search views from canonical records.
+- **ESE may fit a small offline semantic experiment.** The public search example computes embeddings locally as a pure function, so it may help the symptom/paraphrase classes without sending licensed text or queries off-device.
+- **ANNy may fit unfiltered semantic candidates.** The public search example uses it for local HNSW retrieval and deletes replaced nodes rather than leaving tombstones.
+
+### Likely non-fit or unresolved areas
+
+- The public BM25 and HNSW examples expose only `search(query, limit)` / nearest-neighbor calls; they do not show a metadata predicate, allow-list, or filtered traversal. Post-filtering a fixed candidate list would repeat the baseline's safety/recall defect. A per-configuration index would duplicate a median 780,000 active revisions across 400 snapshots and therefore looks incompatible with the 9 GiB limit unless internals reveal a shared filtered-index design.
+- The examples demonstrate transactions inside one database, but not two complete on-disk generations, manifest validation, atomic activation across process exits, or fail-closed corruption behavior. These must not be inferred from the examples.
+- The hybrid example fuses candidates in a `HashMap` and sorts only by score; equal-score ordering is not explicitly tied by stable section ID and revision ID. The trial requires an explicit deterministic tie-break.
+- Nothing public establishes the 2.4-million-revision build, 16-reader concurrency, 2 GiB memory, 9 GiB disk, or crash-recovery targets. A compact run can only be a bounded local proof or exact failure reproducer, not evidence that those operational gates pass.
+
+### Planned decision test
+
+Inspect only the search and transaction surfaces needed to answer whether eligibility can be applied before bounded retrieval and whether generation replacement is an exposed capability. If no filtered retrieval surface exists, preserve a runnable baseline failure reproducer and, at most, a safe exhaustive toy proof using ESE over already-eligible records. That would be an honest overall no-fit for the stated acceptance criteria, even if the local semantic result is promising.
+
+## 2. Targeted internal inspection
+
+The initial hypothesis was confirmed for the relevant APIs:
+
+- `Bm25Reader::search(query, limit)` accumulates all lexical matches, sorts by score only, and then truncates to `limit`. It accepts no metadata predicate or allow-list. Equal scores have no stable-ID/revision-ID tie-break.
+- `HnswReader::search(vector)` returns up to its compile-time `TOP_K`; it accepts no metadata predicate or allow-list.
+- Fold's `Filter` is an ingest-time predicate captured in the pipeline. It cannot vary with the query's aircraft snapshot and effective time.
+- A Fold write transaction commits all sinks together, and a read transaction pins one consistent database snapshot. This is useful within one store, but it is not the brief's separately validated staging generation plus atomic active-generation switch.
+- The HNSW reader shares mutable graph state through `Rc<RefCell<...>>`; the inspected surface does not establish a sixteen-worker, updater-concurrent access model.
+
+Therefore, the public search skeleton cannot safely reuse a bounded global BM25 or HNSW candidate set for this workload. The next step is an exact 21-record reproducer: 20 ineligible records deliberately outrank one eligible record. The baseline will retrieve 20 then filter to zero; an exhaustive all-matches scan can recover the eligible record and return exact evidence, but is retained only as a bounded safety proof, not a scalable solution.
+
+## 3. Test-first RED evidence
+
+The acceptance test was written before the trial library existed. The first offline run failed to compile because the requested crate API did not exist. After adding only the public data shapes and an empty result stub, the meaningful RED run completed the real Fold fixture and reported:
+
+- 1 passing characterization: bounded BM25 top 20 contained no eligible record after filtering.
+- 6 failing desired behaviors: the complete-ranking path returned zero instead of document 21, did not reject duplicate revision IDs, did not reject two active revisions, did not reject an unknown attribute, did not reject missing metadata, and did not enforce deterministic tie ordering.
+
+This is the expected failure: tests reached real behavior and failed because the safety selection was not implemented, rather than because of a typo or fixture error.
+
+## 4. ESE packaging check and GREEN
+
+The ESE runtime is local once compiled, but its build script downloads model and tokenizer files from mutable `.../resolve/main/...` URLs when they are absent. The inspected build path does not pin or verify checksums. That does not meet this brief's clean-build requirement for locally bundled, fixed-version, checksummed model files, so ESE was not added to the prototype. This is a packaging/reproducibility issue independent of semantic quality.
+
+After implementing the initially declared validation subset, eligibility/effective-time filtering, exact evidence, and the required tie-break, all seven original library acceptance tests passed. A separate test was then written before the executable existed; it failed because no binary target was available, and passed after the minimal demo was added. The demo uses real Fold BM25 data and removes its temporary database on exit. The later skeptical review found that the original boundary validation was incomplete, as recorded next.
+
+## 5. Skeptical review round 1: rejected, reproduced, fixed
+
+The same skeptical reviewer marked Trial 2 `REJECTED_UNTIL_FIXED` with one Important prototype correctness finding. Two canonical metadata rows could share a `doc_id`; the later row silently replaced the earlier row in the lookup map, so reversing rows changed eligibility and evidence. A ranked list could also repeat one `doc_id` and return the same evidence twice. The reviewer accepted the no-fit product conclusion but rejected the retained prototype as archive evidence until identity validation was repaired.
+
+Three regressions were added before the fix:
+
+- reversed duplicate metadata rows must both return `DuplicateDocumentId` rather than an order-dependent result;
+- a repeated ranked key must return `DuplicateRankedDocumentId` rather than duplicate evidence;
+- reversing valid unique metadata rows must preserve the full eligible result and exact evidence.
+
+After adding only the two error shapes, the meaningful fix-round RED run executed 10 acceptance tests: 8 passed and the two defect reproducers failed. The duplicate metadata case returned `Ok([])` instead of `DuplicateDocumentId`, while the duplicate ranking case returned the same `EligibleHit` twice instead of `DuplicateRankedDocumentId`.
+
+The implementation now checks all canonical `doc_id` values for uniqueness before constructing the lookup map and checks all ranked `doc_id` values before selection. The GREEN run passed all 10 acceptance tests. This closes the review finding for the compact API while leaving the evidence-backed no-fit product decision unchanged.
+
+## 6. Fix-round verification
+
+Fresh offline verification after the repair passed formatting, 10 acceptance tests, the runnable demo test, strict Clippy with warnings plus `clippy::all` and `clippy::pedantic` denied, the standalone exact Fold BM25 cutoff reproducer, and the runnable demonstration. The demonstration still reports 20 bounded candidates, 0 eligible bounded results, 21 complete matches, 1 eligible exhaustive result, and the same exact evidence. The no-fit decision is unchanged.
diff --git a/developer-simulation/runs/2026-08-15--revision-safe-aircraft-manual-search/README.md b/developer-simulation/runs/2026-08-15--revision-safe-aircraft-manual-search/README.md
new file mode 100644
index 0000000..0eb78c6
--- /dev/null
+++ b/developer-simulation/runs/2026-08-15--revision-safe-aircraft-manual-search/README.md
@@ -0,0 +1,18 @@
+# Revision-safe manual search trial
+
+This is a bounded, synthetic failure reproducer for the aircraft-manual brief. It uses Fold BM25 to show that retrieving a global top 20 and then applying aircraft eligibility can return nothing even though an eligible matching section is ranked next.
+
+It also includes a deliberately exhaustive fallback that validates the complete fixture boundary before selection. It rejects repeated canonical document IDs, repeated ranked document IDs, duplicate revision IDs, overlapping active revisions, unknown applicability data, and missing ranked metadata. For valid unique input it filters active and applicable revisions before the final top ten, applies the required deterministic tie-break, and returns exact evidence. Reversing valid metadata rows does not change eligibility or evidence. This is safety-correct only for the tested 21-document fixture and is not presented as scalable to 2.4 million revisions.
+
+The first skeptical review round rejected the retained selection because repeated canonical IDs were overwritten in row order and repeated ranked IDs returned duplicate evidence. Fix round 1 added fail-closed typed errors plus permanent regressions for both cases and for valid metadata-order independence. The overall product decision remains no-fit because the BogKit search readers still lack bounded query-time eligibility filtering.
+
+Run everything from the repository root without network access and keep build output outside this checkout:
+
+```console
+cargo fmt --manifest-path developer-simulation/Cargo.toml --package revision-safe-manual-search-trial -- --check
+CARGO_TARGET_DIR=/private/tmp/bogkit-trial2-target cargo test --offline --locked --manifest-path developer-simulation/Cargo.toml --package revision-safe-manual-search-trial --all-targets
+CARGO_TARGET_DIR=/private/tmp/bogkit-trial2-target cargo clippy --offline --locked --manifest-path developer-simulation/Cargo.toml --package revision-safe-manual-search-trial --all-targets -- -D warnings -D clippy::all -D clippy::pedantic
+CARGO_TARGET_DIR=/private/tmp/bogkit-trial2-target cargo run --offline --quiet --manifest-path developer-simulation/Cargo.toml --package revision-safe-manual-search-trial
+```
+
+The demo reports zero eligible results from the bounded baseline, one from the exhaustive safety proof, and the exact manual, stable-section, revision, and effective-interval reference.
diff --git a/developer-simulation/runs/2026-08-15--revision-safe-aircraft-manual-search/machine-report.json b/developer-simulation/runs/2026-08-15--revision-safe-aircraft-manual-search/machine-report.json
new file mode 100644
index 0000000..dd5850a
--- /dev/null
+++ b/developer-simulation/runs/2026-08-15--revision-safe-aircraft-manual-search/machine-report.json
@@ -0,0 +1,76 @@
+{
+  "schema_version": 1,
+  "trial": "revision-safe-offline-aircraft-maintenance-manual-search",
+  "decision": "no_fit",
+  "decision_code": "global_indexes_lack_query_eligibility_filter",
+  "review": {
+    "round": 1,
+    "initial_verdict": "rejected_until_fixed",
+    "finding": "document_identity_validation_incomplete_and_order_dependent",
+    "fix_status": "implemented_pending_scoped_re_review"
+  },
+  "fixture": {
+    "kind": "synthetic_bounded_reproducer",
+    "documents": 21,
+    "ineligible_documents": 20,
+    "eligible_documents": 1,
+    "baseline_candidate_limit": 20,
+    "baseline_eligible_results": 0,
+    "complete_ranking_candidates": 21,
+    "safe_eligible_results": 1
+  },
+  "gates": {
+    "eligibility_all_600": "not_run",
+    "active_revision_all_600": "not_run",
+    "identifier_recall_at_5": "not_run",
+    "symptom_recall_at_10": "not_run",
+    "paraphrase_recall_at_10": "not_run",
+    "recall_improvement": "not_run",
+    "latency_5000": "not_run",
+    "initial_build": "not_run",
+    "delta_activation": "missing_capability",
+    "peak_memory": "not_run",
+    "index_disk": "not_run",
+    "five_generation_hashes": "missing_capability",
+    "five_build_ordered_results": "not_run",
+    "sixteen_query_workers_during_update": "missing_capability",
+    "crash_atomic_generation_visibility": "missing_capability",
+    "zero_runtime_network": "pass_by_design_for_bounded_demo",
+    "exact_source_evidence": "pass_on_bounded_fixture",
+    "exact_bm25_candidate_cutoff_reproducer": "pass_on_bounded_fixture",
+    "duplicate_canonical_document_id_rejection": "pass_on_bounded_fixture",
+    "duplicate_ranked_document_id_rejection": "pass_on_bounded_fixture",
+    "duplicate_revision_id_rejection": "pass_on_bounded_fixture",
+    "two_active_revision_rejection": "pass_on_bounded_fixture",
+    "unknown_attribute_rejection": "pass_on_bounded_fixture",
+    "missing_metadata_rejection": "pass_on_bounded_fixture",
+    "deterministic_tie_break": "pass_on_bounded_fixture",
+    "valid_metadata_order_independence": "pass_on_bounded_fixture"
+  },
+  "verification": {
+    "acceptance_tests": 10,
+    "demo_tests": 1,
+    "exact_bm25_reproducer_tests": 1,
+    "failures": 0,
+    "review_fix_round": 1
+  },
+  "metrics": {
+    "identifier_recall_at_5_percent": null,
+    "symptom_recall_at_10_percent": null,
+    "paraphrase_recall_at_10_percent": null,
+    "combined_recall_improvement_percentage_points": null,
+    "latency_p95_ms": null,
+    "latency_p99_ms": null,
+    "initial_build_seconds": null,
+    "delta_activation_seconds": null,
+    "peak_process_bytes": null,
+    "index_bytes": null,
+    "generation_hashes": []
+  },
+  "components": {
+    "fold_bm25": "used_for_failure_reproducer",
+    "fold_transactions": "inspected_but_not_equivalent_to_generation_activation",
+    "anny_hnsw": "not_used_no_query_filter_surface",
+    "ese": "not_used_build_fetches_unchecksummed_mutable_remote_assets"
+  }
+}
diff --git a/developer-simulation/runs/2026-08-15--revision-safe-aircraft-manual-search/src/lib.rs b/developer-simulation/runs/2026-08-15--revision-safe-aircraft-manual-search/src/lib.rs
new file mode 100644
index 0000000..9b9152f
--- /dev/null
+++ b/developer-simulation/runs/2026-08-15--revision-safe-aircraft-manual-search/src/lib.rs
@@ -0,0 +1,141 @@
+use std::collections::{HashMap, HashSet};
+
+use fold::pipeline::Scored;
+
+#[derive(Clone, Debug, Eq, PartialEq)]
+pub enum Applicability {
+    Known(bool),
+    UnknownAttribute(String),
+}
+
+#[derive(Clone, Debug, Eq, PartialEq)]
+pub struct Evidence {
+    pub manual_id: String,
+    pub stable_section_id: String,
+    pub revision_id: String,
+    pub effective_from: i64,
+    pub effective_until: i64,
+}
+
+#[derive(Clone, Debug, Eq, PartialEq)]
+pub struct RevisionMeta {
+    pub doc_id: u64,
+    pub evidence: Evidence,
+    pub applicability: Applicability,
+}
+
+#[derive(Clone, Debug, PartialEq)]
+pub struct EligibleHit {
+    pub doc_id: u64,
+    pub score: f64,
+    pub evidence: Evidence,
+}
+
+#[derive(Clone, Debug, Eq, PartialEq)]
+pub enum SafetyError {
+    DuplicateDocumentId { doc_id: u64 },
+    DuplicateRankedDocumentId { doc_id: u64 },
+    DuplicateRevisionId { revision_id: String },
+    MissingMetadata { doc_id: u64 },
+    TwoActiveRevisions { stable_section_id: String },
+    UnknownAttribute { attribute: String },
+}
+
+/// Validates canonical metadata, filters a complete lexical ranking to active
+/// and applicable revisions, applies the required deterministic tie-break,
+/// and returns exact source evidence.
+///
+/// # Errors
+///
+/// Returns [`SafetyError`] when canonical or ranked document IDs repeat, the
+/// input contains duplicate revision IDs or overlapping active revisions,
+/// applicability data is unknown, or a ranked document lacks canonical
+/// metadata.
+pub fn select_eligible_from_complete_ranking(
+    ranked: &[Scored<f64, u64>],
+    revisions: &[RevisionMeta],
+    effective_time: i64,
+    limit: usize,
+) -> Result<Vec<EligibleHit>, SafetyError> {
+    let mut document_ids = HashSet::with_capacity(revisions.len());
+    for revision in revisions {
+        if !document_ids.insert(revision.doc_id) {
+            return Err(SafetyError::DuplicateDocumentId {
+                doc_id: revision.doc_id,
+            });
+        }
+    }
+
+    let mut ranked_document_ids = HashSet::with_capacity(ranked.len());
+    for ranked_hit in ranked {
+        if !ranked_document_ids.insert(ranked_hit.val) {
+            return Err(SafetyError::DuplicateRankedDocumentId {
+                doc_id: ranked_hit.val,
+            });
+        }
+    }
+
+    let mut revision_ids = HashSet::with_capacity(revisions.len());
+    let mut active_sections = HashSet::with_capacity(revisions.len());
+    let mut by_doc_id = HashMap::with_capacity(revisions.len());
+
+    for revision in revisions {
+        if !revision_ids.insert(&revision.evidence.revision_id) {
+            return Err(SafetyError::DuplicateRevisionId {
+                revision_id: revision.evidence.revision_id.clone(),
+            });
+        }
+
+        if let Applicability::UnknownAttribute(attribute) = &revision.applicability {
+            return Err(SafetyError::UnknownAttribute {
+                attribute: attribute.clone(),
+            });
+        }
+
+        if revision.evidence.effective_from <= effective_time
+            && effective_time < revision.evidence.effective_until
+            && !active_sections.insert((
+                &revision.evidence.manual_id,
+                &revision.evidence.stable_section_id,
+            ))
+        {
+            return Err(SafetyError::TwoActiveRevisions {
+                stable_section_id: revision.evidence.stable_section_id.clone(),
+            });
+        }
+
+        by_doc_id.insert(revision.doc_id, revision);
+    }
+
+    let mut eligible = Vec::new();
+    for ranked_hit in ranked {
+        let revision = by_doc_id
+            .get(&ranked_hit.val)
+            .ok_or(SafetyError::MissingMetadata {
+                doc_id: ranked_hit.val,
+            })?;
+        let is_active = revision.evidence.effective_from <= effective_time
+            && effective_time < revision.evidence.effective_until;
+        if is_active && revision.applicability == Applicability::Known(true) {
+            eligible.push(EligibleHit {
+                doc_id: ranked_hit.val,
+                score: ranked_hit.score,
+                evidence: revision.evidence.clone(),
+            });
+        }
+    }
+
+    eligible.sort_by(|left, right| {
+        right
+            .score
+            .total_cmp(&left.score)
+            .then_with(|| {
+                left.evidence
+                    .stable_section_id
+                    .cmp(&right.evidence.stable_section_id)
+            })
+            .then_with(|| left.evidence.revision_id.cmp(&right.evidence.revision_id))
+    });
+    eligible.truncate(limit);
+    Ok(eligible)
+}
diff --git a/developer-simulation/runs/2026-08-15--revision-safe-aircraft-manual-search/src/main.rs b/developer-simulation/runs/2026-08-15--revision-safe-aircraft-manual-search/src/main.rs
new file mode 100644
index 0000000..d0028d4
--- /dev/null
+++ b/developer-simulation/runs/2026-08-15--revision-safe-aircraft-manual-search/src/main.rs
@@ -0,0 +1,89 @@
+use std::collections::HashMap;
+use std::fs;
+use std::path::PathBuf;
+
+use fold::pipeline::{Keyed, terminal::search::Bm25};
+use fold::stream::Stream;
+use revision_safe_manual_search_trial::{
+    Applicability, Evidence, RevisionMeta, select_eligible_from_complete_ranking,
+};
+
+const SELECTED_TIME: i64 = 1_750_000_000;
+
+struct TempStore(PathBuf);
+
+impl Drop for TempStore {
+    fn drop(&mut self) {
+        let _ = fs::remove_dir_all(&self.0);
+    }
+}
+
+fn revision(doc_id: u64, applicable: bool) -> RevisionMeta {
+    RevisionMeta {
+        doc_id,
+        evidence: Evidence {
+            manual_id: "AMM-32".to_string(),
+            stable_section_id: format!("32-40-{doc_id:02}"),
+            revision_id: format!("R-{doc_id:02}"),
+            effective_from: 1_700_000_000,
+            effective_until: 1_800_000_000,
+        },
+        applicability: Applicability::Known(applicable),
+    }
+}
+
+fn main() {
+    let store =
+        TempStore(std::env::temp_dir().join(format!("bogkit-trial2-demo-{}", std::process::id())));
+    let _ = fs::remove_dir_all(&store.0);
+
+    let mut stream = Stream::new(&store.0, Bm25::new("manual_text"));
+    stream.wtx(|tx| {
+        for doc_id in 1_u64..=20 {
+            tx.insert(&Keyed::new(
+                doc_id,
+                "pump chatter cold soak pump chatter cold soak".to_string(),
+            ));
+        }
+        tx.insert(&Keyed::new(21_u64, "pump".to_string()));
+    });
+
+    let mut revisions = (1_u64..=20)
+        .map(|doc_id| revision(doc_id, false))
+        .collect::<Vec<_>>();
+    revisions.push(revision(21, true));
+    let applicable = revisions
+        .iter()
+        .map(|revision| {
+            (
+                revision.doc_id,
+                revision.applicability == Applicability::Known(true),
+            )
+        })
+        .collect::<HashMap<_, _>>();
+
+    let baseline = stream.rtx(|index| index.search("pump chatter cold soak", 20));
+    let baseline_eligible = baseline
+        .iter()
+        .filter(|hit| applicable.get(&hit.val) == Some(&true))
+        .count();
+    let complete = stream.rtx(|index| index.search("pump chatter cold soak", 21));
+    let safe = select_eligible_from_complete_ranking(&complete, &revisions, SELECTED_TIME, 10)
+        .expect("the validated fixture must pass safety selection");
+    let top = safe.first().expect("the eligible record must be recovered");
+
+    println!("documents={}", revisions.len());
+    println!("baseline_candidate_limit={}", baseline.len());
+    println!("baseline_eligible_results={baseline_eligible}");
+    println!("complete_ranking_candidates={}", complete.len());
+    println!("safe_eligible_results={}", safe.len());
+    println!(
+        "top_evidence={}|{}|{}|{}..{}",
+        top.evidence.manual_id,
+        top.evidence.stable_section_id,
+        top.evidence.revision_id,
+        top.evidence.effective_from,
+        top.evidence.effective_until
+    );
+    println!("decision=NO_FIT_GLOBAL_INDEX_HAS_NO_QUERY_ELIGIBILITY_FILTER");
+}
diff --git a/developer-simulation/runs/2026-08-15--revision-safe-aircraft-manual-search/tests/acceptance.rs b/developer-simulation/runs/2026-08-15--revision-safe-aircraft-manual-search/tests/acceptance.rs
new file mode 100644
index 0000000..facc712
--- /dev/null
+++ b/developer-simulation/runs/2026-08-15--revision-safe-aircraft-manual-search/tests/acceptance.rs
@@ -0,0 +1,243 @@
+use std::collections::HashMap;
+use std::fs;
+use std::path::PathBuf;
+
+use fold::pipeline::{Keyed, Scored, terminal::search::Bm25};
+use fold::stream::Stream;
+use revision_safe_manual_search_trial::{
+    Applicability, Evidence, RevisionMeta, SafetyError, select_eligible_from_complete_ranking,
+};
+
+const SELECTED_TIME: i64 = 1_750_000_000;
+
+fn temp_store(label: &str) -> PathBuf {
+    std::env::temp_dir().join(format!("bogkit-trial2-{label}-{}", std::process::id()))
+}
+
+fn revision(doc_id: u64, applicable: Applicability) -> RevisionMeta {
+    RevisionMeta {
+        doc_id,
+        evidence: Evidence {
+            manual_id: "AMM-32".to_string(),
+            stable_section_id: format!("32-40-{doc_id:02}"),
+            revision_id: format!("R-{doc_id:02}"),
+            effective_from: 1_700_000_000,
+            effective_until: 1_800_000_000,
+        },
+        applicability: applicable,
+    }
+}
+
+fn ranked_fixture(limit: usize, label: &str) -> (Vec<Scored<f64, u64>>, Vec<RevisionMeta>) {
+    let store = temp_store(label);
+    let _ = fs::remove_dir_all(&store);
+
+    let mut stream = Stream::new(&store, Bm25::new("manual_text"));
+    stream.wtx(|tx| {
+        for doc_id in 1_u64..=20 {
+            tx.insert(&Keyed::new(
+                doc_id,
+                "pump chatter cold soak pump chatter cold soak".to_string(),
+            ));
+        }
+        tx.insert(&Keyed::new(21_u64, "pump".to_string()));
+    });
+
+    let ranked = stream.rtx(|index| index.search("pump chatter cold soak", limit));
+    drop(stream);
+    fs::remove_dir_all(&store).expect("fixture store should be removable");
+
+    let mut revisions = (1_u64..=20)
+        .map(|doc_id| revision(doc_id, Applicability::Known(false)))
+        .collect::<Vec<_>>();
+    revisions.push(revision(21, Applicability::Known(true)));
+    (ranked, revisions)
+}
+
+#[test]
+fn bounded_top_twenty_then_filter_loses_the_lower_eligible_revision() {
+    let (ranked, revisions) = ranked_fixture(20, "bounded-baseline");
+    let applicability = revisions
+        .iter()
+        .map(|revision| {
+            (
+                revision.doc_id,
+                matches!(revision.applicability, Applicability::Known(true)),
+            )
+        })
+        .collect::<HashMap<_, _>>();
+
+    let eligible = ranked
+        .iter()
+        .filter(|hit| applicability.get(&hit.val) == Some(&true))
+        .collect::<Vec<_>>();
+
+    assert_eq!(ranked.len(), 20);
+    assert!(ranked.iter().all(|hit| hit.val != 21));
+    assert!(eligible.is_empty());
+}
+
+#[test]
+fn complete_ranking_filters_eligibility_before_final_top_ten() {
+    let (ranked, revisions) = ranked_fixture(21, "complete-ranking");
+
+    let hits = select_eligible_from_complete_ranking(&ranked, &revisions, SELECTED_TIME, 10)
+        .expect("valid fixture should search safely");
+
+    assert_eq!(hits.len(), 1);
+    assert_eq!(hits[0].doc_id, 21);
+    assert_eq!(hits[0].evidence.manual_id, "AMM-32");
+    assert_eq!(hits[0].evidence.stable_section_id, "32-40-21");
+    assert_eq!(hits[0].evidence.revision_id, "R-21");
+    assert_eq!(hits[0].evidence.effective_from, 1_700_000_000);
+    assert_eq!(hits[0].evidence.effective_until, 1_800_000_000);
+}
+
+#[test]
+fn two_active_revisions_for_one_stable_section_fail_closed() {
+    let ranked = vec![Scored::new(1.0, 1_u64), Scored::new(0.9, 2_u64)];
+    let mut first = revision(1, Applicability::Known(true));
+    let mut second = revision(2, Applicability::Known(true));
+    first.evidence.stable_section_id = "32-40-PUMP".to_string();
+    second.evidence.stable_section_id = "32-40-PUMP".to_string();
+
+    let error = select_eligible_from_complete_ranking(&ranked, &[first, second], SELECTED_TIME, 10)
+        .expect_err("overlapping active revisions must reject the complete input");
+
+    assert_eq!(
+        error,
+        SafetyError::TwoActiveRevisions {
+            stable_section_id: "32-40-PUMP".to_string(),
+        }
+    );
+}
+
+#[test]
+fn unknown_applicability_attribute_fails_closed() {
+    let ranked = vec![Scored::new(1.0, 1_u64)];
+    let revisions = vec![revision(
+        1,
+        Applicability::UnknownAttribute("winglet_mod".to_string()),
+    )];
+
+    let error = select_eligible_from_complete_ranking(&ranked, &revisions, SELECTED_TIME, 10)
+        .expect_err("unknown applicability input must reject the complete input");
+
+    assert_eq!(
+        error,
+        SafetyError::UnknownAttribute {
+            attribute: "winglet_mod".to_string(),
+        }
+    );
+}
+
+#[test]
+fn duplicate_revision_id_fails_closed() {
+    let ranked = vec![Scored::new(1.0, 1_u64), Scored::new(0.9, 2_u64)];
+    let first = revision(1, Applicability::Known(true));
+    let mut second = revision(2, Applicability::Known(true));
+    second.evidence.revision_id = first.evidence.revision_id.clone();
+
+    let error = select_eligible_from_complete_ranking(&ranked, &[first, second], SELECTED_TIME, 10)
+        .expect_err("duplicate revision IDs must reject the complete input");
+
+    assert_eq!(
+        error,
+        SafetyError::DuplicateRevisionId {
+            revision_id: "R-01".to_string(),
+        }
+    );
+}
+
+#[test]
+fn ranked_document_without_metadata_fails_closed() {
+    let ranked = vec![Scored::new(1.0, 99_u64)];
+
+    let error = select_eligible_from_complete_ranking(&ranked, &[], SELECTED_TIME, 10)
+        .expect_err("a ranked document without canonical metadata must fail closed");
+
+    assert_eq!(error, SafetyError::MissingMetadata { doc_id: 99 });
+}
+
+#[test]
+fn duplicate_metadata_doc_id_is_rejected_regardless_of_row_order() {
+    let ranked = vec![Scored::new(1.0, 41_u64)];
+    let eligible = revision(41, Applicability::Known(true));
+    let mut ineligible = revision(42, Applicability::Known(false));
+    ineligible.doc_id = 41;
+
+    let forward = select_eligible_from_complete_ranking(
+        &ranked,
+        &[eligible.clone(), ineligible.clone()],
+        SELECTED_TIME,
+        10,
+    );
+    let reversed =
+        select_eligible_from_complete_ranking(&ranked, &[ineligible, eligible], SELECTED_TIME, 10);
+    let expected = Err(SafetyError::DuplicateDocumentId { doc_id: 41 });
+
+    assert_eq!(forward, expected);
+    assert_eq!(reversed, expected);
+}
+
+#[test]
+fn duplicate_ranked_doc_id_fails_closed() {
+    let ranked = vec![Scored::new(1.0, 1_u64), Scored::new(0.9, 1_u64)];
+    let revisions = vec![revision(1, Applicability::Known(true))];
+
+    let error = select_eligible_from_complete_ranking(&ranked, &revisions, SELECTED_TIME, 10)
+        .expect_err("a duplicate ranked key must reject the complete input");
+
+    assert_eq!(error, SafetyError::DuplicateRankedDocumentId { doc_id: 1 });
+}
+
+#[test]
+fn unique_metadata_row_order_does_not_change_eligibility_or_evidence() {
+    let ranked = vec![Scored::new(1.0, 1_u64), Scored::new(0.9, 2_u64)];
+    let eligible = revision(1, Applicability::Known(true));
+    let ineligible = revision(2, Applicability::Known(false));
+
+    let forward = select_eligible_from_complete_ranking(
+        &ranked,
+        &[eligible.clone(), ineligible.clone()],
+        SELECTED_TIME,
+        10,
+    )
+    .expect("unique metadata should be accepted");
+    let reversed =
+        select_eligible_from_complete_ranking(&ranked, &[ineligible, eligible], SELECTED_TIME, 10)
+            .expect("metadata order must not affect valid selection");
+
+    assert_eq!(forward, reversed);
+    assert_eq!(forward.len(), 1);
+    assert_eq!(forward[0].doc_id, 1);
+    assert_eq!(forward[0].evidence.manual_id, "AMM-32");
+    assert_eq!(forward[0].evidence.stable_section_id, "32-40-01");
+    assert_eq!(forward[0].evidence.revision_id, "R-01");
+}
+
+#[test]
+fn equal_scores_tie_break_by_stable_section_then_revision() {
+    let ranked = vec![
+        Scored::new(1.0, 3_u64),
+        Scored::new(1.0, 2_u64),
+        Scored::new(1.0, 1_u64),
+    ];
+    let mut z = revision(1, Applicability::Known(true));
+    let mut a2 = revision(2, Applicability::Known(true));
+    let mut a1 = revision(3, Applicability::Known(true));
+    z.evidence.stable_section_id = "Z".to_string();
+    z.evidence.revision_id = "R-Z".to_string();
+    a2.evidence.stable_section_id = "A".to_string();
+    a2.evidence.revision_id = "R-2".to_string();
+    a2.evidence.manual_id = "AMM-B".to_string();
+    a1.evidence.stable_section_id = "A".to_string();
+    a1.evidence.revision_id = "R-1".to_string();
+    a1.evidence.manual_id = "AMM-C".to_string();
+
+    let hits = select_eligible_from_complete_ranking(&ranked, &[z, a2, a1], SELECTED_TIME, 10)
+        .expect("valid ties should be ordered deterministically");
+
+    let ordered_ids = hits.iter().map(|hit| hit.doc_id).collect::<Vec<_>>();
+    assert_eq!(ordered_ids, vec![3, 2, 1]);
+}
diff --git a/developer-simulation/runs/2026-08-15--revision-safe-aircraft-manual-search/tests/demo.rs b/developer-simulation/runs/2026-08-15--revision-safe-aircraft-manual-search/tests/demo.rs
new file mode 100644
index 0000000..1f3e797
--- /dev/null
+++ b/developer-simulation/runs/2026-08-15--revision-safe-aircraft-manual-search/tests/demo.rs
@@ -0,0 +1,23 @@
+use std::process::Command;
+
+#[test]
+fn runnable_demo_reports_the_exact_baseline_failure_and_bounded_safe_result() {
+    let output = Command::new(env!("CARGO_BIN_EXE_revision-safe-manual-search-trial"))
+        .output()
+        .expect("demo binary should run");
+
+    assert!(output.status.success());
+    assert!(output.stderr.is_empty());
+    assert_eq!(
+        String::from_utf8(output.stdout).expect("demo output should be UTF-8"),
+        concat!(
+            "documents=21\n",
+            "baseline_candidate_limit=20\n",
+            "baseline_eligible_results=0\n",
+            "complete_ranking_candidates=21\n",
+            "safe_eligible_results=1\n",
+            "top_evidence=AMM-32|32-40-21|R-21|1700000000..1800000000\n",
+            "decision=NO_FIT_GLOBAL_INDEX_HAS_NO_QUERY_ELIGIBILITY_FILTER\n",
+        )
+    );
+}
diff --git a/developer-simulation/runs/2026-08-16--causal-canvas-compaction/BRIEF.md b/developer-simulation/runs/2026-08-16--causal-canvas-compaction/BRIEF.md
new file mode 100644
index 0000000..df6adda
--- /dev/null
+++ b/developer-simulation/runs/2026-08-16--causal-canvas-compaction/BRIEF.md
@@ -0,0 +1,133 @@
+# Trial 1 brief: Causal canvas-history compaction
+
+## Developer role and Rust experience
+
+- You maintain synchronization for a collaborative diagram and whiteboard service.
+- You have seven years of production TypeScript and Go experience.
+- You have used Rust for one internal service for about nine months.
+- You are comfortable with ownership and async code but not advanced type-level techniques.
+
+## Existing system and baseline implementation
+
+- Browser clients create immutable operations for shapes, text blocks, connectors, and layers.
+- Each operation has a document ID, actor ID, per-actor sequence, dependency clock, and payload.
+- A WebSocket service relays operations and appends them to a PostgreSQL table.
+- A TypeScript reducer reconstructs a document from a snapshot plus later operations.
+- The reducer uses last-writer-wins registers for scalar fields and ordered identifiers for lists.
+- Deletions leave tombstones so delayed moves or edits cannot incorrectly recreate an object.
+- Every 10,000 accepted operations per document, a background job writes a full snapshot.
+- The baseline keeps all operations and tombstones for 30 days, then runs a bespoke compactor.
+- PostgreSQL remains the production authority for accepted operations and snapshot generations.
+
+## Concrete pain
+
+- Busy documents accumulate several gigabytes of operations and hundreds of thousands of tombstones.
+- A reconnecting client may download far more history than the current canvas contents require.
+- The compactor has twice removed metadata needed by a client that was offline for several weeks.
+- One incident caused two clients to show different connector endpoints until a full reload.
+- Engineers do not trust changes because the baseline tests cover only a few hand-written schedules.
+- The team wants a smaller, independently testable compaction and replay core.
+- A replacement is useful only if it preserves the existing operation semantics exactly.
+
+## Workload and data shape
+
+- The production service has 5,000 active documents and about 40 million operations per day.
+- The prototype fixture contains 100 documents and exactly 5,000,000 accepted operations.
+- Each document has 64 actors and between 25,000 and 75,000 operations.
+- A typical operation is 180 bytes; the largest permitted payload is 64 KiB.
+- Operations cover create, set-property, move, list-insert, list-delete, and object-delete.
+- Exactly 8% of fixture deliveries are duplicates and 12% arrive out of causal order.
+- Five percent of actors disappear for 7 to 30 simulated days before reconnecting.
+- The largest final document has 40,000 live objects and 20,000 retained list elements.
+- Logical time is integer based; wall-clock arrival time cannot resolve concurrent edits.
+
+## Operational constraints
+
+- Existing operation IDs, merge rules, and canonical JSON output cannot change.
+- The production database and WebSocket protocol cannot be replaced in this trial.
+- The supported offline window is 30 full days from an acknowledged server watermark.
+- A client within that window must be able to catch up without a destructive full reset.
+- Clients older than the window may be told to fetch a fresh snapshot before submitting edits.
+- Compaction may run concurrently with new appends but publishes only complete generations.
+- Readers must observe either the prior generation or the complete next generation.
+- The prototype runs on two CPU cores with 1 GiB of memory and no network access.
+- Hash-map iteration order, thread timing, and input batch boundaries must not affect output.
+- Untrusted payloads must return bounded errors rather than panic or allocate without limit.
+
+## Measurable acceptance criteria
+
+- For 50 generated histories and 20 delivery schedules each, all replicas end byte-identically.
+- The result must match the un-compacted TypeScript baseline's canonical JSON for every history.
+- Every reconnecting actor aged 30 days or less must apply its pending valid operations successfully.
+- An actor older than 30 days must receive one deterministic `snapshot_required` decision.
+- Duplicate delivery must never change state, counters, or the final digest.
+- A conflicting reuse of an operation ID must be rejected and must not change visible state.
+- Compacted retained bytes must be at most 40% of the uncompacted fixture bytes.
+- Replaying all 5,000,000 operations must finish within 75 seconds on the declared machine.
+- Peak measured resident memory must remain below 768 MiB.
+- Applying a 200-operation batch must have p95 latency below 4 milliseconds after warm-up.
+- Opening the largest compacted document must finish within 750 milliseconds.
+- Twenty randomized input batchings must produce byte-identical snapshots and manifests.
+- Every injected publication crash must leave either the prior or next valid generation readable.
+- After restart, re-running compaction must be idempotent and produce the same generation digest.
+
+## Explicit non-goals
+
+- Do not build a browser interface, drawing engine, or WebSocket server.
+- Do not redesign conflict semantics or introduce user-visible conflict resolution.
+- Do not implement branching undo, comments, presence, cursors, or access control.
+- Do not replace PostgreSQL or test horizontal database coordination.
+- Do not support clients offline for more than 30 days without a snapshot reset.
+- Do not compress media attachments or inspect their contents.
+- Do not claim Byzantine protection; authenticated service clients are assumed.
+
+## Compact self-contained prototype boundary
+
+- Build one Rust library plus one command-line harness.
+- Input is a directory of NDJSON operations, actor watermarks, and crash schedules.
+- The library exposes validate, apply, compact, reopen, and canonical-snapshot operations.
+- The harness can run the baseline oracle and compare canonical outputs and error codes.
+- Store prototype state in one replaceable local directory, separate from fixture input.
+- Use only the six declared operation kinds and the existing merge rules described above.
+- Generate the 100-document fixture from a fixed seed and save only its recipe and digests.
+- The deliverable is source, tests, benchmark output, and a short fit decision.
+- Time-box implementation and investigation to two developer days.
+
+## Fault, crash, and adversarial cases
+
+- Deliver valid operations in reverse actor order and in 20 random interleavings.
+- Repeat individual operations and whole batches before and after restart.
+- Reuse an operation ID with a different payload, dependency clock, or document ID.
+- Supply missing dependencies, dependency cycles, actor-sequence gaps, and sequence overflow.
+- Delete an object concurrently with property edits, moves, and connector changes.
+- Reinsert list elements whose neighbors were deleted and later compacted.
+- Reconnect actors at 29 days 23 hours 59 minutes and at 30 days plus one minute.
+- Truncate an input line and supply invalid UTF-8, oversized payloads, and unknown operation kinds.
+- Terminate after generation creation, data flush, manifest flush, rename, and directory sync.
+- Simulate disk-full errors at each publication stage and retry with the same input.
+- Corrupt the newest generation manifest and confirm deterministic fallback or hard failure.
+
+## Evidence for the fit decision
+
+### Keep the baseline
+
+- Keep it if the prototype fails any convergence, offline-window, or crash-safety criterion.
+- Keep it if retained-byte reduction is below 60% after equivalent metadata is counted.
+- Keep it if integration requires changing operation semantics, IDs, or the production authority.
+- Keep it if the new core is slower and does not remove a meaningful amount of custom logic.
+
+### Adopt a component
+
+- Adopt only the narrow component that passes every correctness and recovery test.
+- Require at least a 60% byte reduction, the latency targets, and stable memory use.
+- Require a clear boundary that lets PostgreSQL and the TypeScript oracle remain in place.
+- Require ordinary error handling and enough inspectability to explain retained metadata.
+- Prefer staged shadow replay on recorded histories before any production read path changes.
+
+### Conclude no fit
+
+- Conclude no fit if safe collection needs causal semantics the candidate cannot represent.
+- Conclude no fit if complete-generation publication needs an external transaction it lacks.
+- Conclude no fit if bounded adversarial input handling depends on pervasive custom wrappers.
+- Conclude no fit if using it adds storage duplication without replacing baseline complexity.
+- A no-fit result is acceptable and should preserve all measured counterexamples.
diff --git a/developer-simulation/runs/2026-08-16--causal-canvas-compaction/Cargo.toml b/developer-simulation/runs/2026-08-16--causal-canvas-compaction/Cargo.toml
new file mode 100644
index 0000000..f47fd0c
--- /dev/null
+++ b/developer-simulation/runs/2026-08-16--causal-canvas-compaction/Cargo.toml
@@ -0,0 +1,16 @@
+[package]
+name = "causal-canvas-compaction"
+version = "0.1.0"
+edition = "2024"
+publish = false
+
+[dependencies]
+serde = { version = "1", features = ["derive"] }
+serde_json = "1"
+sha2 = "0.10"
+
+[dev-dependencies]
+fold = { path = "../../../fold" }
+
+[lints.rust]
+unsafe_code = "forbid"
diff --git a/developer-simulation/runs/2026-08-16--causal-canvas-compaction/DISCOVERY.md b/developer-simulation/runs/2026-08-16--causal-canvas-compaction/DISCOVERY.md
new file mode 100644
index 0000000..ff1d7cb
--- /dev/null
+++ b/developer-simulation/runs/2026-08-16--causal-canvas-compaction/DISCOVERY.md
@@ -0,0 +1,61 @@
+# Discovery notes
+
+## Baseline-first hypothesis
+
+The production baseline should remain authoritative unless a narrow BogKit component can preserve the existing causal operation semantics, the full 30-day reconnect contract, and atomic generation publication without merely moving the bespoke logic elsewhere. The smallest useful experiment is therefore not a new database. It is an independent replay/compaction core with a literal oracle scenario and a replaceable local generation directory, while PostgreSQL and the TypeScript reducer remain outside the prototype boundary.
+
+Before reading component implementation, my expectation is that most of the hard problem is domain-specific: dependency validation, operation identity, deterministic last-writer ordering, tombstone retention against acknowledged actor watermarks, canonical JSON, and complete-generation publication. A generic incremental view engine could potentially help with current-state materialization, but only if it also exposes enough identity, ordering, deletion, persistence, and transaction behavior to avoid duplicating those rules. The initial experiment could only exercise ordinary returned errors at stage boundaries; process crash and I/O-fault evidence would require a separate harness.
+
+## What the public material led me to expect
+
+- The root README describes Fold as a persistent incremental-programming framework with iterator-like materialization primitives.
+- The starter example demonstrates transactional fan-out to a count and a durable bag, consistent snapshot reads, exact-record retraction, and reopenable storage.
+- The timeseries example demonstrates keyed aggregation and retraction-driven updates, but no causal clock or compaction policy.
+- The chat example shows a single-writer ownership pattern and publishes a freshly read consistent snapshot after each committed write. This looks relevant to visibility within one Fold database, not necessarily to atomic replacement of an externally visible multi-file generation.
+- The search example presents `KeyedStream` upsert/remove behavior and HNSW/BM25 views. It says HNSW deletion avoids tombstones for search churn, which is not equivalent to the canvas tombstones required to reject delayed edits.
+- ESE is presented as static text embedding and ANNy as HNSW approximate-nearest-neighbor indexing. Neither public example suggests causal replay, compaction, or generation publication behavior.
+- No component README was present; the only public component overview was the root README, supplemented by the public examples.
+
+Sequence correction: my initial case-sensitive `README*` inventory missed the three lowercase `readme.md` files. I discovered them from component manifest metadata after writing the first version of this note, but before opening any implementation source, and read them immediately. Fold's component README explicitly promises delta-based incremental materialization, fjall-backed transactional/crash-safe writes, and consistent snapshots across sinks. ANNy's confirms a no-dependency in-memory HNSW index; ESE's confirms two text-embedding functions. These details strengthen, rather than change, the hypotheses below. The inventory miss itself is recorded as discovery friction.
+
+## Components considered
+
+### Fold
+
+Potentially relevant for persistent, incrementally maintained views and consistent transactions. Concrete fit questions to answer from the smallest source surface:
+
+1. Can inputs carry the existing operation identity and be deduplicated or conflict-checked without a parallel custom index?
+2. Does persisted iteration have a documented deterministic order suitable for canonical bytes, or must the caller sort?
+3. Can a keyed row be atomically compared and updated, or does conflict-safe apply require separate application logic?
+4. What durability and crash guarantees does a write transaction provide, and do they extend to complete-generation directory publication?
+5. Can retention decisions inspect per-actor dependency/watermark metadata, or is that necessarily custom logic?
+6. Does the API bound decoded payload size before allocation?
+
+### ESE
+
+Initially no fit. The workload has no semantic-search or embedding requirement. Retaining it would add model/runtime/data concerns without replacing causal replay or compaction logic. I will inspect only enough public API/source metadata to confirm the absence of a relevant storage or causal primitive if needed.
+
+### ANNy
+
+Initially no fit. Approximate-nearest-neighbor search does not express exact operation identity, dependency clocks, list ordering, tombstones, or atomic generation publication. The example's deletion behavior is specifically inappropriate as a substitute for causal tombstone retention. I will inspect only enough public API/source metadata to confirm that it is an index rather than a replay/compaction store if needed.
+
+## Initial fit/no-fit questions
+
+- Can Fold eliminate a meaningful part of the bespoke correctness surface, or would it merely duplicate current state beside the authoritative operation/snapshot data?
+- Are Fold's transactions sufficient only inside one store, leaving the required prior-or-next directory publication protocol custom?
+- Would exact deterministic output require sorting all materialized rows in the caller, reducing the value of the component for canonical snapshots?
+- Does safe collection still require domain-specific acknowledgment and dependency-frontier proofs that none of the three components represents?
+- If those answers are unfavorable, the honest result is a standalone reduced-model reproducer plus an evidence-backed no-fit decision, not an adoption claim.
+
+## Intended prototype and evidence limits
+
+I intend to build a small Rust library and CLI that models a narrow but causal subset of the brief: scalar property writes and object deletion across multiple actors, exact operation identity, causal buffering, deterministic last-writer selection, actor-age decisions, conservative compaction, and replaceable generation publication. Tests will derive expected canonical JSON and digests from literal scenarios rather than from the implementation. This reduced model can expose integration and safety boundaries; it cannot prove parity with the unavailable TypeScript reducer, all six operation kinds, the 5,000,000-operation fixture, PostgreSQL coordination, or a production crash model.
+
+## Reviewer fix round 1/5 discovery correction
+
+The initial handoff was `REJECTED_UNTIL_FIXED` after independent lifecycle tests found two prototype correctness defects and one evidence defect. The corrections changed the trial evidence as follows:
+
+1. Operation identity is not catch-up history. Reconstructing the identity map from retained operations allowed a compacted-away ID to be reused with different bytes after reopen. The prototype must persist one compact canonical SHA-256 fingerprint for every accepted ID whose reuse remains forbidden, including IDs from other document IDs if identity is global.
+2. Selected payload digests do not bind semantic manifest metadata. `reconnect_decisions` could be changed while all three selected digests still passed. The complete canonical manifest bytes now require a separately stored SHA-256 digest; this detects a changed field and makes `open_latest` fall back or fail. This is an integrity check, not keyed authentication or Byzantine protection.
+3. Stage-return injection is not termination or an I/O fault. The code returns an ordinary error after each of five completed stages. It does not kill a child, interrupt a write, synthesize disk-full/permission errors, exercise `CURRENT` sub-stages, or test process/host crash or power loss. The CLI only parses and shape-validates `crash_schedules.json`; it does not execute the schedules.
+4. Correct permanent identity metadata changes the fit evidence. On the same hand-built overwrite-heavy input, compacted bytes are 3,719/8,670 (42.90%), so the brief's at-most-40% gate now fails. This strengthens the original baseline/no-fit decision and invalidates the initial handoff's synthetic PASS claim.
diff --git a/developer-simulation/runs/2026-08-16--causal-canvas-compaction/README.md b/developer-simulation/runs/2026-08-16--causal-canvas-compaction/README.md
new file mode 100644
index 0000000..f9d32ab
--- /dev/null
+++ b/developer-simulation/runs/2026-08-16--causal-canvas-compaction/README.md
@@ -0,0 +1,100 @@
+# Causal canvas compaction experiment
+
+This is a deliberately reduced Rust replay and generation-publication core for the Trial 1 brief. It is runnable and independently tested, but it is not a production replacement for the TypeScript reducer or PostgreSQL authority.
+
+The fit decision is **keep the baseline; adopt no BogKit component for this compaction core**. Fold is useful for persistent incremental views, but its generic keyed upsert is arrival-ordered unless the application first supplies the canvas-specific causal winner. ESE and ANNy solve embedding and approximate-search problems that are absent here.
+
+## What the prototype covers
+
+- the six declared operation kinds;
+- per-document/per-actor sequence and dependency buffering;
+- exact duplicate no-op and conflicting operation-ID rejection, including after compaction, publication, and reopen;
+- a declared reduced causal LWW rule for scalar properties and moves;
+- permanent object and list-element tombstones;
+- deterministic ordered-list traversal even when an anchor is deleted;
+- bounded NDJSON lines, payloads, pending operations, UTF-8, JSON, kind, and sequence errors;
+- exact 30-day reconnect decisions and watermark-based retained history;
+- deterministic canonical JSON, SHA-256 payload digests, and a separately stored SHA-256 digest over every manifest byte;
+- complete-generation local publication, fsync, atomic rename, retry, and validated fallback;
+- ordinary in-process returned errors after five completed publication stages;
+- a CLI replay path from the declared input-directory shape.
+
+## Important limits
+
+The production TypeScript implementation and its canonical fixtures were not supplied. The reduced LWW tie-break here is: causal descendants win; concurrent writes compare `(actor_sequence, actor_id, operation_id)`. That rule must not be assumed to match production.
+
+The randomized oracle covers a scalar subset with a hand-derived expected winner. The full 5,000,000-operation corpus was not generated or replayed: the fresh post-fix 500,000-operation representative run consumed 440,688 KiB RSS because this prototype retains accepted operations and identity metadata in memory. The recipe is preserved under `fixtures/`, with the missing corpus digest explicitly `null`.
+
+The returned-error test is not a crash test: it does not spawn or kill a child process, inject a real disk-full or permission failure, interrupt partial writes or the `CURRENT` temporary-write/flush/rename/final-sync sequence, or test process/host crash and power loss. `crash_schedules.json` is parsed and shape-validated by the replay CLI but is not executed. PostgreSQL coordination, multi-process writers, the real TypeScript oracle, media payloads, keyed authentication, and Byzantine behavior also remain outside this prototype.
+
+The permanent SHA-256 operation fingerprints needed to reject conflicting ID reuse make the corrected synthetic compacted artifact 3,719/8,670 bytes (42.90%). The brief's 40% retained-byte gate therefore fails; this is a no-fit result, not production readiness.
+
+## Dependencies
+
+Production dependencies are `serde`, `serde_json`, and `sha2`. The only development-only component dependency is local `fold`, used by one characterization test. ESE and ANNy are not linked. The package uses the lab's single nested workspace and lockfile.
+
+## Run
+
+Run these commands from the repository root. Build and runtime state stays
+outside the checkout:
+
+```console
+cargo fmt --manifest-path developer-simulation/Cargo.toml \
+  --package causal-canvas-compaction -- --check
+CARGO_TARGET_DIR=/private/tmp/causal-canvas-target \
+  cargo test --offline --locked --manifest-path developer-simulation/Cargo.toml \
+  --package causal-canvas-compaction --all-targets
+CARGO_TARGET_DIR=/private/tmp/causal-canvas-target \
+  cargo clippy --offline --locked --manifest-path developer-simulation/Cargo.toml \
+  --package causal-canvas-compaction --all-targets -- \
+  -D warnings -D clippy::all -D clippy::pedantic
+CARGO_TARGET_DIR=/private/tmp/causal-canvas-target \
+  cargo build --release --offline --locked \
+  --manifest-path developer-simulation/Cargo.toml \
+  --package causal-canvas-compaction
+```
+
+Run the 50-history, 20-schedule reduced oracle:
+
+```console
+/private/tmp/causal-canvas-target/release/causal-canvas-compaction \
+  oracle 50 20 64
+```
+
+Run a representative sequential workload and report 200-operation batch p95:
+
+```console
+/private/tmp/causal-canvas-target/release/causal-canvas-compaction \
+  workload 500000
+```
+
+Run the largest declared visible-document shape. Use a new empty state path:
+
+```console
+/private/tmp/causal-canvas-target/release/causal-canvas-compaction \
+  largest 40000 20000 /private/tmp/causal-largest-state
+```
+
+Run the directory-input integration fixture:
+
+```console
+/private/tmp/causal-canvas-target/release/causal-canvas-compaction replay \
+  developer-simulation/runs/2026-08-16--causal-canvas-compaction/fixtures/smoke-input \
+  /private/tmp/causal-smoke-state \
+  canvas \
+  10
+```
+
+The replay input directory contains `operations.ndjson`, `watermarks.json`, and `crash_schedules.json`. The replay command only parses and shape-validates the crash-schedule file. The publication tests request ordinary returned errors after five completed stages; they do not execute crash schedules or simulate actual I/O failures.
+
+## Main library boundary
+
+- `validate_ndjson_line`: bounded input decode and validation.
+- `Core::apply` / `Core::apply_batch`: identity, causal buffering, and visible-state reduction.
+- `Core::compact`: reconnect decisions, retained operations, permanent compact operation fingerprints, state, and deterministic manifest.
+- `CompactionArtifact::reopen`: in-memory reopen from compacted bytes.
+- `publish_generation` / `open_latest`: replaceable local generation directory.
+- `Core::canonical_snapshot`: deterministic visible JSON.
+
+See the [daily report](../../reports/2026-08-16.md) for the decision audit and
+`evidence/` for preserved command results.
diff --git a/developer-simulation/runs/2026-08-16--causal-canvas-compaction/evidence/TDD_EVIDENCE.md b/developer-simulation/runs/2026-08-16--causal-canvas-compaction/evidence/TDD_EVIDENCE.md
new file mode 100644
index 0000000..63e9be0
--- /dev/null
+++ b/developer-simulation/runs/2026-08-16--causal-canvas-compaction/evidence/TDD_EVIDENCE.md
@@ -0,0 +1,150 @@
+# Preserved RED/GREEN evidence
+
+Every prototype behavior was introduced by a behavioral test before its implementation. Expected values are literal or hand-derived; tests do not call the production reducer to build their expected snapshots.
+
+## Initial causal replay
+
+Command:
+
+```console
+cargo test --offline --test core causally_buffered_scalar_history_has_literal_canonical_snapshot -- --exact
+```
+
+RED first failed with `left: Applied { drained: 0 }`, `right: Applied { drained: 1 }`. GREEN passed after causal readiness, buffering, drain, and canonical-state materialization were implemented.
+
+## Identity safety
+
+Command:
+
+```console
+cargo test --offline --test core duplicate_is_a_no_op_and_conflicting_id_reuse_is_rejected_atomically -- --exact
+```
+
+RED failed to compile because `ApplyError`, `Duplicate`, `Rejected`, `snapshot_digest`, and `accepted_count` did not exist. GREEN passed after exact identity bytes were checked before any mutation.
+
+## Schedule-independent LWW
+
+Command:
+
+```console
+cargo test --offline --test core concurrent_scalar_winner_is_independent_of_delivery_order -- --exact
+```
+
+RED produced `fill:red` for the reverse schedule instead of the literal `fill:blue`. GREEN passed after causal dominance and the declared concurrent writer tuple were separated from arrival order.
+
+## Tombstones and deleted anchors
+
+Command:
+
+```console
+cargo test --offline --test core tombstones_block_resurrection_and_deleted_list_neighbors_still_order_children -- --exact
+```
+
+The first RED lacked four operation variants. After the smallest six-kind implementation, a second test-first case added delayed object recreation; RED visibly recreated an ellipse. GREEN passed after object tombstones blocked recreation. The existing test stayed green while recursive list traversal was later refactored into an iterative ordered traversal.
+
+## Bounded adversarial input
+
+Commands:
+
+```console
+cargo test --offline --test validation raw_input_is_size_bounded_before_utf8_or_json_parsing -- --exact
+cargo test --offline --test validation truncated_json_and_unknown_operation_kind_have_stable_errors -- --exact
+cargo test --offline --test validation payload_and_sequence_limits_reject_valid_json -- --exact
+cargo test --offline --test core pending_work_is_bounded_and_dependency_cycles_are_reported -- --exact
+```
+
+Each RED first lacked the named validation/error API. GREEN covers raw-size-before-UTF-8 priority, invalid UTF-8, truncated JSON, unknown kind, payload cap, zero/overflow sequence, bounded pending work, and cycle diagnosis.
+
+## Offline window and compaction
+
+Commands:
+
+```console
+cargo test --offline --test compaction reconnect_window_has_deterministic_full_thirty_day_boundary -- --exact
+cargo test --offline --locked --test compaction compaction_counts_permanent_identity_metadata_in_retained_byte_gate -- --exact --nocapture
+cargo test --offline --test compaction compacted_state_reopens_with_tombstones_and_accepts_in_window_pending_edit -- --exact
+cargo test --offline --test compaction compaction_refuses_a_causally_incomplete_state -- --exact
+```
+
+The byte-reduction test had a meaningful RED after implementation: equivalent identity payloads were duplicated in compacted state and pushed the artifact above 40%. The initial GREEN removed that duplication by rebuilding identity state from retained operations. Reviewer fix round 1/5 proved that repair was incorrect across the full lifecycle because IDs pruned from catch-up history could then be reused. The corrected permanent fingerprints are intentionally counted by the renamed retained-byte test, and the acceptance gate now fails. The remaining tests first lacked their APIs, then passed at the exact 30-day boundary, after reopen, and on pending-state refusal.
+
+## Generation publication
+
+Commands:
+
+```console
+cargo test --offline --test publication in_process_returned_error_at_each_stage_never_exposes_partial_generation -- --exact
+cargo test --offline --test publication corrupt_current_manifest_falls_back_to_prior_valid_generation -- --exact
+```
+
+The first RED lacked the publication API. GREEN passed an ordinary in-process returned-error model after generation creation, data flush, manifest flush, rename, and directory sync, plus idempotent retry. It did not exercise process termination or operating-system I/O faults. Fallback behavior was deliberately removed before its test; RED returned `InvalidGeneration` for a corrupt current manifest, and GREEN selected generation 1.
+
+## Reviewer fix round 1/5
+
+The independent review rejected the initial handoff. These are the preserved RED/GREEN cycles for its two prototype correctness findings.
+
+### T1-C1 — permanent operation identity
+
+Command:
+
+```console
+cargo test --offline --locked --test compaction conflicting_operation_id_reuse_remains_rejected_after_compact_reopen -- --exact
+```
+
+RED reached the published `open_latest` path and failed its literal outcome assertion: `left: Applied { drained: 0 }`, `right: Rejected(ConflictingOperationId)`. The regression uses the next valid actor sequence and different payload, then checks the exact rejection code plus unchanged canonical bytes, snapshot digest, and accepted counter through both `CompactionArtifact::reopen` and compact → publish → `open_latest`.
+
+GREEN passed after compact state began storing SHA-256 fingerprints of the canonical bytes for every accepted operation ID and reopen restored that complete map. The map is no longer reconstructed only from retained catch-up operations.
+
+The required post-fix byte-gate command was:
+
+```console
+cargo test --offline --locked --test compaction compaction_counts_permanent_identity_metadata_in_retained_byte_gate -- --exact --nocapture
+```
+
+It prints `compacted=3719 uncompacted=8670 percent=42.90`. The test passes because it locks the observed acceptance-gate violation; the brief's at-most-40% criterion itself is **FAIL**, not PASS.
+
+### T1-I1 — complete manifest integrity
+
+Command:
+
+```console
+cargo test --offline --locked --test publication changed_manifest_metadata_falls_back_or_fails -- --exact
+```
+
+RED changed only `reconnect_decisions` from `catch_up` to `snapshot_required`; `open_latest` still accepted generation 2, failing `left: 2`, `right: 1`. GREEN passed after publication stored `manifest.sha256` separately and reopen verified it against every byte of `manifest.json` before trusting any semantic field. A one-file semantic change now falls back to generation 1 (or would hard-fail if no valid generation remained). This is an unkeyed integrity check, not protection from an adversary able to rewrite both files.
+
+### T1-I2 — evidence-only correction
+
+`FaultKind::Crash` and `FaultKind::DiskFull` were removed because both labels followed the same ordinary returned-error path. The remaining test and API say exactly what happens: an error is returned after one of five completed stages. No child exit, actual disk-full/permission error, partial write, pointer sub-stage interruption, process/host crash, or power loss is tested. `crash_schedules.json` is parsed and shape-validated only.
+
+## Harness, determinism, and digest
+
+Commands:
+
+```console
+cargo test --offline --test cli replay_command_reads_ndjson_compacts_publishes_and_reopens -- --exact
+cargo test --offline --test cli largest_command_builds_publishes_and_times_a_requested_shape -- --exact
+cargo test --offline --test determinism generated_histories_match_hand_derived_oracle_across_schedules -- --exact
+cargo test --offline --test determinism twenty_input_batchings_produce_identical_snapshot_and_manifest_bytes -- --exact
+cargo test --offline --test determinism durable_digest_uses_sha256_known_vector -- --exact
+```
+
+The CLI tests first failed because the binary/commands did not exist. The batching test first failed because `apply_batch` did not exist. The digest RED returned the old 64-bit checksum `e71fa2190541574b` instead of the literal SHA-256 vector for `abc`; GREEN returned `ba7816bf...15ad` after adding `sha2`.
+
+## Characterization, not a defect test
+
+```console
+cargo test --offline --test fold_comparison fold_keyed_materialization_is_arrival_ordered_without_a_causal_wrapper -- --exact
+```
+
+This narrow upstream characterization passed: forward and reverse upsert schedules leave different values. It documents why Fold needs a custom causal winner layer; it does not label Fold's generic upsert semantics a defect.
+
+## Final fresh gate
+
+```console
+cargo fmt --manifest-path Cargo.toml --package causal-canvas-compaction -- --check
+cargo test --offline --locked --all-targets
+cargo clippy --offline --locked --all-targets -- -D warnings -D clippy::all -D clippy::pedantic
+```
+
+Fresh fix-round result before artifact cleanup: formatting clean; 22 tests passed; strict Clippy passed with zero warnings. The first post-fix Clippy run rejected only the expanded byte-gate test's length and lossy floating-point display. Fixture construction was extracted and the percentage was changed to integer hundredths; the retained `42.90` result and behavioral assertion were unchanged, and the strict rerun passed without warning suppressions.
diff --git a/developer-simulation/runs/2026-08-16--causal-canvas-compaction/evidence/release-largest.json b/developer-simulation/runs/2026-08-16--causal-canvas-compaction/evidence/release-largest.json
new file mode 100644
index 0000000..245b468
--- /dev/null
+++ b/developer-simulation/runs/2026-08-16--causal-canvas-compaction/evidence/release-largest.json
@@ -0,0 +1,13 @@
+{
+  "command": "target/release/causal-canvas-compaction largest 40000 20000 STATE_DIR",
+  "objects": 40000,
+  "list_elements": 20000,
+  "build_ms": 103,
+  "compact_ms": 81,
+  "publish_ms": 36,
+  "open_ms": 69,
+  "compacted_bytes": 12529568,
+  "snapshot_digest": "0679fb3ee13f76b3af20a63e845767816e457fbf223f894b2626a852977aa5aa",
+  "sampled_peak_rss_kib": 195440,
+  "exit": 0
+}
diff --git a/developer-simulation/runs/2026-08-16--causal-canvas-compaction/evidence/release-oracle.json b/developer-simulation/runs/2026-08-16--causal-canvas-compaction/evidence/release-oracle.json
new file mode 100644
index 0000000..4467274
--- /dev/null
+++ b/developer-simulation/runs/2026-08-16--causal-canvas-compaction/evidence/release-oracle.json
@@ -0,0 +1,9 @@
+{
+  "command": "target/release/causal-canvas-compaction oracle 50 20 64",
+  "histories": 50,
+  "schedules_per_history": 20,
+  "comparisons": 1000,
+  "failures": 0,
+  "digest": "5a36a7120a4b1e4a9c8344d61b8f454bc0f7df191ccb560abb24e915b60e8141",
+  "scope": "reduced scalar oracle, not the unavailable TypeScript baseline"
+}
diff --git a/developer-simulation/runs/2026-08-16--causal-canvas-compaction/evidence/release-smoke.json b/developer-simulation/runs/2026-08-16--causal-canvas-compaction/evidence/release-smoke.json
new file mode 100644
index 0000000..7438bdc
--- /dev/null
+++ b/developer-simulation/runs/2026-08-16--causal-canvas-compaction/evidence/release-smoke.json
@@ -0,0 +1,9 @@
+{
+  "command": "target/release/causal-canvas-compaction replay fixtures/smoke-input STATE_DIR canvas 10",
+  "accepted_operations": 2,
+  "pending_operations": 0,
+  "snapshot_digest": "76c61f8f2526d8b03d4670463ce050471e19d5795d035b68867d53205a54e4c9",
+  "uncompacted_bytes": 405,
+  "compacted_bytes": 1020,
+  "note": "Permanent operation fingerprints and fixed generation overhead dominate this intentionally tiny smoke fixture."
+}
diff --git a/developer-simulation/runs/2026-08-16--causal-canvas-compaction/evidence/release-workload.json b/developer-simulation/runs/2026-08-16--causal-canvas-compaction/evidence/release-workload.json
new file mode 100644
index 0000000..37a089f
--- /dev/null
+++ b/developer-simulation/runs/2026-08-16--causal-canvas-compaction/evidence/release-workload.json
@@ -0,0 +1,10 @@
+{
+  "command": "target/release/causal-canvas-compaction workload 500000",
+  "operations": 500000,
+  "elapsed_ms": 776,
+  "batch_200_p95_us": 343,
+  "snapshot_digest": "99b1b7a23b9c0615736b3e86da409a6c66f3bc048d3980a674c89af99f1bc10a",
+  "sampled_peak_rss_kib": 440688,
+  "exit": 0,
+  "scope": "fresh post-fix single-threaded representative workload; 5,000,000 operations unrun because linear full-history storage remains unsafe to extrapolate within 1 GiB"
+}
diff --git a/developer-simulation/runs/2026-08-16--causal-canvas-compaction/fixtures/SHA256SUMS b/developer-simulation/runs/2026-08-16--causal-canvas-compaction/fixtures/SHA256SUMS
new file mode 100644
index 0000000..9466abb
--- /dev/null
+++ b/developer-simulation/runs/2026-08-16--causal-canvas-compaction/fixtures/SHA256SUMS
@@ -0,0 +1,4 @@
+f17c744da0b8a7b2753b810b25ab27c9ec0ee162e2efa152d23cacb986707b40  fixture-recipe.json
+d164e12aa8e772743555c5fbb7984c194ce78fc1b4b788fb92e48c74513d9669  smoke-input/operations.ndjson
+0ec59ad8cf3757ffc9caaf03f6004a87f455d91bc084703b0cf28de355b58d62  smoke-input/watermarks.json
+37517e5f3dc66819f61f5a7bb8ace1921282415f10551d2defa5c3eb0985b570  smoke-input/crash_schedules.json
diff --git a/developer-simulation/runs/2026-08-16--causal-canvas-compaction/fixtures/fixture-recipe.json b/developer-simulation/runs/2026-08-16--causal-canvas-compaction/fixtures/fixture-recipe.json
new file mode 100644
index 0000000..d71b3f2
--- /dev/null
+++ b/developer-simulation/runs/2026-08-16--causal-canvas-compaction/fixtures/fixture-recipe.json
@@ -0,0 +1,26 @@
+{
+  "schema_version": 1,
+  "seed": 20260816,
+  "documents": 100,
+  "accepted_operations": 5000000,
+  "actors_per_document": 64,
+  "operations_per_document_min": 25000,
+  "operations_per_document_max": 75000,
+  "operation_kinds": [
+    "create",
+    "set_property",
+    "move",
+    "list_insert",
+    "list_delete",
+    "object_delete"
+  ],
+  "duplicate_delivery_percent": 8,
+  "causally_out_of_order_delivery_percent": 12,
+  "offline_actor_percent": 5,
+  "offline_days_min": 7,
+  "offline_days_max": 30,
+  "maximum_payload_bytes": 65536,
+  "generation_status": "recipe_only_not_generated",
+  "operation_corpus_sha256": null,
+  "reason": "The fresh post-fix 500000-operation representative run used 440688 KiB RSS while retaining full accepted history. Generating or replaying ten times that volume inside the 1 GiB trial envelope remained unsafe."
+}
diff --git a/developer-simulation/runs/2026-08-16--causal-canvas-compaction/fixtures/smoke-input/crash_schedules.json b/developer-simulation/runs/2026-08-16--causal-canvas-compaction/fixtures/smoke-input/crash_schedules.json
new file mode 100644
index 0000000..fe51488
--- /dev/null
+++ b/developer-simulation/runs/2026-08-16--causal-canvas-compaction/fixtures/smoke-input/crash_schedules.json
@@ -0,0 +1 @@
+[]
diff --git a/developer-simulation/runs/2026-08-16--causal-canvas-compaction/fixtures/smoke-input/operations.ndjson b/developer-simulation/runs/2026-08-16--causal-canvas-compaction/fixtures/smoke-input/operations.ndjson
new file mode 100644
index 0000000..9b6e1ad
--- /dev/null
+++ b/developer-simulation/runs/2026-08-16--causal-canvas-compaction/fixtures/smoke-input/operations.ndjson
@@ -0,0 +1,2 @@
+{"id":"alice-1","document_id":"canvas","actor_id":"alice","actor_sequence":1,"dependency_clock":{},"accepted_minute":1,"payload":{"kind":"create","object_id":"shape","object_kind":"rectangle"}}
+{"id":"alice-2","document_id":"canvas","actor_id":"alice","actor_sequence":2,"dependency_clock":{"alice":1},"accepted_minute":2,"payload":{"kind":"set_property","object_id":"shape","key":"fill","value":"blue"}}
diff --git a/developer-simulation/runs/2026-08-16--causal-canvas-compaction/fixtures/smoke-input/watermarks.json b/developer-simulation/runs/2026-08-16--causal-canvas-compaction/fixtures/smoke-input/watermarks.json
new file mode 100644
index 0000000..625e207
--- /dev/null
+++ b/developer-simulation/runs/2026-08-16--causal-canvas-compaction/fixtures/smoke-input/watermarks.json
@@ -0,0 +1,8 @@
+[
+  {
+    "client_id": "browser-1",
+    "document_id": "canvas",
+    "acknowledged": { "alice": 2 },
+    "acknowledged_minute": 10
+  }
+]
diff --git a/developer-simulation/runs/2026-08-16--causal-canvas-compaction/src/lib.rs b/developer-simulation/runs/2026-08-16--causal-canvas-compaction/src/lib.rs
new file mode 100644
index 0000000..df36e49
--- /dev/null
+++ b/developer-simulation/runs/2026-08-16--causal-canvas-compaction/src/lib.rs
@@ -0,0 +1,846 @@
+use std::collections::{BTreeMap, BTreeSet};
+use std::fmt;
+
+use serde::{Deserialize, Serialize};
+use sha2::{Digest, Sha256};
+
+mod store;
+pub use store::{
+    FaultInjection, FaultStage, OpenedGeneration, StoreError, open_latest, publish_generation,
+};
+mod suite;
+pub use suite::{SuiteSummary, run_reduced_oracle_suite};
+
+pub const OFFLINE_WINDOW_MINUTES: u64 = 30 * 24 * 60;
+
+#[derive(Clone, Copy, Debug, Eq, PartialEq, Serialize)]
+#[serde(rename_all = "snake_case")]
+pub enum ReconnectDecision {
+    CatchUp,
+    SnapshotRequired,
+}
+
+#[must_use]
+pub fn reconnect_decision(now_minute: u64, acknowledged_minute: u64) -> ReconnectDecision {
+    if now_minute.saturating_sub(acknowledged_minute) <= OFFLINE_WINDOW_MINUTES {
+        ReconnectDecision::CatchUp
+    } else {
+        ReconnectDecision::SnapshotRequired
+    }
+}
+
+#[derive(Clone, Copy, Debug, Deserialize, Eq, PartialEq, Serialize)]
+pub struct Limits {
+    pub max_line_bytes: usize,
+    pub max_payload_bytes: usize,
+    pub max_pending_operations: usize,
+}
+
+impl Default for Limits {
+    fn default() -> Self {
+        Self {
+            max_line_bytes: 70 * 1024,
+            max_payload_bytes: 64 * 1024,
+            max_pending_operations: 10_000,
+        }
+    }
+}
+
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+pub enum ValidationError {
+    InputTooLarge,
+    InvalidUtf8,
+    InvalidJson,
+    UnknownOperationKind,
+    PayloadTooLarge,
+    InvalidSequence,
+    SequenceOverflow,
+}
+
+/// Validates and decodes one bounded NDJSON operation line.
+///
+/// # Errors
+///
+/// Returns a stable validation category for oversized, malformed, unknown, or
+/// invalid-sequence input.
+pub fn validate_ndjson_line(bytes: &[u8], limits: Limits) -> Result<Operation, ValidationError> {
+    if bytes.len() > limits.max_line_bytes {
+        return Err(ValidationError::InputTooLarge);
+    }
+    let line = std::str::from_utf8(bytes).map_err(|_| ValidationError::InvalidUtf8)?;
+    let value: serde_json::Value =
+        serde_json::from_str(line).map_err(|_| ValidationError::InvalidJson)?;
+    let kind = value
+        .pointer("/payload/kind")
+        .and_then(serde_json::Value::as_str)
+        .ok_or(ValidationError::InvalidJson)?;
+    if !matches!(
+        kind,
+        "create" | "set_property" | "move" | "list_insert" | "list_delete" | "object_delete"
+    ) {
+        return Err(ValidationError::UnknownOperationKind);
+    }
+    let operation: Operation =
+        serde_json::from_value(value).map_err(|_| ValidationError::InvalidJson)?;
+    let payload_size = serde_json::to_vec(&operation.payload)
+        .map_err(|_| ValidationError::InvalidJson)?
+        .len();
+    if payload_size > limits.max_payload_bytes {
+        return Err(ValidationError::PayloadTooLarge);
+    }
+    if operation.actor_sequence == 0 {
+        return Err(ValidationError::InvalidSequence);
+    }
+    if operation.actor_sequence == u64::MAX {
+        return Err(ValidationError::SequenceOverflow);
+    }
+    Ok(operation)
+}
+
+#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
+pub struct Operation {
+    pub id: String,
+    pub document_id: String,
+    pub actor_id: String,
+    pub actor_sequence: u64,
+    pub dependency_clock: BTreeMap<String, u64>,
+    pub accepted_minute: u64,
+    pub payload: Payload,
+}
+
+#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
+#[serde(tag = "kind", rename_all = "snake_case")]
+pub enum Payload {
+    Create {
+        object_id: String,
+        object_kind: String,
+    },
+    SetProperty {
+        object_id: String,
+        key: String,
+        value: String,
+    },
+    Move {
+        object_id: String,
+        x: i64,
+        y: i64,
+    },
+    ListInsert {
+        list_id: String,
+        element_id: String,
+        left: Option<String>,
+        value: String,
+    },
+    ListDelete {
+        list_id: String,
+        element_id: String,
+    },
+    ObjectDelete {
+        object_id: String,
+    },
+}
+
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+pub enum ApplyOutcome {
+    Applied { drained: usize },
+    Buffered,
+    Duplicate,
+    Rejected(ApplyError),
+}
+
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+pub enum ApplyError {
+    ConflictingOperationId,
+    InvalidSequence,
+    SequenceOverflow,
+    PendingLimit,
+}
+
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+pub struct PendingDiagnosis {
+    pub pending_operations: usize,
+    pub has_cycle: bool,
+}
+
+#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
+pub struct ClientWatermark {
+    pub client_id: String,
+    pub document_id: String,
+    pub acknowledged: BTreeMap<String, u64>,
+    pub acknowledged_minute: u64,
+}
+
+#[derive(Clone, Debug, Eq, PartialEq)]
+pub struct CompactionArtifact {
+    pub snapshot_json: String,
+    pub retained_operation_ids: Vec<String>,
+    pub reconnect_decisions: BTreeMap<String, ReconnectDecision>,
+    pub manifest_json: String,
+    pub uncompacted_bytes: usize,
+    pub compacted_bytes: usize,
+    state_json: String,
+    retained_json: Vec<u8>,
+}
+
+#[derive(Clone, Debug, Eq, PartialEq)]
+pub enum CompactionError {
+    PendingOperations,
+    Serialization(String),
+}
+
+impl fmt::Display for CompactionError {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        match self {
+            Self::PendingOperations => formatter.write_str("causally pending operations remain"),
+            Self::Serialization(error) => write!(formatter, "serialization error: {error}"),
+        }
+    }
+}
+
+impl std::error::Error for CompactionError {}
+
+impl From<serde_json::Error> for CompactionError {
+    fn from(value: serde_json::Error) -> Self {
+        Self::Serialization(value.to_string())
+    }
+}
+
+#[derive(Serialize)]
+struct CompactionManifest<'a> {
+    document_id: &'a str,
+    snapshot_digest: String,
+    retained_digest: String,
+    retained_operation_ids: &'a [String],
+    reconnect_decisions: &'a BTreeMap<String, ReconnectDecision>,
+    state_digest: String,
+}
+
+#[derive(Deserialize, Serialize)]
+struct PersistedCore {
+    frontiers: Vec<FrontierEntry>,
+    documents: BTreeMap<String, Document>,
+    seen: BTreeMap<String, String>,
+    limits: Limits,
+}
+
+#[derive(Deserialize, Serialize)]
+struct FrontierEntry {
+    document_id: String,
+    actor_id: String,
+    sequence: u64,
+}
+
+#[derive(Default)]
+pub struct Core {
+    frontiers: BTreeMap<(String, String), u64>,
+    pending: Vec<Operation>,
+    documents: BTreeMap<String, Document>,
+    seen: BTreeMap<String, String>,
+    limits: Limits,
+    history: Vec<Operation>,
+}
+
+#[derive(Clone, Default, Deserialize, Serialize)]
+struct Document {
+    objects: BTreeMap<String, Object>,
+    deleted_objects: BTreeSet<String>,
+    lists: BTreeMap<String, List>,
+}
+
+#[derive(Clone, Deserialize, Serialize)]
+struct Object {
+    kind: String,
+    x: i64,
+    y: i64,
+    properties: BTreeMap<String, Register>,
+    position_writer: Option<Writer>,
+}
+
+#[derive(Clone, Default, Deserialize, Serialize)]
+struct List {
+    elements: BTreeMap<String, ListElement>,
+    tombstones: BTreeSet<String>,
+}
+
+#[derive(Clone, Deserialize, Serialize)]
+struct ListElement {
+    left: Option<String>,
+    value: String,
+    writer: Writer,
+}
+
+#[derive(Clone, Deserialize, Serialize)]
+struct Register {
+    value: String,
+    writer: Writer,
+}
+
+#[derive(Clone, Deserialize, Eq, Ord, PartialEq, PartialOrd, Serialize)]
+struct Writer {
+    actor_sequence: u64,
+    actor_id: String,
+    operation_id: String,
+    dependency_clock: BTreeMap<String, u64>,
+}
+
+#[derive(Serialize)]
+struct Snapshot<'a> {
+    document_id: &'a str,
+    objects: Vec<SnapshotObject<'a>>,
+    lists: Vec<SnapshotList<'a>>,
+}
+
+#[derive(Serialize)]
+struct SnapshotList<'a> {
+    id: &'a str,
+    elements: Vec<SnapshotListElement<'a>>,
+}
+
+#[derive(Serialize)]
+struct SnapshotListElement<'a> {
+    id: &'a str,
+    value: &'a str,
+}
+
+#[derive(Serialize)]
+struct SnapshotObject<'a> {
+    id: &'a str,
+    kind: &'a str,
+    x: i64,
+    y: i64,
+    properties: BTreeMap<&'a str, &'a str>,
+}
+
+impl Core {
+    #[must_use]
+    pub fn new() -> Self {
+        Self::default()
+    }
+
+    #[must_use]
+    pub fn with_limits(limits: Limits) -> Self {
+        Self {
+            limits,
+            ..Self::default()
+        }
+    }
+
+    pub fn apply(&mut self, operation: Operation) -> ApplyOutcome {
+        if operation.actor_sequence == 0 {
+            return ApplyOutcome::Rejected(ApplyError::InvalidSequence);
+        }
+        if operation.actor_sequence == u64::MAX {
+            return ApplyOutcome::Rejected(ApplyError::SequenceOverflow);
+        }
+        let fingerprint = operation_fingerprint(&operation);
+        if let Some(seen) = self.seen.get(&operation.id) {
+            return if seen == &fingerprint {
+                ApplyOutcome::Duplicate
+            } else {
+                ApplyOutcome::Rejected(ApplyError::ConflictingOperationId)
+            };
+        }
+
+        if !self.is_ready(&operation) {
+            let current = self
+                .frontiers
+                .get(&(operation.document_id.clone(), operation.actor_id.clone()))
+                .copied()
+                .unwrap_or(0);
+            if operation.actor_sequence <= current {
+                return ApplyOutcome::Rejected(ApplyError::InvalidSequence);
+            }
+            if self.pending.len() >= self.limits.max_pending_operations {
+                return ApplyOutcome::Rejected(ApplyError::PendingLimit);
+            }
+            self.seen.insert(operation.id.clone(), fingerprint);
+            self.history.push(operation.clone());
+            self.pending.push(operation);
+            return ApplyOutcome::Buffered;
+        }
+
+        self.seen.insert(operation.id.clone(), fingerprint);
+        self.history.push(operation.clone());
+        self.apply_ready(operation);
+        let mut drained = 0;
+        while let Some(index) = self.pending.iter().position(|op| self.is_ready(op)) {
+            let ready = self.pending.remove(index);
+            self.apply_ready(ready);
+            drained += 1;
+        }
+        ApplyOutcome::Applied { drained }
+    }
+
+    /// Applies a caller-selected batch without making batch boundaries part of
+    /// operation ordering or canonical output.
+    pub fn apply_batch(
+        &mut self,
+        operations: impl IntoIterator<Item = Operation>,
+    ) -> Vec<ApplyOutcome> {
+        operations
+            .into_iter()
+            .map(|operation| self.apply(operation))
+            .collect()
+    }
+
+    /// Returns byte-stable canonical visible state for one document.
+    ///
+    /// # Errors
+    ///
+    /// Returns a serialization error if the in-memory state cannot be encoded.
+    pub fn canonical_snapshot(&self, document_id: &str) -> Result<String, serde_json::Error> {
+        let objects = self
+            .documents
+            .get(document_id)
+            .map(|document| {
+                document
+                    .objects
+                    .iter()
+                    .map(|(id, object)| SnapshotObject {
+                        id,
+                        kind: &object.kind,
+                        x: object.x,
+                        y: object.y,
+                        properties: object
+                            .properties
+                            .iter()
+                            .map(|(key, register)| (key.as_str(), register.value.as_str()))
+                            .collect(),
+                    })
+                    .collect()
+            })
+            .unwrap_or_default();
+        let lists = self
+            .documents
+            .get(document_id)
+            .map(|document| {
+                document
+                    .lists
+                    .iter()
+                    .map(|(id, list)| SnapshotList {
+                        id,
+                        elements: ordered_visible_elements(list),
+                    })
+                    .collect()
+            })
+            .unwrap_or_default();
+        serde_json::to_string(&Snapshot {
+            document_id,
+            objects,
+            lists,
+        })
+    }
+
+    #[must_use]
+    pub fn accepted_count(&self) -> usize {
+        self.seen.len()
+    }
+
+    /// Digests the canonical snapshot bytes using the prototype's stable digest.
+    ///
+    /// # Errors
+    ///
+    /// Returns a serialization error if the canonical snapshot cannot be encoded.
+    pub fn snapshot_digest(&self, document_id: &str) -> Result<String, serde_json::Error> {
+        self.canonical_snapshot(document_id)
+            .map(|snapshot| stable_digest(snapshot.as_bytes()))
+    }
+
+    #[must_use]
+    pub fn pending_diagnosis(&self) -> PendingDiagnosis {
+        PendingDiagnosis {
+            pending_operations: self.pending.len(),
+            has_cycle: self.pending_has_cycle(),
+        }
+    }
+
+    /// Produces a deterministic compacted artifact for one causally complete document.
+    ///
+    /// # Errors
+    ///
+    /// Returns `PendingOperations` if accepted work is still blocked, or a
+    /// serialization error while producing artifact bytes.
+    pub fn compact(
+        &self,
+        document_id: &str,
+        clients: &[ClientWatermark],
+        now_minute: u64,
+    ) -> Result<CompactionArtifact, CompactionError> {
+        if self
+            .pending
+            .iter()
+            .any(|operation| operation.document_id == document_id)
+        {
+            return Err(CompactionError::PendingOperations);
+        }
+        let mut relevant_clients: Vec<_> = clients
+            .iter()
+            .filter(|client| client.document_id == document_id)
+            .collect();
+        relevant_clients.sort_by(|a, b| a.client_id.cmp(&b.client_id));
+
+        let reconnect_decisions: BTreeMap<_, _> = relevant_clients
+            .iter()
+            .map(|client| {
+                (
+                    client.client_id.clone(),
+                    reconnect_decision(now_minute, client.acknowledged_minute),
+                )
+            })
+            .collect();
+        let supported_clients: Vec<_> = relevant_clients
+            .iter()
+            .copied()
+            .filter(|client| {
+                reconnect_decision(now_minute, client.acknowledged_minute)
+                    == ReconnectDecision::CatchUp
+            })
+            .collect();
+
+        let document_history: Vec<_> = self
+            .history
+            .iter()
+            .filter(|operation| operation.document_id == document_id)
+            .collect();
+        let retained: Vec<_> = document_history
+            .iter()
+            .copied()
+            .filter(|operation| {
+                supported_clients.iter().any(|client| {
+                    client
+                        .acknowledged
+                        .get(&operation.actor_id)
+                        .copied()
+                        .unwrap_or(0)
+                        < operation.actor_sequence
+                })
+            })
+            .collect();
+        let retained_operation_ids: Vec<_> = retained
+            .iter()
+            .map(|operation| operation.id.clone())
+            .collect();
+        let snapshot_json = self.canonical_snapshot(document_id)?;
+        let retained_json = serde_json::to_vec(&retained)?;
+        let persisted = PersistedCore {
+            frontiers: self
+                .frontiers
+                .iter()
+                .filter(|((document, _), _)| document == document_id)
+                .map(|((document, actor), sequence)| FrontierEntry {
+                    document_id: document.clone(),
+                    actor_id: actor.clone(),
+                    sequence: *sequence,
+                })
+                .collect(),
+            documents: self
+                .documents
+                .get(document_id)
+                .map(|document| BTreeMap::from([(document_id.to_string(), document.clone())]))
+                .unwrap_or_default(),
+            seen: self.seen.clone(),
+            limits: self.limits,
+        };
+        let state_json = serde_json::to_string(&persisted)?;
+        let manifest_json = serde_json::to_string(&CompactionManifest {
+            document_id,
+            snapshot_digest: stable_digest(snapshot_json.as_bytes()),
+            retained_digest: stable_digest(&retained_json),
+            retained_operation_ids: &retained_operation_ids,
+            reconnect_decisions: &reconnect_decisions,
+            state_digest: stable_digest(state_json.as_bytes()),
+        })?;
+        let uncompacted_bytes = document_history
+            .iter()
+            .map(|operation| serde_json::to_vec(operation).map(|bytes| bytes.len() + 1))
+            .collect::<Result<Vec<_>, _>>()?
+            .into_iter()
+            .sum();
+        let compacted_bytes = state_json.len() + retained_json.len() + manifest_json.len() + 64;
+
+        Ok(CompactionArtifact {
+            snapshot_json,
+            retained_operation_ids,
+            reconnect_decisions,
+            manifest_json,
+            uncompacted_bytes,
+            compacted_bytes,
+            state_json,
+            retained_json,
+        })
+    }
+
+    fn is_ready(&self, operation: &Operation) -> bool {
+        let expected = self
+            .frontiers
+            .get(&(operation.document_id.clone(), operation.actor_id.clone()))
+            .copied()
+            .unwrap_or(0)
+            + 1;
+        operation.actor_sequence == expected
+            && operation.dependency_clock.iter().all(|(actor, sequence)| {
+                self.frontiers
+                    .get(&(operation.document_id.clone(), actor.clone()))
+                    .copied()
+                    .unwrap_or(0)
+                    >= *sequence
+            })
+    }
+
+    fn apply_ready(&mut self, operation: Operation) {
+        let writer = Writer {
+            actor_sequence: operation.actor_sequence,
+            actor_id: operation.actor_id.clone(),
+            operation_id: operation.id.clone(),
+            dependency_clock: operation.dependency_clock.clone(),
+        };
+        let document = self
+            .documents
+            .entry(operation.document_id.clone())
+            .or_default();
+        match operation.payload {
+            Payload::Create {
+                object_id,
+                object_kind,
+            } => {
+                if !document.deleted_objects.contains(&object_id) {
+                    document.objects.entry(object_id).or_insert(Object {
+                        kind: object_kind,
+                        x: 0,
+                        y: 0,
+                        properties: BTreeMap::new(),
+                        position_writer: None,
+                    });
+                }
+            }
+            Payload::SetProperty {
+                object_id,
+                key,
+                value,
+            } => {
+                if let Some(object) = document.objects.get_mut(&object_id) {
+                    let replace = object
+                        .properties
+                        .get(&key)
+                        .is_none_or(|current| writer_wins(&writer, &current.writer));
+                    if replace {
+                        object.properties.insert(key, Register { value, writer });
+                    }
+                }
+            }
+            Payload::Move { object_id, x, y } => {
+                if let Some(object) = document.objects.get_mut(&object_id) {
+                    let replace = object
+                        .position_writer
+                        .as_ref()
+                        .is_none_or(|current| writer_wins(&writer, current));
+                    if replace {
+                        object.x = x;
+                        object.y = y;
+                        object.position_writer = Some(writer);
+                    }
+                }
+            }
+            Payload::ListInsert {
+                list_id,
+                element_id,
+                left,
+                value,
+            } => {
+                let list = document.lists.entry(list_id).or_default();
+                if !list.tombstones.contains(&element_id) {
+                    let replace = list
+                        .elements
+                        .get(&element_id)
+                        .is_none_or(|current| writer_wins(&writer, &current.writer));
+                    if replace {
+                        list.elements.insert(
+                            element_id,
+                            ListElement {
+                                left,
+                                value,
+                                writer,
+                            },
+                        );
+                    }
+                }
+            }
+            Payload::ListDelete {
+                list_id,
+                element_id,
+            } => {
+                let list = document.lists.entry(list_id).or_default();
+                list.tombstones.insert(element_id);
+            }
+            Payload::ObjectDelete { object_id } => {
+                document.objects.remove(&object_id);
+                document.deleted_objects.insert(object_id);
+            }
+        }
+        self.frontiers.insert(
+            (operation.document_id, operation.actor_id),
+            operation.actor_sequence,
+        );
+    }
+
+    fn pending_has_cycle(&self) -> bool {
+        let mut edges = vec![Vec::new(); self.pending.len()];
+        for (index, operation) in self.pending.iter().enumerate() {
+            for (actor, sequence) in &operation.dependency_clock {
+                let frontier = self
+                    .frontiers
+                    .get(&(operation.document_id.clone(), actor.clone()))
+                    .copied()
+                    .unwrap_or(0);
+                if frontier >= *sequence {
+                    continue;
+                }
+                if let Some(dependency) = self.pending.iter().position(|candidate| {
+                    candidate.document_id == operation.document_id
+                        && candidate.actor_id == *actor
+                        && candidate.actor_sequence == *sequence
+                }) {
+                    edges[index].push(dependency);
+                }
+            }
+        }
+
+        graph_has_cycle(&edges)
+    }
+}
+
+impl CompactionArtifact {
+    /// Reopens compacted state, retained catch-up history, and permanent identity fingerprints.
+    ///
+    /// # Errors
+    ///
+    /// Returns a serialization error if either artifact part is malformed.
+    pub fn reopen(&self) -> Result<Core, serde_json::Error> {
+        core_from_serialized(&self.state_json, &self.retained_json)
+    }
+}
+
+fn graph_has_cycle(edges: &[Vec<usize>]) -> bool {
+    fn visit(node: usize, edges: &[Vec<usize>], marks: &mut [u8]) -> bool {
+        if marks[node] == 1 {
+            return true;
+        }
+        if marks[node] == 2 {
+            return false;
+        }
+        marks[node] = 1;
+        if edges[node].iter().any(|next| visit(*next, edges, marks)) {
+            return true;
+        }
+        marks[node] = 2;
+        false
+    }
+
+    let mut marks = vec![0; edges.len()];
+    (0..edges.len()).any(|node| visit(node, edges, &mut marks))
+}
+
+fn core_from_serialized(state_json: &str, retained_json: &[u8]) -> Result<Core, serde_json::Error> {
+    let persisted: PersistedCore = serde_json::from_str(state_json)?;
+    let retained: Vec<Operation> = serde_json::from_slice(retained_json)?;
+    Ok(Core {
+        frontiers: persisted
+            .frontiers
+            .into_iter()
+            .map(|entry| ((entry.document_id, entry.actor_id), entry.sequence))
+            .collect(),
+        pending: Vec::new(),
+        documents: persisted.documents,
+        seen: persisted.seen,
+        limits: persisted.limits,
+        history: retained,
+    })
+}
+
+fn operation_fingerprint(operation: &Operation) -> String {
+    let canonical = serde_json::to_vec(operation).unwrap_or_default();
+    stable_digest(&canonical)
+}
+
+fn ordered_visible_elements(list: &List) -> Vec<SnapshotListElement<'_>> {
+    fn walk<'a>(
+        list: &'a List,
+        children: &BTreeMap<Option<&'a str>, Vec<&'a str>>,
+        roots: impl IntoIterator<Item = &'a str>,
+        visited: &mut BTreeSet<&'a str>,
+        output: &mut Vec<SnapshotListElement<'a>>,
+    ) {
+        let mut stack: Vec<_> = roots.into_iter().collect();
+        stack.reverse();
+        while let Some(id) = stack.pop() {
+            if visited.insert(id) {
+                let element = &list.elements[id];
+                if !list.tombstones.contains(id) {
+                    output.push(SnapshotListElement {
+                        id,
+                        value: &element.value,
+                    });
+                }
+                if let Some(next) = children.get(&Some(id)) {
+                    stack.extend(next.iter().rev().copied());
+                }
+            }
+        }
+    }
+
+    let mut children: BTreeMap<Option<&str>, Vec<&str>> = BTreeMap::new();
+    for (id, element) in &list.elements {
+        children
+            .entry(element.left.as_deref())
+            .or_default()
+            .push(id);
+    }
+    let mut visited = BTreeSet::new();
+    let mut output = Vec::new();
+    walk(
+        list,
+        &children,
+        children.get(&None).into_iter().flatten().copied(),
+        &mut visited,
+        &mut output,
+    );
+    for id in list.elements.keys() {
+        if !visited.contains(id.as_str()) {
+            walk(
+                list,
+                &children,
+                std::iter::once(id.as_str()),
+                &mut visited,
+                &mut output,
+            );
+        }
+    }
+    output
+}
+
+fn writer_wins(candidate: &Writer, current: &Writer) -> bool {
+    if candidate
+        .dependency_clock
+        .get(&current.actor_id)
+        .copied()
+        .unwrap_or(0)
+        >= current.actor_sequence
+    {
+        return true;
+    }
+    if current
+        .dependency_clock
+        .get(&candidate.actor_id)
+        .copied()
+        .unwrap_or(0)
+        >= candidate.actor_sequence
+    {
+        return false;
+    }
+    candidate > current
+}
+
+#[must_use]
+pub fn stable_digest(bytes: &[u8]) -> String {
+    format!("{:x}", Sha256::digest(bytes))
+}
diff --git a/developer-simulation/runs/2026-08-16--causal-canvas-compaction/src/main.rs b/developer-simulation/runs/2026-08-16--causal-canvas-compaction/src/main.rs
new file mode 100644
index 0000000..07e2542
--- /dev/null
+++ b/developer-simulation/runs/2026-08-16--causal-canvas-compaction/src/main.rs
@@ -0,0 +1,313 @@
+use std::collections::BTreeMap;
+use std::fs::{self, File};
+use std::io::{BufRead, BufReader};
+use std::path::Path;
+use std::time::Instant;
+
+use causal_canvas_compaction::{
+    ApplyOutcome, ClientWatermark, Core, Limits, Operation, Payload, open_latest,
+    publish_generation, run_reduced_oracle_suite, validate_ndjson_line,
+};
+
+fn main() {
+    if let Err(error) = run() {
+        eprintln!("{error}");
+        std::process::exit(1);
+    }
+}
+
+fn run() -> Result<(), String> {
+    let arguments: Vec<String> = std::env::args().collect();
+    match arguments.get(1).map(String::as_str) {
+        Some("replay") => replay_command(&arguments[2..]),
+        Some("oracle") => oracle_command(&arguments[2..]),
+        Some("workload") => workload_command(&arguments[2..]),
+        Some("largest") => largest_command(&arguments[2..]),
+        _ => Err(
+            "usage: causal-canvas-compaction <replay INPUT STATE DOC NOW|oracle [HISTORIES SCHEDULES ACTORS]|workload [OPERATIONS]|largest OBJECTS ELEMENTS STATE>"
+                .to_string(),
+        ),
+    }
+}
+
+fn replay_command(arguments: &[String]) -> Result<(), String> {
+    let [input, state, document_id, now_minute] = arguments else {
+        return Err("replay requires INPUT STATE DOC NOW".to_string());
+    };
+    let now_minute = now_minute
+        .parse::<u64>()
+        .map_err(|_| "NOW must be an integer minute".to_string())?;
+    let limits = Limits::default();
+    let mut core = Core::with_limits(limits);
+    let mut accepted = 0usize;
+    read_bounded_lines(
+        &Path::new(input).join("operations.ndjson"),
+        limits.max_line_bytes,
+        |line| {
+            let operation = validate_ndjson_line(line, limits)
+                .map_err(|error| format!("operation validation error: {error:?}"))?;
+            match core.apply(operation) {
+                ApplyOutcome::Applied { .. } | ApplyOutcome::Buffered => {
+                    accepted += 1;
+                    Ok(())
+                }
+                ApplyOutcome::Duplicate => Ok(()),
+                ApplyOutcome::Rejected(error) => Err(format!("apply error: {error:?}")),
+            }
+        },
+    )?;
+    let pending = core.pending_diagnosis();
+    if pending.pending_operations != 0 {
+        return Err(format!(
+            "{} operations remain causally blocked; cycle={}",
+            pending.pending_operations, pending.has_cycle
+        ));
+    }
+
+    let watermarks_bytes = read_small_file(&Path::new(input).join("watermarks.json"), 1_048_576)?;
+    let watermarks: Vec<ClientWatermark> = serde_json::from_slice(&watermarks_bytes)
+        .map_err(|error| format!("watermark JSON error: {error}"))?;
+    let crash_bytes = read_small_file(&Path::new(input).join("crash_schedules.json"), 1_048_576)?;
+    let _: Vec<serde_json::Value> = serde_json::from_slice(&crash_bytes)
+        .map_err(|error| format!("crash schedule JSON error: {error}"))?;
+
+    let artifact = core
+        .compact(document_id, &watermarks, now_minute)
+        .map_err(|error| format!("compaction error: {error}"))?;
+    publish_generation(Path::new(state), 1, &artifact, None)
+        .map_err(|error| format!("publication error: {error}"))?;
+    println!(
+        "{{\"accepted_operations\":{accepted},\"pending_operations\":0,\"snapshot_digest\":\"{}\",\"uncompacted_bytes\":{},\"compacted_bytes\":{}}}",
+        causal_canvas_compaction::stable_digest(artifact.snapshot_json.as_bytes()),
+        artifact.uncompacted_bytes,
+        artifact.compacted_bytes
+    );
+    Ok(())
+}
+
+fn oracle_command(arguments: &[String]) -> Result<(), String> {
+    let histories = parse_or(arguments.first(), 50)?;
+    let schedules = parse_or(arguments.get(1), 20)?;
+    let actors = parse_or(arguments.get(2), 64)?;
+    let summary = run_reduced_oracle_suite(histories, schedules, actors);
+    println!(
+        "{{\"histories\":{},\"schedules_per_history\":{},\"comparisons\":{},\"failures\":{},\"digest\":\"{}\"}}",
+        summary.histories,
+        summary.schedules_per_history,
+        summary.comparisons,
+        summary.failures,
+        summary.digest
+    );
+    if summary.failures == 0 {
+        Ok(())
+    } else {
+        Err("reduced oracle comparisons failed".to_string())
+    }
+}
+
+fn workload_command(arguments: &[String]) -> Result<(), String> {
+    let operation_count = parse_or(arguments.first(), 100_000)?;
+    if operation_count < 1 {
+        return Err("operation count must be positive".to_string());
+    }
+    let started = Instant::now();
+    let mut core = Core::new();
+    let mut batch_latencies = Vec::new();
+    let mut batch_started = Instant::now();
+    for sequence in 1..=operation_count {
+        let sequence = u64::try_from(sequence).map_err(|_| "operation count too large")?;
+        let payload = if sequence == 1 {
+            Payload::Create {
+                object_id: "shape".to_string(),
+                object_kind: "rectangle".to_string(),
+            }
+        } else {
+            Payload::SetProperty {
+                object_id: "shape".to_string(),
+                key: "value".to_string(),
+                value: sequence.to_string(),
+            }
+        };
+        let dependency_clock = if sequence == 1 {
+            BTreeMap::new()
+        } else {
+            BTreeMap::from([("actor".to_string(), sequence - 1)])
+        };
+        let outcome = core.apply(Operation {
+            id: format!("actor-{sequence}"),
+            document_id: "workload".to_string(),
+            actor_id: "actor".to_string(),
+            actor_sequence: sequence,
+            dependency_clock,
+            accepted_minute: sequence,
+            payload,
+        });
+        if !matches!(outcome, ApplyOutcome::Applied { .. }) {
+            return Err(format!("unexpected workload apply result: {outcome:?}"));
+        }
+        if sequence % 200 == 0 {
+            batch_latencies.push(batch_started.elapsed().as_micros());
+            batch_started = Instant::now();
+        }
+    }
+    batch_latencies.sort_unstable();
+    let warmed = batch_latencies.get(5..).unwrap_or(&batch_latencies);
+    let p95_index = warmed.len().saturating_sub(1) * 95 / 100;
+    let p95_micros = warmed.get(p95_index).copied().unwrap_or(0);
+    let elapsed_millis = started.elapsed().as_millis();
+    let digest = core
+        .snapshot_digest("workload")
+        .map_err(|error| format!("snapshot error: {error}"))?;
+    println!(
+        "{{\"operations\":{operation_count},\"elapsed_ms\":{elapsed_millis},\"batch_200_p95_us\":{p95_micros},\"snapshot_digest\":\"{digest}\"}}"
+    );
+    Ok(())
+}
+
+fn largest_command(arguments: &[String]) -> Result<(), String> {
+    let [object_count, element_count, state] = arguments else {
+        return Err("largest requires OBJECTS ELEMENTS STATE".to_string());
+    };
+    let object_count = object_count
+        .parse::<usize>()
+        .map_err(|_| "OBJECTS must be an integer".to_string())?;
+    let element_count = element_count
+        .parse::<usize>()
+        .map_err(|_| "ELEMENTS must be an integer".to_string())?;
+    let build_started = Instant::now();
+    let mut core = Core::new();
+    let mut sequence = 0_u64;
+    for index in 0..object_count {
+        sequence = sequence
+            .checked_add(1)
+            .ok_or_else(|| "sequence overflow".to_string())?;
+        apply_generated(
+            &mut core,
+            sequence,
+            Payload::Create {
+                object_id: format!("object-{index:06}"),
+                object_kind: "rectangle".to_string(),
+            },
+        )?;
+    }
+    for index in 0..element_count {
+        sequence = sequence
+            .checked_add(1)
+            .ok_or_else(|| "sequence overflow".to_string())?;
+        apply_generated(
+            &mut core,
+            sequence,
+            Payload::ListInsert {
+                list_id: "layers".to_string(),
+                element_id: format!("element-{index:06}"),
+                left: index
+                    .checked_sub(1)
+                    .map(|previous| format!("element-{previous:06}")),
+                value: format!("object-{:06}", index % object_count.max(1)),
+            },
+        )?;
+    }
+    let build_millis = build_started.elapsed().as_millis();
+    let compact_started = Instant::now();
+    let artifact = core
+        .compact("largest", &[], sequence)
+        .map_err(|error| format!("compaction error: {error}"))?;
+    let compact_millis = compact_started.elapsed().as_millis();
+    let publish_started = Instant::now();
+    publish_generation(Path::new(state), 1, &artifact, None)
+        .map_err(|error| format!("publication error: {error}"))?;
+    let publish_millis = publish_started.elapsed().as_millis();
+    let open_started = Instant::now();
+    let reopened = open_latest(Path::new(state)).map_err(|error| format!("open error: {error}"))?;
+    let open_millis = open_started.elapsed().as_millis();
+    let digest = reopened
+        .core
+        .snapshot_digest("largest")
+        .map_err(|error| format!("snapshot error: {error}"))?;
+    println!(
+        "{{\"objects\":{object_count},\"list_elements\":{element_count},\"build_ms\":{build_millis},\"compact_ms\":{compact_millis},\"publish_ms\":{publish_millis},\"open_ms\":{open_millis},\"compacted_bytes\":{},\"snapshot_digest\":\"{digest}\"}}",
+        artifact.compacted_bytes
+    );
+    Ok(())
+}
+
+fn apply_generated(core: &mut Core, sequence: u64, payload: Payload) -> Result<(), String> {
+    let dependency_clock = if sequence == 1 {
+        BTreeMap::new()
+    } else {
+        BTreeMap::from([("generator".to_string(), sequence - 1)])
+    };
+    let outcome = core.apply(Operation {
+        id: format!("generator-{sequence}"),
+        document_id: "largest".to_string(),
+        actor_id: "generator".to_string(),
+        actor_sequence: sequence,
+        dependency_clock,
+        accepted_minute: sequence,
+        payload,
+    });
+    if matches!(outcome, ApplyOutcome::Applied { .. }) {
+        Ok(())
+    } else {
+        Err(format!("unexpected generated apply result: {outcome:?}"))
+    }
+}
+
+fn parse_or(value: Option<&String>, default: usize) -> Result<usize, String> {
+    value.map_or(Ok(default), |value| {
+        value
+            .parse::<usize>()
+            .map_err(|_| format!("invalid integer: {value}"))
+    })
+}
+
+fn read_small_file(path: &Path, maximum: u64) -> Result<Vec<u8>, String> {
+    let metadata = fs::metadata(path).map_err(|error| format!("{}: {error}", path.display()))?;
+    if metadata.len() > maximum {
+        return Err(format!("{} exceeds {maximum} bytes", path.display()));
+    }
+    fs::read(path).map_err(|error| format!("{}: {error}", path.display()))
+}
+
+fn read_bounded_lines(
+    path: &Path,
+    maximum: usize,
+    mut on_line: impl FnMut(&[u8]) -> Result<(), String>,
+) -> Result<(), String> {
+    let file = File::open(path).map_err(|error| format!("{}: {error}", path.display()))?;
+    let mut reader = BufReader::new(file);
+    loop {
+        let mut line = Vec::with_capacity(maximum.min(8_192));
+        let reached_eof = loop {
+            let available = reader
+                .fill_buf()
+                .map_err(|error| format!("{}: {error}", path.display()))?;
+            if available.is_empty() {
+                break true;
+            }
+            let take = available
+                .iter()
+                .position(|byte| *byte == b'\n')
+                .map_or(available.len(), |index| index + 1);
+            if line.len().saturating_add(take) > maximum.saturating_add(1) {
+                return Err(format!("{} contains an oversized line", path.display()));
+            }
+            let has_newline = available[take - 1] == b'\n';
+            line.extend_from_slice(&available[..take]);
+            reader.consume(take);
+            if has_newline {
+                break false;
+            }
+        };
+        while matches!(line.last(), Some(b'\n' | b'\r')) {
+            line.pop();
+        }
+        if !line.is_empty() {
+            on_line(&line)?;
+        }
+        if reached_eof {
+            break;
+        }
+    }
+    Ok(())
+}
diff --git a/developer-simulation/runs/2026-08-16--causal-canvas-compaction/src/store.rs b/developer-simulation/runs/2026-08-16--causal-canvas-compaction/src/store.rs
new file mode 100644
index 0000000..82d2fa2
--- /dev/null
+++ b/developer-simulation/runs/2026-08-16--causal-canvas-compaction/src/store.rs
@@ -0,0 +1,241 @@
+use std::fmt;
+use std::fs::{self, File};
+use std::io::Write;
+use std::path::{Path, PathBuf};
+
+use serde_json::Value;
+
+use super::{CompactionArtifact, Core, core_from_serialized, stable_digest};
+
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+pub enum FaultStage {
+    GenerationCreated,
+    DataFlushed,
+    ManifestFlushed,
+    GenerationRenamed,
+    DirectorySynced,
+}
+
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+pub struct FaultInjection {
+    /// Requests an ordinary returned error after the named stage has completed.
+    /// This does not terminate the process or synthesize an operating-system I/O failure.
+    pub stage: FaultStage,
+}
+
+#[derive(Debug)]
+pub enum StoreError {
+    Io(std::io::Error),
+    Json(serde_json::Error),
+    Injected(FaultInjection),
+    InvalidGeneration,
+    GenerationConflict,
+}
+
+impl fmt::Display for StoreError {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        match self {
+            Self::Io(error) => write!(formatter, "storage I/O error: {error}"),
+            Self::Json(error) => write!(formatter, "generation JSON error: {error}"),
+            Self::Injected(fault) => write!(
+                formatter,
+                "injected in-process returned error after {:?}",
+                fault.stage
+            ),
+            Self::InvalidGeneration => formatter.write_str("no complete valid generation"),
+            Self::GenerationConflict => {
+                formatter.write_str("generation number already has different bytes")
+            }
+        }
+    }
+}
+
+impl std::error::Error for StoreError {}
+
+impl From<std::io::Error> for StoreError {
+    fn from(value: std::io::Error) -> Self {
+        Self::Io(value)
+    }
+}
+
+impl From<serde_json::Error> for StoreError {
+    fn from(value: serde_json::Error) -> Self {
+        Self::Json(value)
+    }
+}
+
+pub struct OpenedGeneration {
+    pub generation: u64,
+    pub core: Core,
+}
+
+/// Publishes one complete local generation and then atomically advances `CURRENT`.
+///
+/// # Errors
+///
+/// Returns an I/O, serialization, generation-conflict, or requested in-process error.
+pub fn publish_generation(
+    root: &Path,
+    generation: u64,
+    artifact: &CompactionArtifact,
+    fault: Option<FaultInjection>,
+) -> Result<(), StoreError> {
+    fs::create_dir_all(root)?;
+    let final_path = generation_path(root, generation);
+    let temporary_path = temporary_generation_path(root, generation);
+
+    if final_path.exists() {
+        if !files_match(&final_path, artifact)? {
+            return Err(StoreError::GenerationConflict);
+        }
+    } else {
+        if temporary_path.exists() {
+            fs::remove_dir_all(&temporary_path)?;
+        }
+        fs::create_dir(&temporary_path)?;
+        inject(fault, FaultStage::GenerationCreated)?;
+
+        write_synced(
+            &temporary_path.join("state.json"),
+            artifact.state_json.as_bytes(),
+        )?;
+        write_synced(
+            &temporary_path.join("retained.json"),
+            &artifact.retained_json,
+        )?;
+        inject(fault, FaultStage::DataFlushed)?;
+
+        write_synced(
+            &temporary_path.join("manifest.json"),
+            artifact.manifest_json.as_bytes(),
+        )?;
+        write_synced(
+            &temporary_path.join("manifest.sha256"),
+            stable_digest(artifact.manifest_json.as_bytes()).as_bytes(),
+        )?;
+        sync_directory(&temporary_path)?;
+        inject(fault, FaultStage::ManifestFlushed)?;
+
+        fs::rename(&temporary_path, &final_path)?;
+        inject(fault, FaultStage::GenerationRenamed)?;
+        sync_directory(root)?;
+        inject(fault, FaultStage::DirectorySynced)?;
+    }
+
+    let current_temporary = root.join("CURRENT.tmp");
+    if current_temporary.exists() {
+        fs::remove_file(&current_temporary)?;
+    }
+    write_synced(&current_temporary, generation.to_string().as_bytes())?;
+    fs::rename(current_temporary, root.join("CURRENT"))?;
+    sync_directory(root)?;
+    Ok(())
+}
+
+/// Opens the generation named by `CURRENT`, falling back to the newest valid generation.
+///
+/// # Errors
+///
+/// Returns an I/O error when the store cannot be scanned, or `InvalidGeneration`
+/// when no complete generation passes manifest validation.
+pub fn open_latest(root: &Path) -> Result<OpenedGeneration, StoreError> {
+    if let Ok(current) = fs::read_to_string(root.join("CURRENT"))
+        && let Ok(generation) = current.trim().parse::<u64>()
+        && let Ok(opened) = open_generation(root, generation)
+    {
+        return Ok(opened);
+    }
+    let mut generations = Vec::new();
+    for entry in fs::read_dir(root)? {
+        let entry = entry?;
+        let name = entry.file_name();
+        let Some(name) = name.to_str() else {
+            continue;
+        };
+        if let Some(number) = name
+            .strip_prefix("generation-")
+            .and_then(|number| number.parse::<u64>().ok())
+        {
+            generations.push(number);
+        }
+    }
+    generations.sort_unstable_by(|a, b| b.cmp(a));
+    for generation in generations {
+        if let Ok(opened) = open_generation(root, generation) {
+            return Ok(opened);
+        }
+    }
+    Err(StoreError::InvalidGeneration)
+}
+
+fn open_generation(root: &Path, generation: u64) -> Result<OpenedGeneration, StoreError> {
+    let path = generation_path(root, generation);
+    let state = fs::read_to_string(path.join("state.json"))?;
+    let retained = fs::read(path.join("retained.json"))?;
+    let manifest = fs::read_to_string(path.join("manifest.json"))?;
+    let manifest_digest = fs::read_to_string(path.join("manifest.sha256"))?;
+    if manifest_digest.trim() != stable_digest(manifest.as_bytes()) {
+        return Err(StoreError::InvalidGeneration);
+    }
+    let manifest_value: Value = serde_json::from_str(&manifest)?;
+    verify_digest(&manifest_value, "state_digest", state.as_bytes())?;
+    verify_digest(&manifest_value, "retained_digest", &retained)?;
+    let document_id = manifest_value
+        .get("document_id")
+        .and_then(Value::as_str)
+        .ok_or(StoreError::InvalidGeneration)?;
+    let core = core_from_serialized(&state, &retained)?;
+    let snapshot = core.canonical_snapshot(document_id)?;
+    verify_digest(&manifest_value, "snapshot_digest", snapshot.as_bytes())?;
+    Ok(OpenedGeneration { generation, core })
+}
+
+fn verify_digest(manifest: &Value, field: &str, bytes: &[u8]) -> Result<(), StoreError> {
+    let expected = manifest
+        .get(field)
+        .and_then(Value::as_str)
+        .ok_or(StoreError::InvalidGeneration)?;
+    if expected == stable_digest(bytes) {
+        Ok(())
+    } else {
+        Err(StoreError::InvalidGeneration)
+    }
+}
+
+fn files_match(path: &Path, artifact: &CompactionArtifact) -> Result<bool, StoreError> {
+    Ok(
+        fs::read(path.join("state.json"))? == artifact.state_json.as_bytes()
+            && fs::read(path.join("retained.json"))? == artifact.retained_json
+            && fs::read(path.join("manifest.json"))? == artifact.manifest_json.as_bytes()
+            && fs::read(path.join("manifest.sha256"))?
+                == stable_digest(artifact.manifest_json.as_bytes()).as_bytes(),
+    )
+}
+
+fn write_synced(path: &Path, bytes: &[u8]) -> Result<(), StoreError> {
+    let mut file = File::create(path)?;
+    file.write_all(bytes)?;
+    file.sync_all()?;
+    Ok(())
+}
+
+fn sync_directory(path: &Path) -> Result<(), StoreError> {
+    File::open(path)?.sync_all()?;
+    Ok(())
+}
+
+fn inject(fault: Option<FaultInjection>, stage: FaultStage) -> Result<(), StoreError> {
+    if fault.is_some_and(|fault| fault.stage == stage) {
+        Err(StoreError::Injected(fault.expect("checked above")))
+    } else {
+        Ok(())
+    }
+}
+
+fn generation_path(root: &Path, generation: u64) -> PathBuf {
+    root.join(format!("generation-{generation:020}"))
+}
+
+fn temporary_generation_path(root: &Path, generation: u64) -> PathBuf {
+    root.join(format!("generation-{generation:020}.tmp"))
+}
diff --git a/developer-simulation/runs/2026-08-16--causal-canvas-compaction/src/suite.rs b/developer-simulation/runs/2026-08-16--causal-canvas-compaction/src/suite.rs
new file mode 100644
index 0000000..4d22612
--- /dev/null
+++ b/developer-simulation/runs/2026-08-16--causal-canvas-compaction/src/suite.rs
@@ -0,0 +1,111 @@
+use std::collections::BTreeMap;
+
+use super::{Core, Operation, Payload, stable_digest};
+
+#[derive(Clone, Debug, Eq, PartialEq)]
+pub struct SuiteSummary {
+    pub histories: usize,
+    pub schedules_per_history: usize,
+    pub comparisons: usize,
+    pub failures: usize,
+    pub digest: String,
+}
+
+#[must_use]
+pub fn run_reduced_oracle_suite(
+    history_count: usize,
+    schedules_per_history: usize,
+    actor_count: usize,
+) -> SuiteSummary {
+    let actor_count = actor_count.max(1);
+    let mut failures = 0;
+    let mut digest_material = Vec::new();
+
+    for history in 0..history_count {
+        let document_id = format!("doc-{history:03}");
+        let operations = generated_scalar_history(&document_id, actor_count);
+        let winner = format!("actor-{:02}", actor_count - 1);
+        let expected = format!(
+            "{{\"document_id\":\"{document_id}\",\"objects\":[{{\"id\":\"shape\",\"kind\":\"rectangle\",\"x\":0,\"y\":0,\"properties\":{{\"fill\":\"value-{winner}\"}}}}],\"lists\":[]}}"
+        );
+        for schedule in 0..schedules_per_history {
+            let mut delivery = operations.clone();
+            shuffle(
+                &mut delivery,
+                (history as u64 + 1) * 1_000_003 + schedule as u64,
+            );
+            let duplicate_count = delivery.len() * 8 / 100;
+            let duplicates: Vec<_> = delivery.iter().take(duplicate_count).cloned().collect();
+            delivery.extend(duplicates);
+            if schedule == 0 {
+                delivery.reverse();
+            }
+
+            let mut core = Core::new();
+            for operation in delivery {
+                core.apply(operation);
+            }
+            match core.canonical_snapshot(&document_id) {
+                Ok(snapshot) => {
+                    if snapshot != expected {
+                        failures += 1;
+                    }
+                    digest_material.extend_from_slice(snapshot.as_bytes());
+                }
+                Err(_) => failures += 1,
+            }
+        }
+    }
+
+    SuiteSummary {
+        histories: history_count,
+        schedules_per_history,
+        comparisons: history_count.saturating_mul(schedules_per_history),
+        failures,
+        digest: stable_digest(&digest_material),
+    }
+}
+
+fn generated_scalar_history(document_id: &str, actor_count: usize) -> Vec<Operation> {
+    let mut operations = vec![Operation {
+        id: "creator-1".to_string(),
+        document_id: document_id.to_string(),
+        actor_id: "creator".to_string(),
+        actor_sequence: 1,
+        dependency_clock: BTreeMap::new(),
+        accepted_minute: 1,
+        payload: Payload::Create {
+            object_id: "shape".to_string(),
+            object_kind: "rectangle".to_string(),
+        },
+    }];
+    for actor in 0..actor_count {
+        let actor_id = format!("actor-{actor:02}");
+        operations.push(Operation {
+            id: format!("{actor_id}-1"),
+            document_id: document_id.to_string(),
+            actor_id: actor_id.clone(),
+            actor_sequence: 1,
+            dependency_clock: BTreeMap::from([("creator".to_string(), 1)]),
+            accepted_minute: actor as u64 + 2,
+            payload: Payload::SetProperty {
+                object_id: "shape".to_string(),
+                key: "fill".to_string(),
+                value: format!("value-{actor_id}"),
+            },
+        });
+    }
+    operations
+}
+
+fn shuffle<T>(items: &mut [T], seed: u64) {
+    let mut state = seed | 1;
+    for index in (1..items.len()).rev() {
+        state = state
+            .wrapping_mul(6_364_136_223_846_793_005)
+            .wrapping_add(1_442_695_040_888_963_407);
+        let modulus = u64::try_from(index + 1).unwrap_or(u64::MAX);
+        let selected = usize::try_from(state % modulus).unwrap_or(0);
+        items.swap(index, selected);
+    }
+}
diff --git a/developer-simulation/runs/2026-08-16--causal-canvas-compaction/tests/cli.rs b/developer-simulation/runs/2026-08-16--causal-canvas-compaction/tests/cli.rs
new file mode 100644
index 0000000..0009f4d
--- /dev/null
+++ b/developer-simulation/runs/2026-08-16--causal-canvas-compaction/tests/cli.rs
@@ -0,0 +1,83 @@
+use std::fs;
+use std::path::PathBuf;
+use std::process::Command;
+use std::time::{SystemTime, UNIX_EPOCH};
+
+use causal_canvas_compaction::open_latest;
+
+fn temporary_path(label: &str) -> PathBuf {
+    let nonce = SystemTime::now()
+        .duration_since(UNIX_EPOCH)
+        .unwrap()
+        .as_nanos();
+    std::env::temp_dir().join(format!("canvas-cli-{label}-{nonce}"))
+}
+
+#[test]
+fn replay_command_reads_ndjson_compacts_publishes_and_reopens() {
+    // Catches a harness that only demonstrates in-memory helpers, ignores the
+    // declared directory inputs, or reports success without readable state.
+    let input = temporary_path("input");
+    let state = temporary_path("state");
+    fs::create_dir_all(&input).unwrap();
+    let operations = concat!(
+        "{\"id\":\"a-1\",\"document_id\":\"canvas\",\"actor_id\":\"a\",\"actor_sequence\":1,\"dependency_clock\":{},\"accepted_minute\":1,\"payload\":{\"kind\":\"create\",\"object_id\":\"shape\",\"object_kind\":\"rectangle\"}}\n",
+        "{\"id\":\"a-2\",\"document_id\":\"canvas\",\"actor_id\":\"a\",\"actor_sequence\":2,\"dependency_clock\":{\"a\":1},\"accepted_minute\":2,\"payload\":{\"kind\":\"set_property\",\"object_id\":\"shape\",\"key\":\"fill\",\"value\":\"blue\"}}\n"
+    );
+    fs::write(input.join("operations.ndjson"), operations).unwrap();
+    fs::write(
+        input.join("watermarks.json"),
+        "[{\"client_id\":\"client\",\"document_id\":\"canvas\",\"acknowledged\":{\"a\":2},\"acknowledged_minute\":10}]",
+    )
+    .unwrap();
+    fs::write(input.join("crash_schedules.json"), "[]").unwrap();
+
+    let result = Command::new(env!("CARGO_BIN_EXE_causal-canvas-compaction"))
+        .args([
+            "replay",
+            input.to_str().unwrap(),
+            state.to_str().unwrap(),
+            "canvas",
+            "10",
+        ])
+        .output()
+        .unwrap();
+    assert!(
+        result.status.success(),
+        "stderr: {}",
+        String::from_utf8_lossy(&result.stderr)
+    );
+    assert!(String::from_utf8_lossy(&result.stdout).contains("\"accepted_operations\":2"));
+    let reopened = open_latest(&state).unwrap();
+    assert_eq!(
+        reopened.core.canonical_snapshot("canvas").unwrap(),
+        r#"{"document_id":"canvas","objects":[{"id":"shape","kind":"rectangle","x":0,"y":0,"properties":{"fill":"blue"}}],"lists":[]}"#
+    );
+
+    fs::remove_dir_all(input).unwrap();
+    fs::remove_dir_all(state).unwrap();
+}
+
+#[test]
+fn largest_command_builds_publishes_and_times_a_requested_shape() {
+    // Catches reporting an open benchmark without actually publishing and
+    // reopening the requested object/list cardinalities.
+    let state = temporary_path("largest-state");
+    let result = Command::new(env!("CARGO_BIN_EXE_causal-canvas-compaction"))
+        .args(["largest", "10", "5", state.to_str().unwrap()])
+        .output()
+        .unwrap();
+    assert!(
+        result.status.success(),
+        "stderr: {}",
+        String::from_utf8_lossy(&result.stderr)
+    );
+    let summary: serde_json::Value = serde_json::from_slice(&result.stdout).unwrap();
+    assert_eq!(summary["objects"], 10);
+    assert_eq!(summary["list_elements"], 5);
+    let reopened = open_latest(&state).unwrap();
+    let snapshot = reopened.core.canonical_snapshot("largest").unwrap();
+    assert!(snapshot.contains("\"id\":\"object-000009\""));
+    assert!(snapshot.contains("\"id\":\"element-000004\""));
+    fs::remove_dir_all(state).unwrap();
+}
diff --git a/developer-simulation/runs/2026-08-16--causal-canvas-compaction/tests/compaction.rs b/developer-simulation/runs/2026-08-16--causal-canvas-compaction/tests/compaction.rs
new file mode 100644
index 0000000..66ed0d8
--- /dev/null
+++ b/developer-simulation/runs/2026-08-16--causal-canvas-compaction/tests/compaction.rs
@@ -0,0 +1,314 @@
+use std::collections::BTreeMap;
+use std::fs;
+use std::path::PathBuf;
+use std::time::{SystemTime, UNIX_EPOCH};
+
+use causal_canvas_compaction::{
+    ApplyError, ApplyOutcome, ClientWatermark, CompactionError, Core, OFFLINE_WINDOW_MINUTES,
+    Operation, Payload, ReconnectDecision, open_latest, publish_generation, reconnect_decision,
+};
+
+const DAY_MINUTES: u64 = 24 * 60;
+
+#[test]
+fn reconnect_window_has_deterministic_full_thirty_day_boundary() {
+    // Catches off-by-one comparisons and wall-clock rounding. Inputs are exact
+    // integer minutes; 30 days is allowed and 30 days + 1 minute is not.
+    let now = 100 * DAY_MINUTES;
+    assert_eq!(
+        reconnect_decision(now, now - (30 * DAY_MINUTES - 1)),
+        ReconnectDecision::CatchUp
+    );
+    assert_eq!(
+        reconnect_decision(now, now - 30 * DAY_MINUTES),
+        ReconnectDecision::CatchUp
+    );
+    assert_eq!(
+        reconnect_decision(now, now - (30 * DAY_MINUTES + 1)),
+        ReconnectDecision::SnapshotRequired
+    );
+}
+
+fn op(sequence: u64, payload: Payload) -> Operation {
+    Operation {
+        id: format!("alice-{sequence}"),
+        document_id: "canvas".to_string(),
+        actor_id: "alice".to_string(),
+        actor_sequence: sequence,
+        dependency_clock: if sequence == 1 {
+            BTreeMap::new()
+        } else {
+            BTreeMap::from([("alice".to_string(), sequence - 1)])
+        },
+        accepted_minute: 10_000 + sequence,
+        payload,
+    }
+}
+
+fn overwrite_heavy_operations() -> Vec<Operation> {
+    let large = |ch: char| std::iter::repeat_n(ch, 1_000).collect::<String>();
+    vec![
+        op(
+            1,
+            Payload::Create {
+                object_id: "shape".to_string(),
+                object_kind: "text".to_string(),
+            },
+        ),
+        op(
+            2,
+            Payload::SetProperty {
+                object_id: "shape".to_string(),
+                key: "text".to_string(),
+                value: large('a'),
+            },
+        ),
+        op(
+            3,
+            Payload::SetProperty {
+                object_id: "shape".to_string(),
+                key: "text".to_string(),
+                value: large('b'),
+            },
+        ),
+        op(
+            4,
+            Payload::SetProperty {
+                object_id: "shape".to_string(),
+                key: "text".to_string(),
+                value: large('c'),
+            },
+        ),
+        op(
+            5,
+            Payload::SetProperty {
+                object_id: "shape".to_string(),
+                key: "text".to_string(),
+                value: large('d'),
+            },
+        ),
+        op(
+            6,
+            Payload::SetProperty {
+                object_id: "shape".to_string(),
+                key: "text".to_string(),
+                value: large('e'),
+            },
+        ),
+        op(
+            7,
+            Payload::SetProperty {
+                object_id: "shape".to_string(),
+                key: "text".to_string(),
+                value: large('f'),
+            },
+        ),
+        op(
+            8,
+            Payload::SetProperty {
+                object_id: "shape".to_string(),
+                key: "text".to_string(),
+                value: large('g'),
+            },
+        ),
+    ]
+}
+
+#[test]
+fn compaction_counts_permanent_identity_metadata_in_retained_byte_gate() {
+    // Catches pruning past an in-window watermark, allowing an expired client
+    // to pin history, or depending on client input order for manifest bytes.
+    let mut core = Core::new();
+    for operation in overwrite_heavy_operations() {
+        core.apply(operation);
+    }
+
+    let now = 100_000;
+    let active = ClientWatermark {
+        client_id: "active".to_string(),
+        document_id: "canvas".to_string(),
+        acknowledged: BTreeMap::from([("alice".to_string(), 7)]),
+        acknowledged_minute: now - 10,
+    };
+    let expired = ClientWatermark {
+        client_id: "expired".to_string(),
+        document_id: "canvas".to_string(),
+        acknowledged: BTreeMap::new(),
+        acknowledged_minute: now - (OFFLINE_WINDOW_MINUTES + 1),
+    };
+
+    let first = core
+        .compact("canvas", &[active.clone(), expired.clone()], now)
+        .unwrap();
+    let reversed = core.compact("canvas", &[expired, active], now).unwrap();
+
+    assert_eq!(first.retained_operation_ids, ["alice-8"]);
+    assert_eq!(
+        first.reconnect_decisions,
+        BTreeMap::from([
+            ("active".to_string(), ReconnectDecision::CatchUp),
+            ("expired".to_string(), ReconnectDecision::SnapshotRequired),
+        ])
+    );
+    assert_eq!(first.manifest_json, reversed.manifest_json);
+    let percentage_hundredths =
+        (first.compacted_bytes * 10_000 + first.uncompacted_bytes / 2) / first.uncompacted_bytes;
+    eprintln!(
+        "retained-byte gate: compacted={} uncompacted={} percent={}.{:02}",
+        first.compacted_bytes,
+        first.uncompacted_bytes,
+        percentage_hundredths / 100,
+        percentage_hundredths % 100
+    );
+    assert!(first.compacted_bytes * 100 > first.uncompacted_bytes * 40);
+}
+
+#[test]
+fn compacted_state_reopens_with_tombstones_and_accepts_in_window_pending_edit() {
+    // Catches publishing only visible JSON while losing the deletion metadata or
+    // causal frontier needed to validate a supported reconnecting actor's edit.
+    let mut core = Core::new();
+    core.apply(Operation {
+        id: "creator-1".to_string(),
+        document_id: "canvas".to_string(),
+        actor_id: "creator".to_string(),
+        actor_sequence: 1,
+        dependency_clock: BTreeMap::new(),
+        accepted_minute: 1,
+        payload: Payload::Create {
+            object_id: "gone".to_string(),
+            object_kind: "rectangle".to_string(),
+        },
+    });
+    core.apply(Operation {
+        id: "deleter-1".to_string(),
+        document_id: "canvas".to_string(),
+        actor_id: "deleter".to_string(),
+        actor_sequence: 1,
+        dependency_clock: BTreeMap::from([("creator".to_string(), 1)]),
+        accepted_minute: 2,
+        payload: Payload::ObjectDelete {
+            object_id: "gone".to_string(),
+        },
+    });
+    let client = ClientWatermark {
+        client_id: "offline".to_string(),
+        document_id: "canvas".to_string(),
+        acknowledged: BTreeMap::from([("creator".to_string(), 1), ("deleter".to_string(), 1)]),
+        acknowledged_minute: 9_900,
+    };
+
+    let artifact = core.compact("canvas", &[client], 10_000).unwrap();
+    let mut reopened = artifact.reopen().unwrap();
+    let pending_edit = Operation {
+        id: "offline-1".to_string(),
+        document_id: "canvas".to_string(),
+        actor_id: "offline".to_string(),
+        actor_sequence: 1,
+        dependency_clock: BTreeMap::from([("deleter".to_string(), 1)]),
+        accepted_minute: 10_000,
+        payload: Payload::SetProperty {
+            object_id: "gone".to_string(),
+            key: "fill".to_string(),
+            value: "red".to_string(),
+        },
+    };
+    assert_eq!(
+        reopened.apply(pending_edit),
+        ApplyOutcome::Applied { drained: 0 }
+    );
+    assert_eq!(
+        reopened.canonical_snapshot("canvas").unwrap(),
+        r#"{"document_id":"canvas","objects":[],"lists":[]}"#
+    );
+}
+
+#[test]
+fn compaction_refuses_a_causally_incomplete_state() {
+    // Catches publishing a snapshot while accepted operations remain buffered,
+    // which could otherwise make an incomplete generation appear complete.
+    let mut core = Core::new();
+    core.apply(Operation {
+        id: "a-2".to_string(),
+        document_id: "canvas".to_string(),
+        actor_id: "a".to_string(),
+        actor_sequence: 2,
+        dependency_clock: BTreeMap::from([("a".to_string(), 1)]),
+        accepted_minute: 2,
+        payload: Payload::ObjectDelete {
+            object_id: "shape".to_string(),
+        },
+    });
+    assert_eq!(
+        core.compact("canvas", &[], 10),
+        Err(CompactionError::PendingOperations)
+    );
+}
+
+#[test]
+fn conflicting_operation_id_reuse_remains_rejected_after_compact_reopen() {
+    // Catches compacting away an accepted operation's permanent identity
+    // fingerprint. The conflicting reuse has the next valid actor sequence, so
+    // only the operation-ID lifecycle rule can reject it.
+    let mut core = Core::new();
+    assert_eq!(
+        core.apply(Operation {
+            id: "reused-id".to_string(),
+            document_id: "canvas".to_string(),
+            actor_id: "alice".to_string(),
+            actor_sequence: 1,
+            dependency_clock: BTreeMap::new(),
+            accepted_minute: 1,
+            payload: Payload::Create {
+                object_id: "shape".to_string(),
+                object_kind: "rectangle".to_string(),
+            },
+        }),
+        ApplyOutcome::Applied { drained: 0 }
+    );
+    let artifact = core.compact("canvas", &[], 10).unwrap();
+    let conflicting_reuse = Operation {
+        id: "reused-id".to_string(),
+        document_id: "canvas".to_string(),
+        actor_id: "alice".to_string(),
+        actor_sequence: 2,
+        dependency_clock: BTreeMap::from([("alice".to_string(), 1)]),
+        accepted_minute: 2,
+        payload: Payload::ObjectDelete {
+            object_id: "shape".to_string(),
+        },
+    };
+
+    let root = temporary_store("identity-lifecycle");
+    publish_generation(&root, 1, &artifact, None).unwrap();
+    let mut published = open_latest(&root).unwrap().core;
+    assert_conflicting_reuse_is_unchanged(&mut published, conflicting_reuse.clone());
+    fs::remove_dir_all(root).unwrap();
+
+    let mut reopened = artifact.reopen().unwrap();
+    assert_conflicting_reuse_is_unchanged(&mut reopened, conflicting_reuse);
+}
+
+fn assert_conflicting_reuse_is_unchanged(core: &mut Core, operation: Operation) {
+    let visible_before = core.canonical_snapshot("canvas").unwrap();
+    let digest_before = core.snapshot_digest("canvas").unwrap();
+    let count_before = core.accepted_count();
+    assert_eq!(
+        core.apply(operation),
+        ApplyOutcome::Rejected(ApplyError::ConflictingOperationId)
+    );
+    assert_eq!(core.canonical_snapshot("canvas").unwrap(), visible_before);
+    assert_eq!(core.snapshot_digest("canvas").unwrap(), digest_before);
+    assert_eq!(core.accepted_count(), count_before);
+}
+
+fn temporary_store(label: &str) -> PathBuf {
+    let nonce = SystemTime::now()
+        .duration_since(UNIX_EPOCH)
+        .unwrap()
+        .as_nanos();
+    std::env::temp_dir().join(format!(
+        "causal-compaction-{label}-{}-{nonce}",
+        std::process::id()
+    ))
+}
diff --git a/developer-simulation/runs/2026-08-16--causal-canvas-compaction/tests/core.rs b/developer-simulation/runs/2026-08-16--causal-canvas-compaction/tests/core.rs
new file mode 100644
index 0000000..3bad673
--- /dev/null
+++ b/developer-simulation/runs/2026-08-16--causal-canvas-compaction/tests/core.rs
@@ -0,0 +1,327 @@
+use std::collections::BTreeMap;
+
+use causal_canvas_compaction::{ApplyError, ApplyOutcome, Core, Limits, Operation, Payload};
+
+fn clock(entries: &[(&str, u64)]) -> BTreeMap<String, u64> {
+    entries
+        .iter()
+        .map(|(actor, seq)| ((*actor).to_string(), *seq))
+        .collect()
+}
+
+fn op(id: &str, actor: &str, seq: u64, deps: &[(&str, u64)], payload: Payload) -> Operation {
+    Operation {
+        id: id.to_string(),
+        document_id: "canvas".to_string(),
+        actor_id: actor.to_string(),
+        actor_sequence: seq,
+        dependency_clock: clock(deps),
+        accepted_minute: 1_000 + seq,
+        payload,
+    }
+}
+
+#[test]
+fn causally_buffered_scalar_history_has_literal_canonical_snapshot() {
+    // Catches applying a dependent write before its create, failing to drain the
+    // buffer, or emitting state in insertion/hash-map order. Expected JSON is
+    // hand-derived from the two operations below.
+    let create = op(
+        "a-1",
+        "alice",
+        1,
+        &[],
+        Payload::Create {
+            object_id: "shape-1".to_string(),
+            object_kind: "rectangle".to_string(),
+        },
+    );
+    let set_fill = op(
+        "a-2",
+        "alice",
+        2,
+        &[("alice", 1)],
+        Payload::SetProperty {
+            object_id: "shape-1".to_string(),
+            key: "fill".to_string(),
+            value: "blue".to_string(),
+        },
+    );
+
+    let mut core = Core::new();
+    assert_eq!(core.apply(set_fill), ApplyOutcome::Buffered);
+    assert_eq!(core.apply(create), ApplyOutcome::Applied { drained: 1 });
+
+    assert_eq!(
+        core.canonical_snapshot("canvas").unwrap(),
+        r#"{"document_id":"canvas","objects":[{"id":"shape-1","kind":"rectangle","x":0,"y":0,"properties":{"fill":"blue"}}],"lists":[]}"#
+    );
+}
+
+#[test]
+fn duplicate_is_a_no_op_and_conflicting_id_reuse_is_rejected_atomically() {
+    // Catches identity tracking that checks only actor/sequence, counts an exact
+    // duplicate, or mutates visible state before discovering an ID conflict.
+    let create = op(
+        "a-1",
+        "alice",
+        1,
+        &[],
+        Payload::Create {
+            object_id: "shape-1".to_string(),
+            object_kind: "rectangle".to_string(),
+        },
+    );
+    let conflicting = op(
+        "a-1",
+        "alice",
+        1,
+        &[],
+        Payload::Create {
+            object_id: "wrong-shape".to_string(),
+            object_kind: "ellipse".to_string(),
+        },
+    );
+
+    let mut core = Core::new();
+    assert_eq!(
+        core.apply(create.clone()),
+        ApplyOutcome::Applied { drained: 0 }
+    );
+    let before = core.canonical_snapshot("canvas").unwrap();
+    let before_digest = core.snapshot_digest("canvas").unwrap();
+    let before_count = core.accepted_count();
+
+    assert_eq!(core.apply(create), ApplyOutcome::Duplicate);
+    assert_eq!(core.accepted_count(), before_count);
+    assert_eq!(core.snapshot_digest("canvas").unwrap(), before_digest);
+
+    assert_eq!(
+        core.apply(conflicting),
+        ApplyOutcome::Rejected(ApplyError::ConflictingOperationId)
+    );
+    assert_eq!(core.accepted_count(), before_count);
+    assert_eq!(core.canonical_snapshot("canvas").unwrap(), before);
+}
+
+#[test]
+fn concurrent_scalar_winner_is_independent_of_delivery_order() {
+    // Catches arrival-order LWW. Both writes have the same integer sequence;
+    // the reduced model's declared tie-break is actor ID, so "bob" wins.
+    let create = op(
+        "creator-1",
+        "creator",
+        1,
+        &[],
+        Payload::Create {
+            object_id: "shape-1".to_string(),
+            object_kind: "rectangle".to_string(),
+        },
+    );
+    let alice = op(
+        "alice-1",
+        "alice",
+        1,
+        &[("creator", 1)],
+        Payload::SetProperty {
+            object_id: "shape-1".to_string(),
+            key: "fill".to_string(),
+            value: "red".to_string(),
+        },
+    );
+    let bob = op(
+        "bob-1",
+        "bob",
+        1,
+        &[("creator", 1)],
+        Payload::SetProperty {
+            object_id: "shape-1".to_string(),
+            key: "fill".to_string(),
+            value: "blue".to_string(),
+        },
+    );
+
+    let mut forward = Core::new();
+    for operation in [create.clone(), alice.clone(), bob.clone()] {
+        forward.apply(operation);
+    }
+    let mut reverse = Core::new();
+    for operation in [create, bob, alice] {
+        reverse.apply(operation);
+    }
+
+    let expected = r#"{"document_id":"canvas","objects":[{"id":"shape-1","kind":"rectangle","x":0,"y":0,"properties":{"fill":"blue"}}],"lists":[]}"#;
+    assert_eq!(forward.canonical_snapshot("canvas").unwrap(), expected);
+    assert_eq!(reverse.canonical_snapshot("canvas").unwrap(), expected);
+}
+
+#[test]
+fn tombstones_block_resurrection_and_deleted_list_neighbors_still_order_children() {
+    // Catches object edits recreating deleted objects, list reinsertion reviving a
+    // tombstone, or compaction/order logic losing a child whose anchor is deleted.
+    let operations = [
+        op(
+            "create-1",
+            "creator",
+            1,
+            &[],
+            Payload::Create {
+                object_id: "shape-1".to_string(),
+                object_kind: "rectangle".to_string(),
+            },
+        ),
+        op(
+            "insert-a",
+            "lisa",
+            1,
+            &[("creator", 1)],
+            Payload::ListInsert {
+                list_id: "layers".to_string(),
+                element_id: "e1".to_string(),
+                left: None,
+                value: "A".to_string(),
+            },
+        ),
+        op(
+            "delete-object",
+            "deleter",
+            1,
+            &[("creator", 1)],
+            Payload::ObjectDelete {
+                object_id: "shape-1".to_string(),
+            },
+        ),
+        op(
+            "late-move",
+            "mover",
+            1,
+            &[("creator", 1)],
+            Payload::Move {
+                object_id: "shape-1".to_string(),
+                x: 90,
+                y: 40,
+            },
+        ),
+        op(
+            "recreate-object",
+            "resurrector",
+            1,
+            &[("deleter", 1)],
+            Payload::Create {
+                object_id: "shape-1".to_string(),
+                object_kind: "ellipse".to_string(),
+            },
+        ),
+        op(
+            "delete-a",
+            "lisa",
+            2,
+            &[("lisa", 1)],
+            Payload::ListDelete {
+                list_id: "layers".to_string(),
+                element_id: "e1".to_string(),
+            },
+        ),
+        op(
+            "insert-b",
+            "liam",
+            1,
+            &[("creator", 1), ("lisa", 1)],
+            Payload::ListInsert {
+                list_id: "layers".to_string(),
+                element_id: "e2".to_string(),
+                left: Some("e1".to_string()),
+                value: "B".to_string(),
+            },
+        ),
+        op(
+            "reinsert-a",
+            "ruth",
+            1,
+            &[("lisa", 2)],
+            Payload::ListInsert {
+                list_id: "layers".to_string(),
+                element_id: "e1".to_string(),
+                left: None,
+                value: "resurrected".to_string(),
+            },
+        ),
+    ];
+
+    let mut core = Core::new();
+    for operation in operations {
+        core.apply(operation);
+    }
+
+    assert_eq!(
+        core.canonical_snapshot("canvas").unwrap(),
+        r#"{"document_id":"canvas","objects":[],"lists":[{"id":"layers","elements":[{"id":"e2","value":"B"}]}]}"#
+    );
+}
+
+#[test]
+fn pending_work_is_bounded_and_dependency_cycles_are_reported() {
+    // Catches unbounded buffering, accepting invalid sequence boundaries, or
+    // classifying an actual cycle as an ordinary missing dependency.
+    let limits = Limits {
+        max_pending_operations: 2,
+        ..Limits::default()
+    };
+    let mut core = Core::with_limits(limits);
+    let cycle_a = op(
+        "a-1",
+        "a",
+        1,
+        &[("b", 1)],
+        Payload::ObjectDelete {
+            object_id: "x".to_string(),
+        },
+    );
+    let cycle_b = op(
+        "b-1",
+        "b",
+        1,
+        &[("a", 1)],
+        Payload::ObjectDelete {
+            object_id: "y".to_string(),
+        },
+    );
+    let missing = op(
+        "c-1",
+        "c",
+        1,
+        &[("never-seen", 1)],
+        Payload::ObjectDelete {
+            object_id: "z".to_string(),
+        },
+    );
+
+    assert_eq!(core.apply(cycle_a), ApplyOutcome::Buffered);
+    assert_eq!(core.apply(cycle_b), ApplyOutcome::Buffered);
+    assert!(core.pending_diagnosis().has_cycle);
+    assert_eq!(core.pending_diagnosis().pending_operations, 2);
+    assert_eq!(
+        core.apply(missing),
+        ApplyOutcome::Rejected(ApplyError::PendingLimit)
+    );
+    assert_eq!(core.accepted_count(), 2);
+
+    let mut invalid = op(
+        "zero",
+        "actor",
+        0,
+        &[],
+        Payload::ObjectDelete {
+            object_id: "x".to_string(),
+        },
+    );
+    assert_eq!(
+        core.apply(invalid.clone()),
+        ApplyOutcome::Rejected(ApplyError::InvalidSequence)
+    );
+    invalid.actor_sequence = u64::MAX;
+    assert_eq!(
+        core.apply(invalid),
+        ApplyOutcome::Rejected(ApplyError::SequenceOverflow)
+    );
+}
diff --git a/developer-simulation/runs/2026-08-16--causal-canvas-compaction/tests/determinism.rs b/developer-simulation/runs/2026-08-16--causal-canvas-compaction/tests/determinism.rs
new file mode 100644
index 0000000..e8bab83
--- /dev/null
+++ b/developer-simulation/runs/2026-08-16--causal-canvas-compaction/tests/determinism.rs
@@ -0,0 +1,87 @@
+use std::collections::BTreeMap;
+
+use causal_canvas_compaction::{Core, Operation, Payload, run_reduced_oracle_suite, stable_digest};
+
+#[test]
+fn durable_digest_uses_sha256_known_vector() {
+    // Catches replacing corruption/identity digests with a small non-cryptographic
+    // checksum. This literal is the independently published SHA-256 vector for abc.
+    assert_eq!(
+        stable_digest(b"abc"),
+        "ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad"
+    );
+}
+
+#[test]
+fn generated_histories_match_hand_derived_oracle_across_schedules() {
+    // Catches schedule-sensitive scalar resolution, causal buffer drain, and
+    // duplicate delivery changing the canonical bytes or suite digest.
+    let first = run_reduced_oracle_suite(5, 3, 8);
+    let repeated = run_reduced_oracle_suite(5, 3, 8);
+    assert_eq!(first.histories, 5);
+    assert_eq!(first.schedules_per_history, 3);
+    assert_eq!(first.comparisons, 15);
+    assert_eq!(first.failures, 0);
+    assert_eq!(first.digest, repeated.digest);
+}
+
+#[test]
+fn twenty_input_batchings_produce_identical_snapshot_and_manifest_bytes() {
+    // Catches transaction/batch-local ordering leaking into durable canonical
+    // state. The literal operations are reused, but expected equality is across
+    // independently chosen boundaries, not computed by the implementation.
+    let payloads = [
+        Payload::Create {
+            object_id: "shape".to_string(),
+            object_kind: "rectangle".to_string(),
+        },
+        Payload::SetProperty {
+            object_id: "shape".to_string(),
+            key: "fill".to_string(),
+            value: "blue".to_string(),
+        },
+        Payload::Move {
+            object_id: "shape".to_string(),
+            x: 12,
+            y: 34,
+        },
+        Payload::ListInsert {
+            list_id: "layers".to_string(),
+            element_id: "shape-element".to_string(),
+            left: None,
+            value: "shape".to_string(),
+        },
+    ];
+    let operations: Vec<_> = payloads
+        .into_iter()
+        .enumerate()
+        .map(|(index, payload)| {
+            let sequence = index as u64 + 1;
+            Operation {
+                id: format!("actor-{sequence}"),
+                document_id: "canvas".to_string(),
+                actor_id: "actor".to_string(),
+                actor_sequence: sequence,
+                dependency_clock: if sequence == 1 {
+                    BTreeMap::new()
+                } else {
+                    BTreeMap::from([("actor".to_string(), sequence - 1)])
+                },
+                accepted_minute: sequence,
+                payload,
+            }
+        })
+        .collect();
+
+    let mut outputs = Vec::new();
+    for schedule in 0..20 {
+        let batch_size = schedule % operations.len() + 1;
+        let mut core = Core::new();
+        for batch in operations.chunks(batch_size) {
+            core.apply_batch(batch.iter().cloned());
+        }
+        let artifact = core.compact("canvas", &[], 10).unwrap();
+        outputs.push((artifact.snapshot_json, artifact.manifest_json));
+    }
+    assert!(outputs.windows(2).all(|pair| pair[0] == pair[1]));
+}
diff --git a/developer-simulation/runs/2026-08-16--causal-canvas-compaction/tests/fold_comparison.rs b/developer-simulation/runs/2026-08-16--causal-canvas-compaction/tests/fold_comparison.rs
new file mode 100644
index 0000000..2f2674d
--- /dev/null
+++ b/developer-simulation/runs/2026-08-16--causal-canvas-compaction/tests/fold_comparison.rs
@@ -0,0 +1,44 @@
+use std::fs;
+use std::path::PathBuf;
+use std::time::{SystemTime, UNIX_EPOCH};
+
+use fold::pipeline::terminal;
+use fold::stream::KeyedStream;
+
+fn temporary_path(label: &str) -> PathBuf {
+    let nonce = SystemTime::now()
+        .duration_since(UNIX_EPOCH)
+        .unwrap()
+        .as_nanos();
+    std::env::temp_dir().join(format!("fold-causal-comparison-{label}-{nonce}"))
+}
+
+#[test]
+fn fold_keyed_materialization_is_arrival_ordered_without_a_causal_wrapper() {
+    // Narrow characterization, not a Fold defect: a generic keyed upsert does
+    // not know the canvas operation's causal writer tuple. The two schedules
+    // therefore need our custom resolution layer before materialization.
+    let forward_path = temporary_path("forward");
+    let reverse_path = temporary_path("reverse");
+    let mut forward = KeyedStream::new(&forward_path, terminal::Table::new("values"));
+    forward.wtx(|transaction| {
+        transaction.upsert(&"shape.fill".to_string(), &"alice-red".to_string());
+        transaction.upsert(&"shape.fill".to_string(), &"bob-blue".to_string());
+    });
+    let mut reverse = KeyedStream::new(&reverse_path, terminal::Table::new("values"));
+    reverse.wtx(|transaction| {
+        transaction.upsert(&"shape.fill".to_string(), &"bob-blue".to_string());
+        transaction.upsert(&"shape.fill".to_string(), &"alice-red".to_string());
+    });
+
+    assert_eq!(
+        forward.get(&"shape.fill".to_string()),
+        Some("bob-blue".to_string())
+    );
+    assert_eq!(
+        reverse.get(&"shape.fill".to_string()),
+        Some("alice-red".to_string())
+    );
+    fs::remove_dir_all(forward_path).unwrap();
+    fs::remove_dir_all(reverse_path).unwrap();
+}
diff --git a/developer-simulation/runs/2026-08-16--causal-canvas-compaction/tests/publication.rs b/developer-simulation/runs/2026-08-16--causal-canvas-compaction/tests/publication.rs
new file mode 100644
index 0000000..d93fca8
--- /dev/null
+++ b/developer-simulation/runs/2026-08-16--causal-canvas-compaction/tests/publication.rs
@@ -0,0 +1,144 @@
+use std::collections::BTreeMap;
+use std::fs;
+use std::path::PathBuf;
+use std::time::{SystemTime, UNIX_EPOCH};
+
+use causal_canvas_compaction::{
+    ClientWatermark, Core, FaultInjection, FaultStage, Operation, Payload, open_latest,
+    publish_generation,
+};
+
+fn temporary_store(label: &str) -> PathBuf {
+    let nonce = SystemTime::now()
+        .duration_since(UNIX_EPOCH)
+        .unwrap()
+        .as_nanos();
+    std::env::temp_dir().join(format!(
+        "causal-canvas-{label}-{}-{nonce}",
+        std::process::id()
+    ))
+}
+
+fn core_with_value(value: &str) -> Core {
+    let mut core = Core::new();
+    core.apply(Operation {
+        id: "actor-1".to_string(),
+        document_id: "canvas".to_string(),
+        actor_id: "actor".to_string(),
+        actor_sequence: 1,
+        dependency_clock: BTreeMap::new(),
+        accepted_minute: 1,
+        payload: Payload::Create {
+            object_id: "shape".to_string(),
+            object_kind: "rectangle".to_string(),
+        },
+    });
+    core.apply(Operation {
+        id: "actor-2".to_string(),
+        document_id: "canvas".to_string(),
+        actor_id: "actor".to_string(),
+        actor_sequence: 2,
+        dependency_clock: BTreeMap::from([("actor".to_string(), 1)]),
+        accepted_minute: 2,
+        payload: Payload::SetProperty {
+            object_id: "shape".to_string(),
+            key: "fill".to_string(),
+            value: value.to_string(),
+        },
+    });
+    core
+}
+
+#[test]
+fn in_process_returned_error_at_each_stage_never_exposes_partial_generation() {
+    // Catches moving CURRENT before all generation files have completed, and
+    // catches retry logic that cannot finish the same generation idempotently.
+    let stages = [
+        FaultStage::GenerationCreated,
+        FaultStage::DataFlushed,
+        FaultStage::ManifestFlushed,
+        FaultStage::GenerationRenamed,
+        FaultStage::DirectorySynced,
+    ];
+    for stage in stages {
+        let root = temporary_store(&format!("returned-error-{stage:?}"));
+        let old = core_with_value("old").compact("canvas", &[], 100).unwrap();
+        let new = core_with_value("new").compact("canvas", &[], 100).unwrap();
+        publish_generation(&root, 1, &old, None).unwrap();
+
+        let fault = FaultInjection { stage };
+        assert!(publish_generation(&root, 2, &new, Some(fault)).is_err());
+        let readable = open_latest(&root).unwrap();
+        let visible = readable.core.canonical_snapshot("canvas").unwrap();
+        assert!(
+            visible == old.snapshot_json || visible == new.snapshot_json,
+            "stage {stage:?} exposed neither complete generation"
+        );
+
+        publish_generation(&root, 2, &new, None).unwrap();
+        publish_generation(&root, 2, &new, None).unwrap();
+        let completed = open_latest(&root).unwrap();
+        assert_eq!(completed.generation, 2);
+        assert_eq!(
+            completed.core.canonical_snapshot("canvas").unwrap(),
+            new.snapshot_json
+        );
+        fs::remove_dir_all(root).unwrap();
+    }
+}
+
+#[test]
+fn corrupt_current_manifest_falls_back_to_prior_valid_generation() {
+    // Catches trusting CURRENT without content validation or selecting a corrupt
+    // newest directory instead of the deterministic prior complete generation.
+    let root = temporary_store("corrupt-fallback");
+    let old = core_with_value("old").compact("canvas", &[], 100).unwrap();
+    let new = core_with_value("new").compact("canvas", &[], 100).unwrap();
+    publish_generation(&root, 1, &old, None).unwrap();
+    publish_generation(&root, 2, &new, None).unwrap();
+    fs::write(
+        root.join("generation-00000000000000000002/manifest.json"),
+        b"{\"corrupt\":true}",
+    )
+    .unwrap();
+
+    let reopened = open_latest(&root).unwrap();
+    assert_eq!(reopened.generation, 1);
+    assert_eq!(
+        reopened.core.canonical_snapshot("canvas").unwrap(),
+        old.snapshot_json
+    );
+    fs::remove_dir_all(root).unwrap();
+}
+
+#[test]
+fn changed_manifest_metadata_falls_back_or_fails() {
+    // Catches validating only selected payload digests while trusting mutable
+    // semantic metadata. reconnect_decisions affects client behavior and must
+    // be bound by the complete-manifest integrity check.
+    let root = temporary_store("manifest-metadata");
+    let old = core_with_value("old").compact("canvas", &[], 100).unwrap();
+    let client = ClientWatermark {
+        client_id: "browser".to_string(),
+        document_id: "canvas".to_string(),
+        acknowledged: BTreeMap::from([("actor".to_string(), 2)]),
+        acknowledged_minute: 100,
+    };
+    let new = core_with_value("new")
+        .compact("canvas", &[client], 100)
+        .unwrap();
+    publish_generation(&root, 1, &old, None).unwrap();
+    publish_generation(&root, 2, &new, None).unwrap();
+
+    let manifest_path = root.join("generation-00000000000000000002/manifest.json");
+    let original = fs::read_to_string(&manifest_path).unwrap();
+    let changed = original.replace("\"catch_up\"", "\"snapshot_required\"");
+    assert_ne!(changed, original);
+    fs::write(manifest_path, changed).unwrap();
+
+    match open_latest(&root) {
+        Ok(reopened) => assert_eq!(reopened.generation, 1),
+        Err(error) => assert_eq!(error.to_string(), "no complete valid generation"),
+    }
+    fs::remove_dir_all(root).unwrap();
+}
diff --git a/developer-simulation/runs/2026-08-16--causal-canvas-compaction/tests/validation.rs b/developer-simulation/runs/2026-08-16--causal-canvas-compaction/tests/validation.rs
new file mode 100644
index 0000000..e08f368
--- /dev/null
+++ b/developer-simulation/runs/2026-08-16--causal-canvas-compaction/tests/validation.rs
@@ -0,0 +1,64 @@
+use causal_canvas_compaction::{Limits, ValidationError, validate_ndjson_line};
+
+#[test]
+fn raw_input_is_size_bounded_before_utf8_or_json_parsing() {
+    // Catches parsing/allocation before the raw byte cap and accidental panic on
+    // invalid UTF-8. The error priority is part of the bounded-input contract.
+    let limits = Limits {
+        max_line_bytes: 8,
+        max_payload_bytes: 4,
+        max_pending_operations: 2,
+    };
+    assert_eq!(
+        validate_ndjson_line(&[0xff; 9], limits),
+        Err(ValidationError::InputTooLarge)
+    );
+    assert_eq!(
+        validate_ndjson_line(&[0xff; 2], limits),
+        Err(ValidationError::InvalidUtf8)
+    );
+}
+
+#[test]
+fn truncated_json_and_unknown_operation_kind_have_stable_errors() {
+    // Catches treating an unknown variant as malformed JSON or accepting a
+    // partially decoded line.
+    let limits = Limits::default();
+    assert_eq!(
+        validate_ndjson_line(br#"{"id":"cut"#, limits),
+        Err(ValidationError::InvalidJson)
+    );
+    let unknown = br#"{"id":"x-1","document_id":"canvas","actor_id":"x","actor_sequence":1,"dependency_clock":{},"accepted_minute":1,"payload":{"kind":"teleport","object_id":"shape"}}"#;
+    assert_eq!(
+        validate_ndjson_line(unknown, limits),
+        Err(ValidationError::UnknownOperationKind)
+    );
+}
+
+#[test]
+fn payload_and_sequence_limits_reject_valid_json() {
+    // Catches checking only the line envelope while allowing an oversized
+    // payload, zero sequences, or the boundary that cannot be incremented.
+    let limits = Limits {
+        max_line_bytes: 1_024,
+        max_payload_bytes: 32,
+        max_pending_operations: 2,
+    };
+    let oversized = br#"{"id":"x-1","document_id":"canvas","actor_id":"x","actor_sequence":1,"dependency_clock":{},"accepted_minute":1,"payload":{"kind":"set_property","object_id":"shape","key":"text","value":"012345678901234567890123456789012345678901234567890123456789"}}"#;
+    assert_eq!(
+        validate_ndjson_line(oversized, limits),
+        Err(ValidationError::PayloadTooLarge)
+    );
+
+    let zero = br#"{"id":"x-0","document_id":"canvas","actor_id":"x","actor_sequence":0,"dependency_clock":{},"accepted_minute":1,"payload":{"kind":"create","object_id":"shape","object_kind":"rect"}}"#;
+    assert_eq!(
+        validate_ndjson_line(zero, Limits::default()),
+        Err(ValidationError::InvalidSequence)
+    );
+
+    let overflow = br#"{"id":"x-max","document_id":"canvas","actor_id":"x","actor_sequence":18446744073709551615,"dependency_clock":{},"accepted_minute":1,"payload":{"kind":"create","object_id":"shape","object_kind":"rect"}}"#;
+    assert_eq!(
+        validate_ndjson_line(overflow, Limits::default()),
+        Err(ValidationError::SequenceOverflow)
+    );
+}
diff --git a/developer-simulation/runs/2026-08-16--transparency-checkpoint-verifier/BRIEF.md b/developer-simulation/runs/2026-08-16--transparency-checkpoint-verifier/BRIEF.md
new file mode 100644
index 0000000..652d2c0
--- /dev/null
+++ b/developer-simulation/runs/2026-08-16--transparency-checkpoint-verifier/BRIEF.md
@@ -0,0 +1,140 @@
+# Trial 2 brief: Transparency-checkpoint verifier
+
+## Developer role and Rust experience
+
+- You maintain a certificate-transparency monitoring service for a hosting provider.
+- You have eight years of production Go and security operations experience.
+- You finished the Rust Book and have four months of part-time Rust experience.
+- You can review unsafe code but do not want it in a new verification boundary.
+
+## Existing system and baseline implementation
+
+- The monitor follows 24 independently operated public append-only logs.
+- Each log publishes signed checkpoints containing log identity, tree size, root hash, and time.
+- A consistency proof must show that a newer root extends the last verified tree.
+- The service currently verifies signatures and Merkle proofs in Go.
+- SQLite stores the last verified checkpoint, input cursor, raw proof, and alert records.
+- One transaction advances a log's checkpoint and its durable archive cursor.
+- Leaf hashes are streamed from compressed local archives to rebuild a compact tree frontier.
+- The baseline is trusted but restart replay and diagnostics are slow and difficult to test.
+- Signed checkpoints and archived leaf hashes remain authoritative inputs.
+
+## Concrete pain
+
+- Restarting after an unclean exit can spend 45 minutes rebuilding tree frontiers.
+- A past cursor bug advanced beyond a checkpoint whose proof had not been durably recorded.
+- Proof failures are logged inconsistently, complicating security review and incident comparison.
+- Malformed proof fixtures have triggered excessive allocation before validation.
+- The team wants a small verifier and checkpoint store with exhaustive recovery tests.
+- It must not weaken the baseline's fail-closed behavior to gain speed.
+
+## Workload and data shape
+
+- Production receives up to 8,000,000 new leaf hashes per day across the 24 logs.
+- The prototype corpus contains 8 logs, 8,000,000 total leaf hashes, and 4,000 checkpoints.
+- Leaf hashes and internal nodes are exactly 32 bytes.
+- A checkpoint envelope is at most 4 KiB before signature validation.
+- A normal consistency proof contains 1 to 64 hashes.
+- The hard admission limit is 128 proof hashes and 16 pending checkpoints per log.
+- Checkpoint tree sizes range from 1 to more than 2^34 leaves.
+- The corpus includes empty-to-first, adjacent, skipped-size, and equal-size transitions.
+- Exactly 10,000 labeled adversarial proof cases accompany the valid corpus.
+- Archive records are length-prefixed and include log identity, leaf index, and leaf hash.
+
+## Operational constraints
+
+- Verification follows the declared binary Merkle-tree hashing rules exactly.
+- Existing log public keys and signature algorithms must remain supported.
+- A new checkpoint is visible only with its proof, archive cursor, and decision record.
+- A process exit may cause replay but must never cause a leaf or proof to be skipped.
+- Checkpoints may arrive out of order independently across logs.
+- Each proof names its base checkpoint, which must be the current verified checkpoint.
+- A candidate anchored to a pending base must wait; no unverified base can be skipped.
+- Two different roots at the same tree size produce a durable equivocation alert.
+- Unknown logs, algorithms, or keys fail closed and cannot create state.
+- The prototype runs offline on two CPU cores with 256 MiB of memory.
+- No diagnostic may include certificate contents or private operational tokens.
+- Verification output must not depend on worker scheduling or hash-map iteration order.
+
+## Measurable acceptance criteria
+
+- Match the Go baseline on every valid checkpoint and proof in the prototype corpus.
+- Match known-answer vectors for sizes 0, 1, 2, 3, 4, 7, 8, 15, 16, 65,535, and 65,536.
+- Reject all 10,000 labeled adversarial cases with zero false acceptance.
+- Never advance visible state on an invalid signature, proof, root, size, or log identity.
+- Detect every planted same-size different-root equivocation and retain both checkpoint hashes.
+- Process the 8,000,000-leaf replay in at most 90 seconds on the declared machine.
+- Peak measured resident memory must remain below 224 MiB.
+- Verify an ordinary incremental checkpoint at p95 below 5 milliseconds after warm-up.
+- Reopen all eight logs after a clean stop in under 500 milliseconds.
+- Twenty cross-log delivery interleavings must yield byte-identical per-log decisions.
+- Duplicated checkpoints and proofs must not create duplicate alerts or cursor advances.
+- For every injected publication exit, recovery exposes the old or new complete checkpoint.
+- Retrying after any modeled disk-full result must converge to the same durable bytes.
+- Error records must use stable codes and bounded metadata, never raw certificate data.
+- No valid input may panic, and each malformed input must finish within 50 milliseconds.
+
+## Explicit non-goals
+
+- Do not poll public logs or make any network request.
+- Do not parse certificates, validate certificate chains, or build a certificate search index.
+- Do not validate submission receipts or browser certificate policy.
+- Do not implement gossip between independent monitors.
+- Do not prove that an operator omitted an unknown leaf from all observers.
+- Do not replace the production alerting, metrics, or incident-response systems.
+- Do not introduce a new signature algorithm or change checkpoint wire formats.
+
+## Compact self-contained prototype boundary
+
+- Build one Rust verification library and one offline command-line replay harness.
+- Input is a read-only fixture directory of keys, checkpoints, proofs, and leaf archives.
+- Expose parse, verify-signature, verify-consistency, advance, reopen, and inspect operations.
+- Persist derived checkpoint state in one disposable local directory.
+- The harness runs both implementations and compares decisions, cursors, and stable error codes.
+- Use the existing eight fixture log identities and no dynamic key discovery.
+- Generate additional Merkle trees from fixed seeds for property and crash tests.
+- Publish only a complete JSONL decision ledger plus a digest manifest.
+- The deliverable is source, tests, benchmark output, and a short fit decision.
+- Time-box implementation and investigation to two developer days.
+
+## Fault, crash, and adversarial cases
+
+- Flip every bit position in representative roots, proof nodes, sizes, and signatures.
+- Supply a valid proof under the wrong log identity or public key.
+- Truncate envelopes and archive records at every field boundary.
+- Declare proof counts of 0, 64, 128, 129, and the maximum unsigned integer.
+- Use impossible tree-size transitions, rollback sizes, and arithmetic-overflow boundaries.
+- Present two signed checkpoints with the same log and size but different roots.
+- Duplicate checkpoints before and after advancement and reorder up to 16 pending items.
+- Omit a declared proof base, then deliver it after dependent candidates are pending.
+- Corrupt the stored frontier, newest manifest, decision tail, and archive cursor separately.
+- Terminate after state write, proof write, decision write, flush, rename, and directory sync.
+- Simulate disk-full and permission-denied results at every publication stage.
+- Cancel a verification worker before decision submission, then resubmit the same proof.
+- Feed 4 KiB envelopes containing invalid lengths designed to provoke large allocations.
+
+## Evidence for the fit decision
+
+### Keep the baseline
+
+- Keep it if any adversarial case advances state or any valid corpus case disagrees.
+- Keep it if recovery can expose a cursor without its matching verified checkpoint and proof.
+- Keep it if the replay exceeds 90 seconds or measured memory exceeds 224 MiB.
+- Keep it if diagnostics or on-disk state are harder for security engineers to inspect.
+- Keep it if equivalent durability still requires most of the existing SQLite implementation.
+
+### Adopt a component
+
+- Adopt only the narrow verifier or durable-checkpoint component that passes every gate.
+- Require stable typed failures, bounded parsing, and no panic across the entire corpus.
+- Require old-or-new recovery at every tested exit boundary and deterministic decision bytes.
+- Require a migration path that can shadow the Go baseline before it owns advancement.
+- Require independent review of tree arithmetic, signature handling, and durability assumptions.
+
+### Conclude no fit
+
+- Conclude no fit if cryptographic proof bytes cannot be preserved and audited exactly.
+- Conclude no fit if atomic checkpoint, proof, cursor, and decision publication is unavailable.
+- Conclude no fit if storage abstractions obscure corruption or make repair ambiguous.
+- Conclude no fit if performance comes from buffering beyond the 256 MiB limit.
+- A no-fit result is acceptable and should retain failing vectors and recovery traces.
diff --git a/developer-simulation/runs/2026-08-16--transparency-checkpoint-verifier/Cargo.toml b/developer-simulation/runs/2026-08-16--transparency-checkpoint-verifier/Cargo.toml
new file mode 100644
index 0000000..97b8dd0
--- /dev/null
+++ b/developer-simulation/runs/2026-08-16--transparency-checkpoint-verifier/Cargo.toml
@@ -0,0 +1,21 @@
+[package]
+name = "transparency-checkpoint-verifier"
+version = "0.1.0"
+edition = "2024"
+publish = false
+
+[dependencies]
+ring = "0.17.14"
+serde = { version = "1.0.228", features = ["derive"] }
+serde_json = "1.0.150"
+
+[dev-dependencies]
+tempfile = "3.27.0"
+
+[lib]
+name = "transparency_checkpoint_verifier"
+path = "src/lib.rs"
+
+[[bin]]
+name = "transparency-checkpoint-verifier"
+path = "src/main.rs"
diff --git a/developer-simulation/runs/2026-08-16--transparency-checkpoint-verifier/DISCOVERY.md b/developer-simulation/runs/2026-08-16--transparency-checkpoint-verifier/DISCOVERY.md
new file mode 100644
index 0000000..fe5440e
--- /dev/null
+++ b/developer-simulation/runs/2026-08-16--transparency-checkpoint-verifier/DISCOVERY.md
@@ -0,0 +1,120 @@
+# Discovery record
+
+## Order and baseline-first hypothesis
+
+I read the supplied brief first, then the required TDD guidance, and then only
+the repository's public root README plus the four public examples and their
+manifests. I had not inspected component implementation source when recording
+this document.
+
+The trusted Go verifier and SQLite transaction remain the baseline. My initial
+hypothesis is that BogKit might contribute a narrow derived-state accelerator,
+but it should not own cryptographic verification or durable publication unless
+the public contract can preserve exact signed checkpoint/proof bytes and commit
+checkpoint, proof, archive cursor, and decision atomically. Any prototype here
+must therefore separate independently testable proof/identity/admission logic
+from a storage experiment, and must default to retaining the baseline.
+
+## What the public material led me to expect
+
+- `fold` is described as a statically typed incremental programming framework
+  that materializes changing streams into durable views. The examples show one
+  write transaction updating a count, bag, keyed tables, and aggregates, with
+  later reads observing one consistent snapshot. Reopening the same path is
+  said to resume state.
+- The starter and chat examples make `fold` look potentially relevant to
+  atomically maintained derived views and quick restart. They do not publicly
+  demonstrate exact raw-byte retention, stable serialization, durability at
+  flush/rename/directory-sync boundaries, disk-full recovery, corruption
+  detection, rollback, or proof-plus-cursor publication.
+- The timeseries example suggests keyed incremental aggregation is useful when
+  many inserts update queryable views. A checkpoint verifier instead has a
+  small amount of security-critical latest-state plus an append-only audit
+  record; this may be a poor match unless the atomic storage guarantees are
+  explicit and inspectable.
+- `ESE` is described as static text embedding. The search example uses it to
+  turn document text into vectors. The brief explicitly excludes certificate
+  search and requires exact cryptographic bytes, so I expect no fit.
+- `ANNy` is described as an HNSW approximate-nearest-neighbor index. The search
+  example uses it only for semantic retrieval. Approximation and vector search
+  have no place in exact Merkle/signature decisions, so I expect no fit.
+
+## Components considered
+
+### Fold
+
+Potentially relevant only as a narrow durable materialization/store candidate.
+Concrete questions before retaining it:
+
+1. Can one transaction durably publish the verified checkpoint, exact proof
+   bytes, exact archive cursor, and stable decision record together?
+2. Are the on-disk representation and recovery rules documented enough to
+   audit old-or-new behavior at every requested publication exit?
+3. Can fixed-key latest state and append-only decisions be reopened and
+   inspected without rebuilding or reproducing the security decision?
+4. Can duplicates and same-size equivocation be represented without losing
+   either checkpoint hash, and are output bytes deterministic?
+5. Is there a public/focused API for failure injection, disk-full handling,
+   corruption diagnosis, and bounded resource use?
+
+If these cannot be answered positively with small, observable tests, I will
+exclude Fold from the implementation and record missing capability or poor
+product fit rather than building security semantics on assumptions.
+
+### ESE
+
+Initial decision: no fit. Its published purpose is embedding text for semantic
+search, while the verifier must compare identities, sizes, signatures, roots,
+and proof nodes exactly. No implementation inspection is needed unless public
+claims elsewhere contradict this boundary.
+
+### ANNy
+
+Initial decision: no fit. Approximate vector neighbors cannot establish an
+exact append-only proof and would add state, memory, and nonessential failure
+modes. No implementation inspection is needed unless public claims elsewhere
+contradict this boundary.
+
+## Initial fit/no-fit questions for the prototype
+
+- Can a small independent parser reject oversized envelopes and proof counts
+  before allocation, including 129 and maximum-unsigned declarations?
+- Can Merkle consistency be tested against hand-derived known answers while
+  preserving every supplied proof byte? A reduced or characterization hash is
+  insufficient evidence for production compatibility and must be labeled.
+- Can candidate ordering be deterministic across logs, require the current
+  verified base, wait on missing bases, and make duplicates idempotent?
+- Can invalid identity, algorithm/key, signature, size, root, or proof leave
+  visible state unchanged with a stable bounded error record?
+- Can same-size different-root inputs retain both hashes as one durable,
+  idempotent equivocation alert?
+- Can a publication layer demonstrate old-or-new complete state at modeled
+  exit and storage-error boundaries without claiming OS/filesystem guarantees
+  it did not test?
+- Can a representative release replay stay inside the time and memory envelope
+  without buffering the corpus? Full corpus parity is impossible unless the
+  supplied external fixtures and Go baseline are actually present.
+
+## Planned evidence boundary
+
+I will use strict red/green cycles with hand-derived expectations. The smallest
+meaningful deliverable should be an offline Rust library plus CLI harness that
+characterizes bounded parsing, exact-byte retention, independently checked
+Merkle consistency logic, deterministic decision/state transitions, duplicate
+and equivocation behavior, and a deliberately explicit publication model. It
+will not claim production signature compatibility, Go parity, crash durability,
+or full-corpus performance without the corresponding real algorithms, inputs,
+fault hooks, and measurements.
+
+## Procedure note for reviewer adjudication
+
+My initial public-document search used the case-sensitive pattern `README*`.
+It found the root `README.md` but missed lowercase component files including
+`fold/readme.md`, `ese/readme.md`, and `anny/readme.md`. This discovery record
+was therefore written after the root README and all public examples, but before
+those lowercase component READMEs were read. A later `rg` source-symbol search
+printed small implementation snippets and revealed the missed paths. I stopped,
+read every lowercase component README, and only then opened implementation
+files with `sed`. The baseline-first hypotheses above did not change, but this
+did not fully satisfy the requested documentation order and is explicitly
+retained for reviewer adjudication.
diff --git a/developer-simulation/runs/2026-08-16--transparency-checkpoint-verifier/README.md b/developer-simulation/runs/2026-08-16--transparency-checkpoint-verifier/README.md
new file mode 100644
index 0000000..c376ce1
--- /dev/null
+++ b/developer-simulation/runs/2026-08-16--transparency-checkpoint-verifier/README.md
@@ -0,0 +1,157 @@
+# Transparency-checkpoint verifier characterization
+
+This is a small offline Rust verifier, deterministic state machine, and
+generation-based publication harness. It is intentionally independent of
+BogKit components: the trial found no component that should own this security
+boundary.
+
+The package is useful as a runnable characterization and failure reproducer,
+not as a drop-in production replacement. It preserves exact input envelope and
+proof bytes, uses real SHA-256 and Ed25519 verification, and models atomic
+publication, but its `CKP1` envelope is a prototype format because the actual
+production wire formats, key set, Go implementation, SQLite schema, compressed
+archives, and labeled corpus were not supplied.
+
+## What is implemented
+
+- A pre-allocation parser with a 4 KiB envelope limit, 128-hash proof limit,
+  checked length arithmetic, bounded identities, exact raw-envelope retention,
+  and exact raw-proof retention.
+- SHA-256 binary Merkle frontier construction and RFC 6962-style consistency
+  verification, including empty, equal, adjacent, and skipped transitions.
+- Ed25519 verification through `ring`, with a fixed log/key registry and
+  fail-closed unknown identity, algorithm, and key handling.
+- Deterministic per-log advancement, a 16-item pending limit, base anchoring,
+  duplicate idempotency, same-size equivocation alerts retaining both roots,
+  total pending order keyed by canonical envelope identity, stable error codes,
+  archive-cursor rollback rejection before mutation, and sorted JSON bytes.
+- A disposable directory store. Each immutable generation contains
+  `state.json`, exact `proofs.json`, `decisions.jsonl`, and a digest manifest;
+  one atomically renamed `CURRENT` pointer selects the visible generation.
+  Existing content-addressed generations are trusted only after every expected
+  filename, digest, and payload byte matches the publication candidate.
+- Checked snapshot resumption validates registry/log correspondence, signatures,
+  identities, state invariants, pending order, and decision/equivocation records
+  before reconstructing an engine.
+- One generic in-process returned-error hook after each of nine completed
+  publication stages: state/proof/decision writes, generation flush/rename,
+  pointer write/flush/rename, and directory sync.
+- CLI commands for a fixed-seed replay, a synthetic full verifier-path p95
+  measurement, deterministic ledger comparison, a store demo, and inspection.
+
+There is no unsafe code.
+
+## Dependencies
+
+Runtime dependencies are deliberately small and disclosed:
+
+- `ring 0.17.14`: SHA-256 and Ed25519.
+- `serde 1` and `serde_json 1`: deterministic typed state and JSONL output.
+- `tempfile 3` is test-only.
+
+The lab's single nested workspace and lockfile pin the exact resolved versions
+while keeping the prototype isolated from BogKit's root workspace.
+
+## Exact verification commands
+
+Run from the repository root. Build and runtime state stays outside the
+checkout:
+
+```console
+cargo fmt --manifest-path developer-simulation/Cargo.toml \
+  --package transparency-checkpoint-verifier -- --check
+CARGO_TARGET_DIR=/private/tmp/transparency-checkpoint-target \
+  cargo test --offline --locked --manifest-path developer-simulation/Cargo.toml \
+  --package transparency-checkpoint-verifier --all-targets
+CARGO_TARGET_DIR=/private/tmp/transparency-checkpoint-target \
+  cargo clippy --offline --locked --manifest-path developer-simulation/Cargo.toml \
+  --package transparency-checkpoint-verifier --all-targets -- \
+  -D warnings -D clippy::all -D clippy::pedantic
+CARGO_TARGET_DIR=/private/tmp/transparency-checkpoint-target \
+  cargo build --release --offline --locked \
+  --manifest-path developer-simulation/Cargo.toml \
+  --package transparency-checkpoint-verifier
+/private/tmp/transparency-checkpoint-target/release/transparency-checkpoint-verifier replay 8000000
+/private/tmp/transparency-checkpoint-target/release/transparency-checkpoint-verifier bench-incremental 10000
+/private/tmp/transparency-checkpoint-target/release/transparency-checkpoint-verifier demo /private/tmp/transparency-demo
+/private/tmp/transparency-checkpoint-target/release/transparency-checkpoint-verifier inspect /private/tmp/transparency-demo
+```
+
+The final trial run observed:
+
+```text
+27 tests passed
+8,000,000 synthetic leaf hashes: 895 ms on the final fresh run
+replay root: 6a0bc3488de6971dd01c38a7a6d2631ef9236fed300449e56510fef281ccbe0c
+peak replay RSS: 1,818,624 bytes (1,776 KiB)
+10,000 synthetic full verifier paths: p95 21 microseconds on the final fresh run
+eight empty fixture logs: reopen_ms 0
+strict Clippy: passed with no warnings
+```
+
+The RSS figure is macOS `/usr/bin/time -l`'s maximum resident set size. These
+timings are from the local trial host, not the declared two-core/256 MiB
+production-equivalent machine. The replay generates fixed-seed 32-byte leaf
+hashes in memory one at a time; it does not decompress or parse the absent
+production archives.
+
+## CLI details
+
+Replay a fixed-seed compact frontier:
+
+```console
+/private/tmp/transparency-checkpoint-target/release/transparency-checkpoint-verifier replay 8000000
+```
+
+Measure parse, registry lookup, Ed25519 signature verification, empty-to-first
+consistency verification, and state advancement after 50 warmups:
+
+```console
+/private/tmp/transparency-checkpoint-target/release/transparency-checkpoint-verifier bench-incremental 10000
+```
+
+Publish, reopen, and validate resumption of a deterministic eight-log empty
+snapshot:
+
+```console
+/private/tmp/transparency-checkpoint-target/release/transparency-checkpoint-verifier demo /private/tmp/transparency-demo
+/private/tmp/transparency-checkpoint-target/release/transparency-checkpoint-verifier inspect /private/tmp/transparency-demo
+```
+
+Compare an external baseline ledger byte-for-byte with a candidate ledger:
+
+```console
+/private/tmp/transparency-checkpoint-target/release/transparency-checkpoint-verifier \
+  compare baseline.jsonl candidate.jsonl
+```
+
+`compare` prints `MATCH` and exits 0 for identical bytes; otherwise it prints
+`MISMATCH` and exits 2. No Go/SQLite baseline ledger was present in the
+checkout, so actual baseline parity was not run.
+
+## Evidence boundaries
+
+- Known-answer Merkle roots were generated independently with Python's
+  `hashlib` and stored as literals. The verifier does not generate its own
+  consistency-proof expectations.
+- Ed25519 uses RFC 8032 vector 2. Tests flip every signature bit; consistency
+  tests flip every bit of representative proof nodes and the new root.
+- The 10,000 malformed inputs are deterministic synthetic characterization
+  cases, not the absent labeled adversarial corpus.
+- The publication tests exercise one generic in-process returned error after a
+  requested stage has completed. They do not create partial writes, distinguish
+  process exit from disk-full or permission errors, kill a process, emulate a
+  kernel/filesystem failure, pull power, or prove behavior on other filesystems.
+- The store duplicates exact bytes into an auditable proof archive and verifies
+  all payload digests on reopen and before reusing an existing generation. It
+  is a small prototype, not a migration of the production SQLite transaction.
+- Snapshot resumption does not reverify the current checkpoint's historical
+  consistency proof because the snapshot has no prior-base history. It checks
+  the retained current envelope/signature and cross-record invariants instead.
+- Archive record parsing, compressed input streaming, stored-frontier repair,
+  archive cursor-to-leaf/index correspondence, all existing signature
+  algorithms, all production public keys, and Go parity remain
+  unimplemented/unrun.
+
+See the [daily report](../../reports/2026-08-16.md) for the fit decision and
+complete audit.
diff --git a/developer-simulation/runs/2026-08-16--transparency-checkpoint-verifier/TDD_EVIDENCE.md b/developer-simulation/runs/2026-08-16--transparency-checkpoint-verifier/TDD_EVIDENCE.md
new file mode 100644
index 0000000..6ee3e54
--- /dev/null
+++ b/developer-simulation/runs/2026-08-16--transparency-checkpoint-verifier/TDD_EVIDENCE.md
@@ -0,0 +1,141 @@
+# Test-first evidence
+
+The tests were written before production behavior. Expectations are literal or
+independently derived; no production helper generated expected Merkle roots or
+proofs.
+
+## Initial RED
+
+After the test files were written, `cargo test --offline` first failed because
+the public API did not exist. Minimal non-behaving stubs were then added so the
+tests could exercise real calls and fail behaviorally rather than stop at name
+resolution.
+
+Observed behavioral RED commands and results:
+
+```text
+cargo test --offline
+  crypto: 4 failed (zero root, consistency invalid, signature invalid,
+  wrong size code)
+
+cargo test --offline --test parser
+  2 failed, 2 passed (valid envelope rejected; proof-count code wrong)
+
+cargo test --offline --test engine
+  4 failed, 1 passed (all submissions returned UNKNOWN_LOG)
+
+cargo test --offline --test store
+  3 failed (fixture could not advance, so publication tests could not start)
+
+cargo test --offline --test cli
+  3 failed (empty command-line program returned no output)
+
+cargo test --offline --test cli incremental_benchmark
+  1 failed (command absent; usage error)
+```
+
+The false-positive `cross_log_interleavings` pass against the initial stub was
+noticed: both empty byte vectors compared equal. That test was retained only
+after the real state engine was implemented, then strengthened to 20 delivery
+interleavings across eight logs with a non-empty independently signed workload.
+
+## GREEN and strengthening
+
+After the minimum parser, verifier, state machine, store, and CLI behavior was
+implemented, each focused suite passed. Coverage was then strengthened without
+changing the implementation to include:
+
+- every bit of a representative three-node proof and new root;
+- every bit of an RFC 8032 Ed25519 signature;
+- every bit of the signed checkpoint prefix, including size, root, and
+  identity;
+- 10,000 deterministic malformed envelope cases with a 50 ms per-case bound;
+- 20 cross-log delivery interleavings;
+- one generic in-process returned error after each of nine completed
+  publication stages;
+- separate state, proof, manifest, and decision corruption.
+
+Final fresh GREEN:
+
+```text
+cargo test --offline
+  cli: 4 passed
+  crypto: 4 passed
+  engine: 9 passed
+  parser: 5 passed
+  store: 5 passed
+  total: 27 passed, 0 failed
+
+cargo clippy --offline --all-targets -- -D warnings -D clippy::all -D clippy::pedantic
+  passed with no warnings
+
+cargo fmt --all -- --check
+  passed
+```
+
+## Reviewer fix round 1: RED to GREEN
+
+Five reviewer-reported gaps were turned into focused behavioral regressions
+before their fixes. The exact RED observations were:
+
+```text
+cargo test --offline --test engine archive_cursor_rollback_is_rejected_without_mutation -- --exact
+  FAILED: left Advanced, right ArchiveCursorRollback
+
+cargo test --offline --test engine same_base_candidates_are_all_decided_after_advance -- --exact
+  FAILED: pending["log-a"] was not empty
+
+cargo test --offline --test engine equal_key_pending_delivery_orders_have_identical_bytes -- --exact
+  FAILED: stable byte vectors differed
+
+cargo test --offline --test store republish_rejects_corrupt_existing_generation_and_preserves_current -- --exact
+  FAILED: left Ok(()), right Err(StoreCorrupt)
+```
+
+The resume regression initially failed to compile because `Engine::from_snapshot`
+did not exist. A minimal method returning `StoreCorrupt` was added solely to
+reach a behavioral RED:
+
+```text
+cargo test --offline --test store reopened_engine_continues_and_drains_pending_without_divergence -- --exact
+  FAILED: called Result::unwrap() on Err(StoreCorrupt)
+```
+
+The smallest fixes added a pre-mutation cursor guard, canonical-envelope pending
+identity and total ordering, complete stale-candidate draining, exact existing
+generation validation, and checked snapshot reconstruction. Each exact command
+then passed, followed by the 27-test all-target suite. Test expectations compare
+complete snapshots or independently signed delivery variants; they do not use
+production helpers to synthesize the expected outcome.
+
+```text
+cargo test --offline --locked --test engine archive_cursor_rollback_is_rejected_without_mutation -- --exact
+  1 passed, 0 failed
+cargo test --offline --locked --test engine same_base_candidates_are_all_decided_after_advance -- --exact
+  1 passed, 0 failed
+cargo test --offline --locked --test engine equal_key_pending_delivery_orders_have_identical_bytes -- --exact
+  1 passed, 0 failed
+cargo test --offline --locked --test store republish_rejects_corrupt_existing_generation_and_preserves_current -- --exact
+  1 passed, 0 failed
+cargo test --offline --locked --test store reopened_engine_continues_and_drains_pending_without_divergence -- --exact
+  1 passed, 0 failed
+```
+
+The publication model was also corrected rather than expanded: named
+process-exit, disk-full, and permission-denied variants were removed. The tests
+now claim only the behavior they execute—one generic returned error after a
+selected stage has completed. No child process, partial-write, OS error, or
+power-loss behavior is characterized.
+
+## Independent vector derivation
+
+The Merkle literals use `leaf[i] = SHA256(0x00 || u64_be(i))` and
+`node = SHA256(0x01 || left || right)`. A separate Python `hashlib` script
+computed roots for sizes 0, 1, 2, 3, 4, 7, 8, 15, 16, 65,535, and 65,536,
+plus consistency proofs for 1->2, 3->4, 4->7, and 7->8. Tests embed those
+literals. The production verifier contains no proof generator.
+
+The signature fixture is RFC 8032 test vector 2, not a signature produced by
+the code under test. Random test-only keys are used only to drive the full
+state-machine path after the RFC vector independently establishes the signature
+verification boundary.
diff --git a/developer-simulation/runs/2026-08-16--transparency-checkpoint-verifier/src/lib.rs b/developer-simulation/runs/2026-08-16--transparency-checkpoint-verifier/src/lib.rs
new file mode 100644
index 0000000..213ba58
--- /dev/null
+++ b/developer-simulation/runs/2026-08-16--transparency-checkpoint-verifier/src/lib.rs
@@ -0,0 +1,1209 @@
+#![forbid(unsafe_code)]
+
+use std::collections::{BTreeMap, BTreeSet};
+use std::fs::{self, File};
+use std::io::Write;
+use std::path::{Path, PathBuf};
+
+use ring::digest::{SHA256, digest};
+use ring::signature::{ED25519, UnparsedPublicKey};
+use serde::{Deserialize, Serialize};
+
+pub type Hash = [u8; 32];
+
+const MAX_ENVELOPE_BYTES: usize = 4_096;
+const MAX_PROOF_HASHES: u64 = 128;
+const MAX_PENDING_PER_LOG: usize = 16;
+const ED25519_ALGORITHM: u8 = 1;
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, PartialOrd, Ord, Serialize, Deserialize)]
+#[serde(rename_all = "SCREAMING_SNAKE_CASE")]
+pub enum ErrorCode {
+    Advanced,
+    Duplicate,
+    Equivocation,
+    PendingBase,
+    PendingLimit,
+    ParseEnvelopeSize,
+    ParseTruncated,
+    ParseMagic,
+    ParseIdentity,
+    ParseProofCount,
+    ParseTrailingBytes,
+    UnknownLog,
+    UnknownAlgorithm,
+    UnknownKey,
+    SignatureInvalid,
+    ProofInvalid,
+    SizeRollback,
+    ArchiveCursorRollback,
+    BaseMismatch,
+    StoreIo,
+    StoreCorrupt,
+    InjectedReturnedError,
+}
+
+#[derive(Debug, Clone)]
+pub struct ParsedEnvelope {
+    pub algorithm: u8,
+    pub tree_size: u64,
+    pub root: Hash,
+    pub timestamp_ms: u64,
+    pub log_id: String,
+    pub key_id: String,
+    pub base_size: u64,
+    pub proof: Vec<Hash>,
+    pub signature: Vec<u8>,
+    pub signed_bytes: Vec<u8>,
+    pub raw_proof: Vec<u8>,
+    pub raw_envelope: Vec<u8>,
+}
+
+/// Parses the prototype's characterized envelope, rejecting all declared
+/// lengths before allocating proof or signature storage.
+///
+/// # Errors
+///
+/// Returns a stable parse code when the envelope is oversized, truncated,
+/// malformed, or declares a proof beyond the admission limit.
+pub fn parse_envelope(raw: &[u8]) -> Result<ParsedEnvelope, ErrorCode> {
+    if raw.len() > MAX_ENVELOPE_BYTES {
+        return Err(ErrorCode::ParseEnvelopeSize);
+    }
+
+    let mut cursor = Cursor::new(raw);
+    if cursor.take(4)? != b"CKP1" {
+        return Err(ErrorCode::ParseMagic);
+    }
+    let algorithm = cursor.u8()?;
+    let tree_size = cursor.u64()?;
+    let root = cursor.hash()?;
+    let timestamp_ms = cursor.u64()?;
+    let log_len = usize::from(cursor.u8()?);
+    let key_len = usize::from(cursor.u8()?);
+    if !(1..=64).contains(&log_len) || !(1..=64).contains(&key_len) {
+        return Err(ErrorCode::ParseIdentity);
+    }
+    let log_id = std::str::from_utf8(cursor.take(log_len)?)
+        .map_err(|_| ErrorCode::ParseIdentity)?
+        .to_owned();
+    let key_id = std::str::from_utf8(cursor.take(key_len)?)
+        .map_err(|_| ErrorCode::ParseIdentity)?
+        .to_owned();
+    let signed_end = cursor.position();
+    let base_size = cursor.u64()?;
+    let proof_count = cursor.u64()?;
+    if proof_count > MAX_PROOF_HASHES {
+        return Err(ErrorCode::ParseProofCount);
+    }
+    let proof_len = usize::try_from(proof_count)
+        .ok()
+        .and_then(|count| count.checked_mul(32))
+        .ok_or(ErrorCode::ParseProofCount)?;
+    let proof_bytes = cursor.take(proof_len)?;
+    let proof = proof_bytes
+        .chunks_exact(32)
+        .map(|node| {
+            let mut hash = [0_u8; 32];
+            hash.copy_from_slice(node);
+            hash
+        })
+        .collect();
+    let signature_len = usize::from(cursor.u16()?);
+    if signature_len > 512 {
+        return Err(ErrorCode::ParseEnvelopeSize);
+    }
+    let signature = cursor.take(signature_len)?.to_vec();
+    if cursor.position() != raw.len() {
+        return Err(ErrorCode::ParseTrailingBytes);
+    }
+
+    Ok(ParsedEnvelope {
+        algorithm,
+        tree_size,
+        root,
+        timestamp_ms,
+        log_id,
+        key_id,
+        base_size,
+        proof,
+        signature,
+        signed_bytes: raw[..signed_end].to_vec(),
+        raw_proof: proof_bytes.to_vec(),
+        raw_envelope: raw.to_vec(),
+    })
+}
+
+struct Cursor<'a> {
+    bytes: &'a [u8],
+    at: usize,
+}
+
+impl<'a> Cursor<'a> {
+    const fn new(bytes: &'a [u8]) -> Self {
+        Self { bytes, at: 0 }
+    }
+
+    const fn position(&self) -> usize {
+        self.at
+    }
+
+    fn take(&mut self, count: usize) -> Result<&'a [u8], ErrorCode> {
+        let end = self
+            .at
+            .checked_add(count)
+            .ok_or(ErrorCode::ParseTruncated)?;
+        let value = self
+            .bytes
+            .get(self.at..end)
+            .ok_or(ErrorCode::ParseTruncated)?;
+        self.at = end;
+        Ok(value)
+    }
+
+    fn u8(&mut self) -> Result<u8, ErrorCode> {
+        Ok(self.take(1)?[0])
+    }
+
+    fn u16(&mut self) -> Result<u16, ErrorCode> {
+        Ok(u16::from_be_bytes(
+            self.take(2)?.try_into().expect("two bytes requested"),
+        ))
+    }
+
+    fn u64(&mut self) -> Result<u64, ErrorCode> {
+        Ok(u64::from_be_bytes(
+            self.take(8)?.try_into().expect("eight bytes requested"),
+        ))
+    }
+
+    fn hash(&mut self) -> Result<Hash, ErrorCode> {
+        Ok(self
+            .take(32)?
+            .try_into()
+            .expect("thirty-two bytes requested"))
+    }
+}
+
+#[derive(Debug, Clone, Default)]
+pub struct TreeBuilder {
+    count: u64,
+    frontier: Vec<Option<Hash>>,
+}
+
+impl TreeBuilder {
+    #[must_use]
+    pub const fn new() -> Self {
+        Self {
+            count: 0,
+            frontier: Vec::new(),
+        }
+    }
+
+    /// Adds one already-domain-separated 32-byte leaf hash.
+    ///
+    /// # Errors
+    ///
+    /// Returns `ProofInvalid` if the leaf count overflows or the frontier is
+    /// internally inconsistent.
+    pub fn append_leaf_hash(&mut self, mut node: Hash) -> Result<(), ErrorCode> {
+        let next = self.count.checked_add(1).ok_or(ErrorCode::ProofInvalid)?;
+        let mut occupied = self.count;
+        let mut level = 0;
+        while occupied & 1 == 1 {
+            let left = self
+                .frontier
+                .get_mut(level)
+                .and_then(Option::take)
+                .ok_or(ErrorCode::ProofInvalid)?;
+            node = hash_node(left, node);
+            occupied >>= 1;
+            level += 1;
+        }
+        if level == self.frontier.len() {
+            self.frontier.push(Some(node));
+        } else {
+            self.frontier[level] = Some(node);
+        }
+        self.count = next;
+        Ok(())
+    }
+
+    #[must_use]
+    pub fn root(&self) -> Hash {
+        let mut root = None;
+        for node in self.frontier.iter().flatten() {
+            root = Some(match root {
+                None => *node,
+                Some(right) => hash_node(*node, right),
+            });
+        }
+        root.unwrap_or_else(empty_root)
+    }
+
+    #[must_use]
+    pub const fn count(&self) -> u64 {
+        self.count
+    }
+}
+
+#[must_use]
+pub fn root_from_leaf_hashes(leaves: &[Hash]) -> Hash {
+    let mut builder = TreeBuilder::new();
+    for leaf in leaves {
+        if builder.append_leaf_hash(*leaf).is_err() {
+            return empty_root();
+        }
+    }
+    builder.root()
+}
+
+#[must_use]
+pub fn empty_root() -> Hash {
+    let mut hash = [0_u8; 32];
+    hash.copy_from_slice(digest(&SHA256, &[]).as_ref());
+    hash
+}
+
+fn hash_node(left: Hash, right: Hash) -> Hash {
+    let mut input = [0_u8; 65];
+    input[0] = 1;
+    input[1..33].copy_from_slice(&left);
+    input[33..].copy_from_slice(&right);
+    let mut hash = [0_u8; 32];
+    hash.copy_from_slice(digest(&SHA256, &input).as_ref());
+    hash
+}
+
+/// Verifies an RFC 6962-style binary Merkle-tree consistency proof.
+///
+/// # Errors
+///
+/// Returns a stable size, admission, or proof code if the transition cannot
+/// establish that the new root extends the old tree.
+pub fn verify_consistency(
+    old_size: u64,
+    new_size: u64,
+    old_root: Hash,
+    new_root: Hash,
+    proof: &[Hash],
+) -> Result<(), ErrorCode> {
+    if proof.len() > 128 {
+        return Err(ErrorCode::ParseProofCount);
+    }
+    if old_size > new_size {
+        return Err(ErrorCode::SizeRollback);
+    }
+    if old_size == new_size {
+        return if old_root == new_root && proof.is_empty() {
+            Ok(())
+        } else {
+            Err(ErrorCode::ProofInvalid)
+        };
+    }
+    if old_size == 0 {
+        return if old_root == empty_root() && proof.is_empty() {
+            Ok(())
+        } else {
+            Err(ErrorCode::ProofInvalid)
+        };
+    }
+
+    let mut old_path = old_size - 1;
+    let mut new_path = new_size - 1;
+    while old_path & 1 == 1 {
+        old_path >>= 1;
+        new_path >>= 1;
+    }
+
+    let (mut old_hash, mut new_hash, start) = if old_size.is_power_of_two() {
+        (old_root, old_root, 0)
+    } else {
+        let first = *proof.first().ok_or(ErrorCode::ProofInvalid)?;
+        (first, first, 1)
+    };
+
+    for node in &proof[start..] {
+        if new_path == 0 {
+            return Err(ErrorCode::ProofInvalid);
+        }
+        if old_path & 1 == 1 || old_path == new_path {
+            old_hash = hash_node(*node, old_hash);
+            new_hash = hash_node(*node, new_hash);
+            while old_path != 0 && old_path & 1 == 0 {
+                old_path >>= 1;
+                new_path >>= 1;
+            }
+        } else {
+            new_hash = hash_node(new_hash, *node);
+        }
+        old_path >>= 1;
+        new_path >>= 1;
+    }
+
+    if new_path == 0 && old_hash == old_root && new_hash == new_root {
+        Ok(())
+    } else {
+        Err(ErrorCode::ProofInvalid)
+    }
+}
+
+/// Verifies an Ed25519 signature over the exact supplied message bytes.
+///
+/// # Errors
+///
+/// Returns `SignatureInvalid` for any malformed key/signature or failed
+/// verification.
+pub fn verify_ed25519(
+    public_key: &[u8; 32],
+    message: &[u8],
+    signature: &[u8],
+) -> Result<(), ErrorCode> {
+    UnparsedPublicKey::new(&ED25519, public_key)
+        .verify(message, signature)
+        .map_err(|_| ErrorCode::SignatureInvalid)
+}
+
+#[derive(Debug, Clone)]
+pub struct KnownLog {
+    pub log_id: String,
+    pub key_id: String,
+    pub algorithm: u8,
+    pub public_key: [u8; 32],
+}
+
+#[derive(Debug, Clone)]
+pub struct Registry {
+    logs: BTreeMap<String, KnownLog>,
+}
+
+impl Registry {
+    /// Constructs a fixed log/key registry.
+    ///
+    /// # Errors
+    ///
+    /// Returns `ParseIdentity` for empty or duplicate log identities.
+    pub fn new(logs: Vec<KnownLog>) -> Result<Self, ErrorCode> {
+        let mut by_id = BTreeMap::new();
+        for log in logs {
+            if log.log_id.is_empty()
+                || log.key_id.is_empty()
+                || by_id.insert(log.log_id.clone(), log).is_some()
+            {
+                return Err(ErrorCode::ParseIdentity);
+            }
+        }
+        Ok(Self { logs: by_id })
+    }
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+pub struct CurrentCheckpoint {
+    pub tree_size: u64,
+    pub root: Hash,
+    pub archive_cursor: u64,
+    pub raw_proof: Vec<u8>,
+    pub raw_envelope: Vec<u8>,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+pub struct Equivocation {
+    pub log_id: String,
+    pub tree_size: u64,
+    pub first_root: Hash,
+    pub second_root: Hash,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+pub struct DecisionRecord {
+    pub log_id: String,
+    pub code: ErrorCode,
+    pub base_size: u64,
+    pub tree_size: u64,
+    pub root: Hash,
+    pub archive_cursor: u64,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+pub struct PendingCheckpoint {
+    pub base_size: u64,
+    pub tree_size: u64,
+    pub root: Hash,
+    pub archive_cursor: u64,
+    pub envelope_id: Hash,
+    pub raw_envelope: Vec<u8>,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize, Default)]
+pub struct EngineSnapshot {
+    pub logs: BTreeMap<String, CurrentCheckpoint>,
+    pub pending: BTreeMap<String, Vec<PendingCheckpoint>>,
+    pub decisions: Vec<DecisionRecord>,
+    pub equivocations: Vec<Equivocation>,
+    pub seen_envelopes: BTreeSet<Hash>,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct SubmitOutcome {
+    pub code: ErrorCode,
+    pub advanced_sizes: Vec<u64>,
+}
+
+pub struct Engine {
+    registry: Registry,
+    snapshot: EngineSnapshot,
+}
+
+impl Engine {
+    #[must_use]
+    pub fn new(registry: Registry) -> Self {
+        let logs = registry
+            .logs
+            .keys()
+            .map(|log_id| {
+                (
+                    log_id.clone(),
+                    CurrentCheckpoint {
+                        tree_size: 0,
+                        root: empty_root(),
+                        archive_cursor: 0,
+                        raw_proof: Vec::new(),
+                        raw_envelope: Vec::new(),
+                    },
+                )
+            })
+            .collect();
+        Self {
+            registry,
+            snapshot: EngineSnapshot {
+                logs,
+                ..EngineSnapshot::default()
+            },
+        }
+    }
+
+    /// Restores a verifier from a persisted snapshot.
+    ///
+    /// # Errors
+    ///
+    /// Returns `StoreCorrupt` when registry/log correspondence, signatures,
+    /// exact envelope identities, or deterministic snapshot invariants fail.
+    pub fn from_snapshot(registry: Registry, snapshot: EngineSnapshot) -> Result<Self, ErrorCode> {
+        validate_snapshot(&registry, &snapshot)?;
+        Ok(Self { registry, snapshot })
+    }
+
+    pub fn submit(&mut self, raw: &[u8], archive_cursor: u64) -> SubmitOutcome {
+        let parsed = match parse_envelope(raw) {
+            Ok(parsed) => parsed,
+            Err(code) => return outcome(code),
+        };
+        let Some(known) = self.registry.logs.get(&parsed.log_id) else {
+            return outcome(ErrorCode::UnknownLog);
+        };
+        if parsed.algorithm != ED25519_ALGORITHM || parsed.algorithm != known.algorithm {
+            return outcome(ErrorCode::UnknownAlgorithm);
+        }
+        if parsed.key_id != known.key_id {
+            return outcome(ErrorCode::UnknownKey);
+        }
+        if let Err(code) =
+            verify_ed25519(&known.public_key, &parsed.signed_bytes, &parsed.signature)
+        {
+            return outcome(code);
+        }
+
+        let envelope_id = sha256(raw);
+        if self.snapshot.seen_envelopes.contains(&envelope_id)
+            || self
+                .snapshot
+                .pending
+                .get(&parsed.log_id)
+                .is_some_and(|pending| pending.iter().any(|item| item.raw_envelope == raw))
+        {
+            return outcome(ErrorCode::Duplicate);
+        }
+
+        self.process_verified(&parsed, archive_cursor, envelope_id, true)
+    }
+
+    fn process_verified(
+        &mut self,
+        parsed: &ParsedEnvelope,
+        archive_cursor: u64,
+        envelope_id: Hash,
+        drain: bool,
+    ) -> SubmitOutcome {
+        let current = self
+            .snapshot
+            .logs
+            .get(&parsed.log_id)
+            .expect("registry and initialized logs agree")
+            .clone();
+
+        if archive_cursor < current.archive_cursor {
+            return outcome(ErrorCode::ArchiveCursorRollback);
+        }
+
+        if parsed.tree_size < current.tree_size {
+            return outcome(ErrorCode::SizeRollback);
+        }
+        if parsed.tree_size == current.tree_size {
+            if parsed.root == current.root {
+                self.snapshot.seen_envelopes.insert(envelope_id);
+                return outcome(ErrorCode::Duplicate);
+            }
+            let alert = Equivocation {
+                log_id: parsed.log_id.clone(),
+                tree_size: parsed.tree_size,
+                first_root: current.root,
+                second_root: parsed.root,
+            };
+            if !self.snapshot.equivocations.contains(&alert) {
+                self.snapshot.equivocations.push(alert);
+                self.snapshot.equivocations.sort_by(equivocation_order);
+            }
+            self.record(parsed, archive_cursor, ErrorCode::Equivocation);
+            self.snapshot.seen_envelopes.insert(envelope_id);
+            return outcome(ErrorCode::Equivocation);
+        }
+        if parsed.base_size < current.tree_size {
+            return outcome(ErrorCode::BaseMismatch);
+        }
+        if parsed.base_size > current.tree_size {
+            let pending = self
+                .snapshot
+                .pending
+                .entry(parsed.log_id.clone())
+                .or_default();
+            if pending.len() >= MAX_PENDING_PER_LOG {
+                return outcome(ErrorCode::PendingLimit);
+            }
+            pending.push(PendingCheckpoint {
+                base_size: parsed.base_size,
+                tree_size: parsed.tree_size,
+                root: parsed.root,
+                archive_cursor,
+                envelope_id,
+                raw_envelope: parsed.raw_envelope.clone(),
+            });
+            pending.sort_by(pending_order);
+            self.record(parsed, archive_cursor, ErrorCode::PendingBase);
+            return outcome(ErrorCode::PendingBase);
+        }
+
+        if let Err(code) = verify_consistency(
+            current.tree_size,
+            parsed.tree_size,
+            current.root,
+            parsed.root,
+            &parsed.proof,
+        ) {
+            self.record(parsed, archive_cursor, code);
+            return outcome(code);
+        }
+
+        let log_id = parsed.log_id.clone();
+        let size = parsed.tree_size;
+        self.snapshot.logs.insert(
+            log_id.clone(),
+            CurrentCheckpoint {
+                tree_size: parsed.tree_size,
+                root: parsed.root,
+                archive_cursor,
+                raw_proof: parsed.raw_proof.clone(),
+                raw_envelope: parsed.raw_envelope.clone(),
+            },
+        );
+        self.record(parsed, archive_cursor, ErrorCode::Advanced);
+        self.snapshot.seen_envelopes.insert(envelope_id);
+
+        let mut advanced_sizes = vec![size];
+        if drain {
+            self.drain_pending(&log_id, &mut advanced_sizes);
+        }
+        SubmitOutcome {
+            code: ErrorCode::Advanced,
+            advanced_sizes,
+        }
+    }
+
+    fn drain_pending(&mut self, log_id: &str, advanced: &mut Vec<u64>) {
+        loop {
+            let current_size = self.snapshot.logs.get(log_id).expect("known log").tree_size;
+            let next = self.snapshot.pending.get_mut(log_id).and_then(|items| {
+                let index = items
+                    .iter()
+                    .position(|item| item.base_size <= current_size)?;
+                Some(items.remove(index))
+            });
+            let Some(next) = next else {
+                break;
+            };
+            let Ok(parsed) = parse_envelope(&next.raw_envelope) else {
+                continue;
+            };
+            let result =
+                self.process_verified(&parsed, next.archive_cursor, next.envelope_id, false);
+            if result.code == ErrorCode::Advanced {
+                advanced.extend(result.advanced_sizes);
+            } else {
+                self.finish_removed_pending(
+                    &parsed,
+                    next.archive_cursor,
+                    next.envelope_id,
+                    result.code,
+                );
+            }
+        }
+    }
+
+    fn finish_removed_pending(
+        &mut self,
+        parsed: &ParsedEnvelope,
+        archive_cursor: u64,
+        envelope_id: Hash,
+        code: ErrorCode,
+    ) {
+        match code {
+            ErrorCode::ProofInvalid => {
+                self.snapshot.seen_envelopes.insert(envelope_id);
+            }
+            ErrorCode::ArchiveCursorRollback
+            | ErrorCode::BaseMismatch
+            | ErrorCode::SizeRollback => {
+                self.record(parsed, archive_cursor, code);
+                self.snapshot.seen_envelopes.insert(envelope_id);
+            }
+            _ => {}
+        }
+    }
+
+    fn record(&mut self, parsed: &ParsedEnvelope, archive_cursor: u64, code: ErrorCode) {
+        self.snapshot.decisions.push(DecisionRecord {
+            log_id: parsed.log_id.clone(),
+            code,
+            base_size: parsed.base_size,
+            tree_size: parsed.tree_size,
+            root: parsed.root,
+            archive_cursor,
+        });
+        self.snapshot.decisions.sort_by(decision_order);
+    }
+
+    #[must_use]
+    pub fn current(&self, log_id: &str) -> Option<&CurrentCheckpoint> {
+        self.snapshot.logs.get(log_id)
+    }
+
+    #[must_use]
+    pub fn snapshot(&self) -> EngineSnapshot {
+        self.snapshot.clone()
+    }
+
+    #[must_use]
+    pub fn stable_bytes(&self) -> Vec<u8> {
+        serde_json::to_vec(&self.snapshot).unwrap_or_default()
+    }
+}
+
+fn validate_snapshot(registry: &Registry, snapshot: &EngineSnapshot) -> Result<(), ErrorCode> {
+    if !registry.logs.keys().eq(snapshot.logs.keys()) {
+        return Err(ErrorCode::StoreCorrupt);
+    }
+
+    for (log_id, current) in &snapshot.logs {
+        let known = registry.logs.get(log_id).ok_or(ErrorCode::StoreCorrupt)?;
+        if current.tree_size == 0 {
+            if current.root != empty_root()
+                || current.archive_cursor != 0
+                || !current.raw_proof.is_empty()
+                || !current.raw_envelope.is_empty()
+            {
+                return Err(ErrorCode::StoreCorrupt);
+            }
+            continue;
+        }
+        let parsed = parse_envelope(&current.raw_envelope).map_err(|_| ErrorCode::StoreCorrupt)?;
+        validate_known_envelope(known, &parsed)?;
+        if parsed.log_id != *log_id
+            || parsed.tree_size != current.tree_size
+            || parsed.root != current.root
+            || parsed.base_size >= parsed.tree_size
+            || parsed.raw_proof != current.raw_proof
+            || !snapshot
+                .seen_envelopes
+                .contains(&sha256(&current.raw_envelope))
+        {
+            return Err(ErrorCode::StoreCorrupt);
+        }
+    }
+
+    let mut pending_ids = BTreeSet::new();
+    for (log_id, items) in &snapshot.pending {
+        let known = registry.logs.get(log_id).ok_or(ErrorCode::StoreCorrupt)?;
+        let current = snapshot.logs.get(log_id).ok_or(ErrorCode::StoreCorrupt)?;
+        if items.len() > MAX_PENDING_PER_LOG
+            || !items.is_sorted_by(|left, right| pending_order(left, right).is_le())
+        {
+            return Err(ErrorCode::StoreCorrupt);
+        }
+        for item in items {
+            let parsed = parse_envelope(&item.raw_envelope).map_err(|_| ErrorCode::StoreCorrupt)?;
+            validate_known_envelope(known, &parsed)?;
+            if parsed.log_id != *log_id
+                || parsed.base_size != item.base_size
+                || parsed.tree_size != item.tree_size
+                || parsed.root != item.root
+                || parsed.tree_size <= parsed.base_size
+                || item.base_size <= current.tree_size
+                || item.archive_cursor < current.archive_cursor
+                || item.envelope_id != sha256(&item.raw_envelope)
+                || snapshot.seen_envelopes.contains(&item.envelope_id)
+                || !pending_ids.insert(item.envelope_id)
+            {
+                return Err(ErrorCode::StoreCorrupt);
+            }
+        }
+    }
+
+    if !snapshot
+        .decisions
+        .iter()
+        .all(|decision| registry.logs.contains_key(&decision.log_id))
+        || !snapshot
+            .decisions
+            .is_sorted_by(|left, right| decision_order(left, right).is_le())
+        || !snapshot.equivocations.iter().all(|alert| {
+            registry.logs.contains_key(&alert.log_id) && alert.first_root != alert.second_root
+        })
+        || !snapshot
+            .equivocations
+            .is_sorted_by(|left, right| equivocation_order(left, right).is_le())
+        || snapshot
+            .equivocations
+            .windows(2)
+            .any(|pair| pair[0] == pair[1])
+    {
+        return Err(ErrorCode::StoreCorrupt);
+    }
+
+    Ok(())
+}
+
+fn validate_known_envelope(known: &KnownLog, parsed: &ParsedEnvelope) -> Result<(), ErrorCode> {
+    if parsed.log_id != known.log_id
+        || parsed.key_id != known.key_id
+        || parsed.algorithm != ED25519_ALGORITHM
+        || parsed.algorithm != known.algorithm
+        || verify_ed25519(&known.public_key, &parsed.signed_bytes, &parsed.signature).is_err()
+    {
+        Err(ErrorCode::StoreCorrupt)
+    } else {
+        Ok(())
+    }
+}
+
+fn outcome(code: ErrorCode) -> SubmitOutcome {
+    SubmitOutcome {
+        code,
+        advanced_sizes: Vec::new(),
+    }
+}
+
+fn decision_order(left: &DecisionRecord, right: &DecisionRecord) -> std::cmp::Ordering {
+    (
+        &left.log_id,
+        left.tree_size,
+        left.base_size,
+        left.root,
+        left.code,
+        left.archive_cursor,
+    )
+        .cmp(&(
+            &right.log_id,
+            right.tree_size,
+            right.base_size,
+            right.root,
+            right.code,
+            right.archive_cursor,
+        ))
+}
+
+fn pending_order(left: &PendingCheckpoint, right: &PendingCheckpoint) -> std::cmp::Ordering {
+    (
+        left.base_size,
+        left.tree_size,
+        left.root,
+        left.archive_cursor,
+        left.envelope_id,
+        &left.raw_envelope,
+    )
+        .cmp(&(
+            right.base_size,
+            right.tree_size,
+            right.root,
+            right.archive_cursor,
+            right.envelope_id,
+            &right.raw_envelope,
+        ))
+}
+
+fn equivocation_order(left: &Equivocation, right: &Equivocation) -> std::cmp::Ordering {
+    (
+        &left.log_id,
+        left.tree_size,
+        left.first_root,
+        left.second_root,
+    )
+        .cmp(&(
+            &right.log_id,
+            right.tree_size,
+            right.first_root,
+            right.second_root,
+        ))
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum PublicationStage {
+    StateWrite,
+    ProofWrite,
+    DecisionWrite,
+    Flush,
+    GenerationRename,
+    PointerWrite,
+    PointerFlush,
+    PointerRename,
+    DirectorySync,
+}
+
+impl PublicationStage {
+    pub const ALL: [Self; 9] = [
+        Self::StateWrite,
+        Self::ProofWrite,
+        Self::DecisionWrite,
+        Self::Flush,
+        Self::GenerationRename,
+        Self::PointerWrite,
+        Self::PointerFlush,
+        Self::PointerRename,
+        Self::DirectorySync,
+    ];
+}
+
+#[derive(Debug, Serialize, Deserialize)]
+struct Manifest {
+    state_sha256: String,
+    proofs_sha256: String,
+    decisions_digest: String,
+}
+
+#[derive(Debug, Serialize)]
+struct ProofArchive<'a> {
+    current: BTreeMap<&'a str, (&'a [u8], &'a [u8])>,
+    pending: BTreeMap<&'a str, Vec<&'a [u8]>>,
+}
+
+#[derive(Debug)]
+pub struct DirectoryStore {
+    root: PathBuf,
+}
+
+impl DirectoryStore {
+    #[must_use]
+    pub fn new(path: impl AsRef<Path>) -> Self {
+        Self {
+            root: path.as_ref().to_path_buf(),
+        }
+    }
+
+    /// Publishes one deterministic generation and atomically switches the
+    /// visible generation pointer.
+    ///
+    /// # Errors
+    ///
+    /// Returns a stable store code for serialization or I/O, or one generic
+    /// in-process returned error after the requested stage has completed.
+    pub fn publish(
+        &self,
+        snapshot: &EngineSnapshot,
+        returned_error_after: Option<PublicationStage>,
+    ) -> Result<(), ErrorCode> {
+        fs::create_dir_all(&self.root).map_err(|_| ErrorCode::StoreIo)?;
+        let state = serde_json::to_vec(snapshot).map_err(|_| ErrorCode::StoreCorrupt)?;
+        let proofs = proof_bytes(snapshot)?;
+        let decisions = decision_bytes(snapshot)?;
+        let manifest = serde_json::to_vec(&Manifest {
+            state_sha256: hex(&sha256(&state)),
+            proofs_sha256: hex(&sha256(&proofs)),
+            decisions_digest: hex(&sha256(&decisions)),
+        })
+        .map_err(|_| ErrorCode::StoreCorrupt)?;
+        let mut generation_material =
+            Vec::with_capacity(state.len() + proofs.len() + decisions.len());
+        generation_material.extend_from_slice(&state);
+        generation_material.extend_from_slice(&proofs);
+        generation_material.extend_from_slice(&decisions);
+        let generation = format!("gen-{}", hex(&sha256(&generation_material)));
+        let temporary = self.root.join(format!(".tmp-{generation}"));
+        let complete = self.root.join(&generation);
+
+        if temporary.exists() {
+            fs::remove_dir_all(&temporary).map_err(|_| ErrorCode::StoreIo)?;
+        }
+        if complete.exists() {
+            validate_generation_exact(&complete, &state, &proofs, &decisions, &manifest)?;
+            inject(returned_error_after, PublicationStage::GenerationRename)?;
+        } else {
+            fs::create_dir(&temporary).map_err(|_| ErrorCode::StoreIo)?;
+            write_file(&temporary.join("state.json"), &state)?;
+            inject(returned_error_after, PublicationStage::StateWrite)?;
+            write_file(&temporary.join("proofs.json"), &proofs)?;
+            inject(returned_error_after, PublicationStage::ProofWrite)?;
+            write_file(&temporary.join("decisions.jsonl"), &decisions)?;
+            inject(returned_error_after, PublicationStage::DecisionWrite)?;
+            write_file(&temporary.join("manifest.json"), &manifest)?;
+            for name in [
+                "state.json",
+                "proofs.json",
+                "decisions.jsonl",
+                "manifest.json",
+            ] {
+                File::open(temporary.join(name))
+                    .and_then(|file| file.sync_all())
+                    .map_err(|_| ErrorCode::StoreIo)?;
+            }
+            inject(returned_error_after, PublicationStage::Flush)?;
+            fs::rename(&temporary, &complete).map_err(|_| ErrorCode::StoreIo)?;
+            inject(returned_error_after, PublicationStage::GenerationRename)?;
+        }
+
+        let pointer_tmp = self.root.join("CURRENT.next");
+        write_file(&pointer_tmp, generation.as_bytes())?;
+        inject(returned_error_after, PublicationStage::PointerWrite)?;
+        File::open(&pointer_tmp)
+            .and_then(|file| file.sync_all())
+            .map_err(|_| ErrorCode::StoreIo)?;
+        inject(returned_error_after, PublicationStage::PointerFlush)?;
+        fs::rename(&pointer_tmp, self.root.join("CURRENT")).map_err(|_| ErrorCode::StoreIo)?;
+        inject(returned_error_after, PublicationStage::PointerRename)?;
+        sync_directory(&self.root)?;
+        inject(returned_error_after, PublicationStage::DirectorySync)?;
+        Ok(())
+    }
+
+    /// Reopens and digest-checks the complete visible generation.
+    ///
+    /// # Errors
+    ///
+    /// Returns `StoreIo` when no generation is readable and `StoreCorrupt`
+    /// when any payload or manifest fails validation.
+    pub fn reopen(&self) -> Result<EngineSnapshot, ErrorCode> {
+        let VisibleParts {
+            state,
+            proofs,
+            decisions,
+            manifest,
+            ..
+        } = self.visible_parts()?;
+        validate_manifest(&state, &proofs, &decisions, &manifest)?;
+        let snapshot: EngineSnapshot =
+            serde_json::from_slice(&state).map_err(|_| ErrorCode::StoreCorrupt)?;
+        if proof_bytes(&snapshot)? != proofs || decision_bytes(&snapshot)? != decisions {
+            return Err(ErrorCode::StoreCorrupt);
+        }
+        Ok(snapshot)
+    }
+
+    /// Returns a canonical concatenation of the visible pointer and files.
+    ///
+    /// # Errors
+    ///
+    /// Returns a stable store code if the visible generation is incomplete.
+    pub fn visible_bytes(&self) -> Result<Vec<u8>, ErrorCode> {
+        let VisibleParts {
+            generation,
+            state,
+            proofs,
+            decisions,
+            manifest,
+        } = self.visible_parts()?;
+        let mut all = generation.into_bytes();
+        all.push(b'\n');
+        for part in [state, proofs, decisions, manifest] {
+            all.extend_from_slice(&part);
+            all.push(b'\n');
+        }
+        Ok(all)
+    }
+
+    fn visible_parts(&self) -> Result<VisibleParts, ErrorCode> {
+        let generation =
+            fs::read_to_string(self.root.join("CURRENT")).map_err(|_| ErrorCode::StoreIo)?;
+        let generation = generation.trim().to_owned();
+        if generation.is_empty() || generation.contains('/') || generation.contains("..") {
+            return Err(ErrorCode::StoreCorrupt);
+        }
+        let dir = self.root.join(&generation);
+        Ok(VisibleParts {
+            generation,
+            state: fs::read(dir.join("state.json")).map_err(|_| ErrorCode::StoreCorrupt)?,
+            proofs: fs::read(dir.join("proofs.json")).map_err(|_| ErrorCode::StoreCorrupt)?,
+            decisions: fs::read(dir.join("decisions.jsonl"))
+                .map_err(|_| ErrorCode::StoreCorrupt)?,
+            manifest: fs::read(dir.join("manifest.json")).map_err(|_| ErrorCode::StoreCorrupt)?,
+        })
+    }
+}
+
+struct VisibleParts {
+    generation: String,
+    state: Vec<u8>,
+    proofs: Vec<u8>,
+    decisions: Vec<u8>,
+    manifest: Vec<u8>,
+}
+
+fn validate_generation_exact(
+    directory: &Path,
+    expected_state: &[u8],
+    expected_proofs: &[u8],
+    expected_decisions: &[u8],
+    expected_manifest: &[u8],
+) -> Result<(), ErrorCode> {
+    let names: BTreeSet<String> = fs::read_dir(directory)
+        .map_err(|_| ErrorCode::StoreCorrupt)?
+        .map(|entry| {
+            entry
+                .map_err(|_| ErrorCode::StoreCorrupt)?
+                .file_name()
+                .into_string()
+                .map_err(|_| ErrorCode::StoreCorrupt)
+        })
+        .collect::<Result<_, _>>()?;
+    let expected_names = [
+        "decisions.jsonl",
+        "manifest.json",
+        "proofs.json",
+        "state.json",
+    ]
+    .into_iter()
+    .map(str::to_string)
+    .collect();
+    if names != expected_names {
+        return Err(ErrorCode::StoreCorrupt);
+    }
+
+    let state = fs::read(directory.join("state.json")).map_err(|_| ErrorCode::StoreCorrupt)?;
+    let proofs = fs::read(directory.join("proofs.json")).map_err(|_| ErrorCode::StoreCorrupt)?;
+    let decisions =
+        fs::read(directory.join("decisions.jsonl")).map_err(|_| ErrorCode::StoreCorrupt)?;
+    let manifest =
+        fs::read(directory.join("manifest.json")).map_err(|_| ErrorCode::StoreCorrupt)?;
+    validate_manifest(&state, &proofs, &decisions, &manifest)?;
+    if state != expected_state
+        || proofs != expected_proofs
+        || decisions != expected_decisions
+        || manifest != expected_manifest
+    {
+        return Err(ErrorCode::StoreCorrupt);
+    }
+    Ok(())
+}
+
+fn validate_manifest(
+    state: &[u8],
+    proofs: &[u8],
+    decisions: &[u8],
+    manifest: &[u8],
+) -> Result<(), ErrorCode> {
+    let manifest: Manifest =
+        serde_json::from_slice(manifest).map_err(|_| ErrorCode::StoreCorrupt)?;
+    if manifest.state_sha256 != hex(&sha256(state))
+        || manifest.proofs_sha256 != hex(&sha256(proofs))
+        || manifest.decisions_digest != hex(&sha256(decisions))
+    {
+        Err(ErrorCode::StoreCorrupt)
+    } else {
+        Ok(())
+    }
+}
+
+fn proof_bytes(snapshot: &EngineSnapshot) -> Result<Vec<u8>, ErrorCode> {
+    let current = snapshot
+        .logs
+        .iter()
+        .map(|(log, checkpoint)| {
+            (
+                log.as_str(),
+                (
+                    checkpoint.raw_proof.as_slice(),
+                    checkpoint.raw_envelope.as_slice(),
+                ),
+            )
+        })
+        .collect();
+    let pending = snapshot
+        .pending
+        .iter()
+        .map(|(log, items)| {
+            (
+                log.as_str(),
+                items
+                    .iter()
+                    .map(|item| item.raw_envelope.as_slice())
+                    .collect(),
+            )
+        })
+        .collect();
+    serde_json::to_vec(&ProofArchive { current, pending }).map_err(|_| ErrorCode::StoreCorrupt)
+}
+
+fn decision_bytes(snapshot: &EngineSnapshot) -> Result<Vec<u8>, ErrorCode> {
+    let mut bytes = Vec::new();
+    for decision in &snapshot.decisions {
+        serde_json::to_writer(&mut bytes, decision).map_err(|_| ErrorCode::StoreCorrupt)?;
+        bytes.push(b'\n');
+    }
+    Ok(bytes)
+}
+
+fn write_file(path: &Path, bytes: &[u8]) -> Result<(), ErrorCode> {
+    let mut file = File::create(path).map_err(|_| ErrorCode::StoreIo)?;
+    file.write_all(bytes).map_err(|_| ErrorCode::StoreIo)
+}
+
+fn sync_directory(path: &Path) -> Result<(), ErrorCode> {
+    File::open(path)
+        .and_then(|directory| directory.sync_all())
+        .map_err(|_| ErrorCode::StoreIo)
+}
+
+fn inject(
+    returned_error_after: Option<PublicationStage>,
+    stage: PublicationStage,
+) -> Result<(), ErrorCode> {
+    if returned_error_after == Some(stage) {
+        Err(ErrorCode::InjectedReturnedError)
+    } else {
+        Ok(())
+    }
+}
+
+fn sha256(bytes: &[u8]) -> Hash {
+    digest(&SHA256, bytes)
+        .as_ref()
+        .try_into()
+        .expect("SHA-256 length")
+}
+
+#[must_use]
+pub fn hex(bytes: &[u8]) -> String {
+    const TABLE: &[u8; 16] = b"0123456789abcdef";
+    let mut out = String::with_capacity(bytes.len() * 2);
+    for byte in bytes {
+        out.push(char::from(TABLE[usize::from(byte >> 4)]));
+        out.push(char::from(TABLE[usize::from(byte & 0x0f)]));
+    }
+    out
+}
diff --git a/developer-simulation/runs/2026-08-16--transparency-checkpoint-verifier/src/main.rs b/developer-simulation/runs/2026-08-16--transparency-checkpoint-verifier/src/main.rs
new file mode 100644
index 0000000..ca03492
--- /dev/null
+++ b/developer-simulation/runs/2026-08-16--transparency-checkpoint-verifier/src/main.rs
@@ -0,0 +1,193 @@
+#![forbid(unsafe_code)]
+
+use std::env;
+use std::fs;
+use std::path::Path;
+use std::process::ExitCode;
+use std::time::Instant;
+
+use ring::digest::{SHA256, digest};
+use ring::rand::SystemRandom;
+use ring::signature::{Ed25519KeyPair, KeyPair};
+use transparency_checkpoint_verifier::{
+    DirectoryStore, Engine, ErrorCode, KnownLog, Registry, TreeBuilder, hex,
+};
+
+fn main() -> ExitCode {
+    match run() {
+        Ok(code) => code,
+        Err(message) => {
+            eprintln!("{message}");
+            ExitCode::FAILURE
+        }
+    }
+}
+
+fn run() -> Result<ExitCode, String> {
+    let args: Vec<String> = env::args().skip(1).collect();
+    match args.as_slice() {
+        [command, count] if command == "replay" => replay(count),
+        [command, count] if command == "bench-incremental" => bench_incremental(count),
+        [command, expected, actual] if command == "compare" => compare(expected, actual),
+        [command, directory] if command == "demo" => demo(Path::new(directory)),
+        [command, directory] if command == "inspect" => inspect(Path::new(directory)),
+        _ => Err("usage: transparency-checkpoint-verifier replay <leaf-count> | bench-incremental <iterations> | compare <expected> <actual> | demo <directory> | inspect <directory>".to_string()),
+    }
+}
+
+fn bench_incremental(count: &str) -> Result<ExitCode, String> {
+    let count: usize = count
+        .parse()
+        .map_err(|_| "iterations must be an unsigned integer".to_string())?;
+    if !(1..=100_000).contains(&count) {
+        return Err("iterations must be between 1 and 100000".to_string());
+    }
+    let pkcs8 = Ed25519KeyPair::generate_pkcs8(&SystemRandom::new())
+        .map_err(|_| "generate benchmark key".to_string())?;
+    let pair = Ed25519KeyPair::from_pkcs8(pkcs8.as_ref())
+        .map_err(|_| "parse benchmark key".to_string())?;
+    let public_key: [u8; 32] = pair
+        .public_key()
+        .as_ref()
+        .try_into()
+        .map_err(|_| "benchmark public-key length".to_string())?;
+    let registry = Registry::new(vec![KnownLog {
+        log_id: "benchmark-log".to_string(),
+        key_id: "benchmark-key".to_string(),
+        algorithm: 1,
+        public_key,
+    }])
+    .map_err(|code| format!("benchmark registry: {code:?}"))?;
+    let envelope = signed_first_checkpoint(&pair);
+
+    for _ in 0..50 {
+        benchmark_once(registry.clone(), &envelope)?;
+    }
+    let mut samples = Vec::with_capacity(count);
+    for _ in 0..count {
+        let started = Instant::now();
+        benchmark_once(registry.clone(), &envelope)?;
+        samples.push(started.elapsed().as_micros());
+    }
+    samples.sort_unstable();
+    let percentile_index = (count * 95).div_ceil(100).saturating_sub(1);
+    println!(
+        "{{\"iterations\":{count},\"p95_us\":{}}}",
+        samples[percentile_index]
+    );
+    Ok(ExitCode::SUCCESS)
+}
+
+fn benchmark_once(registry: Registry, envelope: &[u8]) -> Result<(), String> {
+    let outcome = Engine::new(registry).submit(envelope, 1);
+    if outcome.code == ErrorCode::Advanced {
+        Ok(())
+    } else {
+        Err(format!("benchmark verification: {:?}", outcome.code))
+    }
+}
+
+fn signed_first_checkpoint(pair: &Ed25519KeyPair) -> Vec<u8> {
+    let mut leaf_input = [0_u8; 9];
+    leaf_input[1..].copy_from_slice(&0_u64.to_be_bytes());
+    let root = digest(&SHA256, &leaf_input);
+    let log_id = b"benchmark-log";
+    let key_id = b"benchmark-key";
+    let mut envelope = Vec::new();
+    envelope.extend_from_slice(b"CKP1");
+    envelope.push(1);
+    envelope.extend_from_slice(&1_u64.to_be_bytes());
+    envelope.extend_from_slice(root.as_ref());
+    envelope.extend_from_slice(&1_u64.to_be_bytes());
+    envelope.push(u8::try_from(log_id.len()).expect("constant log identity is short"));
+    envelope.push(u8::try_from(key_id.len()).expect("constant key identity is short"));
+    envelope.extend_from_slice(log_id);
+    envelope.extend_from_slice(key_id);
+    let signature = pair.sign(&envelope);
+    envelope.extend_from_slice(&0_u64.to_be_bytes());
+    envelope.extend_from_slice(&0_u64.to_be_bytes());
+    envelope.extend_from_slice(&64_u16.to_be_bytes());
+    envelope.extend_from_slice(signature.as_ref());
+    envelope
+}
+
+fn replay(count: &str) -> Result<ExitCode, String> {
+    let count: u64 = count
+        .parse()
+        .map_err(|_| "leaf-count must be an unsigned integer".to_string())?;
+    let started = Instant::now();
+    let mut tree = TreeBuilder::new();
+    for index in 0..count {
+        let mut input = [0_u8; 9];
+        input[1..].copy_from_slice(&index.to_be_bytes());
+        let leaf = digest(&SHA256, &input)
+            .as_ref()
+            .try_into()
+            .map_err(|_| "SHA-256 returned the wrong length".to_string())?;
+        tree.append_leaf_hash(leaf)
+            .map_err(|code| format!("tree append failed: {code:?}"))?;
+    }
+    let elapsed = started.elapsed();
+    println!(
+        "{{\"leaves\":{},\"root\":\"{}\",\"elapsed_ms\":{}}}",
+        tree.count(),
+        hex(&tree.root()),
+        elapsed.as_millis()
+    );
+    Ok(ExitCode::SUCCESS)
+}
+
+fn compare(expected: &str, actual: &str) -> Result<ExitCode, String> {
+    let expected = fs::read(expected).map_err(|error| format!("read expected ledger: {error}"))?;
+    let actual = fs::read(actual).map_err(|error| format!("read actual ledger: {error}"))?;
+    if expected == actual {
+        println!("MATCH");
+        Ok(ExitCode::SUCCESS)
+    } else {
+        println!("MISMATCH");
+        Ok(ExitCode::from(2))
+    }
+}
+
+fn demo(directory: &Path) -> Result<ExitCode, String> {
+    let logs = (0..8)
+        .map(|index| KnownLog {
+            log_id: format!("fixture-log-{index}"),
+            key_id: "fixture-key".to_string(),
+            algorithm: 1,
+            public_key: [0_u8; 32],
+        })
+        .collect();
+    let registry = Registry::new(logs).map_err(|code| format!("registry: {code:?}"))?;
+    let snapshot = Engine::new(registry.clone()).snapshot();
+    let store = DirectoryStore::new(directory);
+    store
+        .publish(&snapshot, None)
+        .map_err(|code| format!("publish: {code:?}"))?;
+    let started = Instant::now();
+    let reopened = store.reopen().map_err(|code| format!("reopen: {code:?}"))?;
+    let resumed = Engine::from_snapshot(registry, reopened)
+        .map_err(|code| format!("resume validation: {code:?}"))?;
+    println!(
+        "{{\"logs\":{},\"reopen_ms\":{},\"visible_digest\":\"{}\"}}",
+        resumed.snapshot().logs.len(),
+        started.elapsed().as_millis(),
+        hex(digest(
+            &SHA256,
+            &store
+                .visible_bytes()
+                .map_err(|code| format!("visible bytes: {code:?}"))?
+        )
+        .as_ref())
+    );
+    Ok(ExitCode::SUCCESS)
+}
+
+fn inspect(directory: &Path) -> Result<ExitCode, String> {
+    let snapshot = DirectoryStore::new(directory)
+        .reopen()
+        .map_err(|code| format!("reopen: {code:?}"))?;
+    let json = serde_json::to_string(&snapshot).map_err(|error| format!("serialize: {error}"))?;
+    println!("{json}");
+    Ok(ExitCode::SUCCESS)
+}
diff --git a/developer-simulation/runs/2026-08-16--transparency-checkpoint-verifier/tests/cli.rs b/developer-simulation/runs/2026-08-16--transparency-checkpoint-verifier/tests/cli.rs
new file mode 100644
index 0000000..8b8e594
--- /dev/null
+++ b/developer-simulation/runs/2026-08-16--transparency-checkpoint-verifier/tests/cli.rs
@@ -0,0 +1,80 @@
+use std::fs;
+use std::process::Command;
+
+use tempfile::tempdir;
+
+fn verifier() -> Command {
+    Command::new(env!("CARGO_BIN_EXE_transparency-checkpoint-verifier"))
+}
+
+#[test]
+fn replay_reports_hand_checked_root_for_four_leaf_hashes() {
+    let output = verifier().args(["replay", "4"]).output().unwrap();
+    assert!(output.status.success());
+    let stdout = String::from_utf8(output.stdout).unwrap();
+    assert!(stdout.contains("\"leaves\":4"));
+    assert!(
+        stdout.contains(
+            "\"root\":\"b15d2b1b07adada9b13b555c08062b1ae78ad1b0b7e99d97d942c936a6244439\""
+        )
+    );
+}
+
+#[test]
+fn compare_distinguishes_identical_and_different_ledgers() {
+    let dir = tempdir().unwrap();
+    let expected = dir.path().join("expected.jsonl");
+    let same = dir.path().join("same.jsonl");
+    let different = dir.path().join("different.jsonl");
+    fs::write(&expected, b"{\"code\":\"ADVANCED\"}\n").unwrap();
+    fs::write(&same, b"{\"code\":\"ADVANCED\"}\n").unwrap();
+    fs::write(&different, b"{\"code\":\"PROOF_INVALID\"}\n").unwrap();
+
+    let matched = verifier()
+        .arg("compare")
+        .arg(&expected)
+        .arg(&same)
+        .output()
+        .unwrap();
+    assert!(matched.status.success());
+    assert_eq!(matched.stdout, b"MATCH\n");
+
+    let mismatch = verifier()
+        .arg("compare")
+        .arg(&expected)
+        .arg(&different)
+        .output()
+        .unwrap();
+    assert_eq!(mismatch.status.code(), Some(2));
+    assert_eq!(mismatch.stdout, b"MISMATCH\n");
+}
+
+#[test]
+fn demo_publishes_and_reopens_eight_logs() {
+    let dir = tempdir().unwrap();
+    let output = verifier().arg("demo").arg(dir.path()).output().unwrap();
+    assert!(
+        output.status.success(),
+        "{}",
+        String::from_utf8_lossy(&output.stderr)
+    );
+    let stdout = String::from_utf8(output.stdout).unwrap();
+    assert!(stdout.contains("\"logs\":8"));
+    assert!(dir.path().join("CURRENT").exists());
+}
+
+#[test]
+fn incremental_benchmark_reports_p95_for_real_verification_path() {
+    let output = verifier()
+        .args(["bench-incremental", "100"])
+        .output()
+        .unwrap();
+    assert!(
+        output.status.success(),
+        "{}",
+        String::from_utf8_lossy(&output.stderr)
+    );
+    let value: serde_json::Value = serde_json::from_slice(&output.stdout).unwrap();
+    assert_eq!(value["iterations"], 100);
+    assert!(value["p95_us"].as_u64().unwrap() < 5_000);
+}
diff --git a/developer-simulation/runs/2026-08-16--transparency-checkpoint-verifier/tests/common/mod.rs b/developer-simulation/runs/2026-08-16--transparency-checkpoint-verifier/tests/common/mod.rs
new file mode 100644
index 0000000..2324d2d
--- /dev/null
+++ b/developer-simulation/runs/2026-08-16--transparency-checkpoint-verifier/tests/common/mod.rs
@@ -0,0 +1,118 @@
+#![allow(dead_code)]
+
+use ring::rand::SystemRandom;
+use ring::signature::{Ed25519KeyPair, KeyPair};
+
+pub const ROOT_0: [u8; 32] =
+    hex32("e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855");
+pub const ROOT_1: [u8; 32] =
+    hex32("3e7077fd2f66d689e0cee6a7cf5b37bf2dca7c979af356d0a31cbc5c85605c7d");
+pub const ROOT_2: [u8; 32] =
+    hex32("a7d91894b61fbf46378d88e3e1b1f7aef39532c504b484bd31551d15e0a09dff");
+pub const ROOT_3: [u8; 32] =
+    hex32("9b4965f8b220ba42f7039ad0781c966cf90bb1aea15a80586d634b322ab1f4ce");
+pub const ROOT_4: [u8; 32] =
+    hex32("b15d2b1b07adada9b13b555c08062b1ae78ad1b0b7e99d97d942c936a6244439");
+
+pub const fn hex32(s: &str) -> [u8; 32] {
+    let bytes = s.as_bytes();
+    let mut out = [0_u8; 32];
+    let mut i = 0;
+    while i < 32 {
+        out[i] = (nibble(bytes[2 * i]) << 4) | nibble(bytes[2 * i + 1]);
+        i += 1;
+    }
+    out
+}
+
+const fn nibble(b: u8) -> u8 {
+    match b {
+        b'0'..=b'9' => b - b'0',
+        b'a'..=b'f' => b - b'a' + 10,
+        _ => panic!("invalid fixture hex"),
+    }
+}
+
+pub struct TestSigner {
+    pair: Ed25519KeyPair,
+}
+
+impl TestSigner {
+    pub fn new() -> Self {
+        let pkcs8 = Ed25519KeyPair::generate_pkcs8(&SystemRandom::new()).expect("test key");
+        Self {
+            pair: Ed25519KeyPair::from_pkcs8(pkcs8.as_ref()).expect("parse test key"),
+        }
+    }
+
+    pub fn public_key(&self) -> [u8; 32] {
+        self.pair
+            .public_key()
+            .as_ref()
+            .try_into()
+            .expect("Ed25519 key length")
+    }
+
+    #[allow(clippy::too_many_arguments)]
+    pub fn envelope(
+        &self,
+        log_id: &str,
+        key_id: &str,
+        base_size: u64,
+        size: u64,
+        root: [u8; 32],
+        proof: &[[u8; 32]],
+        timestamp_ms: u64,
+    ) -> Vec<u8> {
+        let mut out = signed_prefix(log_id, key_id, size, root, timestamp_ms);
+        let signature = self.pair.sign(&out);
+        out.extend_from_slice(&base_size.to_be_bytes());
+        out.extend_from_slice(&(proof.len() as u64).to_be_bytes());
+        for node in proof {
+            out.extend_from_slice(node);
+        }
+        let signature_len = u16::try_from(signature.as_ref().len()).expect("short test signature");
+        out.extend_from_slice(&signature_len.to_be_bytes());
+        out.extend_from_slice(signature.as_ref());
+        out
+    }
+}
+
+pub fn unsigned_envelope(
+    log_id: &str,
+    key_id: &str,
+    base_size: u64,
+    size: u64,
+    root: [u8; 32],
+    proof: &[[u8; 32]],
+) -> Vec<u8> {
+    let mut out = signed_prefix(log_id, key_id, size, root, 1_700_000_000_000);
+    out.extend_from_slice(&base_size.to_be_bytes());
+    out.extend_from_slice(&(proof.len() as u64).to_be_bytes());
+    for node in proof {
+        out.extend_from_slice(node);
+    }
+    out.extend_from_slice(&64_u16.to_be_bytes());
+    out.extend_from_slice(&[7_u8; 64]);
+    out
+}
+
+fn signed_prefix(
+    log_id: &str,
+    key_id: &str,
+    size: u64,
+    root: [u8; 32],
+    timestamp_ms: u64,
+) -> Vec<u8> {
+    let mut out = Vec::new();
+    out.extend_from_slice(b"CKP1");
+    out.push(1);
+    out.extend_from_slice(&size.to_be_bytes());
+    out.extend_from_slice(&root);
+    out.extend_from_slice(&timestamp_ms.to_be_bytes());
+    out.push(u8::try_from(log_id.len()).expect("short test identity"));
+    out.push(u8::try_from(key_id.len()).expect("short test key id"));
+    out.extend_from_slice(log_id.as_bytes());
+    out.extend_from_slice(key_id.as_bytes());
+    out
+}
diff --git a/developer-simulation/runs/2026-08-16--transparency-checkpoint-verifier/tests/crypto.rs b/developer-simulation/runs/2026-08-16--transparency-checkpoint-verifier/tests/crypto.rs
new file mode 100644
index 0000000..d1ce129
--- /dev/null
+++ b/developer-simulation/runs/2026-08-16--transparency-checkpoint-verifier/tests/crypto.rs
@@ -0,0 +1,153 @@
+mod common;
+
+use common::hex32;
+use ring::digest::{SHA256, digest};
+use transparency_checkpoint_verifier::{
+    ErrorCode, root_from_leaf_hashes, verify_consistency, verify_ed25519,
+};
+
+#[test]
+fn matches_independently_generated_merkle_roots_at_required_sizes() {
+    let vectors = [
+        (
+            0,
+            "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+        ),
+        (
+            1,
+            "3e7077fd2f66d689e0cee6a7cf5b37bf2dca7c979af356d0a31cbc5c85605c7d",
+        ),
+        (
+            2,
+            "a7d91894b61fbf46378d88e3e1b1f7aef39532c504b484bd31551d15e0a09dff",
+        ),
+        (
+            3,
+            "9b4965f8b220ba42f7039ad0781c966cf90bb1aea15a80586d634b322ab1f4ce",
+        ),
+        (
+            4,
+            "b15d2b1b07adada9b13b555c08062b1ae78ad1b0b7e99d97d942c936a6244439",
+        ),
+        (
+            7,
+            "45cea7edca9543ee5575a5774d0d8fa9321a8be084b3fb657fa4f6d071a3c94c",
+        ),
+        (
+            8,
+            "b15acd8b1ccf7a9b81c04f69b27e5cabd67e90be0e6ff6a4d1ed87004a4f0cc1",
+        ),
+        (
+            15,
+            "249600a1a23dbe4d31fa0694264d54846e587dd4a490bc90a4d386979d7fccd6",
+        ),
+        (
+            16,
+            "d5057b535a9b33119a6344d8cbf16c5a8f1541c106aa9ee50c6c93260664222d",
+        ),
+        (
+            65_535,
+            "e7321cd57abf36c522d89e6d26bd9098a37b6a8b06b318976269e701f6d4802d",
+        ),
+        (
+            65_536,
+            "bc9bca909516d5bf148c2bf2dea0a0d9f717ce4987d2fe7504d6694363b41598",
+        ),
+    ];
+    let mut leaves = Vec::with_capacity(65_536);
+    for i in 0_u64..65_536 {
+        let mut input = [0_u8; 9];
+        input[1..].copy_from_slice(&i.to_be_bytes());
+        leaves.push(digest(&SHA256, &input).as_ref().try_into().unwrap());
+    }
+    for (size, expected) in vectors {
+        assert_eq!(
+            root_from_leaf_hashes(&leaves[..size]),
+            hex32(expected),
+            "size {size}"
+        );
+    }
+}
+
+#[test]
+fn verifies_hand_checked_consistency_vector_and_rejects_every_bit_flip() {
+    let old_root = hex32("9b4965f8b220ba42f7039ad0781c966cf90bb1aea15a80586d634b322ab1f4ce");
+    let new_root = hex32("b15d2b1b07adada9b13b555c08062b1ae78ad1b0b7e99d97d942c936a6244439");
+    let proof = [
+        hex32("d81f51781eeb8f46a0e112e86ca335896ccc12cee00e6cfcf58a3501129dfc24"),
+        hex32("feebf1863bd1fceedfeff2693829d50ffbcac100d0fbe745482e032f93f6bafb"),
+        hex32("a7d91894b61fbf46378d88e3e1b1f7aef39532c504b484bd31551d15e0a09dff"),
+    ];
+    assert_eq!(verify_consistency(3, 4, old_root, new_root, &proof), Ok(()));
+
+    for node in 0..proof.len() {
+        for bit in 0..256 {
+            let mut corrupt = proof;
+            corrupt[node][bit / 8] ^= 1 << (bit % 8);
+            assert_eq!(
+                verify_consistency(3, 4, old_root, new_root, &corrupt),
+                Err(ErrorCode::ProofInvalid)
+            );
+        }
+    }
+    for bit in 0..256 {
+        let mut corrupt = new_root;
+        corrupt[bit / 8] ^= 1 << (bit % 8);
+        assert_eq!(
+            verify_consistency(3, 4, old_root, corrupt, &proof),
+            Err(ErrorCode::ProofInvalid)
+        );
+    }
+}
+
+#[test]
+fn rejects_impossible_sizes_and_excess_proofs() {
+    let h = [1_u8; 32];
+    assert_eq!(
+        verify_consistency(4, 3, h, h, &[]),
+        Err(ErrorCode::SizeRollback)
+    );
+    assert_eq!(
+        verify_consistency(0, 1, h, h, &[[0; 32]]),
+        Err(ErrorCode::ProofInvalid)
+    );
+    assert_eq!(verify_consistency(u64::MAX, u64::MAX, h, h, &[]), Ok(()));
+    assert_eq!(
+        verify_consistency(1, 2, h, h, &[[0; 32]; 129]),
+        Err(ErrorCode::ParseProofCount)
+    );
+}
+
+#[test]
+fn verifies_rfc8032_vector_and_rejects_each_signature_bit_flip() {
+    let public = hex32("3d4017c3e843895a92b70aa74d1b7ebc9c982ccf2ec4968cc0cd55f12af4660c");
+    let message = [0x72_u8];
+    let signature = hex64(
+        "92a009a9f0d4cab8720e820b5f642540a2b27b5416503f8fb3762223ebdb69da085ac1e43e15996e458f3613d0f11d8c387b2eaeb4302aeeb00d291612bb0c00",
+    );
+    assert_eq!(verify_ed25519(&public, &message, &signature), Ok(()));
+    for bit in 0..512 {
+        let mut corrupt = signature;
+        corrupt[bit / 8] ^= 1 << (bit % 8);
+        assert_eq!(
+            verify_ed25519(&public, &message, &corrupt),
+            Err(ErrorCode::SignatureInvalid)
+        );
+    }
+}
+
+fn hex64(s: &str) -> [u8; 64] {
+    let mut out = [0_u8; 64];
+    for (i, byte) in out.iter_mut().enumerate() {
+        *byte = (nibble(s.as_bytes()[2 * i]) << 4) | nibble(s.as_bytes()[2 * i + 1]);
+    }
+    out
+}
+
+fn nibble(b: u8) -> u8 {
+    match b {
+        b'0'..=b'9' => b - b'0',
+        b'a'..=b'f' => b - b'a' + 10,
+        _ => panic!("invalid test fixture"),
+    }
+}
diff --git a/developer-simulation/runs/2026-08-16--transparency-checkpoint-verifier/tests/engine.rs b/developer-simulation/runs/2026-08-16--transparency-checkpoint-verifier/tests/engine.rs
new file mode 100644
index 0000000..9816460
--- /dev/null
+++ b/developer-simulation/runs/2026-08-16--transparency-checkpoint-verifier/tests/engine.rs
@@ -0,0 +1,243 @@
+mod common;
+
+use common::{ROOT_0, ROOT_1, ROOT_2, ROOT_3, TestSigner, hex32};
+use transparency_checkpoint_verifier::{Engine, ErrorCode, KnownLog, Registry};
+
+fn build_engine(signer: &TestSigner, ids: &[&str]) -> Engine {
+    let logs = ids
+        .iter()
+        .map(|id| KnownLog {
+            log_id: (*id).to_string(),
+            key_id: "key-1".to_string(),
+            algorithm: 1,
+            public_key: signer.public_key(),
+        })
+        .collect();
+    Engine::new(Registry::new(logs).unwrap())
+}
+
+#[test]
+fn out_of_order_candidate_waits_then_advances_without_skipping_base() {
+    let signer = TestSigner::new();
+    let mut engine = build_engine(&signer, &["log-a"]);
+    let leaf_1 = hex32("2ae1c19c0cbd378e46c927a9f3611923ec07cc1ae357502a09536d455275cf21");
+    let leaf_2 = hex32("d81f51781eeb8f46a0e112e86ca335896ccc12cee00e6cfcf58a3501129dfc24");
+
+    let first = signer.envelope("log-a", "key-1", 0, 1, ROOT_1, &[], 1);
+    assert_eq!(engine.submit(&first, 10).code, ErrorCode::Advanced);
+
+    let third = signer.envelope("log-a", "key-1", 2, 3, ROOT_3, &[leaf_2], 3);
+    assert_eq!(engine.submit(&third, 30).code, ErrorCode::PendingBase);
+    assert_eq!(engine.current("log-a").unwrap().tree_size, 1);
+
+    let second = signer.envelope("log-a", "key-1", 1, 2, ROOT_2, &[leaf_1], 2);
+    let outcome = engine.submit(&second, 20);
+    assert_eq!(outcome.code, ErrorCode::Advanced);
+    assert_eq!(outcome.advanced_sizes, vec![2, 3]);
+    let current = engine.current("log-a").unwrap();
+    assert_eq!(current.tree_size, 3);
+    assert_eq!(current.archive_cursor, 30);
+    assert_eq!(current.raw_proof, leaf_2);
+}
+
+#[test]
+fn invalid_identity_proof_or_signature_never_changes_state() {
+    let signer = TestSigner::new();
+    let other = TestSigner::new();
+    let mut engine = build_engine(&signer, &["log-a"]);
+    let before = engine.snapshot();
+
+    let unknown = signer.envelope("log-x", "key-1", 0, 1, ROOT_1, &[], 1);
+    assert_eq!(engine.submit(&unknown, 1).code, ErrorCode::UnknownLog);
+    assert_eq!(engine.snapshot(), before);
+
+    let wrong_key = other.envelope("log-a", "key-1", 0, 1, ROOT_1, &[], 1);
+    assert_eq!(
+        engine.submit(&wrong_key, 1).code,
+        ErrorCode::SignatureInvalid
+    );
+    assert_eq!(engine.snapshot(), before);
+
+    let invalid_proof = signer.envelope("log-a", "key-1", 0, 1, ROOT_1, &[[9; 32]], 1);
+    assert_eq!(
+        engine.submit(&invalid_proof, 1).code,
+        ErrorCode::ProofInvalid
+    );
+    assert_eq!(engine.current("log-a").unwrap().tree_size, 0);
+}
+
+#[test]
+fn duplicate_is_idempotent_and_equivocation_retains_both_roots_once() {
+    let signer = TestSigner::new();
+    let mut engine = build_engine(&signer, &["log-a"]);
+    let first = signer.envelope("log-a", "key-1", 0, 1, ROOT_1, &[], 1);
+    assert_eq!(engine.submit(&first, 10).code, ErrorCode::Advanced);
+    let after_first = engine.snapshot();
+
+    assert_eq!(engine.submit(&first, 10).code, ErrorCode::Duplicate);
+    assert_eq!(engine.snapshot(), after_first);
+
+    let alternate = [0xa5_u8; 32];
+    let conflict = signer.envelope("log-a", "key-1", 0, 1, alternate, &[], 2);
+    assert_eq!(engine.submit(&conflict, 11).code, ErrorCode::Equivocation);
+    assert_eq!(engine.submit(&conflict, 11).code, ErrorCode::Duplicate);
+    let alerts = &engine.snapshot().equivocations;
+    assert_eq!(alerts.len(), 1);
+    assert_eq!(alerts[0].first_root, ROOT_1);
+    assert_eq!(alerts[0].second_root, alternate);
+}
+
+#[test]
+fn cross_log_interleavings_produce_identical_durable_bytes() {
+    let signer = TestSigner::new();
+    let ids = [
+        "log-a", "log-b", "log-c", "log-d", "log-e", "log-f", "log-g", "log-h",
+    ];
+    let envelopes: Vec<_> = ids
+        .iter()
+        .enumerate()
+        .map(|(index, id)| {
+            signer.envelope(
+                id,
+                "key-1",
+                0,
+                1,
+                ROOT_1,
+                &[],
+                u64::try_from(index).unwrap(),
+            )
+        })
+        .collect();
+    let mut baseline = build_engine(&signer, &ids);
+    for (index, raw) in envelopes.iter().enumerate() {
+        baseline.submit(raw, u64::try_from(index).unwrap());
+    }
+    let expected = baseline.stable_bytes();
+
+    for interleaving in 0..20 {
+        let mut order: Vec<usize> = (0..ids.len()).collect();
+        order.rotate_left(interleaving % ids.len());
+        if interleaving % 2 == 1 {
+            order.reverse();
+        }
+        let mut candidate = build_engine(&signer, &ids);
+        for index in order {
+            candidate.submit(&envelopes[index], u64::try_from(index).unwrap());
+        }
+        assert_eq!(
+            candidate.stable_bytes(),
+            expected,
+            "interleaving {interleaving}"
+        );
+    }
+}
+
+#[test]
+fn bit_flips_in_signed_size_root_and_identity_never_advance() {
+    let signer = TestSigner::new();
+    let raw = signer.envelope("log-a", "key-1", 0, 1, ROOT_1, &[], 1);
+    let signed_prefix_len = raw.len() - 8 - 8 - 2 - 64;
+    for bit in 0..(signed_prefix_len * 8) {
+        let mut corrupt = raw.clone();
+        corrupt[bit / 8] ^= 1 << (bit % 8);
+        let mut engine = build_engine(&signer, &["log-a"]);
+        assert_ne!(engine.submit(&corrupt, 1).code, ErrorCode::Advanced);
+        assert_eq!(engine.current("log-a").unwrap().tree_size, 0);
+    }
+}
+
+#[test]
+fn pending_limit_and_size_rollback_fail_closed() {
+    let signer = TestSigner::new();
+    let mut engine = build_engine(&signer, &["log-a"]);
+    for i in 0_u8..16 {
+        let i = u64::from(i);
+        let raw = signer.envelope(
+            "log-a",
+            "key-1",
+            100 + i,
+            200 + i,
+            [u8::try_from(i).expect("test range"); 32],
+            &[],
+            i,
+        );
+        assert_eq!(engine.submit(&raw, i).code, ErrorCode::PendingBase);
+    }
+    let seventeenth = signer.envelope("log-a", "key-1", 999, 1_000, [99; 32], &[], 999);
+    assert_eq!(
+        engine.submit(&seventeenth, 999).code,
+        ErrorCode::PendingLimit
+    );
+
+    let first = signer.envelope("log-a", "key-1", 0, 1, ROOT_1, &[], 1);
+    let mut fresh = build_engine(&signer, &["log-a"]);
+    fresh.submit(&first, 1);
+    let rollback = signer.envelope("log-a", "key-1", 0, 0, ROOT_0, &[], 2);
+    assert_eq!(fresh.submit(&rollback, 2).code, ErrorCode::SizeRollback);
+}
+
+#[test]
+fn archive_cursor_rollback_is_rejected_without_mutation() {
+    let signer = TestSigner::new();
+    let mut engine = build_engine(&signer, &["log-a"]);
+    let leaf_1 = hex32("2ae1c19c0cbd378e46c927a9f3611923ec07cc1ae357502a09536d455275cf21");
+    let first = signer.envelope("log-a", "key-1", 0, 1, ROOT_1, &[], 1);
+    assert_eq!(engine.submit(&first, 100).code, ErrorCode::Advanced);
+
+    let second = signer.envelope("log-a", "key-1", 1, 2, ROOT_2, &[leaf_1], 2);
+    let before = engine.snapshot();
+    let rejected = engine.submit(&second, 99);
+    assert_eq!(rejected.code, ErrorCode::ArchiveCursorRollback);
+    assert_eq!(engine.snapshot(), before);
+
+    assert_eq!(engine.submit(&second, 101).code, ErrorCode::Advanced);
+    assert_eq!(engine.current("log-a").unwrap().tree_size, 2);
+    assert_eq!(engine.current("log-a").unwrap().archive_cursor, 101);
+}
+
+#[test]
+fn same_base_candidates_are_all_decided_after_advance() {
+    let signer = TestSigner::new();
+    let mut engine = build_engine(&signer, &["log-a"]);
+    let leaf_1 = hex32("2ae1c19c0cbd378e46c927a9f3611923ec07cc1ae357502a09536d455275cf21");
+    let leaf_2 = hex32("d81f51781eeb8f46a0e112e86ca335896ccc12cee00e6cfcf58a3501129dfc24");
+    let first = signer.envelope("log-a", "key-1", 0, 1, ROOT_1, &[], 1);
+    assert_eq!(engine.submit(&first, 10).code, ErrorCode::Advanced);
+
+    let third_a = signer.envelope("log-a", "key-1", 2, 3, ROOT_3, &[leaf_2], 30);
+    let third_b = signer.envelope("log-a", "key-1", 2, 3, ROOT_3, &[leaf_2], 31);
+    assert_eq!(engine.submit(&third_a, 30).code, ErrorCode::PendingBase);
+    assert_eq!(engine.submit(&third_b, 30).code, ErrorCode::PendingBase);
+
+    let second = signer.envelope("log-a", "key-1", 1, 2, ROOT_2, &[leaf_1], 20);
+    assert_eq!(engine.submit(&second, 20).code, ErrorCode::Advanced);
+    let snapshot = engine.snapshot();
+    assert_eq!(snapshot.logs["log-a"].tree_size, 3);
+    assert!(snapshot.pending.get("log-a").is_none_or(Vec::is_empty));
+    assert_eq!(snapshot.seen_envelopes.len(), 4);
+}
+
+#[test]
+fn equal_key_pending_delivery_orders_have_identical_bytes() {
+    let signer = TestSigner::new();
+    let leaf_1 = hex32("2ae1c19c0cbd378e46c927a9f3611923ec07cc1ae357502a09536d455275cf21");
+    let leaf_2 = hex32("d81f51781eeb8f46a0e112e86ca335896ccc12cee00e6cfcf58a3501129dfc24");
+    let first = signer.envelope("log-a", "key-1", 0, 1, ROOT_1, &[], 1);
+    let second = signer.envelope("log-a", "key-1", 1, 2, ROOT_2, &[leaf_1], 2);
+    let third_a = signer.envelope("log-a", "key-1", 2, 3, ROOT_3, &[leaf_2], 30);
+    let third_b = signer.envelope("log-a", "key-1", 2, 3, ROOT_3, &[leaf_2], 31);
+
+    let mut left = build_engine(&signer, &["log-a"]);
+    left.submit(&first, 10);
+    left.submit(&third_a, 30);
+    left.submit(&third_b, 30);
+    left.submit(&second, 20);
+
+    let mut right = build_engine(&signer, &["log-a"]);
+    right.submit(&first, 10);
+    right.submit(&third_b, 30);
+    right.submit(&third_a, 30);
+    right.submit(&second, 20);
+
+    assert_eq!(left.stable_bytes(), right.stable_bytes());
+}
diff --git a/developer-simulation/runs/2026-08-16--transparency-checkpoint-verifier/tests/parser.rs b/developer-simulation/runs/2026-08-16--transparency-checkpoint-verifier/tests/parser.rs
new file mode 100644
index 0000000..60968d9
--- /dev/null
+++ b/developer-simulation/runs/2026-08-16--transparency-checkpoint-verifier/tests/parser.rs
@@ -0,0 +1,98 @@
+mod common;
+
+use std::panic::{AssertUnwindSafe, catch_unwind};
+use std::time::Duration;
+
+use common::{ROOT_3, hex32, unsigned_envelope};
+use transparency_checkpoint_verifier::{ErrorCode, parse_envelope};
+
+#[test]
+fn parses_fields_and_preserves_exact_proof_and_envelope_bytes() {
+    let proof = [
+        hex32("d81f51781eeb8f46a0e112e86ca335896ccc12cee00e6cfcf58a3501129dfc24"),
+        hex32("feebf1863bd1fceedfeff2693829d50ffbcac100d0fbe745482e032f93f6bafb"),
+        hex32("a7d91894b61fbf46378d88e3e1b1f7aef39532c504b484bd31551d15e0a09dff"),
+    ];
+    let raw = unsigned_envelope("log-a", "key-1", 3, 4, ROOT_3, &proof);
+
+    let parsed = parse_envelope(&raw).expect("valid characterization envelope");
+
+    assert_eq!(parsed.log_id, "log-a");
+    assert_eq!(parsed.key_id, "key-1");
+    assert_eq!(parsed.base_size, 3);
+    assert_eq!(parsed.tree_size, 4);
+    assert_eq!(parsed.proof, proof);
+    assert_eq!(parsed.raw_proof, proof.concat());
+    assert_eq!(parsed.raw_envelope, raw);
+}
+
+#[test]
+fn rejects_oversized_or_excessive_proof_declarations_before_allocation() {
+    let mut too_many = unsigned_envelope("log-a", "key-1", 0, 1, ROOT_3, &[]);
+    let count_offset = too_many.len() - 64 - 2 - 8;
+    too_many[count_offset..count_offset + 8].copy_from_slice(&129_u64.to_be_bytes());
+    assert_eq!(
+        parse_envelope(&too_many).unwrap_err(),
+        ErrorCode::ParseProofCount
+    );
+
+    too_many[count_offset..count_offset + 8].copy_from_slice(&u64::MAX.to_be_bytes());
+    assert_eq!(
+        parse_envelope(&too_many).unwrap_err(),
+        ErrorCode::ParseProofCount
+    );
+
+    let oversized = vec![0_u8; 4_097];
+    assert_eq!(
+        parse_envelope(&oversized).unwrap_err(),
+        ErrorCode::ParseEnvelopeSize
+    );
+}
+
+#[test]
+fn truncation_at_every_byte_is_bounded_and_never_panics() {
+    let raw = unsigned_envelope("log-a", "key-1", 3, 4, ROOT_3, &[[9_u8; 32]]);
+    for end in 0..raw.len() {
+        let result = catch_unwind(AssertUnwindSafe(|| parse_envelope(&raw[..end])));
+        assert!(result.is_ok(), "panic at truncation {end}");
+        assert!(
+            result.expect("no panic").is_err(),
+            "accepted truncation {end}"
+        );
+    }
+}
+
+#[test]
+fn malformed_4k_inputs_finish_without_panicking() {
+    for seed in 0_u8..=31 {
+        let mut raw = vec![seed; 4_096];
+        raw[0..4].copy_from_slice(b"CKP1");
+        let result = catch_unwind(AssertUnwindSafe(|| parse_envelope(&raw)));
+        assert!(result.is_ok());
+    }
+}
+
+#[test]
+fn rejects_ten_thousand_deterministic_adversarial_characterization_cases() {
+    let valid = unsigned_envelope("log-a", "key-1", 0, 1, ROOT_3, &[]);
+    let count_offset = valid.len() - 64 - 2 - 8;
+    for case in 0..10_000 {
+        let mut raw = valid.clone();
+        match case % 5 {
+            0 => raw.truncate(case % raw.len()),
+            1 => raw[count_offset..count_offset + 8].copy_from_slice(&129_u64.to_be_bytes()),
+            2 => raw[case % 4] ^= 1 << (case % 8),
+            3 => raw.resize(4_097, u8::try_from(case % 251).unwrap()),
+            _ => raw[53] = 0,
+        }
+        let started = std::time::Instant::now();
+        assert!(
+            parse_envelope(&raw).is_err(),
+            "accepted synthetic case {case}"
+        );
+        assert!(
+            started.elapsed() < Duration::from_millis(50),
+            "case {case} exceeded 50ms"
+        );
+    }
+}
diff --git a/developer-simulation/runs/2026-08-16--transparency-checkpoint-verifier/tests/store.rs b/developer-simulation/runs/2026-08-16--transparency-checkpoint-verifier/tests/store.rs
new file mode 100644
index 0000000..a0137f8
--- /dev/null
+++ b/developer-simulation/runs/2026-08-16--transparency-checkpoint-verifier/tests/store.rs
@@ -0,0 +1,148 @@
+mod common;
+
+use std::fs;
+
+use common::{ROOT_1, ROOT_2, ROOT_3, TestSigner, hex32};
+use tempfile::tempdir;
+use transparency_checkpoint_verifier::{
+    DirectoryStore, Engine, ErrorCode, KnownLog, PublicationStage, Registry,
+};
+
+fn snapshot_with_one_checkpoint() -> transparency_checkpoint_verifier::EngineSnapshot {
+    let signer = TestSigner::new();
+    let registry = Registry::new(vec![KnownLog {
+        log_id: "log-a".to_string(),
+        key_id: "key-1".to_string(),
+        algorithm: 1,
+        public_key: signer.public_key(),
+    }])
+    .unwrap();
+    let mut engine = Engine::new(registry);
+    let raw = signer.envelope("log-a", "key-1", 0, 1, ROOT_1, &[], 1);
+    assert_eq!(engine.submit(&raw, 42).code, ErrorCode::Advanced);
+    engine.snapshot()
+}
+
+#[test]
+fn every_completed_stage_returned_error_exposes_old_or_new_complete_snapshot() {
+    let old = EngineSnapshotBuilder::empty();
+    let new = snapshot_with_one_checkpoint();
+    for stage in PublicationStage::ALL {
+        let dir = tempdir().unwrap();
+        let store = DirectoryStore::new(dir.path());
+        store.publish(&old, None).unwrap();
+        let result = store.publish(&new, Some(stage));
+        assert!(result.is_err(), "stage {stage:?}");
+        let visible = store.reopen().unwrap();
+        assert!(visible == old || visible == new, "torn state at {stage:?}");
+    }
+}
+
+#[test]
+fn generic_returned_error_retry_converges_to_clean_publication_bytes() {
+    let snapshot = snapshot_with_one_checkpoint();
+    let clean_dir = tempdir().unwrap();
+    let clean = DirectoryStore::new(clean_dir.path());
+    clean.publish(&snapshot, None).unwrap();
+    let expected = clean.visible_bytes().unwrap();
+
+    for stage in PublicationStage::ALL {
+        let dir = tempdir().unwrap();
+        let store = DirectoryStore::new(dir.path());
+        let _ = store.publish(&snapshot, Some(stage));
+        store.publish(&snapshot, None).unwrap();
+        assert_eq!(store.visible_bytes().unwrap(), expected, "stage {stage:?}");
+    }
+}
+
+#[test]
+fn separately_corrupt_state_proof_manifest_and_decision_files_fail_closed() {
+    let snapshot = snapshot_with_one_checkpoint();
+    for name in [
+        "state.json",
+        "proofs.json",
+        "manifest.json",
+        "decisions.jsonl",
+    ] {
+        let dir = tempdir().unwrap();
+        let store = DirectoryStore::new(dir.path());
+        store.publish(&snapshot, None).unwrap();
+        let generation = fs::read_to_string(dir.path().join("CURRENT")).unwrap();
+        fs::write(dir.path().join(generation.trim()).join(name), b"corrupt").unwrap();
+        assert!(store.reopen().is_err(), "accepted corrupt {name}");
+    }
+}
+
+#[test]
+fn republish_rejects_corrupt_existing_generation_and_preserves_current() {
+    let old = EngineSnapshotBuilder::empty();
+    let new = snapshot_with_one_checkpoint();
+    let dir = tempdir().unwrap();
+    let store = DirectoryStore::new(dir.path());
+
+    store.publish(&old, None).unwrap();
+    let old_generation = fs::read_to_string(dir.path().join("CURRENT")).unwrap();
+    store.publish(&new, None).unwrap();
+    let new_generation = fs::read_to_string(dir.path().join("CURRENT")).unwrap();
+    assert_ne!(old_generation, new_generation);
+    store.publish(&old, None).unwrap();
+    fs::write(
+        dir.path().join(new_generation.trim()).join("state.json"),
+        b"corrupt",
+    )
+    .unwrap();
+
+    let before_pointer = fs::read(dir.path().join("CURRENT")).unwrap();
+    assert_eq!(store.publish(&new, None), Err(ErrorCode::StoreCorrupt));
+    assert_eq!(
+        fs::read(dir.path().join("CURRENT")).unwrap(),
+        before_pointer
+    );
+    assert_eq!(store.reopen().unwrap(), old);
+}
+
+#[test]
+fn reopened_engine_continues_and_drains_pending_without_divergence() {
+    let signer = TestSigner::new();
+    let registry = Registry::new(vec![KnownLog {
+        log_id: "log-a".to_string(),
+        key_id: "key-1".to_string(),
+        algorithm: 1,
+        public_key: signer.public_key(),
+    }])
+    .unwrap();
+    let leaf_1 = hex32("2ae1c19c0cbd378e46c927a9f3611923ec07cc1ae357502a09536d455275cf21");
+    let leaf_2 = hex32("d81f51781eeb8f46a0e112e86ca335896ccc12cee00e6cfcf58a3501129dfc24");
+    let first = signer.envelope("log-a", "key-1", 0, 1, ROOT_1, &[], 1);
+    let second = signer.envelope("log-a", "key-1", 1, 2, ROOT_2, &[leaf_1], 2);
+    let third = signer.envelope("log-a", "key-1", 2, 3, ROOT_3, &[leaf_2], 3);
+    let mut engine = Engine::new(registry.clone());
+    assert_eq!(engine.submit(&first, 10).code, ErrorCode::Advanced);
+    assert_eq!(engine.submit(&third, 30).code, ErrorCode::PendingBase);
+    let before_publish = engine.snapshot();
+
+    let dir = tempdir().unwrap();
+    let store = DirectoryStore::new(dir.path());
+    store.publish(&before_publish, None).unwrap();
+    let reopened = store.reopen().unwrap();
+    let mut resumed = Engine::from_snapshot(registry.clone(), reopened).unwrap();
+    let mut control = Engine::from_snapshot(registry.clone(), before_publish).unwrap();
+
+    assert_eq!(resumed.submit(&second, 20).code, ErrorCode::Advanced);
+    assert_eq!(control.submit(&second, 20).code, ErrorCode::Advanced);
+    assert_eq!(resumed.current("log-a").unwrap().tree_size, 3);
+    assert!(resumed.snapshot().pending["log-a"].is_empty());
+    assert_eq!(resumed.stable_bytes(), control.stable_bytes());
+
+    let mut invalid = resumed.snapshot();
+    invalid.logs.clear();
+    assert!(Engine::from_snapshot(registry, invalid).is_err());
+}
+
+struct EngineSnapshotBuilder;
+
+impl EngineSnapshotBuilder {
+    fn empty() -> transparency_checkpoint_verifier::EngineSnapshot {
+        Engine::new(Registry::new(Vec::new()).unwrap()).snapshot()
+    }
+}
diff --git a/developer-simulation/runs/2026-08-17--corruption-resynchronizing-instrument-stream-decoder/BRIEF.md b/developer-simulation/runs/2026-08-17--corruption-resynchronizing-instrument-stream-decoder/BRIEF.md
new file mode 100644
index 0000000..13395f9
--- /dev/null
+++ b/developer-simulation/runs/2026-08-17--corruption-resynchronizing-instrument-stream-decoder/BRIEF.md
@@ -0,0 +1,89 @@
+# Corruption-resynchronizing instrument stream decoder
+
+## Developer role and Rust experience
+
+You maintain the device-ingestion side of a laboratory automation gateway. You have nine years of production C and C++, have completed the Rust Book, and have written two small internal Rust command-line tools but no production protocol parser in Rust. You have no prior knowledge of the candidate library being evaluated; begin from this problem statement rather than assuming that any library component should be used.
+
+## Existing system and baseline implementation
+
+The gateway maintains long-lived TCP connections to laboratory instruments. Each connection carries a proprietary framed binary stream. The current C++ parser appends bytes to a per-connection vector, searches for an end marker, and then validates the declared length and CRC. It is easy to operate and fast on clean traffic, but an absent end marker can grow the vector, and a corrupt length or marker often forces the gateway to discard the entire connection buffer and reconnect.
+
+For this trial, model each wire frame as:
+
+`STX (0x02) | payload_length (u16 big-endian) | sequence (u32 big-endian) | payload | CRC32(sequence || payload) | ETX (0x03)`
+
+The wire length is therefore `payload_length + 12` bytes. Use CRC-32/ISO-HDLC over `sequence || payload`: reflected polynomial `0xEDB88320`, initial value `0xFFFFFFFF`, final XOR `0xFFFFFFFF`, with `"123456789"` checking to `0xCBF43926`. A frame is valid only when both its exact declared wire length and markers agree and its CRC passes.
+
+The runnable baseline is a small Rust translation of the existing append-and-search approach. It is not expected to reproduce unrelated gateway behavior.
+
+## Concrete pain
+
+One noisy device can cause memory growth, repeated reconnects, and loss of valid frames that follow a damaged frame. Operators cannot tell whether a sequence gap came from the instrument, transport damage, or parser recovery. The replacement needs a bounded incremental decoder that consumes arbitrary read chunks, emits only proved-valid frames, records privacy-safe diagnostics, and resumes at the earliest defensible next frame boundary.
+
+## Realistic workload and data shape
+
+Use a deterministic generator for 64 interleaved connection streams:
+
+- 1,000,000 valid frames total.
+- 950,000 frames are exactly 192 wire bytes, with 180-byte payloads.
+- 50,000 frames are exactly 4,096 wire bytes, with 4,084-byte payloads.
+- Valid wire data is therefore exactly 387,200,000 bytes before damage is added.
+- The harness supplies chunks from 1 through 4,096 bytes, including an all-one-byte schedule, a seeded irregular schedule, and boundaries immediately before and after every header field, CRC, and marker.
+- Inject exactly 25,000 damaged candidates: 10,000 CRC bit flips, 5,000 declared lengths above the accepted limit, 5,000 missing or changed end markers, and 5,000 garbage bursts containing misleading marker bytes. Every injected case is followed by at least two known-valid frames.
+
+Payloads are opaque bytes and may contain either marker value. Sequence numbers are connection-local unsigned values and may wrap; the parser reports them but does not decide whether a gap is operationally acceptable.
+
+## Operational constraints
+
+- Accept wire frames no larger than 8,192 bytes; reject larger declared lengths before allocating their claimed size.
+- Keep total peak resident memory at or below 64 MiB for the 64-stream harness.
+- In-progress accepted-frame storage is bounded by `64 × 8,192 = 524,288` bytes, plus fixed parser, output-channel, and runtime overhead.
+- Make no blocking network, disk, logging, or clock calls in the byte-consumption path.
+- Never panic, abort, read out of bounds, or loop without consuming input on any byte sequence.
+- Preserve per-connection order. State from one connection must not affect another.
+- Diagnostics may contain connection ID, byte offset, declared length, sequence when safely decoded, and error class, but not payload bytes.
+- The same bytes and chunk schedule must produce byte-identical frame metadata and diagnostics on repeat runs.
+
+## Measurable acceptance criteria
+
+1. On the clean corpus, the candidate emits exactly the same 1,000,000 `(connection, sequence, payload digest)` tuples as an independent whole-frame oracle, under every chunk schedule.
+2. On the damaged corpus, it emits no damaged candidate as valid and emits every known-valid frame that begins after the declared recovery boundary. For each of the 25,000 injected cases, it emits the immediately following known-valid frame as soon as that frame's end marker has arrived; it may not skip that frame while searching for a later boundary.
+3. The all-one-byte schedule, maximum-size frames, empty payload, payload-embedded markers, adjacent frames, and sequence wrap all pass without special harness exceptions.
+4. Peak resident memory is at most 64 MiB. Retained per-stream input after each call never exceeds 8,192 bytes.
+5. Clean-input throughput is at least 80% of the Rust baseline on the same machine and build profile, and at least 50 MiB/s. Report the slower of three runs after one warm-up.
+6. Fifty deterministic chunk schedules produce the same output digest as the single-chunk oracle.
+7. A property or fuzz-style test processes at least 100,000 generated arbitrary byte strings, each capped at 32 KiB, with no panic, hang, or retained-buffer violation.
+
+## Explicit non-goals
+
+- No TCP server, reconnect policy, TLS, authentication, device discovery, or production deployment.
+- No payload schema decoding or business interpretation.
+- No correction, reordering, or synthesis of sequence numbers.
+- No disk persistence or replay log.
+- No zero-copy requirement if bounded copying satisfies the measured gates.
+- No attempt to recover bytes from inside a frame whose length and CRC have not both been validated; conservative loss is preferable to fabricating a frame.
+
+## Smallest self-contained prototype boundary
+
+Build one Rust workspace containing: the deterministic stream generator, a whole-frame oracle used only for expected results, the append-and-search baseline, the incremental candidate decoder, a 64-stream interleaving harness, diagnostics with stable error classes, and tests or a CLI that runs the clean, damaged, chunk-boundary, memory, and throughput checks. The candidate decoder API need only accept `(connection_id, byte_chunk)` and return zero or more validated frame records and diagnostics. Do not integrate it with the actual gateway.
+
+## Baseline comparison
+
+Run the baseline and candidate on identical generated bytes and chunk schedules. Report clean-output equality, valid frames retained after each corruption class, reconnect-or-buffer-reset count, peak resident memory, throughput, and maximum retained bytes per connection. The candidate is acceptable only if it preserves clean correctness, meets the recovery and memory gates, and does not fall below the stated throughput floor. Do not claim improvement from asymptotic reasoning alone; include measurements.
+
+## Fault and adversarial cases
+
+- A header split at every possible byte boundary.
+- `STX` and `ETX` values repeated throughout the payload.
+- Declared payload lengths of 0, 1, 8,180, 8,181, and 65,535.
+- Correct markers with wrong CRC; correct CRC bytes attached to a changed payload.
+- Missing end marker followed immediately by a valid frame.
+- Garbage containing plausible headers, nested start markers, and long marker-free runs.
+- A connection ending after each individual header, payload, CRC, or marker byte.
+- One malicious stream receiving only one byte at a time while the other 63 carry clean maximum-size frames.
+- Duplicate, decreasing, and wrapping sequence values; these must be surfaced without changing framing decisions.
+- Arbitrary-byte property cases and a regression seed for every discovered panic, hang, false frame, or recovery miss.
+
+## Evidence expected
+
+Provide the exact build and run commands, toolchain and machine description, generator seed, CRC definition and vectors, the output digest for each chunk schedule, a table by corruption class, property-test count and elapsed time, peak-memory method and result, three timed baseline and candidate runs, and the maximum observed retained bytes per stream. Include at least one minimized adversarial example showing how the old baseline loses or over-retains data and how the candidate behaves. State any unmet criterion plainly; a clean no-fit conclusion is valid evidence.
diff --git a/developer-simulation/runs/2026-08-17--corruption-resynchronizing-instrument-stream-decoder/Cargo.toml b/developer-simulation/runs/2026-08-17--corruption-resynchronizing-instrument-stream-decoder/Cargo.toml
new file mode 100644
index 0000000..11f21c3
--- /dev/null
+++ b/developer-simulation/runs/2026-08-17--corruption-resynchronizing-instrument-stream-decoder/Cargo.toml
@@ -0,0 +1,12 @@
+[package]
+name = "instrument-decoder-trial"
+version = "0.1.0"
+edition = "2024"
+publish = false
+
+[lints.rust]
+warnings = "deny"
+
+[lints.clippy]
+all = "deny"
+pedantic = "deny"
diff --git a/developer-simulation/runs/2026-08-17--corruption-resynchronizing-instrument-stream-decoder/DISCOVERY.md b/developer-simulation/runs/2026-08-17--corruption-resynchronizing-instrument-stream-decoder/DISCOVERY.md
new file mode 100644
index 0000000..a55e881
--- /dev/null
+++ b/developer-simulation/runs/2026-08-17--corruption-resynchronizing-instrument-stream-decoder/DISCOVERY.md
@@ -0,0 +1,57 @@
+# Discovery log
+
+## Baseline-first hypothesis (recorded before component implementation inspection)
+
+The public README and examples describe Fold as a durable incremental-view engine, ESE as static text embeddings, and ANNy as an approximate-nearest-neighbor index. The requested instrument decoder instead has a synchronous byte-in/records-out hot path with strict byte-retention, memory, latency, determinism, and privacy constraints.
+
+The existing operational baseline is attractive because it is simple: append bytes, search for a terminator, then validate framing and CRC. Its predicted failure modes follow directly from that order of operations:
+
+1. Waiting for a missing terminator can retain an unbounded prefix.
+2. A false terminator inside opaque payload can make the parser test the wrong candidate.
+3. Clearing the entire buffer after a corrupt candidate can discard the immediately following valid frame.
+4. The absence of structured recovery diagnostics makes a parser-induced sequence gap indistinguishable from upstream loss.
+
+The baseline should therefore remain a small, independent append-and-search implementation in the prototype, not be recast through BogKit. The candidate hypothesis is a bounded incremental decoder that searches for STX, rejects impossible declared lengths as soon as the three-byte prefix is present, waits for exactly `payload_length + 12` bytes, verifies ETX and CRC, and on rejection advances to the earliest later STX already present (or consumes enough bytes to make progress). It should retain at most 8,192 bytes per connection and emit only metadata plus a payload digest.
+
+Initial component fit hypothesis, to be checked against the smallest public surfaces:
+
+- **Fold:** possible fit only outside the consumption path for durable or aggregate diagnostics. It is not expected to help with framing, CRC, bounded resynchronization, or the in-memory per-connection state machine. Persistence in the decoder path would conflict with the no-disk-call constraint.
+- **ESE:** no expected fit. Payloads are opaque bytes and no semantic text operation is requested.
+- **ANNy:** no expected fit. Recovery is an exact byte-boundary problem, not approximate similarity search.
+
+The smallest meaningful prototype should consequently use no BogKit component unless its public API reveals a direct bounded-stream primitive. That outcome would be a grounded no-fit result rather than a failure to use the library.
+
+## Public-surface observations
+
+1. The root README points a newcomer to `scripts/new-project.sh` but does not provide a decoder, byte-stream, bounded-buffer, or CRC example.
+2. The starter and time-series examples show Fold owning persistent state and synchronously updating derived views in transactions.
+3. The chat example explicitly places Fold behind a channel on a dedicated ingest thread, which reinforces that it need not sit in a network byte-consumption path.
+4. The search example uses Fold, ESE, and ANNy for document indexing and semantic retrieval, a different problem shape from exact binary framing.
+
+## Next validation
+
+Inspect only the public crate surfaces needed to determine whether Fold has a non-persistent bounded stream primitive and whether ESE or ANNy expose anything relevant to exact byte framing. Then create an isolated child Rust workspace under `simulation-output/` and begin with failing behavior tests.
+
+## Component-surface check
+
+The narrow inspection confirmed the initial hypothesis:
+
+1. `fold::stream::Stream` always opens a path-backed fjall database. Writes are transactional and commit to that store; the public stream surface is not a bounded in-memory byte decoder. Its useful conceptual lesson is the examples' separation of ingest ownership from readers, not a reusable framing primitive.
+2. ESE's public operations accept text and produce fixed-size semantic embedding vectors. Instrument payload bytes may not be text and no semantic comparison belongs in framing.
+3. ANNy's public surface is a mutable HNSW over fixed-dimensional vectors. Exact STX/length/CRC/ETX validation has no nearest-neighbor step.
+
+Decision: use none of Fold, ESE, or ANNy in the hot-path prototype. Adding Fold only to count diagnostic classes would introduce disk I/O and a database lifecycle without testing the decoder's core risk. Such aggregation could be a downstream consumer in a production architecture, but it is outside this self-contained trial and its no-disk consumption-path rule.
+
+## First review-driven correction (later rejected)
+
+The initial candidate refinement—advance to a later STX only after the current declared candidate completes—was too conservative. The counterexample `02 00 13` followed by valid 14-byte frames for sequences 101 and 102 proved that a plausible in-range false header can suppress already complete, independently valid frames.
+
+The round-one repair chose the earliest later STX whose own length, ETX, and CRC were fully proved while the earlier candidate remained incomplete. If the earlier candidate instead reached its declared end and failed, it preserved the earliest nested STX strictly inside those declared bytes. This passed the plausible-false-header follower case, but a second review found that it violated the protocol's opaque-payload contract.
+
+## Second review-driven correction and incompatibility result
+
+A clean frame for sequence 42 can contain a complete, CRC-valid encoded frame for sequence 777 at the start of its opaque payload. Whole-chunk delivery sees and emits the valid outer frame. The round-one one-byte policy emitted nested sequence 777 as soon as its ETX arrived and permanently lost the valid outer frame.
+
+At the moment a nested-looking frame completes, bytes not yet received determine whether the containing accepted-length candidate will prove valid or fail. No parser can both treat arbitrary payload bytes as opaque and always emit a nested candidate immediately before that containing candidate ends. CRC proof for the nested bytes does not prove they are a transport boundary.
+
+The responsible policy therefore never emits from inside an incomplete accepted-length candidate. It waits for the containing candidate to validate or fail; only after failure may it recover at the earliest nested STX. This restores chunk-independent clean framing, but the exact `02 00 13` plus 14-byte sequence-101 follower can no longer emit on that follower's ETX. The standalone prototype and the full brief are consequently `no_fit`. Fold, ESE, and ANNy still provide no primitive that can resolve missing information in the wire format.
diff --git a/developer-simulation/runs/2026-08-17--corruption-resynchronizing-instrument-stream-decoder/EVIDENCE.md b/developer-simulation/runs/2026-08-17--corruption-resynchronizing-instrument-stream-decoder/EVIDENCE.md
new file mode 100644
index 0000000..397414d
--- /dev/null
+++ b/developer-simulation/runs/2026-08-17--corruption-resynchronizing-instrument-stream-decoder/EVIDENCE.md
@@ -0,0 +1,183 @@
+# Evidence ledger — safe-policy incompatibility handoff
+
+## Scope and environment
+
+- Trial checkout: `/private/tmp/bogkit-sim-2026-08-17-trial1.KyfY2d` at detached BogKit revision `20f2ca5`.
+- Every retained write is under `simulation-output/`.
+- Prototype: independent Rust child workspace in `simulation-output/prototype`, standard library only.
+- Build target used during repair: `/private/tmp/bogkit-sim-2026-08-17-trial1-round2-target` (removed before handoff).
+- Toolchain: `rustc 1.95.0 (59807616e 2026-04-14)`, `cargo 1.95.0 (f2d3ce0bd 2026-03-21)`.
+- Host: Mac mini `Mac16,11`, Apple M4 Pro, 14 cores, 64 GB RAM, arm64 Darwin 25.5.0.
+- Deterministic seed: `0xA17E2026`.
+- No network or external crate was used.
+
+## Protocol and independent oracle
+
+Wire format: `02 | payload_length:u16 BE | sequence:u32 BE | payload | CRC32(sequence || payload) | 03`; exact wire length is `payload_length + 12`.
+
+CRC-32/ISO-HDLC uses reflected polynomial `0xEDB88320`, initial `0xFFFFFFFF`, final XOR `0xFFFFFFFF`.
+
+- `"123456789" -> 0xCBF43926` passes.
+- Sequence `0x01020304` with empty payload has CRC `0xB63CFBCD`; exact frame `02 00 00 01 02 03 04 B6 3C FB CD 03` passes.
+- The whole-frame oracle has a separately written branch-form CRC loop and rejects trailing bytes, marker damage, and CRC damage.
+
+## Review verification and strict RED/GREEN record
+
+The second repair began by reading the complete available skeptical review and the receiving-review, test-driven-development, good-test, and verification instructions. Commands used the external target shown above.
+
+### Clean outer frame with valid-looking nested payload
+
+Permanent test: `candidate_never_emits_valid_nested_payload_before_outer_is_proved`.
+
+Fixture: a clean outer frame for sequence 42 whose opaque payload is `encode_frame(777, "aa")` followed by 32 bytes. The outer payload is 46 bytes and its wire length is 58 bytes.
+
+RED command:
+
+```sh
+CARGO_TARGET_DIR=/private/tmp/bogkit-sim-2026-08-17-trial1-round2-target cargo test candidate_never_emits_valid_nested_payload_before_outer_is_proved -- --nocapture
+```
+
+Observed failure: whole-chunk delivery emitted the valid outer sequence 42 at end offset 57. One-byte delivery emitted only nested sequence 777 at end offset 20; its frame record differed from the expected outer record.
+
+Minimal GREEN change: remove opportunistic nested-frame emission while an accepted-length containing candidate is incomplete. The decoder now waits until the containing candidate either proves valid or reaches its declared end and fails.
+
+GREEN: whole-chunk and one-byte delivery both emit only sequence 42 with byte-identical frame records and no diagnostics.
+
+### Plausible false header and two short followers
+
+Permanent test: `candidate_defers_nested_followers_until_plausible_header_fails`.
+
+Fixture:
+
+```text
+02 00 13 | encode_frame(101, "aa") | encode_frame(102, "bb")
+```
+
+Each follower is 14 bytes; the 31-byte false containing candidate does not reach its declared end until byte index 30. After the safe-policy implementation, the old immediate expectation correctly failed:
+
+```text
+left: [30]
+right: [16, 30]
+```
+
+The retained safe-policy assertion requires no emission at sequence 101's ETX, byte index 16. After the false candidate fails, both sequences 101 and 102 are emitted on the call receiving byte index 30. Aggregate frames and the single privacy-safe `Noise` diagnostic at offset 0 are identical under single-chunk and one-byte delivery.
+
+This is not an implementation gap hidden by the test: the clean outer case proves that emitting at byte 16 can corrupt a valid containing frame. Opaque-payload correctness and unconditional immediate nested recovery are incompatible without additional wire information.
+
+### Other retained recovery coverage
+
+- `candidate_preserves_nested_start_after_plausible_header_fails` uses `02 00 13` followed by two ordinary 192-byte valid frames and verifies chunk-identical recovery after the false candidate actually fails.
+- Every garbage-class event in the damaged workload uses the under-limit plausible header `02 00 13`; the required four damage totals remain unchanged.
+- Frame and diagnostic trace digests are separate and compared across whole-frame, one-byte, and seeded irregular schedules.
+
+## Final static and automated gates
+
+```sh
+cargo fmt --all --check
+CARGO_TARGET_DIR=/private/tmp/bogkit-sim-2026-08-17-trial1-round2-target cargo test --all-targets
+CARGO_TARGET_DIR=/private/tmp/bogkit-sim-2026-08-17-trial1-round2-target cargo clippy --all-targets --all-features -- -D warnings -D clippy::all -D clippy::pedantic
+CARGO_TARGET_DIR=/private/tmp/bogkit-sim-2026-08-17-trial1-round2-target cargo build --release
+```
+
+Results:
+
+- Formatting: exit 0, no diff.
+- Tests: 19 library tests passed, 0 failed; binary target passed with 0 tests.
+- Strict Clippy: exit 0, no warnings.
+- Release build: succeeded.
+
+Covered behavior includes exact CRC/wire layout, every split, empty/1/8,180 payload acceptance, 8,181/65,535 rejection, embedded markers, adjacent frames, wrapping/duplicate/decreasing sequences, bad CRC/marker, changed payload with old CRC, 64-stream isolation, one malicious one-byte stream, 50 schedules, both incompatible-prefix regressions, scaled clean/damaged workloads, property bounds, and identical-byte parser benchmarking.
+
+## Minimized baseline comparison
+
+```sh
+/private/tmp/bogkit-sim-2026-08-17-trial1-round2-target/release/instrument-decoder-trial demo
+```
+
+Observed:
+
+- Modeled append/search baseline: 0 frames, 1 reset, peak retained 39 bytes.
+- Standalone candidate: emitted follower sequence 32, one `Marker` diagnostic for damaged sequence 31, retained 0 bytes.
+
+This is a modeled gateway-baseline finding, not a BogKit finding.
+
+## Full clean and damaged corpus plus current-build RSS
+
+Command, executed outside the restricted sandbox so macOS could provide RSS:
+
+```sh
+/usr/bin/time -l /private/tmp/bogkit-sim-2026-08-17-trial1-round2-target/release/instrument-decoder-trial full
+```
+
+Configuration: 64 connections; exactly 1,000,000 valid frames; exactly 950,000 x 192-byte plus 50,000 x 4,096-byte frames; exactly 387,200,000 clean bytes. Damage total remained exactly 25,000: 10,000 CRC flips, 5,000 over-limit headers, 5,000 changed markers, and 5,000 garbage bursts. All 5,000 garbage bursts used the under-limit `02 00 13` plausible header and nested follower STX.
+
+### Clean schedules — pass
+
+| Schedule | Frames | Tuple digest | Trace digest | Diagnostics | Max retained | Peak buffered | Time |
+|---|---:|---|---|---:|---:|---:|---:|
+| whole-frame | 1,000,000/1,000,000 | `0x227BAFFB59534865` | `0xED1C4875E1055725` | 0 | 0 | 4,096 | 6.416454 s |
+| all-one-byte | 1,000,000/1,000,000 | same | same | 0 | 4,095 | 4,096 | 11.409391 s |
+| seeded irregular 1..4,096 | 1,000,000/1,000,000 | same | same | 0 | 4,095 | 4,096 | 6.377592 s |
+
+Oracle and candidate tuple digests were identical on every clean schedule. Removing the unsafe nested scan reduced the one-byte clean time from the round-one 283.566192 seconds to 11.409391 seconds. The old performance finding is resolved and is not retained as a current finding.
+
+### Damaged schedules — immediate-recovery gate fails
+
+Every schedule emitted 0 damaged candidates, but only 48,942 of 50,000 known-valid followers. The same 48,942 were observed on the final feed call for their own scheduled frame. Candidate trace digest `0x6E17FB57A361D391` and diagnostic digest `0x0952BE767C57CA87` were identical across schedules.
+
+| Schedule | Followers emitted / expected | Candidate max retained / peak | Modeled baseline resets | Modeled baseline max retained | Time |
+|---|---:|---:|---:|---:|---:|
+| whole-frame | 48,942 / 50,000 | 5,990 / 6,182 | 4,928 | 8,367 | 0.215143 s |
+| all-one-byte | 48,942 / 50,000 | 6,072 / 6,073 | 3,246 | 58,418 | 8.705880 s |
+| irregular | 48,942 / 50,000 | 5,990 / 6,182 | 4,938 | 35,698 | 0.219024 s |
+
+Candidate followers emitted by preceding injected class were `[19,544, 9,776, 9,774, 9,848]`, versus expected `[20,000, 10,000, 10,000, 10,000]`, on every schedule. Total known-valid follower loss was 1,058.
+
+Candidate diagnostic counts, identical across schedules: 9,778 CRC, 5,168 over-limit, 4,850 marker, and 10,588 noise; 30,384 total. A damage class does not promise a one-to-one diagnostic class because payload marker bytes and long-lived connection state can establish an earlier conservative recovery candidate. No diagnostic contains payload bytes.
+
+These generator results do not rescue the exact immediate gate: the permanent 14-byte regression proves sequence 101 cannot safely emit on byte 16. Conversely, the full generator shows that conservative recovery after corruption can lose later valid frames in long-lived streams. The brief's immediate-follower acceptance criterion is unmet.
+
+### RSS
+
+Current safe-policy build maximum resident set size: **6,144,000 bytes** (about 5.86 MiB), below 64 MiB. `time -l` also reported peak memory footprint 5,505,336 bytes, 0 swaps, and 0 block input/output operations.
+
+## Required arbitrary-byte property-style run
+
+```sh
+/private/tmp/bogkit-sim-2026-08-17-trial1-round2-target/release/instrument-decoder-trial property 100000
+```
+
+Result: exactly 100,000 deterministic arbitrary strings, lengths 0 through 32,768; largest 32,768; no panic or hang; peak buffered 8,192; maximum retained 8,175; elapsed 15.249824 seconds; digest `0xF063F47065F8AF00`.
+
+This is boundedness and panic/hang stress evidence. It is not an independent framing oracle or a coverage-guided fuzzing campaign.
+
+## Parser-only benchmark
+
+The runner prebuilt one 10,000-frame, 3,872,000-byte corpus before timing. Each parser received exactly those stored bytes in fixed 4,096-byte chunks for ten passes per measured run, after one warm-up. Generation and frame encoding were outside measured time.
+
+```sh
+/private/tmp/bogkit-sim-2026-08-17-trial1-round2-target/release/instrument-decoder-trial bench 100000
+```
+
+| Parser | Run 1 | Run 2 | Run 3 | Slower of three |
+|---|---:|---:|---:|---:|
+| modeled baseline | 126.388 MiB/s | 126.589 MiB/s | 126.464 MiB/s | 126.388 MiB/s |
+| standalone candidate | 135.806 MiB/s | 135.072 MiB/s | 135.002 MiB/s | 135.002 MiB/s |
+
+Slower-run ratio: 1.068161 (106.816%). Both emitted 100,000 frames, zero diagnostics/resets, and digest `0x4BF9177355C9C665`. The throughput gates pass for this clean fixed-chunk microbenchmark.
+
+## Evidence limits
+
+- The full corpus is deterministic and synthetic; it does not establish real-instrument production readiness.
+- Host RSS is measured on this 64 GB M4 Pro Mac, not under an enforced 64 MiB container.
+- The parser benchmark is a clean per-connection stored-byte microbenchmark, not a full gateway capacity test.
+- The property runner checks determinism/counts/bounds and absence of panic/hang; it does not supply an independent oracle for arbitrary bytes.
+- The wire format has no escape or external boundary signal that can prove whether a nested valid byte sequence is payload or a transport frame before a plausible containing frame ends.
+- No BogKit component internals were exercised beyond the public surfaces needed for the fit decision.
+
+## Cleanup verification
+
+- Removed `/private/tmp/bogkit-sim-2026-08-17-trial1-round2-target` after the final gates.
+- No `target` directory, generated corpus, database, runtime output, or binary remains under `simulation-output/`.
+- `git diff -- . ':(exclude)simulation-output'` is empty; no tracked BogKit core, example, Git, GitHub, or automation file changed.
+- The retained handoff contains only the brief, small Markdown evidence, Rust source/tests, `Cargo.toml`, and `Cargo.lock`.
diff --git a/developer-simulation/runs/2026-08-17--corruption-resynchronizing-instrument-stream-decoder/README.md b/developer-simulation/runs/2026-08-17--corruption-resynchronizing-instrument-stream-decoder/README.md
new file mode 100644
index 0000000..531327a
--- /dev/null
+++ b/developer-simulation/runs/2026-08-17--corruption-resynchronizing-instrument-stream-decoder/README.md
@@ -0,0 +1,32 @@
+# Instrument decoder trial prototype
+
+This archived Rust package contains:
+
+- an append-and-search baseline;
+- a bounded, per-connection incremental candidate decoder;
+- CRC-32/ISO-HDLC framing and an independent whole-frame oracle;
+- deterministic clean, damaged, chunk-schedule, property, memory-bound, and throughput harnesses;
+- a small command-line runner.
+
+It has no external dependencies and does not use Fold, ESE, or ANNy. The trial report explains that decision.
+
+The decoder deliberately treats payload bytes as opaque. It never emits a valid-looking nested frame while an accepted-length containing frame is incomplete. The retained regressions demonstrate why this safe policy cannot also satisfy the brief's immediate-recovery rule for every plausible false header; this workspace is an incompatibility reproducer, not a production candidate.
+
+Use an external target directory so build artifacts do not remain in the evidence folder:
+
+```sh
+export CARGO_TARGET_DIR=/private/tmp/bogkit-instrument-decoder-target
+export MANIFEST=developer-simulation/Cargo.toml
+cargo test --locked --manifest-path "$MANIFEST" --package instrument-decoder-trial --all-targets
+cargo test --locked --manifest-path "$MANIFEST" --package instrument-decoder-trial candidate_never_emits_valid_nested_payload_before_outer_is_proved -- --nocapture
+cargo test --locked --manifest-path "$MANIFEST" --package instrument-decoder-trial candidate_defers_nested_followers_until_plausible_header_fails -- --nocapture
+cargo clippy --locked --manifest-path "$MANIFEST" --package instrument-decoder-trial --all-targets --all-features -- -D warnings -D clippy::all -D clippy::pedantic
+cargo build --locked --manifest-path "$MANIFEST" --package instrument-decoder-trial --release
+$CARGO_TARGET_DIR/release/instrument-decoder-trial demo
+$CARGO_TARGET_DIR/release/instrument-decoder-trial representative
+$CARGO_TARGET_DIR/release/instrument-decoder-trial full
+$CARGO_TARGET_DIR/release/instrument-decoder-trial property 100000
+$CARGO_TARGET_DIR/release/instrument-decoder-trial bench 100000
+```
+
+Remove the external target directory after use.
diff --git a/developer-simulation/runs/2026-08-17--corruption-resynchronizing-instrument-stream-decoder/TRIAL_REPORT.md b/developer-simulation/runs/2026-08-17--corruption-resynchronizing-instrument-stream-decoder/TRIAL_REPORT.md
new file mode 100644
index 0000000..ebe4e8e
--- /dev/null
+++ b/developer-simulation/runs/2026-08-17--corruption-resynchronizing-instrument-stream-decoder/TRIAL_REPORT.md
@@ -0,0 +1,135 @@
+# Trial report: corruption-resynchronizing instrument stream decoder
+
+## Outcome
+
+**no_fit**
+
+Fold, ESE, and ANNy are not a fit for the synchronous exact binary-framing path. The safe standalone decoder also cannot satisfy the full brief: unconditional immediate recovery from a plausible false header is incompatible with treating clean frame payloads as opaque.
+
+The retained standard-library prototype is a minimal runnable incompatibility and conservative-recovery reproducer, not a production candidate. It passes clean framing, bounded memory, property stress, parser throughput, and chunk-independence checks. It explicitly fails the immediate-follower gate.
+
+## Ordered discovery and friction
+
+1. Public BogKit documentation identifies Fold as persistent incremental dataflow, ESE as text embedding, and ANNy as approximate vector search.
+2. Fold's public `Stream` opens a path-backed fjall store and commits transactions. That machinery does not help exact byte framing and cannot sit in this no-disk consumption path.
+3. ESE and ANNy are unrelated to opaque bytes and exact marker/length/CRC proof.
+4. The modeled append/search baseline loses already-buffered valid data after some corrupt candidates.
+5. The initial standalone candidate safely waited for an accepted-length containing candidate to end, but therefore could not emit a short valid follower immediately after `02 00 13`.
+6. The round-one repair emitted the earliest later CRC-valid nested candidate before the containing candidate ended. It satisfied the immediate regression but made clean framing chunk-dependent.
+7. The round-two clean counterexample is sequence 42 with opaque payload beginning with a complete valid encoded sequence 777 plus 32 bytes. Whole-chunk delivery emitted sequence 42; the unsafe one-byte path emitted sequence 777 and lost 42.
+8. Strict RED/GREEN removed only the opportunistic nested emission. Whole-chunk and one-byte delivery now both emit sequence 42 with no diagnostics.
+9. The exact false-header regression now waits: sequence 101 does not emit at its ETX on byte 16; sequences 101 and 102 both emit only after the plausible containing candidate fails at byte 30. Frames and diagnostics remain chunk-identical.
+10. The full safe-policy damage corpus emits 0 damaged candidates but only 48,942/50,000 known-valid followers. The immediate gate is unmet, so the full-brief and candidate outcome is `no_fit`.
+
+## Component decision audit
+
+| Component | Considered role | Decision | Reason |
+|---|---|---|---|
+| Fold | Durable privacy-safe diagnostic aggregation | Not used | Useful only downstream of validation. Its path-backed transactions add disk/database machinery and do not solve framing or missing boundary information. |
+| ESE | Payload/diagnostic semantic classification | Not used | Payloads are opaque, diagnostics cannot expose payload, and semantic text processing is out of scope. |
+| ANNy | Boundary similarity search | Not used | Recovery requires exact transport proof, never approximate similarity. |
+
+No BogKit component was forced into an unrelated hot path. A separate downstream Fold consumer remains possible but is outside this trial.
+
+## Safe recovery contract
+
+- Emit only a candidate whose own STX, exact declared length, ETX, and CRC pass.
+- Treat the payload of an accepted-length candidate as opaque while that candidate is incomplete; never emit a nested valid-looking byte sequence early.
+- For a valid containing candidate, emit only that outer frame even if its payload contains complete valid encoded frames.
+- After a containing candidate reaches its declared end and fails, preserve the earliest nested STX strictly inside its declared bytes and wait for that nested candidate's own proof.
+- A valid frame starting exactly at a failed candidate's declared boundary remains a normal follower; the failed candidate keeps its stable CRC/marker diagnostic.
+- Reject over-limit headers from the three-byte prefix without allocating their claimed length.
+- Diagnostics contain connection, offsets, safe header metadata, and error class only—never payload bytes.
+
+## Why the immediate gate is unachievable under this wire contract
+
+When a complete CRC-valid frame-shaped sequence appears inside an incomplete accepted-length candidate, bytes that have not arrived yet determine whether the containing candidate will validate. If it validates, the nested sequence is opaque payload and must not emit. If it fails, the nested sequence may be a recovery boundary. The decoder cannot know which future occurs at the nested ETX.
+
+The unsafe round-one policy guessed “boundary” and corrupted the clean sequence-42 frame under one-byte delivery. The safe round-two policy waits and therefore cannot emit sequence 101 on byte 16 in the plausible-false-header case. No heuristic resolves missing information while preserving both contracts.
+
+The smallest protocol-level improvement is an unambiguous boundary mechanism outside opaque payload—such as byte stuffing/escaping or trusted record segmentation. The smallest requirements-level improvement is to permit recovery only after an accepted-length containing candidate validates or fails.
+
+## Acceptance results
+
+| Criterion | Result | Evidence |
+|---|---|---|
+| 1. Full clean equality | Pass | All three schedules emitted 1,000,000/1,000,000 over 387,200,000 bytes; oracle/candidate digest `0x227BAFFB59534865`; trace `0xED1C4875E1055725`. |
+| 2. Full damaged immediate recovery | **Fail** | Exact 25,000 events including 5,000 under-limit plausible headers; 0 damaged emitted, but only 48,942/50,000 followers emitted on every schedule. The 14-byte sequence-101 follower is deliberately deferred from byte 16 to byte 30. |
+| 3. Edge and adversarial execution | Pass with incompatibility exposed | 19 tests cover both conflicting cases, every split, length edges, markers, CRC, adjacency, wrap/duplicates/decrease, and 64-stream isolation. The tests do not relabel the failed immediate requirement as a pass. |
+| 4. <=64 MiB RSS and <=8,192 retained | Pass on current host | Fresh maximum RSS 6,144,000 bytes; full candidate retained <=4,095 clean and <=6,072 damaged; property max 8,175. |
+| 5. >=80% baseline and >=50 MiB/s | Pass in parser microbenchmark | Slower baseline 126.388 MiB/s; candidate 135.002 MiB/s; ratio 106.816%. |
+| 6. Deterministic schedules | Pass for resulting conservative policy | Targeted frames/diagnostics match across single, one-byte, and 50 seeded schedules; full outputs and losses match across the three named schedules. |
+| 7. 100,000 arbitrary strings | Pass | Exactly 100,000 up to 32 KiB; no panic/hang; retained <=8,175; digest `0xF063F47065F8AF00`. |
+
+Detailed commands, timings, follower counts, diagnostics, and RED/GREEN output are in `EVIDENCE.md`.
+
+## Findings
+
+### F1 — opportunistic nested emission corrupted clean opaque payload
+
+- Category: correctness defect
+- Severity: Important
+- Confidence: High
+- Attribution: standalone round-one prototype; not a BogKit core defect
+- Status: Fixed in this handoff
+- Reproduction: feed a clean sequence-42 frame whose payload starts with `encode_frame(777, "aa")` followed by 32 bytes. The rejected one-byte policy emitted sequence 777 and lost 42; whole-chunk delivery emitted 42.
+- Smallest improvement: never emit a nested candidate while an accepted-length containing candidate is incomplete; retain the exact whole/one-byte regression.
+
+### F2 — the wire contract lacks information required for unconditional immediate resynchronization
+
+- Category: missing capability
+- Severity: Important
+- Confidence: High
+- Attribution: wire-protocol and brief boundary; not the modeled baseline, BogKit, or a BogKit core defect
+- Status: Open; causes the `no_fit` outcome
+- Reproduction: compare the clean outer regression with `02 00 13 | encode_frame(101, "aa") | encode_frame(102, "bb")`. Emitting a nested candidate before the plausible container ends breaks the clean case; waiting prevents sequence 101 from emitting on byte 16 in the false-header case.
+- Smallest improvement: relax immediate recovery until a plausible containing candidate validates or fails.
+
+### F3 — append/search reset loses already-buffered valid data
+
+- Category: correctness defect
+- Severity: Important
+- Confidence: High
+- Attribution: modeled gateway baseline; not the standalone candidate and not a BogKit core defect
+- Status: Demonstrated
+- Reproduction: run the release `demo`; the modeled baseline clears a changed-marker frame and its valid follower, while the conservative candidate emits the follower.
+- Smallest improvement: replace connection-wide reset with per-connection incremental validation and explicit recovery boundaries.
+
+### F4 — BogKit components do not fit exact synchronous framing
+
+- Category: poor product fit
+- Severity: Important
+- Confidence: High
+- Attribution: BogKit product-fit finding; not a BogKit core defect
+- Status: Retained no-fit decision
+- Reproduction: compare the decoder's exact no-disk byte contract with Fold's persistent transaction stream, ESE's text embeddings, and ANNy's approximate vector index.
+- Smallest improvement: keep framing standalone; use Fold only as an optional downstream consumer of already validated privacy-safe diagnostic events.
+
+### F5 — root onboarding does not make the valid use-none path explicit
+
+- Category: documentation gap
+- Severity: Minor
+- Confidence: High
+- Attribution: BogKit documentation; not a BogKit core defect
+- Status: Open
+- Reproduction: start from the root README with a binary protocol parser problem. Component descriptions exist, but a newcomer must infer from examples that using none is correct.
+- Smallest improvement: add a compact capability matrix with explicit no-fit examples such as binary framing, cryptographic validation, and synchronous network parsing.
+
+Every retained finding uses exactly one allowed category and a Critical/Important/Minor severity. Evidence limits are not findings. The resolved round-one one-byte scanning cost is recorded in evidence rather than retained as a current performance finding.
+
+## Evidence limits
+
+- The full corpus is deterministic and synthetic; it does not establish real-instrument production readiness.
+- RSS is a host measurement on an M4 Pro Mac, not an enforced 64 MiB container.
+- The property runner is boundedness/no-panic stress, not an independent oracle or coverage-guided fuzz campaign.
+- The fixed-chunk parser benchmark is not a gateway capacity claim and cannot offset the failed immediate-recovery gate.
+- BogKit internals were not broadly audited; no BogKit core correctness defect is claimed.
+
+## Dependencies and handoff decision
+
+- Standard library only; no external dependency.
+- Independent child workspace and lockfile under `simulation-output/prototype`.
+- Generator seed `0xA17E2026`.
+- Exact reproduction commands in `prototype/README.md`.
+
+Decision: retain outcome **no_fit** for Fold, ESE, ANNy, and the standalone candidate against the full brief. Preserve the prototype only as an incompatibility and conservative-recovery reproducer. Do not adopt it in the gateway unless the wire contract or immediate-recovery requirement changes and the resulting design repeats all correctness, memory, and throughput gates.
diff --git a/developer-simulation/runs/2026-08-17--corruption-resynchronizing-instrument-stream-decoder/src/lib.rs b/developer-simulation/runs/2026-08-17--corruption-resynchronizing-instrument-stream-decoder/src/lib.rs
new file mode 100644
index 0000000..bed2a73
--- /dev/null
+++ b/developer-simulation/runs/2026-08-17--corruption-resynchronizing-instrument-stream-decoder/src/lib.rs
@@ -0,0 +1,1455 @@
+use std::collections::HashMap;
+
+#[must_use]
+pub fn crc32(bytes: &[u8]) -> u32 {
+    let mut crc = u32::MAX;
+    for &byte in bytes {
+        crc ^= u32::from(byte);
+        for _ in 0..8 {
+            crc = (crc >> 1) ^ (0xEDB8_8320 & (0_u32.wrapping_sub(crc & 1)));
+        }
+    }
+    !crc
+}
+
+/// Builds a complete wire frame for deterministic fixtures and workloads.
+///
+/// # Panics
+///
+/// Panics when `payload` is longer than the wire format's unsigned 16-bit
+/// payload-length field. The decoder never calls this generator on input.
+#[must_use]
+pub fn encode_frame(sequence: u32, payload: &[u8]) -> Vec<u8> {
+    let payload_len = u16::try_from(payload.len()).expect("wire payload length fits u16");
+    let sequence_bytes = sequence.to_be_bytes();
+    let mut crc_input = Vec::with_capacity(4 + payload.len());
+    crc_input.extend_from_slice(&sequence_bytes);
+    crc_input.extend_from_slice(payload);
+    let crc = crc32(&crc_input);
+
+    let mut wire = Vec::with_capacity(payload.len() + 12);
+    wire.push(0x02);
+    wire.extend_from_slice(&payload_len.to_be_bytes());
+    wire.extend_from_slice(&sequence_bytes);
+    wire.extend_from_slice(payload);
+    wire.extend_from_slice(&crc.to_be_bytes());
+    wire.push(0x03);
+    wire
+}
+
+pub const MAX_WIRE_LEN: usize = 8_192;
+
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+pub struct FrameRecord {
+    pub connection: u64,
+    pub sequence: u32,
+    pub payload_len: u16,
+    pub payload_digest: u64,
+    pub end_offset: u64,
+}
+
+#[derive(Clone, Debug, Default, Eq, PartialEq)]
+pub struct FeedResult {
+    pub frames: Vec<FrameRecord>,
+    pub diagnostics: Vec<Diagnostic>,
+}
+
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+pub enum ErrorClass {
+    Noise,
+    OversizeLength,
+    Marker,
+    Crc,
+}
+
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+pub struct Diagnostic {
+    pub connection: u64,
+    pub byte_offset: u64,
+    pub declared_payload_len: Option<u16>,
+    pub sequence: Option<u32>,
+    pub class: ErrorClass,
+}
+
+#[derive(Default)]
+struct ConnectionState {
+    bytes: Vec<u8>,
+    base_offset: u64,
+    noise_start: Option<u64>,
+}
+
+#[derive(Default)]
+pub struct Decoder {
+    connections: HashMap<u64, ConnectionState>,
+    max_retained: usize,
+    peak_buffered: usize,
+}
+
+#[derive(Default)]
+pub struct AppendSearchBaseline {
+    connections: HashMap<u64, ConnectionState>,
+    resets: u64,
+    max_retained: usize,
+}
+
+impl AppendSearchBaseline {
+    #[must_use]
+    pub fn new() -> Self {
+        Self::default()
+    }
+
+    pub fn feed(&mut self, connection: u64, chunk: &[u8]) -> FeedResult {
+        let state = self.connections.entry(connection).or_default();
+        state.bytes.extend_from_slice(chunk);
+        self.max_retained = self.max_retained.max(state.bytes.len());
+        let mut result = FeedResult::default();
+
+        loop {
+            if state.bytes.len() < 3 {
+                break;
+            }
+            if state.bytes[0] != 0x02 {
+                if let Some(start) = state.bytes.iter().position(|byte| *byte == 0x02) {
+                    state.bytes.drain(..start);
+                    state.base_offset = state.base_offset.saturating_add(usize_to_u64(start));
+                    continue;
+                }
+                break;
+            }
+            let payload_len = u16::from_be_bytes([state.bytes[1], state.bytes[2]]);
+            let wire_len = usize::from(payload_len) + 12;
+            let terminator = state
+                .bytes
+                .iter()
+                .enumerate()
+                .filter(|(_, byte)| **byte == 0x03)
+                .map(|(index, _)| index)
+                .find(|index| index + 1 >= wire_len);
+            let Some(terminator) = terminator else {
+                break;
+            };
+            if terminator + 1 != wire_len {
+                result.diagnostics.push(Diagnostic {
+                    connection,
+                    byte_offset: state.base_offset,
+                    declared_payload_len: Some(payload_len),
+                    sequence: read_sequence(&state.bytes),
+                    class: ErrorClass::Marker,
+                });
+                state.base_offset = state
+                    .base_offset
+                    .saturating_add(usize_to_u64(state.bytes.len()));
+                state.bytes.clear();
+                self.resets = self.resets.saturating_add(1);
+                break;
+            }
+            let sequence = read_sequence(&state.bytes).unwrap_or(0);
+            let crc_at = wire_len - 5;
+            let expected_crc = u32::from_be_bytes([
+                state.bytes[crc_at],
+                state.bytes[crc_at + 1],
+                state.bytes[crc_at + 2],
+                state.bytes[crc_at + 3],
+            ]);
+            if crc32(&state.bytes[3..crc_at]) != expected_crc {
+                result.diagnostics.push(Diagnostic {
+                    connection,
+                    byte_offset: state.base_offset,
+                    declared_payload_len: Some(payload_len),
+                    sequence: Some(sequence),
+                    class: ErrorClass::Crc,
+                });
+                state.base_offset = state
+                    .base_offset
+                    .saturating_add(usize_to_u64(state.bytes.len()));
+                state.bytes.clear();
+                self.resets = self.resets.saturating_add(1);
+                break;
+            }
+            result.frames.push(FrameRecord {
+                connection,
+                sequence,
+                payload_len,
+                payload_digest: fnv1a64(&state.bytes[7..crc_at]),
+                end_offset: state.base_offset.saturating_add(usize_to_u64(wire_len - 1)),
+            });
+            state.bytes.drain(..wire_len);
+            state.base_offset = state.base_offset.saturating_add(usize_to_u64(wire_len));
+        }
+        result
+    }
+
+    #[must_use]
+    pub fn reset_count(&self) -> u64 {
+        self.resets
+    }
+
+    #[must_use]
+    pub fn max_retained_bytes(&self) -> usize {
+        self.max_retained
+    }
+}
+
+impl Decoder {
+    #[must_use]
+    pub fn new() -> Self {
+        Self::default()
+    }
+
+    pub fn feed(&mut self, connection: u64, chunk: &[u8]) -> FeedResult {
+        let state = self.connections.entry(connection).or_default();
+        let mut result = FeedResult::default();
+        let mut unread = chunk;
+        loop {
+            let consumed = process_available(state, connection, &mut result);
+            if consumed != 0 {
+                state.bytes.drain(..consumed);
+                state.base_offset = state.base_offset.saturating_add(usize_to_u64(consumed));
+            }
+            if unread.is_empty() {
+                break;
+            }
+            let room = MAX_WIRE_LEN.saturating_sub(state.bytes.len());
+            if room == 0 {
+                state.bytes.remove(0);
+                state.base_offset = state.base_offset.saturating_add(1);
+                continue;
+            }
+            let take = room.min(unread.len());
+            state.bytes.extend_from_slice(&unread[..take]);
+            self.peak_buffered = self.peak_buffered.max(state.bytes.len());
+            unread = &unread[take..];
+        }
+        self.max_retained = self.max_retained.max(state.bytes.len());
+        result
+    }
+
+    #[must_use]
+    pub fn max_retained_per_stream(&self) -> usize {
+        self.max_retained
+    }
+
+    #[must_use]
+    pub fn retained_for(&self, connection: u64) -> usize {
+        self.connections
+            .get(&connection)
+            .map_or(0, |state| state.bytes.len())
+    }
+
+    #[must_use]
+    pub fn peak_buffered_bytes(&self) -> usize {
+        self.peak_buffered
+    }
+}
+
+fn process_available(
+    state: &mut ConnectionState,
+    connection: u64,
+    result: &mut FeedResult,
+) -> usize {
+    let mut consumed = 0;
+    loop {
+        if state.bytes.len().saturating_sub(consumed) < 3 {
+            break;
+        }
+        if state.bytes[consumed] != 0x02 {
+            if state.noise_start.is_none() {
+                state.noise_start = Some(state.base_offset.saturating_add(usize_to_u64(consumed)));
+            }
+            consumed += 1;
+            continue;
+        }
+        if let Some(byte_offset) = state.noise_start.take() {
+            result.diagnostics.push(Diagnostic {
+                connection,
+                byte_offset,
+                declared_payload_len: None,
+                sequence: None,
+                class: ErrorClass::Noise,
+            });
+        }
+        let remaining = &state.bytes[consumed..];
+        let payload_len = u16::from_be_bytes([remaining[1], remaining[2]]);
+        let wire_len = usize::from(payload_len) + 12;
+        if wire_len > MAX_WIRE_LEN {
+            result.diagnostics.push(Diagnostic {
+                connection,
+                byte_offset: state.base_offset.saturating_add(usize_to_u64(consumed)),
+                declared_payload_len: Some(payload_len),
+                sequence: None,
+                class: ErrorClass::OversizeLength,
+            });
+            consumed += 1;
+            continue;
+        }
+        if remaining.len() < wire_len {
+            break;
+        }
+        let candidate = &remaining[..wire_len];
+        let sequence = u32::from_be_bytes([candidate[3], candidate[4], candidate[5], candidate[6]]);
+        let crc_at = wire_len - 5;
+        let expected_crc = u32::from_be_bytes([
+            candidate[crc_at],
+            candidate[crc_at + 1],
+            candidate[crc_at + 2],
+            candidate[crc_at + 3],
+        ]);
+        let marker_valid = candidate[wire_len - 1] == 0x03;
+        let crc_valid = crc32(&candidate[3..crc_at]) == expected_crc;
+        if marker_valid && crc_valid {
+            result.frames.push(FrameRecord {
+                connection,
+                sequence,
+                payload_len,
+                payload_digest: fnv1a64(&candidate[7..crc_at]),
+                end_offset: state
+                    .base_offset
+                    .saturating_add(usize_to_u64(consumed + wire_len - 1)),
+            });
+        } else if let Some(later_start) = find_later_stx(&remaining[..wire_len]) {
+            result.diagnostics.push(Diagnostic {
+                connection,
+                byte_offset: state.base_offset.saturating_add(usize_to_u64(consumed)),
+                declared_payload_len: None,
+                sequence: None,
+                class: ErrorClass::Noise,
+            });
+            consumed += later_start;
+            continue;
+        } else if !marker_valid {
+            result.diagnostics.push(Diagnostic {
+                connection,
+                byte_offset: state.base_offset.saturating_add(usize_to_u64(consumed)),
+                declared_payload_len: Some(payload_len),
+                sequence: Some(sequence),
+                class: ErrorClass::Marker,
+            });
+        } else {
+            result.diagnostics.push(Diagnostic {
+                connection,
+                byte_offset: state.base_offset.saturating_add(usize_to_u64(consumed)),
+                declared_payload_len: Some(payload_len),
+                sequence: Some(sequence),
+                class: ErrorClass::Crc,
+            });
+        }
+        consumed += wire_len;
+    }
+    consumed
+}
+
+fn find_later_stx(bytes: &[u8]) -> Option<usize> {
+    bytes[1..]
+        .iter()
+        .position(|byte| *byte == 0x02)
+        .map(|offset| offset + 1)
+}
+
+#[must_use]
+pub fn fnv1a64(bytes: &[u8]) -> u64 {
+    let mut digest = 0xCBF2_9CE4_8422_2325;
+    for &byte in bytes {
+        digest ^= u64::from(byte);
+        digest = digest.wrapping_mul(0x0000_0100_0000_01B3);
+    }
+    digest
+}
+
+fn usize_to_u64(value: usize) -> u64 {
+    u64::try_from(value).unwrap_or(u64::MAX)
+}
+
+fn read_sequence(bytes: &[u8]) -> Option<u32> {
+    let sequence = bytes.get(3..7)?;
+    Some(u32::from_be_bytes([
+        sequence[0],
+        sequence[1],
+        sequence[2],
+        sequence[3],
+    ]))
+}
+
+#[derive(Clone, Copy, Debug, Default, Eq, PartialEq)]
+pub struct PropertySummary {
+    pub cases: usize,
+    pub largest_input: usize,
+    pub peak_buffered: usize,
+    pub max_retained: usize,
+    pub output_digest: u64,
+}
+
+#[must_use]
+pub fn run_property_cases(cases: usize, max_len: usize, seed: u64) -> PropertySummary {
+    let mut rng = DeterministicRng::new(seed);
+    let mut summary = PropertySummary {
+        cases,
+        ..PropertySummary::default()
+    };
+    for case_index in 0..cases {
+        let modulus = max_len.saturating_add(1);
+        let length = if modulus == 0 {
+            usize::try_from(rng.next()).unwrap_or(usize::MAX)
+        } else {
+            usize::try_from(rng.next()).unwrap_or(usize::MAX) % modulus
+        };
+        let mut bytes = vec![0_u8; length];
+        for chunk in bytes.chunks_mut(8) {
+            let random = rng.next().to_le_bytes();
+            chunk.copy_from_slice(&random[..chunk.len()]);
+        }
+        let mut decoder = Decoder::new();
+        let result = decoder.feed(0, &bytes);
+        summary.largest_input = summary.largest_input.max(length);
+        summary.peak_buffered = summary.peak_buffered.max(decoder.peak_buffered_bytes());
+        summary.max_retained = summary.max_retained.max(decoder.retained_for(0));
+        summary.output_digest = summary.output_digest.wrapping_mul(0x0000_0100_0000_01B3)
+            ^ usize_to_u64(case_index)
+            ^ usize_to_u64(result.frames.len()).rotate_left(17)
+            ^ usize_to_u64(result.diagnostics.len()).rotate_left(33);
+    }
+    summary
+}
+
+#[must_use]
+pub fn oracle_frame(connection: u64, wire: &[u8]) -> Option<FrameRecord> {
+    if wire.first().copied()? != 0x02 || wire.last().copied()? != 0x03 {
+        return None;
+    }
+    let length_bytes: [u8; 2] = wire.get(1..3)?.try_into().ok()?;
+    let payload_len = u16::from_be_bytes(length_bytes);
+    if wire.len() != usize::from(payload_len) + 12 || wire.len() > MAX_WIRE_LEN {
+        return None;
+    }
+    let sequence_bytes: [u8; 4] = wire.get(3..7)?.try_into().ok()?;
+    let sequence = u32::from_be_bytes(sequence_bytes);
+    let crc_at = wire.len() - 5;
+    let crc_bytes: [u8; 4] = wire.get(crc_at..crc_at + 4)?.try_into().ok()?;
+    if oracle_crc32(&wire[3..crc_at]) != u32::from_be_bytes(crc_bytes) {
+        return None;
+    }
+    Some(FrameRecord {
+        connection,
+        sequence,
+        payload_len,
+        payload_digest: fnv1a64(&wire[7..crc_at]),
+        end_offset: usize_to_u64(wire.len() - 1),
+    })
+}
+
+fn oracle_crc32(bytes: &[u8]) -> u32 {
+    let mut value = 0xFFFF_FFFF;
+    for byte in bytes {
+        value ^= u32::from(*byte);
+        for _ in 0..8 {
+            if value & 1 == 1 {
+                value = (value >> 1) ^ 0xEDB8_8320;
+            } else {
+                value >>= 1;
+            }
+        }
+    }
+    value ^ 0xFFFF_FFFF
+}
+
+#[derive(Clone, Copy, Debug)]
+struct DeterministicRng(u64);
+
+impl DeterministicRng {
+    fn new(seed: u64) -> Self {
+        Self(if seed == 0 {
+            0x9E37_79B9_7F4A_7C15
+        } else {
+            seed
+        })
+    }
+
+    fn next(&mut self) -> u64 {
+        let mut value = self.0;
+        value ^= value << 13;
+        value ^= value >> 7;
+        value ^= value << 17;
+        self.0 = value;
+        value
+    }
+}
+
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+pub enum ChunkSchedule {
+    WholeFrame,
+    OneByte,
+    Irregular(u64),
+}
+
+#[derive(Clone, Copy, Debug, Default, Eq, PartialEq)]
+pub struct CleanSummary {
+    pub frames_expected: usize,
+    pub frames_emitted: usize,
+    pub wire_bytes: u64,
+    pub oracle_digest: u64,
+    pub candidate_digest: u64,
+    pub trace_digest: u64,
+    pub diagnostics: usize,
+    pub max_retained: usize,
+    pub peak_buffered: usize,
+}
+
+#[derive(Clone, Copy, Debug, Default, Eq, PartialEq)]
+pub struct BaselineSummary {
+    pub frames_emitted: usize,
+    pub wire_bytes: u64,
+    pub candidate_digest: u64,
+    pub diagnostics: usize,
+    pub resets: u64,
+    pub max_retained: usize,
+}
+
+#[derive(Clone, Copy, Debug, Default, Eq, PartialEq)]
+pub struct DamageSummary {
+    pub events: usize,
+    pub crc_cases: usize,
+    pub oversize_cases: usize,
+    pub marker_cases: usize,
+    pub garbage_cases: usize,
+    pub plausible_header_cases: usize,
+    pub damaged_emitted: usize,
+    pub followers_expected: usize,
+    pub followers_emitted: usize,
+    pub followers_immediate: usize,
+    pub diagnostics: usize,
+    pub max_retained: usize,
+    pub peak_buffered: usize,
+    pub baseline_resets: u64,
+    pub baseline_max_retained: usize,
+    pub candidate_followers_by_class: [usize; 4],
+    pub baseline_followers_by_class: [usize; 4],
+    pub diagnostics_by_error: [usize; 4],
+    pub candidate_trace_digest: u64,
+    pub candidate_diagnostic_digest: u64,
+}
+
+#[must_use]
+pub fn run_clean_workload(frames: usize, schedule: ChunkSchedule) -> CleanSummary {
+    let mut summary = CleanSummary {
+        frames_expected: frames,
+        oracle_digest: 0xCBF2_9CE4_8422_2325,
+        candidate_digest: 0xCBF2_9CE4_8422_2325,
+        trace_digest: 0xCBF2_9CE4_8422_2325,
+        ..CleanSummary::default()
+    };
+    let mut decoder = Decoder::new();
+    let mut schedule = ScheduleState::new(schedule);
+    let mut sequences = [u32::MAX - 5; 64];
+
+    for frame_index in 0..frames {
+        let connection_index = frame_index % 64;
+        let connection = usize_to_u64(connection_index);
+        let sequence = sequences[connection_index];
+        sequences[connection_index] = sequence.wrapping_add(1);
+        let payload_len = if frame_index % 20 == 0 { 4_084 } else { 180 };
+        let payload = make_payload(frame_index, payload_len);
+        let wire = encode_frame(sequence, &payload);
+        summary.wire_bytes = summary.wire_bytes.saturating_add(usize_to_u64(wire.len()));
+        if let Some(expected) = oracle_frame(connection, &wire) {
+            update_tuple_digest(&mut summary.oracle_digest, &expected);
+        }
+        feed_candidate_component(
+            &mut decoder,
+            connection,
+            &wire,
+            &mut schedule,
+            |result, _is_last| {
+                summary.frames_emitted += result.frames.len();
+                summary.diagnostics += result.diagnostics.len();
+                for frame in &result.frames {
+                    update_tuple_digest(&mut summary.candidate_digest, frame);
+                    update_trace_digest(&mut summary.trace_digest, frame);
+                }
+                for diagnostic in &result.diagnostics {
+                    update_diagnostic_digest(&mut summary.trace_digest, diagnostic);
+                }
+            },
+        );
+    }
+    summary.max_retained = decoder.max_retained_per_stream();
+    summary.peak_buffered = decoder.peak_buffered_bytes();
+    summary
+}
+
+#[must_use]
+pub fn run_baseline_clean_workload(frames: usize, schedule: ChunkSchedule) -> BaselineSummary {
+    let mut summary = BaselineSummary {
+        candidate_digest: 0xCBF2_9CE4_8422_2325,
+        ..BaselineSummary::default()
+    };
+    let mut baseline = AppendSearchBaseline::new();
+    let mut schedule = ScheduleState::new(schedule);
+    let mut sequences = [u32::MAX - 5; 64];
+    for frame_index in 0..frames {
+        let connection_index = frame_index % 64;
+        let connection = usize_to_u64(connection_index);
+        let sequence = sequences[connection_index];
+        sequences[connection_index] = sequence.wrapping_add(1);
+        let payload_len = if frame_index % 20 == 0 { 4_084 } else { 180 };
+        let payload = make_payload(frame_index, payload_len);
+        let wire = encode_frame(sequence, &payload);
+        summary.wire_bytes = summary.wire_bytes.saturating_add(usize_to_u64(wire.len()));
+        let mut offset = 0;
+        while offset < wire.len() {
+            let chunk_len = schedule.next_size(wire.len() - offset);
+            let end = offset.saturating_add(chunk_len).min(wire.len());
+            let result = baseline.feed(connection, &wire[offset..end]);
+            summary.frames_emitted += result.frames.len();
+            summary.diagnostics += result.diagnostics.len();
+            for frame in &result.frames {
+                update_tuple_digest(&mut summary.candidate_digest, frame);
+            }
+            offset = end;
+        }
+    }
+    summary.resets = baseline.reset_count();
+    summary.max_retained = baseline.max_retained_bytes();
+    summary
+}
+
+#[must_use]
+pub fn run_candidate_benchmark_workload(frames: usize, schedule: ChunkSchedule) -> BaselineSummary {
+    let mut summary = BaselineSummary {
+        candidate_digest: 0xCBF2_9CE4_8422_2325,
+        ..BaselineSummary::default()
+    };
+    let mut decoder = Decoder::new();
+    let mut schedule = ScheduleState::new(schedule);
+    let mut sequences = [u32::MAX - 5; 64];
+    for frame_index in 0..frames {
+        let connection_index = frame_index % 64;
+        let connection = usize_to_u64(connection_index);
+        let sequence = sequences[connection_index];
+        sequences[connection_index] = sequence.wrapping_add(1);
+        let payload_len = if frame_index % 20 == 0 { 4_084 } else { 180 };
+        let payload = make_payload(frame_index, payload_len);
+        let wire = encode_frame(sequence, &payload);
+        summary.wire_bytes = summary.wire_bytes.saturating_add(usize_to_u64(wire.len()));
+        feed_candidate_component(
+            &mut decoder,
+            connection,
+            &wire,
+            &mut schedule,
+            |result, _is_last| {
+                summary.frames_emitted += result.frames.len();
+                summary.diagnostics += result.diagnostics.len();
+                for frame in &result.frames {
+                    update_tuple_digest(&mut summary.candidate_digest, frame);
+                }
+            },
+        );
+    }
+    summary.max_retained = decoder.max_retained_per_stream();
+    summary
+}
+
+pub struct BenchmarkCorpus {
+    streams: Vec<Vec<u8>>,
+    bytes_per_pass: u64,
+}
+
+impl BenchmarkCorpus {
+    #[must_use]
+    pub fn build(frames: usize) -> Self {
+        let mut streams = vec![Vec::new(); 64];
+        let mut sequences = [u32::MAX - 5; 64];
+        let mut bytes_per_pass = 0_u64;
+        for frame_index in 0..frames {
+            let connection = frame_index % 64;
+            let sequence = sequences[connection];
+            sequences[connection] = sequence.wrapping_add(1);
+            let payload_len = if frame_index % 20 == 0 { 4_084 } else { 180 };
+            let payload = make_payload(frame_index, payload_len);
+            let wire = encode_frame(sequence, &payload);
+            bytes_per_pass = bytes_per_pass.saturating_add(usize_to_u64(wire.len()));
+            streams[connection].extend_from_slice(&wire);
+        }
+        Self {
+            streams,
+            bytes_per_pass,
+        }
+    }
+
+    #[must_use]
+    pub fn run_baseline(&self, passes: usize) -> BaselineSummary {
+        let mut summary = BaselineSummary {
+            wire_bytes: self.bytes_per_pass.saturating_mul(usize_to_u64(passes)),
+            candidate_digest: 0xCBF2_9CE4_8422_2325,
+            ..BaselineSummary::default()
+        };
+        let mut baseline = AppendSearchBaseline::new();
+        for _ in 0..passes {
+            for (connection, stream) in self.streams.iter().enumerate() {
+                for chunk in stream.chunks(4_096) {
+                    let result = baseline.feed(usize_to_u64(connection), chunk);
+                    summary.frames_emitted += result.frames.len();
+                    summary.diagnostics += result.diagnostics.len();
+                    for frame in &result.frames {
+                        update_tuple_digest(&mut summary.candidate_digest, frame);
+                    }
+                }
+            }
+        }
+        summary.resets = baseline.reset_count();
+        summary.max_retained = baseline.max_retained_bytes();
+        summary
+    }
+
+    #[must_use]
+    pub fn run_candidate(&self, passes: usize) -> BaselineSummary {
+        let mut summary = BaselineSummary {
+            wire_bytes: self.bytes_per_pass.saturating_mul(usize_to_u64(passes)),
+            candidate_digest: 0xCBF2_9CE4_8422_2325,
+            ..BaselineSummary::default()
+        };
+        let mut decoder = Decoder::new();
+        for _ in 0..passes {
+            for (connection, stream) in self.streams.iter().enumerate() {
+                for chunk in stream.chunks(4_096) {
+                    let result = decoder.feed(usize_to_u64(connection), chunk);
+                    summary.frames_emitted += result.frames.len();
+                    summary.diagnostics += result.diagnostics.len();
+                    for frame in &result.frames {
+                        update_tuple_digest(&mut summary.candidate_digest, frame);
+                    }
+                }
+            }
+        }
+        summary.max_retained = decoder.max_retained_per_stream();
+        summary
+    }
+}
+
+#[must_use]
+pub fn run_damaged_workload(events: usize, schedule: ChunkSchedule) -> DamageSummary {
+    let mut summary = DamageSummary {
+        events,
+        followers_expected: events.saturating_mul(2),
+        candidate_trace_digest: 0xCBF2_9CE4_8422_2325,
+        candidate_diagnostic_digest: 0xCBF2_9CE4_8422_2325,
+        ..DamageSummary::default()
+    };
+    let mut decoder = Decoder::new();
+    let mut baseline = AppendSearchBaseline::new();
+    let mut schedule = ScheduleState::new(schedule);
+    let mut sequences = [10_000_u32; 64];
+
+    for event_index in 0..events {
+        let connection_index = event_index % 64;
+        let connection = usize_to_u64(connection_index);
+        let damaged_sequence = sequences[connection_index];
+        sequences[connection_index] = damaged_sequence.wrapping_add(1);
+        let (class_index, damage) = make_damage(event_index, damaged_sequence, &mut summary);
+        feed_both_component(
+            &mut decoder,
+            &mut baseline,
+            connection,
+            &damage,
+            &mut schedule,
+            |result, _baseline_result, _is_last| {
+                summary.damaged_emitted += result.frames.len();
+                summary.diagnostics += result.diagnostics.len();
+                count_diagnostics(&mut summary.diagnostics_by_error, result);
+                update_damage_digests(
+                    &mut summary.candidate_trace_digest,
+                    &mut summary.candidate_diagnostic_digest,
+                    result,
+                );
+            },
+        );
+
+        for follower_index in 0..2 {
+            let sequence = sequences[connection_index];
+            sequences[connection_index] = sequence.wrapping_add(1);
+            let payload = make_payload(
+                event_index.saturating_mul(2).saturating_add(follower_index),
+                180,
+            );
+            let follower = encode_frame(sequence, &payload);
+            feed_both_component(
+                &mut decoder,
+                &mut baseline,
+                connection,
+                &follower,
+                &mut schedule,
+                |result, baseline_result, is_last| {
+                    let emitted = result
+                        .frames
+                        .iter()
+                        .filter(|frame| frame.sequence == sequence)
+                        .count();
+                    summary.followers_emitted += emitted;
+                    summary.candidate_followers_by_class[class_index] += emitted;
+                    summary.baseline_followers_by_class[class_index] += baseline_result
+                        .frames
+                        .iter()
+                        .filter(|frame| frame.sequence == sequence)
+                        .count();
+                    if is_last {
+                        summary.followers_immediate += emitted;
+                    }
+                    summary.diagnostics += result.diagnostics.len();
+                    count_diagnostics(&mut summary.diagnostics_by_error, result);
+                    update_damage_digests(
+                        &mut summary.candidate_trace_digest,
+                        &mut summary.candidate_diagnostic_digest,
+                        result,
+                    );
+                },
+            );
+        }
+    }
+    summary.max_retained = decoder.max_retained_per_stream();
+    summary.peak_buffered = decoder.peak_buffered_bytes();
+    summary.baseline_resets = baseline.reset_count();
+    summary.baseline_max_retained = baseline.max_retained_bytes();
+    summary
+}
+
+fn make_damage(
+    event_index: usize,
+    damaged_sequence: u32,
+    summary: &mut DamageSummary,
+) -> (usize, Vec<u8>) {
+    match event_index % 10 {
+        0..=3 => {
+            summary.crc_cases += 1;
+            let mut wire = encode_frame(damaged_sequence, b"crc damage");
+            let crc_at = wire.len() - 5;
+            wire[crc_at] ^= 0x01;
+            (0, wire)
+        }
+        4..=5 => {
+            summary.oversize_cases += 1;
+            (1, vec![0x02, 0x1F, 0xF5])
+        }
+        6..=7 => {
+            summary.marker_cases += 1;
+            let mut wire = encode_frame(damaged_sequence, b"marker damage");
+            if let Some(marker) = wire.last_mut() {
+                *marker = 0x7E;
+            }
+            (2, wire)
+        }
+        _ => {
+            summary.garbage_cases += 1;
+            summary.plausible_header_cases += 1;
+            (3, vec![0x02, 0x00, 0x13])
+        }
+    }
+}
+
+struct ScheduleState {
+    schedule: ChunkSchedule,
+    rng: DeterministicRng,
+}
+
+impl ScheduleState {
+    fn new(schedule: ChunkSchedule) -> Self {
+        let seed = match schedule {
+            ChunkSchedule::Irregular(seed) => seed,
+            ChunkSchedule::WholeFrame | ChunkSchedule::OneByte => 1,
+        };
+        Self {
+            schedule,
+            rng: DeterministicRng::new(seed),
+        }
+    }
+
+    fn next_size(&mut self, remaining: usize) -> usize {
+        match self.schedule {
+            ChunkSchedule::WholeFrame => remaining,
+            ChunkSchedule::OneByte => 1,
+            ChunkSchedule::Irregular(_) => {
+                usize::try_from(self.rng.next() % 4_096 + 1).unwrap_or(1)
+            }
+        }
+    }
+}
+
+fn feed_candidate_component(
+    decoder: &mut Decoder,
+    connection: u64,
+    bytes: &[u8],
+    schedule: &mut ScheduleState,
+    mut observe: impl FnMut(&FeedResult, bool),
+) {
+    let mut offset = 0;
+    while offset < bytes.len() {
+        let chunk_len = schedule.next_size(bytes.len() - offset);
+        let end = offset.saturating_add(chunk_len).min(bytes.len());
+        let result = decoder.feed(connection, &bytes[offset..end]);
+        observe(&result, end == bytes.len());
+        offset = end;
+    }
+}
+
+fn feed_both_component(
+    decoder: &mut Decoder,
+    baseline: &mut AppendSearchBaseline,
+    connection: u64,
+    bytes: &[u8],
+    schedule: &mut ScheduleState,
+    mut observe: impl FnMut(&FeedResult, &FeedResult, bool),
+) {
+    let mut offset = 0;
+    while offset < bytes.len() {
+        let chunk_len = schedule.next_size(bytes.len() - offset);
+        let end = offset.saturating_add(chunk_len).min(bytes.len());
+        let result = decoder.feed(connection, &bytes[offset..end]);
+        let baseline_result = baseline.feed(connection, &bytes[offset..end]);
+        observe(&result, &baseline_result, end == bytes.len());
+        offset = end;
+    }
+}
+
+fn count_diagnostics(counts: &mut [usize; 4], result: &FeedResult) {
+    for diagnostic in &result.diagnostics {
+        let index = match diagnostic.class {
+            ErrorClass::Crc => 0,
+            ErrorClass::OversizeLength => 1,
+            ErrorClass::Marker => 2,
+            ErrorClass::Noise => 3,
+        };
+        counts[index] += 1;
+    }
+}
+
+fn update_damage_digests(frame_digest: &mut u64, diagnostic_digest: &mut u64, result: &FeedResult) {
+    for frame in &result.frames {
+        update_trace_digest(frame_digest, frame);
+    }
+    for diagnostic in &result.diagnostics {
+        update_diagnostic_digest(diagnostic_digest, diagnostic);
+    }
+}
+
+fn make_payload(frame_index: usize, payload_len: usize) -> Vec<u8> {
+    let mut payload = Vec::with_capacity(payload_len);
+    for byte_index in 0..payload_len {
+        let value = frame_index
+            .wrapping_mul(31)
+            .wrapping_add(byte_index.wrapping_mul(17))
+            & 0xFF;
+        payload.push(u8::try_from(value).unwrap_or(0));
+    }
+    if let Some(first) = payload.first_mut() {
+        *first = 0x02;
+    }
+    if let Some(second) = payload.get_mut(1) {
+        *second = 0x03;
+    }
+    payload
+}
+
+fn update_tuple_digest(digest: &mut u64, frame: &FrameRecord) {
+    digest_mix(digest, frame.connection);
+    digest_mix(digest, u64::from(frame.sequence));
+    digest_mix(digest, frame.payload_digest);
+}
+
+fn update_trace_digest(digest: &mut u64, frame: &FrameRecord) {
+    update_tuple_digest(digest, frame);
+    digest_mix(digest, u64::from(frame.payload_len));
+    digest_mix(digest, frame.end_offset);
+}
+
+fn update_diagnostic_digest(digest: &mut u64, diagnostic: &Diagnostic) {
+    digest_mix(digest, diagnostic.connection);
+    digest_mix(digest, diagnostic.byte_offset);
+    digest_mix(
+        digest,
+        diagnostic.declared_payload_len.map_or(u64::MAX, u64::from),
+    );
+    digest_mix(digest, diagnostic.sequence.map_or(u64::MAX, u64::from));
+    let class = match diagnostic.class {
+        ErrorClass::Noise => 1,
+        ErrorClass::OversizeLength => 2,
+        ErrorClass::Marker => 3,
+        ErrorClass::Crc => 4,
+    };
+    digest_mix(digest, class);
+}
+
+fn digest_mix(digest: &mut u64, value: u64) {
+    *digest ^= value;
+    *digest = digest.wrapping_mul(0x0000_0100_0000_01B3);
+}
+
+#[cfg(test)]
+mod tests {
+    fn decode_with_sizes(bytes: &[u8], mut next_size: impl FnMut() -> usize) -> crate::FeedResult {
+        let mut decoder = crate::Decoder::new();
+        let mut aggregate = crate::FeedResult::default();
+        let mut offset = 0;
+        while offset < bytes.len() {
+            let end = (offset + next_size().max(1)).min(bytes.len());
+            let result = decoder.feed(41, &bytes[offset..end]);
+            aggregate.frames.extend(result.frames);
+            aggregate.diagnostics.extend(result.diagnostics);
+            offset = end;
+        }
+        aggregate
+    }
+
+    #[test]
+    fn crc_matches_iso_hdlc_check_vector() {
+        // Would fail if reflection, polynomial, initial value, or final XOR changed.
+        assert_eq!(crate::crc32(b"123456789"), 0xCBF4_3926);
+    }
+
+    #[test]
+    fn empty_frame_has_exact_wire_layout() {
+        // Would fail on wrong endianness, field order, CRC coverage, or wire length.
+        assert_eq!(
+            crate::encode_frame(0x0102_0304, &[]),
+            [
+                0x02, 0x00, 0x00, 0x01, 0x02, 0x03, 0x04, 0xB6, 0x3C, 0xFB, 0xCD, 0x03,
+            ]
+        );
+    }
+
+    #[test]
+    fn candidate_decodes_valid_frame_across_every_single_split() {
+        // Would fail if any header/payload/CRC/marker boundary loses state.
+        let wire = crate::encode_frame(7, b"a\x02b\x03c");
+        for split in 0..=wire.len() {
+            let mut decoder = crate::Decoder::new();
+            let first = decoder.feed(19, &wire[..split]);
+            let second = decoder.feed(19, &wire[split..]);
+            if split < wire.len() {
+                assert!(first.frames.is_empty(), "split {split} emitted early");
+            }
+            let frames: Vec<_> = first.frames.iter().chain(&second.frames).copied().collect();
+            assert_eq!(
+                frames,
+                [crate::FrameRecord {
+                    connection: 19,
+                    sequence: 7,
+                    payload_len: 5,
+                    payload_digest: 0x8767_670E_576E_C006,
+                    end_offset: 16,
+                }],
+                "split {split}"
+            );
+            assert!(first.diagnostics.is_empty());
+            assert!(second.diagnostics.is_empty());
+            assert!(decoder.max_retained_per_stream() <= crate::MAX_WIRE_LEN);
+        }
+    }
+
+    #[test]
+    fn candidate_never_emits_valid_nested_payload_before_outer_is_proved() {
+        // Would fail if a valid-looking sequence inside opaque payload could preempt its outer frame.
+        let mut payload = crate::encode_frame(777, b"aa");
+        payload.extend_from_slice(&[0xA5; 32]);
+        let wire = crate::encode_frame(42, &payload);
+
+        let single = decode_with_sizes(&wire, || wire.len());
+        assert_eq!(
+            single
+                .frames
+                .iter()
+                .map(|frame| frame.sequence)
+                .collect::<Vec<_>>(),
+            [42]
+        );
+        assert!(single.diagnostics.is_empty());
+
+        let one_byte = decode_with_sizes(&wire, || 1);
+        assert_eq!(one_byte.frames, single.frames);
+        assert_eq!(one_byte.diagnostics, single.diagnostics);
+    }
+
+    #[test]
+    fn candidate_rejects_oversize_header_then_recovers_at_next_stx() {
+        // Would fail if the decoder waited for 8,192 payload bytes or skipped the follower.
+        let mut bytes = vec![0x02, 0x20, 0x00];
+        bytes.extend_from_slice(&crate::encode_frame(91, b"ok"));
+        let mut decoder = crate::Decoder::new();
+        let result = decoder.feed(4, &bytes);
+        assert_eq!(result.frames.len(), 1);
+        assert_eq!(result.frames[0].sequence, 91);
+        assert_eq!(result.diagnostics.len(), 2);
+        assert_eq!(
+            result.diagnostics[0],
+            crate::Diagnostic {
+                connection: 4,
+                byte_offset: 0,
+                declared_payload_len: Some(8_192),
+                sequence: None,
+                class: crate::ErrorClass::OversizeLength,
+            }
+        );
+        assert_eq!(result.diagnostics[1].class, crate::ErrorClass::Noise);
+        assert_eq!(result.diagnostics[1].byte_offset, 1);
+        assert_eq!(decoder.retained_for(4), 0);
+    }
+
+    #[test]
+    fn candidate_defers_nested_followers_until_plausible_header_fails() {
+        // Would fail if ambiguous nested bytes were emitted before the plausible outer candidate ended.
+        let mut bytes = vec![0x02, 0x00, 0x13];
+        bytes.extend_from_slice(&crate::encode_frame(101, b"aa"));
+        bytes.extend_from_slice(&crate::encode_frame(102, b"bb"));
+        assert_eq!(bytes.len(), 31);
+
+        let mut single_decoder = crate::Decoder::new();
+        let single = single_decoder.feed(77, &bytes);
+        assert_eq!(
+            single
+                .frames
+                .iter()
+                .map(|frame| (frame.sequence, frame.end_offset))
+                .collect::<Vec<_>>(),
+            [(101, 16), (102, 30)]
+        );
+        assert_eq!(
+            single.diagnostics,
+            [crate::Diagnostic {
+                connection: 77,
+                byte_offset: 0,
+                declared_payload_len: None,
+                sequence: None,
+                class: crate::ErrorClass::Noise,
+            }]
+        );
+
+        let mut byte_decoder = crate::Decoder::new();
+        let mut byte_frames = Vec::new();
+        let mut byte_diagnostics = Vec::new();
+        let mut emission_calls = Vec::new();
+        for (index, byte) in bytes.iter().enumerate() {
+            let result = byte_decoder.feed(77, std::slice::from_ref(byte));
+            if !result.frames.is_empty() {
+                emission_calls.push((
+                    index,
+                    result
+                        .frames
+                        .iter()
+                        .map(|frame| frame.sequence)
+                        .collect::<Vec<_>>(),
+                ));
+            }
+            byte_frames.extend(result.frames);
+            byte_diagnostics.extend(result.diagnostics);
+        }
+        assert_eq!(emission_calls, [(30, vec![101, 102])]);
+        assert_eq!(byte_frames, single.frames);
+        assert_eq!(byte_diagnostics, single.diagnostics);
+    }
+
+    #[test]
+    fn candidate_preserves_nested_start_after_plausible_header_fails() {
+        // Would fail if rejecting the false candidate consumed an incomplete nested frame.
+        let mut bytes = vec![0x02, 0x00, 0x13];
+        bytes.extend_from_slice(&crate::encode_frame(201, &[0xA5; 180]));
+        bytes.extend_from_slice(&crate::encode_frame(202, &[0x5A; 180]));
+
+        let single = decode_with_sizes(&bytes, || bytes.len());
+        assert_eq!(
+            single
+                .frames
+                .iter()
+                .map(|frame| frame.sequence)
+                .collect::<Vec<_>>(),
+            [201, 202]
+        );
+        let one_byte = decode_with_sizes(&bytes, || 1);
+        assert_eq!(one_byte.frames, single.frames);
+        assert_eq!(one_byte.diagnostics, single.diagnostics);
+    }
+
+    #[test]
+    fn candidate_reports_bad_end_marker_and_emits_immediate_follower() {
+        // Would fail if marker recovery cleared the whole buffered connection.
+        let mut damaged = crate::encode_frame(11, b"bad");
+        *damaged.last_mut().expect("test frame is non-empty") = 0x7E;
+        damaged.extend_from_slice(&crate::encode_frame(12, b"good"));
+        let mut decoder = crate::Decoder::new();
+        let result = decoder.feed(8, &damaged);
+        assert_eq!(
+            result
+                .frames
+                .iter()
+                .map(|frame| frame.sequence)
+                .collect::<Vec<_>>(),
+            [12]
+        );
+        assert_eq!(
+            result.diagnostics,
+            [crate::Diagnostic {
+                connection: 8,
+                byte_offset: 0,
+                declared_payload_len: Some(3),
+                sequence: Some(11),
+                class: crate::ErrorClass::Marker,
+            }]
+        );
+    }
+
+    #[test]
+    fn candidate_reports_crc_flip_and_never_emits_damaged_frame() {
+        // Would fail if CRC covered only payload, or if rejection lost the follower.
+        let mut damaged = crate::encode_frame(21, b"crc");
+        damaged[7] ^= 0x01;
+        damaged.extend_from_slice(&crate::encode_frame(22, b"next"));
+        let mut decoder = crate::Decoder::new();
+        let result = decoder.feed(9, &damaged);
+        assert_eq!(
+            result
+                .frames
+                .iter()
+                .map(|frame| frame.sequence)
+                .collect::<Vec<_>>(),
+            [22]
+        );
+        assert_eq!(
+            result.diagnostics,
+            [crate::Diagnostic {
+                connection: 9,
+                byte_offset: 0,
+                declared_payload_len: Some(3),
+                sequence: Some(21),
+                class: crate::ErrorClass::Crc,
+            }]
+        );
+    }
+
+    #[test]
+    fn candidate_never_buffers_more_than_max_wire_from_large_chunk() {
+        // Would fail if feed appended an arbitrary read wholesale before parsing it.
+        let mut decoder = crate::Decoder::new();
+        let bytes = vec![0x55; 32 * 1_024];
+        let result = decoder.feed(3, &bytes);
+        assert!(result.frames.is_empty());
+        assert!(decoder.peak_buffered_bytes() <= crate::MAX_WIRE_LEN);
+        assert!(decoder.retained_for(3) < 3);
+    }
+
+    #[test]
+    fn append_search_baseline_resets_and_loses_follower_after_missing_marker() {
+        // Would fail if the modeled baseline recovered without its connection-wide reset.
+        let mut bytes = crate::encode_frame(31, b"damaged");
+        *bytes.last_mut().expect("test frame is non-empty") = 0x7E;
+        bytes.extend_from_slice(&crate::encode_frame(32, b"follower"));
+        let mut baseline = crate::AppendSearchBaseline::new();
+        let result = baseline.feed(1, &bytes);
+        assert!(result.frames.is_empty());
+        assert_eq!(baseline.reset_count(), 1);
+
+        let mut candidate = crate::Decoder::new();
+        let recovered = candidate.feed(1, &bytes);
+        assert_eq!(
+            recovered
+                .frames
+                .iter()
+                .map(|frame| frame.sequence)
+                .collect::<Vec<_>>(),
+            [32]
+        );
+    }
+
+    #[test]
+    fn arbitrary_byte_runner_keeps_every_case_bounded() {
+        // Would fail on retained-buffer growth or if the requested case count were truncated.
+        let summary = crate::run_property_cases(1_000, 32 * 1_024, 0xA17E_2026);
+        assert_eq!(summary.cases, 1_000);
+        assert!(summary.largest_input <= 32 * 1_024);
+        assert!(summary.peak_buffered <= crate::MAX_WIRE_LEN);
+        assert!(summary.max_retained <= crate::MAX_WIRE_LEN);
+    }
+
+    #[test]
+    fn fifty_chunk_schedules_match_single_chunk_trace() {
+        // Would fail if buffering or diagnostic boundaries depended on read chunking.
+        let mut bytes = crate::encode_frame(u32::MAX, &[]);
+        bytes.extend_from_slice(&crate::encode_frame(0, &[0x02, 0x03, 0x02, 0x03]));
+        let mut crc_bad = crate::encode_frame(7, b"crc-bad");
+        crc_bad[8] ^= 0x80;
+        bytes.extend_from_slice(&crc_bad);
+        bytes.extend_from_slice(&crate::encode_frame(6, b"decreasing"));
+        bytes.extend_from_slice(&[0x02, 0xFF, 0xFF]);
+        bytes.extend_from_slice(&crate::encode_frame(6, b"duplicate"));
+        let mut marker_bad = crate::encode_frame(8, b"marker-bad");
+        *marker_bad.last_mut().expect("test frame is non-empty") = 0x7E;
+        bytes.extend_from_slice(&marker_bad);
+        bytes.extend_from_slice(&crate::encode_frame(9, &vec![0x03; 8_180]));
+
+        let oracle = decode_with_sizes(&bytes, || bytes.len());
+        let one_byte = decode_with_sizes(&bytes, || 1);
+        assert_eq!(one_byte, oracle);
+
+        for seed in 1_u64..=50 {
+            let mut state = seed;
+            let trace = decode_with_sizes(&bytes, || {
+                state ^= state << 13;
+                state ^= state >> 7;
+                state ^= state << 17;
+                usize::try_from(state % 4_096 + 1).expect("bounded chunk size fits usize")
+            });
+            assert_eq!(trace, oracle, "seed {seed}");
+        }
+    }
+
+    #[test]
+    fn whole_frame_oracle_requires_exact_length_markers_and_crc() {
+        // Would fail if the oracle shared incremental recovery assumptions.
+        let valid = crate::encode_frame(44, b"oracle");
+        assert_eq!(
+            crate::oracle_frame(5, &valid).map(|frame| frame.sequence),
+            Some(44)
+        );
+        let mut trailing = valid.clone();
+        trailing.push(0);
+        assert!(crate::oracle_frame(5, &trailing).is_none());
+        let mut crc_bad = valid.clone();
+        crc_bad[7] ^= 1;
+        assert!(crate::oracle_frame(5, &crc_bad).is_none());
+        let mut marker_bad = valid;
+        *marker_bad.last_mut().expect("test frame is non-empty") = 0;
+        assert!(crate::oracle_frame(5, &marker_bad).is_none());
+    }
+
+    #[test]
+    fn candidate_coalesces_noise_diagnostic_across_chunks() {
+        // Would fail if diagnostic boundaries followed read calls rather than wire bytes.
+        let mut decoder = crate::Decoder::new();
+        let first = decoder.feed(6, &[0x55]);
+        let mut tail = vec![0x66];
+        tail.extend_from_slice(&crate::encode_frame(3, b"ok"));
+        let second = decoder.feed(6, &tail);
+        assert!(first.diagnostics.is_empty());
+        assert_eq!(
+            second.diagnostics,
+            [crate::Diagnostic {
+                connection: 6,
+                byte_offset: 0,
+                declared_payload_len: None,
+                sequence: None,
+                class: crate::ErrorClass::Noise,
+            }]
+        );
+        assert_eq!(second.frames.len(), 1);
+    }
+
+    #[test]
+    fn scaled_workloads_preserve_exact_shape_and_recovery_counts() {
+        // Would fail if the bounded harness silently changed the 95/5 or damage ratios.
+        let clean = crate::run_clean_workload(2_000, crate::ChunkSchedule::Irregular(42));
+        assert_eq!(clean.frames_expected, 2_000);
+        assert_eq!(clean.frames_emitted, 2_000);
+        assert_eq!(clean.wire_bytes, 774_400);
+        assert_eq!(clean.oracle_digest, clean.candidate_digest);
+        assert_eq!(clean.diagnostics, 0);
+        assert!(clean.max_retained <= crate::MAX_WIRE_LEN);
+
+        let baseline =
+            crate::run_baseline_clean_workload(2_000, crate::ChunkSchedule::Irregular(42));
+        assert_eq!(baseline.frames_emitted, 2_000);
+        assert_eq!(baseline.wire_bytes, 774_400);
+        assert_eq!(baseline.candidate_digest, clean.oracle_digest);
+        assert_eq!(baseline.diagnostics, 0);
+        assert_eq!(baseline.resets, 0);
+
+        let damaged = crate::run_damaged_workload(50, crate::ChunkSchedule::Irregular(91));
+        assert_eq!(damaged.crc_cases, 20);
+        assert_eq!(damaged.oversize_cases, 10);
+        assert_eq!(damaged.marker_cases, 10);
+        assert_eq!(damaged.garbage_cases, 10);
+        assert_eq!(damaged.plausible_header_cases, 10);
+        assert_eq!(damaged.diagnostics_by_error[1], 10);
+        assert_eq!(damaged.damaged_emitted, 0);
+        assert_eq!(damaged.followers_expected, 100);
+        assert_eq!(damaged.followers_emitted, 100);
+        assert_eq!(damaged.followers_immediate, 100);
+        assert!(damaged.max_retained <= crate::MAX_WIRE_LEN);
+
+        let damaged_whole = crate::run_damaged_workload(50, crate::ChunkSchedule::WholeFrame);
+        let damaged_bytes = crate::run_damaged_workload(50, crate::ChunkSchedule::OneByte);
+        assert_ne!(damaged.candidate_trace_digest, 0);
+        assert_eq!(
+            damaged_whole.candidate_trace_digest,
+            damaged.candidate_trace_digest
+        );
+        assert_eq!(
+            damaged_bytes.candidate_trace_digest,
+            damaged.candidate_trace_digest
+        );
+        assert_eq!(
+            damaged_whole.candidate_diagnostic_digest,
+            damaged.candidate_diagnostic_digest
+        );
+        assert_eq!(
+            damaged_bytes.candidate_diagnostic_digest,
+            damaged.candidate_diagnostic_digest
+        );
+        assert_eq!(damaged_whole.followers_immediate, 100);
+        assert_eq!(damaged_bytes.followers_immediate, 100);
+    }
+
+    #[test]
+    fn declared_length_edges_accept_8180_and_reject_8181_and_65535() {
+        // Would fail if the 8,192-byte wire limit were applied to payload length.
+        for payload_len in [0, 1, 8_180] {
+            let payload = vec![0xA5; payload_len];
+            let wire = crate::encode_frame(70, &payload);
+            let mut decoder = crate::Decoder::new();
+            let result = decoder.feed(2, &wire);
+            assert_eq!(result.frames.len(), 1, "payload length {payload_len}");
+            assert!(result.diagnostics.is_empty());
+        }
+        for declared in [8_181_u16, u16::MAX] {
+            let mut bytes = vec![0x02];
+            bytes.extend_from_slice(&declared.to_be_bytes());
+            bytes.extend_from_slice(&crate::encode_frame(71, b"recovered"));
+            let mut decoder = crate::Decoder::new();
+            let result = decoder.feed(2, &bytes);
+            assert_eq!(result.frames.len(), 1, "declared length {declared}");
+            assert_eq!(result.frames[0].sequence, 71);
+            assert_eq!(
+                result.diagnostics[0].class,
+                crate::ErrorClass::OversizeLength
+            );
+        }
+    }
+
+    #[test]
+    fn partial_malicious_connection_does_not_affect_other_63_streams() {
+        // Would fail if per-connection framing state or bounds were shared.
+        let max_wire = crate::encode_frame(90, &vec![0x03; 8_180]);
+        let mut decoder = crate::Decoder::new();
+        assert!(decoder.feed(0, &max_wire[..1]).frames.is_empty());
+        for connection in 1..64 {
+            let result = decoder.feed(connection, &max_wire);
+            assert_eq!(result.frames.len(), 1, "connection {connection}");
+        }
+        let mut malicious_emitted = 0;
+        for byte in &max_wire[1..] {
+            let result = decoder.feed(0, std::slice::from_ref(byte));
+            malicious_emitted += result.frames.len();
+        }
+        assert_eq!(malicious_emitted, 1);
+        assert!(decoder.max_retained_per_stream() <= crate::MAX_WIRE_LEN);
+        assert!(decoder.peak_buffered_bytes() <= crate::MAX_WIRE_LEN);
+    }
+
+    #[test]
+    fn prebuilt_benchmark_corpus_is_identical_for_both_parsers() {
+        // Would fail if timed parsers received different bytes or chunk boundaries.
+        let corpus = crate::BenchmarkCorpus::build(2_000);
+        let baseline = corpus.run_baseline(2);
+        let candidate = corpus.run_candidate(2);
+        assert_eq!(baseline.frames_emitted, 4_000);
+        assert_eq!(candidate.frames_emitted, 4_000);
+        assert_eq!(baseline.wire_bytes, 1_548_800);
+        assert_eq!(candidate.wire_bytes, baseline.wire_bytes);
+        assert_eq!(candidate.candidate_digest, baseline.candidate_digest);
+        assert_eq!(baseline.diagnostics, 0);
+        assert_eq!(candidate.diagnostics, 0);
+    }
+}
diff --git a/developer-simulation/runs/2026-08-17--corruption-resynchronizing-instrument-stream-decoder/src/main.rs b/developer-simulation/runs/2026-08-17--corruption-resynchronizing-instrument-stream-decoder/src/main.rs
new file mode 100644
index 0000000..96a8630
--- /dev/null
+++ b/developer-simulation/runs/2026-08-17--corruption-resynchronizing-instrument-stream-decoder/src/main.rs
@@ -0,0 +1,153 @@
+use std::hint::black_box;
+use std::time::Instant;
+
+use instrument_decoder_trial::{
+    AppendSearchBaseline, BenchmarkCorpus, ChunkSchedule, Decoder, encode_frame,
+    run_clean_workload, run_damaged_workload, run_property_cases,
+};
+
+fn main() {
+    let command = std::env::args()
+        .nth(1)
+        .unwrap_or_else(|| "demo".to_string());
+    match command.as_str() {
+        "demo" => demo(),
+        "representative" => representative(),
+        "full" => full(),
+        "property" => property(),
+        "bench" => bench(),
+        _ => {
+            eprintln!("usage: instrument-decoder-trial [demo|representative|full|property|bench]");
+            std::process::exit(2);
+        }
+    }
+}
+
+fn demo() {
+    let mut bytes = encode_frame(31, b"damaged");
+    if let Some(marker) = bytes.last_mut() {
+        *marker = 0x7E;
+    }
+    bytes.extend_from_slice(&encode_frame(32, b"follower"));
+
+    let mut baseline = AppendSearchBaseline::new();
+    let baseline_result = baseline.feed(1, &bytes);
+    let mut candidate = Decoder::new();
+    let candidate_result = candidate.feed(1, &bytes);
+    println!(
+        "demo baseline_frames={} baseline_resets={} baseline_peak={} candidate_frames={} candidate_diagnostics={} candidate_retained={}",
+        baseline_result.frames.len(),
+        baseline.reset_count(),
+        baseline.max_retained_bytes(),
+        candidate_result.frames.len(),
+        candidate_result.diagnostics.len(),
+        candidate.retained_for(1),
+    );
+    println!("demo candidate={candidate_result:?}");
+}
+
+fn representative() {
+    run_workload("representative", 100_000, 2_500);
+}
+
+fn full() {
+    run_workload("full", 1_000_000, 25_000);
+}
+
+fn run_workload(label: &str, clean_frames: usize, damaged_events: usize) {
+    const SEED: u64 = 0xA17E_2026;
+    println!(
+        "{label} config connections=64 clean_frames={clean_frames} damaged_events={damaged_events} seed=0x{SEED:08X} short_wire=192 max_wire=4096"
+    );
+    for (name, schedule) in [
+        ("whole-frame", ChunkSchedule::WholeFrame),
+        ("one-byte", ChunkSchedule::OneByte),
+        ("irregular", ChunkSchedule::Irregular(SEED)),
+    ] {
+        let started = Instant::now();
+        let summary = run_clean_workload(clean_frames, schedule);
+        println!(
+            "clean schedule={name} elapsed_s={:.6} summary={summary:?}",
+            started.elapsed().as_secs_f64()
+        );
+        black_box(summary);
+    }
+    for (name, schedule) in [
+        ("whole-frame", ChunkSchedule::WholeFrame),
+        ("one-byte", ChunkSchedule::OneByte),
+        ("irregular", ChunkSchedule::Irregular(SEED)),
+    ] {
+        let started = Instant::now();
+        let damage = run_damaged_workload(damaged_events, schedule);
+        println!(
+            "damaged schedule={name} elapsed_s={:.6} summary={damage:?}",
+            started.elapsed().as_secs_f64()
+        );
+        black_box(damage);
+    }
+}
+
+fn property() {
+    let cases = std::env::args()
+        .nth(2)
+        .and_then(|value| value.parse::<usize>().ok())
+        .unwrap_or(100_000);
+    let started = Instant::now();
+    let summary = run_property_cases(cases, 32 * 1_024, 0xA17E_2026);
+    println!(
+        "property elapsed_s={:.6} cap_bytes=32768 seed=0xA17E2026 summary={summary:?}",
+        started.elapsed().as_secs_f64()
+    );
+    black_box(summary);
+}
+
+fn bench() {
+    let frames = std::env::args()
+        .nth(2)
+        .and_then(|value| value.parse::<usize>().ok())
+        .unwrap_or(100_000);
+    let frames_per_pass = frames.clamp(1, 10_000);
+    let passes = frames.div_ceil(frames_per_pass);
+    let corpus = BenchmarkCorpus::build(frames_per_pass);
+    println!(
+        "bench config requested_frames={frames} prebuilt_frames={frames_per_pass} passes={passes} chunk_bytes=4096 warmups=1 measured_runs=3"
+    );
+    black_box(corpus.run_baseline(1));
+    black_box(corpus.run_candidate(1));
+
+    let baseline_rates = timed_runs("baseline", || corpus.run_baseline(passes));
+    let candidate_rates = timed_runs("candidate", || corpus.run_candidate(passes));
+    let baseline_slowest = baseline_rates.into_iter().fold(f64::INFINITY, f64::min);
+    let candidate_slowest = candidate_rates.into_iter().fold(f64::INFINITY, f64::min);
+    println!(
+        "bench slower_of_three baseline_mib_s={baseline_slowest:.3} candidate_mib_s={candidate_slowest:.3} ratio={:.6}",
+        candidate_slowest / baseline_slowest
+    );
+}
+
+fn timed_runs(
+    name: &str,
+    mut run: impl FnMut() -> instrument_decoder_trial::BaselineSummary,
+) -> [f64; 3] {
+    let mut rates = [0.0; 3];
+    for (index, rate) in rates.iter_mut().enumerate() {
+        let started = Instant::now();
+        let summary = run();
+        let seconds = started.elapsed().as_secs_f64();
+        let measured_bytes = u32::try_from(summary.wire_bytes).unwrap_or(u32::MAX);
+        *rate = f64::from(measured_bytes) / (1024.0 * 1024.0) / seconds;
+        println!(
+            "bench parser={name} run={} elapsed_s={seconds:.6} mib_s={:.3} frames={} bytes={} digest=0x{:016X} diagnostics={} resets={} max_retained={}",
+            index + 1,
+            *rate,
+            summary.frames_emitted,
+            summary.wire_bytes,
+            summary.candidate_digest,
+            summary.diagnostics,
+            summary.resets,
+            summary.max_retained,
+        );
+        black_box(summary);
+    }
+    rates
+}
diff --git a/developer-simulation/runs/2026-08-17--mergeable-unique-installation-reach-rollups/BRIEF.md b/developer-simulation/runs/2026-08-17--mergeable-unique-installation-reach-rollups/BRIEF.md
new file mode 100644
index 0000000..6d81420
--- /dev/null
+++ b/developer-simulation/runs/2026-08-17--mergeable-unique-installation-reach-rollups/BRIEF.md
@@ -0,0 +1,82 @@
+# Mergeable unique-installation reach rollups
+
+## Developer role and Rust experience
+
+You are an analytics-infrastructure engineer for a business software company. You have eight years of production Kotlin and SQL experience and four months of Rust experience from batch utilities. You have no prior knowledge of the candidate library being evaluated; treat adoption as optional and start with the existing analytics problem.
+
+## Existing system and baseline implementation
+
+An advisory product-analytics dashboard reports unique active installations for each tenant and UTC hour. The nightly Kotlin job reads an immutable daily export and stores every 128-bit installation ID in an exact hash set keyed by `(tenant_id, hour)`. The result is trusted for capacity planning and product analysis, but never for billing, access control, fraud action, or customer-facing contractual counts.
+
+The exact set-based job is conceptually simple and supplies ground truth, but its peak memory now exceeds the batch container limit. Operations currently raises the limit or splits a day into manual tenant ranges. The prototype must retain an exact Rust set-based baseline as the oracle while evaluating a bounded, mergeable approximate summary.
+
+## Concrete pain
+
+The daily export is growing faster than container memory. Manual partitioning makes runtimes unpredictable and complicates retries, while summing exact per-shard counts double-counts installations seen in more than one shard. The team needs to know whether a compact mergeable summary can meet an explicit error contract, remain deterministic, and reduce memory enough to justify replacing the current advisory rollup.
+
+## Realistic workload and data shape
+
+Generate one deterministic 24-hour export with 240 tenants and therefore `240 × 24 = 5,760` `(tenant, hour)` buckets. For each tenant, assign:
+
+- 20 hourly buckets with exactly 1,000 distinct installation IDs: 4,800 buckets and 4,800,000 unique occurrences.
+- 3 hourly buckets with exactly 5,000 distinct installation IDs: 720 buckets and 3,600,000 unique occurrences.
+- 1 hourly bucket with exactly 10,000 distinct installation IDs: 240 buckets and 2,400,000 unique occurrences.
+- 1,200,000 additional records that duplicate an ID already present in the same bucket.
+
+The export therefore contains exactly 10,800,000 unique bucket occurrences and 12,000,000 records. Partition it round-robin into eight immutable source shards of exactly 1,500,000 records each. A record is `(tenant_id: u32, unix_hour: i64, installation_id: [u8; 16])`. Input order within each shard is deliberately shuffled.
+
+Also generate an accuracy matrix for 20 independent seeds. Each seed has 24 buckets at each true cardinality in `{100, 500, 1,000, 5,000, 10,000, 50,000}`, plus 25% within-bucket duplicates. This gives 144 measured buckets per seed and 2,880 error observations overall.
+
+## Operational constraints
+
+- Process the immutable export offline on one four-core machine with a 128 MiB peak resident-memory limit for the candidate.
+- A serialized approximate state for one bucket, including version and hash-seed identity, must be at most 4,160 bytes. Across 5,760 buckets this caps serialized bucket state at 23,961,600 bytes, about 22.85 MiB.
+- The eight shards must be aggregatable independently and mergeable without raw installation IDs.
+- Duplicate records must not change a bucket estimate or serialized state.
+- Hashing, serialization format, estimator calculation, and report ordering must be explicit and reproducible.
+- The candidate may use parallelism, but its final state and report must not depend on thread scheduling, shard order, input order, locale, clock, or network.
+- Invalid records fail the affected run before a complete report is published. Preserve any earlier complete report by writing the new report to a temporary path and renaming only after validation.
+
+## Measurable acceptance criteria
+
+1. Across the 2,880 accuracy observations, absolute relative error has a median at or below 1.5%, a 95th percentile at or below 3.5%, and a worst case at or below 8.0%. Report positive and negative error separately so bias is visible.
+2. On the 12,000,000-record load corpus, every estimate is compared with the exact Rust baseline and all 5,760 buckets appear exactly once in canonical `(tenant_id, unix_hour)` order.
+3. Direct aggregation and eight-shard aggregation produce byte-identical serialized state for every bucket. The same equality holds for 50 seeded permutations of shard merge order.
+4. Adding any number of within-bucket duplicates leaves serialized state byte-identical. Merging a state with itself is byte-identical to the original state.
+5. Each serialized bucket state is at most 4,160 bytes and contains enough version and hash identity information to reject incompatible merges.
+6. Candidate peak resident memory is at most 128 MiB and at least four times lower than the exact Rust baseline on the 12,000,000-record corpus, measured with the same build profile and harness.
+7. Candidate wall time is no more than 1.5 times the exact Rust baseline. Report the slower of three runs after one warm-up rather than only the best run.
+8. Two complete repeated runs with the same seed produce byte-identical state files, canonical report bytes, and summary digest.
+
+## Explicit non-goals
+
+- No billing, quota enforcement, access decision, fraud action, or exact-count claim.
+- No online query service, live database connection, dashboard UI, or distributed coordinator.
+- No late-event correction, deletion, sliding window, or partial-day mutation; the source is one immutable daily export.
+- No privacy or anonymity guarantee merely from hashing or approximation.
+- No attempt to estimate unions across different hours in the published report.
+- No requirement to preserve compatibility with the current Kotlin job’s internal serialization.
+
+## Smallest self-contained prototype boundary
+
+Build one Rust workspace containing: the deterministic load and accuracy generators, a streaming record reader, an exact hash-set baseline, one approximate per-bucket summary, deterministic state serialization, shard merge logic, canonical report publication, and a harness for correctness, error, state-size, memory, time, and failure tests. The output needs only per-bucket exact count, estimate, signed and absolute relative error, serialized size, and a run summary. Do not build a service or integrate a production datastore.
+
+## Baseline comparison
+
+Use the Rust exact hash-set implementation as the result oracle and performance baseline on identical records. Compare per-bucket counts, error distribution, peak resident memory, wall time, total serialized state, and behavior under shard-order permutations and duplicates. Separately note the current Kotlin job’s operational pain, but do not use cross-language timing as proof of an improvement. Adoption is justified only if the accuracy, merge, state-size, memory, determinism, and runtime gates all pass.
+
+## Fault and adversarial cases
+
+- All records in a shard belong to one tenant and hour; other shards remain normally distributed.
+- IDs are sequential, share a 120-bit prefix, are all-zero except for one changing byte, or arrive in reverse order.
+- Every record in a bucket is duplicated 1,000 times.
+- The same logical records arrive in 50 shuffled input orders and 50 shard merge orders.
+- Empty input; one bucket; the minimum and maximum declared tenant IDs; negative, overflowing, or out-of-day hours.
+- Truncated records, trailing bytes, unknown format version, and incompatible hash-seed identity during merge.
+- A process exit after temporary report creation but before rename; the prior complete report must remain intact.
+- State bytes with a changed version, impossible register value, checksum mismatch if a checksum is used, or truncated payload must be rejected without a partial report.
+- Accuracy seeds that expose unusually high positive or negative error must be retained as named regression cases, not discarded as outliers.
+
+## Evidence expected
+
+Provide exact build and run commands, toolchain and machine description, all generator and hash seeds, proof of the workload counts, the 2,880-row accuracy artifact or a machine-readable equivalent, percentile and bias summaries, per-bucket state-size maximum, direct-versus-merged byte digests, results for all 50 merge permutations, duplicate-idempotence results, peak-memory method and values for both implementations, and three timed runs for each after warm-up. Show that malformed and interrupted-publication cases leave no new complete report and preserve the previous one. State any failed gate and whether the result is no fit; statistical success on a handpicked example is not sufficient.
diff --git a/developer-simulation/runs/2026-08-17--mergeable-unique-installation-reach-rollups/Cargo.toml b/developer-simulation/runs/2026-08-17--mergeable-unique-installation-reach-rollups/Cargo.toml
new file mode 100644
index 0000000..6c7f854
--- /dev/null
+++ b/developer-simulation/runs/2026-08-17--mergeable-unique-installation-reach-rollups/Cargo.toml
@@ -0,0 +1,5 @@
+[package]
+name = "reach-rollup-lab"
+version = "0.1.0"
+edition = "2024"
+publish = false
diff --git a/developer-simulation/runs/2026-08-17--mergeable-unique-installation-reach-rollups/DISCOVERY.md b/developer-simulation/runs/2026-08-17--mergeable-unique-installation-reach-rollups/DISCOVERY.md
new file mode 100644
index 0000000..75b8072
--- /dev/null
+++ b/developer-simulation/runs/2026-08-17--mergeable-unique-installation-reach-rollups/DISCOVERY.md
@@ -0,0 +1,45 @@
+# Discovery log
+
+## Baseline-first hypothesis (recorded before component inspection)
+
+The existing problem is a set problem, so the first implementation boundary should be an exact Rust oracle: a map from `(tenant_id, unix_hour)` to `HashSet<[u8; 16]>`. It should stream the same records as the candidate, reject invalid/truncated input before publishing a report, and provide the trusted cardinality for every bucket. This preserves the conceptual simplicity of the Kotlin job while making its memory cost directly comparable on the same machine, input, executable, and release profile.
+
+My initial hypothesis is that the exact baseline will be operationally correct but fail the 128 MiB container constraint by a large margin on 10.8 million distinct bucket occurrences. The candidate should therefore be a fixed-width, mergeable distinct-count sketch. A 4,096-register HyperLogLog-style state is the smallest familiar design likely to satisfy both the 4,160-byte serialization ceiling and the stated error bounds. Register-wise maximum is commutative, associative, and idempotent, which should make shard and duplicate behavior deterministic. This is a hypothesis, not a result; the full accuracy matrix and load corpus must decide it.
+
+The baseline comes first in the test sequence and benchmark interface. The exact counter and shared record validation will be driven from failing tests before any approximate implementation is written. Candidate tests will then use literal small-set expectations and the exact baseline as a result oracle only where the true count is otherwise too large to list conveniently.
+
+## What I learned from the public entry points
+
+- The root README presents BogKit as three independent tools plus examples, not as a required all-in-one framework.
+- Fold incrementally materializes changing streams into durable views, including keyed aggregation and retraction.
+- ESE is a static text-embedding tool.
+- ANNy is an HNSW approximate-nearest-neighbor index.
+- The starter, chat, search, and timeseries examples emphasize durable mutable views and transactional updates. The requested input, by contrast, is one immutable offline export whose per-bucket state must have a strict portable byte bound.
+
+## Initial component fit, before implementation inspection
+
+- **Fold: possible but doubtful.** Keyed aggregation resembles the grouping problem, but persistence, change logs, and retractions are outside this prototype's immutable batch boundary. Its storage overhead and state encoding may also make the strict per-bucket-state and candidate-RSS evidence harder to isolate. I will inspect only the aggregation and serialization-facing public surface before deciding.
+- **ESE: no apparent fit.** Installation IDs are already fixed-width identifiers; no text embedding is needed.
+- **ANNy: no apparent fit.** This is cardinality estimation, not nearest-neighbor retrieval.
+
+No component will be used merely to demonstrate adoption. A standard-library-only prototype is the default if the smallest relevant component surface does not improve correctness, boundedness, determinism, or evidence quality.
+
+## Finishing criteria
+
+Done means the isolated prototype has test-first evidence for record validation, exact counting, approximate state construction/merge/serialization, deterministic generation and reporting, atomic publication, and all specified corrupt/fault cases; then passes formatting, all-target tests, strict Clippy, release demo, the 2,880-observation accuracy matrix, the complete 12-million-record comparison, duplicate and 50-permutation checks, two-run byte determinism, state-size bounds, and same-profile time/RSS measurement. Generated corpora, targets, binaries, databases, and temporary outputs must be removed, leaving only compact source, tests, documentation, fixtures, and machine-readable evidence under `simulation-output/`.
+
+## Ordered discovery so far
+
+1. The exact set is the only acceptable result oracle and must remain in the prototype even if it misses the memory gate.
+2. Mergeability must be over serialized bounded states, never by replaying raw IDs.
+3. Byte-identical direct/sharded states and duplicate idempotence favor a lattice-like register maximum, not a floating accumulator.
+4. Atomic publication is part of correctness, not a deployment detail.
+5. BogKit adoption is optional; the public examples suggest Fold solves a neighboring mutable-view problem, while ESE and ANNy solve unrelated problems.
+
+## Post-inspection component decision
+
+The inspected Fold `Aggregate` can express positive-only HLL insertion for this immutable subset; its signed-delta API is not itself incompatible because this trial never sends retractions. The supported `no_fit` boundary is that the public surfaces do not demonstrate exporting independently produced bounded per-bucket states and merging them externally by register-wise maximum without raw IDs. Fold would also add persistent `fjall` storage and transaction machinery that this batch proof does not need.
+
+`Aggregate` buffers cloned updates per key until commit. That source observation was not benchmarked in Fold, and smaller positive-only transactions may be viable, so it remains decision context rather than a finding or new API proposal. ESE and ANNy remain unrelated no-fits.
+
+The skeptical review later exposed a standalone prototype defect: v1 protected nested sketch bytes but not the outer tenant/hour binding. The repaired v2 state file checksums its complete outer header, bucket count, every key, and all nested states before constructing a decoded rollup.
diff --git a/developer-simulation/runs/2026-08-17--mergeable-unique-installation-reach-rollups/README.md b/developer-simulation/runs/2026-08-17--mergeable-unique-installation-reach-rollups/README.md
new file mode 100644
index 0000000..53418e8
--- /dev/null
+++ b/developer-simulation/runs/2026-08-17--mergeable-unique-installation-reach-rollups/README.md
@@ -0,0 +1,50 @@
+# Reach rollup lab prototype
+
+This archived Rust package compares an exact per-bucket set oracle with a bounded, mergeable approximate distinct counter over the workload in `BRIEF.md`. It uses no external crates and no BogKit component. The outer state-file format is version 2 and verifies a checksum binding its complete header, bucket count, every tenant/hour key, and every nested state before returning a rollup.
+
+## Regenerate correctness evidence
+
+```console
+CARGO_TARGET_DIR=/private/tmp/bogkit-reach-repair-target cargo run --locked --manifest-path developer-simulation/Cargo.toml --package reach-rollup-lab --release -- demo developer-simulation/runs/2026-08-17--mergeable-unique-installation-reach-rollups/evidence /private/tmp/bogkit-reach-repair-demo-temp
+```
+
+The demo procedurally streams the 12-million-record corpus; it does not write or retain the corpus. It removes temporary shard states before returning.
+
+## Verify source and tests
+
+```console
+cargo fmt --manifest-path developer-simulation/Cargo.toml --package reach-rollup-lab -- --check
+CARGO_TARGET_DIR=/private/tmp/bogkit-reach-repair-target cargo test --locked --manifest-path developer-simulation/Cargo.toml --package reach-rollup-lab --release --all-targets --all-features
+CARGO_TARGET_DIR=/private/tmp/bogkit-reach-repair-target cargo clippy --locked --manifest-path developer-simulation/Cargo.toml --package reach-rollup-lab --all-targets --all-features -- -D warnings -D clippy::all -D clippy::pedantic
+```
+
+## Reproduce time and memory measurements
+
+Run one unmeasured warm-up for each command, then run each command three times with `/usr/bin/time -l`:
+
+```console
+CARGO_TARGET_DIR=/private/tmp/bogkit-reach-repair-target cargo build --locked --manifest-path developer-simulation/Cargo.toml --package reach-rollup-lab --release --all-targets
+/private/tmp/bogkit-reach-repair-target/release/reach-rollup-lab bench-exact
+/private/tmp/bogkit-reach-repair-target/release/reach-rollup-lab bench-candidate
+/usr/bin/time -l /private/tmp/bogkit-reach-repair-target/release/reach-rollup-lab bench-exact
+/usr/bin/time -l /private/tmp/bogkit-reach-repair-target/release/reach-rollup-lab bench-candidate
+```
+
+Use the slower wall time from each three-run series. `evidence/PERFORMANCE.md` records the completed measurements and machine details.
+
+The archive uses the shared nested workspace's release profile rather than the
+trial's temporary child profile. A fresh normalized-profile run on the same
+host recorded exact wall times of 1.03/1.09/1.06 seconds, candidate wall times
+of 0.54/0.53/0.53 seconds, and current-profile maximum resident sizes of
+645,136,384 bytes exact versus 49,594,368 bytes candidate. Deterministic output
+digests remained `6efde7109d2ddba5` exact and `ecda69b5ba1467d1` candidate.
+
+## Retained evidence
+
+- `evidence/accuracy-tuning.tsv`: 2,880 rows from the specified matrix used to diagnose the estimator transition.
+- `evidence/accuracy-heldout.tsv`: 2,880 rows from a different, fixed generator seed not used for further tuning.
+- `evidence/load-report.tsv`: 5,760 canonical `(tenant_id, unix_hour)` result rows.
+- `evidence/summary.txt`: state-file version, seeds, accuracy/bias statistics, counts, sizes, deterministic digests, and boolean gate results.
+- `evidence/PERFORMANCE.md`: warm-up/timing/RSS method and all six measured runs.
+
+Remove `/private/tmp/bogkit-reach-repair-target` after verification; it is deliberately outside this prototype workspace.
diff --git a/developer-simulation/runs/2026-08-17--mergeable-unique-installation-reach-rollups/TDD_LOG.md b/developer-simulation/runs/2026-08-17--mergeable-unique-installation-reach-rollups/TDD_LOG.md
new file mode 100644
index 0000000..a892f6c
--- /dev/null
+++ b/developer-simulation/runs/2026-08-17--mergeable-unique-installation-reach-rollups/TDD_LOG.md
@@ -0,0 +1,213 @@
+# Test-first development log
+
+All commands below were run from `simulation-output/` with the build target isolated at `/private/tmp/bogkit-reach-target`.
+
+## Cycle 1: exact set baseline and routing validation
+
+**Breaks named before the tests:** counting records instead of distinct IDs; accepting a tenant/hour outside the declared day; overflowing the day boundary; excluding the minimum or maximum declared tenant.
+
+**RED command**
+
+```console
+CARGO_TARGET_DIR=/private/tmp/bogkit-reach-target cargo test --test baseline
+```
+
+**Observed RED:** exit 101. Rust reported unresolved `BucketKey`, `DayWindow`, `ExactRollup`, and `Record` imports. This was the expected missing-feature failure from an otherwise valid test crate.
+
+**GREEN change:** added only the record/key model, checked day-window validation, and exact map-of-sets behavior required by the three tests.
+
+**GREEN command/result:** the same command exited 0; 3 tests passed.
+
+## Cycle 2: bounded mergeable sketch
+
+**Breaks named before the tests:** biased hash/rank calculation; loss of duplicate idempotence; order-sensitive merge; unbounded state; missing version/hash identity; and accepting corrupt or truncated state.
+
+**RED command**
+
+```console
+CARGO_TARGET_DIR=/private/tmp/bogkit-reach-target cargo test --test sketch
+```
+
+**Observed RED:** exit 101. Rust reported missing `HllState` and `IncompatibleState`, the intended absent candidate surface.
+
+**GREEN change:** added a 4,096-register state, explicit fixed-seed 128-bit-ID hash, register-wise maximum merge, corrected estimator, and a checksummed 4,124-byte encoding with format and hash identity.
+
+**GREEN command/result:** the same command exited 0; 4 tests passed.
+
+## Cycle 3: deterministic corpus and streaming record validation
+
+**Breaks named before the tests:** workload count drift; uneven or sorted shards; incorrect bucket boundaries; novel IDs in the duplicate tail; buffered-only parsing; and accepting unknown, truncated, trailing, or out-of-window records.
+
+**RED command**
+
+```console
+CARGO_TARGET_DIR=/private/tmp/bogkit-reach-target cargo test --test generator_reader
+```
+
+**Observed RED:** exit 101. Rust reported the generator constants/type and record encoding/streaming functions were missing.
+
+**GREEN change:** added a procedural 12-million-record corpus with exact equal shuffled shards, fixed cardinality layout and deterministic duplicates, plus a versioned streaming reader that validates before forwarding each record.
+
+**GREEN command/result:** the initial GREEN run exposed one unused import warning; after a no-behavior refactor, the same command exited 0 with 3 tests passed and no warnings.
+
+## Cycle 4: canonical rollup, merge-order proof, and atomic reporting
+
+**Breaks named before the tests:** hidden dependence on input/shard/map order; missing or reordered report rows; digesting different bytes; and overwriting a prior report before validation or final rename.
+
+**RED command**
+
+```console
+CARGO_TARGET_DIR=/private/tmp/bogkit-reach-target cargo test --test rollup_report
+```
+
+The first compile also exposed ambiguous integer types in the test fixture. I corrected that test error and reran RED. **Observed valid RED:** exit 101 with only the intended missing `ApproxRollup`, publication, and digest surface.
+
+**GREEN change:** added canonical keyed candidate rollups, merge compatibility checks, deterministic state/report bytes, stable digesting, report/oracle completeness validation, and temporary-file publication with rename only after validation.
+
+**GREEN command/result:** the same command exited 0; 3 tests passed, including 50 input permutations and 50 shard-merge permutations.
+
+## Cycle 5: complete accuracy matrix and bias evidence
+
+**Break named before the test:** a candidate that meets the error contract only for handpicked cardinalities or seeds, or emits incomplete/nondeterministic evidence.
+
+**RED command**
+
+```console
+CARGO_TARGET_DIR=/private/tmp/bogkit-reach-target cargo test --test accuracy
+```
+
+**Observed RED:** exit 101 with the intended missing `run_accuracy_matrix` surface.
+
+**GREEN change:** added all 20 seeds × 6 cardinalities × 24 buckets, 25% duplicate replay, nearest-rank percentiles, separate signed-bias summaries, named worst positive/negative cases, and deterministic row-level TSV evidence.
+
+**GREEN verification:** the first run correctly failed the p95 gate (`3.6115%`) and exposed transition-range bias concentrated at cardinality 10,000. Switching the estimator to the independently derivable empty-register estimate through 12,000 removed that bias; the acceptance test then passed. Temporary diagnostic printing was removed before the final GREEN run.
+
+## Cycle 6: shard-state transport and compact oracle
+
+**Breaks named before the tests:** shard state that cannot be decoded safely; accepting corrupt, truncated, or wrong-seed rollups; retaining 10.8 million IDs during candidate comparison; and losing report completeness after compacting the oracle to exact counts.
+
+**RED command**
+
+```console
+CARGO_TARGET_DIR=/private/tmp/bogkit-reach-target cargo test --test state_file
+```
+
+**Observed RED:** exit 101 with the intended missing state-file decoder, exact-count compaction, and count-based report methods.
+
+**GREEN change:** added strict canonical state-file decoding with nested state validation and seed checks, exact-set consumption into compact counts, and complete count-based report generation.
+
+**GREEN command/result:** the same command exited 0; 2 tests passed.
+
+## Cycle 7: full 12-million-record correctness and determinism harness
+
+**Break named before the test:** logic that works only on small fixtures but drifts in workload counts, duplicate behavior, shard merging, 50 merge orders, or complete-run byte determinism at the representative scale.
+
+**RED command**
+
+```console
+CARGO_TARGET_DIR=/private/tmp/bogkit-reach-target cargo test --release --test load_contract
+```
+
+**Observed RED:** exit 101 with only the intended missing `run_load_verification` entry point.
+
+**GREEN change:** added a procedural full-load harness that runs the exact oracle, compacts it to counts, verifies direct/unique/sharded/repeated candidate states, checks 50 full-scale shard orders, produces the canonical 5,760-row report and digests, and removes temporary shard states on every return path.
+
+**GREEN command/result:** the release test exited 0 after one 19.38-second representative run; all asserted workload and non-performance gates passed, and its external temporary directory was absent at return.
+
+## Cycle 8: comparable isolated benchmark modes
+
+**Break named before the test:** exact and candidate timing/RSS commands that process different records, omit full outputs, or allow the optimizer to discard results.
+
+**RED command**
+
+```console
+CARGO_TARGET_DIR=/private/tmp/bogkit-reach-target cargo test --release --test benchmark
+```
+
+**Observed RED:** exit 101 with the intended missing exact/candidate benchmark entry points.
+
+**GREEN change:** added isolated benchmark functions over the identical procedural shards, with complete bucket/result digests printed by the caller. The representative test is intentionally ignored in routine suites and is run explicitly in release mode for evidence.
+
+**GREEN command/result:** the same command exited 0 with the representative test compiled and explicitly reported as ignored.
+
+## Cycle 9: deterministic command-line regeneration recipe
+
+**Breaks named before the tests:** evidence that requires source edits to regenerate, and a typo that silently launches an expensive mode.
+
+**RED command**
+
+```console
+CARGO_TARGET_DIR=/private/tmp/bogkit-reach-target cargo test --test cli
+```
+
+**Observed RED:** exit 101 because the intended binary target did not yet exist.
+
+**GREEN change:** added explicit help, exact/candidate benchmark commands, and one release demo command that writes tuning, held-out, load-row, and summary evidence atomically.
+
+**GREEN command/result:** the same command exited 0; 2 CLI behavior tests passed.
+
+## Cycle 10: adversarial IDs and skewed shards
+
+**Break named before the test:** hashing and merging that works for balanced pseudorandom examples but fails on sequential IDs, a shared 120-bit prefix, one-changing-byte IDs, reversed input, 1,000 duplicate replays, or one hot shard.
+
+**RED command**
+
+```console
+CARGO_TARGET_DIR=/private/tmp/bogkit-reach-target cargo test --test adversarial
+```
+
+**Observed RED:** exit 101 with the intended missing adversarial-verification entry point.
+
+**GREEN change:** added explicit pattern, order, duplicate, skewed-shard, empty-input, and one-bucket checks over the real candidate.
+
+**GREEN command/result:** the same command exited 0; the adversarial behavior test passed.
+
+## Initial pre-review verification after GREEN
+
+```console
+cargo fmt --all -- --check
+CARGO_TARGET_DIR=/private/tmp/bogkit-reach-target cargo test --release --all-targets --all-features
+CARGO_TARGET_DIR=/private/tmp/bogkit-reach-target cargo clippy --all-targets --all-features -- -D warnings -D clippy::all -D clippy::pedantic
+CARGO_TARGET_DIR=/private/tmp/bogkit-reach-target cargo run --release -- demo evidence /private/tmp/bogkit-reach-demo-temp
+```
+
+- Formatting check: passed after applying `cargo fmt --all` once.
+- Release all-target tests: 20 passed, 0 failed, 1 representative benchmark test intentionally ignored; the same benchmark entry points were run separately for one warm-up plus three timed/RSS samples each.
+- Strict Clippy: passed with warnings, all, and pedantic denied. The crate records six narrowly scoped pedantic allowances for bounded numeric casts, public prototype error/panic prose, simple fixed-register byte counting, similar evidence names, and boolean-heavy evidence result records.
+- Release demo: passed and atomically regenerated two 2,880-row accuracy artifacts, one 5,760-row load report, and the summary evidence. The temporary shard directory was removed.
+- Accuracy disclosure: the original specified matrix exposed the 10,000-cardinality transition bias and was therefore used while selecting the final 12,000 transition threshold. It is labeled `tuning`; a different predeclared generator seed was then run once as held-out validation and was not used for further tuning.
+
+## Skeptical-review repair cycle: complete state-file binding
+
+**Break named before the test:** valid-range bit corruption that changes an outer tenant or hour while leaving the nested sketch bytes and nested checksum untouched.
+
+**RED command**
+
+```console
+CARGO_TARGET_DIR=/private/tmp/bogkit-reach-repair-target cargo test --test state_file state_file_checksum_binds_valid_in_window_tenant_and_hour_keys -- --nocapture
+```
+
+**Observed RED:** exit 101. The new regression expected complete-binding format version 2 but observed version 1, precisely identifying the unprotected outer format.
+
+**GREEN change:** versioned the state file to v2, added an eight-byte file checksum over magic, version, reserved bytes, bucket count, every tenant/hour key, and all nested state bytes, and made decoding verify length and that checksum before constructing any rollup.
+
+**GREEN command/result:** the complete `state_file` test target exited 0; 3 tests passed, including valid-window tenant mutation, valid-window hour mutation, checksum mutation, round-trip, version, wrong-seed, and truncation checks.
+
+## Final skeptical-review repair verification
+
+```console
+cargo fmt --all -- --check
+CARGO_TARGET_DIR=/private/tmp/bogkit-reach-repair-target cargo test --release --all-targets --all-features
+CARGO_TARGET_DIR=/private/tmp/bogkit-reach-repair-target cargo clippy --all-targets --all-features -- -D warnings -D clippy::all -D clippy::pedantic
+CARGO_TARGET_DIR=/private/tmp/bogkit-reach-repair-target cargo run --release -- demo evidence /private/tmp/bogkit-reach-repair-demo-temp
+```
+
+- Formatting: passed.
+- Release all-target tests: 21 passed, 0 failed, 1 benchmark wrapper intentionally ignored; the exact benchmark entry points were separately run after one warm-up and measured three times each.
+- Strict Clippy with warnings, all, and pedantic denied: passed.
+- Corrected release demo: passed. It reran both 2,880-row matrices, the exact 12-million-record oracle, duplicate and self-merge checks, eight-shard direct equality, 50 full-load merge orders, repeated state/report bytes, malformed/publication tests through the release suite, and adversarial cases. Temporary shard states were removed.
+- Corrected v2 state digest: `ecda69b5ba1467d1`.
+- Corrected repeated summary digest: `ca4d7c625e0eec4d`.
+- Canonical report digest remained `6219b8fa82ef6a79` because estimates and row ordering did not change.
+- Corrected slower-of-three exact/candidate wall times: `1.00 s` / `0.55 s`; candidate ratio `0.550×`.
+- Corrected largest candidate peak RSS: `49,627,136` bytes; conservative reduction against the smallest exact peak is `12.61×`.
diff --git a/developer-simulation/runs/2026-08-17--mergeable-unique-installation-reach-rollups/TRIAL_REPORT.md b/developer-simulation/runs/2026-08-17--mergeable-unique-installation-reach-rollups/TRIAL_REPORT.md
new file mode 100644
index 0000000..b88672d
--- /dev/null
+++ b/developer-simulation/runs/2026-08-17--mergeable-unique-installation-reach-rollups/TRIAL_REPORT.md
@@ -0,0 +1,137 @@
+# Trial 2 report: mergeable unique-installation reach rollups
+
+## Outcome
+
+**Outcome: `no_fit`.**
+
+**Execution status: `DONE_WITH_CONCERNS`.** The standalone candidate passes the requested correctness, accuracy, merge, state-size, measured-memory, and runtime gates on the available host. No BogKit component improves the required portable external shard-merge boundary enough to justify adoption.
+
+The remaining evidence concern is environmental: the available Mac has 14 cores rather than four, although both benchmark paths are single-threaded, and 128 MiB was checked by measured peak RSS rather than enforced as a hard container limit.
+
+## Decision
+
+The smallest useful prototype is a standard-library-only, 4,096-register HyperLogLog-style summary. Each bucket's nested state is 4,124 bytes and includes sketch version, precision, hash identity, checksum, and registers. The outer state file is version 2 and adds a checksum over its complete binding: magic, outer version, reserved bytes, bucket count, every tenant/hour key, and every nested state byte. Decoding verifies outer length and checksum before constructing or returning any rollup.
+
+The candidate is suitable only for the brief's advisory immutable daily rollup. It is not exact and must not be used for billing, access, fraud, quotas, privacy, or contractual counts.
+
+### Component decision
+
+- **Fold:** positive-only `Aggregate` updates can express per-key HLL insertion for this immutable subset. Its aggregate contract is not incompatible. Fold does not, however, demonstrate the required portable export/import and register-wise merge of independently produced shard states without raw records. It also adds persistent `fjall` storage and transaction machinery that the self-contained batch proof does not need. Outcome: no fit.
+- **ESE:** text embedding is unrelated to fixed-width installation-ID cardinality. Outcome: no fit.
+- **ANNy:** nearest-neighbor search is unrelated to set cardinality. Outcome: no fit.
+
+## Acceptance results
+
+| Gate | Corrected result | Evidence |
+|---|---:|---|
+| Tuning matrix, 2,880 rows: median / p95 / worst absolute error | **0.858% / 2.671% / 5.626% — pass** | `evidence/accuracy-tuning.tsv` |
+| Held-out matrix, 2,880 rows: median / p95 / worst | **0.858% / 2.708% / 6.124% — pass** | `evidence/accuracy-heldout.tsv` |
+| Full load records / exact unique bucket occurrences | **12,000,000 / 10,800,000 — pass** | `evidence/summary.txt` |
+| Full load canonical rows | **5,760 exactly once — pass** | `evidence/load-report.tsv` |
+| Full-load median / p95 / worst error | **0.802% / 2.328% / 6.321%** | `evidence/summary.txt` |
+| Direct vs eight-shard state | **byte-identical — pass** | corrected state digest `ecda69b5ba1467d1` |
+| 50 seeded full-load shard merge orders | **all identical — pass** | summary + release test |
+| Duplicates, 1,000 replays, and self-merge | **byte-identical — pass** | tests + summary |
+| Two complete repeated state/report runs | **byte-identical — pass** | repeated flags; summary digest `ca4d7c625e0eec4d` |
+| Outer key-to-state binding | **v2 checksum rejects valid-window tenant/hour mutations — pass** | `tests/state_file.rs` |
+| Nested version/hash/length/checksum/register validation | **pass** | serialization tests |
+| Maximum nested bucket state | **4,124 bytes — pass** | 36 bytes below 4,160-byte cap |
+| Total nested bucket state | **23,754,240 bytes — pass** | below 23,961,600-byte cap |
+| Candidate peak RSS | **49,627,136 bytes (47.33 MiB) — pass** | corrected three-run series |
+| Conservative memory improvement | **12.61× — pass** | smallest exact peak / largest candidate peak |
+| Slower-of-three wall ratio | **0.55 / 1.00 = 0.550× — pass** | below 1.5× ceiling |
+| Invalid/truncated/trailing input and invalid publication | **rejected; prior report preserved — pass** | release tests |
+| Sequential/prefix/one-byte/reverse/skew cases | **pass** | adversarial test + summary |
+
+Bias remains visible rather than being folded into absolute error. The held-out matrix has 1,548 nonnegative observations with mean `+1.0418%` and 1,332 negative observations with mean `-1.1276%`. The load corpus has 2,895 nonnegative buckets with mean `+0.9668%` and 2,865 negative buckets with mean `-0.9513%`.
+
+## Ordered discovery and decision audit
+
+1. The exact Rust map of sets remained the result oracle. It is correct but measured 596.8–617.3 MiB peak RSS in the corrected three-run series.
+2. Register-wise maximum was selected because it makes state union associative, commutative, and idempotent; duplicate insertion and self-merge preserve bytes.
+3. Public entry points made ESE and ANNy immediate no-fits. Fold remained plausible enough to inspect its keyed aggregation, transaction, table, serialization, and storage surfaces.
+4. Fold can perform positive-only HLL updates for this immutable subset. The supported no-fit is narrower: no demonstrated portable independently produced partial-state merge, plus unnecessary persistence and transaction machinery.
+5. Source inspection shows `Aggregate` buffers cloned per-key updates until transaction commit. This was not benchmarked through Fold, a caller could use smaller positive-only transactions, and no batch-sizing or mergeable-state API conclusion is promoted from this single source. It is decision context, not a retained finding or product candidate.
+6. The specified accuracy matrix exposed transition bias during development. That matrix is labeled tuning; a different fixed generator seed was then run without further estimator changes and is retained separately as held-out evidence.
+7. The initial skeptical review found that v1 nested checksums did not bind outer tenant/hour keys. A test-first v2 repair now checks the complete file binding before decoding any row. Every affected full-scale state, digest, demo, and benchmark result was regenerated.
+8. Full-scale 50-order proof uses temporary shard-state files so eight full rollups are not retained simultaneously. The harness removes its temporary directory on return.
+
+## Findings
+
+### F1 — v1 state files allowed valid-range key rebinding
+
+- Category: **correctness defect**
+- Severity: **Important**
+- Confidence: **High**
+- Attribution: standalone prototype defect; not a BogKit defect.
+- Reproduction: serialize one bucket for tenant 0/hour 0 inside a window permitting tenant 1 and hour 1, mutate the unprotected v1 outer tenant or hour bytes, and decode. The initial reviewer observed successful decoding because only nested sketch bytes were checksummed. The retained regression performs both valid-window mutations against v2 and requires rejection.
+- Smallest improvement: version and checksum the complete outer key-to-state binding, and verify it before constructing a rollup. **Implemented in v2 and covered by regression tests.**
+
+### F2 — BogKit does not satisfy the portable external shard-merge boundary
+
+- Category: **poor product fit**
+- Severity: **Important**
+- Confidence: **High**
+- Attribution: scenario-specific BogKit fit; not a BogKit correctness defect.
+- Reproduction: independently aggregate the eight immutable shards, then attempt to use the demonstrated Fold interfaces to export bounded portable per-bucket HLL states and merge them by register-wise maximum in another process without replaying raw IDs. The public examples and inspected surfaces do not demonstrate that boundary. Positive-only local Fold aggregation itself is possible.
+- Smallest improvement: keep this prototype standalone and dependency-free. No new BogKit merge primitive or product candidate is proposed from this one trial.
+
+### F3 — External partial-state merge capability is unclear at public entry points
+
+- Category: **documentation gap**
+- Severity: **Important**
+- Confidence: **High**
+- Attribution: BogKit documentation signal; not a BogKit correctness defect.
+- Reproduction: start at the root README and starter/timeseries examples and determine whether independently produced bounded accumulator states can be exported, compatibility-checked, and merged without raw records. Source inspection is required and no supported recipe is presented.
+- Smallest improvement: extend the existing capability-matrix documentation theme to state clearly whether append-only aggregation, retraction, external partial-state merge, deterministic portable serialization, and per-key state bounds are supported. Do not create a new one-source merge/batching candidate.
+
+No Critical finding was observed. The only prototype correctness defect was F1 and is repaired. No BogKit correctness defect was established.
+
+## Failure semantics verified after the repair
+
+- Negative, overflowing, or out-of-day hours and out-of-range tenants fail before forwarding a record.
+- Unknown record version, nonzero reserved bytes, truncation, and trailing bytes fail the run.
+- State-file v2 rejects changed outer version, reserved metadata, bucket-count/length mismatch, file-checksum mismatch, valid-window tenant/hour bit mutations, duplicate/noncanonical keys, nested unknown version, wrong hash identity, nested checksum mismatch, impossible register values, and truncated nested payload.
+- Complete-file integrity is verified before a rollup is constructed or returned.
+- Candidate/oracle bucket mismatch prevents publication.
+- Final report publication uses a validated temporary file and same-directory rename; invalid input and simulated interruption preserve the earlier complete report.
+- Empty input and one bucket remain defined.
+
+## Accuracy history and evidence limits
+
+The specified matrix influenced the empty-register transition threshold and is therefore tuning evidence, not independent validation. The held-out matrix uses a different fixed seed in the same generator family; it passed without further change, but it is not a production-distribution guarantee or independently verifiable preregistration. The addressed tuning history is not a remaining finding.
+
+Other limits:
+
+- Re-run on the intended four-core container image with an enforced 128 MiB limit before production adoption.
+- Validate real export ID distributions and tenant skew without changing the frozen regression cases.
+- The corpus is generated procedurally and never retained. Reader failure semantics are tested separately; timing compares identical generation plus aggregation, not filesystem throughput.
+- Outer and nested FNV checksums detect accidental corruption; they are not cryptographic authentication, privacy, or anonymity mechanisms.
+- Same-process interruption and same-filesystem rename do not prove process-kill, directory-fsync, power-loss, or target-filesystem durability.
+- The prototype intentionally excludes late events, deletion, sliding windows, online service behavior, and distributed coordination.
+
+## Dependencies and reproducibility
+
+- Standard library only; no third-party dependency and no network.
+- Toolchain: Rust 1.95.0, LLVM 22.1.2, `aarch64-apple-darwin`.
+- Hash seed: `0xbb67ae8584caa73b`.
+- Load generator seed: `0x243f6a8885a308d3`.
+- Tuning generator seed: `0x13198a2e03707344`.
+- Held-out generator seed: `0x082efa98ec4e6c89`.
+- State-file version: 2.
+- Exact commands are retained in `README.md`, `TDD_LOG.md`, and `evidence/PERFORMANCE.md`.
+
+## Corrected retained-evidence hashes
+
+- `accuracy-tuning.tsv`: SHA-256 `76452306e95ef91b6bbf40faf48fc0047f3ff819353b81d4ad6d2bfb16eab204` (2,880 data rows).
+- `accuracy-heldout.tsv`: SHA-256 `d93663b394eb5c1d7f02a4e5bd12ee57068fa9080120a1088a833adaf727d1ca` (2,880 data rows).
+- `load-report.tsv`: SHA-256 `e57a1e1f2b94241ed9cf9a1401c6b2c8d2fba7a376e55716d8d4741e02537ed2` (5,760 data rows; unchanged because estimates did not change).
+- `summary.txt`: SHA-256 `b6f2a6710edda01fc030c4ba06ec18ae6deba478ad1f3eba1b8af68bf1d70906`.
+- `PERFORMANCE.md`: SHA-256 `105ecf633b6265a3b806a3b8b1194f30edbbb05bc829133a8d92bd4aab77b775`.
+- Internal v2 full state digest: `ecda69b5ba1467d1`.
+- Internal canonical report digest: `6219b8fa82ef6a79`.
+- Internal repeated summary digest: `ca4d7c625e0eec4d`.
+
+## Cleanup proof
+
+The procedural 12-million-record corpus is never written. Successful full-scale runs remove temporary shard states. Final cleanup removes external Cargo targets and demo directories. Only source, tests, documentation, the isolated lockfile, and compact evidence remain under `simulation-output/`; no BogKit core, examples, Git, GitHub, or automation file is changed.
diff --git a/developer-simulation/runs/2026-08-17--mergeable-unique-installation-reach-rollups/evidence/PERFORMANCE.md b/developer-simulation/runs/2026-08-17--mergeable-unique-installation-reach-rollups/evidence/PERFORMANCE.md
new file mode 100644
index 0000000..bd4c9f6
--- /dev/null
+++ b/developer-simulation/runs/2026-08-17--mergeable-unique-installation-reach-rollups/evidence/PERFORMANCE.md
@@ -0,0 +1,60 @@
+# Performance evidence
+
+## Method
+
+Both implementations were built once with the same Cargo release profile and invoked through the same binary over the same procedurally generated, shuffled 12,000,000-record corpus. Both modes are single-threaded. Each mode received one unmeasured warm-up, followed by three `/usr/bin/time -l` runs. The comparison uses the slower wall time from each series, as required. `maximum resident set size` is the macOS process peak in bytes.
+
+The sandboxed `time -l` call could not query `kern.clockrate`, so the measured series was rerun outside the sandbox; no network or external input was used.
+
+## Exact baseline
+
+Command:
+
+```console
+/usr/bin/time -l /private/tmp/bogkit-reach-repair-target/release/reach-rollup-lab bench-exact
+```
+
+Every run reported 12,000,000 records, 5,760 buckets, 10,800,000 unique bucket occurrences, and digest `6efde7109d2ddba5`.
+
+| Run | Wall (s) | Peak RSS (bytes) |
+|---:|---:|---:|
+| 1 | 1.00 | 640,663,552 |
+| 2 | 0.99 | 647,315,456 |
+| 3 | 1.00 | 625,754,112 |
+
+Slower wall time: **1.00 s**.
+
+## Candidate
+
+Command:
+
+```console
+/usr/bin/time -l /private/tmp/bogkit-reach-repair-target/release/reach-rollup-lab bench-candidate
+```
+
+Every run reported 12,000,000 records, 5,760 buckets, a 4,124-byte maximum bucket state, and v2 complete-binding state digest `ecda69b5ba1467d1`.
+
+| Run | Wall (s) | Peak RSS (bytes) |
+|---:|---:|---:|
+| 1 | 0.55 | 49,627,136 |
+| 2 | 0.55 | 49,627,136 |
+| 3 | 0.55 | 49,610,752 |
+
+Slower wall time: **0.55 s**.
+
+## Gate calculations
+
+- Candidate peak RSS: 49,627,136 bytes = 47.33 MiB, below 128 MiB.
+- Conservative memory ratio using the smallest measured exact peak and largest candidate peak: 625,754,112 / 49,627,136 = **12.61× lower**, above the required 4×.
+- Slower-run wall ratio: 0.55 / 1.00 = **0.550×**, below the maximum 1.5×.
+- No cross-language timing was used.
+
+## Toolchain and machine
+
+- `rustc 1.95.0 (59807616e 2026-04-14)`, LLVM 22.1.2, `aarch64-apple-darwin`.
+- macOS 26.5.2 (25F84), Darwin 25.5.0, model `Mac16,11`.
+- 14 physical / 14 logical cores, 64 GiB memory.
+
+## Evidence limit
+
+The available host is 14-core rather than the requested four-core machine. Both implementations are single-threaded, so extra cores did not accelerate either measured path, but this is not a literal four-core-host reproduction. The 128 MiB criterion is supported by measured process RSS, not by running inside a hard 128 MiB container limit.
diff --git a/developer-simulation/runs/2026-08-17--mergeable-unique-installation-reach-rollups/evidence/accuracy-heldout.tsv b/developer-simulation/runs/2026-08-17--mergeable-unique-installation-reach-rollups/evidence/accuracy-heldout.tsv
new file mode 100644
index 0000000..78209e2
--- /dev/null
+++ b/developer-simulation/runs/2026-08-17--mergeable-unique-installation-reach-rollups/evidence/accuracy-heldout.tsv
@@ -0,0 +1,2881 @@
+seed	cardinality	bucket	estimate	signed_relative_error	absolute_relative_error
+0	100	0	99.191405	-0.008085948	0.008085948
+0	100	1	99.191405	-0.008085948	0.008085948
+0	100	2	100.216046	0.002160456	0.002160456
+0	100	3	100.216046	0.002160456	0.002160456
+0	100	4	100.216046	0.002160456	0.002160456
+0	100	5	100.216046	0.002160456	0.002160456
+0	100	6	98.167021	-0.018329790	0.018329790
+0	100	7	98.167021	-0.018329790	0.018329790
+0	100	8	101.240942	0.012409424	0.012409424
+0	100	9	100.216046	0.002160456	0.002160456
+0	100	10	98.167021	-0.018329790	0.018329790
+0	100	11	98.167021	-0.018329790	0.018329790
+0	100	12	101.240942	0.012409424	0.012409424
+0	100	13	100.216046	0.002160456	0.002160456
+0	100	14	100.216046	0.002160456	0.002160456
+0	100	15	101.240942	0.012409424	0.012409424
+0	100	16	100.216046	0.002160456	0.002160456
+0	100	17	100.216046	0.002160456	0.002160456
+0	100	18	99.191405	-0.008085948	0.008085948
+0	100	19	98.167021	-0.018329790	0.018329790
+0	100	20	101.240942	0.012409424	0.012409424
+0	100	21	101.240942	0.012409424	0.012409424
+0	100	22	100.216046	0.002160456	0.002160456
+0	100	23	99.191405	-0.008085948	0.008085948
+0	500	0	504.875651	0.009751302	0.009751302
+0	500	1	502.613917	0.005227834	0.005227834
+0	500	2	495.836199	-0.008327602	0.008327602
+0	500	3	506.006986	0.012013973	0.012013973
+0	500	4	502.613917	0.005227834	0.005227834
+0	500	5	504.875651	0.009751302	0.009751302
+0	500	6	508.270595	0.016541190	0.016541190
+0	500	7	502.613917	0.005227834	0.005227834
+0	500	8	506.006986	0.012013973	0.012013973
+0	500	9	503.744628	0.007489256	0.007489256
+0	500	10	486.816652	-0.026366696	0.026366696
+0	500	11	500.353431	0.000706863	0.000706863
+0	500	12	506.006986	0.012013973	0.012013973
+0	500	13	499.223656	-0.001552688	0.001552688
+0	500	14	500.353431	0.000706863	0.000706863
+0	500	15	509.402869	0.018805738	0.018805738
+0	500	16	501.483518	0.002967036	0.002967036
+0	500	17	504.875651	0.009751302	0.009751302
+0	500	18	499.223656	-0.001552688	0.001552688
+0	500	19	501.483518	0.002967036	0.002967036
+0	500	20	507.138634	0.014277269	0.014277269
+0	500	21	501.483518	0.002967036	0.002967036
+0	500	22	501.483518	0.002967036	0.002967036
+0	500	23	507.138634	0.014277269	0.014277269
+0	1000	0	1007.300678	0.007300678	0.007300678
+0	1000	1	1011.138879	0.011138879	0.011138879
+0	1000	2	1004.743874	0.004743874	0.004743874
+0	1000	3	979.263232	-0.020736768	0.020736768
+0	1000	4	1004.743874	0.004743874	0.004743874
+0	1000	5	1021.391701	0.021391701	0.021391701
+0	1000	6	1002.188665	0.002188665	0.002188665
+0	1000	7	989.436475	-0.010563525	0.010563525
+0	1000	8	1017.543884	0.017543884	0.017543884
+0	1000	9	983.075238	-0.016924762	0.016924762
+0	1000	10	1004.743874	0.004743874	0.004743874
+0	1000	11	1003.466070	0.003466070	0.003466070
+0	1000	12	986.890795	-0.013109205	0.013109205
+0	1000	13	1000.911658	0.000911658	0.000911658
+0	1000	14	1002.188665	0.002188665	0.002188665
+0	1000	15	981.804175	-0.018195825	0.018195825
+0	1000	16	972.917762	-0.027082238	0.027082238
+0	1000	17	991.983739	-0.008016261	0.008016261
+0	1000	18	1006.022077	0.006022077	0.006022077
+0	1000	19	997.083024	-0.002916976	0.002916976
+0	1000	20	981.804175	-0.018195825	0.018195825
+0	1000	21	1011.138879	0.011138879	0.011138879
+0	1000	22	1007.300678	0.007300678	0.007300678
+0	1000	23	989.436475	-0.010563525	0.010563525
+0	5000	0	4940.816590	-0.011836682	0.011836682
+0	5000	1	4900.920170	-0.019815966	0.019815966
+0	5000	2	5032.030256	0.006406051	0.006406051
+0	5000	3	4987.858944	-0.002428211	0.002428211
+0	5000	4	4987.858944	-0.002428211	0.002428211
+0	5000	5	5153.376413	0.030675283	0.030675283
+0	5000	6	4947.503938	-0.010499212	0.010499212
+0	5000	7	5032.030256	0.006406051	0.006406051
+0	5000	8	4920.819805	-0.015836039	0.015836039
+0	5000	9	4987.858944	-0.002428211	0.002428211
+0	5000	10	5056.013595	0.011202719	0.011202719
+0	5000	11	5001.399453	0.000279891	0.000279891
+0	5000	12	4984.480800	-0.003103840	0.003103840
+0	5000	13	5066.335314	0.013267063	0.013267063
+0	5000	14	4974.363051	-0.005127390	0.005127390
+0	5000	15	5011.584290	0.002316858	0.002316858
+0	5000	16	4964.270233	-0.007145953	0.007145953
+0	5000	17	4900.920170	-0.019815966	0.019815966
+0	5000	18	5035.447861	0.007089572	0.007089572
+0	5000	19	5008.186530	0.001637306	0.001637306
+0	5000	20	5045.717821	0.009143564	0.009143564
+0	5000	21	5025.203588	0.005040718	0.005040718
+0	5000	22	4920.819805	-0.015836039	0.015836039
+0	5000	23	4987.858944	-0.002428211	0.002428211
+0	10000	0	9948.726102	-0.005127390	0.005127390
+0	10000	1	10087.195626	0.008719563	0.008719563
+0	10000	2	10267.136712	0.026713671	0.026713671
+0	10000	3	10087.195626	0.008719563	0.008719563
+0	10000	4	10110.735920	0.011073592	0.011073592
+0	10000	5	9781.973088	-0.021802691	0.021802691
+0	10000	6	9653.292348	-0.034670765	0.034670765
+0	10000	7	9982.907107	-0.001709289	0.001709289
+0	10000	8	10017.375753	0.001737575	0.001737575
+0	10000	9	9948.726102	-0.005127390	0.005127390
+0	10000	10	10075.476018	0.007547602	0.007547602
+0	10000	11	10087.195626	0.008719563	0.008719563
+0	10000	12	10242.682908	0.024268291	0.024268291
+0	10000	13	10017.375753	0.001737575	0.001737575
+0	10000	14	10182.179592	0.018217959	0.018217959
+0	10000	15	10122.556996	0.012255700	0.012255700
+0	10000	16	9836.806570	-0.016319343	0.016319343
+0	10000	17	10098.948862	0.009894886	0.009894886
+0	10000	18	10353.893359	0.035389336	0.035389336
+0	10000	19	10481.108553	0.048110855	0.048110855
+0	10000	20	10341.386479	0.034138648	0.034138648
+0	10000	21	10134.412287	0.013441229	0.013441229
+0	10000	22	10353.893359	0.035389336	0.035389336
+0	10000	23	9814.785012	-0.018521499	0.018521499
+0	50000	0	49806.071755	-0.003878565	0.003878565
+0	50000	1	49354.648842	-0.012907023	0.012907023
+0	50000	2	49435.973410	-0.011280532	0.011280532
+0	50000	3	49643.606458	-0.007127871	0.007127871
+0	50000	4	49813.681317	-0.003726374	0.003726374
+0	50000	5	49396.458209	-0.012070836	0.012070836
+0	50000	6	49339.137384	-0.013217252	0.013217252
+0	50000	7	50750.344299	0.015006886	0.015006886
+0	50000	8	50441.122578	0.008822452	0.008822452
+0	50000	9	50404.896674	0.008097933	0.008097933
+0	50000	10	48795.594098	-0.024088118	0.024088118
+0	50000	11	50568.453343	0.011369067	0.011369067
+0	50000	12	50355.944476	0.007118890	0.007118890
+0	50000	13	48897.560690	-0.022048786	0.022048786
+0	50000	14	48911.334530	-0.021773309	0.021773309
+0	50000	15	50020.558725	0.000411174	0.000411174
+0	50000	16	50274.293750	0.005485875	0.005485875
+0	50000	17	51473.652539	0.029473051	0.029473051
+0	50000	18	49254.218647	-0.014915627	0.014915627
+0	50000	19	49238.177031	-0.015236459	0.015236459
+0	50000	20	49032.206591	-0.019355868	0.019355868
+0	50000	21	49737.197593	-0.005256048	0.005256048
+0	50000	22	50849.999117	0.016999982	0.016999982
+0	50000	23	49640.886053	-0.007182279	0.007182279
+1	100	0	99.191405	-0.008085948	0.008085948
+1	100	1	99.191405	-0.008085948	0.008085948
+1	100	2	101.240942	0.012409424	0.012409424
+1	100	3	101.240942	0.012409424	0.012409424
+1	100	4	100.216046	0.002160456	0.002160456
+1	100	5	99.191405	-0.008085948	0.008085948
+1	100	6	101.240942	0.012409424	0.012409424
+1	100	7	101.240942	0.012409424	0.012409424
+1	100	8	98.167021	-0.018329790	0.018329790
+1	100	9	99.191405	-0.008085948	0.008085948
+1	100	10	99.191405	-0.008085948	0.008085948
+1	100	11	101.240942	0.012409424	0.012409424
+1	100	12	100.216046	0.002160456	0.002160456
+1	100	13	100.216046	0.002160456	0.002160456
+1	100	14	101.240942	0.012409424	0.012409424
+1	100	15	101.240942	0.012409424	0.012409424
+1	100	16	97.142893	-0.028571070	0.028571070
+1	100	17	101.240942	0.012409424	0.012409424
+1	100	18	101.240942	0.012409424	0.012409424
+1	100	19	99.191405	-0.008085948	0.008085948
+1	100	20	100.216046	0.002160456	0.002160456
+1	100	21	101.240942	0.012409424	0.012409424
+1	100	22	100.216046	0.002160456	0.002160456
+1	100	23	99.191405	-0.008085948	0.008085948
+1	500	0	500.353431	0.000706863	0.000706863
+1	500	1	494.707669	-0.010584662	0.010584662
+1	500	2	501.483518	0.002967036	0.002967036
+1	500	3	500.353431	0.000706863	0.000706863
+1	500	4	503.744628	0.007489256	0.007489256
+1	500	5	506.006986	0.012013973	0.012013973
+1	500	6	507.138634	0.014277269	0.014277269
+1	500	7	492.451541	-0.015096918	0.015096918
+1	500	8	499.223656	-0.001552688	0.001552688
+1	500	9	508.270595	0.016541190	0.016541190
+1	500	10	510.535456	0.021070911	0.021070911
+1	500	11	501.483518	0.002967036	0.002967036
+1	500	12	502.613917	0.005227834	0.005227834
+1	500	13	499.223656	-0.001552688	0.001552688
+1	500	14	496.965040	-0.006069920	0.006069920
+1	500	15	500.353431	0.000706863	0.000706863
+1	500	16	503.744628	0.007489256	0.007489256
+1	500	17	500.353431	0.000706863	0.000706863
+1	500	18	503.744628	0.007489256	0.007489256
+1	500	19	502.613917	0.005227834	0.005227834
+1	500	20	502.613917	0.005227834	0.005227834
+1	500	21	494.707669	-0.010584662	0.010584662
+1	500	22	496.965040	-0.006069920	0.006069920
+1	500	23	501.483518	0.002967036	0.002967036
+1	1000	0	985.618547	-0.014381453	0.014381453
+1	1000	1	1012.419079	0.012419079	0.012419079
+1	1000	2	999.635049	-0.000364951	0.000364951
+1	1000	3	1007.300678	0.007300678	0.007300678
+1	1000	4	989.436475	-0.010563525	0.010563525
+1	1000	5	1008.579679	0.008579679	0.008579679
+1	1000	6	998.358838	-0.001641162	0.001641162
+1	1000	7	1008.579679	0.008579679	0.008579679
+1	1000	8	976.723864	-0.023276136	0.023276136
+1	1000	9	995.807607	-0.004192393	0.004192393
+1	1000	10	1006.022077	0.006022077	0.006022077
+1	1000	11	1003.466070	0.003466070	0.003466070
+1	1000	12	993.257965	-0.006742035	0.006742035
+1	1000	13	988.163437	-0.011836563	0.011836563
+1	1000	14	993.257965	-0.006742035	0.006742035
+1	1000	15	988.163437	-0.011836563	0.011836563
+1	1000	16	1002.188665	0.002188665	0.002188665
+1	1000	17	1013.699680	0.013699680	0.013699680
+1	1000	18	1003.466070	0.003466070	0.003466070
+1	1000	19	1011.138879	0.011138879	0.011138879
+1	1000	20	984.346695	-0.015653305	0.015653305
+1	1000	21	989.436475	-0.010563525	0.010563525
+1	1000	22	993.257965	-0.006742035	0.006742035
+1	1000	23	979.263232	-0.020736768	0.020736768
+1	5000	0	5021.794515	0.004358903	0.004358903
+1	5000	1	5073.230939	0.014646188	0.014646188
+1	5000	2	4987.858944	-0.002428211	0.002428211
+1	5000	3	4854.860247	-0.029027951	0.029027951
+1	5000	4	4977.732858	-0.004453428	0.004453428
+1	5000	5	5008.186530	0.001637306	0.001637306
+1	5000	6	4954.202223	-0.009159555	0.009159555
+1	5000	7	4897.612944	-0.020477411	0.020477411
+1	5000	8	4991.239877	-0.001752025	0.001752025
+1	5000	9	5107.884276	0.021576855	0.021576855
+1	5000	10	5118.337705	0.023667541	0.023667541
+1	5000	11	4848.322337	-0.030335533	0.030335533
+1	5000	12	5153.376413	0.030675283	0.030675283
+1	5000	13	4994.623603	-0.001075279	0.001075279
+1	5000	14	5032.030256	0.006406051	0.006406051
+1	5000	15	5025.203588	0.005040718	0.005040718
+1	5000	16	5025.203588	0.005040718	0.005040718
+1	5000	17	5021.794515	0.004358903	0.004358903
+1	5000	18	4904.230070	-0.019153986	0.019153986
+1	5000	19	4994.623603	-0.001075279	0.001075279
+1	5000	20	5021.794515	0.004358903	0.004358903
+1	5000	21	5059.451279	0.011890256	0.011890256
+1	5000	22	5080.138191	0.016027638	0.016027638
+1	5000	23	4877.825466	-0.024434907	0.024434907
+1	10000	0	10040.517058	0.004051706	0.004051706
+1	10000	1	10146.301990	0.014630199	0.014630199
+1	10000	2	9870.062504	-0.012993750	0.012993750
+1	10000	3	10075.476018	0.007547602	0.007547602
+1	10000	4	10230.510536	0.023051054	0.023051054
+1	10000	5	10328.917672	0.032891767	0.032891767
+1	10000	6	10063.789848	0.006378985	0.006378985
+1	10000	7	9847.861908	-0.015213809	0.015213809
+1	10000	8	9792.881217	-0.020711878	0.020711878
+1	10000	9	9836.806570	-0.016319343	0.016319343
+1	10000	10	10230.510536	0.023051054	0.023051054
+1	10000	11	10146.301990	0.014630199	0.014630199
+1	10000	12	10052.136924	0.005213692	0.005213692
+1	10000	13	9982.907107	-0.001709289	0.001709289
+1	10000	14	10028.930063	0.002893006	0.002893006
+1	10000	15	10052.136924	0.005213692	0.005213692
+1	10000	16	9892.384085	-0.010761591	0.010761591
+1	10000	17	10087.195626	0.008719563	0.008719563
+1	10000	18	10194.208969	0.019420897	0.019420897
+1	10000	19	9792.881217	-0.020711878	0.020711878
+1	10000	20	10075.476018	0.007547602	0.007547602
+1	10000	21	9870.062504	-0.012993750	0.012993750
+1	10000	22	9881.208089	-0.011879191	0.011879191
+1	10000	23	10017.375753	0.001737575	0.001737575
+1	50000	0	50028.807506	0.000576150	0.000576150
+1	50000	1	50728.121621	0.014562432	0.014562432
+1	50000	2	51166.800733	0.023336015	0.023336015
+1	50000	3	50568.277469	0.011365549	0.011365549
+1	50000	4	49640.287386	-0.007194252	0.007194252
+1	50000	5	50982.206668	0.019644133	0.019644133
+1	50000	6	50633.855981	0.012677120	0.012677120
+1	50000	7	50999.450521	0.019989010	0.019989010
+1	50000	8	49644.904603	-0.007101908	0.007101908
+1	50000	9	49377.406945	-0.012451861	0.012451861
+1	50000	10	50040.463232	0.000809265	0.000809265
+1	50000	11	50593.583760	0.011871675	0.011871675
+1	50000	12	50253.513128	0.005070263	0.005070263
+1	50000	13	49932.137959	-0.001357241	0.001357241
+1	50000	14	49982.572454	-0.000348551	0.000348551
+1	50000	15	50116.028531	0.002320571	0.002320571
+1	50000	16	48897.204098	-0.022055918	0.022055918
+1	50000	17	49689.755760	-0.006204885	0.006204885
+1	50000	18	50348.893522	0.006977870	0.006977870
+1	50000	19	50307.198588	0.006143972	0.006143972
+1	50000	20	49636.263369	-0.007274733	0.007274733
+1	50000	21	49725.830737	-0.005483385	0.005483385
+1	50000	22	48702.545769	-0.025949085	0.025949085
+1	50000	23	50138.491660	0.002769833	0.002769833
+2	100	0	101.240942	0.012409424	0.012409424
+2	100	1	101.240942	0.012409424	0.012409424
+2	100	2	100.216046	0.002160456	0.002160456
+2	100	3	100.216046	0.002160456	0.002160456
+2	100	4	101.240942	0.012409424	0.012409424
+2	100	5	99.191405	-0.008085948	0.008085948
+2	100	6	100.216046	0.002160456	0.002160456
+2	100	7	101.240942	0.012409424	0.012409424
+2	100	8	100.216046	0.002160456	0.002160456
+2	100	9	99.191405	-0.008085948	0.008085948
+2	100	10	100.216046	0.002160456	0.002160456
+2	100	11	99.191405	-0.008085948	0.008085948
+2	100	12	101.240942	0.012409424	0.012409424
+2	100	13	101.240942	0.012409424	0.012409424
+2	100	14	100.216046	0.002160456	0.002160456
+2	100	15	100.216046	0.002160456	0.002160456
+2	100	16	99.191405	-0.008085948	0.008085948
+2	100	17	101.240942	0.012409424	0.012409424
+2	100	18	101.240942	0.012409424	0.012409424
+2	100	19	98.167021	-0.018329790	0.018329790
+2	100	20	101.240942	0.012409424	0.012409424
+2	100	21	98.167021	-0.018329790	0.018329790
+2	100	22	101.240942	0.012409424	0.012409424
+2	100	23	100.216046	0.002160456	0.002160456
+2	500	0	503.744628	0.007489256	0.007489256
+2	500	1	509.402869	0.018805738	0.018805738
+2	500	2	507.138634	0.014277269	0.014277269
+2	500	3	502.613917	0.005227834	0.005227834
+2	500	4	502.613917	0.005227834	0.005227834
+2	500	5	496.965040	-0.006069920	0.006069920
+2	500	6	492.451541	-0.015096918	0.015096918
+2	500	7	492.451541	-0.015096918	0.015096918
+2	500	8	501.483518	0.002967036	0.002967036
+2	500	9	503.744628	0.007489256	0.007489256
+2	500	10	493.579450	-0.012841101	0.012841101
+2	500	11	498.094192	-0.003811615	0.003811615
+2	500	12	494.707669	-0.010584662	0.010584662
+2	500	13	495.836199	-0.008327602	0.008327602
+2	500	14	499.223656	-0.001552688	0.001552688
+2	500	15	503.744628	0.007489256	0.007489256
+2	500	16	494.707669	-0.010584662	0.010584662
+2	500	17	503.744628	0.007489256	0.007489256
+2	500	18	499.223656	-0.001552688	0.001552688
+2	500	19	506.006986	0.012013973	0.012013973
+2	500	20	512.801569	0.025603138	0.025603138
+2	500	21	504.875651	0.009751302	0.009751302
+2	500	22	495.836199	-0.008327602	0.008327602
+2	500	23	496.965040	-0.006069920	0.006069920
+2	1000	0	1008.579679	0.008579679	0.008579679
+2	1000	1	1008.579679	0.008579679	0.008579679
+2	1000	2	1006.022077	0.006022077	0.006022077
+2	1000	3	1009.859079	0.009859079	0.009859079
+2	1000	4	998.358838	-0.001641162	0.001641162
+2	1000	5	997.083024	-0.002916976	0.002916976
+2	1000	6	1011.138879	0.011138879	0.011138879
+2	1000	7	991.983739	-0.008016261	0.008016261
+2	1000	8	998.358838	-0.001641162	0.001641162
+2	1000	9	999.635049	-0.000364951	0.000364951
+2	1000	10	1004.743874	0.004743874	0.004743874
+2	1000	11	1004.743874	0.004743874	0.004743874
+2	1000	12	997.083024	-0.002916976	0.002916976
+2	1000	13	993.257965	-0.006742035	0.006742035
+2	1000	14	1003.466070	0.003466070	0.003466070
+2	1000	15	999.635049	-0.000364951	0.000364951
+2	1000	16	980.533506	-0.019466494	0.019466494
+2	1000	17	995.807607	-0.004192393	0.004192393
+2	1000	18	1016.262082	0.016262082	0.016262082
+2	1000	19	1011.138879	0.011138879	0.011138879
+2	1000	20	1002.188665	0.002188665	0.002188665
+2	1000	21	1008.579679	0.008579679	0.008579679
+2	1000	22	999.635049	-0.000364951	0.000364951
+2	1000	23	1014.980680	0.014980680	0.014980680
+2	5000	0	5118.337705	0.023667541	0.023667541
+2	5000	1	5014.984871	0.002996974	0.002996974
+2	5000	2	5011.584290	0.002316858	0.002316858
+2	5000	3	5052.578794	0.010515759	0.010515759
+2	5000	4	4991.239877	-0.001752025	0.001752025
+2	5000	5	4894.308385	-0.021138323	0.021138323
+2	5000	6	5018.388278	0.003677656	0.003677656
+2	5000	7	5035.447861	0.007089572	0.007089572
+2	5000	8	5052.578794	0.010515759	0.010515759
+2	5000	9	5062.891850	0.012578370	0.012578370
+2	5000	10	4977.732858	-0.004453428	0.004453428
+2	5000	11	4977.732858	-0.004453428	0.004453428
+2	5000	12	4927.474558	-0.014505088	0.014505088
+2	5000	13	5018.388278	0.003677656	0.003677656
+2	5000	14	4977.732858	-0.004453428	0.004453428
+2	5000	15	5011.584290	0.002316858	0.002316858
+2	5000	16	4900.920170	-0.019815966	0.019815966
+2	5000	17	5083.596191	0.016719238	0.016719238
+2	5000	18	4914.175845	-0.017164831	0.017164831
+2	5000	19	4981.105439	-0.003778912	0.003778912
+2	5000	20	5052.578794	0.010515759	0.010515759
+2	5000	21	5076.683109	0.015336622	0.015336622
+2	5000	22	5097.457456	0.019491491	0.019491491
+2	5000	23	4851.589988	-0.029682002	0.029682002
+2	10000	0	9971.481716	-0.002851828	0.002851828
+2	10000	1	9814.785012	-0.018521499	0.018521499
+2	10000	2	9892.384085	-0.010761591	0.010761591
+2	10000	3	10572.570088	0.057257009	0.057257009
+2	10000	4	10328.917672	0.032891767	0.032891767
+2	10000	5	10267.136712	0.026713671	0.026713671
+2	10000	6	10087.195626	0.008719563	0.008719563
+2	10000	7	9926.096210	-0.007390379	0.007390379
+2	10000	8	10052.136924	0.005213692	0.005213692
+2	10000	9	10134.412287	0.013441229	0.013441229
+2	10000	10	9914.827977	-0.008517202	0.008517202
+2	10000	11	9971.481716	-0.002851828	0.002851828
+2	10000	12	10075.476018	0.007547602	0.007547602
+2	10000	13	10122.556996	0.012255700	0.012255700
+2	10000	14	10316.486706	0.031648671	0.031648671
+2	10000	15	10182.179592	0.018217959	0.018217959
+2	10000	16	9948.726102	-0.005127390	0.005127390
+2	10000	17	9407.458580	-0.059254142	0.059254142
+2	10000	18	9926.096210	-0.007390379	0.007390379
+2	10000	19	9903.590659	-0.009640934	0.009640934
+2	10000	20	10087.195626	0.008719563	0.008719563
+2	10000	21	9632.233175	-0.036776682	0.036776682
+2	10000	22	9892.384085	-0.010761591	0.010761591
+2	10000	23	9518.304213	-0.048169579	0.048169579
+2	50000	0	49707.060602	-0.005858788	0.005858788
+2	50000	1	51382.726811	0.027654536	0.027654536
+2	50000	2	48929.010095	-0.021419798	0.021419798
+2	50000	3	50047.216499	0.000944330	0.000944330
+2	50000	4	49582.476735	-0.008350465	0.008350465
+2	50000	5	50898.838569	0.017976771	0.017976771
+2	50000	6	48732.742884	-0.025345142	0.025345142
+2	50000	7	49167.320901	-0.016653582	0.016653582
+2	50000	8	49476.051259	-0.010478975	0.010478975
+2	50000	9	50443.890482	0.008877810	0.008877810
+2	50000	10	49096.540720	-0.018069186	0.018069186
+2	50000	11	47952.336172	-0.040953277	0.040953277
+2	50000	12	51088.397365	0.021767947	0.021767947
+2	50000	13	49739.197234	-0.005216055	0.005216055
+2	50000	14	50356.528147	0.007130563	0.007130563
+2	50000	15	49804.647653	-0.003907047	0.003907047
+2	50000	16	49793.084215	-0.004138316	0.004138316
+2	50000	17	49981.269193	-0.000374616	0.000374616
+2	50000	18	50280.320204	0.005606404	0.005606404
+2	50000	19	50413.460233	0.008269205	0.008269205
+2	50000	20	50460.855544	0.009217111	0.009217111
+2	50000	21	49459.705177	-0.010805896	0.010805896
+2	50000	22	49715.949788	-0.005681004	0.005681004
+2	50000	23	49111.618553	-0.017767629	0.017767629
+3	100	0	101.240942	0.012409424	0.012409424
+3	100	1	100.216046	0.002160456	0.002160456
+3	100	2	99.191405	-0.008085948	0.008085948
+3	100	3	101.240942	0.012409424	0.012409424
+3	100	4	100.216046	0.002160456	0.002160456
+3	100	5	100.216046	0.002160456	0.002160456
+3	100	6	99.191405	-0.008085948	0.008085948
+3	100	7	99.191405	-0.008085948	0.008085948
+3	100	8	100.216046	0.002160456	0.002160456
+3	100	9	100.216046	0.002160456	0.002160456
+3	100	10	99.191405	-0.008085948	0.008085948
+3	100	11	99.191405	-0.008085948	0.008085948
+3	100	12	98.167021	-0.018329790	0.018329790
+3	100	13	99.191405	-0.008085948	0.008085948
+3	100	14	101.240942	0.012409424	0.012409424
+3	100	15	100.216046	0.002160456	0.002160456
+3	100	16	100.216046	0.002160456	0.002160456
+3	100	17	100.216046	0.002160456	0.002160456
+3	100	18	100.216046	0.002160456	0.002160456
+3	100	19	100.216046	0.002160456	0.002160456
+3	100	20	99.191405	-0.008085948	0.008085948
+3	100	21	101.240942	0.012409424	0.012409424
+3	100	22	100.216046	0.002160456	0.002160456
+3	100	23	101.240942	0.012409424	0.012409424
+3	500	0	491.323943	-0.017352114	0.017352114
+3	500	1	509.402869	0.018805738	0.018805738
+3	500	2	501.483518	0.002967036	0.002967036
+3	500	3	496.965040	-0.006069920	0.006069920
+3	500	4	502.613917	0.005227834	0.005227834
+3	500	5	494.707669	-0.010584662	0.010584662
+3	500	6	506.006986	0.012013973	0.012013973
+3	500	7	487.943010	-0.024113980	0.024113980
+3	500	8	491.323943	-0.017352114	0.017352114
+3	500	9	506.006986	0.012013973	0.012013973
+3	500	10	507.138634	0.014277269	0.014277269
+3	500	11	490.196655	-0.019606690	0.019606690
+3	500	12	502.613917	0.005227834	0.005227834
+3	500	13	499.223656	-0.001552688	0.001552688
+3	500	14	500.353431	0.000706863	0.000706863
+3	500	15	493.579450	-0.012841101	0.012841101
+3	500	16	504.875651	0.009751302	0.009751302
+3	500	17	496.965040	-0.006069920	0.006069920
+3	500	18	498.094192	-0.003811615	0.003811615
+3	500	19	495.836199	-0.008327602	0.008327602
+3	500	20	500.353431	0.000706863	0.000706863
+3	500	21	498.094192	-0.003811615	0.003811615
+3	500	22	496.965040	-0.006069920	0.006069920
+3	500	23	495.836199	-0.008327602	0.008327602
+3	1000	0	1008.579679	0.008579679	0.008579679
+3	1000	1	1013.699680	0.013699680	0.013699680
+3	1000	2	1013.699680	0.013699680	0.013699680
+3	1000	3	1020.108694	0.020108694	0.020108694
+3	1000	4	1008.579679	0.008579679	0.008579679
+3	1000	5	998.358838	-0.001641162	0.001641162
+3	1000	6	1003.466070	0.003466070	0.003466070
+3	1000	7	994.532588	-0.005467412	0.005467412
+3	1000	8	1007.300678	0.007300678	0.007300678
+3	1000	9	994.532588	-0.005467412	0.005467412
+3	1000	10	990.709909	-0.009290091	0.009290091
+3	1000	11	1009.859079	0.009859079	0.009859079
+3	1000	12	1011.138879	0.011138879	0.011138879
+3	1000	13	997.083024	-0.002916976	0.002916976
+3	1000	14	988.163437	-0.011836563	0.011836563
+3	1000	15	998.358838	-0.001641162	0.001641162
+3	1000	16	1014.980680	0.014980680	0.014980680
+3	1000	17	1008.579679	0.008579679	0.008579679
+3	1000	18	1014.980680	0.014980680	0.014980680
+3	1000	19	1000.911658	0.000911658	0.000911658
+3	1000	20	983.075238	-0.016924762	0.016924762
+3	1000	21	986.890795	-0.013109205	0.013109205
+3	1000	22	1006.022077	0.006022077	0.006022077
+3	1000	23	1014.980680	0.014980680	0.014980680
+3	5000	0	4854.860247	-0.029027951	0.029027951
+3	5000	1	5032.030256	0.006406051	0.006406051
+3	5000	2	4960.911479	-0.007817704	0.007817704
+3	5000	3	4858.133120	-0.028373376	0.028373376
+3	5000	4	5111.365789	0.022273158	0.022273158
+3	5000	5	4984.480800	-0.003103840	0.003103840
+3	5000	6	4934.140142	-0.013171972	0.013171972
+3	5000	7	5025.203588	0.005040718	0.005040718
+3	5000	8	5059.451279	0.011890256	0.011890256
+3	5000	9	4884.410676	-0.023117865	0.023117865
+3	5000	10	5004.791585	0.000958317	0.000958317
+3	5000	11	5038.868321	0.007773664	0.007773664
+3	5000	12	5014.984871	0.002996974	0.002996974
+3	5000	13	5059.451279	0.011890256	0.011890256
+3	5000	14	4967.631743	-0.006473651	0.006473651
+3	5000	15	5008.186530	0.001637306	0.001637306
+3	5000	16	5011.584290	0.002316858	0.002316858
+3	5000	17	5004.791585	0.000958317	0.000958317
+3	5000	18	5069.781675	0.013956335	0.013956335
+3	5000	19	4991.239877	-0.001752025	0.001752025
+3	5000	20	4987.858944	-0.002428211	0.002428211
+3	5000	21	4944.158899	-0.011168220	0.011168220
+3	5000	22	4984.480800	-0.003103840	0.003103840
+3	5000	23	4998.010127	-0.000397975	0.000397975
+3	10000	0	9825.780992	-0.017421901	0.017421901
+3	10000	1	10304.093353	0.030409335	0.030409335
+3	10000	2	9971.481716	-0.002851828	0.002851828
+3	10000	3	9858.947165	-0.014105284	0.014105284
+3	10000	4	9760.243594	-0.023975641	0.023975641
+3	10000	5	9903.590659	-0.009640934	0.009640934
+3	10000	6	10391.644778	0.039164478	0.039164478
+3	10000	7	10158.226307	0.015822631	0.015822631
+3	10000	8	9937.395527	-0.006260447	0.006260447
+3	10000	9	10017.375753	0.001737575	0.001737575
+3	10000	10	9685.085522	-0.031491448	0.031491448
+3	10000	11	10040.517058	0.004051706	0.004051706
+3	10000	12	9706.418903	-0.029358110	0.029358110
+3	10000	13	10267.136712	0.026713671	0.026713671
+3	10000	14	9836.806570	-0.016319343	0.016319343
+3	10000	15	10218.374231	0.021837423	0.021837423
+3	10000	16	9994.364457	-0.000563554	0.000563554
+3	10000	17	10158.226307	0.015822631	0.015822631
+3	10000	18	9960.088106	-0.003991189	0.003991189
+3	10000	19	10005.853945	0.000585395	0.000585395
+3	10000	20	10075.476018	0.007547602	0.007547602
+3	10000	21	10146.301990	0.014630199	0.014630199
+3	10000	22	10110.735920	0.011073592	0.011073592
+3	10000	23	9611.281723	-0.038871828	0.038871828
+3	50000	0	48542.780745	-0.029144385	0.029144385
+3	50000	1	49756.055289	-0.004878894	0.004878894
+3	50000	2	49946.871392	-0.001062572	0.001062572
+3	50000	3	50496.438741	0.009928775	0.009928775
+3	50000	4	49628.579577	-0.007428408	0.007428408
+3	50000	5	49851.843763	-0.002963125	0.002963125
+3	50000	6	49631.285818	-0.007374284	0.007374284
+3	50000	7	51195.521005	0.023910420	0.023910420
+3	50000	8	48053.479911	-0.038930402	0.038930402
+3	50000	9	50151.134436	0.003022689	0.003022689
+3	50000	10	48848.586016	-0.023028280	0.023028280
+3	50000	11	49873.615348	-0.002527693	0.002527693
+3	50000	12	48778.497827	-0.024430043	0.024430043
+3	50000	13	50125.032915	0.002500658	0.002500658
+3	50000	14	49814.544724	-0.003709106	0.003709106
+3	50000	15	49508.598872	-0.009828023	0.009828023
+3	50000	16	50558.161375	0.011163227	0.011163227
+3	50000	17	49697.661962	-0.006046761	0.006046761
+3	50000	18	49597.612607	-0.008047748	0.008047748
+3	50000	19	49843.546693	-0.003129066	0.003129066
+3	50000	20	50167.672536	0.003353451	0.003353451
+3	50000	21	49596.965732	-0.008060685	0.008060685
+3	50000	22	50496.335829	0.009926717	0.009926717
+3	50000	23	50144.145870	0.002882917	0.002882917
+4	100	0	99.191405	-0.008085948	0.008085948
+4	100	1	100.216046	0.002160456	0.002160456
+4	100	2	100.216046	0.002160456	0.002160456
+4	100	3	101.240942	0.012409424	0.012409424
+4	100	4	101.240942	0.012409424	0.012409424
+4	100	5	101.240942	0.012409424	0.012409424
+4	100	6	100.216046	0.002160456	0.002160456
+4	100	7	98.167021	-0.018329790	0.018329790
+4	100	8	101.240942	0.012409424	0.012409424
+4	100	9	99.191405	-0.008085948	0.008085948
+4	100	10	101.240942	0.012409424	0.012409424
+4	100	11	101.240942	0.012409424	0.012409424
+4	100	12	100.216046	0.002160456	0.002160456
+4	100	13	101.240942	0.012409424	0.012409424
+4	100	14	101.240942	0.012409424	0.012409424
+4	100	15	100.216046	0.002160456	0.002160456
+4	100	16	100.216046	0.002160456	0.002160456
+4	100	17	100.216046	0.002160456	0.002160456
+4	100	18	101.240942	0.012409424	0.012409424
+4	100	19	98.167021	-0.018329790	0.018329790
+4	100	20	99.191405	-0.008085948	0.008085948
+4	100	21	99.191405	-0.008085948	0.008085948
+4	100	22	98.167021	-0.018329790	0.018329790
+4	100	23	100.216046	0.002160456	0.002160456
+4	500	0	498.094192	-0.003811615	0.003811615
+4	500	1	500.353431	0.000706863	0.000706863
+4	500	2	490.196655	-0.019606690	0.019606690
+4	500	3	501.483518	0.002967036	0.002967036
+4	500	4	486.816652	-0.026366696	0.026366696
+4	500	5	495.836199	-0.008327602	0.008327602
+4	500	6	495.836199	-0.008327602	0.008327602
+4	500	7	501.483518	0.002967036	0.002967036
+4	500	8	501.483518	0.002967036	0.002967036
+4	500	9	503.744628	0.007489256	0.007489256
+4	500	10	501.483518	0.002967036	0.002967036
+4	500	11	500.353431	0.000706863	0.000706863
+4	500	12	503.744628	0.007489256	0.007489256
+4	500	13	500.353431	0.000706863	0.000706863
+4	500	14	491.323943	-0.017352114	0.017352114
+4	500	15	500.353431	0.000706863	0.000706863
+4	500	16	510.535456	0.021070911	0.021070911
+4	500	17	492.451541	-0.015096918	0.015096918
+4	500	18	504.875651	0.009751302	0.009751302
+4	500	19	500.353431	0.000706863	0.000706863
+4	500	20	502.613917	0.005227834	0.005227834
+4	500	21	507.138634	0.014277269	0.014277269
+4	500	22	496.965040	-0.006069920	0.006069920
+4	500	23	496.965040	-0.006069920	0.006069920
+4	1000	0	1007.300678	0.007300678	0.007300678
+4	1000	1	991.983739	-0.008016261	0.008016261
+4	1000	2	983.075238	-0.016924762	0.016924762
+4	1000	3	1016.262082	0.016262082	0.016262082
+4	1000	4	1016.262082	0.016262082	0.016262082
+4	1000	5	1013.699680	0.013699680	0.013699680
+4	1000	6	989.436475	-0.010563525	0.010563525
+4	1000	7	988.163437	-0.011836563	0.011836563
+4	1000	8	1008.579679	0.008579679	0.008579679
+4	1000	9	1017.543884	0.017543884	0.017543884
+4	1000	10	991.983739	-0.008016261	0.008016261
+4	1000	11	986.890795	-0.013109205	0.013109205
+4	1000	12	985.618547	-0.014381453	0.014381453
+4	1000	13	1000.911658	0.000911658	0.000911658
+4	1000	14	989.436475	-0.010563525	0.010563525
+4	1000	15	998.358838	-0.001641162	0.001641162
+4	1000	16	1025.243135	0.025243135	0.025243135
+4	1000	17	980.533506	-0.019466494	0.019466494
+4	1000	18	995.807607	-0.004192393	0.004192393
+4	1000	19	1002.188665	0.002188665	0.002188665
+4	1000	20	1020.108694	0.020108694	0.020108694
+4	1000	21	1003.466070	0.003466070	0.003466070
+4	1000	22	993.257965	-0.006742035	0.006742035
+4	1000	23	991.983739	-0.008016261	0.008016261
+4	5000	0	5014.984871	0.002996974	0.002996974
+4	5000	1	5066.335314	0.013267063	0.013267063
+4	5000	2	4910.857903	-0.017828419	0.017828419
+4	5000	3	4987.858944	-0.002428211	0.002428211
+4	5000	4	5042.291639	0.008458328	0.008458328
+4	5000	5	4987.858944	-0.002428211	0.002428211
+4	5000	6	4930.805994	-0.013838801	0.013838801
+4	5000	7	5052.578794	0.010515759	0.010515759
+4	5000	8	5011.584290	0.002316858	0.002316858
+4	5000	9	4984.480800	-0.003103840	0.003103840
+4	5000	10	5121.828119	0.024365624	0.024365624
+4	5000	11	4960.911479	-0.007817704	0.007817704
+4	5000	12	4930.805994	-0.013838801	0.013838801
+4	5000	13	5097.457456	0.019491491	0.019491491
+4	5000	14	4974.363051	-0.005127390	0.005127390
+4	5000	15	5125.321509	0.025064302	0.025064302
+4	5000	16	4917.496478	-0.016500704	0.016500704
+4	5000	17	4974.363051	-0.005127390	0.005127390
+4	5000	18	5032.030256	0.006406051	0.006406051
+4	5000	19	4950.851711	-0.009829658	0.009829658
+4	5000	20	4987.858944	-0.002428211	0.002428211
+4	5000	21	4887.707256	-0.022458549	0.022458549
+4	5000	22	4947.503938	-0.010499212	0.010499212
+4	5000	23	5087.057112	0.017411422	0.017411422
+4	10000	0	10170.185440	0.017018544	0.017018544
+4	10000	1	10206.273779	0.020627378	0.020627378
+4	10000	2	9914.827977	-0.008517202	0.008517202
+4	10000	3	9926.096210	-0.007390379	0.007390379
+4	10000	4	10063.789848	0.006378985	0.006378985
+4	10000	5	9836.806570	-0.016319343	0.016319343
+4	10000	6	10218.374231	0.021837423	0.021837423
+4	10000	7	10481.108553	0.048110855	0.048110855
+4	10000	8	10017.375753	0.001737575	0.001737575
+4	10000	9	9803.818473	-0.019618153	0.019618153
+4	10000	10	10005.853945	0.000585395	0.000585395
+4	10000	11	9982.907107	-0.001709289	0.001709289
+4	10000	12	10005.853945	0.000585395	0.000585395
+4	10000	13	9982.907107	-0.001709289	0.001709289
+4	10000	14	10316.486706	0.031648671	0.031648671
+4	10000	15	10206.273779	0.020627378	0.020627378
+4	10000	16	10218.374231	0.021837423	0.021837423
+4	10000	17	10052.136924	0.005213692	0.005213692
+4	10000	18	10005.853945	0.000585395	0.000585395
+4	10000	19	9903.590659	-0.009640934	0.009640934
+4	10000	20	10146.301990	0.014630199	0.014630199
+4	10000	21	10028.930063	0.002893006	0.002893006
+4	10000	22	9814.785012	-0.018521499	0.018521499
+4	10000	23	10087.195626	0.008719563	0.008719563
+4	50000	0	49580.151344	-0.008396973	0.008396973
+4	50000	1	49203.611997	-0.015927760	0.015927760
+4	50000	2	51495.762423	0.029915248	0.029915248
+4	50000	3	50988.428638	0.019768573	0.019768573
+4	50000	4	49846.667760	-0.003066645	0.003066645
+4	50000	5	50775.506293	0.015510126	0.015510126
+4	50000	6	49893.373723	-0.002132526	0.002132526
+4	50000	7	51720.271159	0.034405423	0.034405423
+4	50000	8	48902.056601	-0.021958868	0.021958868
+4	50000	9	50358.480344	0.007169607	0.007169607
+4	50000	10	50307.639483	0.006152790	0.006152790
+4	50000	11	50651.202280	0.013024046	0.013024046
+4	50000	12	49444.355796	-0.011112884	0.011112884
+4	50000	13	52068.423541	0.041368471	0.041368471
+4	50000	14	50318.648000	0.006372960	0.006372960
+4	50000	15	48847.352881	-0.023052942	0.023052942
+4	50000	16	50488.080054	0.009761601	0.009761601
+4	50000	17	50940.483497	0.018809670	0.018809670
+4	50000	18	49253.781107	-0.014924378	0.014924378
+4	50000	19	48533.412413	-0.029331752	0.029331752
+4	50000	20	51169.382603	0.023387652	0.023387652
+4	50000	21	48805.322855	-0.023893543	0.023893543
+4	50000	22	50025.594545	0.000511891	0.000511891
+4	50000	23	49537.724934	-0.009245501	0.009245501
+5	100	0	99.191405	-0.008085948	0.008085948
+5	100	1	101.240942	0.012409424	0.012409424
+5	100	2	100.216046	0.002160456	0.002160456
+5	100	3	101.240942	0.012409424	0.012409424
+5	100	4	98.167021	-0.018329790	0.018329790
+5	100	5	100.216046	0.002160456	0.002160456
+5	100	6	101.240942	0.012409424	0.012409424
+5	100	7	98.167021	-0.018329790	0.018329790
+5	100	8	101.240942	0.012409424	0.012409424
+5	100	9	98.167021	-0.018329790	0.018329790
+5	100	10	100.216046	0.002160456	0.002160456
+5	100	11	99.191405	-0.008085948	0.008085948
+5	100	12	99.191405	-0.008085948	0.008085948
+5	100	13	99.191405	-0.008085948	0.008085948
+5	100	14	100.216046	0.002160456	0.002160456
+5	100	15	101.240942	0.012409424	0.012409424
+5	100	16	101.240942	0.012409424	0.012409424
+5	100	17	99.191405	-0.008085948	0.008085948
+5	100	18	100.216046	0.002160456	0.002160456
+5	100	19	99.191405	-0.008085948	0.008085948
+5	100	20	100.216046	0.002160456	0.002160456
+5	100	21	100.216046	0.002160456	0.002160456
+5	100	22	101.240942	0.012409424	0.012409424
+5	100	23	98.167021	-0.018329790	0.018329790
+5	500	0	492.451541	-0.015096918	0.015096918
+5	500	1	494.707669	-0.010584662	0.010584662
+5	500	2	494.707669	-0.010584662	0.010584662
+5	500	3	498.094192	-0.003811615	0.003811615
+5	500	4	506.006986	0.012013973	0.012013973
+5	500	5	498.094192	-0.003811615	0.003811615
+5	500	6	496.965040	-0.006069920	0.006069920
+5	500	7	501.483518	0.002967036	0.002967036
+5	500	8	498.094192	-0.003811615	0.003811615
+5	500	9	510.535456	0.021070911	0.021070911
+5	500	10	495.836199	-0.008327602	0.008327602
+5	500	11	501.483518	0.002967036	0.002967036
+5	500	12	501.483518	0.002967036	0.002967036
+5	500	13	496.965040	-0.006069920	0.006069920
+5	500	14	495.836199	-0.008327602	0.008327602
+5	500	15	507.138634	0.014277269	0.014277269
+5	500	16	504.875651	0.009751302	0.009751302
+5	500	17	508.270595	0.016541190	0.016541190
+5	500	18	496.965040	-0.006069920	0.006069920
+5	500	19	501.483518	0.002967036	0.002967036
+5	500	20	503.744628	0.007489256	0.007489256
+5	500	21	494.707669	-0.010584662	0.010584662
+5	500	22	490.196655	-0.019606690	0.019606690
+5	500	23	500.353431	0.000706863	0.000706863
+5	1000	0	989.436475	-0.010563525	0.010563525
+5	1000	1	977.993351	-0.022006649	0.022006649
+5	1000	2	998.358838	-0.001641162	0.001641162
+5	1000	3	1016.262082	0.016262082	0.016262082
+5	1000	4	989.436475	-0.010563525	0.010563525
+5	1000	5	1000.911658	0.000911658	0.000911658
+5	1000	6	995.807607	-0.004192393	0.004192393
+5	1000	7	1003.466070	0.003466070	0.003466070
+5	1000	8	1012.419079	0.012419079	0.012419079
+5	1000	9	1021.391701	0.021391701	0.021391701
+5	1000	10	995.807607	-0.004192393	0.004192393
+5	1000	11	1016.262082	0.016262082	0.016262082
+5	1000	12	1002.188665	0.002188665	0.002188665
+5	1000	13	989.436475	-0.010563525	0.010563525
+5	1000	14	997.083024	-0.002916976	0.002916976
+5	1000	15	1014.980680	0.014980680	0.014980680
+5	1000	16	1017.543884	0.017543884	0.017543884
+5	1000	17	993.257965	-0.006742035	0.006742035
+5	1000	18	1016.262082	0.016262082	0.016262082
+5	1000	19	1009.859079	0.009859079	0.009859079
+5	1000	20	981.804175	-0.018195825	0.018195825
+5	1000	21	1023.958921	0.023958921	0.023958921
+5	1000	22	1011.138879	0.011138879	0.011138879
+5	1000	23	1009.859079	0.009859079	0.009859079
+5	5000	0	5004.791585	0.000958317	0.000958317
+5	5000	1	5011.584290	0.002316858	0.002316858
+5	5000	2	4930.805994	-0.013838801	0.013838801
+5	5000	3	5011.584290	0.002316858	0.002316858
+5	5000	4	4904.230070	-0.019153986	0.019153986
+5	5000	5	5087.057112	0.017411422	0.017411422
+5	5000	6	4957.555477	-0.008488905	0.008488905
+5	5000	7	4998.010127	-0.000397975	0.000397975
+5	5000	8	5083.596191	0.016719238	0.016719238
+5	5000	9	4970.996014	-0.005800797	0.005800797
+5	5000	10	5217.211472	0.043442294	0.043442294
+5	5000	11	4987.858944	-0.002428211	0.002428211
+5	5000	12	4950.851711	-0.009829658	0.009829658
+5	5000	13	4981.105439	-0.003778912	0.003778912
+5	5000	14	5059.451279	0.011890256	0.011890256
+5	5000	15	5114.850264	0.022970053	0.022970053
+5	5000	16	5008.186530	0.001637306	0.001637306
+5	5000	17	4960.911479	-0.007817704	0.007817704
+5	5000	18	5028.615500	0.005723100	0.005723100
+5	5000	19	4957.555477	-0.008488905	0.008488905
+5	5000	20	4940.816590	-0.011836682	0.011836682
+5	5000	21	4974.363051	-0.005127390	0.005127390
+5	5000	22	5014.984871	0.002996974	0.002996974
+5	5000	23	4987.858944	-0.002428211	0.002428211
+5	10000	0	10194.208969	0.019420897	0.019420897
+5	10000	1	10146.301990	0.014630199	0.014630199
+5	10000	2	9948.726102	-0.005127390	0.005127390
+5	10000	3	10017.375753	0.001737575	0.001737575
+5	10000	4	9803.818473	-0.019618153	0.019618153
+5	10000	5	9914.827977	-0.008517202	0.008517202
+5	10000	6	9749.421923	-0.025057808	0.025057808
+5	10000	7	9903.590659	-0.009640934	0.009640934
+5	10000	8	10005.853945	0.000585395	0.000585395
+5	10000	9	10075.476018	0.007547602	0.007547602
+5	10000	10	10040.517058	0.004051706	0.004051706
+5	10000	11	10279.418580	0.027941858	0.027941858
+5	10000	12	10170.185440	0.017018544	0.017018544
+5	10000	13	9926.096210	-0.007390379	0.007390379
+5	10000	14	9727.863978	-0.027213602	0.027213602
+5	10000	15	9870.062504	-0.012993750	0.012993750
+5	10000	16	10005.853945	0.000585395	0.000585395
+5	10000	17	10110.735920	0.011073592	0.011073592
+5	10000	18	9738.628768	-0.026137123	0.026137123
+5	10000	19	10040.517058	0.004051706	0.004051706
+5	10000	20	10040.517058	0.004051706	0.004051706
+5	10000	21	9971.481716	-0.002851828	0.002851828
+5	10000	22	9792.881217	-0.020711878	0.020711878
+5	10000	23	9937.395527	-0.006260447	0.006260447
+5	50000	0	50327.913828	0.006558277	0.006558277
+5	50000	1	50428.159993	0.008563200	0.008563200
+5	50000	2	49562.398751	-0.008752025	0.008752025
+5	50000	3	49989.402957	-0.000211941	0.000211941
+5	50000	4	49514.185723	-0.009716286	0.009716286
+5	50000	5	50441.297468	0.008825949	0.008825949
+5	50000	6	50087.343492	0.001746870	0.001746870
+5	50000	7	50377.405273	0.007548105	0.007548105
+5	50000	8	50559.251881	0.011185038	0.011185038
+5	50000	9	48580.167855	-0.028396643	0.028396643
+5	50000	10	49355.872391	-0.012882552	0.012882552
+5	50000	11	49652.420490	-0.006951590	0.006951590
+5	50000	12	49189.663156	-0.016206737	0.016206737
+5	50000	13	49270.166429	-0.014596671	0.014596671
+5	50000	14	50383.558128	0.007671163	0.007671163
+5	50000	15	49114.927059	-0.017701459	0.017701459
+5	50000	16	49760.227965	-0.004795441	0.004795441
+5	50000	17	50617.115225	0.012342304	0.012342304
+5	50000	18	49865.791257	-0.002684175	0.002684175
+5	50000	19	49767.845977	-0.004643080	0.004643080
+5	50000	20	49893.227728	-0.002135445	0.002135445
+5	50000	21	50766.832306	0.015336646	0.015336646
+5	50000	22	49900.187743	-0.001996245	0.001996245
+5	50000	23	51473.005926	0.029460119	0.029460119
+6	100	0	99.191405	-0.008085948	0.008085948
+6	100	1	97.142893	-0.028571070	0.028571070
+6	100	2	101.240942	0.012409424	0.012409424
+6	100	3	100.216046	0.002160456	0.002160456
+6	100	4	100.216046	0.002160456	0.002160456
+6	100	5	101.240942	0.012409424	0.012409424
+6	100	6	99.191405	-0.008085948	0.008085948
+6	100	7	99.191405	-0.008085948	0.008085948
+6	100	8	100.216046	0.002160456	0.002160456
+6	100	9	98.167021	-0.018329790	0.018329790
+6	100	10	100.216046	0.002160456	0.002160456
+6	100	11	99.191405	-0.008085948	0.008085948
+6	100	12	101.240942	0.012409424	0.012409424
+6	100	13	100.216046	0.002160456	0.002160456
+6	100	14	101.240942	0.012409424	0.012409424
+6	100	15	99.191405	-0.008085948	0.008085948
+6	100	16	100.216046	0.002160456	0.002160456
+6	100	17	101.240942	0.012409424	0.012409424
+6	100	18	100.216046	0.002160456	0.002160456
+6	100	19	100.216046	0.002160456	0.002160456
+6	100	20	99.191405	-0.008085948	0.008085948
+6	100	21	99.191405	-0.008085948	0.008085948
+6	100	22	101.240942	0.012409424	0.012409424
+6	100	23	100.216046	0.002160456	0.002160456
+6	500	0	486.816652	-0.026366696	0.026366696
+6	500	1	501.483518	0.002967036	0.002967036
+6	500	2	502.613917	0.005227834	0.005227834
+6	500	3	495.836199	-0.008327602	0.008327602
+6	500	4	506.006986	0.012013973	0.012013973
+6	500	5	495.836199	-0.008327602	0.008327602
+6	500	6	509.402869	0.018805738	0.018805738
+6	500	7	498.094192	-0.003811615	0.003811615
+6	500	8	498.094192	-0.003811615	0.003811615
+6	500	9	503.744628	0.007489256	0.007489256
+6	500	10	499.223656	-0.001552688	0.001552688
+6	500	11	494.707669	-0.010584662	0.010584662
+6	500	12	509.402869	0.018805738	0.018805738
+6	500	13	492.451541	-0.015096918	0.015096918
+6	500	14	493.579450	-0.012841101	0.012841101
+6	500	15	504.875651	0.009751302	0.009751302
+6	500	16	498.094192	-0.003811615	0.003811615
+6	500	17	490.196655	-0.019606690	0.019606690
+6	500	18	496.965040	-0.006069920	0.006069920
+6	500	19	494.707669	-0.010584662	0.010584662
+6	500	20	496.965040	-0.006069920	0.006069920
+6	500	21	499.223656	-0.001552688	0.001552688
+6	500	22	503.744628	0.007489256	0.007489256
+6	500	23	501.483518	0.002967036	0.002967036
+6	1000	0	1006.022077	0.006022077	0.006022077
+6	1000	1	993.257965	-0.006742035	0.006742035
+6	1000	2	981.804175	-0.018195825	0.018195825
+6	1000	3	989.436475	-0.010563525	0.010563525
+6	1000	4	975.454771	-0.024545229	0.024545229
+6	1000	5	985.618547	-0.014381453	0.014381453
+6	1000	6	997.083024	-0.002916976	0.002916976
+6	1000	7	991.983739	-0.008016261	0.008016261
+6	1000	8	981.804175	-0.018195825	0.018195825
+6	1000	9	994.532588	-0.005467412	0.005467412
+6	1000	10	1004.743874	0.004743874	0.004743874
+6	1000	11	975.454771	-0.024545229	0.024545229
+6	1000	12	1006.022077	0.006022077	0.006022077
+6	1000	13	981.804175	-0.018195825	0.018195825
+6	1000	14	995.807607	-0.004192393	0.004192393
+6	1000	15	993.257965	-0.006742035	0.006742035
+6	1000	16	1020.108694	0.020108694	0.020108694
+6	1000	17	1011.138879	0.011138879	0.011138879
+6	1000	18	1007.300678	0.007300678	0.007300678
+6	1000	19	997.083024	-0.002916976	0.002916976
+6	1000	20	1009.859079	0.009859079	0.009859079
+6	1000	21	1012.419079	0.012419079	0.012419079
+6	1000	22	990.709909	-0.009290091	0.009290091
+6	1000	23	995.807607	-0.004192393	0.004192393
+6	5000	0	4970.996014	-0.005800797	0.005800797
+6	5000	1	5111.365789	0.022273158	0.022273158
+6	5000	2	4964.270233	-0.007145953	0.007145953
+6	5000	3	5014.984871	0.002996974	0.002996974
+6	5000	4	4954.202223	-0.009159555	0.009159555
+6	5000	5	4984.480800	-0.003103840	0.003103840
+6	5000	6	4947.503938	-0.010499212	0.010499212
+6	5000	7	5135.819593	0.027163919	0.027163919
+6	5000	8	4940.816590	-0.011836682	0.011836682
+6	5000	9	4937.477005	-0.012504599	0.012504599
+6	5000	10	5011.584290	0.002316858	0.002316858
+6	5000	11	5090.520960	0.018104192	0.018104192
+6	5000	12	5090.520960	0.018104192	0.018104192
+6	5000	13	4998.010127	-0.000397975	0.000397975
+6	5000	14	4970.996014	-0.005800797	0.005800797
+6	5000	15	4970.996014	-0.005800797	0.005800797
+6	5000	16	4984.480800	-0.003103840	0.003103840
+6	5000	17	5035.447861	0.007089572	0.007089572
+6	5000	18	5097.457456	0.019491491	0.019491491
+6	5000	19	5018.388278	0.003677656	0.003677656
+6	5000	20	5014.984871	0.002996974	0.002996974
+6	5000	21	4894.308385	-0.021138323	0.021138323
+6	5000	22	4964.270233	-0.007145953	0.007145953
+6	5000	23	4937.477005	-0.012504599	0.012504599
+6	10000	0	10052.136924	0.005213692	0.005213692
+6	10000	1	9836.806570	-0.016319343	0.016319343
+6	10000	2	9881.208089	-0.011879191	0.011879191
+6	10000	3	10075.476018	0.007547602	0.007547602
+6	10000	4	9982.907107	-0.001709289	0.001709289
+6	10000	5	10040.517058	0.004051706	0.004051706
+6	10000	6	9914.827977	-0.008517202	0.008517202
+6	10000	7	9749.421923	-0.025057808	0.025057808
+6	10000	8	9847.861908	-0.015213809	0.015213809
+6	10000	9	9760.243594	-0.023975641	0.023975641
+6	10000	10	10267.136712	0.026713671	0.026713671
+6	10000	11	9914.827977	-0.008517202	0.008517202
+6	10000	12	10170.185440	0.017018544	0.017018544
+6	10000	13	9982.907107	-0.001709289	0.001709289
+6	10000	14	10206.273779	0.020627378	0.020627378
+6	10000	15	9982.907107	-0.001709289	0.001709289
+6	10000	16	10316.486706	0.031648671	0.031648671
+6	10000	17	10063.789848	0.006378985	0.006378985
+6	10000	18	10028.930063	0.002893006	0.002893006
+6	10000	19	9960.088106	-0.003991189	0.003991189
+6	10000	20	9926.096210	-0.007390379	0.007390379
+6	10000	21	10468.207755	0.046820776	0.046820776
+6	10000	22	9937.395527	-0.006260447	0.006260447
+6	10000	23	10218.374231	0.021837423	0.021837423
+6	50000	0	49963.990578	-0.000720188	0.000720188
+6	50000	1	49451.370791	-0.010972584	0.010972584
+6	50000	2	48274.893200	-0.034502136	0.034502136
+6	50000	3	50602.074305	0.012041486	0.012041486
+6	50000	4	49419.400439	-0.011611991	0.011611991
+6	50000	5	50978.720025	0.019574401	0.019574401
+6	50000	6	50466.222932	0.009324459	0.009324459
+6	50000	7	50776.911056	0.015538221	0.015538221
+6	50000	8	50539.893317	0.010797866	0.010797866
+6	50000	9	50198.182561	0.003963651	0.003963651
+6	50000	10	50544.397873	0.010887957	0.010887957
+6	50000	11	48885.037870	-0.022299243	0.022299243
+6	50000	12	49838.424103	-0.003231518	0.003231518
+6	50000	13	50987.200681	0.019744014	0.019744014
+6	50000	14	48842.208092	-0.023155838	0.023155838
+6	50000	15	49793.371906	-0.004132562	0.004132562
+6	50000	16	50073.089970	0.001461799	0.001461799
+6	50000	17	51330.244429	0.026604889	0.026604889
+6	50000	18	50130.509366	0.002610187	0.002610187
+6	50000	19	48859.031413	-0.022819372	0.022819372
+6	50000	20	50021.896777	0.000437936	0.000437936
+6	50000	21	50941.128255	0.018822565	0.018822565
+6	50000	22	50293.346458	0.005866929	0.005866929
+6	50000	23	49463.748833	-0.010725023	0.010725023
+7	100	0	101.240942	0.012409424	0.012409424
+7	100	1	100.216046	0.002160456	0.002160456
+7	100	2	101.240942	0.012409424	0.012409424
+7	100	3	100.216046	0.002160456	0.002160456
+7	100	4	100.216046	0.002160456	0.002160456
+7	100	5	101.240942	0.012409424	0.012409424
+7	100	6	100.216046	0.002160456	0.002160456
+7	100	7	99.191405	-0.008085948	0.008085948
+7	100	8	100.216046	0.002160456	0.002160456
+7	100	9	100.216046	0.002160456	0.002160456
+7	100	10	100.216046	0.002160456	0.002160456
+7	100	11	101.240942	0.012409424	0.012409424
+7	100	12	100.216046	0.002160456	0.002160456
+7	100	13	99.191405	-0.008085948	0.008085948
+7	100	14	100.216046	0.002160456	0.002160456
+7	100	15	101.240942	0.012409424	0.012409424
+7	100	16	101.240942	0.012409424	0.012409424
+7	100	17	100.216046	0.002160456	0.002160456
+7	100	18	101.240942	0.012409424	0.012409424
+7	100	19	99.191405	-0.008085948	0.008085948
+7	100	20	100.216046	0.002160456	0.002160456
+7	100	21	101.240942	0.012409424	0.012409424
+7	100	22	101.240942	0.012409424	0.012409424
+7	100	23	100.216046	0.002160456	0.002160456
+7	500	0	498.094192	-0.003811615	0.003811615
+7	500	1	502.613917	0.005227834	0.005227834
+7	500	2	509.402869	0.018805738	0.018805738
+7	500	3	489.069678	-0.021860645	0.021860645
+7	500	4	506.006986	0.012013973	0.012013973
+7	500	5	490.196655	-0.019606690	0.019606690
+7	500	6	500.353431	0.000706863	0.000706863
+7	500	7	495.836199	-0.008327602	0.008327602
+7	500	8	495.836199	-0.008327602	0.008327602
+7	500	9	493.579450	-0.012841101	0.012841101
+7	500	10	504.875651	0.009751302	0.009751302
+7	500	11	500.353431	0.000706863	0.000706863
+7	500	12	501.483518	0.002967036	0.002967036
+7	500	13	499.223656	-0.001552688	0.001552688
+7	500	14	499.223656	-0.001552688	0.001552688
+7	500	15	502.613917	0.005227834	0.005227834
+7	500	16	502.613917	0.005227834	0.005227834
+7	500	17	506.006986	0.012013973	0.012013973
+7	500	18	491.323943	-0.017352114	0.017352114
+7	500	19	496.965040	-0.006069920	0.006069920
+7	500	20	501.483518	0.002967036	0.002967036
+7	500	21	499.223656	-0.001552688	0.001552688
+7	500	22	498.094192	-0.003811615	0.003811615
+7	500	23	503.744628	0.007489256	0.007489256
+7	1000	0	994.532588	-0.005467412	0.005467412
+7	1000	1	1003.466070	0.003466070	0.003466070
+7	1000	2	1013.699680	0.013699680	0.013699680
+7	1000	3	999.635049	-0.000364951	0.000364951
+7	1000	4	1007.300678	0.007300678	0.007300678
+7	1000	5	1008.579679	0.008579679	0.008579679
+7	1000	6	1008.579679	0.008579679	0.008579679
+7	1000	7	983.075238	-0.016924762	0.016924762
+7	1000	8	1008.579679	0.008579679	0.008579679
+7	1000	9	993.257965	-0.006742035	0.006742035
+7	1000	10	999.635049	-0.000364951	0.000364951
+7	1000	11	1016.262082	0.016262082	0.016262082
+7	1000	12	990.709909	-0.009290091	0.009290091
+7	1000	13	1012.419079	0.012419079	0.012419079
+7	1000	14	997.083024	-0.002916976	0.002916976
+7	1000	15	997.083024	-0.002916976	0.002916976
+7	1000	16	995.807607	-0.004192393	0.004192393
+7	1000	17	1000.911658	0.000911658	0.000911658
+7	1000	18	1002.188665	0.002188665	0.002188665
+7	1000	19	1008.579679	0.008579679	0.008579679
+7	1000	20	1011.138879	0.011138879	0.011138879
+7	1000	21	1018.826088	0.018826088	0.018826088
+7	1000	22	988.163437	-0.011836563	0.011836563
+7	1000	23	999.635049	-0.000364951	0.000364951
+7	5000	0	5132.317241	0.026463448	0.026463448
+7	5000	1	4957.555477	-0.008488905	0.008488905
+7	5000	2	5008.186530	0.001637306	0.001637306
+7	5000	3	5001.399453	0.000279891	0.000279891
+7	5000	4	5139.324942	0.027864988	0.027864988
+7	5000	5	4977.732858	-0.004453428	0.004453428
+7	5000	6	5045.717821	0.009143564	0.009143564
+7	5000	7	4907.542646	-0.018491471	0.018491471
+7	5000	8	4970.996014	-0.005800797	0.005800797
+7	5000	9	5025.203588	0.005040718	0.005040718
+7	5000	10	4904.230070	-0.019153986	0.019153986
+7	5000	11	4891.006491	-0.021798702	0.021798702
+7	5000	12	5004.791585	0.000958317	0.000958317
+7	5000	13	4991.239877	-0.001752025	0.001752025
+7	5000	14	5045.717821	0.009143564	0.009143564
+7	5000	15	5011.584290	0.002316858	0.002316858
+7	5000	16	4828.770987	-0.034245803	0.034245803
+7	5000	17	5107.884276	0.021576855	0.021576855
+7	5000	18	5100.930114	0.020186023	0.020186023
+7	5000	19	4967.631743	-0.006473651	0.006473651
+7	5000	20	5042.291639	0.008458328	0.008458328
+7	5000	21	4994.623603	-0.001075279	0.001075279
+7	5000	22	5021.794515	0.004358903	0.004358903
+7	5000	23	4924.145830	-0.015170834	0.015170834
+7	10000	0	10098.948862	0.009894886	0.009894886
+7	10000	1	9695.738323	-0.030426168	0.030426168
+7	10000	2	10075.476018	0.007547602	0.007547602
+7	10000	3	10028.930063	0.002893006	0.002893006
+7	10000	4	9717.127406	-0.028287259	0.028287259
+7	10000	5	9814.785012	-0.018521499	0.018521499
+7	10000	6	9870.062504	-0.012993750	0.012993750
+7	10000	7	9760.243594	-0.023975641	0.023975641
+7	10000	8	10267.136712	0.026713671	0.026713671
+7	10000	9	10063.789848	0.006378985	0.006378985
+7	10000	10	9914.827977	-0.008517202	0.008517202
+7	10000	11	10040.517058	0.004051706	0.004051706
+7	10000	12	9903.590659	-0.009640934	0.009640934
+7	10000	13	9982.907107	-0.001709289	0.001709289
+7	10000	14	10040.517058	0.004051706	0.004051706
+7	10000	15	10158.226307	0.015822631	0.015822631
+7	10000	16	10005.853945	0.000585395	0.000585395
+7	10000	17	10158.226307	0.015822631	0.015822631
+7	10000	18	10028.930063	0.002893006	0.002893006
+7	10000	19	10063.789848	0.006378985	0.006378985
+7	10000	20	10242.682908	0.024268291	0.024268291
+7	10000	21	10087.195626	0.008719563	0.008719563
+7	10000	22	9803.818473	-0.019618153	0.019618153
+7	10000	23	10052.136924	0.005213692	0.005213692
+7	50000	0	49547.998834	-0.009040023	0.009040023
+7	50000	1	49635.805032	-0.007283899	0.007283899
+7	50000	2	50716.493647	0.014329873	0.014329873
+7	50000	3	50875.312282	0.017506246	0.017506246
+7	50000	4	49975.277589	-0.000494448	0.000494448
+7	50000	5	51229.806636	0.024596133	0.024596133
+7	50000	6	50717.288875	0.014345777	0.014345777
+7	50000	7	48694.741963	-0.026105161	0.026105161
+7	50000	8	50383.548123	0.007670962	0.007670962
+7	50000	9	50863.770100	0.017275402	0.017275402
+7	50000	10	49118.409407	-0.017631812	0.017631812
+7	50000	11	49441.801318	-0.011163974	0.011163974
+7	50000	12	50453.765549	0.009075311	0.009075311
+7	50000	13	50517.306534	0.010346131	0.010346131
+7	50000	14	49677.392362	-0.006452153	0.006452153
+7	50000	15	49632.144856	-0.007357103	0.007357103
+7	50000	16	48922.754637	-0.021544907	0.021544907
+7	50000	17	49544.810567	-0.009103789	0.009103789
+7	50000	18	51714.222631	0.034284453	0.034284453
+7	50000	19	50040.033817	0.000800676	0.000800676
+7	50000	20	49591.713597	-0.008165728	0.008165728
+7	50000	21	49797.249030	-0.004055019	0.004055019
+7	50000	22	51881.284363	0.037625687	0.037625687
+7	50000	23	49540.911516	-0.009181770	0.009181770
+8	100	0	99.191405	-0.008085948	0.008085948
+8	100	1	100.216046	0.002160456	0.002160456
+8	100	2	98.167021	-0.018329790	0.018329790
+8	100	3	101.240942	0.012409424	0.012409424
+8	100	4	100.216046	0.002160456	0.002160456
+8	100	5	100.216046	0.002160456	0.002160456
+8	100	6	101.240942	0.012409424	0.012409424
+8	100	7	99.191405	-0.008085948	0.008085948
+8	100	8	99.191405	-0.008085948	0.008085948
+8	100	9	100.216046	0.002160456	0.002160456
+8	100	10	100.216046	0.002160456	0.002160456
+8	100	11	101.240942	0.012409424	0.012409424
+8	100	12	99.191405	-0.008085948	0.008085948
+8	100	13	98.167021	-0.018329790	0.018329790
+8	100	14	99.191405	-0.008085948	0.008085948
+8	100	15	98.167021	-0.018329790	0.018329790
+8	100	16	100.216046	0.002160456	0.002160456
+8	100	17	101.240942	0.012409424	0.012409424
+8	100	18	99.191405	-0.008085948	0.008085948
+8	100	19	98.167021	-0.018329790	0.018329790
+8	100	20	100.216046	0.002160456	0.002160456
+8	100	21	100.216046	0.002160456	0.002160456
+8	100	22	99.191405	-0.008085948	0.008085948
+8	100	23	98.167021	-0.018329790	0.018329790
+8	500	0	508.270595	0.016541190	0.016541190
+8	500	1	486.816652	-0.026366696	0.026366696
+8	500	2	507.138634	0.014277269	0.014277269
+8	500	3	499.223656	-0.001552688	0.001552688
+8	500	4	493.579450	-0.012841101	0.012841101
+8	500	5	498.094192	-0.003811615	0.003811615
+8	500	6	501.483518	0.002967036	0.002967036
+8	500	7	494.707669	-0.010584662	0.010584662
+8	500	8	510.535456	0.021070911	0.021070911
+8	500	9	501.483518	0.002967036	0.002967036
+8	500	10	501.483518	0.002967036	0.002967036
+8	500	11	498.094192	-0.003811615	0.003811615
+8	500	12	498.094192	-0.003811615	0.003811615
+8	500	13	504.875651	0.009751302	0.009751302
+8	500	14	496.965040	-0.006069920	0.006069920
+8	500	15	496.965040	-0.006069920	0.006069920
+8	500	16	502.613917	0.005227834	0.005227834
+8	500	17	498.094192	-0.003811615	0.003811615
+8	500	18	502.613917	0.005227834	0.005227834
+8	500	19	500.353431	0.000706863	0.000706863
+8	500	20	508.270595	0.016541190	0.016541190
+8	500	21	496.965040	-0.006069920	0.006069920
+8	500	22	500.353431	0.000706863	0.000706863
+8	500	23	502.613917	0.005227834	0.005227834
+8	1000	0	988.163437	-0.011836563	0.011836563
+8	1000	1	1004.743874	0.004743874	0.004743874
+8	1000	2	990.709909	-0.009290091	0.009290091
+8	1000	3	991.983739	-0.008016261	0.008016261
+8	1000	4	993.257965	-0.006742035	0.006742035
+8	1000	5	997.083024	-0.002916976	0.002916976
+8	1000	6	995.807607	-0.004192393	0.004192393
+8	1000	7	1013.699680	0.013699680	0.013699680
+8	1000	8	984.346695	-0.015653305	0.015653305
+8	1000	9	991.983739	-0.008016261	0.008016261
+8	1000	10	1022.675110	0.022675110	0.022675110
+8	1000	11	1013.699680	0.013699680	0.013699680
+8	1000	12	1011.138879	0.011138879	0.011138879
+8	1000	13	993.257965	-0.006742035	0.006742035
+8	1000	14	989.436475	-0.010563525	0.010563525
+8	1000	15	1006.022077	0.006022077	0.006022077
+8	1000	16	989.436475	-0.010563525	0.010563525
+8	1000	17	1009.859079	0.009859079	0.009859079
+8	1000	18	1013.699680	0.013699680	0.013699680
+8	1000	19	1011.138879	0.011138879	0.011138879
+8	1000	20	1006.022077	0.006022077	0.006022077
+8	1000	21	989.436475	-0.010563525	0.010563525
+8	1000	22	972.917762	-0.027082238	0.027082238
+8	1000	23	998.358838	-0.001641162	0.001641162
+8	5000	0	4944.158899	-0.011168220	0.011168220
+8	5000	1	5052.578794	0.010515759	0.010515759
+8	5000	2	5083.596191	0.016719238	0.016719238
+8	5000	3	5028.615500	0.005723100	0.005723100
+8	5000	4	5093.987740	0.018797548	0.018797548
+8	5000	5	5004.791585	0.000958317	0.000958317
+8	5000	6	5001.399453	0.000279891	0.000279891
+8	5000	7	5008.186530	0.001637306	0.001637306
+8	5000	8	5032.030256	0.006406051	0.006406051
+8	5000	9	4981.105439	-0.003778912	0.003778912
+8	5000	10	4998.010127	-0.000397975	0.000397975
+8	5000	11	5021.794515	0.004358903	0.004358903
+8	5000	12	5049.146871	0.009829374	0.009829374
+8	5000	13	4960.911479	-0.007817704	0.007817704
+8	5000	14	5038.868321	0.007773664	0.007773664
+8	5000	15	4947.503938	-0.010499212	0.010499212
+8	5000	16	5001.399453	0.000279891	0.000279891
+8	5000	17	4957.555477	-0.008488905	0.008488905
+8	5000	18	5021.794515	0.004358903	0.004358903
+8	5000	19	4970.996014	-0.005800797	0.005800797
+8	5000	20	5052.578794	0.010515759	0.010515759
+8	5000	21	4934.140142	-0.013171972	0.013171972
+8	5000	22	4977.732858	-0.004453428	0.004453428
+8	5000	23	5035.447861	0.007089572	0.007089572
+8	10000	0	10052.136924	0.005213692	0.005213692
+8	10000	1	9881.208089	-0.011879191	0.011879191
+8	10000	2	9892.384085	-0.010761591	0.010761591
+8	10000	3	9538.784255	-0.046121574	0.046121574
+8	10000	4	9971.481716	-0.002851828	0.002851828
+8	10000	5	9982.907107	-0.001709289	0.001709289
+8	10000	6	10005.853945	0.000585395	0.000585395
+8	10000	7	10507.032690	0.050703269	0.050703269
+8	10000	8	10366.438545	0.036643854	0.036643854
+8	10000	9	10040.517058	0.004051706	0.004051706
+8	10000	10	10328.917672	0.032891767	0.032891767
+8	10000	11	10242.682908	0.024268291	0.024268291
+8	10000	12	10379.022272	0.037902227	0.037902227
+8	10000	13	9642.749227	-0.035725077	0.035725077
+8	10000	14	9948.726102	-0.005127390	0.005127390
+8	10000	15	9590.436894	-0.040956311	0.040956311
+8	10000	16	9738.628768	-0.026137123	0.026137123
+8	10000	17	10182.179592	0.018217959	0.018217959
+8	10000	18	10254.891561	0.025489156	0.025489156
+8	10000	19	9858.947165	-0.014105284	0.014105284
+8	10000	20	10158.226307	0.015822631	0.015822631
+8	10000	21	9836.806570	-0.016319343	0.016319343
+8	10000	22	10040.517058	0.004051706	0.004051706
+8	10000	23	9926.096210	-0.007390379	0.007390379
+8	50000	0	48857.468835	-0.022850623	0.022850623
+8	50000	1	48734.492951	-0.025310141	0.025310141
+8	50000	2	49426.536993	-0.011469260	0.011469260
+8	50000	3	48546.115551	-0.029077689	0.029077689
+8	50000	4	49386.633883	-0.012267322	0.012267322
+8	50000	5	50730.912592	0.014618252	0.014618252
+8	50000	6	49069.543504	-0.018609130	0.018609130
+8	50000	7	49985.535665	-0.000289287	0.000289287
+8	50000	8	50235.859203	0.004717184	0.004717184
+8	50000	9	49320.533739	-0.013589325	0.013589325
+8	50000	10	49940.381193	-0.001192376	0.001192376
+8	50000	11	50118.561281	0.002371226	0.002371226
+8	50000	12	50078.115419	0.001562308	0.001562308
+8	50000	13	51681.133430	0.033622669	0.033622669
+8	50000	14	50339.979529	0.006799591	0.006799591
+8	50000	15	50375.347188	0.007506944	0.007506944
+8	50000	16	50902.734737	0.018054695	0.018054695
+8	50000	17	49368.200361	-0.012635993	0.012635993
+8	50000	18	49692.683185	-0.006146336	0.006146336
+8	50000	19	50979.624804	0.019592496	0.019592496
+8	50000	20	49956.384799	-0.000872304	0.000872304
+8	50000	21	51345.343701	0.026906874	0.026906874
+8	50000	22	51422.534795	0.028450696	0.028450696
+8	50000	23	51431.022606	0.028620452	0.028620452
+9	100	0	100.216046	0.002160456	0.002160456
+9	100	1	101.240942	0.012409424	0.012409424
+9	100	2	100.216046	0.002160456	0.002160456
+9	100	3	99.191405	-0.008085948	0.008085948
+9	100	4	99.191405	-0.008085948	0.008085948
+9	100	5	100.216046	0.002160456	0.002160456
+9	100	6	101.240942	0.012409424	0.012409424
+9	100	7	99.191405	-0.008085948	0.008085948
+9	100	8	97.142893	-0.028571070	0.028571070
+9	100	9	99.191405	-0.008085948	0.008085948
+9	100	10	101.240942	0.012409424	0.012409424
+9	100	11	100.216046	0.002160456	0.002160456
+9	100	12	99.191405	-0.008085948	0.008085948
+9	100	13	99.191405	-0.008085948	0.008085948
+9	100	14	99.191405	-0.008085948	0.008085948
+9	100	15	101.240942	0.012409424	0.012409424
+9	100	16	101.240942	0.012409424	0.012409424
+9	100	17	99.191405	-0.008085948	0.008085948
+9	100	18	99.191405	-0.008085948	0.008085948
+9	100	19	100.216046	0.002160456	0.002160456
+9	100	20	99.191405	-0.008085948	0.008085948
+9	100	21	98.167021	-0.018329790	0.018329790
+9	100	22	99.191405	-0.008085948	0.008085948
+9	100	23	99.191405	-0.008085948	0.008085948
+9	500	0	494.707669	-0.010584662	0.010584662
+9	500	1	502.613917	0.005227834	0.005227834
+9	500	2	492.451541	-0.015096918	0.015096918
+9	500	3	507.138634	0.014277269	0.014277269
+9	500	4	494.707669	-0.010584662	0.010584662
+9	500	5	489.069678	-0.021860645	0.021860645
+9	500	6	509.402869	0.018805738	0.018805738
+9	500	7	501.483518	0.002967036	0.002967036
+9	500	8	499.223656	-0.001552688	0.001552688
+9	500	9	502.613917	0.005227834	0.005227834
+9	500	10	504.875651	0.009751302	0.009751302
+9	500	11	499.223656	-0.001552688	0.001552688
+9	500	12	494.707669	-0.010584662	0.010584662
+9	500	13	503.744628	0.007489256	0.007489256
+9	500	14	503.744628	0.007489256	0.007489256
+9	500	15	506.006986	0.012013973	0.012013973
+9	500	16	511.668356	0.023336711	0.023336711
+9	500	17	489.069678	-0.021860645	0.021860645
+9	500	18	500.353431	0.000706863	0.000706863
+9	500	19	490.196655	-0.019606690	0.019606690
+9	500	20	508.270595	0.016541190	0.016541190
+9	500	21	509.402869	0.018805738	0.018805738
+9	500	22	502.613917	0.005227834	0.005227834
+9	500	23	503.744628	0.007489256	0.007489256
+9	1000	0	990.709909	-0.009290091	0.009290091
+9	1000	1	998.358838	-0.001641162	0.001641162
+9	1000	2	1002.188665	0.002188665	0.002188665
+9	1000	3	1014.980680	0.014980680	0.014980680
+9	1000	4	995.807607	-0.004192393	0.004192393
+9	1000	5	1013.699680	0.013699680	0.013699680
+9	1000	6	980.533506	-0.019466494	0.019466494
+9	1000	7	1004.743874	0.004743874	0.004743874
+9	1000	8	1008.579679	0.008579679	0.008579679
+9	1000	9	984.346695	-0.015653305	0.015653305
+9	1000	10	1009.859079	0.009859079	0.009859079
+9	1000	11	999.635049	-0.000364951	0.000364951
+9	1000	12	991.983739	-0.008016261	0.008016261
+9	1000	13	994.532588	-0.005467412	0.005467412
+9	1000	14	998.358838	-0.001641162	0.001641162
+9	1000	15	990.709909	-0.009290091	0.009290091
+9	1000	16	1018.826088	0.018826088	0.018826088
+9	1000	17	1000.911658	0.000911658	0.000911658
+9	1000	18	1003.466070	0.003466070	0.003466070
+9	1000	19	994.532588	-0.005467412	0.005467412
+9	1000	20	1018.826088	0.018826088	0.018826088
+9	1000	21	1018.826088	0.018826088	0.018826088
+9	1000	22	1013.699680	0.013699680	0.013699680
+9	1000	23	1021.391701	0.021391701	0.021391701
+9	5000	0	5090.520960	0.018104192	0.018104192
+9	5000	1	4930.805994	-0.013838801	0.013838801
+9	5000	2	4864.686721	-0.027062656	0.027062656
+9	5000	3	5107.884276	0.021576855	0.021576855
+9	5000	4	4970.996014	-0.005800797	0.005800797
+9	5000	5	5038.868321	0.007773664	0.007773664
+9	5000	6	4940.816590	-0.011836682	0.011836682
+9	5000	7	5045.717821	0.009143564	0.009143564
+9	5000	8	4894.308385	-0.021138323	0.021138323
+9	5000	9	5093.987740	0.018797548	0.018797548
+9	5000	10	5001.399453	0.000279891	0.000279891
+9	5000	11	4960.911479	-0.007817704	0.007817704
+9	5000	12	5052.578794	0.010515759	0.010515759
+9	5000	13	4897.612944	-0.020477411	0.020477411
+9	5000	14	4974.363051	-0.005127390	0.005127390
+9	5000	15	4967.631743	-0.006473651	0.006473651
+9	5000	16	5163.946742	0.032789348	0.032789348
+9	5000	17	4934.140142	-0.013171972	0.013171972
+9	5000	18	5018.388278	0.003677656	0.003677656
+9	5000	19	4984.480800	-0.003103840	0.003103840
+9	5000	20	4998.010127	-0.000397975	0.000397975
+9	5000	21	4944.158899	-0.011168220	0.011168220
+9	5000	22	5011.584290	0.002316858	0.002316858
+9	5000	23	4967.631743	-0.006473651	0.006473651
+9	10000	0	10075.476018	0.007547602	0.007547602
+9	10000	1	9760.243594	-0.023975641	0.023975641
+9	10000	2	10230.510536	0.023051054	0.023051054
+9	10000	3	9994.364457	-0.000563554	0.000563554
+9	10000	4	10304.093353	0.030409335	0.030409335
+9	10000	5	10206.273779	0.020627378	0.020627378
+9	10000	6	10087.195626	0.008719563	0.008719563
+9	10000	7	9870.062504	-0.012993750	0.012993750
+9	10000	8	9994.364457	-0.000563554	0.000563554
+9	10000	9	9994.364457	-0.000563554	0.000563554
+9	10000	10	10122.556996	0.012255700	0.012255700
+9	10000	11	10218.374231	0.021837423	0.021837423
+9	10000	12	10158.226307	0.015822631	0.015822631
+9	10000	13	9926.096210	-0.007390379	0.007390379
+9	10000	14	10063.789848	0.006378985	0.006378985
+9	10000	15	9771.093931	-0.022890607	0.022890607
+9	10000	16	9858.947165	-0.014105284	0.014105284
+9	10000	17	10242.682908	0.024268291	0.024268291
+9	10000	18	10063.789848	0.006378985	0.006378985
+9	10000	19	9847.861908	-0.015213809	0.015213809
+9	10000	20	9903.590659	-0.009640934	0.009640934
+9	10000	21	10122.556996	0.012255700	0.012255700
+9	10000	22	9749.421923	-0.025057808	0.025057808
+9	10000	23	9538.784255	-0.046121574	0.046121574
+9	50000	0	49064.083864	-0.018718323	0.018718323
+9	50000	1	50863.283919	0.017265678	0.017265678
+9	50000	2	49905.517792	-0.001889644	0.001889644
+9	50000	3	51645.945198	0.032918904	0.032918904
+9	50000	4	51151.112859	0.023022257	0.023022257
+9	50000	5	49294.467293	-0.014110654	0.014110654
+9	50000	6	49945.482684	-0.001090346	0.001090346
+9	50000	7	50417.346363	0.008346927	0.008346927
+9	50000	8	48976.782615	-0.020464348	0.020464348
+9	50000	9	48934.415648	-0.021311687	0.021311687
+9	50000	10	50575.298165	0.011505963	0.011505963
+9	50000	11	50102.675241	0.002053505	0.002053505
+9	50000	12	49644.294183	-0.007114116	0.007114116
+9	50000	13	49356.826387	-0.012863472	0.012863472
+9	50000	14	49985.044464	-0.000299111	0.000299111
+9	50000	15	50715.384993	0.014307700	0.014307700
+9	50000	16	50592.584585	0.011851692	0.011851692
+9	50000	17	50475.115619	0.009502312	0.009502312
+9	50000	18	50710.859944	0.014217199	0.014217199
+9	50000	19	50263.231343	0.005264627	0.005264627
+9	50000	20	51170.168980	0.023403380	0.023403380
+9	50000	21	49866.231113	-0.002675378	0.002675378
+9	50000	22	49798.509479	-0.004029810	0.004029810
+9	50000	23	48961.695184	-0.020766096	0.020766096
+10	100	0	98.167021	-0.018329790	0.018329790
+10	100	1	99.191405	-0.008085948	0.008085948
+10	100	2	98.167021	-0.018329790	0.018329790
+10	100	3	99.191405	-0.008085948	0.008085948
+10	100	4	99.191405	-0.008085948	0.008085948
+10	100	5	101.240942	0.012409424	0.012409424
+10	100	6	100.216046	0.002160456	0.002160456
+10	100	7	101.240942	0.012409424	0.012409424
+10	100	8	100.216046	0.002160456	0.002160456
+10	100	9	99.191405	-0.008085948	0.008085948
+10	100	10	101.240942	0.012409424	0.012409424
+10	100	11	99.191405	-0.008085948	0.008085948
+10	100	12	98.167021	-0.018329790	0.018329790
+10	100	13	99.191405	-0.008085948	0.008085948
+10	100	14	101.240942	0.012409424	0.012409424
+10	100	15	101.240942	0.012409424	0.012409424
+10	100	16	101.240942	0.012409424	0.012409424
+10	100	17	100.216046	0.002160456	0.002160456
+10	100	18	100.216046	0.002160456	0.002160456
+10	100	19	100.216046	0.002160456	0.002160456
+10	100	20	101.240942	0.012409424	0.012409424
+10	100	21	99.191405	-0.008085948	0.008085948
+10	100	22	100.216046	0.002160456	0.002160456
+10	100	23	99.191405	-0.008085948	0.008085948
+10	500	0	501.483518	0.002967036	0.002967036
+10	500	1	508.270595	0.016541190	0.016541190
+10	500	2	501.483518	0.002967036	0.002967036
+10	500	3	501.483518	0.002967036	0.002967036
+10	500	4	496.965040	-0.006069920	0.006069920
+10	500	5	496.965040	-0.006069920	0.006069920
+10	500	6	499.223656	-0.001552688	0.001552688
+10	500	7	503.744628	0.007489256	0.007489256
+10	500	8	501.483518	0.002967036	0.002967036
+10	500	9	503.744628	0.007489256	0.007489256
+10	500	10	507.138634	0.014277269	0.014277269
+10	500	11	491.323943	-0.017352114	0.017352114
+10	500	12	508.270595	0.016541190	0.016541190
+10	500	13	506.006986	0.012013973	0.012013973
+10	500	14	500.353431	0.000706863	0.000706863
+10	500	15	503.744628	0.007489256	0.007489256
+10	500	16	501.483518	0.002967036	0.002967036
+10	500	17	503.744628	0.007489256	0.007489256
+10	500	18	508.270595	0.016541190	0.016541190
+10	500	19	500.353431	0.000706863	0.000706863
+10	500	20	494.707669	-0.010584662	0.010584662
+10	500	21	492.451541	-0.015096918	0.015096918
+10	500	22	498.094192	-0.003811615	0.003811615
+10	500	23	513.935096	0.027870192	0.027870192
+10	1000	0	983.075238	-0.016924762	0.016924762
+10	1000	1	1012.419079	0.012419079	0.012419079
+10	1000	2	1007.300678	0.007300678	0.007300678
+10	1000	3	991.983739	-0.008016261	0.008016261
+10	1000	4	986.890795	-0.013109205	0.013109205
+10	1000	5	990.709909	-0.009290091	0.009290091
+10	1000	6	1006.022077	0.006022077	0.006022077
+10	1000	7	1007.300678	0.007300678	0.007300678
+10	1000	8	1004.743874	0.004743874	0.004743874
+10	1000	9	999.635049	-0.000364951	0.000364951
+10	1000	10	1008.579679	0.008579679	0.008579679
+10	1000	11	988.163437	-0.011836563	0.011836563
+10	1000	12	1000.911658	0.000911658	0.000911658
+10	1000	13	991.983739	-0.008016261	0.008016261
+10	1000	14	1007.300678	0.007300678	0.007300678
+10	1000	15	994.532588	-0.005467412	0.005467412
+10	1000	16	1003.466070	0.003466070	0.003466070
+10	1000	17	1006.022077	0.006022077	0.006022077
+10	1000	18	998.358838	-0.001641162	0.001641162
+10	1000	19	1006.022077	0.006022077	0.006022077
+10	1000	20	1020.108694	0.020108694	0.020108694
+10	1000	21	983.075238	-0.016924762	0.016924762
+10	1000	22	995.807607	-0.004192393	0.004192393
+10	1000	23	986.890795	-0.013109205	0.013109205
+10	5000	0	5066.335314	0.013267063	0.013267063
+10	5000	1	5028.615500	0.005723100	0.005723100
+10	5000	2	4920.819805	-0.015836039	0.015836039
+10	5000	3	4773.876985	-0.045224603	0.045224603
+10	5000	4	5011.584290	0.002316858	0.002316858
+10	5000	5	5001.399453	0.000279891	0.000279891
+10	5000	6	5028.615500	0.005723100	0.005723100
+10	5000	7	4964.270233	-0.007145953	0.007145953
+10	5000	8	5097.457456	0.019491491	0.019491491
+10	5000	9	4991.239877	-0.001752025	0.001752025
+10	5000	10	4987.858944	-0.002428211	0.002428211
+10	5000	11	5066.335314	0.013267063	0.013267063
+10	5000	12	5042.291639	0.008458328	0.008458328
+10	5000	13	5097.457456	0.019491491	0.019491491
+10	5000	14	5025.203588	0.005040718	0.005040718
+10	5000	15	4897.612944	-0.020477411	0.020477411
+10	5000	16	5062.891850	0.012578370	0.012578370
+10	5000	17	4894.308385	-0.021138323	0.021138323
+10	5000	18	4851.589988	-0.029682002	0.029682002
+10	5000	19	4848.322337	-0.030335533	0.030335533
+10	5000	20	4964.270233	-0.007145953	0.007145953
+10	5000	21	5011.584290	0.002316858	0.002316858
+10	5000	22	4937.477005	-0.012504599	0.012504599
+10	5000	23	4940.816590	-0.011836682	0.011836682
+10	10000	0	10134.412287	0.013441229	0.013441229
+10	10000	1	10291.737386	0.029173739	0.029173739
+10	10000	2	9727.863978	-0.027213602	0.027213602
+10	10000	3	9825.780992	-0.017421901	0.017421901
+10	10000	4	10110.735920	0.011073592	0.011073592
+10	10000	5	10242.682908	0.024268291	0.024268291
+10	10000	6	10028.930063	0.002893006	0.002893006
+10	10000	7	10098.948862	0.009894886	0.009894886
+10	10000	8	10218.374231	0.021837423	0.021837423
+10	10000	9	9971.481716	-0.002851828	0.002851828
+10	10000	10	9937.395527	-0.006260447	0.006260447
+10	10000	11	10254.891561	0.025489156	0.025489156
+10	10000	12	10158.226307	0.015822631	0.015822631
+10	10000	13	9825.780992	-0.017421901	0.017421901
+10	10000	14	9738.628768	-0.026137123	0.026137123
+10	10000	15	10040.517058	0.004051706	0.004051706
+10	10000	16	9971.481716	-0.002851828	0.002851828
+10	10000	17	10017.375753	0.001737575	0.001737575
+10	10000	18	10052.136924	0.005213692	0.005213692
+10	10000	19	9858.947165	-0.014105284	0.014105284
+10	10000	20	10366.438545	0.036643854	0.036643854
+10	10000	21	9825.780992	-0.017421901	0.017421901
+10	10000	22	10075.476018	0.007547602	0.007547602
+10	10000	23	9803.818473	-0.019618153	0.019618153
+10	50000	0	50017.657621	0.000353152	0.000353152
+10	50000	1	50015.559018	0.000311180	0.000311180
+10	50000	2	50902.063991	0.018041280	0.018041280
+10	50000	3	50855.581722	0.017111634	0.017111634
+10	50000	4	48874.520908	-0.022509582	0.022509582
+10	50000	5	49180.604186	-0.016387916	0.016387916
+10	50000	6	49368.341762	-0.012633165	0.012633165
+10	50000	7	50040.522942	0.000810459	0.000810459
+10	50000	8	49810.772476	-0.003784550	0.003784550
+10	50000	9	49798.119296	-0.004037614	0.004037614
+10	50000	10	50966.410214	0.019328204	0.019328204
+10	50000	11	50084.258653	0.001685173	0.001685173
+10	50000	12	49961.608801	-0.000767824	0.000767824
+10	50000	13	49946.848581	-0.001063028	0.001063028
+10	50000	14	48967.845777	-0.020643084	0.020643084
+10	50000	15	49533.806496	-0.009323870	0.009323870
+10	50000	16	49234.345963	-0.015313081	0.015313081
+10	50000	17	48992.837488	-0.020143250	0.020143250
+10	50000	18	50654.771589	0.013095432	0.013095432
+10	50000	19	51836.359836	0.036727197	0.036727197
+10	50000	20	49688.471228	-0.006230575	0.006230575
+10	50000	21	50980.178770	0.019603575	0.019603575
+10	50000	22	51244.471365	0.024889427	0.024889427
+10	50000	23	49931.093989	-0.001378120	0.001378120
+11	100	0	98.167021	-0.018329790	0.018329790
+11	100	1	101.240942	0.012409424	0.012409424
+11	100	2	101.240942	0.012409424	0.012409424
+11	100	3	101.240942	0.012409424	0.012409424
+11	100	4	101.240942	0.012409424	0.012409424
+11	100	5	98.167021	-0.018329790	0.018329790
+11	100	6	101.240942	0.012409424	0.012409424
+11	100	7	100.216046	0.002160456	0.002160456
+11	100	8	98.167021	-0.018329790	0.018329790
+11	100	9	100.216046	0.002160456	0.002160456
+11	100	10	100.216046	0.002160456	0.002160456
+11	100	11	98.167021	-0.018329790	0.018329790
+11	100	12	98.167021	-0.018329790	0.018329790
+11	100	13	101.240942	0.012409424	0.012409424
+11	100	14	100.216046	0.002160456	0.002160456
+11	100	15	100.216046	0.002160456	0.002160456
+11	100	16	100.216046	0.002160456	0.002160456
+11	100	17	101.240942	0.012409424	0.012409424
+11	100	18	100.216046	0.002160456	0.002160456
+11	100	19	100.216046	0.002160456	0.002160456
+11	100	20	101.240942	0.012409424	0.012409424
+11	100	21	98.167021	-0.018329790	0.018329790
+11	100	22	101.240942	0.012409424	0.012409424
+11	100	23	99.191405	-0.008085948	0.008085948
+11	500	0	500.353431	0.000706863	0.000706863
+11	500	1	501.483518	0.002967036	0.002967036
+11	500	2	500.353431	0.000706863	0.000706863
+11	500	3	495.836199	-0.008327602	0.008327602
+11	500	4	500.353431	0.000706863	0.000706863
+11	500	5	499.223656	-0.001552688	0.001552688
+11	500	6	504.875651	0.009751302	0.009751302
+11	500	7	494.707669	-0.010584662	0.010584662
+11	500	8	499.223656	-0.001552688	0.001552688
+11	500	9	503.744628	0.007489256	0.007489256
+11	500	10	490.196655	-0.019606690	0.019606690
+11	500	11	499.223656	-0.001552688	0.001552688
+11	500	12	500.353431	0.000706863	0.000706863
+11	500	13	494.707669	-0.010584662	0.010584662
+11	500	14	508.270595	0.016541190	0.016541190
+11	500	15	503.744628	0.007489256	0.007489256
+11	500	16	506.006986	0.012013973	0.012013973
+11	500	17	498.094192	-0.003811615	0.003811615
+11	500	18	499.223656	-0.001552688	0.001552688
+11	500	19	496.965040	-0.006069920	0.006069920
+11	500	20	508.270595	0.016541190	0.016541190
+11	500	21	495.836199	-0.008327602	0.008327602
+11	500	22	495.836199	-0.008327602	0.008327602
+11	500	23	498.094192	-0.003811615	0.003811615
+11	1000	0	1000.911658	0.000911658	0.000911658
+11	1000	1	997.083024	-0.002916976	0.002916976
+11	1000	2	1014.980680	0.014980680	0.014980680
+11	1000	3	1007.300678	0.007300678	0.007300678
+11	1000	4	993.257965	-0.006742035	0.006742035
+11	1000	5	977.993351	-0.022006649	0.022006649
+11	1000	6	999.635049	-0.000364951	0.000364951
+11	1000	7	1000.911658	0.000911658	0.000911658
+11	1000	8	1016.262082	0.016262082	0.016262082
+11	1000	9	998.358838	-0.001641162	0.001641162
+11	1000	10	979.263232	-0.020736768	0.020736768
+11	1000	11	970.382324	-0.029617676	0.029617676
+11	1000	12	1014.980680	0.014980680	0.014980680
+11	1000	13	1002.188665	0.002188665	0.002188665
+11	1000	14	1000.911658	0.000911658	0.000911658
+11	1000	15	1006.022077	0.006022077	0.006022077
+11	1000	16	984.346695	-0.015653305	0.015653305
+11	1000	17	985.618547	-0.014381453	0.014381453
+11	1000	18	991.983739	-0.008016261	0.008016261
+11	1000	19	985.618547	-0.014381453	0.014381453
+11	1000	20	981.804175	-0.018195825	0.018195825
+11	1000	21	1003.466070	0.003466070	0.003466070
+11	1000	22	990.709909	-0.009290091	0.009290091
+11	1000	23	1000.911658	0.000911658	0.000911658
+11	5000	0	4991.239877	-0.001752025	0.001752025
+11	5000	1	5069.781675	0.013956335	0.013956335
+11	5000	2	5004.791585	0.000958317	0.000958317
+11	5000	3	4891.006491	-0.021798702	0.021798702
+11	5000	4	4950.851711	-0.009829658	0.009829658
+11	5000	5	4957.555477	-0.008488905	0.008488905
+11	5000	6	5045.717821	0.009143564	0.009143564
+11	5000	7	5087.057112	0.017411422	0.017411422
+11	5000	8	4977.732858	-0.004453428	0.004453428
+11	5000	9	5045.717821	0.009143564	0.009143564
+11	5000	10	4967.631743	-0.006473651	0.006473651
+11	5000	11	4991.239877	-0.001752025	0.001752025
+11	5000	12	4944.158899	-0.011168220	0.011168220
+11	5000	13	5028.615500	0.005723100	0.005723100
+11	5000	14	4970.996014	-0.005800797	0.005800797
+11	5000	15	4960.911479	-0.007817704	0.007817704
+11	5000	16	5001.399453	0.000279891	0.000279891
+11	5000	17	4937.477005	-0.012504599	0.012504599
+11	5000	18	4981.105439	-0.003778912	0.003778912
+11	5000	19	5069.781675	0.013956335	0.013956335
+11	5000	20	5087.057112	0.017411422	0.017411422
+11	5000	21	4887.707256	-0.022458549	0.022458549
+11	5000	22	5093.987740	0.018797548	0.018797548
+11	5000	23	5014.984871	0.002996974	0.002996974
+11	10000	0	9982.907107	-0.001709289	0.001709289
+11	10000	1	10218.374231	0.021837423	0.021837423
+11	10000	2	10110.735920	0.011073592	0.011073592
+11	10000	3	9803.818473	-0.019618153	0.019618153
+11	10000	4	9803.818473	-0.019618153	0.019618153
+11	10000	5	10098.948862	0.009894886	0.009894886
+11	10000	6	10052.136924	0.005213692	0.005213692
+11	10000	7	9825.780992	-0.017421901	0.017421901
+11	10000	8	10087.195626	0.008719563	0.008719563
+11	10000	9	9914.827977	-0.008517202	0.008517202
+11	10000	10	9569.697610	-0.043030239	0.043030239
+11	10000	11	9717.127406	-0.028287259	0.028287259
+11	10000	12	9948.726102	-0.005127390	0.005127390
+11	10000	13	9948.726102	-0.005127390	0.005127390
+11	10000	14	9590.436894	-0.040956311	0.040956311
+11	10000	15	10146.301990	0.014630199	0.014630199
+11	10000	16	9994.364457	-0.000563554	0.000563554
+11	10000	17	9653.292348	-0.034670765	0.034670765
+11	10000	18	9569.697610	-0.043030239	0.043030239
+11	10000	19	9926.096210	-0.007390379	0.007390379
+11	10000	20	10040.517058	0.004051706	0.004051706
+11	10000	21	10379.022272	0.037902227	0.037902227
+11	10000	22	9982.907107	-0.001709289	0.001709289
+11	10000	23	9738.628768	-0.026137123	0.026137123
+11	50000	0	49423.358946	-0.011532821	0.011532821
+11	50000	1	49931.257499	-0.001374850	0.001374850
+11	50000	2	50085.166466	0.001703329	0.001703329
+11	50000	3	50003.110636	0.000062213	0.000062213
+11	50000	4	49441.528465	-0.011169431	0.011169431
+11	50000	5	49297.967485	-0.014040650	0.014040650
+11	50000	6	51699.365753	0.033987315	0.033987315
+11	50000	7	50441.083869	0.008821677	0.008821677
+11	50000	8	51376.499587	0.027529992	0.027529992
+11	50000	9	50176.432575	0.003528651	0.003528651
+11	50000	10	48794.846354	-0.024103073	0.024103073
+11	50000	11	51073.396587	0.021467932	0.021467932
+11	50000	12	50819.319744	0.016386395	0.016386395
+11	50000	13	51473.995066	0.029479901	0.029479901
+11	50000	14	50907.423919	0.018148478	0.018148478
+11	50000	15	50251.315463	0.005026309	0.005026309
+11	50000	16	49553.418824	-0.008931624	0.008931624
+11	50000	17	50885.602955	0.017712059	0.017712059
+11	50000	18	50147.198048	0.002943961	0.002943961
+11	50000	19	49481.958489	-0.010360830	0.010360830
+11	50000	20	49492.524002	-0.010149520	0.010149520
+11	50000	21	50025.103345	0.000502067	0.000502067
+11	50000	22	51477.916913	0.029558338	0.029558338
+11	50000	23	48722.287786	-0.025554244	0.025554244
+12	100	0	100.216046	0.002160456	0.002160456
+12	100	1	101.240942	0.012409424	0.012409424
+12	100	2	100.216046	0.002160456	0.002160456
+12	100	3	100.216046	0.002160456	0.002160456
+12	100	4	97.142893	-0.028571070	0.028571070
+12	100	5	98.167021	-0.018329790	0.018329790
+12	100	6	101.240942	0.012409424	0.012409424
+12	100	7	98.167021	-0.018329790	0.018329790
+12	100	8	101.240942	0.012409424	0.012409424
+12	100	9	100.216046	0.002160456	0.002160456
+12	100	10	100.216046	0.002160456	0.002160456
+12	100	11	101.240942	0.012409424	0.012409424
+12	100	12	101.240942	0.012409424	0.012409424
+12	100	13	99.191405	-0.008085948	0.008085948
+12	100	14	100.216046	0.002160456	0.002160456
+12	100	15	100.216046	0.002160456	0.002160456
+12	100	16	101.240942	0.012409424	0.012409424
+12	100	17	101.240942	0.012409424	0.012409424
+12	100	18	100.216046	0.002160456	0.002160456
+12	100	19	98.167021	-0.018329790	0.018329790
+12	100	20	101.240942	0.012409424	0.012409424
+12	100	21	101.240942	0.012409424	0.012409424
+12	100	22	101.240942	0.012409424	0.012409424
+12	100	23	100.216046	0.002160456	0.002160456
+12	500	0	501.483518	0.002967036	0.002967036
+12	500	1	508.270595	0.016541190	0.016541190
+12	500	2	498.094192	-0.003811615	0.003811615
+12	500	3	496.965040	-0.006069920	0.006069920
+12	500	4	499.223656	-0.001552688	0.001552688
+12	500	5	504.875651	0.009751302	0.009751302
+12	500	6	503.744628	0.007489256	0.007489256
+12	500	7	500.353431	0.000706863	0.000706863
+12	500	8	503.744628	0.007489256	0.007489256
+12	500	9	503.744628	0.007489256	0.007489256
+12	500	10	493.579450	-0.012841101	0.012841101
+12	500	11	494.707669	-0.010584662	0.010584662
+12	500	12	496.965040	-0.006069920	0.006069920
+12	500	13	503.744628	0.007489256	0.007489256
+12	500	14	500.353431	0.000706863	0.000706863
+12	500	15	498.094192	-0.003811615	0.003811615
+12	500	16	489.069678	-0.021860645	0.021860645
+12	500	17	493.579450	-0.012841101	0.012841101
+12	500	18	506.006986	0.012013973	0.012013973
+12	500	19	500.353431	0.000706863	0.000706863
+12	500	20	502.613917	0.005227834	0.005227834
+12	500	21	504.875651	0.009751302	0.009751302
+12	500	22	493.579450	-0.012841101	0.012841101
+12	500	23	504.875651	0.009751302	0.009751302
+12	1000	0	1002.188665	0.002188665	0.002188665
+12	1000	1	1004.743874	0.004743874	0.004743874
+12	1000	2	998.358838	-0.001641162	0.001641162
+12	1000	3	986.890795	-0.013109205	0.013109205
+12	1000	4	1017.543884	0.017543884	0.017543884
+12	1000	5	984.346695	-0.015653305	0.015653305
+12	1000	6	1002.188665	0.002188665	0.002188665
+12	1000	7	977.993351	-0.022006649	0.022006649
+12	1000	8	1017.543884	0.017543884	0.017543884
+12	1000	9	1003.466070	0.003466070	0.003466070
+12	1000	10	991.983739	-0.008016261	0.008016261
+12	1000	11	991.983739	-0.008016261	0.008016261
+12	1000	12	999.635049	-0.000364951	0.000364951
+12	1000	13	1003.466070	0.003466070	0.003466070
+12	1000	14	995.807607	-0.004192393	0.004192393
+12	1000	15	1026.527751	0.026527751	0.026527751
+12	1000	16	988.163437	-0.011836563	0.011836563
+12	1000	17	998.358838	-0.001641162	0.001641162
+12	1000	18	998.358838	-0.001641162	0.001641162
+12	1000	19	993.257965	-0.006742035	0.006742035
+12	1000	20	1025.243135	0.025243135	0.025243135
+12	1000	21	991.983739	-0.008016261	0.008016261
+12	1000	22	994.532588	-0.005467412	0.005467412
+12	1000	23	988.163437	-0.011836563	0.011836563
+12	5000	0	5093.987740	0.018797548	0.018797548
+12	5000	1	4998.010127	-0.000397975	0.000397975
+12	5000	2	5032.030256	0.006406051	0.006406051
+12	5000	3	4940.816590	-0.011836682	0.011836682
+12	5000	4	5008.186530	0.001637306	0.001637306
+12	5000	5	4927.474558	-0.014505088	0.014505088
+12	5000	6	4984.480800	-0.003103840	0.003103840
+12	5000	7	5114.850264	0.022970053	0.022970053
+12	5000	8	5052.578794	0.010515759	0.010515759
+12	5000	9	4991.239877	-0.001752025	0.001752025
+12	5000	10	4937.477005	-0.012504599	0.012504599
+12	5000	11	4894.308385	-0.021138323	0.021138323
+12	5000	12	5121.828119	0.024365624	0.024365624
+12	5000	13	4970.996014	-0.005800797	0.005800797
+12	5000	14	5001.399453	0.000279891	0.000279891
+12	5000	15	4819.030198	-0.036193960	0.036193960
+12	5000	16	5052.578794	0.010515759	0.010515759
+12	5000	17	5059.451279	0.011890256	0.011890256
+12	5000	18	4947.503938	-0.010499212	0.010499212
+12	5000	19	4981.105439	-0.003778912	0.003778912
+12	5000	20	4950.851711	-0.009829658	0.009829658
+12	5000	21	4891.006491	-0.021798702	0.021798702
+12	5000	22	4991.239877	-0.001752025	0.001752025
+12	5000	23	5032.030256	0.006406051	0.006406051
+12	10000	0	9892.384085	-0.010761591	0.010761591
+12	10000	1	9836.806570	-0.016319343	0.016319343
+12	10000	2	10194.208969	0.019420897	0.019420897
+12	10000	3	9926.096210	-0.007390379	0.007390379
+12	10000	4	10146.301990	0.014630199	0.014630199
+12	10000	5	9914.827977	-0.008517202	0.008517202
+12	10000	6	10052.136924	0.005213692	0.005213692
+12	10000	7	9892.384085	-0.010761591	0.010761591
+12	10000	8	10098.948862	0.009894886	0.009894886
+12	10000	9	9771.093931	-0.022890607	0.022890607
+12	10000	10	10341.386479	0.034138648	0.034138648
+12	10000	11	10110.735920	0.011073592	0.011073592
+12	10000	12	10005.853945	0.000585395	0.000585395
+12	10000	13	10005.853945	0.000585395	0.000585395
+12	10000	14	10005.853945	0.000585395	0.000585395
+12	10000	15	10052.136924	0.005213692	0.005213692
+12	10000	16	9994.364457	-0.000563554	0.000563554
+12	10000	17	10040.517058	0.004051706	0.004051706
+12	10000	18	10040.517058	0.004051706	0.004051706
+12	10000	19	9836.806570	-0.016319343	0.016319343
+12	10000	20	9926.096210	-0.007390379	0.007390379
+12	10000	21	10017.375753	0.001737575	0.001737575
+12	10000	22	10304.093353	0.030409335	0.030409335
+12	10000	23	10341.386479	0.034138648	0.034138648
+12	50000	0	49746.068691	-0.005078626	0.005078626
+12	50000	1	51504.786846	0.030095737	0.030095737
+12	50000	2	49775.410074	-0.004491799	0.004491799
+12	50000	3	48856.762847	-0.022864743	0.022864743
+12	50000	4	49018.929040	-0.019621419	0.019621419
+12	50000	5	50100.614214	0.002012284	0.002012284
+12	50000	6	50549.805609	0.010996112	0.010996112
+12	50000	7	50445.622683	0.008912454	0.008912454
+12	50000	8	50436.760336	0.008735207	0.008735207
+12	50000	9	49840.867776	-0.003182644	0.003182644
+12	50000	10	51714.665343	0.034293307	0.034293307
+12	50000	11	50343.511104	0.006870222	0.006870222
+12	50000	12	49735.600180	-0.005287996	0.005287996
+12	50000	13	50594.376348	0.011887527	0.011887527
+12	50000	14	49460.322251	-0.010793555	0.010793555
+12	50000	15	50586.052986	0.011721060	0.011721060
+12	50000	16	51052.060366	0.021041207	0.021041207
+12	50000	17	49569.261148	-0.008614777	0.008614777
+12	50000	18	50033.822492	0.000676450	0.000676450
+12	50000	19	49025.493405	-0.019490132	0.019490132
+12	50000	20	50637.678739	0.012753575	0.012753575
+12	50000	21	48898.019818	-0.022039604	0.022039604
+12	50000	22	48794.666929	-0.024106661	0.024106661
+12	50000	23	50283.949846	0.005678997	0.005678997
+13	100	0	100.216046	0.002160456	0.002160456
+13	100	1	100.216046	0.002160456	0.002160456
+13	100	2	99.191405	-0.008085948	0.008085948
+13	100	3	100.216046	0.002160456	0.002160456
+13	100	4	98.167021	-0.018329790	0.018329790
+13	100	5	99.191405	-0.008085948	0.008085948
+13	100	6	100.216046	0.002160456	0.002160456
+13	100	7	99.191405	-0.008085948	0.008085948
+13	100	8	100.216046	0.002160456	0.002160456
+13	100	9	99.191405	-0.008085948	0.008085948
+13	100	10	101.240942	0.012409424	0.012409424
+13	100	11	98.167021	-0.018329790	0.018329790
+13	100	12	101.240942	0.012409424	0.012409424
+13	100	13	99.191405	-0.008085948	0.008085948
+13	100	14	101.240942	0.012409424	0.012409424
+13	100	15	100.216046	0.002160456	0.002160456
+13	100	16	101.240942	0.012409424	0.012409424
+13	100	17	100.216046	0.002160456	0.002160456
+13	100	18	98.167021	-0.018329790	0.018329790
+13	100	19	101.240942	0.012409424	0.012409424
+13	100	20	98.167021	-0.018329790	0.018329790
+13	100	21	100.216046	0.002160456	0.002160456
+13	100	22	101.240942	0.012409424	0.012409424
+13	100	23	101.240942	0.012409424	0.012409424
+13	500	0	507.138634	0.014277269	0.014277269
+13	500	1	500.353431	0.000706863	0.000706863
+13	500	2	504.875651	0.009751302	0.009751302
+13	500	3	495.836199	-0.008327602	0.008327602
+13	500	4	511.668356	0.023336711	0.023336711
+13	500	5	500.353431	0.000706863	0.000706863
+13	500	6	495.836199	-0.008327602	0.008327602
+13	500	7	506.006986	0.012013973	0.012013973
+13	500	8	501.483518	0.002967036	0.002967036
+13	500	9	501.483518	0.002967036	0.002967036
+13	500	10	504.875651	0.009751302	0.009751302
+13	500	11	508.270595	0.016541190	0.016541190
+13	500	12	500.353431	0.000706863	0.000706863
+13	500	13	491.323943	-0.017352114	0.017352114
+13	500	14	500.353431	0.000706863	0.000706863
+13	500	15	496.965040	-0.006069920	0.006069920
+13	500	16	498.094192	-0.003811615	0.003811615
+13	500	17	506.006986	0.012013973	0.012013973
+13	500	18	502.613917	0.005227834	0.005227834
+13	500	19	500.353431	0.000706863	0.000706863
+13	500	20	489.069678	-0.021860645	0.021860645
+13	500	21	500.353431	0.000706863	0.000706863
+13	500	22	494.707669	-0.010584662	0.010584662
+13	500	23	495.836199	-0.008327602	0.008327602
+13	1000	0	986.890795	-0.013109205	0.013109205
+13	1000	1	998.358838	-0.001641162	0.001641162
+13	1000	2	1002.188665	0.002188665	0.002188665
+13	1000	3	999.635049	-0.000364951	0.000364951
+13	1000	4	998.358838	-0.001641162	0.001641162
+13	1000	5	993.257965	-0.006742035	0.006742035
+13	1000	6	991.983739	-0.008016261	0.008016261
+13	1000	7	1035.531366	0.035531366	0.035531366
+13	1000	8	993.257965	-0.006742035	0.006742035
+13	1000	9	995.807607	-0.004192393	0.004192393
+13	1000	10	989.436475	-0.010563525	0.010563525
+13	1000	11	998.358838	-0.001641162	0.001641162
+13	1000	12	1011.138879	0.011138879	0.011138879
+13	1000	13	977.993351	-0.022006649	0.022006649
+13	1000	14	993.257965	-0.006742035	0.006742035
+13	1000	15	985.618547	-0.014381453	0.014381453
+13	1000	16	999.635049	-0.000364951	0.000364951
+13	1000	17	1009.859079	0.009859079	0.009859079
+13	1000	18	1004.743874	0.004743874	0.004743874
+13	1000	19	998.358838	-0.001641162	0.001641162
+13	1000	20	1006.022077	0.006022077	0.006022077
+13	1000	21	986.890795	-0.013109205	0.013109205
+13	1000	22	1000.911658	0.000911658	0.000911658
+13	1000	23	990.709909	-0.009290091	0.009290091
+13	5000	0	5049.146871	0.009829374	0.009829374
+13	5000	1	5042.291639	0.008458328	0.008458328
+13	5000	2	4914.175845	-0.017164831	0.017164831
+13	5000	3	5049.146871	0.009829374	0.009829374
+13	5000	4	4960.911479	-0.007817704	0.007817704
+13	5000	5	5090.520960	0.018104192	0.018104192
+13	5000	6	4884.410676	-0.023117865	0.023117865
+13	5000	7	4981.105439	-0.003778912	0.003778912
+13	5000	8	4957.555477	-0.008488905	0.008488905
+13	5000	9	5001.399453	0.000279891	0.000279891
+13	5000	10	4960.911479	-0.007817704	0.007817704
+13	5000	11	4998.010127	-0.000397975	0.000397975
+13	5000	12	4964.270233	-0.007145953	0.007145953
+13	5000	13	5062.891850	0.012578370	0.012578370
+13	5000	14	5056.013595	0.011202719	0.011202719
+13	5000	15	4950.851711	-0.009829658	0.009829658
+13	5000	16	4897.612944	-0.020477411	0.020477411
+13	5000	17	5066.335314	0.013267063	0.013267063
+13	5000	18	4937.477005	-0.012504599	0.012504599
+13	5000	19	5008.186530	0.001637306	0.001637306
+13	5000	20	4927.474558	-0.014505088	0.014505088
+13	5000	21	4900.920170	-0.019815966	0.019815966
+13	5000	22	5080.138191	0.016027638	0.016027638
+13	5000	23	4887.707256	-0.022458549	0.022458549
+13	10000	0	10075.476018	0.007547602	0.007547602
+13	10000	1	10146.301990	0.014630199	0.014630199
+13	10000	2	10279.418580	0.027941858	0.027941858
+13	10000	3	10017.375753	0.001737575	0.001737575
+13	10000	4	10230.510536	0.023051054	0.023051054
+13	10000	5	10122.556996	0.012255700	0.012255700
+13	10000	6	9881.208089	-0.011879191	0.011879191
+13	10000	7	10230.510536	0.023051054	0.023051054
+13	10000	8	9685.085522	-0.031491448	0.031491448
+13	10000	9	10170.185440	0.017018544	0.017018544
+13	10000	10	9914.827977	-0.008517202	0.008517202
+13	10000	11	9892.384085	-0.010761591	0.010761591
+13	10000	12	10612.401845	0.061240184	0.061240184
+13	10000	13	9870.062504	-0.012993750	0.012993750
+13	10000	14	10005.853945	0.000585395	0.000585395
+13	10000	15	10040.517058	0.004051706	0.004051706
+13	10000	16	10341.386479	0.034138648	0.034138648
+13	10000	17	10110.735920	0.011073592	0.011073592
+13	10000	18	9847.861908	-0.015213809	0.015213809
+13	10000	19	10254.891561	0.025489156	0.025489156
+13	10000	20	10267.136712	0.026713671	0.026713671
+13	10000	21	9948.726102	-0.005127390	0.005127390
+13	10000	22	9792.881217	-0.020711878	0.020711878
+13	10000	23	10267.136712	0.026713671	0.026713671
+13	50000	0	48402.151869	-0.031956963	0.031956963
+13	50000	1	50327.386724	0.006547734	0.006547734
+13	50000	2	50127.938962	0.002558779	0.002558779
+13	50000	3	50745.814533	0.014916291	0.014916291
+13	50000	4	50488.874163	0.009777483	0.009777483
+13	50000	5	50217.752406	0.004355048	0.004355048
+13	50000	6	48865.604219	-0.022687916	0.022687916
+13	50000	7	50184.874402	0.003697488	0.003697488
+13	50000	8	50967.568367	0.019351367	0.019351367
+13	50000	9	50744.026844	0.014880537	0.014880537
+13	50000	10	49736.130559	-0.005277389	0.005277389
+13	50000	11	49884.442953	-0.002311141	0.002311141
+13	50000	12	49172.563765	-0.016548725	0.016548725
+13	50000	13	52152.674494	0.043053490	0.043053490
+13	50000	14	50834.002959	0.016680059	0.016680059
+13	50000	15	49718.078662	-0.005638427	0.005638427
+13	50000	16	50441.974579	0.008839492	0.008839492
+13	50000	17	49897.756306	-0.002044874	0.002044874
+13	50000	18	49616.543894	-0.007669122	0.007669122
+13	50000	19	50634.862041	0.012697241	0.012697241
+13	50000	20	50054.268524	0.001085370	0.001085370
+13	50000	21	49014.391918	-0.019712162	0.019712162
+13	50000	22	49067.614994	-0.018647700	0.018647700
+13	50000	23	49249.566741	-0.015008665	0.015008665
+14	100	0	99.191405	-0.008085948	0.008085948
+14	100	1	100.216046	0.002160456	0.002160456
+14	100	2	99.191405	-0.008085948	0.008085948
+14	100	3	99.191405	-0.008085948	0.008085948
+14	100	4	99.191405	-0.008085948	0.008085948
+14	100	5	100.216046	0.002160456	0.002160456
+14	100	6	100.216046	0.002160456	0.002160456
+14	100	7	99.191405	-0.008085948	0.008085948
+14	100	8	100.216046	0.002160456	0.002160456
+14	100	9	97.142893	-0.028571070	0.028571070
+14	100	10	99.191405	-0.008085948	0.008085948
+14	100	11	101.240942	0.012409424	0.012409424
+14	100	12	100.216046	0.002160456	0.002160456
+14	100	13	100.216046	0.002160456	0.002160456
+14	100	14	100.216046	0.002160456	0.002160456
+14	100	15	100.216046	0.002160456	0.002160456
+14	100	16	99.191405	-0.008085948	0.008085948
+14	100	17	101.240942	0.012409424	0.012409424
+14	100	18	101.240942	0.012409424	0.012409424
+14	100	19	101.240942	0.012409424	0.012409424
+14	100	20	100.216046	0.002160456	0.002160456
+14	100	21	101.240942	0.012409424	0.012409424
+14	100	22	101.240942	0.012409424	0.012409424
+14	100	23	100.216046	0.002160456	0.002160456
+14	500	0	503.744628	0.007489256	0.007489256
+14	500	1	501.483518	0.002967036	0.002967036
+14	500	2	509.402869	0.018805738	0.018805738
+14	500	3	503.744628	0.007489256	0.007489256
+14	500	4	502.613917	0.005227834	0.005227834
+14	500	5	499.223656	-0.001552688	0.001552688
+14	500	6	499.223656	-0.001552688	0.001552688
+14	500	7	496.965040	-0.006069920	0.006069920
+14	500	8	507.138634	0.014277269	0.014277269
+14	500	9	493.579450	-0.012841101	0.012841101
+14	500	10	509.402869	0.018805738	0.018805738
+14	500	11	503.744628	0.007489256	0.007489256
+14	500	12	492.451541	-0.015096918	0.015096918
+14	500	13	496.965040	-0.006069920	0.006069920
+14	500	14	509.402869	0.018805738	0.018805738
+14	500	15	501.483518	0.002967036	0.002967036
+14	500	16	499.223656	-0.001552688	0.001552688
+14	500	17	487.943010	-0.024113980	0.024113980
+14	500	18	501.483518	0.002967036	0.002967036
+14	500	19	501.483518	0.002967036	0.002967036
+14	500	20	503.744628	0.007489256	0.007489256
+14	500	21	503.744628	0.007489256	0.007489256
+14	500	22	508.270595	0.016541190	0.016541190
+14	500	23	506.006986	0.012013973	0.012013973
+14	1000	0	998.358838	-0.001641162	0.001641162
+14	1000	1	995.807607	-0.004192393	0.004192393
+14	1000	2	1011.138879	0.011138879	0.011138879
+14	1000	3	995.807607	-0.004192393	0.004192393
+14	1000	4	1003.466070	0.003466070	0.003466070
+14	1000	5	989.436475	-0.010563525	0.010563525
+14	1000	6	980.533506	-0.019466494	0.019466494
+14	1000	7	1003.466070	0.003466070	0.003466070
+14	1000	8	1016.262082	0.016262082	0.016262082
+14	1000	9	998.358838	-0.001641162	0.001641162
+14	1000	10	1008.579679	0.008579679	0.008579679
+14	1000	11	972.917762	-0.027082238	0.027082238
+14	1000	12	1016.262082	0.016262082	0.016262082
+14	1000	13	1007.300678	0.007300678	0.007300678
+14	1000	14	994.532588	-0.005467412	0.005467412
+14	1000	15	1007.300678	0.007300678	0.007300678
+14	1000	16	1004.743874	0.004743874	0.004743874
+14	1000	17	994.532588	-0.005467412	0.005467412
+14	1000	18	1013.699680	0.013699680	0.013699680
+14	1000	19	1008.579679	0.008579679	0.008579679
+14	1000	20	1008.579679	0.008579679	0.008579679
+14	1000	21	1004.743874	0.004743874	0.004743874
+14	1000	22	988.163437	-0.011836563	0.011836563
+14	1000	23	1004.743874	0.004743874	0.004743874
+14	5000	0	5028.615500	0.005723100	0.005723100
+14	5000	1	5125.321509	0.025064302	0.025064302
+14	5000	2	5045.717821	0.009143564	0.009143564
+14	5000	3	5118.337705	0.023667541	0.023667541
+14	5000	4	4964.270233	-0.007145953	0.007145953
+14	5000	5	5114.850264	0.022970053	0.022970053
+14	5000	6	5025.203588	0.005040718	0.005040718
+14	5000	7	4994.623603	-0.001075279	0.001075279
+14	5000	8	4998.010127	-0.000397975	0.000397975
+14	5000	9	4960.911479	-0.007817704	0.007817704
+14	5000	10	4954.202223	-0.009159555	0.009159555
+14	5000	11	4950.851711	-0.009829658	0.009829658
+14	5000	12	4981.105439	-0.003778912	0.003778912
+14	5000	13	4987.858944	-0.002428211	0.002428211
+14	5000	14	5128.817882	0.025763576	0.025763576
+14	5000	15	5018.388278	0.003677656	0.003677656
+14	5000	16	4937.477005	-0.012504599	0.012504599
+14	5000	17	5008.186530	0.001637306	0.001637306
+14	5000	18	4924.145830	-0.015170834	0.015170834
+14	5000	19	5042.291639	0.008458328	0.008458328
+14	5000	20	5104.405719	0.020881144	0.020881144
+14	5000	21	4907.542646	-0.018491471	0.018491471
+14	5000	22	5056.013595	0.011202719	0.011202719
+14	5000	23	5076.683109	0.015336622	0.015336622
+14	10000	0	10158.226307	0.015822631	0.015822631
+14	10000	1	9960.088106	-0.003991189	0.003991189
+14	10000	2	9982.907107	-0.001709289	0.001709289
+14	10000	3	10391.644778	0.039164478	0.039164478
+14	10000	4	10028.930063	0.002893006	0.002893006
+14	10000	5	10028.930063	0.002893006	0.002893006
+14	10000	6	9600.846049	-0.039915395	0.039915395
+14	10000	7	9836.806570	-0.016319343	0.016319343
+14	10000	8	10017.375753	0.001737575	0.001737575
+14	10000	9	10075.476018	0.007547602	0.007547602
+14	10000	10	10005.853945	0.000585395	0.000585395
+14	10000	11	9825.780992	-0.017421901	0.017421901
+14	10000	12	9738.628768	-0.026137123	0.026137123
+14	10000	13	9870.062504	-0.012993750	0.012993750
+14	10000	14	9948.726102	-0.005127390	0.005127390
+14	10000	15	10158.226307	0.015822631	0.015822631
+14	10000	16	9847.861908	-0.015213809	0.015213809
+14	10000	17	9792.881217	-0.020711878	0.020711878
+14	10000	18	9836.806570	-0.016319343	0.016319343
+14	10000	19	10098.948862	0.009894886	0.009894886
+14	10000	20	9982.907107	-0.001709289	0.001709289
+14	10000	21	9881.208089	-0.011879191	0.011879191
+14	10000	22	10098.948862	0.009894886	0.009894886
+14	10000	23	10304.093353	0.030409335	0.030409335
+14	50000	0	49433.278794	-0.011334424	0.011334424
+14	50000	1	49590.601813	-0.008187964	0.008187964
+14	50000	2	50740.769666	0.014815393	0.014815393
+14	50000	3	49819.261718	-0.003614766	0.003614766
+14	50000	4	50037.381105	0.000747622	0.000747622
+14	50000	5	51711.194681	0.034223894	0.034223894
+14	50000	6	49888.708581	-0.002225828	0.002225828
+14	50000	7	50342.952108	0.006859042	0.006859042
+14	50000	8	49218.434915	-0.015631302	0.015631302
+14	50000	9	49464.393733	-0.010712125	0.010712125
+14	50000	10	49920.279521	-0.001594410	0.001594410
+14	50000	11	51209.550905	0.024191018	0.024191018
+14	50000	12	49287.077757	-0.014258445	0.014258445
+14	50000	13	50689.139380	0.013782788	0.013782788
+14	50000	14	50772.049998	0.015441000	0.015441000
+14	50000	15	50422.103611	0.008442072	0.008442072
+14	50000	16	49690.057829	-0.006198843	0.006198843
+14	50000	17	50698.166121	0.013963322	0.013963322
+14	50000	18	49940.360354	-0.001192793	0.001192793
+14	50000	19	50755.287302	0.015105746	0.015105746
+14	50000	20	49776.475669	-0.004470487	0.004470487
+14	50000	21	49414.534423	-0.011709312	0.011709312
+14	50000	22	50235.797932	0.004715959	0.004715959
+14	50000	23	49120.034368	-0.017599313	0.017599313
+15	100	0	100.216046	0.002160456	0.002160456
+15	100	1	98.167021	-0.018329790	0.018329790
+15	100	2	101.240942	0.012409424	0.012409424
+15	100	3	99.191405	-0.008085948	0.008085948
+15	100	4	101.240942	0.012409424	0.012409424
+15	100	5	99.191405	-0.008085948	0.008085948
+15	100	6	99.191405	-0.008085948	0.008085948
+15	100	7	100.216046	0.002160456	0.002160456
+15	100	8	99.191405	-0.008085948	0.008085948
+15	100	9	99.191405	-0.008085948	0.008085948
+15	100	10	101.240942	0.012409424	0.012409424
+15	100	11	98.167021	-0.018329790	0.018329790
+15	100	12	101.240942	0.012409424	0.012409424
+15	100	13	100.216046	0.002160456	0.002160456
+15	100	14	100.216046	0.002160456	0.002160456
+15	100	15	101.240942	0.012409424	0.012409424
+15	100	16	101.240942	0.012409424	0.012409424
+15	100	17	100.216046	0.002160456	0.002160456
+15	100	18	101.240942	0.012409424	0.012409424
+15	100	19	100.216046	0.002160456	0.002160456
+15	100	20	100.216046	0.002160456	0.002160456
+15	100	21	101.240942	0.012409424	0.012409424
+15	100	22	100.216046	0.002160456	0.002160456
+15	100	23	101.240942	0.012409424	0.012409424
+15	500	0	498.094192	-0.003811615	0.003811615
+15	500	1	506.006986	0.012013973	0.012013973
+15	500	2	495.836199	-0.008327602	0.008327602
+15	500	3	501.483518	0.002967036	0.002967036
+15	500	4	507.138634	0.014277269	0.014277269
+15	500	5	493.579450	-0.012841101	0.012841101
+15	500	6	501.483518	0.002967036	0.002967036
+15	500	7	499.223656	-0.001552688	0.001552688
+15	500	8	507.138634	0.014277269	0.014277269
+15	500	9	494.707669	-0.010584662	0.010584662
+15	500	10	506.006986	0.012013973	0.012013973
+15	500	11	503.744628	0.007489256	0.007489256
+15	500	12	502.613917	0.005227834	0.005227834
+15	500	13	506.006986	0.012013973	0.012013973
+15	500	14	490.196655	-0.019606690	0.019606690
+15	500	15	499.223656	-0.001552688	0.001552688
+15	500	16	495.836199	-0.008327602	0.008327602
+15	500	17	496.965040	-0.006069920	0.006069920
+15	500	18	493.579450	-0.012841101	0.012841101
+15	500	19	494.707669	-0.010584662	0.010584662
+15	500	20	495.836199	-0.008327602	0.008327602
+15	500	21	499.223656	-0.001552688	0.001552688
+15	500	22	494.707669	-0.010584662	0.010584662
+15	500	23	501.483518	0.002967036	0.002967036
+15	1000	0	1016.262082	0.016262082	0.016262082
+15	1000	1	1006.022077	0.006022077	0.006022077
+15	1000	2	1004.743874	0.004743874	0.004743874
+15	1000	3	986.890795	-0.013109205	0.013109205
+15	1000	4	998.358838	-0.001641162	0.001641162
+15	1000	5	984.346695	-0.015653305	0.015653305
+15	1000	6	994.532588	-0.005467412	0.005467412
+15	1000	7	989.436475	-0.010563525	0.010563525
+15	1000	8	997.083024	-0.002916976	0.002916976
+15	1000	9	985.618547	-0.014381453	0.014381453
+15	1000	10	998.358838	-0.001641162	0.001641162
+15	1000	11	988.163437	-0.011836563	0.011836563
+15	1000	12	1009.859079	0.009859079	0.009859079
+15	1000	13	1007.300678	0.007300678	0.007300678
+15	1000	14	995.807607	-0.004192393	0.004192393
+15	1000	15	991.983739	-0.008016261	0.008016261
+15	1000	16	1003.466070	0.003466070	0.003466070
+15	1000	17	1000.911658	0.000911658	0.000911658
+15	1000	18	1013.699680	0.013699680	0.013699680
+15	1000	19	1002.188665	0.002188665	0.002188665
+15	1000	20	998.358838	-0.001641162	0.001641162
+15	1000	21	986.890795	-0.013109205	0.013109205
+15	1000	22	1000.911658	0.000911658	0.000911658
+15	1000	23	993.257965	-0.006742035	0.006742035
+15	5000	0	5097.457456	0.019491491	0.019491491
+15	5000	1	5032.030256	0.006406051	0.006406051
+15	5000	2	4924.145830	-0.015170834	0.015170834
+15	5000	3	5090.520960	0.018104192	0.018104192
+15	5000	4	5042.291639	0.008458328	0.008458328
+15	5000	5	5042.291639	0.008458328	0.008458328
+15	5000	6	5021.794515	0.004358903	0.004358903
+15	5000	7	5045.717821	0.009143564	0.009143564
+15	5000	8	4981.105439	-0.003778912	0.003778912
+15	5000	9	5045.717821	0.009143564	0.009143564
+15	5000	10	5038.868321	0.007773664	0.007773664
+15	5000	11	4927.474558	-0.014505088	0.014505088
+15	5000	12	4904.230070	-0.019153986	0.019153986
+15	5000	13	4877.825466	-0.024434907	0.024434907
+15	5000	14	5104.405719	0.020881144	0.020881144
+15	5000	15	5014.984871	0.002996974	0.002996974
+15	5000	16	5052.578794	0.010515759	0.010515759
+15	5000	17	5104.405719	0.020881144	0.020881144
+15	5000	18	5004.791585	0.000958317	0.000958317
+15	5000	19	5035.447861	0.007089572	0.007089572
+15	5000	20	5069.781675	0.013956335	0.013956335
+15	5000	21	5028.615500	0.005723100	0.005723100
+15	5000	22	4874.536826	-0.025092635	0.025092635
+15	5000	23	5008.186530	0.001637306	0.001637306
+15	10000	0	9847.861908	-0.015213809	0.015213809
+15	10000	1	10242.682908	0.024268291	0.024268291
+15	10000	2	10028.930063	0.002893006	0.002893006
+15	10000	3	10468.207755	0.046820776	0.046820776
+15	10000	4	10028.930063	0.002893006	0.002893006
+15	10000	5	9892.384085	-0.010761591	0.010761591
+15	10000	6	9836.806570	-0.016319343	0.016319343
+15	10000	7	10087.195626	0.008719563	0.008719563
+15	10000	8	10110.735920	0.011073592	0.011073592
+15	10000	9	9914.827977	-0.008517202	0.008517202
+15	10000	10	9926.096210	-0.007390379	0.007390379
+15	10000	11	9836.806570	-0.016319343	0.016319343
+15	10000	12	10254.891561	0.025489156	0.025489156
+15	10000	13	10194.208969	0.019420897	0.019420897
+15	10000	14	10075.476018	0.007547602	0.007547602
+15	10000	15	10098.948862	0.009894886	0.009894886
+15	10000	16	10242.682908	0.024268291	0.024268291
+15	10000	17	10481.108553	0.048110855	0.048110855
+15	10000	18	10017.375753	0.001737575	0.001737575
+15	10000	19	9792.881217	-0.020711878	0.020711878
+15	10000	20	9982.907107	-0.001709289	0.001709289
+15	10000	21	10206.273779	0.020627378	0.020627378
+15	10000	22	10230.510536	0.023051054	0.023051054
+15	10000	23	9717.127406	-0.028287259	0.028287259
+15	50000	0	48679.782893	-0.026404342	0.026404342
+15	50000	1	50162.598203	0.003251964	0.003251964
+15	50000	2	49111.623163	-0.017767537	0.017767537
+15	50000	3	50930.294731	0.018605895	0.018605895
+15	50000	4	49407.093070	-0.011858139	0.011858139
+15	50000	5	50195.398654	0.003907973	0.003907973
+15	50000	6	50186.362621	0.003727252	0.003727252
+15	50000	7	50753.061776	0.015061236	0.015061236
+15	50000	8	49906.955620	-0.001860888	0.001860888
+15	50000	9	50184.852167	0.003697043	0.003697043
+15	50000	10	50742.640138	0.014852803	0.014852803
+15	50000	11	49759.965249	-0.004800695	0.004800695
+15	50000	12	50475.466074	0.009509321	0.009509321
+15	50000	13	50686.887247	0.013737745	0.013737745
+15	50000	14	49842.480966	-0.003150381	0.003150381
+15	50000	15	48939.672771	-0.021206545	0.021206545
+15	50000	16	50605.946771	0.012118935	0.012118935
+15	50000	17	49383.930033	-0.012321399	0.012321399
+15	50000	18	49291.745945	-0.014165081	0.014165081
+15	50000	19	50549.114321	0.010982286	0.010982286
+15	50000	20	50610.469167	0.012209383	0.012209383
+15	50000	21	49417.079491	-0.011658410	0.011658410
+15	50000	22	50983.471676	0.019669434	0.019669434
+15	50000	23	51046.883563	0.020937671	0.020937671
+16	100	0	101.240942	0.012409424	0.012409424
+16	100	1	99.191405	-0.008085948	0.008085948
+16	100	2	100.216046	0.002160456	0.002160456
+16	100	3	100.216046	0.002160456	0.002160456
+16	100	4	98.167021	-0.018329790	0.018329790
+16	100	5	99.191405	-0.008085948	0.008085948
+16	100	6	100.216046	0.002160456	0.002160456
+16	100	7	100.216046	0.002160456	0.002160456
+16	100	8	98.167021	-0.018329790	0.018329790
+16	100	9	100.216046	0.002160456	0.002160456
+16	100	10	101.240942	0.012409424	0.012409424
+16	100	11	98.167021	-0.018329790	0.018329790
+16	100	12	100.216046	0.002160456	0.002160456
+16	100	13	100.216046	0.002160456	0.002160456
+16	100	14	100.216046	0.002160456	0.002160456
+16	100	15	98.167021	-0.018329790	0.018329790
+16	100	16	101.240942	0.012409424	0.012409424
+16	100	17	100.216046	0.002160456	0.002160456
+16	100	18	100.216046	0.002160456	0.002160456
+16	100	19	97.142893	-0.028571070	0.028571070
+16	100	20	100.216046	0.002160456	0.002160456
+16	100	21	101.240942	0.012409424	0.012409424
+16	100	22	100.216046	0.002160456	0.002160456
+16	100	23	100.216046	0.002160456	0.002160456
+16	500	0	506.006986	0.012013973	0.012013973
+16	500	1	503.744628	0.007489256	0.007489256
+16	500	2	496.965040	-0.006069920	0.006069920
+16	500	3	510.535456	0.021070911	0.021070911
+16	500	4	494.707669	-0.010584662	0.010584662
+16	500	5	508.270595	0.016541190	0.016541190
+16	500	6	496.965040	-0.006069920	0.006069920
+16	500	7	501.483518	0.002967036	0.002967036
+16	500	8	501.483518	0.002967036	0.002967036
+16	500	9	493.579450	-0.012841101	0.012841101
+16	500	10	504.875651	0.009751302	0.009751302
+16	500	11	501.483518	0.002967036	0.002967036
+16	500	12	501.483518	0.002967036	0.002967036
+16	500	13	509.402869	0.018805738	0.018805738
+16	500	14	502.613917	0.005227834	0.005227834
+16	500	15	503.744628	0.007489256	0.007489256
+16	500	16	492.451541	-0.015096918	0.015096918
+16	500	17	495.836199	-0.008327602	0.008327602
+16	500	18	492.451541	-0.015096918	0.015096918
+16	500	19	507.138634	0.014277269	0.014277269
+16	500	20	499.223656	-0.001552688	0.001552688
+16	500	21	501.483518	0.002967036	0.002967036
+16	500	22	503.744628	0.007489256	0.007489256
+16	500	23	495.836199	-0.008327602	0.008327602
+16	1000	0	988.163437	-0.011836563	0.011836563
+16	1000	1	1006.022077	0.006022077	0.006022077
+16	1000	2	999.635049	-0.000364951	0.000364951
+16	1000	3	1003.466070	0.003466070	0.003466070
+16	1000	4	1007.300678	0.007300678	0.007300678
+16	1000	5	985.618547	-0.014381453	0.014381453
+16	1000	6	997.083024	-0.002916976	0.002916976
+16	1000	7	994.532588	-0.005467412	0.005467412
+16	1000	8	1000.911658	0.000911658	0.000911658
+16	1000	9	1004.743874	0.004743874	0.004743874
+16	1000	10	1029.098194	0.029098194	0.029098194
+16	1000	11	1002.188665	0.002188665	0.002188665
+16	1000	12	1006.022077	0.006022077	0.006022077
+16	1000	13	1002.188665	0.002188665	0.002188665
+16	1000	14	990.709909	-0.009290091	0.009290091
+16	1000	15	997.083024	-0.002916976	0.002916976
+16	1000	16	999.635049	-0.000364951	0.000364951
+16	1000	17	1016.262082	0.016262082	0.016262082
+16	1000	18	1009.859079	0.009859079	0.009859079
+16	1000	19	1009.859079	0.009859079	0.009859079
+16	1000	20	997.083024	-0.002916976	0.002916976
+16	1000	21	1013.699680	0.013699680	0.013699680
+16	1000	22	984.346695	-0.015653305	0.015653305
+16	1000	23	1004.743874	0.004743874	0.004743874
+16	5000	0	4994.623603	-0.001075279	0.001075279
+16	5000	1	5087.057112	0.017411422	0.017411422
+16	5000	2	4991.239877	-0.001752025	0.001752025
+16	5000	3	5028.615500	0.005723100	0.005723100
+16	5000	4	5121.828119	0.024365624	0.024365624
+16	5000	5	5018.388278	0.003677656	0.003677656
+16	5000	6	4887.707256	-0.022458549	0.022458549
+16	5000	7	4970.996014	-0.005800797	0.005800797
+16	5000	8	4819.030198	-0.036193960	0.036193960
+16	5000	9	5160.420267	0.032084053	0.032084053
+16	5000	10	4924.145830	-0.015170834	0.015170834
+16	5000	11	4957.555477	-0.008488905	0.008488905
+16	5000	12	4887.707256	-0.022458549	0.022458549
+16	5000	13	4970.996014	-0.005800797	0.005800797
+16	5000	14	5104.405719	0.020881144	0.020881144
+16	5000	15	4944.158899	-0.011168220	0.011168220
+16	5000	16	4984.480800	-0.003103840	0.003103840
+16	5000	17	5018.388278	0.003677656	0.003677656
+16	5000	18	4998.010127	-0.000397975	0.000397975
+16	5000	19	4967.631743	-0.006473651	0.006473651
+16	5000	20	4897.612944	-0.020477411	0.020477411
+16	5000	21	5032.030256	0.006406051	0.006406051
+16	5000	22	4934.140142	-0.013171972	0.013171972
+16	5000	23	5128.817882	0.025763576	0.025763576
+16	10000	0	9892.384085	-0.010761591	0.010761591
+16	10000	1	9792.881217	-0.020711878	0.020711878
+16	10000	2	10052.136924	0.005213692	0.005213692
+16	10000	3	9982.907107	-0.001709289	0.001709289
+16	10000	4	9926.096210	-0.007390379	0.007390379
+16	10000	5	9937.395527	-0.006260447	0.006260447
+16	10000	6	9926.096210	-0.007390379	0.007390379
+16	10000	7	10098.948862	0.009894886	0.009894886
+16	10000	8	10158.226307	0.015822631	0.015822631
+16	10000	9	9803.818473	-0.019618153	0.019618153
+16	10000	10	10110.735920	0.011073592	0.011073592
+16	10000	11	10158.226307	0.015822631	0.015822631
+16	10000	12	10291.737386	0.029173739	0.029173739
+16	10000	13	10110.735920	0.011073592	0.011073592
+16	10000	14	10182.179592	0.018217959	0.018217959
+16	10000	15	9771.093931	-0.022890607	0.022890607
+16	10000	16	10170.185440	0.017018544	0.017018544
+16	10000	17	10005.853945	0.000585395	0.000585395
+16	10000	18	9825.780992	-0.017421901	0.017421901
+16	10000	19	10040.517058	0.004051706	0.004051706
+16	10000	20	9674.460354	-0.032553965	0.032553965
+16	10000	21	9870.062504	-0.012993750	0.012993750
+16	10000	22	10158.226307	0.015822631	0.015822631
+16	10000	23	10087.195626	0.008719563	0.008719563
+16	50000	0	49650.523038	-0.006989539	0.006989539
+16	50000	1	49545.772655	-0.009084547	0.009084547
+16	50000	2	49587.007223	-0.008259856	0.008259856
+16	50000	3	50676.029592	0.013520592	0.013520592
+16	50000	4	50130.263724	0.002605274	0.002605274
+16	50000	5	48924.257997	-0.021514840	0.021514840
+16	50000	6	50734.444855	0.014688897	0.014688897
+16	50000	7	49299.493994	-0.014010120	0.014010120
+16	50000	8	49267.870431	-0.014642591	0.014642591
+16	50000	9	48653.068455	-0.026938631	0.026938631
+16	50000	10	49280.624643	-0.014387507	0.014387507
+16	50000	11	49864.887655	-0.002702247	0.002702247
+16	50000	12	49732.042833	-0.005359143	0.005359143
+16	50000	13	49143.989140	-0.017120217	0.017120217
+16	50000	14	51202.959896	0.024059198	0.024059198
+16	50000	15	49787.076287	-0.004258474	0.004258474
+16	50000	16	49250.883749	-0.014982325	0.014982325
+16	50000	17	49128.836584	-0.017423268	0.017423268
+16	50000	18	52596.108482	0.051922170	0.051922170
+16	50000	19	50625.683270	0.012513665	0.012513665
+16	50000	20	50848.467510	0.016969350	0.016969350
+16	50000	21	51080.082622	0.021601652	0.021601652
+16	50000	22	51866.133772	0.037322675	0.037322675
+16	50000	23	50665.992465	0.013319849	0.013319849
+17	100	0	98.167021	-0.018329790	0.018329790
+17	100	1	101.240942	0.012409424	0.012409424
+17	100	2	100.216046	0.002160456	0.002160456
+17	100	3	101.240942	0.012409424	0.012409424
+17	100	4	100.216046	0.002160456	0.002160456
+17	100	5	98.167021	-0.018329790	0.018329790
+17	100	6	98.167021	-0.018329790	0.018329790
+17	100	7	101.240942	0.012409424	0.012409424
+17	100	8	100.216046	0.002160456	0.002160456
+17	100	9	99.191405	-0.008085948	0.008085948
+17	100	10	100.216046	0.002160456	0.002160456
+17	100	11	100.216046	0.002160456	0.002160456
+17	100	12	101.240942	0.012409424	0.012409424
+17	100	13	99.191405	-0.008085948	0.008085948
+17	100	14	100.216046	0.002160456	0.002160456
+17	100	15	99.191405	-0.008085948	0.008085948
+17	100	16	100.216046	0.002160456	0.002160456
+17	100	17	101.240942	0.012409424	0.012409424
+17	100	18	100.216046	0.002160456	0.002160456
+17	100	19	100.216046	0.002160456	0.002160456
+17	100	20	101.240942	0.012409424	0.012409424
+17	100	21	100.216046	0.002160456	0.002160456
+17	100	22	99.191405	-0.008085948	0.008085948
+17	100	23	99.191405	-0.008085948	0.008085948
+17	500	0	502.613917	0.005227834	0.005227834
+17	500	1	499.223656	-0.001552688	0.001552688
+17	500	2	501.483518	0.002967036	0.002967036
+17	500	3	492.451541	-0.015096918	0.015096918
+17	500	4	502.613917	0.005227834	0.005227834
+17	500	5	494.707669	-0.010584662	0.010584662
+17	500	6	494.707669	-0.010584662	0.010584662
+17	500	7	500.353431	0.000706863	0.000706863
+17	500	8	499.223656	-0.001552688	0.001552688
+17	500	9	496.965040	-0.006069920	0.006069920
+17	500	10	486.816652	-0.026366696	0.026366696
+17	500	11	501.483518	0.002967036	0.002967036
+17	500	12	494.707669	-0.010584662	0.010584662
+17	500	13	498.094192	-0.003811615	0.003811615
+17	500	14	499.223656	-0.001552688	0.001552688
+17	500	15	502.613917	0.005227834	0.005227834
+17	500	16	500.353431	0.000706863	0.000706863
+17	500	17	495.836199	-0.008327602	0.008327602
+17	500	18	503.744628	0.007489256	0.007489256
+17	500	19	487.943010	-0.024113980	0.024113980
+17	500	20	504.875651	0.009751302	0.009751302
+17	500	21	502.613917	0.005227834	0.005227834
+17	500	22	501.483518	0.002967036	0.002967036
+17	500	23	499.223656	-0.001552688	0.001552688
+17	1000	0	986.890795	-0.013109205	0.013109205
+17	1000	1	993.257965	-0.006742035	0.006742035
+17	1000	2	1012.419079	0.012419079	0.012419079
+17	1000	3	994.532588	-0.005467412	0.005467412
+17	1000	4	1002.188665	0.002188665	0.002188665
+17	1000	5	989.436475	-0.010563525	0.010563525
+17	1000	6	1021.391701	0.021391701	0.021391701
+17	1000	7	995.807607	-0.004192393	0.004192393
+17	1000	8	995.807607	-0.004192393	0.004192393
+17	1000	9	1007.300678	0.007300678	0.007300678
+17	1000	10	999.635049	-0.000364951	0.000364951
+17	1000	11	988.163437	-0.011836563	0.011836563
+17	1000	12	979.263232	-0.020736768	0.020736768
+17	1000	13	1002.188665	0.002188665	0.002188665
+17	1000	14	1002.188665	0.002188665	0.002188665
+17	1000	15	990.709909	-0.009290091	0.009290091
+17	1000	16	1009.859079	0.009859079	0.009859079
+17	1000	17	988.163437	-0.011836563	0.011836563
+17	1000	18	990.709909	-0.009290091	0.009290091
+17	1000	19	998.358838	-0.001641162	0.001641162
+17	1000	20	991.983739	-0.008016261	0.008016261
+17	1000	21	988.163437	-0.011836563	0.011836563
+17	1000	22	998.358838	-0.001641162	0.001641162
+17	1000	23	1011.138879	0.011138879	0.011138879
+17	5000	0	4924.145830	-0.015170834	0.015170834
+17	5000	1	4877.825466	-0.024434907	0.024434907
+17	5000	2	5080.138191	0.016027638	0.016027638
+17	5000	3	5062.891850	0.012578370	0.012578370
+17	5000	4	5111.365789	0.022273158	0.022273158
+17	5000	5	4970.996014	-0.005800797	0.005800797
+17	5000	6	4900.920170	-0.019815966	0.019815966
+17	5000	7	4881.116747	-0.023776651	0.023776651
+17	5000	8	4934.140142	-0.013171972	0.013171972
+17	5000	9	5011.584290	0.002316858	0.002316858
+17	5000	10	5049.146871	0.009829374	0.009829374
+17	5000	11	4947.503938	-0.010499212	0.010499212
+17	5000	12	5111.365789	0.022273158	0.022273158
+17	5000	13	5011.584290	0.002316858	0.002316858
+17	5000	14	4974.363051	-0.005127390	0.005127390
+17	5000	15	4981.105439	-0.003778912	0.003778912
+17	5000	16	5111.365789	0.022273158	0.022273158
+17	5000	17	4914.175845	-0.017164831	0.017164831
+17	5000	18	5049.146871	0.009829374	0.009829374
+17	5000	19	4984.480800	-0.003103840	0.003103840
+17	5000	20	4950.851711	-0.009829658	0.009829658
+17	5000	21	4981.105439	-0.003778912	0.003778912
+17	5000	22	4930.805994	-0.013838801	0.013838801
+17	5000	23	5107.884276	0.021576855	0.021576855
+17	10000	0	9870.062504	-0.012993750	0.012993750
+17	10000	1	10134.412287	0.013441229	0.013441229
+17	10000	2	10218.374231	0.021837423	0.021837423
+17	10000	3	9653.292348	-0.034670765	0.034670765
+17	10000	4	10005.853945	0.000585395	0.000585395
+17	10000	5	9814.785012	-0.018521499	0.018521499
+17	10000	6	10005.853945	0.000585395	0.000585395
+17	10000	7	9611.281723	-0.038871828	0.038871828
+17	10000	8	10075.476018	0.007547602	0.007547602
+17	10000	9	10254.891561	0.025489156	0.025489156
+17	10000	10	10230.510536	0.023051054	0.023051054
+17	10000	11	10254.891561	0.025489156	0.025489156
+17	10000	12	9749.421923	-0.025057808	0.025057808
+17	10000	13	9781.973088	-0.021802691	0.021802691
+17	10000	14	9814.785012	-0.018521499	0.018521499
+17	10000	15	10242.682908	0.024268291	0.024268291
+17	10000	16	9948.726102	-0.005127390	0.005127390
+17	10000	17	9914.827977	-0.008517202	0.008517202
+17	10000	18	9948.726102	-0.005127390	0.005127390
+17	10000	19	10017.375753	0.001737575	0.001737575
+17	10000	20	10230.510536	0.023051054	0.023051054
+17	10000	21	9749.421923	-0.025057808	0.025057808
+17	10000	22	10291.737386	0.029173739	0.029173739
+17	10000	23	9982.907107	-0.001709289	0.001709289
+17	50000	0	50011.700666	0.000234013	0.000234013
+17	50000	1	49248.924324	-0.015021514	0.015021514
+17	50000	2	49702.210604	-0.005955788	0.005955788
+17	50000	3	51090.930587	0.021818612	0.021818612
+17	50000	4	51416.380651	0.028327613	0.028327613
+17	50000	5	50359.067672	0.007181353	0.007181353
+17	50000	6	50116.118812	0.002322376	0.002322376
+17	50000	7	50161.312909	0.003226258	0.003226258
+17	50000	8	49235.590307	-0.015288194	0.015288194
+17	50000	9	49799.198374	-0.004016033	0.004016033
+17	50000	10	50072.711283	0.001454226	0.001454226
+17	50000	11	49240.771289	-0.015184574	0.015184574
+17	50000	12	50470.958133	0.009419163	0.009419163
+17	50000	13	51362.355821	0.027247116	0.027247116
+17	50000	14	49326.956648	-0.013460867	0.013460867
+17	50000	15	50842.872713	0.016857454	0.016857454
+17	50000	16	50217.990259	0.004359805	0.004359805
+17	50000	17	50407.622547	0.008152451	0.008152451
+17	50000	18	51144.748026	0.022894961	0.022894961
+17	50000	19	50724.715583	0.014494312	0.014494312
+17	50000	20	49584.084483	-0.008318310	0.008318310
+17	50000	21	49542.770367	-0.009144593	0.009144593
+17	50000	22	49771.732209	-0.004565356	0.004565356
+17	50000	23	50727.805987	0.014556120	0.014556120
+18	100	0	98.167021	-0.018329790	0.018329790
+18	100	1	99.191405	-0.008085948	0.008085948
+18	100	2	101.240942	0.012409424	0.012409424
+18	100	3	99.191405	-0.008085948	0.008085948
+18	100	4	101.240942	0.012409424	0.012409424
+18	100	5	100.216046	0.002160456	0.002160456
+18	100	6	101.240942	0.012409424	0.012409424
+18	100	7	98.167021	-0.018329790	0.018329790
+18	100	8	98.167021	-0.018329790	0.018329790
+18	100	9	100.216046	0.002160456	0.002160456
+18	100	10	99.191405	-0.008085948	0.008085948
+18	100	11	98.167021	-0.018329790	0.018329790
+18	100	12	99.191405	-0.008085948	0.008085948
+18	100	13	98.167021	-0.018329790	0.018329790
+18	100	14	100.216046	0.002160456	0.002160456
+18	100	15	99.191405	-0.008085948	0.008085948
+18	100	16	98.167021	-0.018329790	0.018329790
+18	100	17	100.216046	0.002160456	0.002160456
+18	100	18	101.240942	0.012409424	0.012409424
+18	100	19	99.191405	-0.008085948	0.008085948
+18	100	20	99.191405	-0.008085948	0.008085948
+18	100	21	99.191405	-0.008085948	0.008085948
+18	100	22	101.240942	0.012409424	0.012409424
+18	100	23	101.240942	0.012409424	0.012409424
+18	500	0	492.451541	-0.015096918	0.015096918
+18	500	1	498.094192	-0.003811615	0.003811615
+18	500	2	502.613917	0.005227834	0.005227834
+18	500	3	498.094192	-0.003811615	0.003811615
+18	500	4	498.094192	-0.003811615	0.003811615
+18	500	5	495.836199	-0.008327602	0.008327602
+18	500	6	499.223656	-0.001552688	0.001552688
+18	500	7	498.094192	-0.003811615	0.003811615
+18	500	8	501.483518	0.002967036	0.002967036
+18	500	9	506.006986	0.012013973	0.012013973
+18	500	10	503.744628	0.007489256	0.007489256
+18	500	11	500.353431	0.000706863	0.000706863
+18	500	12	506.006986	0.012013973	0.012013973
+18	500	13	492.451541	-0.015096918	0.015096918
+18	500	14	502.613917	0.005227834	0.005227834
+18	500	15	494.707669	-0.010584662	0.010584662
+18	500	16	506.006986	0.012013973	0.012013973
+18	500	17	503.744628	0.007489256	0.007489256
+18	500	18	508.270595	0.016541190	0.016541190
+18	500	19	499.223656	-0.001552688	0.001552688
+18	500	20	508.270595	0.016541190	0.016541190
+18	500	21	499.223656	-0.001552688	0.001552688
+18	500	22	508.270595	0.016541190	0.016541190
+18	500	23	485.690604	-0.028618792	0.028618792
+18	1000	0	993.257965	-0.006742035	0.006742035
+18	1000	1	1007.300678	0.007300678	0.007300678
+18	1000	2	1004.743874	0.004743874	0.004743874
+18	1000	3	999.635049	-0.000364951	0.000364951
+18	1000	4	1003.466070	0.003466070	0.003466070
+18	1000	5	991.983739	-0.008016261	0.008016261
+18	1000	6	975.454771	-0.024545229	0.024545229
+18	1000	7	1002.188665	0.002188665	0.002188665
+18	1000	8	995.807607	-0.004192393	0.004192393
+18	1000	9	990.709909	-0.009290091	0.009290091
+18	1000	10	990.709909	-0.009290091	0.009290091
+18	1000	11	1002.188665	0.002188665	0.002188665
+18	1000	12	994.532588	-0.005467412	0.005467412
+18	1000	13	995.807607	-0.004192393	0.004192393
+18	1000	14	1012.419079	0.012419079	0.012419079
+18	1000	15	1020.108694	0.020108694	0.020108694
+18	1000	16	1003.466070	0.003466070	0.003466070
+18	1000	17	984.346695	-0.015653305	0.015653305
+18	1000	18	1009.859079	0.009859079	0.009859079
+18	1000	19	980.533506	-0.019466494	0.019466494
+18	1000	20	993.257965	-0.006742035	0.006742035
+18	1000	21	1006.022077	0.006022077	0.006022077
+18	1000	22	997.083024	-0.002916976	0.002916976
+18	1000	23	993.257965	-0.006742035	0.006742035
+18	5000	0	5066.335314	0.013267063	0.013267063
+18	5000	1	4994.623603	-0.001075279	0.001075279
+18	5000	2	5035.447861	0.007089572	0.007089572
+18	5000	3	4904.230070	-0.019153986	0.019153986
+18	5000	4	4974.363051	-0.005127390	0.005127390
+18	5000	5	4967.631743	-0.006473651	0.006473651
+18	5000	6	5008.186530	0.001637306	0.001637306
+18	5000	7	5028.615500	0.005723100	0.005723100
+18	5000	8	4977.732858	-0.004453428	0.004453428
+18	5000	9	5045.717821	0.009143564	0.009143564
+18	5000	10	5018.388278	0.003677656	0.003677656
+18	5000	11	5052.578794	0.010515759	0.010515759
+18	5000	12	4861.408610	-0.027718278	0.027718278
+18	5000	13	4838.534996	-0.032293001	0.032293001
+18	5000	14	5049.146871	0.009829374	0.009829374
+18	5000	15	4974.363051	-0.005127390	0.005127390
+18	5000	16	5008.186530	0.001637306	0.001637306
+18	5000	17	4900.920170	-0.019815966	0.019815966
+18	5000	18	4904.230070	-0.019153986	0.019153986
+18	5000	19	5021.794515	0.004358903	0.004358903
+18	5000	20	4950.851711	-0.009829658	0.009829658
+18	5000	21	4994.623603	-0.001075279	0.001075279
+18	5000	22	4967.631743	-0.006473651	0.006473651
+18	5000	23	5076.683109	0.015336622	0.015336622
+18	10000	0	10182.179592	0.018217959	0.018217959
+18	10000	1	9948.726102	-0.005127390	0.005127390
+18	10000	2	10028.930063	0.002893006	0.002893006
+18	10000	3	9497.926061	-0.050207394	0.050207394
+18	10000	4	9836.806570	-0.016319343	0.016319343
+18	10000	5	10158.226307	0.015822631	0.015822631
+18	10000	6	9836.806570	-0.016319343	0.016319343
+18	10000	7	9632.233175	-0.036776682	0.036776682
+18	10000	8	10075.476018	0.007547602	0.007547602
+18	10000	9	9948.726102	-0.005127390	0.005127390
+18	10000	10	9569.697610	-0.043030239	0.043030239
+18	10000	11	10028.930063	0.002893006	0.002893006
+18	10000	12	10353.893359	0.035389336	0.035389336
+18	10000	13	10017.375753	0.001737575	0.001737575
+18	10000	14	10028.930063	0.002893006	0.002893006
+18	10000	15	10063.789848	0.006378985	0.006378985
+18	10000	16	9960.088106	-0.003991189	0.003991189
+18	10000	17	9825.780992	-0.017421901	0.017421901
+18	10000	18	9881.208089	-0.011879191	0.011879191
+18	10000	19	9781.973088	-0.021802691	0.021802691
+18	10000	20	9792.881217	-0.020711878	0.020711878
+18	10000	21	10040.517058	0.004051706	0.004051706
+18	10000	22	10341.386479	0.034138648	0.034138648
+18	10000	23	10254.891561	0.025489156	0.025489156
+18	50000	0	50961.570948	0.019231419	0.019231419
+18	50000	1	50444.533762	0.008890675	0.008890675
+18	50000	2	50650.532382	0.013010648	0.013010648
+18	50000	3	50323.599890	0.006471998	0.006471998
+18	50000	4	50428.277061	0.008565541	0.008565541
+18	50000	5	50711.239513	0.014224790	0.014224790
+18	50000	6	51179.060640	0.023581213	0.023581213
+18	50000	7	50000.256094	0.000005122	0.000005122
+18	50000	8	49930.251888	-0.001394962	0.001394962
+18	50000	9	51070.749966	0.021414999	0.021414999
+18	50000	10	48761.737407	-0.024765252	0.024765252
+18	50000	11	49162.644241	-0.016747115	0.016747115
+18	50000	12	48836.039385	-0.023279212	0.023279212
+18	50000	13	50218.255845	0.004365117	0.004365117
+18	50000	14	50437.394009	0.008747880	0.008747880
+18	50000	15	50264.649726	0.005292995	0.005292995
+18	50000	16	50534.805363	0.010696107	0.010696107
+18	50000	17	49538.611688	-0.009227766	0.009227766
+18	50000	18	49623.199426	-0.007536011	0.007536011
+18	50000	19	51218.488518	0.024369770	0.024369770
+18	50000	20	48567.884781	-0.028642304	0.028642304
+18	50000	21	49986.040270	-0.000279195	0.000279195
+18	50000	22	50047.442373	0.000948847	0.000948847
+18	50000	23	48461.624814	-0.030767504	0.030767504
+19	100	0	98.167021	-0.018329790	0.018329790
+19	100	1	101.240942	0.012409424	0.012409424
+19	100	2	101.240942	0.012409424	0.012409424
+19	100	3	100.216046	0.002160456	0.002160456
+19	100	4	99.191405	-0.008085948	0.008085948
+19	100	5	100.216046	0.002160456	0.002160456
+19	100	6	100.216046	0.002160456	0.002160456
+19	100	7	100.216046	0.002160456	0.002160456
+19	100	8	98.167021	-0.018329790	0.018329790
+19	100	9	100.216046	0.002160456	0.002160456
+19	100	10	101.240942	0.012409424	0.012409424
+19	100	11	101.240942	0.012409424	0.012409424
+19	100	12	101.240942	0.012409424	0.012409424
+19	100	13	99.191405	-0.008085948	0.008085948
+19	100	14	101.240942	0.012409424	0.012409424
+19	100	15	100.216046	0.002160456	0.002160456
+19	100	16	99.191405	-0.008085948	0.008085948
+19	100	17	100.216046	0.002160456	0.002160456
+19	100	18	100.216046	0.002160456	0.002160456
+19	100	19	101.240942	0.012409424	0.012409424
+19	100	20	100.216046	0.002160456	0.002160456
+19	100	21	99.191405	-0.008085948	0.008085948
+19	100	22	99.191405	-0.008085948	0.008085948
+19	100	23	99.191405	-0.008085948	0.008085948
+19	500	0	504.875651	0.009751302	0.009751302
+19	500	1	512.801569	0.025603138	0.025603138
+19	500	2	500.353431	0.000706863	0.000706863
+19	500	3	499.223656	-0.001552688	0.001552688
+19	500	4	492.451541	-0.015096918	0.015096918
+19	500	5	499.223656	-0.001552688	0.001552688
+19	500	6	493.579450	-0.012841101	0.012841101
+19	500	7	509.402869	0.018805738	0.018805738
+19	500	8	499.223656	-0.001552688	0.001552688
+19	500	9	500.353431	0.000706863	0.000706863
+19	500	10	503.744628	0.007489256	0.007489256
+19	500	11	508.270595	0.016541190	0.016541190
+19	500	12	507.138634	0.014277269	0.014277269
+19	500	13	503.744628	0.007489256	0.007489256
+19	500	14	506.006986	0.012013973	0.012013973
+19	500	15	494.707669	-0.010584662	0.010584662
+19	500	16	502.613917	0.005227834	0.005227834
+19	500	17	493.579450	-0.012841101	0.012841101
+19	500	18	485.690604	-0.028618792	0.028618792
+19	500	19	501.483518	0.002967036	0.002967036
+19	500	20	500.353431	0.000706863	0.000706863
+19	500	21	499.223656	-0.001552688	0.001552688
+19	500	22	498.094192	-0.003811615	0.003811615
+19	500	23	494.707669	-0.010584662	0.010584662
+19	1000	0	1023.958921	0.023958921	0.023958921
+19	1000	1	981.804175	-0.018195825	0.018195825
+19	1000	2	997.083024	-0.002916976	0.002916976
+19	1000	3	999.635049	-0.000364951	0.000364951
+19	1000	4	994.532588	-0.005467412	0.005467412
+19	1000	5	1008.579679	0.008579679	0.008579679
+19	1000	6	1003.466070	0.003466070	0.003466070
+19	1000	7	985.618547	-0.014381453	0.014381453
+19	1000	8	998.358838	-0.001641162	0.001641162
+19	1000	9	986.890795	-0.013109205	0.013109205
+19	1000	10	991.983739	-0.008016261	0.008016261
+19	1000	11	995.807607	-0.004192393	0.004192393
+19	1000	12	1007.300678	0.007300678	0.007300678
+19	1000	13	985.618547	-0.014381453	0.014381453
+19	1000	14	991.983739	-0.008016261	0.008016261
+19	1000	15	995.807607	-0.004192393	0.004192393
+19	1000	16	985.618547	-0.014381453	0.014381453
+19	1000	17	994.532588	-0.005467412	0.005467412
+19	1000	18	995.807607	-0.004192393	0.004192393
+19	1000	19	1002.188665	0.002188665	0.002188665
+19	1000	20	979.263232	-0.020736768	0.020736768
+19	1000	21	1007.300678	0.007300678	0.007300678
+19	1000	22	995.807607	-0.004192393	0.004192393
+19	1000	23	1000.911658	0.000911658	0.000911658
+19	5000	0	4957.555477	-0.008488905	0.008488905
+19	5000	1	5080.138191	0.016027638	0.016027638
+19	5000	2	5028.615500	0.005723100	0.005723100
+19	5000	3	5032.030256	0.006406051	0.006406051
+19	5000	4	5001.399453	0.000279891	0.000279891
+19	5000	5	4998.010127	-0.000397975	0.000397975
+19	5000	6	5062.891850	0.012578370	0.012578370
+19	5000	7	4981.105439	-0.003778912	0.003778912
+19	5000	8	4977.732858	-0.004453428	0.004453428
+19	5000	9	5045.717821	0.009143564	0.009143564
+19	5000	10	5118.337705	0.023667541	0.023667541
+19	5000	11	5001.399453	0.000279891	0.000279891
+19	5000	12	5066.335314	0.013267063	0.013267063
+19	5000	13	5160.420267	0.032084053	0.032084053
+19	5000	14	5011.584290	0.002316858	0.002316858
+19	5000	15	5008.186530	0.001637306	0.001637306
+19	5000	16	4897.612944	-0.020477411	0.020477411
+19	5000	17	5069.781675	0.013956335	0.013956335
+19	5000	18	5062.891850	0.012578370	0.012578370
+19	5000	19	5021.794515	0.004358903	0.004358903
+19	5000	20	4981.105439	-0.003778912	0.003778912
+19	5000	21	5035.447861	0.007089572	0.007089572
+19	5000	22	4848.322337	-0.030335533	0.030335533
+19	5000	23	5021.794515	0.004358903	0.004358903
+19	10000	0	9960.088106	-0.003991189	0.003991189
+19	10000	1	10267.136712	0.026713671	0.026713671
+19	10000	2	10005.853945	0.000585395	0.000585395
+19	10000	3	10279.418580	0.027941858	0.027941858
+19	10000	4	10291.737386	0.029173739	0.029173739
+19	10000	5	9870.062504	-0.012993750	0.012993750
+19	10000	6	9892.384085	-0.010761591	0.010761591
+19	10000	7	10341.386479	0.034138648	0.034138648
+19	10000	8	10017.375753	0.001737575	0.001737575
+19	10000	9	10455.347462	0.045534746	0.045534746
+19	10000	10	10146.301990	0.014630199	0.014630199
+19	10000	11	9892.384085	-0.010761591	0.010761591
+19	10000	12	9960.088106	-0.003991189	0.003991189
+19	10000	13	10194.208969	0.019420897	0.019420897
+19	10000	14	9803.818473	-0.019618153	0.019618153
+19	10000	15	10206.273779	0.020627378	0.020627378
+19	10000	16	9892.384085	-0.010761591	0.010761591
+19	10000	17	9892.384085	-0.010761591	0.010761591
+19	10000	18	9814.785012	-0.018521499	0.018521499
+19	10000	19	10158.226307	0.015822631	0.015822631
+19	10000	20	10040.517058	0.004051706	0.004051706
+19	10000	21	10052.136924	0.005213692	0.005213692
+19	10000	22	10063.789848	0.006378985	0.006378985
+19	10000	23	10005.853945	0.000585395	0.000585395
+19	50000	0	49068.851873	-0.018622963	0.018622963
+19	50000	1	51673.324063	0.033466481	0.033466481
+19	50000	2	50405.438220	0.008108764	0.008108764
+19	50000	3	51680.134629	0.033602693	0.033602693
+19	50000	4	50339.973137	0.006799463	0.006799463
+19	50000	5	50248.240646	0.004964813	0.004964813
+19	50000	6	50808.971815	0.016179436	0.016179436
+19	50000	7	49867.516227	-0.002649675	0.002649675
+19	50000	8	49791.256513	-0.004174870	0.004174870
+19	50000	9	50653.942724	0.013078854	0.013078854
+19	50000	10	48697.257213	-0.026054856	0.026054856
+19	50000	11	50165.111858	0.003302237	0.003302237
+19	50000	12	49685.461789	-0.006290764	0.006290764
+19	50000	13	50078.431718	0.001568634	0.001568634
+19	50000	14	49679.814433	-0.006403711	0.006403711
+19	50000	15	50721.778871	0.014435577	0.014435577
+19	50000	16	49511.236005	-0.009775280	0.009775280
+19	50000	17	50270.967504	0.005419350	0.005419350
+19	50000	18	51559.062738	0.031181255	0.031181255
+19	50000	19	49565.444425	-0.008691111	0.008691111
+19	50000	20	49838.295464	-0.003234091	0.003234091
+19	50000	21	51810.313452	0.036206269	0.036206269
+19	50000	22	48850.689599	-0.022986208	0.022986208
+19	50000	23	50030.142053	0.000602841	0.000602841
diff --git a/developer-simulation/runs/2026-08-17--mergeable-unique-installation-reach-rollups/evidence/accuracy-tuning.tsv b/developer-simulation/runs/2026-08-17--mergeable-unique-installation-reach-rollups/evidence/accuracy-tuning.tsv
new file mode 100644
index 0000000..8bb28fb
--- /dev/null
+++ b/developer-simulation/runs/2026-08-17--mergeable-unique-installation-reach-rollups/evidence/accuracy-tuning.tsv
@@ -0,0 +1,2881 @@
+seed	cardinality	bucket	estimate	signed_relative_error	absolute_relative_error
+0	100	0	101.240942	0.012409424	0.012409424
+0	100	1	100.216046	0.002160456	0.002160456
+0	100	2	100.216046	0.002160456	0.002160456
+0	100	3	101.240942	0.012409424	0.012409424
+0	100	4	100.216046	0.002160456	0.002160456
+0	100	5	98.167021	-0.018329790	0.018329790
+0	100	6	100.216046	0.002160456	0.002160456
+0	100	7	100.216046	0.002160456	0.002160456
+0	100	8	99.191405	-0.008085948	0.008085948
+0	100	9	100.216046	0.002160456	0.002160456
+0	100	10	99.191405	-0.008085948	0.008085948
+0	100	11	99.191405	-0.008085948	0.008085948
+0	100	12	101.240942	0.012409424	0.012409424
+0	100	13	101.240942	0.012409424	0.012409424
+0	100	14	100.216046	0.002160456	0.002160456
+0	100	15	100.216046	0.002160456	0.002160456
+0	100	16	101.240942	0.012409424	0.012409424
+0	100	17	98.167021	-0.018329790	0.018329790
+0	100	18	100.216046	0.002160456	0.002160456
+0	100	19	101.240942	0.012409424	0.012409424
+0	100	20	101.240942	0.012409424	0.012409424
+0	100	21	100.216046	0.002160456	0.002160456
+0	100	22	99.191405	-0.008085948	0.008085948
+0	100	23	101.240942	0.012409424	0.012409424
+0	500	0	494.707669	-0.010584662	0.010584662
+0	500	1	509.402869	0.018805738	0.018805738
+0	500	2	482.314316	-0.035371368	0.035371368
+0	500	3	495.836199	-0.008327602	0.008327602
+0	500	4	506.006986	0.012013973	0.012013973
+0	500	5	503.744628	0.007489256	0.007489256
+0	500	6	499.223656	-0.001552688	0.001552688
+0	500	7	506.006986	0.012013973	0.012013973
+0	500	8	486.816652	-0.026366696	0.026366696
+0	500	9	487.943010	-0.024113980	0.024113980
+0	500	10	503.744628	0.007489256	0.007489256
+0	500	11	489.069678	-0.021860645	0.021860645
+0	500	12	502.613917	0.005227834	0.005227834
+0	500	13	498.094192	-0.003811615	0.003811615
+0	500	14	515.068937	0.030137874	0.030137874
+0	500	15	499.223656	-0.001552688	0.001552688
+0	500	16	495.836199	-0.008327602	0.008327602
+0	500	17	499.223656	-0.001552688	0.001552688
+0	500	18	502.613917	0.005227834	0.005227834
+0	500	19	506.006986	0.012013973	0.012013973
+0	500	20	500.353431	0.000706863	0.000706863
+0	500	21	498.094192	-0.003811615	0.003811615
+0	500	22	506.006986	0.012013973	0.012013973
+0	500	23	493.579450	-0.012841101	0.012841101
+0	1000	0	1004.743874	0.004743874	0.004743874
+0	1000	1	997.083024	-0.002916976	0.002916976
+0	1000	2	995.807607	-0.004192393	0.004192393
+0	1000	3	997.083024	-0.002916976	0.002916976
+0	1000	4	1002.188665	0.002188665	0.002188665
+0	1000	5	1011.138879	0.011138879	0.011138879
+0	1000	6	997.083024	-0.002916976	0.002916976
+0	1000	7	981.804175	-0.018195825	0.018195825
+0	1000	8	1000.911658	0.000911658	0.000911658
+0	1000	9	994.532588	-0.005467412	0.005467412
+0	1000	10	1003.466070	0.003466070	0.003466070
+0	1000	11	988.163437	-0.011836563	0.011836563
+0	1000	12	998.358838	-0.001641162	0.001641162
+0	1000	13	995.807607	-0.004192393	0.004192393
+0	1000	14	1009.859079	0.009859079	0.009859079
+0	1000	15	1003.466070	0.003466070	0.003466070
+0	1000	16	1012.419079	0.012419079	0.012419079
+0	1000	17	1013.699680	0.013699680	0.013699680
+0	1000	18	1014.980680	0.014980680	0.014980680
+0	1000	19	999.635049	-0.000364951	0.000364951
+0	1000	20	1002.188665	0.002188665	0.002188665
+0	1000	21	994.532588	-0.005467412	0.005467412
+0	1000	22	993.257965	-0.006742035	0.006742035
+0	1000	23	1008.579679	0.008579679	0.008579679
+0	5000	0	4917.496478	-0.016500704	0.016500704
+0	5000	1	5045.717821	0.009143564	0.009143564
+0	5000	2	4950.851711	-0.009829658	0.009829658
+0	5000	3	4981.105439	-0.003778912	0.003778912
+0	5000	4	5008.186530	0.001637306	0.001637306
+0	5000	5	5035.447861	0.007089572	0.007089572
+0	5000	6	5052.578794	0.010515759	0.010515759
+0	5000	7	4887.707256	-0.022458549	0.022458549
+0	5000	8	5052.578794	0.010515759	0.010515759
+0	5000	9	4994.623603	-0.001075279	0.001075279
+0	5000	10	4910.857903	-0.017828419	0.017828419
+0	5000	11	5107.884276	0.021576855	0.021576855
+0	5000	12	5093.987740	0.018797548	0.018797548
+0	5000	13	5025.203588	0.005040718	0.005040718
+0	5000	14	5032.030256	0.006406051	0.006406051
+0	5000	15	4881.116747	-0.023776651	0.023776651
+0	5000	16	4981.105439	-0.003778912	0.003778912
+0	5000	17	5049.146871	0.009829374	0.009829374
+0	5000	18	5018.388278	0.003677656	0.003677656
+0	5000	19	5066.335314	0.013267063	0.013267063
+0	5000	20	5104.405719	0.020881144	0.020881144
+0	5000	21	5090.520960	0.018104192	0.018104192
+0	5000	22	5073.230939	0.014646188	0.014646188
+0	5000	23	4974.363051	-0.005127390	0.005127390
+0	10000	0	9948.726102	-0.005127390	0.005127390
+0	10000	1	9781.973088	-0.021802691	0.021802691
+0	10000	2	10218.374231	0.021837423	0.021837423
+0	10000	3	10218.374231	0.021837423	0.021837423
+0	10000	4	9600.846049	-0.039915395	0.039915395
+0	10000	5	9847.861908	-0.015213809	0.015213809
+0	10000	6	10218.374231	0.021837423	0.021837423
+0	10000	7	10098.948862	0.009894886	0.009894886
+0	10000	8	10098.948862	0.009894886	0.009894886
+0	10000	9	10134.412287	0.013441229	0.013441229
+0	10000	10	9870.062504	-0.012993750	0.012993750
+0	10000	11	10040.517058	0.004051706	0.004051706
+0	10000	12	10122.556996	0.012255700	0.012255700
+0	10000	13	10170.185440	0.017018544	0.017018544
+0	10000	14	10098.948862	0.009894886	0.009894886
+0	10000	15	9903.590659	-0.009640934	0.009640934
+0	10000	16	9914.827977	-0.008517202	0.008517202
+0	10000	17	10379.022272	0.037902227	0.037902227
+0	10000	18	9994.364457	-0.000563554	0.000563554
+0	10000	19	10242.682908	0.024268291	0.024268291
+0	10000	20	9663.862676	-0.033613732	0.033613732
+0	10000	21	9948.726102	-0.005127390	0.005127390
+0	10000	22	9771.093931	-0.022890607	0.022890607
+0	10000	23	10087.195626	0.008719563	0.008719563
+0	50000	0	51232.455698	0.024649114	0.024649114
+0	50000	1	50523.966477	0.010479330	0.010479330
+0	50000	2	49572.995547	-0.008540089	0.008540089
+0	50000	3	50504.489749	0.010089795	0.010089795
+0	50000	4	49666.043878	-0.006679122	0.006679122
+0	50000	5	49920.457890	-0.001590842	0.001590842
+0	50000	6	50747.346154	0.014946923	0.014946923
+0	50000	7	50383.558128	0.007671163	0.007671163
+0	50000	8	49731.846896	-0.005363062	0.005363062
+0	50000	9	51030.017755	0.020600355	0.020600355
+0	50000	10	50140.673919	0.002813478	0.002813478
+0	50000	11	50827.848351	0.016556967	0.016556967
+0	50000	12	50258.212876	0.005164258	0.005164258
+0	50000	13	50601.170061	0.012023401	0.012023401
+0	50000	14	51124.704537	0.022494091	0.022494091
+0	50000	15	49563.284839	-0.008734303	0.008734303
+0	50000	16	50112.507816	0.002250156	0.002250156
+0	50000	17	50136.055174	0.002721103	0.002721103
+0	50000	18	50805.593978	0.016111880	0.016111880
+0	50000	19	49369.776566	-0.012604469	0.012604469
+0	50000	20	50860.243052	0.017204861	0.017204861
+0	50000	21	50422.797892	0.008455958	0.008455958
+0	50000	22	50580.052043	0.011601041	0.011601041
+0	50000	23	49336.932235	-0.013261355	0.013261355
+1	100	0	99.191405	-0.008085948	0.008085948
+1	100	1	98.167021	-0.018329790	0.018329790
+1	100	2	100.216046	0.002160456	0.002160456
+1	100	3	100.216046	0.002160456	0.002160456
+1	100	4	99.191405	-0.008085948	0.008085948
+1	100	5	101.240942	0.012409424	0.012409424
+1	100	6	99.191405	-0.008085948	0.008085948
+1	100	7	101.240942	0.012409424	0.012409424
+1	100	8	101.240942	0.012409424	0.012409424
+1	100	9	101.240942	0.012409424	0.012409424
+1	100	10	101.240942	0.012409424	0.012409424
+1	100	11	99.191405	-0.008085948	0.008085948
+1	100	12	100.216046	0.002160456	0.002160456
+1	100	13	97.142893	-0.028571070	0.028571070
+1	100	14	99.191405	-0.008085948	0.008085948
+1	100	15	99.191405	-0.008085948	0.008085948
+1	100	16	101.240942	0.012409424	0.012409424
+1	100	17	100.216046	0.002160456	0.002160456
+1	100	18	100.216046	0.002160456	0.002160456
+1	100	19	100.216046	0.002160456	0.002160456
+1	100	20	100.216046	0.002160456	0.002160456
+1	100	21	100.216046	0.002160456	0.002160456
+1	100	22	100.216046	0.002160456	0.002160456
+1	100	23	100.216046	0.002160456	0.002160456
+1	500	0	501.483518	0.002967036	0.002967036
+1	500	1	486.816652	-0.026366696	0.026366696
+1	500	2	498.094192	-0.003811615	0.003811615
+1	500	3	501.483518	0.002967036	0.002967036
+1	500	4	501.483518	0.002967036	0.002967036
+1	500	5	498.094192	-0.003811615	0.003811615
+1	500	6	492.451541	-0.015096918	0.015096918
+1	500	7	511.668356	0.023336711	0.023336711
+1	500	8	501.483518	0.002967036	0.002967036
+1	500	9	496.965040	-0.006069920	0.006069920
+1	500	10	502.613917	0.005227834	0.005227834
+1	500	11	494.707669	-0.010584662	0.010584662
+1	500	12	503.744628	0.007489256	0.007489256
+1	500	13	486.816652	-0.026366696	0.026366696
+1	500	14	500.353431	0.000706863	0.000706863
+1	500	15	500.353431	0.000706863	0.000706863
+1	500	16	500.353431	0.000706863	0.000706863
+1	500	17	496.965040	-0.006069920	0.006069920
+1	500	18	501.483518	0.002967036	0.002967036
+1	500	19	492.451541	-0.015096918	0.015096918
+1	500	20	498.094192	-0.003811615	0.003811615
+1	500	21	499.223656	-0.001552688	0.001552688
+1	500	22	510.535456	0.021070911	0.021070911
+1	500	23	501.483518	0.002967036	0.002967036
+1	1000	0	1003.466070	0.003466070	0.003466070
+1	1000	1	1000.911658	0.000911658	0.000911658
+1	1000	2	1004.743874	0.004743874	0.004743874
+1	1000	3	997.083024	-0.002916976	0.002916976
+1	1000	4	1007.300678	0.007300678	0.007300678
+1	1000	5	975.454771	-0.024545229	0.024545229
+1	1000	6	988.163437	-0.011836563	0.011836563
+1	1000	7	984.346695	-0.015653305	0.015653305
+1	1000	8	1014.980680	0.014980680	0.014980680
+1	1000	9	1000.911658	0.000911658	0.000911658
+1	1000	10	1016.262082	0.016262082	0.016262082
+1	1000	11	1008.579679	0.008579679	0.008579679
+1	1000	12	983.075238	-0.016924762	0.016924762
+1	1000	13	984.346695	-0.015653305	0.015653305
+1	1000	14	1008.579679	0.008579679	0.008579679
+1	1000	15	979.263232	-0.020736768	0.020736768
+1	1000	16	1008.579679	0.008579679	0.008579679
+1	1000	17	976.723864	-0.023276136	0.023276136
+1	1000	18	1006.022077	0.006022077	0.006022077
+1	1000	19	985.618547	-0.014381453	0.014381453
+1	1000	20	988.163437	-0.011836563	0.011836563
+1	1000	21	1008.579679	0.008579679	0.008579679
+1	1000	22	1003.466070	0.003466070	0.003466070
+1	1000	23	994.532588	-0.005467412	0.005467412
+1	5000	0	4954.202223	-0.009159555	0.009159555
+1	5000	1	5004.791585	0.000958317	0.000958317
+1	5000	2	5073.230939	0.014646188	0.014646188
+1	5000	3	4991.239877	-0.001752025	0.001752025
+1	5000	4	5011.584290	0.002316858	0.002316858
+1	5000	5	5066.335314	0.013267063	0.013267063
+1	5000	6	4920.819805	-0.015836039	0.015836039
+1	5000	7	4974.363051	-0.005127390	0.005127390
+1	5000	8	5025.203588	0.005040718	0.005040718
+1	5000	9	5083.596191	0.016719238	0.016719238
+1	5000	10	4887.707256	-0.022458549	0.022458549
+1	5000	11	5008.186530	0.001637306	0.001637306
+1	5000	12	5021.794515	0.004358903	0.004358903
+1	5000	13	5042.291639	0.008458328	0.008458328
+1	5000	14	5146.344652	0.029268930	0.029268930
+1	5000	15	4940.816590	-0.011836682	0.011836682
+1	5000	16	5118.337705	0.023667541	0.023667541
+1	5000	17	4897.612944	-0.020477411	0.020477411
+1	5000	18	5018.388278	0.003677656	0.003677656
+1	5000	19	5004.791585	0.000958317	0.000958317
+1	5000	20	4947.503938	-0.010499212	0.010499212
+1	5000	21	5042.291639	0.008458328	0.008458328
+1	5000	22	5073.230939	0.014646188	0.014646188
+1	5000	23	5008.186530	0.001637306	0.001637306
+1	10000	0	10040.517058	0.004051706	0.004051706
+1	10000	1	9781.973088	-0.021802691	0.021802691
+1	10000	2	10242.682908	0.024268291	0.024268291
+1	10000	3	10267.136712	0.026713671	0.026713671
+1	10000	4	9706.418903	-0.029358110	0.029358110
+1	10000	5	10291.737386	0.029173739	0.029173739
+1	10000	6	10098.948862	0.009894886	0.009894886
+1	10000	7	9738.628768	-0.026137123	0.026137123
+1	10000	8	9695.738323	-0.030426168	0.030426168
+1	10000	9	9881.208089	-0.011879191	0.011879191
+1	10000	10	10158.226307	0.015822631	0.015822631
+1	10000	11	9847.861908	-0.015213809	0.015213809
+1	10000	12	9847.861908	-0.015213809	0.015213809
+1	10000	13	9971.481716	-0.002851828	0.002851828
+1	10000	14	10230.510536	0.023051054	0.023051054
+1	10000	15	10075.476018	0.007547602	0.007547602
+1	10000	16	10017.375753	0.001737575	0.001737575
+1	10000	17	10170.185440	0.017018544	0.017018544
+1	10000	18	9982.907107	-0.001709289	0.001709289
+1	10000	19	9971.481716	-0.002851828	0.002851828
+1	10000	20	10087.195626	0.008719563	0.008719563
+1	10000	21	10182.179592	0.018217959	0.018217959
+1	10000	22	10040.517058	0.004051706	0.004051706
+1	10000	23	10040.517058	0.004051706	0.004051706
+1	50000	0	49399.899032	-0.012002019	0.012002019
+1	50000	1	50408.197402	0.008163948	0.008163948
+1	50000	2	49802.412429	-0.003951751	0.003951751
+1	50000	3	51023.165048	0.020463301	0.020463301
+1	50000	4	49403.743210	-0.011925136	0.011925136
+1	50000	5	49668.486233	-0.006630275	0.006630275
+1	50000	6	50052.897141	0.001057943	0.001057943
+1	50000	7	50298.357187	0.005967144	0.005967144
+1	50000	8	51270.241881	0.025404838	0.025404838
+1	50000	9	48992.414418	-0.020151712	0.020151712
+1	50000	10	49740.072493	-0.005198550	0.005198550
+1	50000	11	50691.375508	0.013827510	0.013827510
+1	50000	12	51180.486169	0.023609723	0.023609723
+1	50000	13	49538.872459	-0.009222551	0.009222551
+1	50000	14	50504.049016	0.010080980	0.010080980
+1	50000	15	49714.593763	-0.005708125	0.005708125
+1	50000	16	49481.847703	-0.010363046	0.010363046
+1	50000	17	51419.602650	0.028392053	0.028392053
+1	50000	18	51594.311419	0.031886228	0.031886228
+1	50000	19	51080.897109	0.021617942	0.021617942
+1	50000	20	49685.704648	-0.006285907	0.006285907
+1	50000	21	50085.163500	0.001703270	0.001703270
+1	50000	22	51198.063209	0.023961264	0.023961264
+1	50000	23	48147.033019	-0.037059340	0.037059340
+2	100	0	100.216046	0.002160456	0.002160456
+2	100	1	99.191405	-0.008085948	0.008085948
+2	100	2	97.142893	-0.028571070	0.028571070
+2	100	3	101.240942	0.012409424	0.012409424
+2	100	4	100.216046	0.002160456	0.002160456
+2	100	5	99.191405	-0.008085948	0.008085948
+2	100	6	101.240942	0.012409424	0.012409424
+2	100	7	100.216046	0.002160456	0.002160456
+2	100	8	100.216046	0.002160456	0.002160456
+2	100	9	101.240942	0.012409424	0.012409424
+2	100	10	97.142893	-0.028571070	0.028571070
+2	100	11	101.240942	0.012409424	0.012409424
+2	100	12	99.191405	-0.008085948	0.008085948
+2	100	13	101.240942	0.012409424	0.012409424
+2	100	14	100.216046	0.002160456	0.002160456
+2	100	15	99.191405	-0.008085948	0.008085948
+2	100	16	101.240942	0.012409424	0.012409424
+2	100	17	99.191405	-0.008085948	0.008085948
+2	100	18	101.240942	0.012409424	0.012409424
+2	100	19	99.191405	-0.008085948	0.008085948
+2	100	20	100.216046	0.002160456	0.002160456
+2	100	21	99.191405	-0.008085948	0.008085948
+2	100	22	98.167021	-0.018329790	0.018329790
+2	100	23	100.216046	0.002160456	0.002160456
+2	500	0	509.402869	0.018805738	0.018805738
+2	500	1	507.138634	0.014277269	0.014277269
+2	500	2	500.353431	0.000706863	0.000706863
+2	500	3	498.094192	-0.003811615	0.003811615
+2	500	4	492.451541	-0.015096918	0.015096918
+2	500	5	500.353431	0.000706863	0.000706863
+2	500	6	503.744628	0.007489256	0.007489256
+2	500	7	512.801569	0.025603138	0.025603138
+2	500	8	499.223656	-0.001552688	0.001552688
+2	500	9	494.707669	-0.010584662	0.010584662
+2	500	10	499.223656	-0.001552688	0.001552688
+2	500	11	501.483518	0.002967036	0.002967036
+2	500	12	493.579450	-0.012841101	0.012841101
+2	500	13	496.965040	-0.006069920	0.006069920
+2	500	14	511.668356	0.023336711	0.023336711
+2	500	15	506.006986	0.012013973	0.012013973
+2	500	16	496.965040	-0.006069920	0.006069920
+2	500	17	498.094192	-0.003811615	0.003811615
+2	500	18	500.353431	0.000706863	0.000706863
+2	500	19	494.707669	-0.010584662	0.010584662
+2	500	20	503.744628	0.007489256	0.007489256
+2	500	21	503.744628	0.007489256	0.007489256
+2	500	22	507.138634	0.014277269	0.014277269
+2	500	23	499.223656	-0.001552688	0.001552688
+2	1000	0	1020.108694	0.020108694	0.020108694
+2	1000	1	998.358838	-0.001641162	0.001641162
+2	1000	2	1003.466070	0.003466070	0.003466070
+2	1000	3	1016.262082	0.016262082	0.016262082
+2	1000	4	990.709909	-0.009290091	0.009290091
+2	1000	5	994.532588	-0.005467412	0.005467412
+2	1000	6	990.709909	-0.009290091	0.009290091
+2	1000	7	1009.859079	0.009859079	0.009859079
+2	1000	8	995.807607	-0.004192393	0.004192393
+2	1000	9	1000.911658	0.000911658	0.000911658
+2	1000	10	974.186070	-0.025813930	0.025813930
+2	1000	11	1013.699680	0.013699680	0.013699680
+2	1000	12	1004.743874	0.004743874	0.004743874
+2	1000	13	1031.670251	0.031670251	0.031670251
+2	1000	14	1003.466070	0.003466070	0.003466070
+2	1000	15	999.635049	-0.000364951	0.000364951
+2	1000	16	1004.743874	0.004743874	0.004743874
+2	1000	17	1016.262082	0.016262082	0.016262082
+2	1000	18	990.709909	-0.009290091	0.009290091
+2	1000	19	1003.466070	0.003466070	0.003466070
+2	1000	20	1004.743874	0.004743874	0.004743874
+2	1000	21	1000.911658	0.000911658	0.000911658
+2	1000	22	990.709909	-0.009290091	0.009290091
+2	1000	23	994.532588	-0.005467412	0.005467412
+2	5000	0	5114.850264	0.022970053	0.022970053
+2	5000	1	5011.584290	0.002316858	0.002316858
+2	5000	2	5021.794515	0.004358903	0.004358903
+2	5000	3	4970.996014	-0.005800797	0.005800797
+2	5000	4	5128.817882	0.025763576	0.025763576
+2	5000	5	4937.477005	-0.012504599	0.012504599
+2	5000	6	4927.474558	-0.014505088	0.014505088
+2	5000	7	5128.817882	0.025763576	0.025763576
+2	5000	8	5066.335314	0.013267063	0.013267063
+2	5000	9	5125.321509	0.025064302	0.025064302
+2	5000	10	5125.321509	0.025064302	0.025064302
+2	5000	11	5052.578794	0.010515759	0.010515759
+2	5000	12	5045.717821	0.009143564	0.009143564
+2	5000	13	4937.477005	-0.012504599	0.012504599
+2	5000	14	4981.105439	-0.003778912	0.003778912
+2	5000	15	5038.868321	0.007773664	0.007773664
+2	5000	16	4877.825466	-0.024434907	0.024434907
+2	5000	17	4981.105439	-0.003778912	0.003778912
+2	5000	18	4954.202223	-0.009159555	0.009159555
+2	5000	19	4940.816590	-0.011836682	0.011836682
+2	5000	20	5049.146871	0.009829374	0.009829374
+2	5000	21	4994.623603	-0.001075279	0.001075279
+2	5000	22	5100.930114	0.020186023	0.020186023
+2	5000	23	5032.030256	0.006406051	0.006406051
+2	10000	0	9960.088106	-0.003991189	0.003991189
+2	10000	1	10230.510536	0.023051054	0.023051054
+2	10000	2	10028.930063	0.002893006	0.002893006
+2	10000	3	9847.861908	-0.015213809	0.015213809
+2	10000	4	10158.226307	0.015822631	0.015822631
+2	10000	5	10194.208969	0.019420897	0.019420897
+2	10000	6	10134.412287	0.013441229	0.013441229
+2	10000	7	9914.827977	-0.008517202	0.008517202
+2	10000	8	10005.853945	0.000585395	0.000585395
+2	10000	9	10063.789848	0.006378985	0.006378985
+2	10000	10	10122.556996	0.012255700	0.012255700
+2	10000	11	9971.481716	-0.002851828	0.002851828
+2	10000	12	9814.785012	-0.018521499	0.018521499
+2	10000	13	9960.088106	-0.003991189	0.003991189
+2	10000	14	9870.062504	-0.012993750	0.012993750
+2	10000	15	10017.375753	0.001737575	0.001737575
+2	10000	16	9937.395527	-0.006260447	0.006260447
+2	10000	17	10218.374231	0.021837423	0.021837423
+2	10000	18	9858.947165	-0.014105284	0.014105284
+2	10000	19	10122.556996	0.012255700	0.012255700
+2	10000	20	9881.208089	-0.011879191	0.011879191
+2	10000	21	9948.726102	-0.005127390	0.005127390
+2	10000	22	10087.195626	0.008719563	0.008719563
+2	10000	23	9926.096210	-0.007390379	0.007390379
+2	50000	0	50231.080497	0.004621610	0.004621610
+2	50000	1	49825.897579	-0.003482048	0.003482048
+2	50000	2	49408.912690	-0.011821746	0.011821746
+2	50000	3	50875.390630	0.017507813	0.017507813
+2	50000	4	51278.578855	0.025571577	0.025571577
+2	50000	5	51037.896496	0.020757930	0.020757930
+2	50000	6	49788.612916	-0.004227742	0.004227742
+2	50000	7	50276.629716	0.005532594	0.005532594
+2	50000	8	49416.395785	-0.011672084	0.011672084
+2	50000	9	49116.936689	-0.017661266	0.017661266
+2	50000	10	49802.611072	-0.003947779	0.003947779
+2	50000	11	49474.572453	-0.010508551	0.010508551
+2	50000	12	50452.099706	0.009041994	0.009041994
+2	50000	13	49556.244641	-0.008875107	0.008875107
+2	50000	14	50398.852335	0.007977047	0.007977047
+2	50000	15	49992.592777	-0.000148144	0.000148144
+2	50000	16	50777.984191	0.015559684	0.015559684
+2	50000	17	49100.850565	-0.017982989	0.017982989
+2	50000	18	50843.104196	0.016862084	0.016862084
+2	50000	19	50334.555479	0.006691110	0.006691110
+2	50000	20	49031.703247	-0.019365935	0.019365935
+2	50000	21	50039.719583	0.000794392	0.000794392
+2	50000	22	51073.482125	0.021469643	0.021469643
+2	50000	23	51656.750479	0.033135010	0.033135010
+3	100	0	101.240942	0.012409424	0.012409424
+3	100	1	101.240942	0.012409424	0.012409424
+3	100	2	101.240942	0.012409424	0.012409424
+3	100	3	100.216046	0.002160456	0.002160456
+3	100	4	100.216046	0.002160456	0.002160456
+3	100	5	98.167021	-0.018329790	0.018329790
+3	100	6	99.191405	-0.008085948	0.008085948
+3	100	7	100.216046	0.002160456	0.002160456
+3	100	8	100.216046	0.002160456	0.002160456
+3	100	9	99.191405	-0.008085948	0.008085948
+3	100	10	99.191405	-0.008085948	0.008085948
+3	100	11	100.216046	0.002160456	0.002160456
+3	100	12	99.191405	-0.008085948	0.008085948
+3	100	13	99.191405	-0.008085948	0.008085948
+3	100	14	100.216046	0.002160456	0.002160456
+3	100	15	100.216046	0.002160456	0.002160456
+3	100	16	99.191405	-0.008085948	0.008085948
+3	100	17	101.240942	0.012409424	0.012409424
+3	100	18	98.167021	-0.018329790	0.018329790
+3	100	19	99.191405	-0.008085948	0.008085948
+3	100	20	100.216046	0.002160456	0.002160456
+3	100	21	100.216046	0.002160456	0.002160456
+3	100	22	100.216046	0.002160456	0.002160456
+3	100	23	101.240942	0.012409424	0.012409424
+3	500	0	499.223656	-0.001552688	0.001552688
+3	500	1	499.223656	-0.001552688	0.001552688
+3	500	2	498.094192	-0.003811615	0.003811615
+3	500	3	499.223656	-0.001552688	0.001552688
+3	500	4	503.744628	0.007489256	0.007489256
+3	500	5	508.270595	0.016541190	0.016541190
+3	500	6	507.138634	0.014277269	0.014277269
+3	500	7	495.836199	-0.008327602	0.008327602
+3	500	8	495.836199	-0.008327602	0.008327602
+3	500	9	503.744628	0.007489256	0.007489256
+3	500	10	506.006986	0.012013973	0.012013973
+3	500	11	501.483518	0.002967036	0.002967036
+3	500	12	499.223656	-0.001552688	0.001552688
+3	500	13	501.483518	0.002967036	0.002967036
+3	500	14	499.223656	-0.001552688	0.001552688
+3	500	15	495.836199	-0.008327602	0.008327602
+3	500	16	502.613917	0.005227834	0.005227834
+3	500	17	501.483518	0.002967036	0.002967036
+3	500	18	506.006986	0.012013973	0.012013973
+3	500	19	510.535456	0.021070911	0.021070911
+3	500	20	494.707669	-0.010584662	0.010584662
+3	500	21	500.353431	0.000706863	0.000706863
+3	500	22	499.223656	-0.001552688	0.001552688
+3	500	23	496.965040	-0.006069920	0.006069920
+3	1000	0	991.983739	-0.008016261	0.008016261
+3	1000	1	994.532588	-0.005467412	0.005467412
+3	1000	2	1014.980680	0.014980680	0.014980680
+3	1000	3	976.723864	-0.023276136	0.023276136
+3	1000	4	1007.300678	0.007300678	0.007300678
+3	1000	5	1002.188665	0.002188665	0.002188665
+3	1000	6	997.083024	-0.002916976	0.002916976
+3	1000	7	998.358838	-0.001641162	0.001641162
+3	1000	8	1009.859079	0.009859079	0.009859079
+3	1000	9	998.358838	-0.001641162	0.001641162
+3	1000	10	986.890795	-0.013109205	0.013109205
+3	1000	11	1003.466070	0.003466070	0.003466070
+3	1000	12	1006.022077	0.006022077	0.006022077
+3	1000	13	1030.384020	0.030384020	0.030384020
+3	1000	14	1007.300678	0.007300678	0.007300678
+3	1000	15	1004.743874	0.004743874	0.004743874
+3	1000	16	994.532588	-0.005467412	0.005467412
+3	1000	17	1013.699680	0.013699680	0.013699680
+3	1000	18	1000.911658	0.000911658	0.000911658
+3	1000	19	1007.300678	0.007300678	0.007300678
+3	1000	20	993.257965	-0.006742035	0.006742035
+3	1000	21	991.983739	-0.008016261	0.008016261
+3	1000	22	988.163437	-0.011836563	0.011836563
+3	1000	23	1016.262082	0.016262082	0.016262082
+3	5000	0	5128.817882	0.025763576	0.025763576
+3	5000	1	4981.105439	-0.003778912	0.003778912
+3	5000	2	4994.623603	-0.001075279	0.001075279
+3	5000	3	5139.324942	0.027864988	0.027864988
+3	5000	4	5076.683109	0.015336622	0.015336622
+3	5000	5	4920.819805	-0.015836039	0.015836039
+3	5000	6	4977.732858	-0.004453428	0.004453428
+3	5000	7	4998.010127	-0.000397975	0.000397975
+3	5000	8	5028.615500	0.005723100	0.005723100
+3	5000	9	4851.589988	-0.029682002	0.029682002
+3	5000	10	4937.477005	-0.012504599	0.012504599
+3	5000	11	5052.578794	0.010515759	0.010515759
+3	5000	12	5107.884276	0.021576855	0.021576855
+3	5000	13	5011.584290	0.002316858	0.002316858
+3	5000	14	4904.230070	-0.019153986	0.019153986
+3	5000	15	5018.388278	0.003677656	0.003677656
+3	5000	16	5018.388278	0.003677656	0.003677656
+3	5000	17	5056.013595	0.011202719	0.011202719
+3	5000	18	5025.203588	0.005040718	0.005040718
+3	5000	19	4954.202223	-0.009159555	0.009159555
+3	5000	20	4910.857903	-0.017828419	0.017828419
+3	5000	21	4920.819805	-0.015836039	0.015836039
+3	5000	22	4927.474558	-0.014505088	0.014505088
+3	5000	23	4937.477005	-0.012504599	0.012504599
+3	10000	0	9914.827977	-0.008517202	0.008517202
+3	10000	1	10052.136924	0.005213692	0.005213692
+3	10000	2	9870.062504	-0.012993750	0.012993750
+3	10000	3	10005.853945	0.000585395	0.000585395
+3	10000	4	9971.481716	-0.002851828	0.002851828
+3	10000	5	10304.093353	0.030409335	0.030409335
+3	10000	6	9960.088106	-0.003991189	0.003991189
+3	10000	7	10052.136924	0.005213692	0.005213692
+3	10000	8	9749.421923	-0.025057808	0.025057808
+3	10000	9	9870.062504	-0.012993750	0.012993750
+3	10000	10	10040.517058	0.004051706	0.004051706
+3	10000	11	10005.853945	0.000585395	0.000585395
+3	10000	12	10254.891561	0.025489156	0.025489156
+3	10000	13	10218.374231	0.021837423	0.021837423
+3	10000	14	10110.735920	0.011073592	0.011073592
+3	10000	15	10158.226307	0.015822631	0.015822631
+3	10000	16	10028.930063	0.002893006	0.002893006
+3	10000	17	10017.375753	0.001737575	0.001737575
+3	10000	18	10194.208969	0.019420897	0.019420897
+3	10000	19	9825.780992	-0.017421901	0.017421901
+3	10000	20	9971.481716	-0.002851828	0.002851828
+3	10000	21	9792.881217	-0.020711878	0.020711878
+3	10000	22	9836.806570	-0.016319343	0.016319343
+3	10000	23	9982.907107	-0.001709289	0.001709289
+3	50000	0	50126.377356	0.002527547	0.002527547
+3	50000	1	49542.460653	-0.009150787	0.009150787
+3	50000	2	51042.365811	0.020847316	0.020847316
+3	50000	3	50333.401152	0.006668023	0.006668023
+3	50000	4	48924.708570	-0.021505829	0.021505829
+3	50000	5	49874.716917	-0.002505662	0.002505662
+3	50000	6	51252.478591	0.025049572	0.025049572
+3	50000	7	50533.934925	0.010678698	0.010678698
+3	50000	8	49794.675941	-0.004106481	0.004106481
+3	50000	9	50767.089102	0.015341782	0.015341782
+3	50000	10	48905.025804	-0.021899484	0.021899484
+3	50000	11	49131.658710	-0.017366826	0.017366826
+3	50000	12	49416.137072	-0.011677259	0.011677259
+3	50000	13	50177.479089	0.003549582	0.003549582
+3	50000	14	47720.621803	-0.045587564	0.045587564
+3	50000	15	49717.436824	-0.005651264	0.005651264
+3	50000	16	49960.414062	-0.000791719	0.000791719
+3	50000	17	48859.681764	-0.022806365	0.022806365
+3	50000	18	48758.660390	-0.024826792	0.024826792
+3	50000	19	50576.335372	0.011526707	0.011526707
+3	50000	20	49699.997027	-0.006000059	0.006000059
+3	50000	21	49940.853037	-0.001182939	0.001182939
+3	50000	22	51066.281436	0.021325629	0.021325629
+3	50000	23	50154.606646	0.003092133	0.003092133
+4	100	0	100.216046	0.002160456	0.002160456
+4	100	1	101.240942	0.012409424	0.012409424
+4	100	2	99.191405	-0.008085948	0.008085948
+4	100	3	99.191405	-0.008085948	0.008085948
+4	100	4	98.167021	-0.018329790	0.018329790
+4	100	5	100.216046	0.002160456	0.002160456
+4	100	6	98.167021	-0.018329790	0.018329790
+4	100	7	100.216046	0.002160456	0.002160456
+4	100	8	101.240942	0.012409424	0.012409424
+4	100	9	97.142893	-0.028571070	0.028571070
+4	100	10	100.216046	0.002160456	0.002160456
+4	100	11	101.240942	0.012409424	0.012409424
+4	100	12	101.240942	0.012409424	0.012409424
+4	100	13	101.240942	0.012409424	0.012409424
+4	100	14	99.191405	-0.008085948	0.008085948
+4	100	15	101.240942	0.012409424	0.012409424
+4	100	16	98.167021	-0.018329790	0.018329790
+4	100	17	100.216046	0.002160456	0.002160456
+4	100	18	101.240942	0.012409424	0.012409424
+4	100	19	100.216046	0.002160456	0.002160456
+4	100	20	98.167021	-0.018329790	0.018329790
+4	100	21	98.167021	-0.018329790	0.018329790
+4	100	22	99.191405	-0.008085948	0.008085948
+4	100	23	99.191405	-0.008085948	0.008085948
+4	500	0	500.353431	0.000706863	0.000706863
+4	500	1	492.451541	-0.015096918	0.015096918
+4	500	2	500.353431	0.000706863	0.000706863
+4	500	3	504.875651	0.009751302	0.009751302
+4	500	4	507.138634	0.014277269	0.014277269
+4	500	5	498.094192	-0.003811615	0.003811615
+4	500	6	504.875651	0.009751302	0.009751302
+4	500	7	498.094192	-0.003811615	0.003811615
+4	500	8	481.189505	-0.037620991	0.037620991
+4	500	9	499.223656	-0.001552688	0.001552688
+4	500	10	490.196655	-0.019606690	0.019606690
+4	500	11	504.875651	0.009751302	0.009751302
+4	500	12	499.223656	-0.001552688	0.001552688
+4	500	13	502.613917	0.005227834	0.005227834
+4	500	14	504.875651	0.009751302	0.009751302
+4	500	15	484.564865	-0.030870269	0.030870269
+4	500	16	504.875651	0.009751302	0.009751302
+4	500	17	504.875651	0.009751302	0.009751302
+4	500	18	503.744628	0.007489256	0.007489256
+4	500	19	502.613917	0.005227834	0.005227834
+4	500	20	495.836199	-0.008327602	0.008327602
+4	500	21	494.707669	-0.010584662	0.010584662
+4	500	22	491.323943	-0.017352114	0.017352114
+4	500	23	499.223656	-0.001552688	0.001552688
+4	1000	0	991.983739	-0.008016261	0.008016261
+4	1000	1	983.075238	-0.016924762	0.016924762
+4	1000	2	1029.098194	0.029098194	0.029098194
+4	1000	3	1016.262082	0.016262082	0.016262082
+4	1000	4	1004.743874	0.004743874	0.004743874
+4	1000	5	988.163437	-0.011836563	0.011836563
+4	1000	6	1000.911658	0.000911658	0.000911658
+4	1000	7	1000.911658	0.000911658	0.000911658
+4	1000	8	1012.419079	0.012419079	0.012419079
+4	1000	9	981.804175	-0.018195825	0.018195825
+4	1000	10	991.983739	-0.008016261	0.008016261
+4	1000	11	998.358838	-0.001641162	0.001641162
+4	1000	12	1006.022077	0.006022077	0.006022077
+4	1000	13	1004.743874	0.004743874	0.004743874
+4	1000	14	998.358838	-0.001641162	0.001641162
+4	1000	15	989.436475	-0.010563525	0.010563525
+4	1000	16	1018.826088	0.018826088	0.018826088
+4	1000	17	995.807607	-0.004192393	0.004192393
+4	1000	18	989.436475	-0.010563525	0.010563525
+4	1000	19	986.890795	-0.013109205	0.013109205
+4	1000	20	995.807607	-0.004192393	0.004192393
+4	1000	21	976.723864	-0.023276136	0.023276136
+4	1000	22	984.346695	-0.015653305	0.015653305
+4	1000	23	1014.980680	0.014980680	0.014980680
+4	5000	0	5032.030256	0.006406051	0.006406051
+4	5000	1	5056.013595	0.011202719	0.011202719
+4	5000	2	4994.623603	-0.001075279	0.001075279
+4	5000	3	5001.399453	0.000279891	0.000279891
+4	5000	4	4998.010127	-0.000397975	0.000397975
+4	5000	5	4877.825466	-0.024434907	0.024434907
+4	5000	6	5011.584290	0.002316858	0.002316858
+4	5000	7	4974.363051	-0.005127390	0.005127390
+4	5000	8	4960.911479	-0.007817704	0.007817704
+4	5000	9	4960.911479	-0.007817704	0.007817704
+4	5000	10	4910.857903	-0.017828419	0.017828419
+4	5000	11	4984.480800	-0.003103840	0.003103840
+4	5000	12	5004.791585	0.000958317	0.000958317
+4	5000	13	4967.631743	-0.006473651	0.006473651
+4	5000	14	4967.631743	-0.006473651	0.006473651
+4	5000	15	5062.891850	0.012578370	0.012578370
+4	5000	16	4838.534996	-0.032293001	0.032293001
+4	5000	17	4914.175845	-0.017164831	0.017164831
+4	5000	18	4957.555477	-0.008488905	0.008488905
+4	5000	19	5090.520960	0.018104192	0.018104192
+4	5000	20	5059.451279	0.011890256	0.011890256
+4	5000	21	4947.503938	-0.010499212	0.010499212
+4	5000	22	4937.477005	-0.012504599	0.012504599
+4	5000	23	4940.816590	-0.011836682	0.011836682
+4	10000	0	9760.243594	-0.023975641	0.023975641
+4	10000	1	10028.930063	0.002893006	0.002893006
+4	10000	2	10052.136924	0.005213692	0.005213692
+4	10000	3	10218.374231	0.021837423	0.021837423
+4	10000	4	10182.179592	0.018217959	0.018217959
+4	10000	5	10170.185440	0.017018544	0.017018544
+4	10000	6	9982.907107	-0.001709289	0.001709289
+4	10000	7	9971.481716	-0.002851828	0.002851828
+4	10000	8	9881.208089	-0.011879191	0.011879191
+4	10000	9	10170.185440	0.017018544	0.017018544
+4	10000	10	10028.930063	0.002893006	0.002893006
+4	10000	11	9621.744053	-0.037825595	0.037825595
+4	10000	12	9695.738323	-0.030426168	0.030426168
+4	10000	13	10075.476018	0.007547602	0.007547602
+4	10000	14	9903.590659	-0.009640934	0.009640934
+4	10000	15	10017.375753	0.001737575	0.001737575
+4	10000	16	10158.226307	0.015822631	0.015822631
+4	10000	17	9781.973088	-0.021802691	0.021802691
+4	10000	18	10122.556996	0.012255700	0.012255700
+4	10000	19	9960.088106	-0.003991189	0.003991189
+4	10000	20	9982.907107	-0.001709289	0.001709289
+4	10000	21	10254.891561	0.025489156	0.025489156
+4	10000	22	9982.907107	-0.001709289	0.001709289
+4	10000	23	9600.846049	-0.039915395	0.039915395
+4	50000	0	50487.329371	0.009746587	0.009746587
+4	50000	1	49628.519390	-0.007429612	0.007429612
+4	50000	2	49468.405797	-0.010631884	0.010631884
+4	50000	3	50201.101863	0.004022037	0.004022037
+4	50000	4	50364.273861	0.007285477	0.007285477
+4	50000	5	49261.243297	-0.014775134	0.014775134
+4	50000	6	51561.623991	0.031232480	0.031232480
+4	50000	7	49142.131110	-0.017157378	0.017157378
+4	50000	8	50487.171039	0.009743421	0.009743421
+4	50000	9	49711.822716	-0.005763546	0.005763546
+4	50000	10	49836.558613	-0.003268828	0.003268828
+4	50000	11	48670.637036	-0.026587259	0.026587259
+4	50000	12	49977.542534	-0.000449149	0.000449149
+4	50000	13	50692.983050	0.013859661	0.013859661
+4	50000	14	50169.247876	0.003384958	0.003384958
+4	50000	15	50283.385395	0.005667708	0.005667708
+4	50000	16	48949.966772	-0.021000665	0.021000665
+4	50000	17	51130.817492	0.022616350	0.022616350
+4	50000	18	50410.604322	0.008212086	0.008212086
+4	50000	19	51365.580151	0.027311603	0.027311603
+4	50000	20	49511.948667	-0.009761027	0.009761027
+4	50000	21	48925.002164	-0.021499957	0.021499957
+4	50000	22	48117.701007	-0.037645980	0.037645980
+4	50000	23	49225.792420	-0.015484152	0.015484152
+5	100	0	99.191405	-0.008085948	0.008085948
+5	100	1	99.191405	-0.008085948	0.008085948
+5	100	2	101.240942	0.012409424	0.012409424
+5	100	3	96.119021	-0.038809790	0.038809790
+5	100	4	101.240942	0.012409424	0.012409424
+5	100	5	100.216046	0.002160456	0.002160456
+5	100	6	101.240942	0.012409424	0.012409424
+5	100	7	100.216046	0.002160456	0.002160456
+5	100	8	101.240942	0.012409424	0.012409424
+5	100	9	100.216046	0.002160456	0.002160456
+5	100	10	100.216046	0.002160456	0.002160456
+5	100	11	98.167021	-0.018329790	0.018329790
+5	100	12	98.167021	-0.018329790	0.018329790
+5	100	13	99.191405	-0.008085948	0.008085948
+5	100	14	101.240942	0.012409424	0.012409424
+5	100	15	100.216046	0.002160456	0.002160456
+5	100	16	101.240942	0.012409424	0.012409424
+5	100	17	99.191405	-0.008085948	0.008085948
+5	100	18	99.191405	-0.008085948	0.008085948
+5	100	19	101.240942	0.012409424	0.012409424
+5	100	20	98.167021	-0.018329790	0.018329790
+5	100	21	101.240942	0.012409424	0.012409424
+5	100	22	100.216046	0.002160456	0.002160456
+5	100	23	100.216046	0.002160456	0.002160456
+5	500	0	496.965040	-0.006069920	0.006069920
+5	500	1	503.744628	0.007489256	0.007489256
+5	500	2	495.836199	-0.008327602	0.008327602
+5	500	3	503.744628	0.007489256	0.007489256
+5	500	4	490.196655	-0.019606690	0.019606690
+5	500	5	496.965040	-0.006069920	0.006069920
+5	500	6	506.006986	0.012013973	0.012013973
+5	500	7	491.323943	-0.017352114	0.017352114
+5	500	8	508.270595	0.016541190	0.016541190
+5	500	9	496.965040	-0.006069920	0.006069920
+5	500	10	496.965040	-0.006069920	0.006069920
+5	500	11	502.613917	0.005227834	0.005227834
+5	500	12	498.094192	-0.003811615	0.003811615
+5	500	13	501.483518	0.002967036	0.002967036
+5	500	14	499.223656	-0.001552688	0.001552688
+5	500	15	502.613917	0.005227834	0.005227834
+5	500	16	493.579450	-0.012841101	0.012841101
+5	500	17	496.965040	-0.006069920	0.006069920
+5	500	18	504.875651	0.009751302	0.009751302
+5	500	19	490.196655	-0.019606690	0.019606690
+5	500	20	502.613917	0.005227834	0.005227834
+5	500	21	494.707669	-0.010584662	0.010584662
+5	500	22	496.965040	-0.006069920	0.006069920
+5	500	23	500.353431	0.000706863	0.000706863
+5	1000	0	1009.859079	0.009859079	0.009859079
+5	1000	1	1002.188665	0.002188665	0.002188665
+5	1000	2	995.807607	-0.004192393	0.004192393
+5	1000	3	991.983739	-0.008016261	0.008016261
+5	1000	4	1009.859079	0.009859079	0.009859079
+5	1000	5	1022.675110	0.022675110	0.022675110
+5	1000	6	1006.022077	0.006022077	0.006022077
+5	1000	7	1003.466070	0.003466070	0.003466070
+5	1000	8	1004.743874	0.004743874	0.004743874
+5	1000	9	1023.958921	0.023958921	0.023958921
+5	1000	10	1000.911658	0.000911658	0.000911658
+5	1000	11	986.890795	-0.013109205	0.013109205
+5	1000	12	1006.022077	0.006022077	0.006022077
+5	1000	13	1011.138879	0.011138879	0.011138879
+5	1000	14	999.635049	-0.000364951	0.000364951
+5	1000	15	998.358838	-0.001641162	0.001641162
+5	1000	16	1002.188665	0.002188665	0.002188665
+5	1000	17	1034.243923	0.034243923	0.034243923
+5	1000	18	1002.188665	0.002188665	0.002188665
+5	1000	19	988.163437	-0.011836563	0.011836563
+5	1000	20	995.807607	-0.004192393	0.004192393
+5	1000	21	1014.980680	0.014980680	0.014980680
+5	1000	22	1021.391701	0.021391701	0.021391701
+5	1000	23	1004.743874	0.004743874	0.004743874
+5	5000	0	4967.631743	-0.006473651	0.006473651
+5	5000	1	5107.884276	0.021576855	0.021576855
+5	5000	2	5107.884276	0.021576855	0.021576855
+5	5000	3	5100.930114	0.020186023	0.020186023
+5	5000	4	5111.365789	0.022273158	0.022273158
+5	5000	5	5021.794515	0.004358903	0.004358903
+5	5000	6	4930.805994	-0.013838801	0.013838801
+5	5000	7	5107.884276	0.021576855	0.021576855
+5	5000	8	4904.230070	-0.019153986	0.019153986
+5	5000	9	5014.984871	0.002996974	0.002996974
+5	5000	10	4914.175845	-0.017164831	0.017164831
+5	5000	11	5080.138191	0.016027638	0.016027638
+5	5000	12	5069.781675	0.013956335	0.013956335
+5	5000	13	4944.158899	-0.011168220	0.011168220
+5	5000	14	4984.480800	-0.003103840	0.003103840
+5	5000	15	5001.399453	0.000279891	0.000279891
+5	5000	16	4964.270233	-0.007145953	0.007145953
+5	5000	17	4964.270233	-0.007145953	0.007145953
+5	5000	18	5021.794515	0.004358903	0.004358903
+5	5000	19	5018.388278	0.003677656	0.003677656
+5	5000	20	4904.230070	-0.019153986	0.019153986
+5	5000	21	4944.158899	-0.011168220	0.011168220
+5	5000	22	4970.996014	-0.005800797	0.005800797
+5	5000	23	5097.457456	0.019491491	0.019491491
+5	10000	0	9847.861908	-0.015213809	0.015213809
+5	10000	1	9836.806570	-0.016319343	0.016319343
+5	10000	2	10134.412287	0.013441229	0.013441229
+5	10000	3	9937.395527	-0.006260447	0.006260447
+5	10000	4	10353.893359	0.035389336	0.035389336
+5	10000	5	9994.364457	-0.000563554	0.000563554
+5	10000	6	10052.136924	0.005213692	0.005213692
+5	10000	7	10110.735920	0.011073592	0.011073592
+5	10000	8	9960.088106	-0.003991189	0.003991189
+5	10000	9	10052.136924	0.005213692	0.005213692
+5	10000	10	9903.590659	-0.009640934	0.009640934
+5	10000	11	9903.590659	-0.009640934	0.009640934
+5	10000	12	10267.136712	0.026713671	0.026713671
+5	10000	13	9994.364457	-0.000563554	0.000563554
+5	10000	14	9960.088106	-0.003991189	0.003991189
+5	10000	15	10146.301990	0.014630199	0.014630199
+5	10000	16	9781.973088	-0.021802691	0.021802691
+5	10000	17	10170.185440	0.017018544	0.017018544
+5	10000	18	9926.096210	-0.007390379	0.007390379
+5	10000	19	10040.517058	0.004051706	0.004051706
+5	10000	20	10254.891561	0.025489156	0.025489156
+5	10000	21	10052.136924	0.005213692	0.005213692
+5	10000	22	9903.590659	-0.009640934	0.009640934
+5	10000	23	10040.517058	0.004051706	0.004051706
+5	50000	0	50391.452277	0.007829046	0.007829046
+5	50000	1	51345.546947	0.026910939	0.026910939
+5	50000	2	49788.922441	-0.004221551	0.004221551
+5	50000	3	50706.652690	0.014133054	0.014133054
+5	50000	4	49229.207214	-0.015415856	0.015415856
+5	50000	5	51116.766431	0.022335329	0.022335329
+5	50000	6	50489.706879	0.009794138	0.009794138
+5	50000	7	50537.087487	0.010741750	0.010741750
+5	50000	8	49082.918379	-0.018341632	0.018341632
+5	50000	9	49661.741440	-0.006765171	0.006765171
+5	50000	10	50725.329638	0.014506593	0.014506593
+5	50000	11	49644.005103	-0.007119898	0.007119898
+5	50000	12	50944.130520	0.018882610	0.018882610
+5	50000	13	49841.423902	-0.003171522	0.003171522
+5	50000	14	50103.067342	0.002061347	0.002061347
+5	50000	15	50172.263822	0.003445276	0.003445276
+5	50000	16	50876.998437	0.017539969	0.017539969
+5	50000	17	49863.156177	-0.002736876	0.002736876
+5	50000	18	49327.134639	-0.013457307	0.013457307
+5	50000	19	49184.348758	-0.016313025	0.016313025
+5	50000	20	50646.793921	0.012935878	0.012935878
+5	50000	21	49726.404570	-0.005471909	0.005471909
+5	50000	22	48706.937818	-0.025861244	0.025861244
+5	50000	23	49138.690983	-0.017226180	0.017226180
+6	100	0	100.216046	0.002160456	0.002160456
+6	100	1	99.191405	-0.008085948	0.008085948
+6	100	2	101.240942	0.012409424	0.012409424
+6	100	3	98.167021	-0.018329790	0.018329790
+6	100	4	96.119021	-0.038809790	0.038809790
+6	100	5	101.240942	0.012409424	0.012409424
+6	100	6	101.240942	0.012409424	0.012409424
+6	100	7	100.216046	0.002160456	0.002160456
+6	100	8	100.216046	0.002160456	0.002160456
+6	100	9	100.216046	0.002160456	0.002160456
+6	100	10	100.216046	0.002160456	0.002160456
+6	100	11	101.240942	0.012409424	0.012409424
+6	100	12	100.216046	0.002160456	0.002160456
+6	100	13	100.216046	0.002160456	0.002160456
+6	100	14	100.216046	0.002160456	0.002160456
+6	100	15	99.191405	-0.008085948	0.008085948
+6	100	16	100.216046	0.002160456	0.002160456
+6	100	17	100.216046	0.002160456	0.002160456
+6	100	18	98.167021	-0.018329790	0.018329790
+6	100	19	100.216046	0.002160456	0.002160456
+6	100	20	99.191405	-0.008085948	0.008085948
+6	100	21	101.240942	0.012409424	0.012409424
+6	100	22	100.216046	0.002160456	0.002160456
+6	100	23	101.240942	0.012409424	0.012409424
+6	500	0	501.483518	0.002967036	0.002967036
+6	500	1	496.965040	-0.006069920	0.006069920
+6	500	2	492.451541	-0.015096918	0.015096918
+6	500	3	503.744628	0.007489256	0.007489256
+6	500	4	501.483518	0.002967036	0.002967036
+6	500	5	506.006986	0.012013973	0.012013973
+6	500	6	499.223656	-0.001552688	0.001552688
+6	500	7	499.223656	-0.001552688	0.001552688
+6	500	8	503.744628	0.007489256	0.007489256
+6	500	9	501.483518	0.002967036	0.002967036
+6	500	10	503.744628	0.007489256	0.007489256
+6	500	11	500.353431	0.000706863	0.000706863
+6	500	12	492.451541	-0.015096918	0.015096918
+6	500	13	501.483518	0.002967036	0.002967036
+6	500	14	508.270595	0.016541190	0.016541190
+6	500	15	493.579450	-0.012841101	0.012841101
+6	500	16	496.965040	-0.006069920	0.006069920
+6	500	17	502.613917	0.005227834	0.005227834
+6	500	18	501.483518	0.002967036	0.002967036
+6	500	19	492.451541	-0.015096918	0.015096918
+6	500	20	502.613917	0.005227834	0.005227834
+6	500	21	498.094192	-0.003811615	0.003811615
+6	500	22	495.836199	-0.008327602	0.008327602
+6	500	23	507.138634	0.014277269	0.014277269
+6	1000	0	1004.743874	0.004743874	0.004743874
+6	1000	1	995.807607	-0.004192393	0.004192393
+6	1000	2	1025.243135	0.025243135	0.025243135
+6	1000	3	990.709909	-0.009290091	0.009290091
+6	1000	4	974.186070	-0.025813930	0.025813930
+6	1000	5	1006.022077	0.006022077	0.006022077
+6	1000	6	1002.188665	0.002188665	0.002188665
+6	1000	7	995.807607	-0.004192393	0.004192393
+6	1000	8	1012.419079	0.012419079	0.012419079
+6	1000	9	991.983739	-0.008016261	0.008016261
+6	1000	10	1007.300678	0.007300678	0.007300678
+6	1000	11	997.083024	-0.002916976	0.002916976
+6	1000	12	1002.188665	0.002188665	0.002188665
+6	1000	13	999.635049	-0.000364951	0.000364951
+6	1000	14	1002.188665	0.002188665	0.002188665
+6	1000	15	1012.419079	0.012419079	0.012419079
+6	1000	16	1006.022077	0.006022077	0.006022077
+6	1000	17	1007.300678	0.007300678	0.007300678
+6	1000	18	1016.262082	0.016262082	0.016262082
+6	1000	19	999.635049	-0.000364951	0.000364951
+6	1000	20	1013.699680	0.013699680	0.013699680
+6	1000	21	1011.138879	0.011138879	0.011138879
+6	1000	22	995.807607	-0.004192393	0.004192393
+6	1000	23	1011.138879	0.011138879	0.011138879
+6	5000	0	5069.781675	0.013956335	0.013956335
+6	5000	1	4994.623603	-0.001075279	0.001075279
+6	5000	2	5100.930114	0.020186023	0.020186023
+6	5000	3	4970.996014	-0.005800797	0.005800797
+6	5000	4	5025.203588	0.005040718	0.005040718
+6	5000	5	5025.203588	0.005040718	0.005040718
+6	5000	6	4917.496478	-0.016500704	0.016500704
+6	5000	7	5090.520960	0.018104192	0.018104192
+6	5000	8	5090.520960	0.018104192	0.018104192
+6	5000	9	4930.805994	-0.013838801	0.013838801
+6	5000	10	5097.457456	0.019491491	0.019491491
+6	5000	11	5025.203588	0.005040718	0.005040718
+6	5000	12	5014.984871	0.002996974	0.002996974
+6	5000	13	4970.996014	-0.005800797	0.005800797
+6	5000	14	5083.596191	0.016719238	0.016719238
+6	5000	15	4991.239877	-0.001752025	0.001752025
+6	5000	16	4981.105439	-0.003778912	0.003778912
+6	5000	17	4917.496478	-0.016500704	0.016500704
+6	5000	18	5049.146871	0.009829374	0.009829374
+6	5000	19	5121.828119	0.024365624	0.024365624
+6	5000	20	5049.146871	0.009829374	0.009829374
+6	5000	21	4960.911479	-0.007817704	0.007817704
+6	5000	22	5008.186530	0.001637306	0.001637306
+6	5000	23	4867.967458	-0.026406508	0.026406508
+6	10000	0	9781.973088	-0.021802691	0.021802691
+6	10000	1	9926.096210	-0.007390379	0.007390379
+6	10000	2	9926.096210	-0.007390379	0.007390379
+6	10000	3	10075.476018	0.007547602	0.007547602
+6	10000	4	10134.412287	0.013441229	0.013441229
+6	10000	5	9937.395527	-0.006260447	0.006260447
+6	10000	6	10087.195626	0.008719563	0.008719563
+6	10000	7	9926.096210	-0.007390379	0.007390379
+6	10000	8	9960.088106	-0.003991189	0.003991189
+6	10000	9	9781.973088	-0.021802691	0.021802691
+6	10000	10	9960.088106	-0.003991189	0.003991189
+6	10000	11	10087.195626	0.008719563	0.008719563
+6	10000	12	9881.208089	-0.011879191	0.011879191
+6	10000	13	10279.418580	0.027941858	0.027941858
+6	10000	14	9836.806570	-0.016319343	0.016319343
+6	10000	15	10353.893359	0.035389336	0.035389336
+6	10000	16	9847.861908	-0.015213809	0.015213809
+6	10000	17	10040.517058	0.004051706	0.004051706
+6	10000	18	9914.827977	-0.008517202	0.008517202
+6	10000	19	10040.517058	0.004051706	0.004051706
+6	10000	20	9858.947165	-0.014105284	0.014105284
+6	10000	21	10206.273779	0.020627378	0.020627378
+6	10000	22	9994.364457	-0.000563554	0.000563554
+6	10000	23	10028.930063	0.002893006	0.002893006
+6	50000	0	50866.556030	0.017331121	0.017331121
+6	50000	1	50994.299755	0.019885995	0.019885995
+6	50000	2	50152.785619	0.003055712	0.003055712
+6	50000	3	50009.246521	0.000184930	0.000184930
+6	50000	4	51192.753437	0.023855069	0.023855069
+6	50000	5	51317.809025	0.026356181	0.026356181
+6	50000	6	49690.014183	-0.006199716	0.006199716
+6	50000	7	49670.900822	-0.006581984	0.006581984
+6	50000	8	50409.216098	0.008184322	0.008184322
+6	50000	9	48467.454489	-0.030650910	0.030650910
+6	50000	10	48748.920627	-0.025021587	0.025021587
+6	50000	11	50478.177491	0.009563550	0.009563550
+6	50000	12	49772.743748	-0.004545125	0.004545125
+6	50000	13	49249.226793	-0.015015464	0.015015464
+6	50000	14	51134.369389	0.022687388	0.022687388
+6	50000	15	50809.167987	0.016183360	0.016183360
+6	50000	16	49709.829366	-0.005803413	0.005803413
+6	50000	17	50661.608947	0.013232179	0.013232179
+6	50000	18	50944.463991	0.018889280	0.018889280
+6	50000	19	49980.739480	-0.000385210	0.000385210
+6	50000	20	50029.610910	0.000592218	0.000592218
+6	50000	21	49041.580992	-0.019168380	0.019168380
+6	50000	22	50248.168995	0.004963380	0.004963380
+6	50000	23	52078.280917	0.041565618	0.041565618
+7	100	0	101.240942	0.012409424	0.012409424
+7	100	1	99.191405	-0.008085948	0.008085948
+7	100	2	99.191405	-0.008085948	0.008085948
+7	100	3	100.216046	0.002160456	0.002160456
+7	100	4	98.167021	-0.018329790	0.018329790
+7	100	5	100.216046	0.002160456	0.002160456
+7	100	6	101.240942	0.012409424	0.012409424
+7	100	7	99.191405	-0.008085948	0.008085948
+7	100	8	99.191405	-0.008085948	0.008085948
+7	100	9	101.240942	0.012409424	0.012409424
+7	100	10	97.142893	-0.028571070	0.028571070
+7	100	11	101.240942	0.012409424	0.012409424
+7	100	12	101.240942	0.012409424	0.012409424
+7	100	13	99.191405	-0.008085948	0.008085948
+7	100	14	101.240942	0.012409424	0.012409424
+7	100	15	101.240942	0.012409424	0.012409424
+7	100	16	101.240942	0.012409424	0.012409424
+7	100	17	101.240942	0.012409424	0.012409424
+7	100	18	99.191405	-0.008085948	0.008085948
+7	100	19	99.191405	-0.008085948	0.008085948
+7	100	20	99.191405	-0.008085948	0.008085948
+7	100	21	100.216046	0.002160456	0.002160456
+7	100	22	100.216046	0.002160456	0.002160456
+7	100	23	100.216046	0.002160456	0.002160456
+7	500	0	492.451541	-0.015096918	0.015096918
+7	500	1	500.353431	0.000706863	0.000706863
+7	500	2	516.203092	0.032406183	0.032406183
+7	500	3	499.223656	-0.001552688	0.001552688
+7	500	4	508.270595	0.016541190	0.016541190
+7	500	5	499.223656	-0.001552688	0.001552688
+7	500	6	500.353431	0.000706863	0.000706863
+7	500	7	499.223656	-0.001552688	0.001552688
+7	500	8	503.744628	0.007489256	0.007489256
+7	500	9	492.451541	-0.015096918	0.015096918
+7	500	10	489.069678	-0.021860645	0.021860645
+7	500	11	498.094192	-0.003811615	0.003811615
+7	500	12	504.875651	0.009751302	0.009751302
+7	500	13	506.006986	0.012013973	0.012013973
+7	500	14	501.483518	0.002967036	0.002967036
+7	500	15	499.223656	-0.001552688	0.001552688
+7	500	16	509.402869	0.018805738	0.018805738
+7	500	17	504.875651	0.009751302	0.009751302
+7	500	18	495.836199	-0.008327602	0.008327602
+7	500	19	499.223656	-0.001552688	0.001552688
+7	500	20	503.744628	0.007489256	0.007489256
+7	500	21	495.836199	-0.008327602	0.008327602
+7	500	22	503.744628	0.007489256	0.007489256
+7	500	23	504.875651	0.009751302	0.009751302
+7	1000	0	1003.466070	0.003466070	0.003466070
+7	1000	1	1021.391701	0.021391701	0.021391701
+7	1000	2	994.532588	-0.005467412	0.005467412
+7	1000	3	995.807607	-0.004192393	0.004192393
+7	1000	4	997.083024	-0.002916976	0.002916976
+7	1000	5	1011.138879	0.011138879	0.011138879
+7	1000	6	997.083024	-0.002916976	0.002916976
+7	1000	7	1003.466070	0.003466070	0.003466070
+7	1000	8	991.983739	-0.008016261	0.008016261
+7	1000	9	1008.579679	0.008579679	0.008579679
+7	1000	10	1012.419079	0.012419079	0.012419079
+7	1000	11	1003.466070	0.003466070	0.003466070
+7	1000	12	999.635049	-0.000364951	0.000364951
+7	1000	13	999.635049	-0.000364951	0.000364951
+7	1000	14	986.890795	-0.013109205	0.013109205
+7	1000	15	995.807607	-0.004192393	0.004192393
+7	1000	16	995.807607	-0.004192393	0.004192393
+7	1000	17	1008.579679	0.008579679	0.008579679
+7	1000	18	980.533506	-0.019466494	0.019466494
+7	1000	19	997.083024	-0.002916976	0.002916976
+7	1000	20	989.436475	-0.010563525	0.010563525
+7	1000	21	1000.911658	0.000911658	0.000911658
+7	1000	22	1011.138879	0.011138879	0.011138879
+7	1000	23	994.532588	-0.005467412	0.005467412
+7	5000	0	5035.447861	0.007089572	0.007089572
+7	5000	1	4867.967458	-0.026406508	0.026406508
+7	5000	2	5021.794515	0.004358903	0.004358903
+7	5000	3	5121.828119	0.024365624	0.024365624
+7	5000	4	5025.203588	0.005040718	0.005040718
+7	5000	5	4881.116747	-0.023776651	0.023776651
+7	5000	6	5087.057112	0.017411422	0.017411422
+7	5000	7	5069.781675	0.013956335	0.013956335
+7	5000	8	4930.805994	-0.013838801	0.013838801
+7	5000	9	4994.623603	-0.001075279	0.001075279
+7	5000	10	5100.930114	0.020186023	0.020186023
+7	5000	11	4998.010127	-0.000397975	0.000397975
+7	5000	12	5004.791585	0.000958317	0.000958317
+7	5000	13	4974.363051	-0.005127390	0.005127390
+7	5000	14	4950.851711	-0.009829658	0.009829658
+7	5000	15	5049.146871	0.009829374	0.009829374
+7	5000	16	4937.477005	-0.012504599	0.012504599
+7	5000	17	5021.794515	0.004358903	0.004358903
+7	5000	18	5056.013595	0.011202719	0.011202719
+7	5000	19	5066.335314	0.013267063	0.013267063
+7	5000	20	4987.858944	-0.002428211	0.002428211
+7	5000	21	5032.030256	0.006406051	0.006406051
+7	5000	22	4937.477005	-0.012504599	0.012504599
+7	5000	23	4970.996014	-0.005800797	0.005800797
+7	10000	0	10052.136924	0.005213692	0.005213692
+7	10000	1	10194.208969	0.019420897	0.019420897
+7	10000	2	10122.556996	0.012255700	0.012255700
+7	10000	3	9858.947165	-0.014105284	0.014105284
+7	10000	4	10028.930063	0.002893006	0.002893006
+7	10000	5	9994.364457	-0.000563554	0.000563554
+7	10000	6	10182.179592	0.018217959	0.018217959
+7	10000	7	9642.749227	-0.035725077	0.035725077
+7	10000	8	9600.846049	-0.039915395	0.039915395
+7	10000	9	10052.136924	0.005213692	0.005213692
+7	10000	10	10052.136924	0.005213692	0.005213692
+7	10000	11	10218.374231	0.021837423	0.021837423
+7	10000	12	10218.374231	0.021837423	0.021837423
+7	10000	13	9858.947165	-0.014105284	0.014105284
+7	10000	14	10098.948862	0.009894886	0.009894886
+7	10000	15	10063.789848	0.006378985	0.006378985
+7	10000	16	10075.476018	0.007547602	0.007547602
+7	10000	17	10417.007088	0.041700709	0.041700709
+7	10000	18	10417.007088	0.041700709	0.041700709
+7	10000	19	10063.789848	0.006378985	0.006378985
+7	10000	20	10005.853945	0.000585395	0.000585395
+7	10000	21	9825.780992	-0.017421901	0.017421901
+7	10000	22	10075.476018	0.007547602	0.007547602
+7	10000	23	10028.930063	0.002893006	0.002893006
+7	50000	0	51039.222125	0.020784443	0.020784443
+7	50000	1	49065.056027	-0.018698879	0.018698879
+7	50000	2	50549.920019	0.010998400	0.010998400
+7	50000	3	50006.522955	0.000130459	0.000130459
+7	50000	4	50279.074305	0.005581486	0.005581486
+7	50000	5	50317.402595	0.006348052	0.006348052
+7	50000	6	48925.374587	-0.021492508	0.021492508
+7	50000	7	49215.294265	-0.015694115	0.015694115
+7	50000	8	49652.641648	-0.006947167	0.006947167
+7	50000	9	50000.410993	0.000008220	0.000008220
+7	50000	10	49349.287603	-0.013014248	0.013014248
+7	50000	11	49362.199253	-0.012756015	0.012756015
+7	50000	12	48828.715976	-0.023425680	0.023425680
+7	50000	13	49265.381603	-0.014692368	0.014692368
+7	50000	14	48760.906360	-0.024781873	0.024781873
+7	50000	15	49933.816813	-0.001323664	0.001323664
+7	50000	16	50579.842511	0.011596850	0.011596850
+7	50000	17	50091.397074	0.001827941	0.001827941
+7	50000	18	49830.663896	-0.003386722	0.003386722
+7	50000	19	49618.548207	-0.007629036	0.007629036
+7	50000	20	49233.792602	-0.015324148	0.015324148
+7	50000	21	50647.397700	0.012947954	0.012947954
+7	50000	22	50538.824383	0.010776488	0.010776488
+7	50000	23	49336.876975	-0.013262461	0.013262461
+8	100	0	99.191405	-0.008085948	0.008085948
+8	100	1	98.167021	-0.018329790	0.018329790
+8	100	2	101.240942	0.012409424	0.012409424
+8	100	3	100.216046	0.002160456	0.002160456
+8	100	4	99.191405	-0.008085948	0.008085948
+8	100	5	99.191405	-0.008085948	0.008085948
+8	100	6	101.240942	0.012409424	0.012409424
+8	100	7	101.240942	0.012409424	0.012409424
+8	100	8	99.191405	-0.008085948	0.008085948
+8	100	9	99.191405	-0.008085948	0.008085948
+8	100	10	95.095405	-0.049045951	0.049045951
+8	100	11	100.216046	0.002160456	0.002160456
+8	100	12	99.191405	-0.008085948	0.008085948
+8	100	13	100.216046	0.002160456	0.002160456
+8	100	14	98.167021	-0.018329790	0.018329790
+8	100	15	101.240942	0.012409424	0.012409424
+8	100	16	99.191405	-0.008085948	0.008085948
+8	100	17	101.240942	0.012409424	0.012409424
+8	100	18	99.191405	-0.008085948	0.008085948
+8	100	19	101.240942	0.012409424	0.012409424
+8	100	20	101.240942	0.012409424	0.012409424
+8	100	21	96.119021	-0.038809790	0.038809790
+8	100	22	99.191405	-0.008085948	0.008085948
+8	100	23	100.216046	0.002160456	0.002160456
+8	500	0	510.535456	0.021070911	0.021070911
+8	500	1	500.353431	0.000706863	0.000706863
+8	500	2	507.138634	0.014277269	0.014277269
+8	500	3	500.353431	0.000706863	0.000706863
+8	500	4	492.451541	-0.015096918	0.015096918
+8	500	5	504.875651	0.009751302	0.009751302
+8	500	6	508.270595	0.016541190	0.016541190
+8	500	7	509.402869	0.018805738	0.018805738
+8	500	8	507.138634	0.014277269	0.014277269
+8	500	9	501.483518	0.002967036	0.002967036
+8	500	10	504.875651	0.009751302	0.009751302
+8	500	11	493.579450	-0.012841101	0.012841101
+8	500	12	493.579450	-0.012841101	0.012841101
+8	500	13	494.707669	-0.010584662	0.010584662
+8	500	14	500.353431	0.000706863	0.000706863
+8	500	15	504.875651	0.009751302	0.009751302
+8	500	16	486.816652	-0.026366696	0.026366696
+8	500	17	493.579450	-0.012841101	0.012841101
+8	500	18	504.875651	0.009751302	0.009751302
+8	500	19	502.613917	0.005227834	0.005227834
+8	500	20	495.836199	-0.008327602	0.008327602
+8	500	21	502.613917	0.005227834	0.005227834
+8	500	22	494.707669	-0.010584662	0.010584662
+8	500	23	498.094192	-0.003811615	0.003811615
+8	1000	0	1007.300678	0.007300678	0.007300678
+8	1000	1	1014.980680	0.014980680	0.014980680
+8	1000	2	999.635049	-0.000364951	0.000364951
+8	1000	3	999.635049	-0.000364951	0.000364951
+8	1000	4	975.454771	-0.024545229	0.024545229
+8	1000	5	986.890795	-0.013109205	0.013109205
+8	1000	6	988.163437	-0.011836563	0.011836563
+8	1000	7	1016.262082	0.016262082	0.016262082
+8	1000	8	990.709909	-0.009290091	0.009290091
+8	1000	9	1003.466070	0.003466070	0.003466070
+8	1000	10	983.075238	-0.016924762	0.016924762
+8	1000	11	995.807607	-0.004192393	0.004192393
+8	1000	12	1004.743874	0.004743874	0.004743874
+8	1000	13	981.804175	-0.018195825	0.018195825
+8	1000	14	1002.188665	0.002188665	0.002188665
+8	1000	15	1002.188665	0.002188665	0.002188665
+8	1000	16	989.436475	-0.010563525	0.010563525
+8	1000	17	1002.188665	0.002188665	0.002188665
+8	1000	18	976.723864	-0.023276136	0.023276136
+8	1000	19	1006.022077	0.006022077	0.006022077
+8	1000	20	980.533506	-0.019466494	0.019466494
+8	1000	21	1009.859079	0.009859079	0.009859079
+8	1000	22	999.635049	-0.000364951	0.000364951
+8	1000	23	995.807607	-0.004192393	0.004192393
+8	5000	0	5146.344652	0.029268930	0.029268930
+8	5000	1	4954.202223	-0.009159555	0.009159555
+8	5000	2	4991.239877	-0.001752025	0.001752025
+8	5000	3	4954.202223	-0.009159555	0.009159555
+8	5000	4	5146.344652	0.029268930	0.029268930
+8	5000	5	4904.230070	-0.019153986	0.019153986
+8	5000	6	5021.794515	0.004358903	0.004358903
+8	5000	7	4984.480800	-0.003103840	0.003103840
+8	5000	8	4907.542646	-0.018491471	0.018491471
+8	5000	9	5073.230939	0.014646188	0.014646188
+8	5000	10	5083.596191	0.016719238	0.016719238
+8	5000	11	4950.851711	-0.009829658	0.009829658
+8	5000	12	5083.596191	0.016719238	0.016719238
+8	5000	13	4838.534996	-0.032293001	0.032293001
+8	5000	14	4964.270233	-0.007145953	0.007145953
+8	5000	15	4914.175845	-0.017164831	0.017164831
+8	5000	16	4900.920170	-0.019815966	0.019815966
+8	5000	17	5080.138191	0.016027638	0.016027638
+8	5000	18	5001.399453	0.000279891	0.000279891
+8	5000	19	5021.794515	0.004358903	0.004358903
+8	5000	20	4998.010127	-0.000397975	0.000397975
+8	5000	21	4991.239877	-0.001752025	0.001752025
+8	5000	22	5069.781675	0.013956335	0.013956335
+8	5000	23	5073.230939	0.014646188	0.014646188
+8	10000	0	10254.891561	0.025489156	0.025489156
+8	10000	1	10134.412287	0.013441229	0.013441229
+8	10000	2	10028.930063	0.002893006	0.002893006
+8	10000	3	9881.208089	-0.011879191	0.011879191
+8	10000	4	10110.735920	0.011073592	0.011073592
+8	10000	5	9892.384085	-0.010761591	0.010761591
+8	10000	6	10098.948862	0.009894886	0.009894886
+8	10000	7	9738.628768	-0.026137123	0.026137123
+8	10000	8	9994.364457	-0.000563554	0.000563554
+8	10000	9	10170.185440	0.017018544	0.017018544
+8	10000	10	10040.517058	0.004051706	0.004051706
+8	10000	11	9994.364457	-0.000563554	0.000563554
+8	10000	12	9903.590659	-0.009640934	0.009640934
+8	10000	13	10052.136924	0.005213692	0.005213692
+8	10000	14	9760.243594	-0.023975641	0.023975641
+8	10000	15	9814.785012	-0.018521499	0.018521499
+8	10000	16	9937.395527	-0.006260447	0.006260447
+8	10000	17	10005.853945	0.000585395	0.000585395
+8	10000	18	9948.726102	-0.005127390	0.005127390
+8	10000	19	9903.590659	-0.009640934	0.009640934
+8	10000	20	10052.136924	0.005213692	0.005213692
+8	10000	21	10017.375753	0.001737575	0.001737575
+8	10000	22	10028.930063	0.002893006	0.002893006
+8	10000	23	9982.907107	-0.001709289	0.001709289
+8	50000	0	50408.969170	0.008179383	0.008179383
+8	50000	1	49668.336884	-0.006633262	0.006633262
+8	50000	2	50692.030180	0.013840604	0.013840604
+8	50000	3	49088.277360	-0.018234453	0.018234453
+8	50000	4	50384.302927	0.007686059	0.007686059
+8	50000	5	49036.761417	-0.019264772	0.019264772
+8	50000	6	50522.479497	0.010449590	0.010449590
+8	50000	7	50763.162684	0.015263254	0.015263254
+8	50000	8	49296.106988	-0.014077860	0.014077860
+8	50000	9	50358.575100	0.007171502	0.007171502
+8	50000	10	51453.084189	0.029061684	0.029061684
+8	50000	11	49456.256018	-0.010874880	0.010874880
+8	50000	12	49808.017293	-0.003839654	0.003839654
+8	50000	13	48777.222091	-0.024455558	0.024455558
+8	50000	14	48664.539638	-0.026709207	0.026709207
+8	50000	15	49539.185464	-0.009216291	0.009216291
+8	50000	16	49157.072434	-0.016858551	0.016858551
+8	50000	17	50303.946579	0.006078932	0.006078932
+8	50000	18	50632.624429	0.012652489	0.012652489
+8	50000	19	49301.147724	-0.013977046	0.013977046
+8	50000	20	50965.932614	0.019318652	0.019318652
+8	50000	21	48982.142652	-0.020357147	0.020357147
+8	50000	22	49718.730649	-0.005625387	0.005625387
+8	50000	23	50000.926934	0.000018539	0.000018539
+9	100	0	99.191405	-0.008085948	0.008085948
+9	100	1	100.216046	0.002160456	0.002160456
+9	100	2	100.216046	0.002160456	0.002160456
+9	100	3	100.216046	0.002160456	0.002160456
+9	100	4	99.191405	-0.008085948	0.008085948
+9	100	5	101.240942	0.012409424	0.012409424
+9	100	6	98.167021	-0.018329790	0.018329790
+9	100	7	101.240942	0.012409424	0.012409424
+9	100	8	98.167021	-0.018329790	0.018329790
+9	100	9	100.216046	0.002160456	0.002160456
+9	100	10	101.240942	0.012409424	0.012409424
+9	100	11	100.216046	0.002160456	0.002160456
+9	100	12	100.216046	0.002160456	0.002160456
+9	100	13	100.216046	0.002160456	0.002160456
+9	100	14	100.216046	0.002160456	0.002160456
+9	100	15	100.216046	0.002160456	0.002160456
+9	100	16	101.240942	0.012409424	0.012409424
+9	100	17	98.167021	-0.018329790	0.018329790
+9	100	18	100.216046	0.002160456	0.002160456
+9	100	19	100.216046	0.002160456	0.002160456
+9	100	20	100.216046	0.002160456	0.002160456
+9	100	21	100.216046	0.002160456	0.002160456
+9	100	22	100.216046	0.002160456	0.002160456
+9	100	23	101.240942	0.012409424	0.012409424
+9	500	0	500.353431	0.000706863	0.000706863
+9	500	1	499.223656	-0.001552688	0.001552688
+9	500	2	496.965040	-0.006069920	0.006069920
+9	500	3	502.613917	0.005227834	0.005227834
+9	500	4	509.402869	0.018805738	0.018805738
+9	500	5	508.270595	0.016541190	0.016541190
+9	500	6	502.613917	0.005227834	0.005227834
+9	500	7	499.223656	-0.001552688	0.001552688
+9	500	8	502.613917	0.005227834	0.005227834
+9	500	9	506.006986	0.012013973	0.012013973
+9	500	10	511.668356	0.023336711	0.023336711
+9	500	11	501.483518	0.002967036	0.002967036
+9	500	12	496.965040	-0.006069920	0.006069920
+9	500	13	500.353431	0.000706863	0.000706863
+9	500	14	503.744628	0.007489256	0.007489256
+9	500	15	491.323943	-0.017352114	0.017352114
+9	500	16	492.451541	-0.015096918	0.015096918
+9	500	17	492.451541	-0.015096918	0.015096918
+9	500	18	507.138634	0.014277269	0.014277269
+9	500	19	504.875651	0.009751302	0.009751302
+9	500	20	496.965040	-0.006069920	0.006069920
+9	500	21	500.353431	0.000706863	0.000706863
+9	500	22	507.138634	0.014277269	0.014277269
+9	500	23	500.353431	0.000706863	0.000706863
+9	1000	0	1008.579679	0.008579679	0.008579679
+9	1000	1	995.807607	-0.004192393	0.004192393
+9	1000	2	984.346695	-0.015653305	0.015653305
+9	1000	3	1002.188665	0.002188665	0.002188665
+9	1000	4	990.709909	-0.009290091	0.009290091
+9	1000	5	1012.419079	0.012419079	0.012419079
+9	1000	6	986.890795	-0.013109205	0.013109205
+9	1000	7	1007.300678	0.007300678	0.007300678
+9	1000	8	1004.743874	0.004743874	0.004743874
+9	1000	9	1023.958921	0.023958921	0.023958921
+9	1000	10	1021.391701	0.021391701	0.021391701
+9	1000	11	1021.391701	0.021391701	0.021391701
+9	1000	12	980.533506	-0.019466494	0.019466494
+9	1000	13	1012.419079	0.012419079	0.012419079
+9	1000	14	1009.859079	0.009859079	0.009859079
+9	1000	15	977.993351	-0.022006649	0.022006649
+9	1000	16	1003.466070	0.003466070	0.003466070
+9	1000	17	1000.911658	0.000911658	0.000911658
+9	1000	18	989.436475	-0.010563525	0.010563525
+9	1000	19	1004.743874	0.004743874	0.004743874
+9	1000	20	1000.911658	0.000911658	0.000911658
+9	1000	21	999.635049	-0.000364951	0.000364951
+9	1000	22	1008.579679	0.008579679	0.008579679
+9	1000	23	1011.138879	0.011138879	0.011138879
+9	5000	0	5001.399453	0.000279891	0.000279891
+9	5000	1	4974.363051	-0.005127390	0.005127390
+9	5000	2	5045.717821	0.009143564	0.009143564
+9	5000	3	5069.781675	0.013956335	0.013956335
+9	5000	4	4950.851711	-0.009829658	0.009829658
+9	5000	5	4944.158899	-0.011168220	0.011168220
+9	5000	6	4954.202223	-0.009159555	0.009159555
+9	5000	7	5032.030256	0.006406051	0.006406051
+9	5000	8	5069.781675	0.013956335	0.013956335
+9	5000	9	4977.732858	-0.004453428	0.004453428
+9	5000	10	5038.868321	0.007773664	0.007773664
+9	5000	11	5090.520960	0.018104192	0.018104192
+9	5000	12	4970.996014	-0.005800797	0.005800797
+9	5000	13	4947.503938	-0.010499212	0.010499212
+9	5000	14	5042.291639	0.008458328	0.008458328
+9	5000	15	5021.794515	0.004358903	0.004358903
+9	5000	16	4900.920170	-0.019815966	0.019815966
+9	5000	17	4894.308385	-0.021138323	0.021138323
+9	5000	18	4947.503938	-0.010499212	0.010499212
+9	5000	19	5038.868321	0.007773664	0.007773664
+9	5000	20	5188.717444	0.037743489	0.037743489
+9	5000	21	4950.851711	-0.009829658	0.009829658
+9	5000	22	4954.202223	-0.009159555	0.009159555
+9	5000	23	4967.631743	-0.006473651	0.006473651
+9	10000	0	10075.476018	0.007547602	0.007547602
+9	10000	1	10005.853945	0.000585395	0.000585395
+9	10000	2	10146.301990	0.014630199	0.014630199
+9	10000	3	10182.179592	0.018217959	0.018217959
+9	10000	4	9803.818473	-0.019618153	0.019618153
+9	10000	5	10017.375753	0.001737575	0.001737575
+9	10000	6	10170.185440	0.017018544	0.017018544
+9	10000	7	10279.418580	0.027941858	0.027941858
+9	10000	8	9847.861908	-0.015213809	0.015213809
+9	10000	9	10017.375753	0.001737575	0.001737575
+9	10000	10	10040.517058	0.004051706	0.004051706
+9	10000	11	10075.476018	0.007547602	0.007547602
+9	10000	12	10194.208969	0.019420897	0.019420897
+9	10000	13	9858.947165	-0.014105284	0.014105284
+9	10000	14	9760.243594	-0.023975641	0.023975641
+9	10000	15	9926.096210	-0.007390379	0.007390379
+9	10000	16	9926.096210	-0.007390379	0.007390379
+9	10000	17	10052.136924	0.005213692	0.005213692
+9	10000	18	9914.827977	-0.008517202	0.008517202
+9	10000	19	9982.907107	-0.001709289	0.001709289
+9	10000	20	10353.893359	0.035389336	0.035389336
+9	10000	21	10040.517058	0.004051706	0.004051706
+9	10000	22	10218.374231	0.021837423	0.021837423
+9	10000	23	9771.093931	-0.022890607	0.022890607
+9	50000	0	49701.364717	-0.005972706	0.005972706
+9	50000	1	51071.235187	0.021424704	0.021424704
+9	50000	2	49205.277718	-0.015894446	0.015894446
+9	50000	3	49630.972036	-0.007380559	0.007380559
+9	50000	4	50670.441406	0.013408828	0.013408828
+9	50000	5	48729.633961	-0.025407321	0.025407321
+9	50000	6	49130.990442	-0.017380191	0.017380191
+9	50000	7	49720.395573	-0.005592089	0.005592089
+9	50000	8	50034.545541	0.000690911	0.000690911
+9	50000	9	50297.547522	0.005950950	0.005950950
+9	50000	10	48701.564547	-0.025968709	0.025968709
+9	50000	11	49330.407649	-0.013391847	0.013391847
+9	50000	12	48806.207617	-0.023875848	0.023875848
+9	50000	13	50805.029150	0.016100583	0.016100583
+9	50000	14	49936.826142	-0.001263477	0.001263477
+9	50000	15	51869.549762	0.037390995	0.037390995
+9	50000	16	51027.497137	0.020549943	0.020549943
+9	50000	17	50147.797507	0.002955950	0.002955950
+9	50000	18	50341.345114	0.006826902	0.006826902
+9	50000	19	49376.272270	-0.012474555	0.012474555
+9	50000	20	49877.529688	-0.002449406	0.002449406
+9	50000	21	49600.476435	-0.007990471	0.007990471
+9	50000	22	51019.429550	0.020388591	0.020388591
+9	50000	23	49825.156869	-0.003496863	0.003496863
+10	100	0	99.191405	-0.008085948	0.008085948
+10	100	1	99.191405	-0.008085948	0.008085948
+10	100	2	100.216046	0.002160456	0.002160456
+10	100	3	100.216046	0.002160456	0.002160456
+10	100	4	99.191405	-0.008085948	0.008085948
+10	100	5	101.240942	0.012409424	0.012409424
+10	100	6	101.240942	0.012409424	0.012409424
+10	100	7	100.216046	0.002160456	0.002160456
+10	100	8	100.216046	0.002160456	0.002160456
+10	100	9	100.216046	0.002160456	0.002160456
+10	100	10	100.216046	0.002160456	0.002160456
+10	100	11	100.216046	0.002160456	0.002160456
+10	100	12	100.216046	0.002160456	0.002160456
+10	100	13	100.216046	0.002160456	0.002160456
+10	100	14	100.216046	0.002160456	0.002160456
+10	100	15	101.240942	0.012409424	0.012409424
+10	100	16	100.216046	0.002160456	0.002160456
+10	100	17	100.216046	0.002160456	0.002160456
+10	100	18	100.216046	0.002160456	0.002160456
+10	100	19	98.167021	-0.018329790	0.018329790
+10	100	20	100.216046	0.002160456	0.002160456
+10	100	21	100.216046	0.002160456	0.002160456
+10	100	22	98.167021	-0.018329790	0.018329790
+10	100	23	101.240942	0.012409424	0.012409424
+10	500	0	496.965040	-0.006069920	0.006069920
+10	500	1	487.943010	-0.024113980	0.024113980
+10	500	2	501.483518	0.002967036	0.002967036
+10	500	3	493.579450	-0.012841101	0.012841101
+10	500	4	492.451541	-0.015096918	0.015096918
+10	500	5	503.744628	0.007489256	0.007489256
+10	500	6	496.965040	-0.006069920	0.006069920
+10	500	7	506.006986	0.012013973	0.012013973
+10	500	8	502.613917	0.005227834	0.005227834
+10	500	9	501.483518	0.002967036	0.002967036
+10	500	10	495.836199	-0.008327602	0.008327602
+10	500	11	508.270595	0.016541190	0.016541190
+10	500	12	508.270595	0.016541190	0.016541190
+10	500	13	506.006986	0.012013973	0.012013973
+10	500	14	493.579450	-0.012841101	0.012841101
+10	500	15	507.138634	0.014277269	0.014277269
+10	500	16	501.483518	0.002967036	0.002967036
+10	500	17	503.744628	0.007489256	0.007489256
+10	500	18	494.707669	-0.010584662	0.010584662
+10	500	19	498.094192	-0.003811615	0.003811615
+10	500	20	498.094192	-0.003811615	0.003811615
+10	500	21	501.483518	0.002967036	0.002967036
+10	500	22	508.270595	0.016541190	0.016541190
+10	500	23	507.138634	0.014277269	0.014277269
+10	1000	0	998.358838	-0.001641162	0.001641162
+10	1000	1	989.436475	-0.010563525	0.010563525
+10	1000	2	988.163437	-0.011836563	0.011836563
+10	1000	3	997.083024	-0.002916976	0.002916976
+10	1000	4	995.807607	-0.004192393	0.004192393
+10	1000	5	1009.859079	0.009859079	0.009859079
+10	1000	6	1014.980680	0.014980680	0.014980680
+10	1000	7	1016.262082	0.016262082	0.016262082
+10	1000	8	990.709909	-0.009290091	0.009290091
+10	1000	9	989.436475	-0.010563525	0.010563525
+10	1000	10	998.358838	-0.001641162	0.001641162
+10	1000	11	998.358838	-0.001641162	0.001641162
+10	1000	12	993.257965	-0.006742035	0.006742035
+10	1000	13	999.635049	-0.000364951	0.000364951
+10	1000	14	998.358838	-0.001641162	0.001641162
+10	1000	15	980.533506	-0.019466494	0.019466494
+10	1000	16	1003.466070	0.003466070	0.003466070
+10	1000	17	995.807607	-0.004192393	0.004192393
+10	1000	18	998.358838	-0.001641162	0.001641162
+10	1000	19	1013.699680	0.013699680	0.013699680
+10	1000	20	1021.391701	0.021391701	0.021391701
+10	1000	21	1003.466070	0.003466070	0.003466070
+10	1000	22	1004.743874	0.004743874	0.004743874
+10	1000	23	1012.419079	0.012419079	0.012419079
+10	5000	0	5107.884276	0.021576855	0.021576855
+10	5000	1	5111.365789	0.022273158	0.022273158
+10	5000	2	4861.408610	-0.027718278	0.027718278
+10	5000	3	5038.868321	0.007773664	0.007773664
+10	5000	4	4897.612944	-0.020477411	0.020477411
+10	5000	5	5025.203588	0.005040718	0.005040718
+10	5000	6	4977.732858	-0.004453428	0.004453428
+10	5000	7	5059.451279	0.011890256	0.011890256
+10	5000	8	5128.817882	0.025763576	0.025763576
+10	5000	9	5021.794515	0.004358903	0.004358903
+10	5000	10	5008.186530	0.001637306	0.001637306
+10	5000	11	4881.116747	-0.023776651	0.023776651
+10	5000	12	4917.496478	-0.016500704	0.016500704
+10	5000	13	5156.896826	0.031379365	0.031379365
+10	5000	14	4998.010127	-0.000397975	0.000397975
+10	5000	15	4967.631743	-0.006473651	0.006473651
+10	5000	16	4924.145830	-0.015170834	0.015170834
+10	5000	17	4960.911479	-0.007817704	0.007817704
+10	5000	18	5100.930114	0.020186023	0.020186023
+10	5000	19	4934.140142	-0.013171972	0.013171972
+10	5000	20	5021.794515	0.004358903	0.004358903
+10	5000	21	5021.794515	0.004358903	0.004358903
+10	5000	22	4974.363051	-0.005127390	0.005127390
+10	5000	23	5018.388278	0.003677656	0.003677656
+10	10000	0	9836.806570	-0.016319343	0.016319343
+10	10000	1	9803.818473	-0.019618153	0.019618153
+10	10000	2	10194.208969	0.019420897	0.019420897
+10	10000	3	9803.818473	-0.019618153	0.019618153
+10	10000	4	9994.364457	-0.000563554	0.000563554
+10	10000	5	9903.590659	-0.009640934	0.009640934
+10	10000	6	10028.930063	0.002893006	0.002893006
+10	10000	7	10075.476018	0.007547602	0.007547602
+10	10000	8	9685.085522	-0.031491448	0.031491448
+10	10000	9	10087.195626	0.008719563	0.008719563
+10	10000	10	9926.096210	-0.007390379	0.007390379
+10	10000	11	9982.907107	-0.001709289	0.001709289
+10	10000	12	10122.556996	0.012255700	0.012255700
+10	10000	13	9836.806570	-0.016319343	0.016319343
+10	10000	14	10063.789848	0.006378985	0.006378985
+10	10000	15	9937.395527	-0.006260447	0.006260447
+10	10000	16	10267.136712	0.026713671	0.026713671
+10	10000	17	10194.208969	0.019420897	0.019420897
+10	10000	18	9881.208089	-0.011879191	0.011879191
+10	10000	19	9881.208089	-0.011879191	0.011879191
+10	10000	20	10005.853945	0.000585395	0.000585395
+10	10000	21	10005.853945	0.000585395	0.000585395
+10	10000	22	9738.628768	-0.026137123	0.026137123
+10	10000	23	10087.195626	0.008719563	0.008719563
+10	50000	0	49697.473695	-0.006050526	0.006050526
+10	50000	1	50202.991565	0.004059831	0.004059831
+10	50000	2	50133.674400	0.002673488	0.002673488
+10	50000	3	51157.984300	0.023159686	0.023159686
+10	50000	4	49646.048938	-0.007079021	0.007079021
+10	50000	5	50284.767843	0.005695357	0.005695357
+10	50000	6	51157.127745	0.023142555	0.023142555
+10	50000	7	50047.288368	0.000945767	0.000945767
+10	50000	8	50278.930827	0.005578617	0.005578617
+10	50000	9	49889.990955	-0.002200181	0.002200181
+10	50000	10	49759.500331	-0.004809993	0.004809993
+10	50000	11	50005.404912	0.000108098	0.000108098
+10	50000	12	50450.077244	0.009001545	0.009001545
+10	50000	13	50570.370400	0.011407408	0.011407408
+10	50000	14	49365.005223	-0.012699896	0.012699896
+10	50000	15	50431.532535	0.008630651	0.008630651
+10	50000	16	50518.421834	0.010368437	0.010368437
+10	50000	17	49667.173243	-0.006656535	0.006656535
+10	50000	18	49699.872217	-0.006002556	0.006002556
+10	50000	19	50020.987706	0.000419754	0.000419754
+10	50000	20	50071.853529	0.001437071	0.001437071
+10	50000	21	50128.460311	0.002569206	0.002569206
+10	50000	22	48521.811987	-0.029563760	0.029563760
+10	50000	23	49698.336583	-0.006033268	0.006033268
+11	100	0	100.216046	0.002160456	0.002160456
+11	100	1	100.216046	0.002160456	0.002160456
+11	100	2	97.142893	-0.028571070	0.028571070
+11	100	3	99.191405	-0.008085948	0.008085948
+11	100	4	100.216046	0.002160456	0.002160456
+11	100	5	100.216046	0.002160456	0.002160456
+11	100	6	99.191405	-0.008085948	0.008085948
+11	100	7	101.240942	0.012409424	0.012409424
+11	100	8	99.191405	-0.008085948	0.008085948
+11	100	9	98.167021	-0.018329790	0.018329790
+11	100	10	100.216046	0.002160456	0.002160456
+11	100	11	99.191405	-0.008085948	0.008085948
+11	100	12	101.240942	0.012409424	0.012409424
+11	100	13	100.216046	0.002160456	0.002160456
+11	100	14	99.191405	-0.008085948	0.008085948
+11	100	15	98.167021	-0.018329790	0.018329790
+11	100	16	100.216046	0.002160456	0.002160456
+11	100	17	101.240942	0.012409424	0.012409424
+11	100	18	100.216046	0.002160456	0.002160456
+11	100	19	101.240942	0.012409424	0.012409424
+11	100	20	101.240942	0.012409424	0.012409424
+11	100	21	101.240942	0.012409424	0.012409424
+11	100	22	100.216046	0.002160456	0.002160456
+11	100	23	101.240942	0.012409424	0.012409424
+11	500	0	499.223656	-0.001552688	0.001552688
+11	500	1	512.801569	0.025603138	0.025603138
+11	500	2	499.223656	-0.001552688	0.001552688
+11	500	3	502.613917	0.005227834	0.005227834
+11	500	4	502.613917	0.005227834	0.005227834
+11	500	5	500.353431	0.000706863	0.000706863
+11	500	6	502.613917	0.005227834	0.005227834
+11	500	7	492.451541	-0.015096918	0.015096918
+11	500	8	503.744628	0.007489256	0.007489256
+11	500	9	499.223656	-0.001552688	0.001552688
+11	500	10	508.270595	0.016541190	0.016541190
+11	500	11	512.801569	0.025603138	0.025603138
+11	500	12	506.006986	0.012013973	0.012013973
+11	500	13	499.223656	-0.001552688	0.001552688
+11	500	14	500.353431	0.000706863	0.000706863
+11	500	15	502.613917	0.005227834	0.005227834
+11	500	16	503.744628	0.007489256	0.007489256
+11	500	17	498.094192	-0.003811615	0.003811615
+11	500	18	496.965040	-0.006069920	0.006069920
+11	500	19	500.353431	0.000706863	0.000706863
+11	500	20	496.965040	-0.006069920	0.006069920
+11	500	21	511.668356	0.023336711	0.023336711
+11	500	22	495.836199	-0.008327602	0.008327602
+11	500	23	503.744628	0.007489256	0.007489256
+11	1000	0	1012.419079	0.012419079	0.012419079
+11	1000	1	1003.466070	0.003466070	0.003466070
+11	1000	2	1017.543884	0.017543884	0.017543884
+11	1000	3	1006.022077	0.006022077	0.006022077
+11	1000	4	1002.188665	0.002188665	0.002188665
+11	1000	5	989.436475	-0.010563525	0.010563525
+11	1000	6	1013.699680	0.013699680	0.013699680
+11	1000	7	1013.699680	0.013699680	0.013699680
+11	1000	8	1011.138879	0.011138879	0.011138879
+11	1000	9	1006.022077	0.006022077	0.006022077
+11	1000	10	1008.579679	0.008579679	0.008579679
+11	1000	11	1007.300678	0.007300678	0.007300678
+11	1000	12	1000.911658	0.000911658	0.000911658
+11	1000	13	1013.699680	0.013699680	0.013699680
+11	1000	14	988.163437	-0.011836563	0.011836563
+11	1000	15	1002.188665	0.002188665	0.002188665
+11	1000	16	972.917762	-0.027082238	0.027082238
+11	1000	17	1006.022077	0.006022077	0.006022077
+11	1000	18	967.848454	-0.032151546	0.032151546
+11	1000	19	984.346695	-0.015653305	0.015653305
+11	1000	20	989.436475	-0.010563525	0.010563525
+11	1000	21	991.983739	-0.008016261	0.008016261
+11	1000	22	989.436475	-0.010563525	0.010563525
+11	1000	23	990.709909	-0.009290091	0.009290091
+11	5000	0	4994.623603	-0.001075279	0.001075279
+11	5000	1	5018.388278	0.003677656	0.003677656
+11	5000	2	4904.230070	-0.019153986	0.019153986
+11	5000	3	4994.623603	-0.001075279	0.001075279
+11	5000	4	4987.858944	-0.002428211	0.002428211
+11	5000	5	5100.930114	0.020186023	0.020186023
+11	5000	6	5093.987740	0.018797548	0.018797548
+11	5000	7	4998.010127	-0.000397975	0.000397975
+11	5000	8	4871.250825	-0.025749835	0.025749835
+11	5000	9	5028.615500	0.005723100	0.005723100
+11	5000	10	4974.363051	-0.005127390	0.005127390
+11	5000	11	5001.399453	0.000279891	0.000279891
+11	5000	12	4998.010127	-0.000397975	0.000397975
+11	5000	13	4940.816590	-0.011836682	0.011836682
+11	5000	14	4940.816590	-0.011836682	0.011836682
+11	5000	15	5011.584290	0.002316858	0.002316858
+11	5000	16	5014.984871	0.002996974	0.002996974
+11	5000	17	4967.631743	-0.006473651	0.006473651
+11	5000	18	4987.858944	-0.002428211	0.002428211
+11	5000	19	4974.363051	-0.005127390	0.005127390
+11	5000	20	5035.447861	0.007089572	0.007089572
+11	5000	21	5038.868321	0.007773664	0.007773664
+11	5000	22	5011.584290	0.002316858	0.002316858
+11	5000	23	5014.984871	0.002996974	0.002996974
+11	10000	0	10316.486706	0.031648671	0.031648671
+11	10000	1	10218.374231	0.021837423	0.021837423
+11	10000	2	9960.088106	-0.003991189	0.003991189
+11	10000	3	9781.973088	-0.021802691	0.021802691
+11	10000	4	10017.375753	0.001737575	0.001737575
+11	10000	5	10122.556996	0.012255700	0.012255700
+11	10000	6	9580.054126	-0.041994587	0.041994587
+11	10000	7	9892.384085	-0.010761591	0.010761591
+11	10000	8	9948.726102	-0.005127390	0.005127390
+11	10000	9	9892.384085	-0.010761591	0.010761591
+11	10000	10	9695.738323	-0.030426168	0.030426168
+11	10000	11	10291.737386	0.029173739	0.029173739
+11	10000	12	10110.735920	0.011073592	0.011073592
+11	10000	13	9674.460354	-0.032553965	0.032553965
+11	10000	14	9814.785012	-0.018521499	0.018521499
+11	10000	15	9994.364457	-0.000563554	0.000563554
+11	10000	16	9926.096210	-0.007390379	0.007390379
+11	10000	17	9914.827977	-0.008517202	0.008517202
+11	10000	18	10242.682908	0.024268291	0.024268291
+11	10000	19	10075.476018	0.007547602	0.007547602
+11	10000	20	9771.093931	-0.022890607	0.022890607
+11	10000	21	9971.481716	-0.002851828	0.002851828
+11	10000	22	9994.364457	-0.000563554	0.000563554
+11	10000	23	10146.301990	0.014630199	0.014630199
+11	50000	0	49940.742939	-0.001185141	0.001185141
+11	50000	1	49132.307205	-0.017353856	0.017353856
+11	50000	2	50197.251380	0.003945028	0.003945028
+11	50000	3	50924.694486	0.018493890	0.018493890
+11	50000	4	49053.666701	-0.018926666	0.018926666
+11	50000	5	49577.650242	-0.008446995	0.008446995
+11	50000	6	49268.344959	-0.014633101	0.014633101
+11	50000	7	51098.033262	0.021960665	0.021960665
+11	50000	8	48435.479821	-0.031290404	0.031290404
+11	50000	9	49634.527948	-0.007309441	0.007309441
+11	50000	10	50340.509294	0.006810186	0.006810186
+11	50000	11	50361.309960	0.007226199	0.007226199
+11	50000	12	50173.266903	0.003465338	0.003465338
+11	50000	13	50647.877740	0.012957555	0.012957555
+11	50000	14	50197.916392	0.003958328	0.003958328
+11	50000	15	50960.358205	0.019207164	0.019207164
+11	50000	16	49242.140199	-0.015157196	0.015157196
+11	50000	17	49894.799175	-0.002104017	0.002104017
+11	50000	18	49396.624392	-0.012067512	0.012067512
+11	50000	19	49312.764507	-0.013744710	0.013744710
+11	50000	20	50284.169889	0.005683398	0.005683398
+11	50000	21	49812.412276	-0.003751754	0.003751754
+11	50000	22	50104.343815	0.002086876	0.002086876
+11	50000	23	50564.524335	0.011290487	0.011290487
+12	100	0	101.240942	0.012409424	0.012409424
+12	100	1	100.216046	0.002160456	0.002160456
+12	100	2	98.167021	-0.018329790	0.018329790
+12	100	3	101.240942	0.012409424	0.012409424
+12	100	4	100.216046	0.002160456	0.002160456
+12	100	5	99.191405	-0.008085948	0.008085948
+12	100	6	101.240942	0.012409424	0.012409424
+12	100	7	101.240942	0.012409424	0.012409424
+12	100	8	100.216046	0.002160456	0.002160456
+12	100	9	99.191405	-0.008085948	0.008085948
+12	100	10	101.240942	0.012409424	0.012409424
+12	100	11	100.216046	0.002160456	0.002160456
+12	100	12	101.240942	0.012409424	0.012409424
+12	100	13	99.191405	-0.008085948	0.008085948
+12	100	14	99.191405	-0.008085948	0.008085948
+12	100	15	100.216046	0.002160456	0.002160456
+12	100	16	98.167021	-0.018329790	0.018329790
+12	100	17	100.216046	0.002160456	0.002160456
+12	100	18	100.216046	0.002160456	0.002160456
+12	100	19	100.216046	0.002160456	0.002160456
+12	100	20	100.216046	0.002160456	0.002160456
+12	100	21	100.216046	0.002160456	0.002160456
+12	100	22	101.240942	0.012409424	0.012409424
+12	100	23	100.216046	0.002160456	0.002160456
+12	500	0	495.836199	-0.008327602	0.008327602
+12	500	1	504.875651	0.009751302	0.009751302
+12	500	2	495.836199	-0.008327602	0.008327602
+12	500	3	484.564865	-0.030870269	0.030870269
+12	500	4	495.836199	-0.008327602	0.008327602
+12	500	5	494.707669	-0.010584662	0.010584662
+12	500	6	491.323943	-0.017352114	0.017352114
+12	500	7	496.965040	-0.006069920	0.006069920
+12	500	8	495.836199	-0.008327602	0.008327602
+12	500	9	495.836199	-0.008327602	0.008327602
+12	500	10	504.875651	0.009751302	0.009751302
+12	500	11	507.138634	0.014277269	0.014277269
+12	500	12	513.935096	0.027870192	0.027870192
+12	500	13	493.579450	-0.012841101	0.012841101
+12	500	14	494.707669	-0.010584662	0.010584662
+12	500	15	502.613917	0.005227834	0.005227834
+12	500	16	506.006986	0.012013973	0.012013973
+12	500	17	507.138634	0.014277269	0.014277269
+12	500	18	493.579450	-0.012841101	0.012841101
+12	500	19	499.223656	-0.001552688	0.001552688
+12	500	20	494.707669	-0.010584662	0.010584662
+12	500	21	492.451541	-0.015096918	0.015096918
+12	500	22	493.579450	-0.012841101	0.012841101
+12	500	23	503.744628	0.007489256	0.007489256
+12	1000	0	998.358838	-0.001641162	0.001641162
+12	1000	1	1013.699680	0.013699680	0.013699680
+12	1000	2	977.993351	-0.022006649	0.022006649
+12	1000	3	1017.543884	0.017543884	0.017543884
+12	1000	4	1003.466070	0.003466070	0.003466070
+12	1000	5	979.263232	-0.020736768	0.020736768
+12	1000	6	1004.743874	0.004743874	0.004743874
+12	1000	7	1014.980680	0.014980680	0.014980680
+12	1000	8	1003.466070	0.003466070	0.003466070
+12	1000	9	993.257965	-0.006742035	0.006742035
+12	1000	10	1008.579679	0.008579679	0.008579679
+12	1000	11	986.890795	-0.013109205	0.013109205
+12	1000	12	986.890795	-0.013109205	0.013109205
+12	1000	13	1012.419079	0.012419079	0.012419079
+12	1000	14	1000.911658	0.000911658	0.000911658
+12	1000	15	989.436475	-0.010563525	0.010563525
+12	1000	16	1007.300678	0.007300678	0.007300678
+12	1000	17	1007.300678	0.007300678	0.007300678
+12	1000	18	993.257965	-0.006742035	0.006742035
+12	1000	19	999.635049	-0.000364951	0.000364951
+12	1000	20	999.635049	-0.000364951	0.000364951
+12	1000	21	986.890795	-0.013109205	0.013109205
+12	1000	22	1000.911658	0.000911658	0.000911658
+12	1000	23	995.807607	-0.004192393	0.004192393
+12	5000	0	4900.920170	-0.019815966	0.019815966
+12	5000	1	4937.477005	-0.012504599	0.012504599
+12	5000	2	4984.480800	-0.003103840	0.003103840
+12	5000	3	5107.884276	0.021576855	0.021576855
+12	5000	4	5104.405719	0.020881144	0.020881144
+12	5000	5	4994.623603	-0.001075279	0.001075279
+12	5000	6	5056.013595	0.011202719	0.011202719
+12	5000	7	5032.030256	0.006406051	0.006406051
+12	5000	8	4927.474558	-0.014505088	0.014505088
+12	5000	9	5025.203588	0.005040718	0.005040718
+12	5000	10	4970.996014	-0.005800797	0.005800797
+12	5000	11	4954.202223	-0.009159555	0.009159555
+12	5000	12	4994.623603	-0.001075279	0.001075279
+12	5000	13	4934.140142	-0.013171972	0.013171972
+12	5000	14	5153.376413	0.030675283	0.030675283
+12	5000	15	4910.857903	-0.017828419	0.017828419
+12	5000	16	5028.615500	0.005723100	0.005723100
+12	5000	17	4924.145830	-0.015170834	0.015170834
+12	5000	18	5087.057112	0.017411422	0.017411422
+12	5000	19	4967.631743	-0.006473651	0.006473651
+12	5000	20	4851.589988	-0.029682002	0.029682002
+12	5000	21	5038.868321	0.007773664	0.007773664
+12	5000	22	5087.057112	0.017411422	0.017411422
+12	5000	23	4977.732858	-0.004453428	0.004453428
+12	10000	0	10417.007088	0.041700709	0.041700709
+12	10000	1	10017.375753	0.001737575	0.001737575
+12	10000	2	9948.726102	-0.005127390	0.005127390
+12	10000	3	10218.374231	0.021837423	0.021837423
+12	10000	4	10098.948862	0.009894886	0.009894886
+12	10000	5	10005.853945	0.000585395	0.000585395
+12	10000	6	9903.590659	-0.009640934	0.009640934
+12	10000	7	10291.737386	0.029173739	0.029173739
+12	10000	8	9982.907107	-0.001709289	0.001709289
+12	10000	9	10242.682908	0.024268291	0.024268291
+12	10000	10	9738.628768	-0.026137123	0.026137123
+12	10000	11	10110.735920	0.011073592	0.011073592
+12	10000	12	10075.476018	0.007547602	0.007547602
+12	10000	13	9926.096210	-0.007390379	0.007390379
+12	10000	14	10182.179592	0.018217959	0.018217959
+12	10000	15	10063.789848	0.006378985	0.006378985
+12	10000	16	10087.195626	0.008719563	0.008719563
+12	10000	17	9569.697610	-0.043030239	0.043030239
+12	10000	18	9847.861908	-0.015213809	0.015213809
+12	10000	19	10028.930063	0.002893006	0.002893006
+12	10000	20	10063.789848	0.006378985	0.006378985
+12	10000	21	9706.418903	-0.029358110	0.029358110
+12	10000	22	10134.412287	0.013441229	0.013441229
+12	10000	23	9836.806570	-0.016319343	0.016319343
+12	50000	0	49590.871660	-0.008182567	0.008182567
+12	50000	1	50150.049568	0.003000991	0.003000991
+12	50000	2	48958.191138	-0.020836177	0.020836177
+12	50000	3	50621.095940	0.012421919	0.012421919
+12	50000	4	49692.692529	-0.006146149	0.006146149
+12	50000	5	50419.926495	0.008398530	0.008398530
+12	50000	6	50346.313362	0.006926267	0.006926267
+12	50000	7	50113.736763	0.002274735	0.002274735
+12	50000	8	49900.709076	-0.001985818	0.001985818
+12	50000	9	50330.003183	0.006600064	0.006600064
+12	50000	10	50184.771961	0.003695439	0.003695439
+12	50000	11	50036.781126	0.000735623	0.000735623
+12	50000	12	49474.389538	-0.010512209	0.010512209
+12	50000	13	49212.465196	-0.015750696	0.015750696
+12	50000	14	49462.101052	-0.010757979	0.010757979
+12	50000	15	51790.442734	0.035808855	0.035808855
+12	50000	16	49553.965457	-0.008920691	0.008920691
+12	50000	17	49933.755884	-0.001324882	0.001324882
+12	50000	18	50266.880029	0.005337601	0.005337601
+12	50000	19	50195.486044	0.003909721	0.003909721
+12	50000	20	49080.305360	-0.018393893	0.018393893
+12	50000	21	50025.362161	0.000507243	0.000507243
+12	50000	22	48726.047062	-0.025479059	0.025479059
+12	50000	23	48994.732687	-0.020105346	0.020105346
+13	100	0	100.216046	0.002160456	0.002160456
+13	100	1	101.240942	0.012409424	0.012409424
+13	100	2	101.240942	0.012409424	0.012409424
+13	100	3	101.240942	0.012409424	0.012409424
+13	100	4	99.191405	-0.008085948	0.008085948
+13	100	5	101.240942	0.012409424	0.012409424
+13	100	6	99.191405	-0.008085948	0.008085948
+13	100	7	101.240942	0.012409424	0.012409424
+13	100	8	98.167021	-0.018329790	0.018329790
+13	100	9	100.216046	0.002160456	0.002160456
+13	100	10	99.191405	-0.008085948	0.008085948
+13	100	11	101.240942	0.012409424	0.012409424
+13	100	12	101.240942	0.012409424	0.012409424
+13	100	13	100.216046	0.002160456	0.002160456
+13	100	14	100.216046	0.002160456	0.002160456
+13	100	15	100.216046	0.002160456	0.002160456
+13	100	16	101.240942	0.012409424	0.012409424
+13	100	17	101.240942	0.012409424	0.012409424
+13	100	18	99.191405	-0.008085948	0.008085948
+13	100	19	99.191405	-0.008085948	0.008085948
+13	100	20	101.240942	0.012409424	0.012409424
+13	100	21	101.240942	0.012409424	0.012409424
+13	100	22	101.240942	0.012409424	0.012409424
+13	100	23	97.142893	-0.028571070	0.028571070
+13	500	0	501.483518	0.002967036	0.002967036
+13	500	1	489.069678	-0.021860645	0.021860645
+13	500	2	503.744628	0.007489256	0.007489256
+13	500	3	510.535456	0.021070911	0.021070911
+13	500	4	510.535456	0.021070911	0.021070911
+13	500	5	499.223656	-0.001552688	0.001552688
+13	500	6	495.836199	-0.008327602	0.008327602
+13	500	7	495.836199	-0.008327602	0.008327602
+13	500	8	501.483518	0.002967036	0.002967036
+13	500	9	491.323943	-0.017352114	0.017352114
+13	500	10	499.223656	-0.001552688	0.001552688
+13	500	11	504.875651	0.009751302	0.009751302
+13	500	12	491.323943	-0.017352114	0.017352114
+13	500	13	498.094192	-0.003811615	0.003811615
+13	500	14	487.943010	-0.024113980	0.024113980
+13	500	15	508.270595	0.016541190	0.016541190
+13	500	16	502.613917	0.005227834	0.005227834
+13	500	17	501.483518	0.002967036	0.002967036
+13	500	18	504.875651	0.009751302	0.009751302
+13	500	19	503.744628	0.007489256	0.007489256
+13	500	20	502.613917	0.005227834	0.005227834
+13	500	21	495.836199	-0.008327602	0.008327602
+13	500	22	495.836199	-0.008327602	0.008327602
+13	500	23	500.353431	0.000706863	0.000706863
+13	1000	0	999.635049	-0.000364951	0.000364951
+13	1000	1	997.083024	-0.002916976	0.002916976
+13	1000	2	994.532588	-0.005467412	0.005467412
+13	1000	3	993.257965	-0.006742035	0.006742035
+13	1000	4	1003.466070	0.003466070	0.003466070
+13	1000	5	1009.859079	0.009859079	0.009859079
+13	1000	6	1004.743874	0.004743874	0.004743874
+13	1000	7	1004.743874	0.004743874	0.004743874
+13	1000	8	1020.108694	0.020108694	0.020108694
+13	1000	9	1008.579679	0.008579679	0.008579679
+13	1000	10	986.890795	-0.013109205	0.013109205
+13	1000	11	1007.300678	0.007300678	0.007300678
+13	1000	12	1018.826088	0.018826088	0.018826088
+13	1000	13	1029.098194	0.029098194	0.029098194
+13	1000	14	990.709909	-0.009290091	0.009290091
+13	1000	15	1002.188665	0.002188665	0.002188665
+13	1000	16	997.083024	-0.002916976	0.002916976
+13	1000	17	1013.699680	0.013699680	0.013699680
+13	1000	18	998.358838	-0.001641162	0.001641162
+13	1000	19	1023.958921	0.023958921	0.023958921
+13	1000	20	1002.188665	0.002188665	0.002188665
+13	1000	21	1014.980680	0.014980680	0.014980680
+13	1000	22	981.804175	-0.018195825	0.018195825
+13	1000	23	979.263232	-0.020736768	0.020736768
+13	5000	0	5073.230939	0.014646188	0.014646188
+13	5000	1	4900.920170	-0.019815966	0.019815966
+13	5000	2	4967.631743	-0.006473651	0.006473651
+13	5000	3	4977.732858	-0.004453428	0.004453428
+13	5000	4	5011.584290	0.002316858	0.002316858
+13	5000	5	5069.781675	0.013956335	0.013956335
+13	5000	6	4930.805994	-0.013838801	0.013838801
+13	5000	7	5042.291639	0.008458328	0.008458328
+13	5000	8	5004.791585	0.000958317	0.000958317
+13	5000	9	5080.138191	0.016027638	0.016027638
+13	5000	10	5073.230939	0.014646188	0.014646188
+13	5000	11	5042.291639	0.008458328	0.008458328
+13	5000	12	5090.520960	0.018104192	0.018104192
+13	5000	13	5125.321509	0.025064302	0.025064302
+13	5000	14	4848.322337	-0.030335533	0.030335533
+13	5000	15	5008.186530	0.001637306	0.001637306
+13	5000	16	5066.335314	0.013267063	0.013267063
+13	5000	17	5114.850264	0.022970053	0.022970053
+13	5000	18	4991.239877	-0.001752025	0.001752025
+13	5000	19	5018.388278	0.003677656	0.003677656
+13	5000	20	4994.623603	-0.001075279	0.001075279
+13	5000	21	4867.967458	-0.026406508	0.026406508
+13	5000	22	5014.984871	0.002996974	0.002996974
+13	5000	23	4950.851711	-0.009829658	0.009829658
+13	10000	0	10206.273779	0.020627378	0.020627378
+13	10000	1	9803.818473	-0.019618153	0.019618153
+13	10000	2	10005.853945	0.000585395	0.000585395
+13	10000	3	10134.412287	0.013441229	0.013441229
+13	10000	4	9642.749227	-0.035725077	0.035725077
+13	10000	5	10087.195626	0.008719563	0.008719563
+13	10000	6	9695.738323	-0.030426168	0.030426168
+13	10000	7	9892.384085	-0.010761591	0.010761591
+13	10000	8	10341.386479	0.034138648	0.034138648
+13	10000	9	10028.930063	0.002893006	0.002893006
+13	10000	10	9926.096210	-0.007390379	0.007390379
+13	10000	11	9994.364457	-0.000563554	0.000563554
+13	10000	12	10170.185440	0.017018544	0.017018544
+13	10000	13	9914.827977	-0.008517202	0.008517202
+13	10000	14	9781.973088	-0.021802691	0.021802691
+13	10000	15	10087.195626	0.008719563	0.008719563
+13	10000	16	9847.861908	-0.015213809	0.015213809
+13	10000	17	10391.644778	0.039164478	0.039164478
+13	10000	18	9948.726102	-0.005127390	0.005127390
+13	10000	19	10075.476018	0.007547602	0.007547602
+13	10000	20	9971.481716	-0.002851828	0.002851828
+13	10000	21	10075.476018	0.007547602	0.007547602
+13	10000	22	9960.088106	-0.003991189	0.003991189
+13	10000	23	10063.789848	0.006378985	0.006378985
+13	50000	0	49594.767529	-0.008104649	0.008104649
+13	50000	1	50363.820776	0.007276416	0.007276416
+13	50000	2	51625.170884	0.032503418	0.032503418
+13	50000	3	48930.368236	-0.021392635	0.021392635
+13	50000	4	50929.260948	0.018585219	0.018585219
+13	50000	5	49257.797089	-0.014844058	0.014844058
+13	50000	6	48973.333931	-0.020533321	0.020533321
+13	50000	7	49501.350522	-0.009972990	0.009972990
+13	50000	8	49744.003348	-0.005119933	0.005119933
+13	50000	9	50521.217544	0.010424351	0.010424351
+13	50000	10	49600.469066	-0.007990619	0.007990619
+13	50000	11	51710.773107	0.034215462	0.034215462
+13	50000	12	49653.241390	-0.006935172	0.006935172
+13	50000	13	50011.692779	0.000233856	0.000233856
+13	50000	14	50018.657488	0.000373150	0.000373150
+13	50000	15	50376.710691	0.007534214	0.007534214
+13	50000	16	49048.674073	-0.019026519	0.019026519
+13	50000	17	49696.932361	-0.006061353	0.006061353
+13	50000	18	49686.864488	-0.006262710	0.006262710
+13	50000	19	49894.949888	-0.002101002	0.002101002
+13	50000	20	48155.165293	-0.036896694	0.036896694
+13	50000	21	50277.190030	0.005543801	0.005543801
+13	50000	22	48678.239277	-0.026435214	0.026435214
+13	50000	23	50387.332377	0.007746648	0.007746648
+14	100	0	100.216046	0.002160456	0.002160456
+14	100	1	100.216046	0.002160456	0.002160456
+14	100	2	101.240942	0.012409424	0.012409424
+14	100	3	100.216046	0.002160456	0.002160456
+14	100	4	97.142893	-0.028571070	0.028571070
+14	100	5	101.240942	0.012409424	0.012409424
+14	100	6	100.216046	0.002160456	0.002160456
+14	100	7	98.167021	-0.018329790	0.018329790
+14	100	8	98.167021	-0.018329790	0.018329790
+14	100	9	99.191405	-0.008085948	0.008085948
+14	100	10	98.167021	-0.018329790	0.018329790
+14	100	11	101.240942	0.012409424	0.012409424
+14	100	12	100.216046	0.002160456	0.002160456
+14	100	13	98.167021	-0.018329790	0.018329790
+14	100	14	100.216046	0.002160456	0.002160456
+14	100	15	100.216046	0.002160456	0.002160456
+14	100	16	100.216046	0.002160456	0.002160456
+14	100	17	101.240942	0.012409424	0.012409424
+14	100	18	99.191405	-0.008085948	0.008085948
+14	100	19	99.191405	-0.008085948	0.008085948
+14	100	20	100.216046	0.002160456	0.002160456
+14	100	21	100.216046	0.002160456	0.002160456
+14	100	22	98.167021	-0.018329790	0.018329790
+14	100	23	101.240942	0.012409424	0.012409424
+14	500	0	495.836199	-0.008327602	0.008327602
+14	500	1	490.196655	-0.019606690	0.019606690
+14	500	2	489.069678	-0.021860645	0.021860645
+14	500	3	496.965040	-0.006069920	0.006069920
+14	500	4	508.270595	0.016541190	0.016541190
+14	500	5	494.707669	-0.010584662	0.010584662
+14	500	6	496.965040	-0.006069920	0.006069920
+14	500	7	506.006986	0.012013973	0.012013973
+14	500	8	502.613917	0.005227834	0.005227834
+14	500	9	511.668356	0.023336711	0.023336711
+14	500	10	501.483518	0.002967036	0.002967036
+14	500	11	494.707669	-0.010584662	0.010584662
+14	500	12	503.744628	0.007489256	0.007489256
+14	500	13	508.270595	0.016541190	0.016541190
+14	500	14	496.965040	-0.006069920	0.006069920
+14	500	15	502.613917	0.005227834	0.005227834
+14	500	16	495.836199	-0.008327602	0.008327602
+14	500	17	494.707669	-0.010584662	0.010584662
+14	500	18	502.613917	0.005227834	0.005227834
+14	500	19	494.707669	-0.010584662	0.010584662
+14	500	20	498.094192	-0.003811615	0.003811615
+14	500	21	502.613917	0.005227834	0.005227834
+14	500	22	503.744628	0.007489256	0.007489256
+14	500	23	498.094192	-0.003811615	0.003811615
+14	1000	0	1023.958921	0.023958921	0.023958921
+14	1000	1	993.257965	-0.006742035	0.006742035
+14	1000	2	994.532588	-0.005467412	0.005467412
+14	1000	3	1020.108694	0.020108694	0.020108694
+14	1000	4	1013.699680	0.013699680	0.013699680
+14	1000	5	986.890795	-0.013109205	0.013109205
+14	1000	6	1003.466070	0.003466070	0.003466070
+14	1000	7	1007.300678	0.007300678	0.007300678
+14	1000	8	993.257965	-0.006742035	0.006742035
+14	1000	9	1004.743874	0.004743874	0.004743874
+14	1000	10	1011.138879	0.011138879	0.011138879
+14	1000	11	990.709909	-0.009290091	0.009290091
+14	1000	12	990.709909	-0.009290091	0.009290091
+14	1000	13	1002.188665	0.002188665	0.002188665
+14	1000	14	1007.300678	0.007300678	0.007300678
+14	1000	15	980.533506	-0.019466494	0.019466494
+14	1000	16	1002.188665	0.002188665	0.002188665
+14	1000	17	999.635049	-0.000364951	0.000364951
+14	1000	18	997.083024	-0.002916976	0.002916976
+14	1000	19	998.358838	-0.001641162	0.001641162
+14	1000	20	997.083024	-0.002916976	0.002916976
+14	1000	21	1003.466070	0.003466070	0.003466070
+14	1000	22	999.635049	-0.000364951	0.000364951
+14	1000	23	1006.022077	0.006022077	0.006022077
+14	5000	0	4964.270233	-0.007145953	0.007145953
+14	5000	1	5032.030256	0.006406051	0.006406051
+14	5000	2	5076.683109	0.015336622	0.015336622
+14	5000	3	4981.105439	-0.003778912	0.003778912
+14	5000	4	5014.984871	0.002996974	0.002996974
+14	5000	5	5025.203588	0.005040718	0.005040718
+14	5000	6	4981.105439	-0.003778912	0.003778912
+14	5000	7	5087.057112	0.017411422	0.017411422
+14	5000	8	5093.987740	0.018797548	0.018797548
+14	5000	9	4991.239877	-0.001752025	0.001752025
+14	5000	10	5076.683109	0.015336622	0.015336622
+14	5000	11	5011.584290	0.002316858	0.002316858
+14	5000	12	4930.805994	-0.013838801	0.013838801
+14	5000	13	5028.615500	0.005723100	0.005723100
+14	5000	14	5018.388278	0.003677656	0.003677656
+14	5000	15	5025.203588	0.005040718	0.005040718
+14	5000	16	5097.457456	0.019491491	0.019491491
+14	5000	17	4884.410676	-0.023117865	0.023117865
+14	5000	18	5097.457456	0.019491491	0.019491491
+14	5000	19	4904.230070	-0.019153986	0.019153986
+14	5000	20	5018.388278	0.003677656	0.003677656
+14	5000	21	4977.732858	-0.004453428	0.004453428
+14	5000	22	4917.496478	-0.016500704	0.016500704
+14	5000	23	5069.781675	0.013956335	0.013956335
+14	10000	0	10098.948862	0.009894886	0.009894886
+14	10000	1	10028.930063	0.002893006	0.002893006
+14	10000	2	10206.273779	0.020627378	0.020627378
+14	10000	3	10206.273779	0.020627378	0.020627378
+14	10000	4	10098.948862	0.009894886	0.009894886
+14	10000	5	9960.088106	-0.003991189	0.003991189
+14	10000	6	9926.096210	-0.007390379	0.007390379
+14	10000	7	10279.418580	0.027941858	0.027941858
+14	10000	8	9717.127406	-0.028287259	0.028287259
+14	10000	9	10063.789848	0.006378985	0.006378985
+14	10000	10	9685.085522	-0.031491448	0.031491448
+14	10000	11	9760.243594	-0.023975641	0.023975641
+14	10000	12	9937.395527	-0.006260447	0.006260447
+14	10000	13	9994.364457	-0.000563554	0.000563554
+14	10000	14	9706.418903	-0.029358110	0.029358110
+14	10000	15	9760.243594	-0.023975641	0.023975641
+14	10000	16	9825.780992	-0.017421901	0.017421901
+14	10000	17	9892.384085	-0.010761591	0.010761591
+14	10000	18	10170.185440	0.017018544	0.017018544
+14	10000	19	10028.930063	0.002893006	0.002893006
+14	10000	20	10366.438545	0.036643854	0.036643854
+14	10000	21	9825.780992	-0.017421901	0.017421901
+14	10000	22	10533.121950	0.053312195	0.053312195
+14	10000	23	10028.930063	0.002893006	0.002893006
+14	50000	0	49455.953700	-0.010880926	0.010880926
+14	50000	1	50023.298022	0.000465960	0.000465960
+14	50000	2	50188.070131	0.003761403	0.003761403
+14	50000	3	50590.145730	0.011802915	0.011802915
+14	50000	4	51201.795980	0.024035920	0.024035920
+14	50000	5	48968.547418	-0.020629052	0.020629052
+14	50000	6	49267.036871	-0.014659263	0.014659263
+14	50000	7	51956.922584	0.039138452	0.039138452
+14	50000	8	49232.101259	-0.015357975	0.015357975
+14	50000	9	49804.953467	-0.003900931	0.003900931
+14	50000	10	49880.363173	-0.002392737	0.002392737
+14	50000	11	49975.176790	-0.000496464	0.000496464
+14	50000	12	49689.308891	-0.006213822	0.006213822
+14	50000	13	49723.239200	-0.005535216	0.005535216
+14	50000	14	49920.293664	-0.001594127	0.001594127
+14	50000	15	49243.699954	-0.015126001	0.015126001
+14	50000	16	51465.515094	0.029310302	0.029310302
+14	50000	17	50539.167669	0.010783353	0.010783353
+14	50000	18	50886.700489	0.017734010	0.017734010
+14	50000	19	49589.996216	-0.008200076	0.008200076
+14	50000	20	49812.204067	-0.003755919	0.003755919
+14	50000	21	50353.467623	0.007069352	0.007069352
+14	50000	22	48913.682097	-0.021726358	0.021726358
+14	50000	23	49830.906611	-0.003381868	0.003381868
+15	100	0	100.216046	0.002160456	0.002160456
+15	100	1	101.240942	0.012409424	0.012409424
+15	100	2	100.216046	0.002160456	0.002160456
+15	100	3	100.216046	0.002160456	0.002160456
+15	100	4	99.191405	-0.008085948	0.008085948
+15	100	5	100.216046	0.002160456	0.002160456
+15	100	6	101.240942	0.012409424	0.012409424
+15	100	7	100.216046	0.002160456	0.002160456
+15	100	8	97.142893	-0.028571070	0.028571070
+15	100	9	98.167021	-0.018329790	0.018329790
+15	100	10	101.240942	0.012409424	0.012409424
+15	100	11	100.216046	0.002160456	0.002160456
+15	100	12	101.240942	0.012409424	0.012409424
+15	100	13	101.240942	0.012409424	0.012409424
+15	100	14	100.216046	0.002160456	0.002160456
+15	100	15	100.216046	0.002160456	0.002160456
+15	100	16	99.191405	-0.008085948	0.008085948
+15	100	17	100.216046	0.002160456	0.002160456
+15	100	18	101.240942	0.012409424	0.012409424
+15	100	19	99.191405	-0.008085948	0.008085948
+15	100	20	99.191405	-0.008085948	0.008085948
+15	100	21	101.240942	0.012409424	0.012409424
+15	100	22	99.191405	-0.008085948	0.008085948
+15	100	23	101.240942	0.012409424	0.012409424
+15	500	0	503.744628	0.007489256	0.007489256
+15	500	1	506.006986	0.012013973	0.012013973
+15	500	2	494.707669	-0.010584662	0.010584662
+15	500	3	493.579450	-0.012841101	0.012841101
+15	500	4	507.138634	0.014277269	0.014277269
+15	500	5	509.402869	0.018805738	0.018805738
+15	500	6	515.068937	0.030137874	0.030137874
+15	500	7	492.451541	-0.015096918	0.015096918
+15	500	8	496.965040	-0.006069920	0.006069920
+15	500	9	493.579450	-0.012841101	0.012841101
+15	500	10	499.223656	-0.001552688	0.001552688
+15	500	11	511.668356	0.023336711	0.023336711
+15	500	12	509.402869	0.018805738	0.018805738
+15	500	13	502.613917	0.005227834	0.005227834
+15	500	14	495.836199	-0.008327602	0.008327602
+15	500	15	503.744628	0.007489256	0.007489256
+15	500	16	507.138634	0.014277269	0.014277269
+15	500	17	501.483518	0.002967036	0.002967036
+15	500	18	507.138634	0.014277269	0.014277269
+15	500	19	506.006986	0.012013973	0.012013973
+15	500	20	504.875651	0.009751302	0.009751302
+15	500	21	500.353431	0.000706863	0.000706863
+15	500	22	501.483518	0.002967036	0.002967036
+15	500	23	493.579450	-0.012841101	0.012841101
+15	1000	0	993.257965	-0.006742035	0.006742035
+15	1000	1	1007.300678	0.007300678	0.007300678
+15	1000	2	991.983739	-0.008016261	0.008016261
+15	1000	3	1012.419079	0.012419079	0.012419079
+15	1000	4	1004.743874	0.004743874	0.004743874
+15	1000	5	1008.579679	0.008579679	0.008579679
+15	1000	6	1007.300678	0.007300678	0.007300678
+15	1000	7	977.993351	-0.022006649	0.022006649
+15	1000	8	998.358838	-0.001641162	0.001641162
+15	1000	9	995.807607	-0.004192393	0.004192393
+15	1000	10	1030.384020	0.030384020	0.030384020
+15	1000	11	983.075238	-0.016924762	0.016924762
+15	1000	12	1000.911658	0.000911658	0.000911658
+15	1000	13	993.257965	-0.006742035	0.006742035
+15	1000	14	1006.022077	0.006022077	0.006022077
+15	1000	15	991.983739	-0.008016261	0.008016261
+15	1000	16	999.635049	-0.000364951	0.000364951
+15	1000	17	1017.543884	0.017543884	0.017543884
+15	1000	18	1013.699680	0.013699680	0.013699680
+15	1000	19	1007.300678	0.007300678	0.007300678
+15	1000	20	1013.699680	0.013699680	0.013699680
+15	1000	21	1009.859079	0.009859079	0.009859079
+15	1000	22	1021.391701	0.021391701	0.021391701
+15	1000	23	1016.262082	0.016262082	0.016262082
+15	5000	0	4914.175845	-0.017164831	0.017164831
+15	5000	1	4947.503938	-0.010499212	0.010499212
+15	5000	2	4894.308385	-0.021138323	0.021138323
+15	5000	3	5001.399453	0.000279891	0.000279891
+15	5000	4	4914.175845	-0.017164831	0.017164831
+15	5000	5	5056.013595	0.011202719	0.011202719
+15	5000	6	5035.447861	0.007089572	0.007089572
+15	5000	7	4967.631743	-0.006473651	0.006473651
+15	5000	8	4937.477005	-0.012504599	0.012504599
+15	5000	9	5014.984871	0.002996974	0.002996974
+15	5000	10	5035.447861	0.007089572	0.007089572
+15	5000	11	5025.203588	0.005040718	0.005040718
+15	5000	12	4967.631743	-0.006473651	0.006473651
+15	5000	13	4917.496478	-0.016500704	0.016500704
+15	5000	14	4967.631743	-0.006473651	0.006473651
+15	5000	15	4974.363051	-0.005127390	0.005127390
+15	5000	16	5121.828119	0.024365624	0.024365624
+15	5000	17	5035.447861	0.007089572	0.007089572
+15	5000	18	5035.447861	0.007089572	0.007089572
+15	5000	19	5052.578794	0.010515759	0.010515759
+15	5000	20	5114.850264	0.022970053	0.022970053
+15	5000	21	5045.717821	0.009143564	0.009143564
+15	5000	22	4947.503938	-0.010499212	0.010499212
+15	5000	23	4977.732858	-0.004453428	0.004453428
+15	10000	0	10218.374231	0.021837423	0.021837423
+15	10000	1	10291.737386	0.029173739	0.029173739
+15	10000	2	9781.973088	-0.021802691	0.021802691
+15	10000	3	9738.628768	-0.026137123	0.026137123
+15	10000	4	9858.947165	-0.014105284	0.014105284
+15	10000	5	10316.486706	0.031648671	0.031648671
+15	10000	6	10028.930063	0.002893006	0.002893006
+15	10000	7	10017.375753	0.001737575	0.001737575
+15	10000	8	9926.096210	-0.007390379	0.007390379
+15	10000	9	10353.893359	0.035389336	0.035389336
+15	10000	10	10291.737386	0.029173739	0.029173739
+15	10000	11	9825.780992	-0.017421901	0.017421901
+15	10000	12	10218.374231	0.021837423	0.021837423
+15	10000	13	9847.861908	-0.015213809	0.015213809
+15	10000	14	9870.062504	-0.012993750	0.012993750
+15	10000	15	9971.481716	-0.002851828	0.002851828
+15	10000	16	10005.853945	0.000585395	0.000585395
+15	10000	17	9892.384085	-0.010761591	0.010761591
+15	10000	18	9870.062504	-0.012993750	0.012993750
+15	10000	19	10206.273779	0.020627378	0.020627378
+15	10000	20	9903.590659	-0.009640934	0.009640934
+15	10000	21	10218.374231	0.021837423	0.021837423
+15	10000	22	10028.930063	0.002893006	0.002893006
+15	10000	23	9781.973088	-0.021802691	0.021802691
+15	50000	0	49651.203570	-0.006975929	0.006975929
+15	50000	1	48195.460687	-0.036090786	0.036090786
+15	50000	2	49875.570088	-0.002488598	0.002488598
+15	50000	3	49960.350706	-0.000792986	0.000792986
+15	50000	4	50353.101473	0.007062029	0.007062029
+15	50000	5	50793.944294	0.015878886	0.015878886
+15	50000	6	48918.483167	-0.021630337	0.021630337
+15	50000	7	51075.788486	0.021515770	0.021515770
+15	50000	8	49521.829104	-0.009563418	0.009563418
+15	50000	9	49676.473010	-0.006470540	0.006470540
+15	50000	10	50761.124957	0.015222499	0.015222499
+15	50000	11	49550.605716	-0.008987886	0.008987886
+15	50000	12	48943.549508	-0.021129010	0.021129010
+15	50000	13	51892.798416	0.037855968	0.037855968
+15	50000	14	50610.054042	0.012201081	0.012201081
+15	50000	15	50872.676358	0.017453527	0.017453527
+15	50000	16	50345.471083	0.006909422	0.006909422
+15	50000	17	49848.296604	-0.003034068	0.003034068
+15	50000	18	50321.645206	0.006432904	0.006432904
+15	50000	19	49845.307729	-0.003093845	0.003093845
+15	50000	20	50767.822528	0.015356451	0.015356451
+15	50000	21	50481.919324	0.009638386	0.009638386
+15	50000	22	50810.888835	0.016217777	0.016217777
+15	50000	23	49437.308883	-0.011253822	0.011253822
+16	100	0	98.167021	-0.018329790	0.018329790
+16	100	1	99.191405	-0.008085948	0.008085948
+16	100	2	101.240942	0.012409424	0.012409424
+16	100	3	101.240942	0.012409424	0.012409424
+16	100	4	100.216046	0.002160456	0.002160456
+16	100	5	100.216046	0.002160456	0.002160456
+16	100	6	100.216046	0.002160456	0.002160456
+16	100	7	100.216046	0.002160456	0.002160456
+16	100	8	101.240942	0.012409424	0.012409424
+16	100	9	101.240942	0.012409424	0.012409424
+16	100	10	100.216046	0.002160456	0.002160456
+16	100	11	101.240942	0.012409424	0.012409424
+16	100	12	100.216046	0.002160456	0.002160456
+16	100	13	101.240942	0.012409424	0.012409424
+16	100	14	100.216046	0.002160456	0.002160456
+16	100	15	100.216046	0.002160456	0.002160456
+16	100	16	99.191405	-0.008085948	0.008085948
+16	100	17	101.240942	0.012409424	0.012409424
+16	100	18	100.216046	0.002160456	0.002160456
+16	100	19	100.216046	0.002160456	0.002160456
+16	100	20	101.240942	0.012409424	0.012409424
+16	100	21	100.216046	0.002160456	0.002160456
+16	100	22	99.191405	-0.008085948	0.008085948
+16	100	23	99.191405	-0.008085948	0.008085948
+16	500	0	495.836199	-0.008327602	0.008327602
+16	500	1	498.094192	-0.003811615	0.003811615
+16	500	2	502.613917	0.005227834	0.005227834
+16	500	3	503.744628	0.007489256	0.007489256
+16	500	4	509.402869	0.018805738	0.018805738
+16	500	5	502.613917	0.005227834	0.005227834
+16	500	6	494.707669	-0.010584662	0.010584662
+16	500	7	503.744628	0.007489256	0.007489256
+16	500	8	500.353431	0.000706863	0.000706863
+16	500	9	493.579450	-0.012841101	0.012841101
+16	500	10	500.353431	0.000706863	0.000706863
+16	500	11	503.744628	0.007489256	0.007489256
+16	500	12	501.483518	0.002967036	0.002967036
+16	500	13	502.613917	0.005227834	0.005227834
+16	500	14	496.965040	-0.006069920	0.006069920
+16	500	15	504.875651	0.009751302	0.009751302
+16	500	16	491.323943	-0.017352114	0.017352114
+16	500	17	495.836199	-0.008327602	0.008327602
+16	500	18	495.836199	-0.008327602	0.008327602
+16	500	19	506.006986	0.012013973	0.012013973
+16	500	20	486.816652	-0.026366696	0.026366696
+16	500	21	495.836199	-0.008327602	0.008327602
+16	500	22	496.965040	-0.006069920	0.006069920
+16	500	23	503.744628	0.007489256	0.007489256
+16	1000	0	984.346695	-0.015653305	0.015653305
+16	1000	1	1014.980680	0.014980680	0.014980680
+16	1000	2	1006.022077	0.006022077	0.006022077
+16	1000	3	986.890795	-0.013109205	0.013109205
+16	1000	4	999.635049	-0.000364951	0.000364951
+16	1000	5	976.723864	-0.023276136	0.023276136
+16	1000	6	981.804175	-0.018195825	0.018195825
+16	1000	7	1009.859079	0.009859079	0.009859079
+16	1000	8	989.436475	-0.010563525	0.010563525
+16	1000	9	1007.300678	0.007300678	0.007300678
+16	1000	10	997.083024	-0.002916976	0.002916976
+16	1000	11	1002.188665	0.002188665	0.002188665
+16	1000	12	1000.911658	0.000911658	0.000911658
+16	1000	13	1007.300678	0.007300678	0.007300678
+16	1000	14	990.709909	-0.009290091	0.009290091
+16	1000	15	1006.022077	0.006022077	0.006022077
+16	1000	16	975.454771	-0.024545229	0.024545229
+16	1000	17	1003.466070	0.003466070	0.003466070
+16	1000	18	1006.022077	0.006022077	0.006022077
+16	1000	19	1014.980680	0.014980680	0.014980680
+16	1000	20	1007.300678	0.007300678	0.007300678
+16	1000	21	999.635049	-0.000364951	0.000364951
+16	1000	22	993.257965	-0.006742035	0.006742035
+16	1000	23	1002.188665	0.002188665	0.002188665
+16	5000	0	5035.447861	0.007089572	0.007089572
+16	5000	1	5042.291639	0.008458328	0.008458328
+16	5000	2	5045.717821	0.009143564	0.009143564
+16	5000	3	4977.732858	-0.004453428	0.004453428
+16	5000	4	4924.145830	-0.015170834	0.015170834
+16	5000	5	5032.030256	0.006406051	0.006406051
+16	5000	6	4900.920170	-0.019815966	0.019815966
+16	5000	7	4954.202223	-0.009159555	0.009159555
+16	5000	8	4984.480800	-0.003103840	0.003103840
+16	5000	9	5093.987740	0.018797548	0.018797548
+16	5000	10	4967.631743	-0.006473651	0.006473651
+16	5000	11	5146.344652	0.029268930	0.029268930
+16	5000	12	4950.851711	-0.009829658	0.009829658
+16	5000	13	5080.138191	0.016027638	0.016027638
+16	5000	14	4947.503938	-0.010499212	0.010499212
+16	5000	15	4957.555477	-0.008488905	0.008488905
+16	5000	16	4970.996014	-0.005800797	0.005800797
+16	5000	17	5028.615500	0.005723100	0.005723100
+16	5000	18	5021.794515	0.004358903	0.004358903
+16	5000	19	5066.335314	0.013267063	0.013267063
+16	5000	20	5042.291639	0.008458328	0.008458328
+16	5000	21	4825.521483	-0.034895703	0.034895703
+16	5000	22	4984.480800	-0.003103840	0.003103840
+16	5000	23	5104.405719	0.020881144	0.020881144
+16	10000	0	10429.747379	0.042974738	0.042974738
+16	10000	1	10110.735920	0.011073592	0.011073592
+16	10000	2	10063.789848	0.006378985	0.006378985
+16	10000	3	10087.195626	0.008719563	0.008719563
+16	10000	4	10533.121950	0.053312195	0.053312195
+16	10000	5	10110.735920	0.011073592	0.011073592
+16	10000	6	9903.590659	-0.009640934	0.009640934
+16	10000	7	10028.930063	0.002893006	0.002893006
+16	10000	8	10304.093353	0.030409335	0.030409335
+16	10000	9	9982.907107	-0.001709289	0.001709289
+16	10000	10	9881.208089	-0.011879191	0.011879191
+16	10000	11	10146.301990	0.014630199	0.014630199
+16	10000	12	9971.481716	-0.002851828	0.002851828
+16	10000	13	9836.806570	-0.016319343	0.016319343
+16	10000	14	10040.517058	0.004051706	0.004051706
+16	10000	15	10279.418580	0.027941858	0.027941858
+16	10000	16	10267.136712	0.026713671	0.026713671
+16	10000	17	10291.737386	0.029173739	0.029173739
+16	10000	18	9960.088106	-0.003991189	0.003991189
+16	10000	19	10087.195626	0.008719563	0.008719563
+16	10000	20	9937.395527	-0.006260447	0.006260447
+16	10000	21	9760.243594	-0.023975641	0.023975641
+16	10000	22	10366.438545	0.036643854	0.036643854
+16	10000	23	9914.827977	-0.008517202	0.008517202
+16	50000	0	49644.700804	-0.007105984	0.007105984
+16	50000	1	49671.317020	-0.006573660	0.006573660
+16	50000	2	49891.913818	-0.002161724	0.002161724
+16	50000	3	48948.801795	-0.021023964	0.021023964
+16	50000	4	49833.320183	-0.003333596	0.003333596
+16	50000	5	50339.059859	0.006781197	0.006781197
+16	50000	6	50393.440413	0.007868808	0.007868808
+16	50000	7	49614.045329	-0.007719093	0.007719093
+16	50000	8	48468.989997	-0.030620200	0.030620200
+16	50000	9	49943.519118	-0.001129618	0.001129618
+16	50000	10	48973.139957	-0.020537201	0.020537201
+16	50000	11	51901.892895	0.038037858	0.038037858
+16	50000	12	49406.551212	-0.011868976	0.011868976
+16	50000	13	50927.015232	0.018540305	0.018540305
+16	50000	14	49386.735398	-0.012265292	0.012265292
+16	50000	15	50416.063159	0.008321263	0.008321263
+16	50000	16	48448.238868	-0.031035223	0.031035223
+16	50000	17	51570.020366	0.031400407	0.031400407
+16	50000	18	51334.824920	0.026696498	0.026696498
+16	50000	19	49336.852414	-0.013262952	0.013262952
+16	50000	20	50823.337724	0.016466754	0.016466754
+16	50000	21	49082.131420	-0.018357372	0.018357372
+16	50000	22	51790.860534	0.035817211	0.035817211
+16	50000	23	49083.990993	-0.018320180	0.018320180
+17	100	0	100.216046	0.002160456	0.002160456
+17	100	1	101.240942	0.012409424	0.012409424
+17	100	2	101.240942	0.012409424	0.012409424
+17	100	3	101.240942	0.012409424	0.012409424
+17	100	4	101.240942	0.012409424	0.012409424
+17	100	5	99.191405	-0.008085948	0.008085948
+17	100	6	101.240942	0.012409424	0.012409424
+17	100	7	100.216046	0.002160456	0.002160456
+17	100	8	99.191405	-0.008085948	0.008085948
+17	100	9	99.191405	-0.008085948	0.008085948
+17	100	10	101.240942	0.012409424	0.012409424
+17	100	11	99.191405	-0.008085948	0.008085948
+17	100	12	99.191405	-0.008085948	0.008085948
+17	100	13	99.191405	-0.008085948	0.008085948
+17	100	14	100.216046	0.002160456	0.002160456
+17	100	15	101.240942	0.012409424	0.012409424
+17	100	16	101.240942	0.012409424	0.012409424
+17	100	17	96.119021	-0.038809790	0.038809790
+17	100	18	99.191405	-0.008085948	0.008085948
+17	100	19	101.240942	0.012409424	0.012409424
+17	100	20	99.191405	-0.008085948	0.008085948
+17	100	21	99.191405	-0.008085948	0.008085948
+17	100	22	100.216046	0.002160456	0.002160456
+17	100	23	99.191405	-0.008085948	0.008085948
+17	500	0	500.353431	0.000706863	0.000706863
+17	500	1	503.744628	0.007489256	0.007489256
+17	500	2	506.006986	0.012013973	0.012013973
+17	500	3	496.965040	-0.006069920	0.006069920
+17	500	4	501.483518	0.002967036	0.002967036
+17	500	5	495.836199	-0.008327602	0.008327602
+17	500	6	494.707669	-0.010584662	0.010584662
+17	500	7	510.535456	0.021070911	0.021070911
+17	500	8	500.353431	0.000706863	0.000706863
+17	500	9	498.094192	-0.003811615	0.003811615
+17	500	10	498.094192	-0.003811615	0.003811615
+17	500	11	495.836199	-0.008327602	0.008327602
+17	500	12	496.965040	-0.006069920	0.006069920
+17	500	13	506.006986	0.012013973	0.012013973
+17	500	14	491.323943	-0.017352114	0.017352114
+17	500	15	503.744628	0.007489256	0.007489256
+17	500	16	502.613917	0.005227834	0.005227834
+17	500	17	498.094192	-0.003811615	0.003811615
+17	500	18	503.744628	0.007489256	0.007489256
+17	500	19	491.323943	-0.017352114	0.017352114
+17	500	20	493.579450	-0.012841101	0.012841101
+17	500	21	509.402869	0.018805738	0.018805738
+17	500	22	498.094192	-0.003811615	0.003811615
+17	500	23	504.875651	0.009751302	0.009751302
+17	1000	0	988.163437	-0.011836563	0.011836563
+17	1000	1	991.983739	-0.008016261	0.008016261
+17	1000	2	991.983739	-0.008016261	0.008016261
+17	1000	3	1018.826088	0.018826088	0.018826088
+17	1000	4	983.075238	-0.016924762	0.016924762
+17	1000	5	993.257965	-0.006742035	0.006742035
+17	1000	6	1011.138879	0.011138879	0.011138879
+17	1000	7	1020.108694	0.020108694	0.020108694
+17	1000	8	1006.022077	0.006022077	0.006022077
+17	1000	9	1006.022077	0.006022077	0.006022077
+17	1000	10	981.804175	-0.018195825	0.018195825
+17	1000	11	1012.419079	0.012419079	0.012419079
+17	1000	12	997.083024	-0.002916976	0.002916976
+17	1000	13	1018.826088	0.018826088	0.018826088
+17	1000	14	994.532588	-0.005467412	0.005467412
+17	1000	15	1018.826088	0.018826088	0.018826088
+17	1000	16	1008.579679	0.008579679	0.008579679
+17	1000	17	1011.138879	0.011138879	0.011138879
+17	1000	18	1004.743874	0.004743874	0.004743874
+17	1000	19	1008.579679	0.008579679	0.008579679
+17	1000	20	1013.699680	0.013699680	0.013699680
+17	1000	21	1012.419079	0.012419079	0.012419079
+17	1000	22	980.533506	-0.019466494	0.019466494
+17	1000	23	1013.699680	0.013699680	0.013699680
+17	5000	0	4907.542646	-0.018491471	0.018491471
+17	5000	1	5032.030256	0.006406051	0.006406051
+17	5000	2	5181.624801	0.036324960	0.036324960
+17	5000	3	4970.996014	-0.005800797	0.005800797
+17	5000	4	5066.335314	0.013267063	0.013267063
+17	5000	5	4947.503938	-0.010499212	0.010499212
+17	5000	6	5056.013595	0.011202719	0.011202719
+17	5000	7	4957.555477	-0.008488905	0.008488905
+17	5000	8	5045.717821	0.009143564	0.009143564
+17	5000	9	4934.140142	-0.013171972	0.013171972
+17	5000	10	4944.158899	-0.011168220	0.011168220
+17	5000	11	5069.781675	0.013956335	0.013956335
+17	5000	12	5083.596191	0.016719238	0.016719238
+17	5000	13	5125.321509	0.025064302	0.025064302
+17	5000	14	5104.405719	0.020881144	0.020881144
+17	5000	15	5008.186530	0.001637306	0.001637306
+17	5000	16	5052.578794	0.010515759	0.010515759
+17	5000	17	4920.819805	-0.015836039	0.015836039
+17	5000	18	4977.732858	-0.004453428	0.004453428
+17	5000	19	5014.984871	0.002996974	0.002996974
+17	5000	20	5097.457456	0.019491491	0.019491491
+17	5000	21	4914.175845	-0.017164831	0.017164831
+17	5000	22	5018.388278	0.003677656	0.003677656
+17	5000	23	4987.858944	-0.002428211	0.002428211
+17	10000	0	9437.392940	-0.056260706	0.056260706
+17	10000	1	10017.375753	0.001737575	0.001737575
+17	10000	2	10170.185440	0.017018544	0.017018544
+17	10000	3	10230.510536	0.023051054	0.023051054
+17	10000	4	10254.891561	0.025489156	0.025489156
+17	10000	5	9497.926061	-0.050207394	0.050207394
+17	10000	6	9836.806570	-0.016319343	0.016319343
+17	10000	7	10087.195626	0.008719563	0.008719563
+17	10000	8	10087.195626	0.008719563	0.008719563
+17	10000	9	9814.785012	-0.018521499	0.018521499
+17	10000	10	10158.226307	0.015822631	0.015822631
+17	10000	11	9982.907107	-0.001709289	0.001709289
+17	10000	12	9982.907107	-0.001709289	0.001709289
+17	10000	13	9914.827977	-0.008517202	0.008517202
+17	10000	14	9814.785012	-0.018521499	0.018521499
+17	10000	15	9792.881217	-0.020711878	0.020711878
+17	10000	16	10182.179592	0.018217959	0.018217959
+17	10000	17	9653.292348	-0.034670765	0.034670765
+17	10000	18	10063.789848	0.006378985	0.006378985
+17	10000	19	9926.096210	-0.007390379	0.007390379
+17	10000	20	9870.062504	-0.012993750	0.012993750
+17	10000	21	10468.207755	0.046820776	0.046820776
+17	10000	22	9914.827977	-0.008517202	0.008517202
+17	10000	23	9760.243594	-0.023975641	0.023975641
+17	50000	0	50798.226154	0.015964523	0.015964523
+17	50000	1	50155.018299	0.003100366	0.003100366
+17	50000	2	49128.209490	-0.017435810	0.017435810
+17	50000	3	48513.703837	-0.029725923	0.029725923
+17	50000	4	48970.159453	-0.020596811	0.020596811
+17	50000	5	49319.976137	-0.013600477	0.013600477
+17	50000	6	49889.376455	-0.002212471	0.002212471
+17	50000	7	49482.306290	-0.010353874	0.010353874
+17	50000	8	49929.133519	-0.001417330	0.001417330
+17	50000	9	49504.561789	-0.009908764	0.009908764
+17	50000	10	49566.903879	-0.008661922	0.008661922
+17	50000	11	50897.389580	0.017947792	0.017947792
+17	50000	12	50038.224258	0.000764485	0.000764485
+17	50000	13	49527.346238	-0.009453075	0.009453075
+17	50000	14	50087.079289	0.001741586	0.001741586
+17	50000	15	48855.235033	-0.022895299	0.022895299
+17	50000	16	51114.924707	0.022298494	0.022298494
+17	50000	17	49828.268196	-0.003434636	0.003434636
+17	50000	18	50782.485347	0.015649707	0.015649707
+17	50000	19	48972.432419	-0.020551352	0.020551352
+17	50000	20	49232.300729	-0.015353985	0.015353985
+17	50000	21	49619.604767	-0.007607905	0.007607905
+17	50000	22	50320.018016	0.006400360	0.006400360
+17	50000	23	49016.696927	-0.019666061	0.019666061
+18	100	0	99.191405	-0.008085948	0.008085948
+18	100	1	100.216046	0.002160456	0.002160456
+18	100	2	99.191405	-0.008085948	0.008085948
+18	100	3	100.216046	0.002160456	0.002160456
+18	100	4	99.191405	-0.008085948	0.008085948
+18	100	5	100.216046	0.002160456	0.002160456
+18	100	6	101.240942	0.012409424	0.012409424
+18	100	7	101.240942	0.012409424	0.012409424
+18	100	8	101.240942	0.012409424	0.012409424
+18	100	9	100.216046	0.002160456	0.002160456
+18	100	10	100.216046	0.002160456	0.002160456
+18	100	11	100.216046	0.002160456	0.002160456
+18	100	12	100.216046	0.002160456	0.002160456
+18	100	13	100.216046	0.002160456	0.002160456
+18	100	14	100.216046	0.002160456	0.002160456
+18	100	15	100.216046	0.002160456	0.002160456
+18	100	16	100.216046	0.002160456	0.002160456
+18	100	17	99.191405	-0.008085948	0.008085948
+18	100	18	97.142893	-0.028571070	0.028571070
+18	100	19	101.240942	0.012409424	0.012409424
+18	100	20	100.216046	0.002160456	0.002160456
+18	100	21	99.191405	-0.008085948	0.008085948
+18	100	22	100.216046	0.002160456	0.002160456
+18	100	23	100.216046	0.002160456	0.002160456
+18	500	0	500.353431	0.000706863	0.000706863
+18	500	1	507.138634	0.014277269	0.014277269
+18	500	2	502.613917	0.005227834	0.005227834
+18	500	3	507.138634	0.014277269	0.014277269
+18	500	4	500.353431	0.000706863	0.000706863
+18	500	5	495.836199	-0.008327602	0.008327602
+18	500	6	493.579450	-0.012841101	0.012841101
+18	500	7	498.094192	-0.003811615	0.003811615
+18	500	8	500.353431	0.000706863	0.000706863
+18	500	9	501.483518	0.002967036	0.002967036
+18	500	10	493.579450	-0.012841101	0.012841101
+18	500	11	493.579450	-0.012841101	0.012841101
+18	500	12	499.223656	-0.001552688	0.001552688
+18	500	13	509.402869	0.018805738	0.018805738
+18	500	14	496.965040	-0.006069920	0.006069920
+18	500	15	510.535456	0.021070911	0.021070911
+18	500	16	493.579450	-0.012841101	0.012841101
+18	500	17	502.613917	0.005227834	0.005227834
+18	500	18	498.094192	-0.003811615	0.003811615
+18	500	19	501.483518	0.002967036	0.002967036
+18	500	20	504.875651	0.009751302	0.009751302
+18	500	21	508.270595	0.016541190	0.016541190
+18	500	22	490.196655	-0.019606690	0.019606690
+18	500	23	503.744628	0.007489256	0.007489256
+18	1000	0	1009.859079	0.009859079	0.009859079
+18	1000	1	985.618547	-0.014381453	0.014381453
+18	1000	2	1018.826088	0.018826088	0.018826088
+18	1000	3	1000.911658	0.000911658	0.000911658
+18	1000	4	993.257965	-0.006742035	0.006742035
+18	1000	5	1004.743874	0.004743874	0.004743874
+18	1000	6	1004.743874	0.004743874	0.004743874
+18	1000	7	999.635049	-0.000364951	0.000364951
+18	1000	8	976.723864	-0.023276136	0.023276136
+18	1000	9	1012.419079	0.012419079	0.012419079
+18	1000	10	988.163437	-0.011836563	0.011836563
+18	1000	11	1014.980680	0.014980680	0.014980680
+18	1000	12	983.075238	-0.016924762	0.016924762
+18	1000	13	991.983739	-0.008016261	0.008016261
+18	1000	14	1003.466070	0.003466070	0.003466070
+18	1000	15	1008.579679	0.008579679	0.008579679
+18	1000	16	984.346695	-0.015653305	0.015653305
+18	1000	17	994.532588	-0.005467412	0.005467412
+18	1000	18	1007.300678	0.007300678	0.007300678
+18	1000	19	1007.300678	0.007300678	0.007300678
+18	1000	20	1006.022077	0.006022077	0.006022077
+18	1000	21	1003.466070	0.003466070	0.003466070
+18	1000	22	989.436475	-0.010563525	0.010563525
+18	1000	23	995.807607	-0.004192393	0.004192393
+18	5000	0	4954.202223	-0.009159555	0.009159555
+18	5000	1	5080.138191	0.016027638	0.016027638
+18	5000	2	4897.612944	-0.020477411	0.020477411
+18	5000	3	5171.008813	0.034201763	0.034201763
+18	5000	4	5008.186530	0.001637306	0.001637306
+18	5000	5	5028.615500	0.005723100	0.005723100
+18	5000	6	5087.057112	0.017411422	0.017411422
+18	5000	7	4967.631743	-0.006473651	0.006473651
+18	5000	8	4924.145830	-0.015170834	0.015170834
+18	5000	9	5062.891850	0.012578370	0.012578370
+18	5000	10	4974.363051	-0.005127390	0.005127390
+18	5000	11	4940.816590	-0.011836682	0.011836682
+18	5000	12	5018.388278	0.003677656	0.003677656
+18	5000	13	5032.030256	0.006406051	0.006406051
+18	5000	14	5059.451279	0.011890256	0.011890256
+18	5000	15	4987.858944	-0.002428211	0.002428211
+18	5000	16	5018.388278	0.003677656	0.003677656
+18	5000	17	5097.457456	0.019491491	0.019491491
+18	5000	18	5038.868321	0.007773664	0.007773664
+18	5000	19	5018.388278	0.003677656	0.003677656
+18	5000	20	4981.105439	-0.003778912	0.003778912
+18	5000	21	5021.794515	0.004358903	0.004358903
+18	5000	22	5008.186530	0.001637306	0.001637306
+18	5000	23	5045.717821	0.009143564	0.009143564
+18	10000	0	9994.364457	-0.000563554	0.000563554
+18	10000	1	9903.590659	-0.009640934	0.009640934
+18	10000	2	9749.421923	-0.025057808	0.025057808
+18	10000	3	9749.421923	-0.025057808	0.025057808
+18	10000	4	10017.375753	0.001737575	0.001737575
+18	10000	5	9836.806570	-0.016319343	0.016319343
+18	10000	6	9695.738323	-0.030426168	0.030426168
+18	10000	7	9960.088106	-0.003991189	0.003991189
+18	10000	8	10098.948862	0.009894886	0.009894886
+18	10000	9	10110.735920	0.011073592	0.011073592
+18	10000	10	9994.364457	-0.000563554	0.000563554
+18	10000	11	9858.947165	-0.014105284	0.014105284
+18	10000	12	9960.088106	-0.003991189	0.003991189
+18	10000	13	10110.735920	0.011073592	0.011073592
+18	10000	14	10122.556996	0.012255700	0.012255700
+18	10000	15	9994.364457	-0.000563554	0.000563554
+18	10000	16	10146.301990	0.014630199	0.014630199
+18	10000	17	9847.861908	-0.015213809	0.015213809
+18	10000	18	9836.806570	-0.016319343	0.016319343
+18	10000	19	9653.292348	-0.034670765	0.034670765
+18	10000	20	9881.208089	-0.011879191	0.011879191
+18	10000	21	10353.893359	0.035389336	0.035389336
+18	10000	22	9825.780992	-0.017421901	0.017421901
+18	10000	23	10455.347462	0.045534746	0.045534746
+18	50000	0	49247.783310	-0.015044334	0.015044334
+18	50000	1	49340.959679	-0.013180806	0.013180806
+18	50000	2	48796.706746	-0.024065865	0.024065865
+18	50000	3	50097.419918	0.001948398	0.001948398
+18	50000	4	49787.806291	-0.004243874	0.004243874
+18	50000	5	51433.017717	0.028660354	0.028660354
+18	50000	6	51087.264162	0.021745283	0.021745283
+18	50000	7	49222.789107	-0.015544218	0.015544218
+18	50000	8	50057.153729	0.001143075	0.001143075
+18	50000	9	48581.458606	-0.028370828	0.028370828
+18	50000	10	50778.237847	0.015564757	0.015564757
+18	50000	11	49749.547078	-0.005009058	0.005009058
+18	50000	12	50784.546747	0.015690935	0.015690935
+18	50000	13	48726.726818	-0.025465464	0.025465464
+18	50000	14	49659.166128	-0.006816677	0.006816677
+18	50000	15	49776.010051	-0.004479799	0.004479799
+18	50000	16	51363.586526	0.027271731	0.027271731
+18	50000	17	50466.613215	0.009332264	0.009332264
+18	50000	18	48878.666997	-0.022426660	0.022426660
+18	50000	19	49551.687643	-0.008966247	0.008966247
+18	50000	20	48686.516128	-0.026269677	0.026269677
+18	50000	21	51256.196106	0.025123922	0.025123922
+18	50000	22	48537.088558	-0.029258229	0.029258229
+18	50000	23	51320.471245	0.026409425	0.026409425
+19	100	0	100.216046	0.002160456	0.002160456
+19	100	1	100.216046	0.002160456	0.002160456
+19	100	2	99.191405	-0.008085948	0.008085948
+19	100	3	98.167021	-0.018329790	0.018329790
+19	100	4	100.216046	0.002160456	0.002160456
+19	100	5	101.240942	0.012409424	0.012409424
+19	100	6	101.240942	0.012409424	0.012409424
+19	100	7	100.216046	0.002160456	0.002160456
+19	100	8	98.167021	-0.018329790	0.018329790
+19	100	9	100.216046	0.002160456	0.002160456
+19	100	10	100.216046	0.002160456	0.002160456
+19	100	11	101.240942	0.012409424	0.012409424
+19	100	12	101.240942	0.012409424	0.012409424
+19	100	13	99.191405	-0.008085948	0.008085948
+19	100	14	100.216046	0.002160456	0.002160456
+19	100	15	100.216046	0.002160456	0.002160456
+19	100	16	101.240942	0.012409424	0.012409424
+19	100	17	100.216046	0.002160456	0.002160456
+19	100	18	99.191405	-0.008085948	0.008085948
+19	100	19	101.240942	0.012409424	0.012409424
+19	100	20	101.240942	0.012409424	0.012409424
+19	100	21	100.216046	0.002160456	0.002160456
+19	100	22	101.240942	0.012409424	0.012409424
+19	100	23	98.167021	-0.018329790	0.018329790
+19	500	0	500.353431	0.000706863	0.000706863
+19	500	1	493.579450	-0.012841101	0.012841101
+19	500	2	496.965040	-0.006069920	0.006069920
+19	500	3	501.483518	0.002967036	0.002967036
+19	500	4	507.138634	0.014277269	0.014277269
+19	500	5	502.613917	0.005227834	0.005227834
+19	500	6	494.707669	-0.010584662	0.010584662
+19	500	7	503.744628	0.007489256	0.007489256
+19	500	8	499.223656	-0.001552688	0.001552688
+19	500	9	493.579450	-0.012841101	0.012841101
+19	500	10	503.744628	0.007489256	0.007489256
+19	500	11	499.223656	-0.001552688	0.001552688
+19	500	12	496.965040	-0.006069920	0.006069920
+19	500	13	503.744628	0.007489256	0.007489256
+19	500	14	503.744628	0.007489256	0.007489256
+19	500	15	493.579450	-0.012841101	0.012841101
+19	500	16	492.451541	-0.015096918	0.015096918
+19	500	17	492.451541	-0.015096918	0.015096918
+19	500	18	512.801569	0.025603138	0.025603138
+19	500	19	504.875651	0.009751302	0.009751302
+19	500	20	500.353431	0.000706863	0.000706863
+19	500	21	498.094192	-0.003811615	0.003811615
+19	500	22	504.875651	0.009751302	0.009751302
+19	500	23	495.836199	-0.008327602	0.008327602
+19	1000	0	979.263232	-0.020736768	0.020736768
+19	1000	1	1013.699680	0.013699680	0.013699680
+19	1000	2	991.983739	-0.008016261	0.008016261
+19	1000	3	979.263232	-0.020736768	0.020736768
+19	1000	4	1004.743874	0.004743874	0.004743874
+19	1000	5	999.635049	-0.000364951	0.000364951
+19	1000	6	989.436475	-0.010563525	0.010563525
+19	1000	7	1004.743874	0.004743874	0.004743874
+19	1000	8	1011.138879	0.011138879	0.011138879
+19	1000	9	989.436475	-0.010563525	0.010563525
+19	1000	10	998.358838	-0.001641162	0.001641162
+19	1000	11	995.807607	-0.004192393	0.004192393
+19	1000	12	998.358838	-0.001641162	0.001641162
+19	1000	13	1002.188665	0.002188665	0.002188665
+19	1000	14	1016.262082	0.016262082	0.016262082
+19	1000	15	1012.419079	0.012419079	0.012419079
+19	1000	16	1000.911658	0.000911658	0.000911658
+19	1000	17	1009.859079	0.009859079	0.009859079
+19	1000	18	1017.543884	0.017543884	0.017543884
+19	1000	19	997.083024	-0.002916976	0.002916976
+19	1000	20	1003.466070	0.003466070	0.003466070
+19	1000	21	988.163437	-0.011836563	0.011836563
+19	1000	22	1009.859079	0.009859079	0.009859079
+19	1000	23	1011.138879	0.011138879	0.011138879
+19	5000	0	4998.010127	-0.000397975	0.000397975
+19	5000	1	5163.946742	0.032789348	0.032789348
+19	5000	2	5093.987740	0.018797548	0.018797548
+19	5000	3	5021.794515	0.004358903	0.004358903
+19	5000	4	4930.805994	-0.013838801	0.013838801
+19	5000	5	4974.363051	-0.005127390	0.005127390
+19	5000	6	4970.996014	-0.005800797	0.005800797
+19	5000	7	5062.891850	0.012578370	0.012578370
+19	5000	8	4994.623603	-0.001075279	0.001075279
+19	5000	9	4987.858944	-0.002428211	0.002428211
+19	5000	10	4940.816590	-0.011836682	0.011836682
+19	5000	11	4960.911479	-0.007817704	0.007817704
+19	5000	12	5001.399453	0.000279891	0.000279891
+19	5000	13	4897.612944	-0.020477411	0.020477411
+19	5000	14	5014.984871	0.002996974	0.002996974
+19	5000	15	5021.794515	0.004358903	0.004358903
+19	5000	16	4991.239877	-0.001752025	0.001752025
+19	5000	17	5090.520960	0.018104192	0.018104192
+19	5000	18	4934.140142	-0.013171972	0.013171972
+19	5000	19	4914.175845	-0.017164831	0.017164831
+19	5000	20	4974.363051	-0.005127390	0.005127390
+19	5000	21	5059.451279	0.011890256	0.011890256
+19	5000	22	4914.175845	-0.017164831	0.017164831
+19	5000	23	4981.105439	-0.003778912	0.003778912
+19	10000	0	10075.476018	0.007547602	0.007547602
+19	10000	1	9749.421923	-0.025057808	0.025057808
+19	10000	2	10075.476018	0.007547602	0.007547602
+19	10000	3	9814.785012	-0.018521499	0.018521499
+19	10000	4	10267.136712	0.026713671	0.026713671
+19	10000	5	9749.421923	-0.025057808	0.025057808
+19	10000	6	9858.947165	-0.014105284	0.014105284
+19	10000	7	9892.384085	-0.010761591	0.010761591
+19	10000	8	9971.481716	-0.002851828	0.002851828
+19	10000	9	9994.364457	-0.000563554	0.000563554
+19	10000	10	9914.827977	-0.008517202	0.008517202
+19	10000	11	9825.780992	-0.017421901	0.017421901
+19	10000	12	10134.412287	0.013441229	0.013441229
+19	10000	13	9971.481716	-0.002851828	0.002851828
+19	10000	14	10267.136712	0.026713671	0.026713671
+19	10000	15	10017.375753	0.001737575	0.001737575
+19	10000	16	9632.233175	-0.036776682	0.036776682
+19	10000	17	9632.233175	-0.036776682	0.036776682
+19	10000	18	10170.185440	0.017018544	0.017018544
+19	10000	19	9881.208089	-0.011879191	0.011879191
+19	10000	20	10028.930063	0.002893006	0.002893006
+19	10000	21	10005.853945	0.000585395	0.000585395
+19	10000	22	10559.378451	0.055937845	0.055937845
+19	10000	23	10087.195626	0.008719563	0.008719563
+19	50000	0	49327.915664	-0.013441687	0.013441687
+19	50000	1	51223.969072	0.024479381	0.024479381
+19	50000	2	50250.340111	0.005006802	0.005006802
+19	50000	3	51197.625165	0.023952503	0.023952503
+19	50000	4	50862.374394	0.017247488	0.017247488
+19	50000	5	49463.073045	-0.010738539	0.010738539
+19	50000	6	50071.426638	0.001428533	0.001428533
+19	50000	7	50110.396891	0.002207938	0.002207938
+19	50000	8	51724.023737	0.034480475	0.034480475
+19	50000	9	50034.818663	0.000696373	0.000696373
+19	50000	10	49751.169971	-0.004976601	0.004976601
+19	50000	11	49329.055790	-0.013418884	0.013418884
+19	50000	12	51102.387544	0.022047751	0.022047751
+19	50000	13	50430.321832	0.008606437	0.008606437
+19	50000	14	49325.294187	-0.013494116	0.013494116
+19	50000	15	50055.060895	0.001101218	0.001101218
+19	50000	16	50554.483982	0.011089680	0.011089680
+19	50000	17	49666.965566	-0.006660689	0.006660689
+19	50000	18	50888.165302	0.017763306	0.017763306
+19	50000	19	49364.699409	-0.012706012	0.012706012
+19	50000	20	49613.156648	-0.007736867	0.007736867
+19	50000	21	51830.592452	0.036611849	0.036611849
+19	50000	22	50350.621702	0.007012434	0.007012434
+19	50000	23	50794.818832	0.015896377	0.015896377
diff --git a/developer-simulation/runs/2026-08-17--mergeable-unique-installation-reach-rollups/evidence/load-report.tsv b/developer-simulation/runs/2026-08-17--mergeable-unique-installation-reach-rollups/evidence/load-report.tsv
new file mode 100644
index 0000000..3012667
--- /dev/null
+++ b/developer-simulation/runs/2026-08-17--mergeable-unique-installation-reach-rollups/evidence/load-report.tsv
@@ -0,0 +1,5761 @@
+tenant_id	unix_hour	exact_count	estimate	signed_relative_error	absolute_relative_error	serialized_size
+0	0	1000	1008.579679	0.008579679	0.008579679	4124
+0	1	1000	993.257965	-0.006742035	0.006742035	4124
+0	2	1000	1011.138879	0.011138879	0.011138879	4124
+0	3	1000	1012.419079	0.012419079	0.012419079	4124
+0	4	1000	998.358838	-0.001641162	0.001641162	4124
+0	5	1000	984.346695	-0.015653305	0.015653305	4124
+0	6	1000	1004.743874	0.004743874	0.004743874	4124
+0	7	1000	1008.579679	0.008579679	0.008579679	4124
+0	8	1000	998.358838	-0.001641162	0.001641162	4124
+0	9	1000	1008.579679	0.008579679	0.008579679	4124
+0	10	1000	999.635049	-0.000364951	0.000364951	4124
+0	11	1000	1003.466070	0.003466070	0.003466070	4124
+0	12	1000	993.257965	-0.006742035	0.006742035	4124
+0	13	1000	1007.300678	0.007300678	0.007300678	4124
+0	14	1000	1012.419079	0.012419079	0.012419079	4124
+0	15	1000	1009.859079	0.009859079	0.009859079	4124
+0	16	1000	1002.188665	0.002188665	0.002188665	4124
+0	17	1000	1003.466070	0.003466070	0.003466070	4124
+0	18	1000	991.983739	-0.008016261	0.008016261	4124
+0	19	1000	995.807607	-0.004192393	0.004192393	4124
+0	20	5000	4894.308385	-0.021138323	0.021138323	4124
+0	21	5000	4934.140142	-0.013171972	0.013171972	4124
+0	22	5000	4937.477005	-0.012504599	0.012504599	4124
+0	23	10000	9881.208089	-0.011879191	0.011879191	4124
+1	0	1000	994.532588	-0.005467412	0.005467412	4124
+1	1	1000	999.635049	-0.000364951	0.000364951	4124
+1	2	1000	985.618547	-0.014381453	0.014381453	4124
+1	3	1000	1017.543884	0.017543884	0.017543884	4124
+1	4	1000	983.075238	-0.016924762	0.016924762	4124
+1	5	1000	1002.188665	0.002188665	0.002188665	4124
+1	6	1000	1000.911658	0.000911658	0.000911658	4124
+1	7	1000	1003.466070	0.003466070	0.003466070	4124
+1	8	1000	1018.826088	0.018826088	0.018826088	4124
+1	9	1000	1013.699680	0.013699680	0.013699680	4124
+1	10	1000	1002.188665	0.002188665	0.002188665	4124
+1	11	1000	980.533506	-0.019466494	0.019466494	4124
+1	12	1000	999.635049	-0.000364951	0.000364951	4124
+1	13	1000	1000.911658	0.000911658	0.000911658	4124
+1	14	1000	989.436475	-0.010563525	0.010563525	4124
+1	15	1000	999.635049	-0.000364951	0.000364951	4124
+1	16	1000	1007.300678	0.007300678	0.007300678	4124
+1	17	1000	1009.859079	0.009859079	0.009859079	4124
+1	18	1000	1002.188665	0.002188665	0.002188665	4124
+1	19	1000	1008.579679	0.008579679	0.008579679	4124
+1	20	5000	4974.363051	-0.005127390	0.005127390	4124
+1	21	5000	4950.851711	-0.009829658	0.009829658	4124
+1	22	5000	4900.920170	-0.019815966	0.019815966	4124
+1	23	10000	10098.948862	0.009894886	0.009894886	4124
+2	0	1000	993.257965	-0.006742035	0.006742035	4124
+2	1	1000	1006.022077	0.006022077	0.006022077	4124
+2	2	1000	990.709909	-0.009290091	0.009290091	4124
+2	3	1000	1002.188665	0.002188665	0.002188665	4124
+2	4	1000	997.083024	-0.002916976	0.002916976	4124
+2	5	1000	989.436475	-0.010563525	0.010563525	4124
+2	6	1000	999.635049	-0.000364951	0.000364951	4124
+2	7	1000	1009.859079	0.009859079	0.009859079	4124
+2	8	1000	1004.743874	0.004743874	0.004743874	4124
+2	9	1000	1011.138879	0.011138879	0.011138879	4124
+2	10	1000	1007.300678	0.007300678	0.007300678	4124
+2	11	1000	997.083024	-0.002916976	0.002916976	4124
+2	12	1000	1020.108694	0.020108694	0.020108694	4124
+2	13	1000	994.532588	-0.005467412	0.005467412	4124
+2	14	1000	983.075238	-0.016924762	0.016924762	4124
+2	15	1000	1002.188665	0.002188665	0.002188665	4124
+2	16	1000	1009.859079	0.009859079	0.009859079	4124
+2	17	1000	1002.188665	0.002188665	0.002188665	4124
+2	18	1000	1000.911658	0.000911658	0.000911658	4124
+2	19	1000	999.635049	-0.000364951	0.000364951	4124
+2	20	5000	5049.146871	0.009829374	0.009829374	4124
+2	21	5000	5035.447861	0.007089572	0.007089572	4124
+2	22	5000	4934.140142	-0.013171972	0.013171972	4124
+2	23	10000	9870.062504	-0.012993750	0.012993750	4124
+3	0	1000	990.709909	-0.009290091	0.009290091	4124
+3	1	1000	994.532588	-0.005467412	0.005467412	4124
+3	2	1000	1011.138879	0.011138879	0.011138879	4124
+3	3	1000	1009.859079	0.009859079	0.009859079	4124
+3	4	1000	1017.543884	0.017543884	0.017543884	4124
+3	5	1000	985.618547	-0.014381453	0.014381453	4124
+3	6	1000	995.807607	-0.004192393	0.004192393	4124
+3	7	1000	997.083024	-0.002916976	0.002916976	4124
+3	8	1000	1002.188665	0.002188665	0.002188665	4124
+3	9	1000	995.807607	-0.004192393	0.004192393	4124
+3	10	1000	985.618547	-0.014381453	0.014381453	4124
+3	11	1000	994.532588	-0.005467412	0.005467412	4124
+3	12	1000	1000.911658	0.000911658	0.000911658	4124
+3	13	1000	997.083024	-0.002916976	0.002916976	4124
+3	14	1000	1002.188665	0.002188665	0.002188665	4124
+3	15	1000	993.257965	-0.006742035	0.006742035	4124
+3	16	1000	1009.859079	0.009859079	0.009859079	4124
+3	17	1000	1009.859079	0.009859079	0.009859079	4124
+3	18	1000	1003.466070	0.003466070	0.003466070	4124
+3	19	1000	1003.466070	0.003466070	0.003466070	4124
+3	20	5000	4994.623603	-0.001075279	0.001075279	4124
+3	21	5000	4835.277740	-0.032944452	0.032944452	4124
+3	22	5000	4920.819805	-0.015836039	0.015836039	4124
+3	23	10000	9870.062504	-0.012993750	0.012993750	4124
+4	0	1000	1014.980680	0.014980680	0.014980680	4124
+4	1	1000	1000.911658	0.000911658	0.000911658	4124
+4	2	1000	1004.743874	0.004743874	0.004743874	4124
+4	3	1000	1003.466070	0.003466070	0.003466070	4124
+4	4	1000	1009.859079	0.009859079	0.009859079	4124
+4	5	1000	997.083024	-0.002916976	0.002916976	4124
+4	6	1000	995.807607	-0.004192393	0.004192393	4124
+4	7	1000	1003.466070	0.003466070	0.003466070	4124
+4	8	1000	1014.980680	0.014980680	0.014980680	4124
+4	9	1000	1000.911658	0.000911658	0.000911658	4124
+4	10	1000	983.075238	-0.016924762	0.016924762	4124
+4	11	1000	1006.022077	0.006022077	0.006022077	4124
+4	12	1000	993.257965	-0.006742035	0.006742035	4124
+4	13	1000	986.890795	-0.013109205	0.013109205	4124
+4	14	1000	983.075238	-0.016924762	0.016924762	4124
+4	15	1000	998.358838	-0.001641162	0.001641162	4124
+4	16	1000	988.163437	-0.011836563	0.011836563	4124
+4	17	1000	997.083024	-0.002916976	0.002916976	4124
+4	18	1000	1009.859079	0.009859079	0.009859079	4124
+4	19	1000	1000.911658	0.000911658	0.000911658	4124
+4	20	5000	5011.584290	0.002316858	0.002316858	4124
+4	21	5000	5011.584290	0.002316858	0.002316858	4124
+4	22	5000	4924.145830	-0.015170834	0.015170834	4124
+4	23	10000	10005.853945	0.000585395	0.000585395	4124
+5	0	1000	1007.300678	0.007300678	0.007300678	4124
+5	1	1000	1006.022077	0.006022077	0.006022077	4124
+5	2	1000	1003.466070	0.003466070	0.003466070	4124
+5	3	1000	1008.579679	0.008579679	0.008579679	4124
+5	4	1000	993.257965	-0.006742035	0.006742035	4124
+5	5	1000	1007.300678	0.007300678	0.007300678	4124
+5	6	1000	997.083024	-0.002916976	0.002916976	4124
+5	7	1000	1004.743874	0.004743874	0.004743874	4124
+5	8	1000	1009.859079	0.009859079	0.009859079	4124
+5	9	1000	985.618547	-0.014381453	0.014381453	4124
+5	10	1000	989.436475	-0.010563525	0.010563525	4124
+5	11	1000	1009.859079	0.009859079	0.009859079	4124
+5	12	1000	991.983739	-0.008016261	0.008016261	4124
+5	13	1000	981.804175	-0.018195825	0.018195825	4124
+5	14	1000	995.807607	-0.004192393	0.004192393	4124
+5	15	1000	1025.243135	0.025243135	0.025243135	4124
+5	16	1000	1008.579679	0.008579679	0.008579679	4124
+5	17	1000	989.436475	-0.010563525	0.010563525	4124
+5	18	1000	965.316151	-0.034683849	0.034683849	4124
+5	19	1000	975.454771	-0.024545229	0.024545229	4124
+5	20	5000	4934.140142	-0.013171972	0.013171972	4124
+5	21	5000	5087.057112	0.017411422	0.017411422	4124
+5	22	5000	4987.858944	-0.002428211	0.002428211	4124
+5	23	10000	10017.375753	0.001737575	0.001737575	4124
+6	0	1000	1000.911658	0.000911658	0.000911658	4124
+6	1	1000	995.807607	-0.004192393	0.004192393	4124
+6	2	1000	981.804175	-0.018195825	0.018195825	4124
+6	3	1000	976.723864	-0.023276136	0.023276136	4124
+6	4	1000	1016.262082	0.016262082	0.016262082	4124
+6	5	1000	999.635049	-0.000364951	0.000364951	4124
+6	6	1000	1004.743874	0.004743874	0.004743874	4124
+6	7	1000	1009.859079	0.009859079	0.009859079	4124
+6	8	1000	1020.108694	0.020108694	0.020108694	4124
+6	9	1000	1002.188665	0.002188665	0.002188665	4124
+6	10	1000	991.983739	-0.008016261	0.008016261	4124
+6	11	1000	1014.980680	0.014980680	0.014980680	4124
+6	12	1000	997.083024	-0.002916976	0.002916976	4124
+6	13	1000	980.533506	-0.019466494	0.019466494	4124
+6	14	1000	1000.911658	0.000911658	0.000911658	4124
+6	15	1000	1007.300678	0.007300678	0.007300678	4124
+6	16	1000	980.533506	-0.019466494	0.019466494	4124
+6	17	1000	995.807607	-0.004192393	0.004192393	4124
+6	18	1000	1011.138879	0.011138879	0.011138879	4124
+6	19	1000	989.436475	-0.010563525	0.010563525	4124
+6	20	5000	5042.291639	0.008458328	0.008458328	4124
+6	21	5000	5028.615500	0.005723100	0.005723100	4124
+6	22	5000	4977.732858	-0.004453428	0.004453428	4124
+6	23	10000	10110.735920	0.011073592	0.011073592	4124
+7	0	1000	999.635049	-0.000364951	0.000364951	4124
+7	1	1000	985.618547	-0.014381453	0.014381453	4124
+7	2	1000	1003.466070	0.003466070	0.003466070	4124
+7	3	1000	997.083024	-0.002916976	0.002916976	4124
+7	4	1000	999.635049	-0.000364951	0.000364951	4124
+7	5	1000	988.163437	-0.011836563	0.011836563	4124
+7	6	1000	1002.188665	0.002188665	0.002188665	4124
+7	7	1000	995.807607	-0.004192393	0.004192393	4124
+7	8	1000	994.532588	-0.005467412	0.005467412	4124
+7	9	1000	1013.699680	0.013699680	0.013699680	4124
+7	10	1000	1002.188665	0.002188665	0.002188665	4124
+7	11	1000	985.618547	-0.014381453	0.014381453	4124
+7	12	1000	997.083024	-0.002916976	0.002916976	4124
+7	13	1000	1021.391701	0.021391701	0.021391701	4124
+7	14	1000	1008.579679	0.008579679	0.008579679	4124
+7	15	1000	1002.188665	0.002188665	0.002188665	4124
+7	16	1000	1004.743874	0.004743874	0.004743874	4124
+7	17	1000	974.186070	-0.025813930	0.025813930	4124
+7	18	1000	986.890795	-0.013109205	0.013109205	4124
+7	19	1000	985.618547	-0.014381453	0.014381453	4124
+7	20	5000	4927.474558	-0.014505088	0.014505088	4124
+7	21	5000	4981.105439	-0.003778912	0.003778912	4124
+7	22	5000	4891.006491	-0.021798702	0.021798702	4124
+7	23	10000	9937.395527	-0.006260447	0.006260447	4124
+8	0	1000	977.993351	-0.022006649	0.022006649	4124
+8	1	1000	1008.579679	0.008579679	0.008579679	4124
+8	2	1000	1000.911658	0.000911658	0.000911658	4124
+8	3	1000	1009.859079	0.009859079	0.009859079	4124
+8	4	1000	999.635049	-0.000364951	0.000364951	4124
+8	5	1000	997.083024	-0.002916976	0.002916976	4124
+8	6	1000	977.993351	-0.022006649	0.022006649	4124
+8	7	1000	977.993351	-0.022006649	0.022006649	4124
+8	8	1000	990.709909	-0.009290091	0.009290091	4124
+8	9	1000	1000.911658	0.000911658	0.000911658	4124
+8	10	1000	984.346695	-0.015653305	0.015653305	4124
+8	11	1000	993.257965	-0.006742035	0.006742035	4124
+8	12	1000	989.436475	-0.010563525	0.010563525	4124
+8	13	1000	1013.699680	0.013699680	0.013699680	4124
+8	14	1000	993.257965	-0.006742035	0.006742035	4124
+8	15	1000	997.083024	-0.002916976	0.002916976	4124
+8	16	1000	988.163437	-0.011836563	0.011836563	4124
+8	17	1000	993.257965	-0.006742035	0.006742035	4124
+8	18	1000	991.983739	-0.008016261	0.008016261	4124
+8	19	1000	1011.138879	0.011138879	0.011138879	4124
+8	20	5000	4977.732858	-0.004453428	0.004453428	4124
+8	21	5000	4964.270233	-0.007145953	0.007145953	4124
+8	22	5000	4934.140142	-0.013171972	0.013171972	4124
+8	23	10000	10063.789848	0.006378985	0.006378985	4124
+9	0	1000	998.358838	-0.001641162	0.001641162	4124
+9	1	1000	999.635049	-0.000364951	0.000364951	4124
+9	2	1000	1002.188665	0.002188665	0.002188665	4124
+9	3	1000	1002.188665	0.002188665	0.002188665	4124
+9	4	1000	1000.911658	0.000911658	0.000911658	4124
+9	5	1000	977.993351	-0.022006649	0.022006649	4124
+9	6	1000	1022.675110	0.022675110	0.022675110	4124
+9	7	1000	993.257965	-0.006742035	0.006742035	4124
+9	8	1000	1004.743874	0.004743874	0.004743874	4124
+9	9	1000	994.532588	-0.005467412	0.005467412	4124
+9	10	1000	1000.911658	0.000911658	0.000911658	4124
+9	11	1000	1000.911658	0.000911658	0.000911658	4124
+9	12	1000	998.358838	-0.001641162	0.001641162	4124
+9	13	1000	1002.188665	0.002188665	0.002188665	4124
+9	14	1000	971.649847	-0.028350153	0.028350153	4124
+9	15	1000	1013.699680	0.013699680	0.013699680	4124
+9	16	1000	998.358838	-0.001641162	0.001641162	4124
+9	17	1000	995.807607	-0.004192393	0.004192393	4124
+9	18	1000	997.083024	-0.002916976	0.002916976	4124
+9	19	1000	1003.466070	0.003466070	0.003466070	4124
+9	20	5000	4920.819805	-0.015836039	0.015836039	4124
+9	21	5000	4934.140142	-0.013171972	0.013171972	4124
+9	22	5000	5035.447861	0.007089572	0.007089572	4124
+9	23	10000	9858.947165	-0.014105284	0.014105284	4124
+10	0	1000	1011.138879	0.011138879	0.011138879	4124
+10	1	1000	1008.579679	0.008579679	0.008579679	4124
+10	2	1000	1008.579679	0.008579679	0.008579679	4124
+10	3	1000	999.635049	-0.000364951	0.000364951	4124
+10	4	1000	998.358838	-0.001641162	0.001641162	4124
+10	5	1000	1012.419079	0.012419079	0.012419079	4124
+10	6	1000	993.257965	-0.006742035	0.006742035	4124
+10	7	1000	995.807607	-0.004192393	0.004192393	4124
+10	8	1000	1009.859079	0.009859079	0.009859079	4124
+10	9	1000	998.358838	-0.001641162	0.001641162	4124
+10	10	1000	1011.138879	0.011138879	0.011138879	4124
+10	11	1000	994.532588	-0.005467412	0.005467412	4124
+10	12	1000	1009.859079	0.009859079	0.009859079	4124
+10	13	1000	984.346695	-0.015653305	0.015653305	4124
+10	14	1000	976.723864	-0.023276136	0.023276136	4124
+10	15	1000	1021.391701	0.021391701	0.021391701	4124
+10	16	1000	1003.466070	0.003466070	0.003466070	4124
+10	17	1000	967.848454	-0.032151546	0.032151546	4124
+10	18	1000	1003.466070	0.003466070	0.003466070	4124
+10	19	1000	989.436475	-0.010563525	0.010563525	4124
+10	20	5000	5042.291639	0.008458328	0.008458328	4124
+10	21	5000	4981.105439	-0.003778912	0.003778912	4124
+10	22	5000	5028.615500	0.005723100	0.005723100	4124
+10	23	10000	9738.628768	-0.026137123	0.026137123	4124
+11	0	1000	995.807607	-0.004192393	0.004192393	4124
+11	1	1000	1007.300678	0.007300678	0.007300678	4124
+11	2	1000	998.358838	-0.001641162	0.001641162	4124
+11	3	1000	1006.022077	0.006022077	0.006022077	4124
+11	4	1000	995.807607	-0.004192393	0.004192393	4124
+11	5	1000	998.358838	-0.001641162	0.001641162	4124
+11	6	1000	999.635049	-0.000364951	0.000364951	4124
+11	7	1000	1014.980680	0.014980680	0.014980680	4124
+11	8	1000	993.257965	-0.006742035	0.006742035	4124
+11	9	1000	1004.743874	0.004743874	0.004743874	4124
+11	10	1000	990.709909	-0.009290091	0.009290091	4124
+11	11	1000	997.083024	-0.002916976	0.002916976	4124
+11	12	1000	1002.188665	0.002188665	0.002188665	4124
+11	13	1000	984.346695	-0.015653305	0.015653305	4124
+11	14	1000	1014.980680	0.014980680	0.014980680	4124
+11	15	1000	990.709909	-0.009290091	0.009290091	4124
+11	16	1000	1016.262082	0.016262082	0.016262082	4124
+11	17	1000	995.807607	-0.004192393	0.004192393	4124
+11	18	1000	1007.300678	0.007300678	0.007300678	4124
+11	19	1000	991.983739	-0.008016261	0.008016261	4124
+11	20	5000	4947.503938	-0.010499212	0.010499212	4124
+11	21	5000	5021.794515	0.004358903	0.004358903	4124
+11	22	5000	5056.013595	0.011202719	0.011202719	4124
+11	23	10000	9937.395527	-0.006260447	0.006260447	4124
+12	0	1000	1030.384020	0.030384020	0.030384020	4124
+12	1	1000	1000.911658	0.000911658	0.000911658	4124
+12	2	1000	986.890795	-0.013109205	0.013109205	4124
+12	3	1000	983.075238	-0.016924762	0.016924762	4124
+12	4	1000	998.358838	-0.001641162	0.001641162	4124
+12	5	1000	989.436475	-0.010563525	0.010563525	4124
+12	6	1000	999.635049	-0.000364951	0.000364951	4124
+12	7	1000	1000.911658	0.000911658	0.000911658	4124
+12	8	1000	999.635049	-0.000364951	0.000364951	4124
+12	9	1000	991.983739	-0.008016261	0.008016261	4124
+12	10	1000	1008.579679	0.008579679	0.008579679	4124
+12	11	1000	988.163437	-0.011836563	0.011836563	4124
+12	12	1000	1018.826088	0.018826088	0.018826088	4124
+12	13	1000	1006.022077	0.006022077	0.006022077	4124
+12	14	1000	991.983739	-0.008016261	0.008016261	4124
+12	15	1000	1000.911658	0.000911658	0.000911658	4124
+12	16	1000	1017.543884	0.017543884	0.017543884	4124
+12	17	1000	999.635049	-0.000364951	0.000364951	4124
+12	18	1000	995.807607	-0.004192393	0.004192393	4124
+12	19	1000	998.358838	-0.001641162	0.001641162	4124
+12	20	5000	4904.230070	-0.019153986	0.019153986	4124
+12	21	5000	4998.010127	-0.000397975	0.000397975	4124
+12	22	5000	5083.596191	0.016719238	0.016719238	4124
+12	23	10000	10291.737386	0.029173739	0.029173739	4124
+13	0	1000	979.263232	-0.020736768	0.020736768	4124
+13	1	1000	998.358838	-0.001641162	0.001641162	4124
+13	2	1000	1000.911658	0.000911658	0.000911658	4124
+13	3	1000	993.257965	-0.006742035	0.006742035	4124
+13	4	1000	1000.911658	0.000911658	0.000911658	4124
+13	5	1000	1006.022077	0.006022077	0.006022077	4124
+13	6	1000	1020.108694	0.020108694	0.020108694	4124
+13	7	1000	1017.543884	0.017543884	0.017543884	4124
+13	8	1000	995.807607	-0.004192393	0.004192393	4124
+13	9	1000	983.075238	-0.016924762	0.016924762	4124
+13	10	1000	995.807607	-0.004192393	0.004192393	4124
+13	11	1000	989.436475	-0.010563525	0.010563525	4124
+13	12	1000	1007.300678	0.007300678	0.007300678	4124
+13	13	1000	991.983739	-0.008016261	0.008016261	4124
+13	14	1000	1012.419079	0.012419079	0.012419079	4124
+13	15	1000	1007.300678	0.007300678	0.007300678	4124
+13	16	1000	1029.098194	0.029098194	0.029098194	4124
+13	17	1000	991.983739	-0.008016261	0.008016261	4124
+13	18	1000	999.635049	-0.000364951	0.000364951	4124
+13	19	1000	1004.743874	0.004743874	0.004743874	4124
+13	20	5000	5090.520960	0.018104192	0.018104192	4124
+13	21	5000	5100.930114	0.020186023	0.020186023	4124
+13	22	5000	4998.010127	-0.000397975	0.000397975	4124
+13	23	10000	9903.590659	-0.009640934	0.009640934	4124
+14	0	1000	981.804175	-0.018195825	0.018195825	4124
+14	1	1000	1003.466070	0.003466070	0.003466070	4124
+14	2	1000	972.917762	-0.027082238	0.027082238	4124
+14	3	1000	1002.188665	0.002188665	0.002188665	4124
+14	4	1000	995.807607	-0.004192393	0.004192393	4124
+14	5	1000	997.083024	-0.002916976	0.002916976	4124
+14	6	1000	995.807607	-0.004192393	0.004192393	4124
+14	7	1000	980.533506	-0.019466494	0.019466494	4124
+14	8	1000	979.263232	-0.020736768	0.020736768	4124
+14	9	1000	983.075238	-0.016924762	0.016924762	4124
+14	10	1000	985.618547	-0.014381453	0.014381453	4124
+14	11	1000	1004.743874	0.004743874	0.004743874	4124
+14	12	1000	993.257965	-0.006742035	0.006742035	4124
+14	13	1000	993.257965	-0.006742035	0.006742035	4124
+14	14	1000	984.346695	-0.015653305	0.015653305	4124
+14	15	1000	995.807607	-0.004192393	0.004192393	4124
+14	16	1000	1011.138879	0.011138879	0.011138879	4124
+14	17	1000	994.532588	-0.005467412	0.005467412	4124
+14	18	1000	988.163437	-0.011836563	0.011836563	4124
+14	19	1000	1002.188665	0.002188665	0.002188665	4124
+14	20	5000	4924.145830	-0.015170834	0.015170834	4124
+14	21	5000	5104.405719	0.020881144	0.020881144	4124
+14	22	5000	4940.816590	-0.011836682	0.011836682	4124
+14	23	10000	9749.421923	-0.025057808	0.025057808	4124
+15	0	1000	999.635049	-0.000364951	0.000364951	4124
+15	1	1000	1011.138879	0.011138879	0.011138879	4124
+15	2	1000	1003.466070	0.003466070	0.003466070	4124
+15	3	1000	991.983739	-0.008016261	0.008016261	4124
+15	4	1000	1008.579679	0.008579679	0.008579679	4124
+15	5	1000	998.358838	-0.001641162	0.001641162	4124
+15	6	1000	1011.138879	0.011138879	0.011138879	4124
+15	7	1000	984.346695	-0.015653305	0.015653305	4124
+15	8	1000	993.257965	-0.006742035	0.006742035	4124
+15	9	1000	1004.743874	0.004743874	0.004743874	4124
+15	10	1000	1002.188665	0.002188665	0.002188665	4124
+15	11	1000	1003.466070	0.003466070	0.003466070	4124
+15	12	1000	1011.138879	0.011138879	0.011138879	4124
+15	13	1000	1017.543884	0.017543884	0.017543884	4124
+15	14	1000	1000.911658	0.000911658	0.000911658	4124
+15	15	1000	990.709909	-0.009290091	0.009290091	4124
+15	16	1000	977.993351	-0.022006649	0.022006649	4124
+15	17	1000	1009.859079	0.009859079	0.009859079	4124
+15	18	1000	988.163437	-0.011836563	0.011836563	4124
+15	19	1000	1026.527751	0.026527751	0.026527751	4124
+15	20	5000	4977.732858	-0.004453428	0.004453428	4124
+15	21	5000	4957.555477	-0.008488905	0.008488905	4124
+15	22	5000	5008.186530	0.001637306	0.001637306	4124
+15	23	10000	10230.510536	0.023051054	0.023051054	4124
+16	0	1000	999.635049	-0.000364951	0.000364951	4124
+16	1	1000	998.358838	-0.001641162	0.001641162	4124
+16	2	1000	980.533506	-0.019466494	0.019466494	4124
+16	3	1000	1009.859079	0.009859079	0.009859079	4124
+16	4	1000	1014.980680	0.014980680	0.014980680	4124
+16	5	1000	1004.743874	0.004743874	0.004743874	4124
+16	6	1000	1012.419079	0.012419079	0.012419079	4124
+16	7	1000	981.804175	-0.018195825	0.018195825	4124
+16	8	1000	995.807607	-0.004192393	0.004192393	4124
+16	9	1000	985.618547	-0.014381453	0.014381453	4124
+16	10	1000	1008.579679	0.008579679	0.008579679	4124
+16	11	1000	1000.911658	0.000911658	0.000911658	4124
+16	12	1000	1007.300678	0.007300678	0.007300678	4124
+16	13	1000	1000.911658	0.000911658	0.000911658	4124
+16	14	1000	1004.743874	0.004743874	0.004743874	4124
+16	15	1000	1007.300678	0.007300678	0.007300678	4124
+16	16	1000	1012.419079	0.012419079	0.012419079	4124
+16	17	1000	1000.911658	0.000911658	0.000911658	4124
+16	18	1000	994.532588	-0.005467412	0.005467412	4124
+16	19	1000	977.993351	-0.022006649	0.022006649	4124
+16	20	5000	5025.203588	0.005040718	0.005040718	4124
+16	21	5000	4994.623603	-0.001075279	0.001075279	4124
+16	22	5000	4998.010127	-0.000397975	0.000397975	4124
+16	23	10000	9836.806570	-0.016319343	0.016319343	4124
+17	0	1000	994.532588	-0.005467412	0.005467412	4124
+17	1	1000	1018.826088	0.018826088	0.018826088	4124
+17	2	1000	998.358838	-0.001641162	0.001641162	4124
+17	3	1000	1016.262082	0.016262082	0.016262082	4124
+17	4	1000	1011.138879	0.011138879	0.011138879	4124
+17	5	1000	1003.466070	0.003466070	0.003466070	4124
+17	6	1000	1009.859079	0.009859079	0.009859079	4124
+17	7	1000	1007.300678	0.007300678	0.007300678	4124
+17	8	1000	1000.911658	0.000911658	0.000911658	4124
+17	9	1000	1004.743874	0.004743874	0.004743874	4124
+17	10	1000	1007.300678	0.007300678	0.007300678	4124
+17	11	1000	984.346695	-0.015653305	0.015653305	4124
+17	12	1000	1014.980680	0.014980680	0.014980680	4124
+17	13	1000	994.532588	-0.005467412	0.005467412	4124
+17	14	1000	1011.138879	0.011138879	0.011138879	4124
+17	15	1000	981.804175	-0.018195825	0.018195825	4124
+17	16	1000	1002.188665	0.002188665	0.002188665	4124
+17	17	1000	999.635049	-0.000364951	0.000364951	4124
+17	18	1000	1008.579679	0.008579679	0.008579679	4124
+17	19	1000	994.532588	-0.005467412	0.005467412	4124
+17	20	5000	5038.868321	0.007773664	0.007773664	4124
+17	21	5000	4987.858944	-0.002428211	0.002428211	4124
+17	22	5000	5139.324942	0.027864988	0.027864988	4124
+17	23	10000	9858.947165	-0.014105284	0.014105284	4124
+18	0	1000	1000.911658	0.000911658	0.000911658	4124
+18	1	1000	998.358838	-0.001641162	0.001641162	4124
+18	2	1000	1007.300678	0.007300678	0.007300678	4124
+18	3	1000	1018.826088	0.018826088	0.018826088	4124
+18	4	1000	1011.138879	0.011138879	0.011138879	4124
+18	5	1000	998.358838	-0.001641162	0.001641162	4124
+18	6	1000	985.618547	-0.014381453	0.014381453	4124
+18	7	1000	986.890795	-0.013109205	0.013109205	4124
+18	8	1000	1007.300678	0.007300678	0.007300678	4124
+18	9	1000	1014.980680	0.014980680	0.014980680	4124
+18	10	1000	967.848454	-0.032151546	0.032151546	4124
+18	11	1000	999.635049	-0.000364951	0.000364951	4124
+18	12	1000	1000.911658	0.000911658	0.000911658	4124
+18	13	1000	993.257965	-0.006742035	0.006742035	4124
+18	14	1000	1009.859079	0.009859079	0.009859079	4124
+18	15	1000	1000.911658	0.000911658	0.000911658	4124
+18	16	1000	1006.022077	0.006022077	0.006022077	4124
+18	17	1000	1007.300678	0.007300678	0.007300678	4124
+18	18	1000	997.083024	-0.002916976	0.002916976	4124
+18	19	1000	1003.466070	0.003466070	0.003466070	4124
+18	20	5000	4934.140142	-0.013171972	0.013171972	4124
+18	21	5000	5008.186530	0.001637306	0.001637306	4124
+18	22	5000	5080.138191	0.016027638	0.016027638	4124
+18	23	10000	9792.881217	-0.020711878	0.020711878	4124
+19	0	1000	984.346695	-0.015653305	0.015653305	4124
+19	1	1000	990.709909	-0.009290091	0.009290091	4124
+19	2	1000	990.709909	-0.009290091	0.009290091	4124
+19	3	1000	1020.108694	0.020108694	0.020108694	4124
+19	4	1000	999.635049	-0.000364951	0.000364951	4124
+19	5	1000	1003.466070	0.003466070	0.003466070	4124
+19	6	1000	980.533506	-0.019466494	0.019466494	4124
+19	7	1000	999.635049	-0.000364951	0.000364951	4124
+19	8	1000	1003.466070	0.003466070	0.003466070	4124
+19	9	1000	1007.300678	0.007300678	0.007300678	4124
+19	10	1000	1000.911658	0.000911658	0.000911658	4124
+19	11	1000	986.890795	-0.013109205	0.013109205	4124
+19	12	1000	994.532588	-0.005467412	0.005467412	4124
+19	13	1000	1016.262082	0.016262082	0.016262082	4124
+19	14	1000	993.257965	-0.006742035	0.006742035	4124
+19	15	1000	990.709909	-0.009290091	0.009290091	4124
+19	16	1000	998.358838	-0.001641162	0.001641162	4124
+19	17	1000	1004.743874	0.004743874	0.004743874	4124
+19	18	1000	1006.022077	0.006022077	0.006022077	4124
+19	19	1000	1003.466070	0.003466070	0.003466070	4124
+19	20	5000	4867.967458	-0.026406508	0.026406508	4124
+19	21	5000	5011.584290	0.002316858	0.002316858	4124
+19	22	5000	5035.447861	0.007089572	0.007089572	4124
+19	23	10000	9685.085522	-0.031491448	0.031491448	4124
+20	0	1000	995.807607	-0.004192393	0.004192393	4124
+20	1	1000	988.163437	-0.011836563	0.011836563	4124
+20	2	1000	984.346695	-0.015653305	0.015653305	4124
+20	3	1000	1013.699680	0.013699680	0.013699680	4124
+20	4	1000	984.346695	-0.015653305	0.015653305	4124
+20	5	1000	1009.859079	0.009859079	0.009859079	4124
+20	6	1000	1003.466070	0.003466070	0.003466070	4124
+20	7	1000	995.807607	-0.004192393	0.004192393	4124
+20	8	1000	1007.300678	0.007300678	0.007300678	4124
+20	9	1000	991.983739	-0.008016261	0.008016261	4124
+20	10	1000	1002.188665	0.002188665	0.002188665	4124
+20	11	1000	1012.419079	0.012419079	0.012419079	4124
+20	12	1000	1004.743874	0.004743874	0.004743874	4124
+20	13	1000	990.709909	-0.009290091	0.009290091	4124
+20	14	1000	971.649847	-0.028350153	0.028350153	4124
+20	15	1000	1003.466070	0.003466070	0.003466070	4124
+20	16	1000	974.186070	-0.025813930	0.025813930	4124
+20	17	1000	1014.980680	0.014980680	0.014980680	4124
+20	18	1000	988.163437	-0.011836563	0.011836563	4124
+20	19	1000	1012.419079	0.012419079	0.012419079	4124
+20	20	5000	4960.911479	-0.007817704	0.007817704	4124
+20	21	5000	4960.911479	-0.007817704	0.007817704	4124
+20	22	5000	5052.578794	0.010515759	0.010515759	4124
+20	23	10000	10052.136924	0.005213692	0.005213692	4124
+21	0	1000	988.163437	-0.011836563	0.011836563	4124
+21	1	1000	993.257965	-0.006742035	0.006742035	4124
+21	2	1000	1008.579679	0.008579679	0.008579679	4124
+21	3	1000	1003.466070	0.003466070	0.003466070	4124
+21	4	1000	997.083024	-0.002916976	0.002916976	4124
+21	5	1000	995.807607	-0.004192393	0.004192393	4124
+21	6	1000	991.983739	-0.008016261	0.008016261	4124
+21	7	1000	983.075238	-0.016924762	0.016924762	4124
+21	8	1000	995.807607	-0.004192393	0.004192393	4124
+21	9	1000	991.983739	-0.008016261	0.008016261	4124
+21	10	1000	995.807607	-0.004192393	0.004192393	4124
+21	11	1000	980.533506	-0.019466494	0.019466494	4124
+21	12	1000	991.983739	-0.008016261	0.008016261	4124
+21	13	1000	999.635049	-0.000364951	0.000364951	4124
+21	14	1000	1000.911658	0.000911658	0.000911658	4124
+21	15	1000	994.532588	-0.005467412	0.005467412	4124
+21	16	1000	985.618547	-0.014381453	0.014381453	4124
+21	17	1000	998.358838	-0.001641162	0.001641162	4124
+21	18	1000	983.075238	-0.016924762	0.016924762	4124
+21	19	1000	984.346695	-0.015653305	0.015653305	4124
+21	20	5000	5181.624801	0.036324960	0.036324960	4124
+21	21	5000	5056.013595	0.011202719	0.011202719	4124
+21	22	5000	4984.480800	-0.003103840	0.003103840	4124
+21	23	10000	10017.375753	0.001737575	0.001737575	4124
+22	0	1000	998.358838	-0.001641162	0.001641162	4124
+22	1	1000	976.723864	-0.023276136	0.023276136	4124
+22	2	1000	1009.859079	0.009859079	0.009859079	4124
+22	3	1000	1009.859079	0.009859079	0.009859079	4124
+22	4	1000	985.618547	-0.014381453	0.014381453	4124
+22	5	1000	1021.391701	0.021391701	0.021391701	4124
+22	6	1000	1007.300678	0.007300678	0.007300678	4124
+22	7	1000	997.083024	-0.002916976	0.002916976	4124
+22	8	1000	1002.188665	0.002188665	0.002188665	4124
+22	9	1000	1020.108694	0.020108694	0.020108694	4124
+22	10	1000	998.358838	-0.001641162	0.001641162	4124
+22	11	1000	994.532588	-0.005467412	0.005467412	4124
+22	12	1000	1006.022077	0.006022077	0.006022077	4124
+22	13	1000	1002.188665	0.002188665	0.002188665	4124
+22	14	1000	981.804175	-0.018195825	0.018195825	4124
+22	15	1000	998.358838	-0.001641162	0.001641162	4124
+22	16	1000	979.263232	-0.020736768	0.020736768	4124
+22	17	1000	986.890795	-0.013109205	0.013109205	4124
+22	18	1000	1007.300678	0.007300678	0.007300678	4124
+22	19	1000	995.807607	-0.004192393	0.004192393	4124
+22	20	5000	5018.388278	0.003677656	0.003677656	4124
+22	21	5000	5032.030256	0.006406051	0.006406051	4124
+22	22	5000	4974.363051	-0.005127390	0.005127390	4124
+22	23	10000	10206.273779	0.020627378	0.020627378	4124
+23	0	1000	1009.859079	0.009859079	0.009859079	4124
+23	1	1000	989.436475	-0.010563525	0.010563525	4124
+23	2	1000	1003.466070	0.003466070	0.003466070	4124
+23	3	1000	975.454771	-0.024545229	0.024545229	4124
+23	4	1000	1011.138879	0.011138879	0.011138879	4124
+23	5	1000	1022.675110	0.022675110	0.022675110	4124
+23	6	1000	1007.300678	0.007300678	0.007300678	4124
+23	7	1000	1008.579679	0.008579679	0.008579679	4124
+23	8	1000	1002.188665	0.002188665	0.002188665	4124
+23	9	1000	1003.466070	0.003466070	0.003466070	4124
+23	10	1000	991.983739	-0.008016261	0.008016261	4124
+23	11	1000	974.186070	-0.025813930	0.025813930	4124
+23	12	1000	985.618547	-0.014381453	0.014381453	4124
+23	13	1000	994.532588	-0.005467412	0.005467412	4124
+23	14	1000	1004.743874	0.004743874	0.004743874	4124
+23	15	1000	1007.300678	0.007300678	0.007300678	4124
+23	16	1000	1021.391701	0.021391701	0.021391701	4124
+23	17	1000	1021.391701	0.021391701	0.021391701	4124
+23	18	1000	993.257965	-0.006742035	0.006742035	4124
+23	19	1000	998.358838	-0.001641162	0.001641162	4124
+23	20	5000	5008.186530	0.001637306	0.001637306	4124
+23	21	5000	5014.984871	0.002996974	0.002996974	4124
+23	22	5000	5028.615500	0.005723100	0.005723100	4124
+23	23	10000	9971.481716	-0.002851828	0.002851828	4124
+24	0	1000	1002.188665	0.002188665	0.002188665	4124
+24	1	1000	999.635049	-0.000364951	0.000364951	4124
+24	2	1000	993.257965	-0.006742035	0.006742035	4124
+24	3	1000	1026.527751	0.026527751	0.026527751	4124
+24	4	1000	997.083024	-0.002916976	0.002916976	4124
+24	5	1000	1003.466070	0.003466070	0.003466070	4124
+24	6	1000	1002.188665	0.002188665	0.002188665	4124
+24	7	1000	1017.543884	0.017543884	0.017543884	4124
+24	8	1000	1006.022077	0.006022077	0.006022077	4124
+24	9	1000	1007.300678	0.007300678	0.007300678	4124
+24	10	1000	1002.188665	0.002188665	0.002188665	4124
+24	11	1000	1003.466070	0.003466070	0.003466070	4124
+24	12	1000	990.709909	-0.009290091	0.009290091	4124
+24	13	1000	1000.911658	0.000911658	0.000911658	4124
+24	14	1000	990.709909	-0.009290091	0.009290091	4124
+24	15	1000	974.186070	-0.025813930	0.025813930	4124
+24	16	1000	1004.743874	0.004743874	0.004743874	4124
+24	17	1000	1017.543884	0.017543884	0.017543884	4124
+24	18	1000	972.917762	-0.027082238	0.027082238	4124
+24	19	1000	985.618547	-0.014381453	0.014381453	4124
+24	20	5000	5021.794515	0.004358903	0.004358903	4124
+24	21	5000	5014.984871	0.002996974	0.002996974	4124
+24	22	5000	4845.057291	-0.030988542	0.030988542	4124
+24	23	10000	10028.930063	0.002893006	0.002893006	4124
+25	0	1000	980.533506	-0.019466494	0.019466494	4124
+25	1	1000	967.848454	-0.032151546	0.032151546	4124
+25	2	1000	995.807607	-0.004192393	0.004192393	4124
+25	3	1000	993.257965	-0.006742035	0.006742035	4124
+25	4	1000	1002.188665	0.002188665	0.002188665	4124
+25	5	1000	1007.300678	0.007300678	0.007300678	4124
+25	6	1000	983.075238	-0.016924762	0.016924762	4124
+25	7	1000	989.436475	-0.010563525	0.010563525	4124
+25	8	1000	994.532588	-0.005467412	0.005467412	4124
+25	9	1000	1020.108694	0.020108694	0.020108694	4124
+25	10	1000	1006.022077	0.006022077	0.006022077	4124
+25	11	1000	1006.022077	0.006022077	0.006022077	4124
+25	12	1000	1007.300678	0.007300678	0.007300678	4124
+25	13	1000	990.709909	-0.009290091	0.009290091	4124
+25	14	1000	989.436475	-0.010563525	0.010563525	4124
+25	15	1000	1004.743874	0.004743874	0.004743874	4124
+25	16	1000	983.075238	-0.016924762	0.016924762	4124
+25	17	1000	980.533506	-0.019466494	0.019466494	4124
+25	18	1000	1008.579679	0.008579679	0.008579679	4124
+25	19	1000	1022.675110	0.022675110	0.022675110	4124
+25	20	5000	5045.717821	0.009143564	0.009143564	4124
+25	21	5000	5042.291639	0.008458328	0.008458328	4124
+25	22	5000	4991.239877	-0.001752025	0.001752025	4124
+25	23	10000	9937.395527	-0.006260447	0.006260447	4124
+26	0	1000	1017.543884	0.017543884	0.017543884	4124
+26	1	1000	1003.466070	0.003466070	0.003466070	4124
+26	2	1000	1007.300678	0.007300678	0.007300678	4124
+26	3	1000	1021.391701	0.021391701	0.021391701	4124
+26	4	1000	986.890795	-0.013109205	0.013109205	4124
+26	5	1000	1000.911658	0.000911658	0.000911658	4124
+26	6	1000	990.709909	-0.009290091	0.009290091	4124
+26	7	1000	1014.980680	0.014980680	0.014980680	4124
+26	8	1000	988.163437	-0.011836563	0.011836563	4124
+26	9	1000	999.635049	-0.000364951	0.000364951	4124
+26	10	1000	1003.466070	0.003466070	0.003466070	4124
+26	11	1000	997.083024	-0.002916976	0.002916976	4124
+26	12	1000	998.358838	-0.001641162	0.001641162	4124
+26	13	1000	1017.543884	0.017543884	0.017543884	4124
+26	14	1000	999.635049	-0.000364951	0.000364951	4124
+26	15	1000	1020.108694	0.020108694	0.020108694	4124
+26	16	1000	991.983739	-0.008016261	0.008016261	4124
+26	17	1000	993.257965	-0.006742035	0.006742035	4124
+26	18	1000	986.890795	-0.013109205	0.013109205	4124
+26	19	1000	976.723864	-0.023276136	0.023276136	4124
+26	20	5000	5011.584290	0.002316858	0.002316858	4124
+26	21	5000	4954.202223	-0.009159555	0.009159555	4124
+26	22	5000	4967.631743	-0.006473651	0.006473651	4124
+26	23	10000	10017.375753	0.001737575	0.001737575	4124
+27	0	1000	990.709909	-0.009290091	0.009290091	4124
+27	1	1000	998.358838	-0.001641162	0.001641162	4124
+27	2	1000	1009.859079	0.009859079	0.009859079	4124
+27	3	1000	1013.699680	0.013699680	0.013699680	4124
+27	4	1000	993.257965	-0.006742035	0.006742035	4124
+27	5	1000	989.436475	-0.010563525	0.010563525	4124
+27	6	1000	1022.675110	0.022675110	0.022675110	4124
+27	7	1000	988.163437	-0.011836563	0.011836563	4124
+27	8	1000	990.709909	-0.009290091	0.009290091	4124
+27	9	1000	1000.911658	0.000911658	0.000911658	4124
+27	10	1000	1008.579679	0.008579679	0.008579679	4124
+27	11	1000	1011.138879	0.011138879	0.011138879	4124
+27	12	1000	995.807607	-0.004192393	0.004192393	4124
+27	13	1000	1004.743874	0.004743874	0.004743874	4124
+27	14	1000	1002.188665	0.002188665	0.002188665	4124
+27	15	1000	1000.911658	0.000911658	0.000911658	4124
+27	16	1000	999.635049	-0.000364951	0.000364951	4124
+27	17	1000	990.709909	-0.009290091	0.009290091	4124
+27	18	1000	1000.911658	0.000911658	0.000911658	4124
+27	19	1000	1006.022077	0.006022077	0.006022077	4124
+27	20	5000	4934.140142	-0.013171972	0.013171972	4124
+27	21	5000	5069.781675	0.013956335	0.013956335	4124
+27	22	5000	4984.480800	-0.003103840	0.003103840	4124
+27	23	10000	9738.628768	-0.026137123	0.026137123	4124
+28	0	1000	999.635049	-0.000364951	0.000364951	4124
+28	1	1000	988.163437	-0.011836563	0.011836563	4124
+28	2	1000	1006.022077	0.006022077	0.006022077	4124
+28	3	1000	1000.911658	0.000911658	0.000911658	4124
+28	4	1000	1008.579679	0.008579679	0.008579679	4124
+28	5	1000	990.709909	-0.009290091	0.009290091	4124
+28	6	1000	1011.138879	0.011138879	0.011138879	4124
+28	7	1000	991.983739	-0.008016261	0.008016261	4124
+28	8	1000	1004.743874	0.004743874	0.004743874	4124
+28	9	1000	1006.022077	0.006022077	0.006022077	4124
+28	10	1000	1008.579679	0.008579679	0.008579679	4124
+28	11	1000	1018.826088	0.018826088	0.018826088	4124
+28	12	1000	1000.911658	0.000911658	0.000911658	4124
+28	13	1000	980.533506	-0.019466494	0.019466494	4124
+28	14	1000	994.532588	-0.005467412	0.005467412	4124
+28	15	1000	995.807607	-0.004192393	0.004192393	4124
+28	16	1000	1002.188665	0.002188665	0.002188665	4124
+28	17	1000	975.454771	-0.024545229	0.024545229	4124
+28	18	1000	999.635049	-0.000364951	0.000364951	4124
+28	19	1000	1017.543884	0.017543884	0.017543884	4124
+28	20	5000	5093.987740	0.018797548	0.018797548	4124
+28	21	5000	4917.496478	-0.016500704	0.016500704	4124
+28	22	5000	5018.388278	0.003677656	0.003677656	4124
+28	23	10000	10087.195626	0.008719563	0.008719563	4124
+29	0	1000	1013.699680	0.013699680	0.013699680	4124
+29	1	1000	993.257965	-0.006742035	0.006742035	4124
+29	2	1000	1014.980680	0.014980680	0.014980680	4124
+29	3	1000	1009.859079	0.009859079	0.009859079	4124
+29	4	1000	998.358838	-0.001641162	0.001641162	4124
+29	5	1000	988.163437	-0.011836563	0.011836563	4124
+29	6	1000	994.532588	-0.005467412	0.005467412	4124
+29	7	1000	994.532588	-0.005467412	0.005467412	4124
+29	8	1000	1009.859079	0.009859079	0.009859079	4124
+29	9	1000	999.635049	-0.000364951	0.000364951	4124
+29	10	1000	1008.579679	0.008579679	0.008579679	4124
+29	11	1000	1003.466070	0.003466070	0.003466070	4124
+29	12	1000	1016.262082	0.016262082	0.016262082	4124
+29	13	1000	997.083024	-0.002916976	0.002916976	4124
+29	14	1000	1002.188665	0.002188665	0.002188665	4124
+29	15	1000	1018.826088	0.018826088	0.018826088	4124
+29	16	1000	1004.743874	0.004743874	0.004743874	4124
+29	17	1000	981.804175	-0.018195825	0.018195825	4124
+29	18	1000	1021.391701	0.021391701	0.021391701	4124
+29	19	1000	999.635049	-0.000364951	0.000364951	4124
+29	20	5000	5121.828119	0.024365624	0.024365624	4124
+29	21	5000	4984.480800	-0.003103840	0.003103840	4124
+29	22	5000	5059.451279	0.011890256	0.011890256	4124
+29	23	10000	10170.185440	0.017018544	0.017018544	4124
+30	0	1000	1009.859079	0.009859079	0.009859079	4124
+30	1	1000	1007.300678	0.007300678	0.007300678	4124
+30	2	1000	1004.743874	0.004743874	0.004743874	4124
+30	3	1000	1029.098194	0.029098194	0.029098194	4124
+30	4	1000	1007.300678	0.007300678	0.007300678	4124
+30	5	1000	991.983739	-0.008016261	0.008016261	4124
+30	6	1000	1000.911658	0.000911658	0.000911658	4124
+30	7	1000	985.618547	-0.014381453	0.014381453	4124
+30	8	1000	1039.396125	0.039396125	0.039396125	4124
+30	9	1000	1004.743874	0.004743874	0.004743874	4124
+30	10	1000	1011.138879	0.011138879	0.011138879	4124
+30	11	1000	1004.743874	0.004743874	0.004743874	4124
+30	12	1000	994.532588	-0.005467412	0.005467412	4124
+30	13	1000	1007.300678	0.007300678	0.007300678	4124
+30	14	1000	985.618547	-0.014381453	0.014381453	4124
+30	15	1000	1009.859079	0.009859079	0.009859079	4124
+30	16	1000	999.635049	-0.000364951	0.000364951	4124
+30	17	1000	995.807607	-0.004192393	0.004192393	4124
+30	18	1000	990.709909	-0.009290091	0.009290091	4124
+30	19	1000	1004.743874	0.004743874	0.004743874	4124
+30	20	5000	4974.363051	-0.005127390	0.005127390	4124
+30	21	5000	4994.623603	-0.001075279	0.001075279	4124
+30	22	5000	5018.388278	0.003677656	0.003677656	4124
+30	23	10000	9982.907107	-0.001709289	0.001709289	4124
+31	0	1000	1000.911658	0.000911658	0.000911658	4124
+31	1	1000	994.532588	-0.005467412	0.005467412	4124
+31	2	1000	988.163437	-0.011836563	0.011836563	4124
+31	3	1000	1006.022077	0.006022077	0.006022077	4124
+31	4	1000	1017.543884	0.017543884	0.017543884	4124
+31	5	1000	994.532588	-0.005467412	0.005467412	4124
+31	6	1000	974.186070	-0.025813930	0.025813930	4124
+31	7	1000	1012.419079	0.012419079	0.012419079	4124
+31	8	1000	980.533506	-0.019466494	0.019466494	4124
+31	9	1000	995.807607	-0.004192393	0.004192393	4124
+31	10	1000	1009.859079	0.009859079	0.009859079	4124
+31	11	1000	997.083024	-0.002916976	0.002916976	4124
+31	12	1000	1012.419079	0.012419079	0.012419079	4124
+31	13	1000	993.257965	-0.006742035	0.006742035	4124
+31	14	1000	999.635049	-0.000364951	0.000364951	4124
+31	15	1000	1003.466070	0.003466070	0.003466070	4124
+31	16	1000	1004.743874	0.004743874	0.004743874	4124
+31	17	1000	1012.419079	0.012419079	0.012419079	4124
+31	18	1000	1006.022077	0.006022077	0.006022077	4124
+31	19	1000	1002.188665	0.002188665	0.002188665	4124
+31	20	5000	5107.884276	0.021576855	0.021576855	4124
+31	21	5000	5032.030256	0.006406051	0.006406051	4124
+31	22	5000	5032.030256	0.006406051	0.006406051	4124
+31	23	10000	10341.386479	0.034138648	0.034138648	4124
+32	0	1000	999.635049	-0.000364951	0.000364951	4124
+32	1	1000	997.083024	-0.002916976	0.002916976	4124
+32	2	1000	995.807607	-0.004192393	0.004192393	4124
+32	3	1000	997.083024	-0.002916976	0.002916976	4124
+32	4	1000	1006.022077	0.006022077	0.006022077	4124
+32	5	1000	1007.300678	0.007300678	0.007300678	4124
+32	6	1000	1020.108694	0.020108694	0.020108694	4124
+32	7	1000	991.983739	-0.008016261	0.008016261	4124
+32	8	1000	1009.859079	0.009859079	0.009859079	4124
+32	9	1000	1000.911658	0.000911658	0.000911658	4124
+32	10	1000	1007.300678	0.007300678	0.007300678	4124
+32	11	1000	1006.022077	0.006022077	0.006022077	4124
+32	12	1000	1004.743874	0.004743874	0.004743874	4124
+32	13	1000	990.709909	-0.009290091	0.009290091	4124
+32	14	1000	998.358838	-0.001641162	0.001641162	4124
+32	15	1000	986.890795	-0.013109205	0.013109205	4124
+32	16	1000	999.635049	-0.000364951	0.000364951	4124
+32	17	1000	1002.188665	0.002188665	0.002188665	4124
+32	18	1000	1011.138879	0.011138879	0.011138879	4124
+32	19	1000	994.532588	-0.005467412	0.005467412	4124
+32	20	5000	5028.615500	0.005723100	0.005723100	4124
+32	21	5000	5021.794515	0.004358903	0.004358903	4124
+32	22	5000	5001.399453	0.000279891	0.000279891	4124
+32	23	10000	10304.093353	0.030409335	0.030409335	4124
+33	0	1000	1011.138879	0.011138879	0.011138879	4124
+33	1	1000	1004.743874	0.004743874	0.004743874	4124
+33	2	1000	990.709909	-0.009290091	0.009290091	4124
+33	3	1000	1012.419079	0.012419079	0.012419079	4124
+33	4	1000	985.618547	-0.014381453	0.014381453	4124
+33	5	1000	988.163437	-0.011836563	0.011836563	4124
+33	6	1000	997.083024	-0.002916976	0.002916976	4124
+33	7	1000	995.807607	-0.004192393	0.004192393	4124
+33	8	1000	1006.022077	0.006022077	0.006022077	4124
+33	9	1000	994.532588	-0.005467412	0.005467412	4124
+33	10	1000	986.890795	-0.013109205	0.013109205	4124
+33	11	1000	999.635049	-0.000364951	0.000364951	4124
+33	12	1000	993.257965	-0.006742035	0.006742035	4124
+33	13	1000	998.358838	-0.001641162	0.001641162	4124
+33	14	1000	1004.743874	0.004743874	0.004743874	4124
+33	15	1000	997.083024	-0.002916976	0.002916976	4124
+33	16	1000	994.532588	-0.005467412	0.005467412	4124
+33	17	1000	979.263232	-0.020736768	0.020736768	4124
+33	18	1000	1017.543884	0.017543884	0.017543884	4124
+33	19	1000	999.635049	-0.000364951	0.000364951	4124
+33	20	5000	4940.816590	-0.011836682	0.011836682	4124
+33	21	5000	4904.230070	-0.019153986	0.019153986	4124
+33	22	5000	4904.230070	-0.019153986	0.019153986	4124
+33	23	10000	10182.179592	0.018217959	0.018217959	4124
+34	0	1000	997.083024	-0.002916976	0.002916976	4124
+34	1	1000	1013.699680	0.013699680	0.013699680	4124
+34	2	1000	981.804175	-0.018195825	0.018195825	4124
+34	3	1000	1018.826088	0.018826088	0.018826088	4124
+34	4	1000	993.257965	-0.006742035	0.006742035	4124
+34	5	1000	988.163437	-0.011836563	0.011836563	4124
+34	6	1000	997.083024	-0.002916976	0.002916976	4124
+34	7	1000	1007.300678	0.007300678	0.007300678	4124
+34	8	1000	962.785413	-0.037214587	0.037214587	4124
+34	9	1000	991.983739	-0.008016261	0.008016261	4124
+34	10	1000	1009.859079	0.009859079	0.009859079	4124
+34	11	1000	988.163437	-0.011836563	0.011836563	4124
+34	12	1000	1018.826088	0.018826088	0.018826088	4124
+34	13	1000	997.083024	-0.002916976	0.002916976	4124
+34	14	1000	991.983739	-0.008016261	0.008016261	4124
+34	15	1000	1006.022077	0.006022077	0.006022077	4124
+34	16	1000	997.083024	-0.002916976	0.002916976	4124
+34	17	1000	1017.543884	0.017543884	0.017543884	4124
+34	18	1000	1016.262082	0.016262082	0.016262082	4124
+34	19	1000	1017.543884	0.017543884	0.017543884	4124
+34	20	5000	4934.140142	-0.013171972	0.013171972	4124
+34	21	5000	4970.996014	-0.005800797	0.005800797	4124
+34	22	5000	5004.791585	0.000958317	0.000958317	4124
+34	23	10000	9738.628768	-0.026137123	0.026137123	4124
+35	0	1000	999.635049	-0.000364951	0.000364951	4124
+35	1	1000	1008.579679	0.008579679	0.008579679	4124
+35	2	1000	988.163437	-0.011836563	0.011836563	4124
+35	3	1000	1013.699680	0.013699680	0.013699680	4124
+35	4	1000	980.533506	-0.019466494	0.019466494	4124
+35	5	1000	1012.419079	0.012419079	0.012419079	4124
+35	6	1000	1003.466070	0.003466070	0.003466070	4124
+35	7	1000	1014.980680	0.014980680	0.014980680	4124
+35	8	1000	986.890795	-0.013109205	0.013109205	4124
+35	9	1000	983.075238	-0.016924762	0.016924762	4124
+35	10	1000	1016.262082	0.016262082	0.016262082	4124
+35	11	1000	1027.812771	0.027812771	0.027812771	4124
+35	12	1000	1002.188665	0.002188665	0.002188665	4124
+35	13	1000	998.358838	-0.001641162	0.001641162	4124
+35	14	1000	1012.419079	0.012419079	0.012419079	4124
+35	15	1000	986.890795	-0.013109205	0.013109205	4124
+35	16	1000	986.890795	-0.013109205	0.013109205	4124
+35	17	1000	983.075238	-0.016924762	0.016924762	4124
+35	18	1000	993.257965	-0.006742035	0.006742035	4124
+35	19	1000	1012.419079	0.012419079	0.012419079	4124
+35	20	5000	5087.057112	0.017411422	0.017411422	4124
+35	21	5000	5052.578794	0.010515759	0.010515759	4124
+35	22	5000	5004.791585	0.000958317	0.000958317	4124
+35	23	10000	9937.395527	-0.006260447	0.006260447	4124
+36	0	1000	988.163437	-0.011836563	0.011836563	4124
+36	1	1000	1006.022077	0.006022077	0.006022077	4124
+36	2	1000	1004.743874	0.004743874	0.004743874	4124
+36	3	1000	994.532588	-0.005467412	0.005467412	4124
+36	4	1000	998.358838	-0.001641162	0.001641162	4124
+36	5	1000	994.532588	-0.005467412	0.005467412	4124
+36	6	1000	1003.466070	0.003466070	0.003466070	4124
+36	7	1000	1008.579679	0.008579679	0.008579679	4124
+36	8	1000	1004.743874	0.004743874	0.004743874	4124
+36	9	1000	999.635049	-0.000364951	0.000364951	4124
+36	10	1000	1004.743874	0.004743874	0.004743874	4124
+36	11	1000	979.263232	-0.020736768	0.020736768	4124
+36	12	1000	1000.911658	0.000911658	0.000911658	4124
+36	13	1000	1004.743874	0.004743874	0.004743874	4124
+36	14	1000	1008.579679	0.008579679	0.008579679	4124
+36	15	1000	985.618547	-0.014381453	0.014381453	4124
+36	16	1000	1016.262082	0.016262082	0.016262082	4124
+36	17	1000	1003.466070	0.003466070	0.003466070	4124
+36	18	1000	1003.466070	0.003466070	0.003466070	4124
+36	19	1000	1013.699680	0.013699680	0.013699680	4124
+36	20	5000	5139.324942	0.027864988	0.027864988	4124
+36	21	5000	4964.270233	-0.007145953	0.007145953	4124
+36	22	5000	4867.967458	-0.026406508	0.026406508	4124
+36	23	10000	9781.973088	-0.021802691	0.021802691	4124
+37	0	1000	1003.466070	0.003466070	0.003466070	4124
+37	1	1000	1004.743874	0.004743874	0.004743874	4124
+37	2	1000	1000.911658	0.000911658	0.000911658	4124
+37	3	1000	966.582107	-0.033417893	0.033417893	4124
+37	4	1000	1006.022077	0.006022077	0.006022077	4124
+37	5	1000	997.083024	-0.002916976	0.002916976	4124
+37	6	1000	984.346695	-0.015653305	0.015653305	4124
+37	7	1000	984.346695	-0.015653305	0.015653305	4124
+37	8	1000	997.083024	-0.002916976	0.002916976	4124
+37	9	1000	1003.466070	0.003466070	0.003466070	4124
+37	10	1000	995.807607	-0.004192393	0.004192393	4124
+37	11	1000	997.083024	-0.002916976	0.002916976	4124
+37	12	1000	1013.699680	0.013699680	0.013699680	4124
+37	13	1000	989.436475	-0.010563525	0.010563525	4124
+37	14	1000	997.083024	-0.002916976	0.002916976	4124
+37	15	1000	998.358838	-0.001641162	0.001641162	4124
+37	16	1000	998.358838	-0.001641162	0.001641162	4124
+37	17	1000	1007.300678	0.007300678	0.007300678	4124
+37	18	1000	998.358838	-0.001641162	0.001641162	4124
+37	19	1000	994.532588	-0.005467412	0.005467412	4124
+37	20	5000	4981.105439	-0.003778912	0.003778912	4124
+37	21	5000	4981.105439	-0.003778912	0.003778912	4124
+37	22	5000	4987.858944	-0.002428211	0.002428211	4124
+37	23	10000	9971.481716	-0.002851828	0.002851828	4124
+38	0	1000	993.257965	-0.006742035	0.006742035	4124
+38	1	1000	1002.188665	0.002188665	0.002188665	4124
+38	2	1000	997.083024	-0.002916976	0.002916976	4124
+38	3	1000	989.436475	-0.010563525	0.010563525	4124
+38	4	1000	1008.579679	0.008579679	0.008579679	4124
+38	5	1000	1002.188665	0.002188665	0.002188665	4124
+38	6	1000	1011.138879	0.011138879	0.011138879	4124
+38	7	1000	1008.579679	0.008579679	0.008579679	4124
+38	8	1000	998.358838	-0.001641162	0.001641162	4124
+38	9	1000	1016.262082	0.016262082	0.016262082	4124
+38	10	1000	1016.262082	0.016262082	0.016262082	4124
+38	11	1000	1004.743874	0.004743874	0.004743874	4124
+38	12	1000	1018.826088	0.018826088	0.018826088	4124
+38	13	1000	999.635049	-0.000364951	0.000364951	4124
+38	14	1000	986.890795	-0.013109205	0.013109205	4124
+38	15	1000	1004.743874	0.004743874	0.004743874	4124
+38	16	1000	1006.022077	0.006022077	0.006022077	4124
+38	17	1000	1006.022077	0.006022077	0.006022077	4124
+38	18	1000	1009.859079	0.009859079	0.009859079	4124
+38	19	1000	997.083024	-0.002916976	0.002916976	4124
+38	20	5000	5025.203588	0.005040718	0.005040718	4124
+38	21	5000	4845.057291	-0.030988542	0.030988542	4124
+38	22	5000	4994.623603	-0.001075279	0.001075279	4124
+38	23	10000	9771.093931	-0.022890607	0.022890607	4124
+39	0	1000	1007.300678	0.007300678	0.007300678	4124
+39	1	1000	997.083024	-0.002916976	0.002916976	4124
+39	2	1000	1016.262082	0.016262082	0.016262082	4124
+39	3	1000	985.618547	-0.014381453	0.014381453	4124
+39	4	1000	998.358838	-0.001641162	0.001641162	4124
+39	5	1000	1004.743874	0.004743874	0.004743874	4124
+39	6	1000	995.807607	-0.004192393	0.004192393	4124
+39	7	1000	986.890795	-0.013109205	0.013109205	4124
+39	8	1000	1003.466070	0.003466070	0.003466070	4124
+39	9	1000	1007.300678	0.007300678	0.007300678	4124
+39	10	1000	1006.022077	0.006022077	0.006022077	4124
+39	11	1000	979.263232	-0.020736768	0.020736768	4124
+39	12	1000	1020.108694	0.020108694	0.020108694	4124
+39	13	1000	1018.826088	0.018826088	0.018826088	4124
+39	14	1000	994.532588	-0.005467412	0.005467412	4124
+39	15	1000	1016.262082	0.016262082	0.016262082	4124
+39	16	1000	990.709909	-0.009290091	0.009290091	4124
+39	17	1000	1011.138879	0.011138879	0.011138879	4124
+39	18	1000	1017.543884	0.017543884	0.017543884	4124
+39	19	1000	1002.188665	0.002188665	0.002188665	4124
+39	20	5000	5001.399453	0.000279891	0.000279891	4124
+39	21	5000	5001.399453	0.000279891	0.000279891	4124
+39	22	5000	5011.584290	0.002316858	0.002316858	4124
+39	23	10000	10230.510536	0.023051054	0.023051054	4124
+40	0	1000	1000.911658	0.000911658	0.000911658	4124
+40	1	1000	1002.188665	0.002188665	0.002188665	4124
+40	2	1000	985.618547	-0.014381453	0.014381453	4124
+40	3	1000	994.532588	-0.005467412	0.005467412	4124
+40	4	1000	1004.743874	0.004743874	0.004743874	4124
+40	5	1000	997.083024	-0.002916976	0.002916976	4124
+40	6	1000	994.532588	-0.005467412	0.005467412	4124
+40	7	1000	995.807607	-0.004192393	0.004192393	4124
+40	8	1000	994.532588	-0.005467412	0.005467412	4124
+40	9	1000	990.709909	-0.009290091	0.009290091	4124
+40	10	1000	1004.743874	0.004743874	0.004743874	4124
+40	11	1000	1009.859079	0.009859079	0.009859079	4124
+40	12	1000	991.983739	-0.008016261	0.008016261	4124
+40	13	1000	985.618547	-0.014381453	0.014381453	4124
+40	14	1000	1000.911658	0.000911658	0.000911658	4124
+40	15	1000	1000.911658	0.000911658	0.000911658	4124
+40	16	1000	979.263232	-0.020736768	0.020736768	4124
+40	17	1000	993.257965	-0.006742035	0.006742035	4124
+40	18	1000	1011.138879	0.011138879	0.011138879	4124
+40	19	1000	981.804175	-0.018195825	0.018195825	4124
+40	20	5000	5021.794515	0.004358903	0.004358903	4124
+40	21	5000	5014.984871	0.002996974	0.002996974	4124
+40	22	5000	4970.996014	-0.005800797	0.005800797	4124
+40	23	10000	9926.096210	-0.007390379	0.007390379	4124
+41	0	1000	1016.262082	0.016262082	0.016262082	4124
+41	1	1000	997.083024	-0.002916976	0.002916976	4124
+41	2	1000	985.618547	-0.014381453	0.014381453	4124
+41	3	1000	985.618547	-0.014381453	0.014381453	4124
+41	4	1000	1004.743874	0.004743874	0.004743874	4124
+41	5	1000	998.358838	-0.001641162	0.001641162	4124
+41	6	1000	991.983739	-0.008016261	0.008016261	4124
+41	7	1000	990.709909	-0.009290091	0.009290091	4124
+41	8	1000	1011.138879	0.011138879	0.011138879	4124
+41	9	1000	1013.699680	0.013699680	0.013699680	4124
+41	10	1000	989.436475	-0.010563525	0.010563525	4124
+41	11	1000	999.635049	-0.000364951	0.000364951	4124
+41	12	1000	1000.911658	0.000911658	0.000911658	4124
+41	13	1000	1009.859079	0.009859079	0.009859079	4124
+41	14	1000	998.358838	-0.001641162	0.001641162	4124
+41	15	1000	997.083024	-0.002916976	0.002916976	4124
+41	16	1000	1020.108694	0.020108694	0.020108694	4124
+41	17	1000	1008.579679	0.008579679	0.008579679	4124
+41	18	1000	1016.262082	0.016262082	0.016262082	4124
+41	19	1000	993.257965	-0.006742035	0.006742035	4124
+41	20	5000	5028.615500	0.005723100	0.005723100	4124
+41	21	5000	5059.451279	0.011890256	0.011890256	4124
+41	22	5000	4904.230070	-0.019153986	0.019153986	4124
+41	23	10000	9960.088106	-0.003991189	0.003991189	4124
+42	0	1000	993.257965	-0.006742035	0.006742035	4124
+42	1	1000	998.358838	-0.001641162	0.001641162	4124
+42	2	1000	1002.188665	0.002188665	0.002188665	4124
+42	3	1000	1011.138879	0.011138879	0.011138879	4124
+42	4	1000	993.257965	-0.006742035	0.006742035	4124
+42	5	1000	1014.980680	0.014980680	0.014980680	4124
+42	6	1000	1013.699680	0.013699680	0.013699680	4124
+42	7	1000	994.532588	-0.005467412	0.005467412	4124
+42	8	1000	1025.243135	0.025243135	0.025243135	4124
+42	9	1000	976.723864	-0.023276136	0.023276136	4124
+42	10	1000	1014.980680	0.014980680	0.014980680	4124
+42	11	1000	1011.138879	0.011138879	0.011138879	4124
+42	12	1000	1012.419079	0.012419079	0.012419079	4124
+42	13	1000	1013.699680	0.013699680	0.013699680	4124
+42	14	1000	988.163437	-0.011836563	0.011836563	4124
+42	15	1000	1009.859079	0.009859079	0.009859079	4124
+42	16	1000	999.635049	-0.000364951	0.000364951	4124
+42	17	1000	994.532588	-0.005467412	0.005467412	4124
+42	18	1000	991.983739	-0.008016261	0.008016261	4124
+42	19	1000	1011.138879	0.011138879	0.011138879	4124
+42	20	5000	4904.230070	-0.019153986	0.019153986	4124
+42	21	5000	4981.105439	-0.003778912	0.003778912	4124
+42	22	5000	4894.308385	-0.021138323	0.021138323	4124
+42	23	10000	10341.386479	0.034138648	0.034138648	4124
+43	0	1000	1007.300678	0.007300678	0.007300678	4124
+43	1	1000	1008.579679	0.008579679	0.008579679	4124
+43	2	1000	998.358838	-0.001641162	0.001641162	4124
+43	3	1000	983.075238	-0.016924762	0.016924762	4124
+43	4	1000	999.635049	-0.000364951	0.000364951	4124
+43	5	1000	1013.699680	0.013699680	0.013699680	4124
+43	6	1000	1007.300678	0.007300678	0.007300678	4124
+43	7	1000	1004.743874	0.004743874	0.004743874	4124
+43	8	1000	1013.699680	0.013699680	0.013699680	4124
+43	9	1000	1016.262082	0.016262082	0.016262082	4124
+43	10	1000	989.436475	-0.010563525	0.010563525	4124
+43	11	1000	991.983739	-0.008016261	0.008016261	4124
+43	12	1000	1014.980680	0.014980680	0.014980680	4124
+43	13	1000	1014.980680	0.014980680	0.014980680	4124
+43	14	1000	981.804175	-0.018195825	0.018195825	4124
+43	15	1000	998.358838	-0.001641162	0.001641162	4124
+43	16	1000	1023.958921	0.023958921	0.023958921	4124
+43	17	1000	991.983739	-0.008016261	0.008016261	4124
+43	18	1000	1022.675110	0.022675110	0.022675110	4124
+43	19	1000	997.083024	-0.002916976	0.002916976	4124
+43	20	5000	5045.717821	0.009143564	0.009143564	4124
+43	21	5000	5014.984871	0.002996974	0.002996974	4124
+43	22	5000	4957.555477	-0.008488905	0.008488905	4124
+43	23	10000	9814.785012	-0.018521499	0.018521499	4124
+44	0	1000	983.075238	-0.016924762	0.016924762	4124
+44	1	1000	1006.022077	0.006022077	0.006022077	4124
+44	2	1000	1013.699680	0.013699680	0.013699680	4124
+44	3	1000	1031.670251	0.031670251	0.031670251	4124
+44	4	1000	1003.466070	0.003466070	0.003466070	4124
+44	5	1000	989.436475	-0.010563525	0.010563525	4124
+44	6	1000	1003.466070	0.003466070	0.003466070	4124
+44	7	1000	995.807607	-0.004192393	0.004192393	4124
+44	8	1000	983.075238	-0.016924762	0.016924762	4124
+44	9	1000	990.709909	-0.009290091	0.009290091	4124
+44	10	1000	994.532588	-0.005467412	0.005467412	4124
+44	11	1000	985.618547	-0.014381453	0.014381453	4124
+44	12	1000	1007.300678	0.007300678	0.007300678	4124
+44	13	1000	1006.022077	0.006022077	0.006022077	4124
+44	14	1000	1008.579679	0.008579679	0.008579679	4124
+44	15	1000	985.618547	-0.014381453	0.014381453	4124
+44	16	1000	994.532588	-0.005467412	0.005467412	4124
+44	17	1000	985.618547	-0.014381453	0.014381453	4124
+44	18	1000	995.807607	-0.004192393	0.004192393	4124
+44	19	1000	1000.911658	0.000911658	0.000911658	4124
+44	20	5000	5038.868321	0.007773664	0.007773664	4124
+44	21	5000	4987.858944	-0.002428211	0.002428211	4124
+44	22	5000	4967.631743	-0.006473651	0.006473651	4124
+44	23	10000	10279.418580	0.027941858	0.027941858	4124
+45	0	1000	999.635049	-0.000364951	0.000364951	4124
+45	1	1000	976.723864	-0.023276136	0.023276136	4124
+45	2	1000	1012.419079	0.012419079	0.012419079	4124
+45	3	1000	1012.419079	0.012419079	0.012419079	4124
+45	4	1000	1021.391701	0.021391701	0.021391701	4124
+45	5	1000	1002.188665	0.002188665	0.002188665	4124
+45	6	1000	1011.138879	0.011138879	0.011138879	4124
+45	7	1000	1007.300678	0.007300678	0.007300678	4124
+45	8	1000	984.346695	-0.015653305	0.015653305	4124
+45	9	1000	984.346695	-0.015653305	0.015653305	4124
+45	10	1000	1014.980680	0.014980680	0.014980680	4124
+45	11	1000	1016.262082	0.016262082	0.016262082	4124
+45	12	1000	1002.188665	0.002188665	0.002188665	4124
+45	13	1000	999.635049	-0.000364951	0.000364951	4124
+45	14	1000	1013.699680	0.013699680	0.013699680	4124
+45	15	1000	1025.243135	0.025243135	0.025243135	4124
+45	16	1000	998.358838	-0.001641162	0.001641162	4124
+45	17	1000	1014.980680	0.014980680	0.014980680	4124
+45	18	1000	1011.138879	0.011138879	0.011138879	4124
+45	19	1000	991.983739	-0.008016261	0.008016261	4124
+45	20	5000	5052.578794	0.010515759	0.010515759	4124
+45	21	5000	5052.578794	0.010515759	0.010515759	4124
+45	22	5000	4964.270233	-0.007145953	0.007145953	4124
+45	23	10000	10017.375753	0.001737575	0.001737575	4124
+46	0	1000	986.890795	-0.013109205	0.013109205	4124
+46	1	1000	1026.527751	0.026527751	0.026527751	4124
+46	2	1000	997.083024	-0.002916976	0.002916976	4124
+46	3	1000	1013.699680	0.013699680	0.013699680	4124
+46	4	1000	1006.022077	0.006022077	0.006022077	4124
+46	5	1000	999.635049	-0.000364951	0.000364951	4124
+46	6	1000	1008.579679	0.008579679	0.008579679	4124
+46	7	1000	1014.980680	0.014980680	0.014980680	4124
+46	8	1000	989.436475	-0.010563525	0.010563525	4124
+46	9	1000	993.257965	-0.006742035	0.006742035	4124
+46	10	1000	1004.743874	0.004743874	0.004743874	4124
+46	11	1000	1020.108694	0.020108694	0.020108694	4124
+46	12	1000	997.083024	-0.002916976	0.002916976	4124
+46	13	1000	1007.300678	0.007300678	0.007300678	4124
+46	14	1000	997.083024	-0.002916976	0.002916976	4124
+46	15	1000	985.618547	-0.014381453	0.014381453	4124
+46	16	1000	993.257965	-0.006742035	0.006742035	4124
+46	17	1000	993.257965	-0.006742035	0.006742035	4124
+46	18	1000	994.532588	-0.005467412	0.005467412	4124
+46	19	1000	1007.300678	0.007300678	0.007300678	4124
+46	20	5000	4974.363051	-0.005127390	0.005127390	4124
+46	21	5000	5069.781675	0.013956335	0.013956335	4124
+46	22	5000	5035.447861	0.007089572	0.007089572	4124
+46	23	10000	9781.973088	-0.021802691	0.021802691	4124
+47	0	1000	988.163437	-0.011836563	0.011836563	4124
+47	1	1000	997.083024	-0.002916976	0.002916976	4124
+47	2	1000	1008.579679	0.008579679	0.008579679	4124
+47	3	1000	1007.300678	0.007300678	0.007300678	4124
+47	4	1000	993.257965	-0.006742035	0.006742035	4124
+47	5	1000	997.083024	-0.002916976	0.002916976	4124
+47	6	1000	1002.188665	0.002188665	0.002188665	4124
+47	7	1000	990.709909	-0.009290091	0.009290091	4124
+47	8	1000	995.807607	-0.004192393	0.004192393	4124
+47	9	1000	1023.958921	0.023958921	0.023958921	4124
+47	10	1000	991.983739	-0.008016261	0.008016261	4124
+47	11	1000	995.807607	-0.004192393	0.004192393	4124
+47	12	1000	994.532588	-0.005467412	0.005467412	4124
+47	13	1000	1022.675110	0.022675110	0.022675110	4124
+47	14	1000	1006.022077	0.006022077	0.006022077	4124
+47	15	1000	995.807607	-0.004192393	0.004192393	4124
+47	16	1000	981.804175	-0.018195825	0.018195825	4124
+47	17	1000	1011.138879	0.011138879	0.011138879	4124
+47	18	1000	1006.022077	0.006022077	0.006022077	4124
+47	19	1000	1012.419079	0.012419079	0.012419079	4124
+47	20	5000	5076.683109	0.015336622	0.015336622	4124
+47	21	5000	4974.363051	-0.005127390	0.005127390	4124
+47	22	5000	4927.474558	-0.014505088	0.014505088	4124
+47	23	10000	10098.948862	0.009894886	0.009894886	4124
+48	0	1000	1004.743874	0.004743874	0.004743874	4124
+48	1	1000	1020.108694	0.020108694	0.020108694	4124
+48	2	1000	988.163437	-0.011836563	0.011836563	4124
+48	3	1000	1006.022077	0.006022077	0.006022077	4124
+48	4	1000	1004.743874	0.004743874	0.004743874	4124
+48	5	1000	1002.188665	0.002188665	0.002188665	4124
+48	6	1000	994.532588	-0.005467412	0.005467412	4124
+48	7	1000	979.263232	-0.020736768	0.020736768	4124
+48	8	1000	1007.300678	0.007300678	0.007300678	4124
+48	9	1000	1000.911658	0.000911658	0.000911658	4124
+48	10	1000	1009.859079	0.009859079	0.009859079	4124
+48	11	1000	990.709909	-0.009290091	0.009290091	4124
+48	12	1000	999.635049	-0.000364951	0.000364951	4124
+48	13	1000	1011.138879	0.011138879	0.011138879	4124
+48	14	1000	991.983739	-0.008016261	0.008016261	4124
+48	15	1000	991.983739	-0.008016261	0.008016261	4124
+48	16	1000	998.358838	-0.001641162	0.001641162	4124
+48	17	1000	999.635049	-0.000364951	0.000364951	4124
+48	18	1000	1007.300678	0.007300678	0.007300678	4124
+48	19	1000	995.807607	-0.004192393	0.004192393	4124
+48	20	5000	5035.447861	0.007089572	0.007089572	4124
+48	21	5000	4994.623603	-0.001075279	0.001075279	4124
+48	22	5000	5038.868321	0.007773664	0.007773664	4124
+48	23	10000	10230.510536	0.023051054	0.023051054	4124
+49	0	1000	999.635049	-0.000364951	0.000364951	4124
+49	1	1000	990.709909	-0.009290091	0.009290091	4124
+49	2	1000	989.436475	-0.010563525	0.010563525	4124
+49	3	1000	986.890795	-0.013109205	0.013109205	4124
+49	4	1000	991.983739	-0.008016261	0.008016261	4124
+49	5	1000	1014.980680	0.014980680	0.014980680	4124
+49	6	1000	1007.300678	0.007300678	0.007300678	4124
+49	7	1000	980.533506	-0.019466494	0.019466494	4124
+49	8	1000	993.257965	-0.006742035	0.006742035	4124
+49	9	1000	1004.743874	0.004743874	0.004743874	4124
+49	10	1000	999.635049	-0.000364951	0.000364951	4124
+49	11	1000	1003.466070	0.003466070	0.003466070	4124
+49	12	1000	1011.138879	0.011138879	0.011138879	4124
+49	13	1000	1008.579679	0.008579679	0.008579679	4124
+49	14	1000	979.263232	-0.020736768	0.020736768	4124
+49	15	1000	1004.743874	0.004743874	0.004743874	4124
+49	16	1000	991.983739	-0.008016261	0.008016261	4124
+49	17	1000	1008.579679	0.008579679	0.008579679	4124
+49	18	1000	1016.262082	0.016262082	0.016262082	4124
+49	19	1000	983.075238	-0.016924762	0.016924762	4124
+49	20	5000	5097.457456	0.019491491	0.019491491	4124
+49	21	5000	5069.781675	0.013956335	0.013956335	4124
+49	22	5000	4991.239877	-0.001752025	0.001752025	4124
+49	23	10000	9960.088106	-0.003991189	0.003991189	4124
+50	0	1000	986.890795	-0.013109205	0.013109205	4124
+50	1	1000	1017.543884	0.017543884	0.017543884	4124
+50	2	1000	1023.958921	0.023958921	0.023958921	4124
+50	3	1000	994.532588	-0.005467412	0.005467412	4124
+50	4	1000	1003.466070	0.003466070	0.003466070	4124
+50	5	1000	988.163437	-0.011836563	0.011836563	4124
+50	6	1000	997.083024	-0.002916976	0.002916976	4124
+50	7	1000	989.436475	-0.010563525	0.010563525	4124
+50	8	1000	1018.826088	0.018826088	0.018826088	4124
+50	9	1000	998.358838	-0.001641162	0.001641162	4124
+50	10	1000	1007.300678	0.007300678	0.007300678	4124
+50	11	1000	1014.980680	0.014980680	0.014980680	4124
+50	12	1000	1007.300678	0.007300678	0.007300678	4124
+50	13	1000	995.807607	-0.004192393	0.004192393	4124
+50	14	1000	989.436475	-0.010563525	0.010563525	4124
+50	15	1000	1013.699680	0.013699680	0.013699680	4124
+50	16	1000	976.723864	-0.023276136	0.023276136	4124
+50	17	1000	1003.466070	0.003466070	0.003466070	4124
+50	18	1000	988.163437	-0.011836563	0.011836563	4124
+50	19	1000	988.163437	-0.011836563	0.011836563	4124
+50	20	5000	5069.781675	0.013956335	0.013956335	4124
+50	21	5000	5021.794515	0.004358903	0.004358903	4124
+50	22	5000	5066.335314	0.013267063	0.013267063	4124
+50	23	10000	10087.195626	0.008719563	0.008719563	4124
+51	0	1000	990.709909	-0.009290091	0.009290091	4124
+51	1	1000	994.532588	-0.005467412	0.005467412	4124
+51	2	1000	1003.466070	0.003466070	0.003466070	4124
+51	3	1000	1007.300678	0.007300678	0.007300678	4124
+51	4	1000	983.075238	-0.016924762	0.016924762	4124
+51	5	1000	988.163437	-0.011836563	0.011836563	4124
+51	6	1000	991.983739	-0.008016261	0.008016261	4124
+51	7	1000	1008.579679	0.008579679	0.008579679	4124
+51	8	1000	988.163437	-0.011836563	0.011836563	4124
+51	9	1000	1006.022077	0.006022077	0.006022077	4124
+51	10	1000	991.983739	-0.008016261	0.008016261	4124
+51	11	1000	1000.911658	0.000911658	0.000911658	4124
+51	12	1000	997.083024	-0.002916976	0.002916976	4124
+51	13	1000	997.083024	-0.002916976	0.002916976	4124
+51	14	1000	991.983739	-0.008016261	0.008016261	4124
+51	15	1000	990.709909	-0.009290091	0.009290091	4124
+51	16	1000	1022.675110	0.022675110	0.022675110	4124
+51	17	1000	995.807607	-0.004192393	0.004192393	4124
+51	18	1000	998.358838	-0.001641162	0.001641162	4124
+51	19	1000	995.807607	-0.004192393	0.004192393	4124
+51	20	5000	5014.984871	0.002996974	0.002996974	4124
+51	21	5000	5028.615500	0.005723100	0.005723100	4124
+51	22	5000	5018.388278	0.003677656	0.003677656	4124
+51	23	10000	9994.364457	-0.000563554	0.000563554	4124
+52	0	1000	995.807607	-0.004192393	0.004192393	4124
+52	1	1000	1002.188665	0.002188665	0.002188665	4124
+52	2	1000	1002.188665	0.002188665	0.002188665	4124
+52	3	1000	1012.419079	0.012419079	0.012419079	4124
+52	4	1000	985.618547	-0.014381453	0.014381453	4124
+52	5	1000	997.083024	-0.002916976	0.002916976	4124
+52	6	1000	997.083024	-0.002916976	0.002916976	4124
+52	7	1000	991.983739	-0.008016261	0.008016261	4124
+52	8	1000	986.890795	-0.013109205	0.013109205	4124
+52	9	1000	998.358838	-0.001641162	0.001641162	4124
+52	10	1000	981.804175	-0.018195825	0.018195825	4124
+52	11	1000	1002.188665	0.002188665	0.002188665	4124
+52	12	1000	991.983739	-0.008016261	0.008016261	4124
+52	13	1000	1014.980680	0.014980680	0.014980680	4124
+52	14	1000	985.618547	-0.014381453	0.014381453	4124
+52	15	1000	993.257965	-0.006742035	0.006742035	4124
+52	16	1000	1021.391701	0.021391701	0.021391701	4124
+52	17	1000	999.635049	-0.000364951	0.000364951	4124
+52	18	1000	988.163437	-0.011836563	0.011836563	4124
+52	19	1000	995.807607	-0.004192393	0.004192393	4124
+52	20	5000	5066.335314	0.013267063	0.013267063	4124
+52	21	5000	5001.399453	0.000279891	0.000279891	4124
+52	22	5000	4950.851711	-0.009829658	0.009829658	4124
+52	23	10000	10075.476018	0.007547602	0.007547602	4124
+53	0	1000	1022.675110	0.022675110	0.022675110	4124
+53	1	1000	994.532588	-0.005467412	0.005467412	4124
+53	2	1000	984.346695	-0.015653305	0.015653305	4124
+53	3	1000	1016.262082	0.016262082	0.016262082	4124
+53	4	1000	993.257965	-0.006742035	0.006742035	4124
+53	5	1000	974.186070	-0.025813930	0.025813930	4124
+53	6	1000	998.358838	-0.001641162	0.001641162	4124
+53	7	1000	1003.466070	0.003466070	0.003466070	4124
+53	8	1000	997.083024	-0.002916976	0.002916976	4124
+53	9	1000	1016.262082	0.016262082	0.016262082	4124
+53	10	1000	993.257965	-0.006742035	0.006742035	4124
+53	11	1000	988.163437	-0.011836563	0.011836563	4124
+53	12	1000	995.807607	-0.004192393	0.004192393	4124
+53	13	1000	1012.419079	0.012419079	0.012419079	4124
+53	14	1000	1022.675110	0.022675110	0.022675110	4124
+53	15	1000	993.257965	-0.006742035	0.006742035	4124
+53	16	1000	998.358838	-0.001641162	0.001641162	4124
+53	17	1000	1004.743874	0.004743874	0.004743874	4124
+53	18	1000	1009.859079	0.009859079	0.009859079	4124
+53	19	1000	1002.188665	0.002188665	0.002188665	4124
+53	20	5000	5056.013595	0.011202719	0.011202719	4124
+53	21	5000	4998.010127	-0.000397975	0.000397975	4124
+53	22	5000	4954.202223	-0.009159555	0.009159555	4124
+53	23	10000	9717.127406	-0.028287259	0.028287259	4124
+54	0	1000	990.709909	-0.009290091	0.009290091	4124
+54	1	1000	990.709909	-0.009290091	0.009290091	4124
+54	2	1000	989.436475	-0.010563525	0.010563525	4124
+54	3	1000	1006.022077	0.006022077	0.006022077	4124
+54	4	1000	1008.579679	0.008579679	0.008579679	4124
+54	5	1000	988.163437	-0.011836563	0.011836563	4124
+54	6	1000	984.346695	-0.015653305	0.015653305	4124
+54	7	1000	1017.543884	0.017543884	0.017543884	4124
+54	8	1000	999.635049	-0.000364951	0.000364951	4124
+54	9	1000	999.635049	-0.000364951	0.000364951	4124
+54	10	1000	984.346695	-0.015653305	0.015653305	4124
+54	11	1000	1013.699680	0.013699680	0.013699680	4124
+54	12	1000	998.358838	-0.001641162	0.001641162	4124
+54	13	1000	1004.743874	0.004743874	0.004743874	4124
+54	14	1000	1009.859079	0.009859079	0.009859079	4124
+54	15	1000	1018.826088	0.018826088	0.018826088	4124
+54	16	1000	994.532588	-0.005467412	0.005467412	4124
+54	17	1000	1006.022077	0.006022077	0.006022077	4124
+54	18	1000	1002.188665	0.002188665	0.002188665	4124
+54	19	1000	993.257965	-0.006742035	0.006742035	4124
+54	20	5000	4934.140142	-0.013171972	0.013171972	4124
+54	21	5000	4887.707256	-0.022458549	0.022458549	4124
+54	22	5000	4987.858944	-0.002428211	0.002428211	4124
+54	23	10000	9771.093931	-0.022890607	0.022890607	4124
+55	0	1000	986.890795	-0.013109205	0.013109205	4124
+55	1	1000	991.983739	-0.008016261	0.008016261	4124
+55	2	1000	998.358838	-0.001641162	0.001641162	4124
+55	3	1000	1018.826088	0.018826088	0.018826088	4124
+55	4	1000	989.436475	-0.010563525	0.010563525	4124
+55	5	1000	1006.022077	0.006022077	0.006022077	4124
+55	6	1000	991.983739	-0.008016261	0.008016261	4124
+55	7	1000	983.075238	-0.016924762	0.016924762	4124
+55	8	1000	1013.699680	0.013699680	0.013699680	4124
+55	9	1000	997.083024	-0.002916976	0.002916976	4124
+55	10	1000	1006.022077	0.006022077	0.006022077	4124
+55	11	1000	1016.262082	0.016262082	0.016262082	4124
+55	12	1000	1007.300678	0.007300678	0.007300678	4124
+55	13	1000	991.983739	-0.008016261	0.008016261	4124
+55	14	1000	1003.466070	0.003466070	0.003466070	4124
+55	15	1000	1009.859079	0.009859079	0.009859079	4124
+55	16	1000	983.075238	-0.016924762	0.016924762	4124
+55	17	1000	997.083024	-0.002916976	0.002916976	4124
+55	18	1000	988.163437	-0.011836563	0.011836563	4124
+55	19	1000	986.890795	-0.013109205	0.013109205	4124
+55	20	5000	5018.388278	0.003677656	0.003677656	4124
+55	21	5000	4874.536826	-0.025092635	0.025092635	4124
+55	22	5000	5042.291639	0.008458328	0.008458328	4124
+55	23	10000	9948.726102	-0.005127390	0.005127390	4124
+56	0	1000	1003.466070	0.003466070	0.003466070	4124
+56	1	1000	995.807607	-0.004192393	0.004192393	4124
+56	2	1000	988.163437	-0.011836563	0.011836563	4124
+56	3	1000	1012.419079	0.012419079	0.012419079	4124
+56	4	1000	985.618547	-0.014381453	0.014381453	4124
+56	5	1000	990.709909	-0.009290091	0.009290091	4124
+56	6	1000	984.346695	-0.015653305	0.015653305	4124
+56	7	1000	1017.543884	0.017543884	0.017543884	4124
+56	8	1000	1002.188665	0.002188665	0.002188665	4124
+56	9	1000	1006.022077	0.006022077	0.006022077	4124
+56	10	1000	979.263232	-0.020736768	0.020736768	4124
+56	11	1000	997.083024	-0.002916976	0.002916976	4124
+56	12	1000	993.257965	-0.006742035	0.006742035	4124
+56	13	1000	990.709909	-0.009290091	0.009290091	4124
+56	14	1000	1009.859079	0.009859079	0.009859079	4124
+56	15	1000	979.263232	-0.020736768	0.020736768	4124
+56	16	1000	1009.859079	0.009859079	0.009859079	4124
+56	17	1000	991.983739	-0.008016261	0.008016261	4124
+56	18	1000	997.083024	-0.002916976	0.002916976	4124
+56	19	1000	1012.419079	0.012419079	0.012419079	4124
+56	20	5000	5032.030256	0.006406051	0.006406051	4124
+56	21	5000	4930.805994	-0.013838801	0.013838801	4124
+56	22	5000	5114.850264	0.022970053	0.022970053	4124
+56	23	10000	10098.948862	0.009894886	0.009894886	4124
+57	0	1000	993.257965	-0.006742035	0.006742035	4124
+57	1	1000	997.083024	-0.002916976	0.002916976	4124
+57	2	1000	983.075238	-0.016924762	0.016924762	4124
+57	3	1000	1003.466070	0.003466070	0.003466070	4124
+57	4	1000	995.807607	-0.004192393	0.004192393	4124
+57	5	1000	976.723864	-0.023276136	0.023276136	4124
+57	6	1000	986.890795	-0.013109205	0.013109205	4124
+57	7	1000	1014.980680	0.014980680	0.014980680	4124
+57	8	1000	1007.300678	0.007300678	0.007300678	4124
+57	9	1000	1007.300678	0.007300678	0.007300678	4124
+57	10	1000	991.983739	-0.008016261	0.008016261	4124
+57	11	1000	1008.579679	0.008579679	0.008579679	4124
+57	12	1000	995.807607	-0.004192393	0.004192393	4124
+57	13	1000	1012.419079	0.012419079	0.012419079	4124
+57	14	1000	999.635049	-0.000364951	0.000364951	4124
+57	15	1000	999.635049	-0.000364951	0.000364951	4124
+57	16	1000	998.358838	-0.001641162	0.001641162	4124
+57	17	1000	994.532588	-0.005467412	0.005467412	4124
+57	18	1000	1018.826088	0.018826088	0.018826088	4124
+57	19	1000	1000.911658	0.000911658	0.000911658	4124
+57	20	5000	4957.555477	-0.008488905	0.008488905	4124
+57	21	5000	4937.477005	-0.012504599	0.012504599	4124
+57	22	5000	5104.405719	0.020881144	0.020881144	4124
+57	23	10000	9771.093931	-0.022890607	0.022890607	4124
+58	0	1000	983.075238	-0.016924762	0.016924762	4124
+58	1	1000	995.807607	-0.004192393	0.004192393	4124
+58	2	1000	988.163437	-0.011836563	0.011836563	4124
+58	3	1000	999.635049	-0.000364951	0.000364951	4124
+58	4	1000	1006.022077	0.006022077	0.006022077	4124
+58	5	1000	997.083024	-0.002916976	0.002916976	4124
+58	6	1000	998.358838	-0.001641162	0.001641162	4124
+58	7	1000	1003.466070	0.003466070	0.003466070	4124
+58	8	1000	991.983739	-0.008016261	0.008016261	4124
+58	9	1000	1011.138879	0.011138879	0.011138879	4124
+58	10	1000	1016.262082	0.016262082	0.016262082	4124
+58	11	1000	1022.675110	0.022675110	0.022675110	4124
+58	12	1000	1000.911658	0.000911658	0.000911658	4124
+58	13	1000	1004.743874	0.004743874	0.004743874	4124
+58	14	1000	1003.466070	0.003466070	0.003466070	4124
+58	15	1000	1012.419079	0.012419079	0.012419079	4124
+58	16	1000	997.083024	-0.002916976	0.002916976	4124
+58	17	1000	990.709909	-0.009290091	0.009290091	4124
+58	18	1000	1011.138879	0.011138879	0.011138879	4124
+58	19	1000	994.532588	-0.005467412	0.005467412	4124
+58	20	5000	4944.158899	-0.011168220	0.011168220	4124
+58	21	5000	4977.732858	-0.004453428	0.004453428	4124
+58	22	5000	4927.474558	-0.014505088	0.014505088	4124
+58	23	10000	9948.726102	-0.005127390	0.005127390	4124
+59	0	1000	993.257965	-0.006742035	0.006742035	4124
+59	1	1000	1003.466070	0.003466070	0.003466070	4124
+59	2	1000	994.532588	-0.005467412	0.005467412	4124
+59	3	1000	1003.466070	0.003466070	0.003466070	4124
+59	4	1000	1000.911658	0.000911658	0.000911658	4124
+59	5	1000	997.083024	-0.002916976	0.002916976	4124
+59	6	1000	1017.543884	0.017543884	0.017543884	4124
+59	7	1000	1004.743874	0.004743874	0.004743874	4124
+59	8	1000	972.917762	-0.027082238	0.027082238	4124
+59	9	1000	1013.699680	0.013699680	0.013699680	4124
+59	10	1000	1009.859079	0.009859079	0.009859079	4124
+59	11	1000	986.890795	-0.013109205	0.013109205	4124
+59	12	1000	994.532588	-0.005467412	0.005467412	4124
+59	13	1000	1014.980680	0.014980680	0.014980680	4124
+59	14	1000	998.358838	-0.001641162	0.001641162	4124
+59	15	1000	1021.391701	0.021391701	0.021391701	4124
+59	16	1000	1008.579679	0.008579679	0.008579679	4124
+59	17	1000	1012.419079	0.012419079	0.012419079	4124
+59	18	1000	1007.300678	0.007300678	0.007300678	4124
+59	19	1000	1000.911658	0.000911658	0.000911658	4124
+59	20	5000	5028.615500	0.005723100	0.005723100	4124
+59	21	5000	4981.105439	-0.003778912	0.003778912	4124
+59	22	5000	5028.615500	0.005723100	0.005723100	4124
+59	23	10000	10194.208969	0.019420897	0.019420897	4124
+60	0	1000	1021.391701	0.021391701	0.021391701	4124
+60	1	1000	1002.188665	0.002188665	0.002188665	4124
+60	2	1000	985.618547	-0.014381453	0.014381453	4124
+60	3	1000	962.785413	-0.037214587	0.037214587	4124
+60	4	1000	1014.980680	0.014980680	0.014980680	4124
+60	5	1000	997.083024	-0.002916976	0.002916976	4124
+60	6	1000	1008.579679	0.008579679	0.008579679	4124
+60	7	1000	988.163437	-0.011836563	0.011836563	4124
+60	8	1000	1007.300678	0.007300678	0.007300678	4124
+60	9	1000	1021.391701	0.021391701	0.021391701	4124
+60	10	1000	1007.300678	0.007300678	0.007300678	4124
+60	11	1000	993.257965	-0.006742035	0.006742035	4124
+60	12	1000	985.618547	-0.014381453	0.014381453	4124
+60	13	1000	993.257965	-0.006742035	0.006742035	4124
+60	14	1000	993.257965	-0.006742035	0.006742035	4124
+60	15	1000	998.358838	-0.001641162	0.001641162	4124
+60	16	1000	1004.743874	0.004743874	0.004743874	4124
+60	17	1000	990.709909	-0.009290091	0.009290091	4124
+60	18	1000	1011.138879	0.011138879	0.011138879	4124
+60	19	1000	995.807607	-0.004192393	0.004192393	4124
+60	20	5000	5032.030256	0.006406051	0.006406051	4124
+60	21	5000	4960.911479	-0.007817704	0.007817704	4124
+60	22	5000	4937.477005	-0.012504599	0.012504599	4124
+60	23	10000	10005.853945	0.000585395	0.000585395	4124
+61	0	1000	994.532588	-0.005467412	0.005467412	4124
+61	1	1000	977.993351	-0.022006649	0.022006649	4124
+61	2	1000	1002.188665	0.002188665	0.002188665	4124
+61	3	1000	985.618547	-0.014381453	0.014381453	4124
+61	4	1000	983.075238	-0.016924762	0.016924762	4124
+61	5	1000	1008.579679	0.008579679	0.008579679	4124
+61	6	1000	1009.859079	0.009859079	0.009859079	4124
+61	7	1000	1011.138879	0.011138879	0.011138879	4124
+61	8	1000	995.807607	-0.004192393	0.004192393	4124
+61	9	1000	986.890795	-0.013109205	0.013109205	4124
+61	10	1000	1007.300678	0.007300678	0.007300678	4124
+61	11	1000	1016.262082	0.016262082	0.016262082	4124
+61	12	1000	1018.826088	0.018826088	0.018826088	4124
+61	13	1000	995.807607	-0.004192393	0.004192393	4124
+61	14	1000	985.618547	-0.014381453	0.014381453	4124
+61	15	1000	1023.958921	0.023958921	0.023958921	4124
+61	16	1000	998.358838	-0.001641162	0.001641162	4124
+61	17	1000	995.807607	-0.004192393	0.004192393	4124
+61	18	1000	994.532588	-0.005467412	0.005467412	4124
+61	19	1000	999.635049	-0.000364951	0.000364951	4124
+61	20	5000	5025.203588	0.005040718	0.005040718	4124
+61	21	5000	5069.781675	0.013956335	0.013956335	4124
+61	22	5000	5008.186530	0.001637306	0.001637306	4124
+61	23	10000	9971.481716	-0.002851828	0.002851828	4124
+62	0	1000	994.532588	-0.005467412	0.005467412	4124
+62	1	1000	1008.579679	0.008579679	0.008579679	4124
+62	2	1000	1002.188665	0.002188665	0.002188665	4124
+62	3	1000	1006.022077	0.006022077	0.006022077	4124
+62	4	1000	985.618547	-0.014381453	0.014381453	4124
+62	5	1000	995.807607	-0.004192393	0.004192393	4124
+62	6	1000	993.257965	-0.006742035	0.006742035	4124
+62	7	1000	1004.743874	0.004743874	0.004743874	4124
+62	8	1000	981.804175	-0.018195825	0.018195825	4124
+62	9	1000	995.807607	-0.004192393	0.004192393	4124
+62	10	1000	983.075238	-0.016924762	0.016924762	4124
+62	11	1000	979.263232	-0.020736768	0.020736768	4124
+62	12	1000	994.532588	-0.005467412	0.005467412	4124
+62	13	1000	986.890795	-0.013109205	0.013109205	4124
+62	14	1000	986.890795	-0.013109205	0.013109205	4124
+62	15	1000	1008.579679	0.008579679	0.008579679	4124
+62	16	1000	995.807607	-0.004192393	0.004192393	4124
+62	17	1000	1018.826088	0.018826088	0.018826088	4124
+62	18	1000	997.083024	-0.002916976	0.002916976	4124
+62	19	1000	1007.300678	0.007300678	0.007300678	4124
+62	20	5000	4944.158899	-0.011168220	0.011168220	4124
+62	21	5000	5059.451279	0.011890256	0.011890256	4124
+62	22	5000	5052.578794	0.010515759	0.010515759	4124
+62	23	10000	10182.179592	0.018217959	0.018217959	4124
+63	0	1000	1012.419079	0.012419079	0.012419079	4124
+63	1	1000	1026.527751	0.026527751	0.026527751	4124
+63	2	1000	995.807607	-0.004192393	0.004192393	4124
+63	3	1000	989.436475	-0.010563525	0.010563525	4124
+63	4	1000	991.983739	-0.008016261	0.008016261	4124
+63	5	1000	993.257965	-0.006742035	0.006742035	4124
+63	6	1000	1018.826088	0.018826088	0.018826088	4124
+63	7	1000	1012.419079	0.012419079	0.012419079	4124
+63	8	1000	991.983739	-0.008016261	0.008016261	4124
+63	9	1000	993.257965	-0.006742035	0.006742035	4124
+63	10	1000	1008.579679	0.008579679	0.008579679	4124
+63	11	1000	980.533506	-0.019466494	0.019466494	4124
+63	12	1000	1000.911658	0.000911658	0.000911658	4124
+63	13	1000	1021.391701	0.021391701	0.021391701	4124
+63	14	1000	1002.188665	0.002188665	0.002188665	4124
+63	15	1000	1026.527751	0.026527751	0.026527751	4124
+63	16	1000	1004.743874	0.004743874	0.004743874	4124
+63	17	1000	993.257965	-0.006742035	0.006742035	4124
+63	18	1000	1009.859079	0.009859079	0.009859079	4124
+63	19	1000	991.983739	-0.008016261	0.008016261	4124
+63	20	5000	4924.145830	-0.015170834	0.015170834	4124
+63	21	5000	5008.186530	0.001637306	0.001637306	4124
+63	22	5000	5049.146871	0.009829374	0.009829374	4124
+63	23	10000	9914.827977	-0.008517202	0.008517202	4124
+64	0	1000	1008.579679	0.008579679	0.008579679	4124
+64	1	1000	990.709909	-0.009290091	0.009290091	4124
+64	2	1000	1000.911658	0.000911658	0.000911658	4124
+64	3	1000	994.532588	-0.005467412	0.005467412	4124
+64	4	1000	1007.300678	0.007300678	0.007300678	4124
+64	5	1000	981.804175	-0.018195825	0.018195825	4124
+64	6	1000	999.635049	-0.000364951	0.000364951	4124
+64	7	1000	1008.579679	0.008579679	0.008579679	4124
+64	8	1000	997.083024	-0.002916976	0.002916976	4124
+64	9	1000	994.532588	-0.005467412	0.005467412	4124
+64	10	1000	1002.188665	0.002188665	0.002188665	4124
+64	11	1000	1014.980680	0.014980680	0.014980680	4124
+64	12	1000	1008.579679	0.008579679	0.008579679	4124
+64	13	1000	986.890795	-0.013109205	0.013109205	4124
+64	14	1000	1012.419079	0.012419079	0.012419079	4124
+64	15	1000	1011.138879	0.011138879	0.011138879	4124
+64	16	1000	991.983739	-0.008016261	0.008016261	4124
+64	17	1000	994.532588	-0.005467412	0.005467412	4124
+64	18	1000	1004.743874	0.004743874	0.004743874	4124
+64	19	1000	993.257965	-0.006742035	0.006742035	4124
+64	20	5000	5038.868321	0.007773664	0.007773664	4124
+64	21	5000	4994.623603	-0.001075279	0.001075279	4124
+64	22	5000	5090.520960	0.018104192	0.018104192	4124
+64	23	10000	10182.179592	0.018217959	0.018217959	4124
+65	0	1000	1002.188665	0.002188665	0.002188665	4124
+65	1	1000	993.257965	-0.006742035	0.006742035	4124
+65	2	1000	974.186070	-0.025813930	0.025813930	4124
+65	3	1000	1007.300678	0.007300678	0.007300678	4124
+65	4	1000	980.533506	-0.019466494	0.019466494	4124
+65	5	1000	986.890795	-0.013109205	0.013109205	4124
+65	6	1000	1006.022077	0.006022077	0.006022077	4124
+65	7	1000	997.083024	-0.002916976	0.002916976	4124
+65	8	1000	990.709909	-0.009290091	0.009290091	4124
+65	9	1000	999.635049	-0.000364951	0.000364951	4124
+65	10	1000	983.075238	-0.016924762	0.016924762	4124
+65	11	1000	1016.262082	0.016262082	0.016262082	4124
+65	12	1000	1003.466070	0.003466070	0.003466070	4124
+65	13	1000	1013.699680	0.013699680	0.013699680	4124
+65	14	1000	991.983739	-0.008016261	0.008016261	4124
+65	15	1000	993.257965	-0.006742035	0.006742035	4124
+65	16	1000	1009.859079	0.009859079	0.009859079	4124
+65	17	1000	1000.911658	0.000911658	0.000911658	4124
+65	18	1000	1007.300678	0.007300678	0.007300678	4124
+65	19	1000	1008.579679	0.008579679	0.008579679	4124
+65	20	5000	5011.584290	0.002316858	0.002316858	4124
+65	21	5000	5008.186530	0.001637306	0.001637306	4124
+65	22	5000	5018.388278	0.003677656	0.003677656	4124
+65	23	10000	10110.735920	0.011073592	0.011073592	4124
+66	0	1000	986.890795	-0.013109205	0.013109205	4124
+66	1	1000	1004.743874	0.004743874	0.004743874	4124
+66	2	1000	985.618547	-0.014381453	0.014381453	4124
+66	3	1000	993.257965	-0.006742035	0.006742035	4124
+66	4	1000	993.257965	-0.006742035	0.006742035	4124
+66	5	1000	1002.188665	0.002188665	0.002188665	4124
+66	6	1000	1008.579679	0.008579679	0.008579679	4124
+66	7	1000	1009.859079	0.009859079	0.009859079	4124
+66	8	1000	986.890795	-0.013109205	0.013109205	4124
+66	9	1000	984.346695	-0.015653305	0.015653305	4124
+66	10	1000	988.163437	-0.011836563	0.011836563	4124
+66	11	1000	1003.466070	0.003466070	0.003466070	4124
+66	12	1000	1021.391701	0.021391701	0.021391701	4124
+66	13	1000	991.983739	-0.008016261	0.008016261	4124
+66	14	1000	999.635049	-0.000364951	0.000364951	4124
+66	15	1000	983.075238	-0.016924762	0.016924762	4124
+66	16	1000	1009.859079	0.009859079	0.009859079	4124
+66	17	1000	998.358838	-0.001641162	0.001641162	4124
+66	18	1000	1002.188665	0.002188665	0.002188665	4124
+66	19	1000	991.983739	-0.008016261	0.008016261	4124
+66	20	5000	4998.010127	-0.000397975	0.000397975	4124
+66	21	5000	4950.851711	-0.009829658	0.009829658	4124
+66	22	5000	4934.140142	-0.013171972	0.013171972	4124
+66	23	10000	10146.301990	0.014630199	0.014630199	4124
+67	0	1000	993.257965	-0.006742035	0.006742035	4124
+67	1	1000	1017.543884	0.017543884	0.017543884	4124
+67	2	1000	1025.243135	0.025243135	0.025243135	4124
+67	3	1000	991.983739	-0.008016261	0.008016261	4124
+67	4	1000	1006.022077	0.006022077	0.006022077	4124
+67	5	1000	979.263232	-0.020736768	0.020736768	4124
+67	6	1000	1003.466070	0.003466070	0.003466070	4124
+67	7	1000	1014.980680	0.014980680	0.014980680	4124
+67	8	1000	1002.188665	0.002188665	0.002188665	4124
+67	9	1000	1002.188665	0.002188665	0.002188665	4124
+67	10	1000	1003.466070	0.003466070	0.003466070	4124
+67	11	1000	1000.911658	0.000911658	0.000911658	4124
+67	12	1000	1013.699680	0.013699680	0.013699680	4124
+67	13	1000	999.635049	-0.000364951	0.000364951	4124
+67	14	1000	986.890795	-0.013109205	0.013109205	4124
+67	15	1000	1020.108694	0.020108694	0.020108694	4124
+67	16	1000	1002.188665	0.002188665	0.002188665	4124
+67	17	1000	995.807607	-0.004192393	0.004192393	4124
+67	18	1000	1004.743874	0.004743874	0.004743874	4124
+67	19	1000	993.257965	-0.006742035	0.006742035	4124
+67	20	5000	4904.230070	-0.019153986	0.019153986	4124
+67	21	5000	4947.503938	-0.010499212	0.010499212	4124
+67	22	5000	5032.030256	0.006406051	0.006406051	4124
+67	23	10000	9771.093931	-0.022890607	0.022890607	4124
+68	0	1000	1013.699680	0.013699680	0.013699680	4124
+68	1	1000	994.532588	-0.005467412	0.005467412	4124
+68	2	1000	995.807607	-0.004192393	0.004192393	4124
+68	3	1000	1018.826088	0.018826088	0.018826088	4124
+68	4	1000	980.533506	-0.019466494	0.019466494	4124
+68	5	1000	993.257965	-0.006742035	0.006742035	4124
+68	6	1000	991.983739	-0.008016261	0.008016261	4124
+68	7	1000	989.436475	-0.010563525	0.010563525	4124
+68	8	1000	990.709909	-0.009290091	0.009290091	4124
+68	9	1000	999.635049	-0.000364951	0.000364951	4124
+68	10	1000	975.454771	-0.024545229	0.024545229	4124
+68	11	1000	1016.262082	0.016262082	0.016262082	4124
+68	12	1000	995.807607	-0.004192393	0.004192393	4124
+68	13	1000	1014.980680	0.014980680	0.014980680	4124
+68	14	1000	1003.466070	0.003466070	0.003466070	4124
+68	15	1000	999.635049	-0.000364951	0.000364951	4124
+68	16	1000	1006.022077	0.006022077	0.006022077	4124
+68	17	1000	995.807607	-0.004192393	0.004192393	4124
+68	18	1000	1007.300678	0.007300678	0.007300678	4124
+68	19	1000	998.358838	-0.001641162	0.001641162	4124
+68	20	5000	4987.858944	-0.002428211	0.002428211	4124
+68	21	5000	5093.987740	0.018797548	0.018797548	4124
+68	22	5000	4987.858944	-0.002428211	0.002428211	4124
+68	23	10000	9580.054126	-0.041994587	0.041994587	4124
+69	0	1000	998.358838	-0.001641162	0.001641162	4124
+69	1	1000	998.358838	-0.001641162	0.001641162	4124
+69	2	1000	990.709909	-0.009290091	0.009290091	4124
+69	3	1000	1023.958921	0.023958921	0.023958921	4124
+69	4	1000	990.709909	-0.009290091	0.009290091	4124
+69	5	1000	1020.108694	0.020108694	0.020108694	4124
+69	6	1000	981.804175	-0.018195825	0.018195825	4124
+69	7	1000	983.075238	-0.016924762	0.016924762	4124
+69	8	1000	1006.022077	0.006022077	0.006022077	4124
+69	9	1000	997.083024	-0.002916976	0.002916976	4124
+69	10	1000	1017.543884	0.017543884	0.017543884	4124
+69	11	1000	988.163437	-0.011836563	0.011836563	4124
+69	12	1000	981.804175	-0.018195825	0.018195825	4124
+69	13	1000	1000.911658	0.000911658	0.000911658	4124
+69	14	1000	991.983739	-0.008016261	0.008016261	4124
+69	15	1000	976.723864	-0.023276136	0.023276136	4124
+69	16	1000	991.983739	-0.008016261	0.008016261	4124
+69	17	1000	994.532588	-0.005467412	0.005467412	4124
+69	18	1000	985.618547	-0.014381453	0.014381453	4124
+69	19	1000	1016.262082	0.016262082	0.016262082	4124
+69	20	5000	5093.987740	0.018797548	0.018797548	4124
+69	21	5000	4789.946052	-0.042010790	0.042010790	4124
+69	22	5000	5083.596191	0.016719238	0.016719238	4124
+69	23	10000	10075.476018	0.007547602	0.007547602	4124
+70	0	1000	988.163437	-0.011836563	0.011836563	4124
+70	1	1000	1004.743874	0.004743874	0.004743874	4124
+70	2	1000	1002.188665	0.002188665	0.002188665	4124
+70	3	1000	1013.699680	0.013699680	0.013699680	4124
+70	4	1000	994.532588	-0.005467412	0.005467412	4124
+70	5	1000	1018.826088	0.018826088	0.018826088	4124
+70	6	1000	1006.022077	0.006022077	0.006022077	4124
+70	7	1000	976.723864	-0.023276136	0.023276136	4124
+70	8	1000	1000.911658	0.000911658	0.000911658	4124
+70	9	1000	990.709909	-0.009290091	0.009290091	4124
+70	10	1000	994.532588	-0.005467412	0.005467412	4124
+70	11	1000	986.890795	-0.013109205	0.013109205	4124
+70	12	1000	995.807607	-0.004192393	0.004192393	4124
+70	13	1000	989.436475	-0.010563525	0.010563525	4124
+70	14	1000	1007.300678	0.007300678	0.007300678	4124
+70	15	1000	998.358838	-0.001641162	0.001641162	4124
+70	16	1000	989.436475	-0.010563525	0.010563525	4124
+70	17	1000	986.890795	-0.013109205	0.013109205	4124
+70	18	1000	990.709909	-0.009290091	0.009290091	4124
+70	19	1000	1007.300678	0.007300678	0.007300678	4124
+70	20	5000	5001.399453	0.000279891	0.000279891	4124
+70	21	5000	5052.578794	0.010515759	0.010515759	4124
+70	22	5000	5146.344652	0.029268930	0.029268930	4124
+70	23	10000	10110.735920	0.011073592	0.011073592	4124
+71	0	1000	995.807607	-0.004192393	0.004192393	4124
+71	1	1000	1002.188665	0.002188665	0.002188665	4124
+71	2	1000	997.083024	-0.002916976	0.002916976	4124
+71	3	1000	1027.812771	0.027812771	0.027812771	4124
+71	4	1000	975.454771	-0.024545229	0.024545229	4124
+71	5	1000	993.257965	-0.006742035	0.006742035	4124
+71	6	1000	1006.022077	0.006022077	0.006022077	4124
+71	7	1000	1007.300678	0.007300678	0.007300678	4124
+71	8	1000	1012.419079	0.012419079	0.012419079	4124
+71	9	1000	1023.958921	0.023958921	0.023958921	4124
+71	10	1000	960.256237	-0.039743763	0.039743763	4124
+71	11	1000	994.532588	-0.005467412	0.005467412	4124
+71	12	1000	988.163437	-0.011836563	0.011836563	4124
+71	13	1000	994.532588	-0.005467412	0.005467412	4124
+71	14	1000	1018.826088	0.018826088	0.018826088	4124
+71	15	1000	1009.859079	0.009859079	0.009859079	4124
+71	16	1000	986.890795	-0.013109205	0.013109205	4124
+71	17	1000	981.804175	-0.018195825	0.018195825	4124
+71	18	1000	1020.108694	0.020108694	0.020108694	4124
+71	19	1000	995.807607	-0.004192393	0.004192393	4124
+71	20	5000	5028.615500	0.005723100	0.005723100	4124
+71	21	5000	5028.615500	0.005723100	0.005723100	4124
+71	22	5000	4960.911479	-0.007817704	0.007817704	4124
+71	23	10000	9825.780992	-0.017421901	0.017421901	4124
+72	0	1000	1004.743874	0.004743874	0.004743874	4124
+72	1	1000	976.723864	-0.023276136	0.023276136	4124
+72	2	1000	989.436475	-0.010563525	0.010563525	4124
+72	3	1000	993.257965	-0.006742035	0.006742035	4124
+72	4	1000	977.993351	-0.022006649	0.022006649	4124
+72	5	1000	1020.108694	0.020108694	0.020108694	4124
+72	6	1000	990.709909	-0.009290091	0.009290091	4124
+72	7	1000	1021.391701	0.021391701	0.021391701	4124
+72	8	1000	994.532588	-0.005467412	0.005467412	4124
+72	9	1000	1004.743874	0.004743874	0.004743874	4124
+72	10	1000	997.083024	-0.002916976	0.002916976	4124
+72	11	1000	995.807607	-0.004192393	0.004192393	4124
+72	12	1000	988.163437	-0.011836563	0.011836563	4124
+72	13	1000	1006.022077	0.006022077	0.006022077	4124
+72	14	1000	1004.743874	0.004743874	0.004743874	4124
+72	15	1000	1012.419079	0.012419079	0.012419079	4124
+72	16	1000	998.358838	-0.001641162	0.001641162	4124
+72	17	1000	997.083024	-0.002916976	0.002916976	4124
+72	18	1000	1014.980680	0.014980680	0.014980680	4124
+72	19	1000	999.635049	-0.000364951	0.000364951	4124
+72	20	5000	4984.480800	-0.003103840	0.003103840	4124
+72	21	5000	4907.542646	-0.018491471	0.018491471	4124
+72	22	5000	4937.477005	-0.012504599	0.012504599	4124
+72	23	10000	10194.208969	0.019420897	0.019420897	4124
+73	0	1000	994.532588	-0.005467412	0.005467412	4124
+73	1	1000	995.807607	-0.004192393	0.004192393	4124
+73	2	1000	988.163437	-0.011836563	0.011836563	4124
+73	3	1000	994.532588	-0.005467412	0.005467412	4124
+73	4	1000	1016.262082	0.016262082	0.016262082	4124
+73	5	1000	991.983739	-0.008016261	0.008016261	4124
+73	6	1000	986.890795	-0.013109205	0.013109205	4124
+73	7	1000	980.533506	-0.019466494	0.019466494	4124
+73	8	1000	1006.022077	0.006022077	0.006022077	4124
+73	9	1000	1006.022077	0.006022077	0.006022077	4124
+73	10	1000	1022.675110	0.022675110	0.022675110	4124
+73	11	1000	999.635049	-0.000364951	0.000364951	4124
+73	12	1000	971.649847	-0.028350153	0.028350153	4124
+73	13	1000	1004.743874	0.004743874	0.004743874	4124
+73	14	1000	1014.980680	0.014980680	0.014980680	4124
+73	15	1000	1000.911658	0.000911658	0.000911658	4124
+73	16	1000	970.382324	-0.029617676	0.029617676	4124
+73	17	1000	1013.699680	0.013699680	0.013699680	4124
+73	18	1000	1002.188665	0.002188665	0.002188665	4124
+73	19	1000	994.532588	-0.005467412	0.005467412	4124
+73	20	5000	4861.408610	-0.027718278	0.027718278	4124
+73	21	5000	4984.480800	-0.003103840	0.003103840	4124
+73	22	5000	5001.399453	0.000279891	0.000279891	4124
+73	23	10000	10158.226307	0.015822631	0.015822631	4124
+74	0	1000	991.983739	-0.008016261	0.008016261	4124
+74	1	1000	1007.300678	0.007300678	0.007300678	4124
+74	2	1000	990.709909	-0.009290091	0.009290091	4124
+74	3	1000	1004.743874	0.004743874	0.004743874	4124
+74	4	1000	1006.022077	0.006022077	0.006022077	4124
+74	5	1000	979.263232	-0.020736768	0.020736768	4124
+74	6	1000	995.807607	-0.004192393	0.004192393	4124
+74	7	1000	980.533506	-0.019466494	0.019466494	4124
+74	8	1000	1002.188665	0.002188665	0.002188665	4124
+74	9	1000	969.115193	-0.030884807	0.030884807	4124
+74	10	1000	1012.419079	0.012419079	0.012419079	4124
+74	11	1000	1002.188665	0.002188665	0.002188665	4124
+74	12	1000	1009.859079	0.009859079	0.009859079	4124
+74	13	1000	1017.543884	0.017543884	0.017543884	4124
+74	14	1000	994.532588	-0.005467412	0.005467412	4124
+74	15	1000	995.807607	-0.004192393	0.004192393	4124
+74	16	1000	995.807607	-0.004192393	0.004192393	4124
+74	17	1000	1002.188665	0.002188665	0.002188665	4124
+74	18	1000	1014.980680	0.014980680	0.014980680	4124
+74	19	1000	1002.188665	0.002188665	0.002188665	4124
+74	20	5000	5032.030256	0.006406051	0.006406051	4124
+74	21	5000	5114.850264	0.022970053	0.022970053	4124
+74	22	5000	5025.203588	0.005040718	0.005040718	4124
+74	23	10000	10087.195626	0.008719563	0.008719563	4124
+75	0	1000	999.635049	-0.000364951	0.000364951	4124
+75	1	1000	994.532588	-0.005467412	0.005467412	4124
+75	2	1000	1017.543884	0.017543884	0.017543884	4124
+75	3	1000	988.163437	-0.011836563	0.011836563	4124
+75	4	1000	1004.743874	0.004743874	0.004743874	4124
+75	5	1000	1002.188665	0.002188665	0.002188665	4124
+75	6	1000	995.807607	-0.004192393	0.004192393	4124
+75	7	1000	989.436475	-0.010563525	0.010563525	4124
+75	8	1000	1016.262082	0.016262082	0.016262082	4124
+75	9	1000	1034.243923	0.034243923	0.034243923	4124
+75	10	1000	975.454771	-0.024545229	0.024545229	4124
+75	11	1000	994.532588	-0.005467412	0.005467412	4124
+75	12	1000	1030.384020	0.030384020	0.030384020	4124
+75	13	1000	1006.022077	0.006022077	0.006022077	4124
+75	14	1000	998.358838	-0.001641162	0.001641162	4124
+75	15	1000	994.532588	-0.005467412	0.005467412	4124
+75	16	1000	993.257965	-0.006742035	0.006742035	4124
+75	17	1000	1011.138879	0.011138879	0.011138879	4124
+75	18	1000	1008.579679	0.008579679	0.008579679	4124
+75	19	1000	994.532588	-0.005467412	0.005467412	4124
+75	20	5000	5059.451279	0.011890256	0.011890256	4124
+75	21	5000	4970.996014	-0.005800797	0.005800797	4124
+75	22	5000	5059.451279	0.011890256	0.011890256	4124
+75	23	10000	9706.418903	-0.029358110	0.029358110	4124
+76	0	1000	988.163437	-0.011836563	0.011836563	4124
+76	1	1000	976.723864	-0.023276136	0.023276136	4124
+76	2	1000	1023.958921	0.023958921	0.023958921	4124
+76	3	1000	988.163437	-0.011836563	0.011836563	4124
+76	4	1000	999.635049	-0.000364951	0.000364951	4124
+76	5	1000	997.083024	-0.002916976	0.002916976	4124
+76	6	1000	985.618547	-0.014381453	0.014381453	4124
+76	7	1000	981.804175	-0.018195825	0.018195825	4124
+76	8	1000	1027.812771	0.027812771	0.027812771	4124
+76	9	1000	995.807607	-0.004192393	0.004192393	4124
+76	10	1000	997.083024	-0.002916976	0.002916976	4124
+76	11	1000	1003.466070	0.003466070	0.003466070	4124
+76	12	1000	983.075238	-0.016924762	0.016924762	4124
+76	13	1000	999.635049	-0.000364951	0.000364951	4124
+76	14	1000	1000.911658	0.000911658	0.000911658	4124
+76	15	1000	1004.743874	0.004743874	0.004743874	4124
+76	16	1000	1022.675110	0.022675110	0.022675110	4124
+76	17	1000	997.083024	-0.002916976	0.002916976	4124
+76	18	1000	994.532588	-0.005467412	0.005467412	4124
+76	19	1000	1006.022077	0.006022077	0.006022077	4124
+76	20	5000	5069.781675	0.013956335	0.013956335	4124
+76	21	5000	5028.615500	0.005723100	0.005723100	4124
+76	22	5000	4950.851711	-0.009829658	0.009829658	4124
+76	23	10000	10218.374231	0.021837423	0.021837423	4124
+77	0	1000	998.358838	-0.001641162	0.001641162	4124
+77	1	1000	1003.466070	0.003466070	0.003466070	4124
+77	2	1000	1016.262082	0.016262082	0.016262082	4124
+77	3	1000	1009.859079	0.009859079	0.009859079	4124
+77	4	1000	984.346695	-0.015653305	0.015653305	4124
+77	5	1000	981.804175	-0.018195825	0.018195825	4124
+77	6	1000	1006.022077	0.006022077	0.006022077	4124
+77	7	1000	1006.022077	0.006022077	0.006022077	4124
+77	8	1000	1012.419079	0.012419079	0.012419079	4124
+77	9	1000	989.436475	-0.010563525	0.010563525	4124
+77	10	1000	1002.188665	0.002188665	0.002188665	4124
+77	11	1000	1014.980680	0.014980680	0.014980680	4124
+77	12	1000	981.804175	-0.018195825	0.018195825	4124
+77	13	1000	1004.743874	0.004743874	0.004743874	4124
+77	14	1000	1011.138879	0.011138879	0.011138879	4124
+77	15	1000	1008.579679	0.008579679	0.008579679	4124
+77	16	1000	974.186070	-0.025813930	0.025813930	4124
+77	17	1000	994.532588	-0.005467412	0.005467412	4124
+77	18	1000	1013.699680	0.013699680	0.013699680	4124
+77	19	1000	997.083024	-0.002916976	0.002916976	4124
+77	20	5000	4927.474558	-0.014505088	0.014505088	4124
+77	21	5000	4937.477005	-0.012504599	0.012504599	4124
+77	22	5000	4894.308385	-0.021138323	0.021138323	4124
+77	23	10000	9749.421923	-0.025057808	0.025057808	4124
+78	0	1000	993.257965	-0.006742035	0.006742035	4124
+78	1	1000	991.983739	-0.008016261	0.008016261	4124
+78	2	1000	1008.579679	0.008579679	0.008579679	4124
+78	3	1000	1009.859079	0.009859079	0.009859079	4124
+78	4	1000	1009.859079	0.009859079	0.009859079	4124
+78	5	1000	991.983739	-0.008016261	0.008016261	4124
+78	6	1000	985.618547	-0.014381453	0.014381453	4124
+78	7	1000	994.532588	-0.005467412	0.005467412	4124
+78	8	1000	995.807607	-0.004192393	0.004192393	4124
+78	9	1000	997.083024	-0.002916976	0.002916976	4124
+78	10	1000	1023.958921	0.023958921	0.023958921	4124
+78	11	1000	1006.022077	0.006022077	0.006022077	4124
+78	12	1000	1003.466070	0.003466070	0.003466070	4124
+78	13	1000	1012.419079	0.012419079	0.012419079	4124
+78	14	1000	1006.022077	0.006022077	0.006022077	4124
+78	15	1000	1018.826088	0.018826088	0.018826088	4124
+78	16	1000	1022.675110	0.022675110	0.022675110	4124
+78	17	1000	1004.743874	0.004743874	0.004743874	4124
+78	18	1000	985.618547	-0.014381453	0.014381453	4124
+78	19	1000	1003.466070	0.003466070	0.003466070	4124
+78	20	5000	5056.013595	0.011202719	0.011202719	4124
+78	21	5000	4940.816590	-0.011836682	0.011836682	4124
+78	22	5000	4950.851711	-0.009829658	0.009829658	4124
+78	23	10000	9717.127406	-0.028287259	0.028287259	4124
+79	0	1000	986.890795	-0.013109205	0.013109205	4124
+79	1	1000	1004.743874	0.004743874	0.004743874	4124
+79	2	1000	1000.911658	0.000911658	0.000911658	4124
+79	3	1000	986.890795	-0.013109205	0.013109205	4124
+79	4	1000	1000.911658	0.000911658	0.000911658	4124
+79	5	1000	995.807607	-0.004192393	0.004192393	4124
+79	6	1000	984.346695	-0.015653305	0.015653305	4124
+79	7	1000	999.635049	-0.000364951	0.000364951	4124
+79	8	1000	1008.579679	0.008579679	0.008579679	4124
+79	9	1000	998.358838	-0.001641162	0.001641162	4124
+79	10	1000	1002.188665	0.002188665	0.002188665	4124
+79	11	1000	989.436475	-0.010563525	0.010563525	4124
+79	12	1000	989.436475	-0.010563525	0.010563525	4124
+79	13	1000	994.532588	-0.005467412	0.005467412	4124
+79	14	1000	1004.743874	0.004743874	0.004743874	4124
+79	15	1000	999.635049	-0.000364951	0.000364951	4124
+79	16	1000	1003.466070	0.003466070	0.003466070	4124
+79	17	1000	1016.262082	0.016262082	0.016262082	4124
+79	18	1000	1012.419079	0.012419079	0.012419079	4124
+79	19	1000	1000.911658	0.000911658	0.000911658	4124
+79	20	5000	4974.363051	-0.005127390	0.005127390	4124
+79	21	5000	5042.291639	0.008458328	0.008458328	4124
+79	22	5000	5021.794515	0.004358903	0.004358903	4124
+79	23	10000	9960.088106	-0.003991189	0.003991189	4124
+80	0	1000	1007.300678	0.007300678	0.007300678	4124
+80	1	1000	999.635049	-0.000364951	0.000364951	4124
+80	2	1000	1000.911658	0.000911658	0.000911658	4124
+80	3	1000	1016.262082	0.016262082	0.016262082	4124
+80	4	1000	1017.543884	0.017543884	0.017543884	4124
+80	5	1000	998.358838	-0.001641162	0.001641162	4124
+80	6	1000	1014.980680	0.014980680	0.014980680	4124
+80	7	1000	983.075238	-0.016924762	0.016924762	4124
+80	8	1000	998.358838	-0.001641162	0.001641162	4124
+80	9	1000	1027.812771	0.027812771	0.027812771	4124
+80	10	1000	995.807607	-0.004192393	0.004192393	4124
+80	11	1000	999.635049	-0.000364951	0.000364951	4124
+80	12	1000	988.163437	-0.011836563	0.011836563	4124
+80	13	1000	1014.980680	0.014980680	0.014980680	4124
+80	14	1000	999.635049	-0.000364951	0.000364951	4124
+80	15	1000	999.635049	-0.000364951	0.000364951	4124
+80	16	1000	1014.980680	0.014980680	0.014980680	4124
+80	17	1000	1013.699680	0.013699680	0.013699680	4124
+80	18	1000	998.358838	-0.001641162	0.001641162	4124
+80	19	1000	981.804175	-0.018195825	0.018195825	4124
+80	20	5000	5028.615500	0.005723100	0.005723100	4124
+80	21	5000	4954.202223	-0.009159555	0.009159555	4124
+80	22	5000	4954.202223	-0.009159555	0.009159555	4124
+80	23	10000	9836.806570	-0.016319343	0.016319343	4124
+81	0	1000	985.618547	-0.014381453	0.014381453	4124
+81	1	1000	1009.859079	0.009859079	0.009859079	4124
+81	2	1000	1017.543884	0.017543884	0.017543884	4124
+81	3	1000	984.346695	-0.015653305	0.015653305	4124
+81	4	1000	995.807607	-0.004192393	0.004192393	4124
+81	5	1000	1009.859079	0.009859079	0.009859079	4124
+81	6	1000	998.358838	-0.001641162	0.001641162	4124
+81	7	1000	1000.911658	0.000911658	0.000911658	4124
+81	8	1000	997.083024	-0.002916976	0.002916976	4124
+81	9	1000	1006.022077	0.006022077	0.006022077	4124
+81	10	1000	993.257965	-0.006742035	0.006742035	4124
+81	11	1000	1003.466070	0.003466070	0.003466070	4124
+81	12	1000	1008.579679	0.008579679	0.008579679	4124
+81	13	1000	997.083024	-0.002916976	0.002916976	4124
+81	14	1000	999.635049	-0.000364951	0.000364951	4124
+81	15	1000	1000.911658	0.000911658	0.000911658	4124
+81	16	1000	995.807607	-0.004192393	0.004192393	4124
+81	17	1000	985.618547	-0.014381453	0.014381453	4124
+81	18	1000	1006.022077	0.006022077	0.006022077	4124
+81	19	1000	1004.743874	0.004743874	0.004743874	4124
+81	20	5000	4994.623603	-0.001075279	0.001075279	4124
+81	21	5000	4991.239877	-0.001752025	0.001752025	4124
+81	22	5000	5045.717821	0.009143564	0.009143564	4124
+81	23	10000	9836.806570	-0.016319343	0.016319343	4124
+82	0	1000	990.709909	-0.009290091	0.009290091	4124
+82	1	1000	1004.743874	0.004743874	0.004743874	4124
+82	2	1000	984.346695	-0.015653305	0.015653305	4124
+82	3	1000	989.436475	-0.010563525	0.010563525	4124
+82	4	1000	999.635049	-0.000364951	0.000364951	4124
+82	5	1000	989.436475	-0.010563525	0.010563525	4124
+82	6	1000	1007.300678	0.007300678	0.007300678	4124
+82	7	1000	999.635049	-0.000364951	0.000364951	4124
+82	8	1000	1008.579679	0.008579679	0.008579679	4124
+82	9	1000	1020.108694	0.020108694	0.020108694	4124
+82	10	1000	1000.911658	0.000911658	0.000911658	4124
+82	11	1000	1003.466070	0.003466070	0.003466070	4124
+82	12	1000	993.257965	-0.006742035	0.006742035	4124
+82	13	1000	988.163437	-0.011836563	0.011836563	4124
+82	14	1000	1009.859079	0.009859079	0.009859079	4124
+82	15	1000	1002.188665	0.002188665	0.002188665	4124
+82	16	1000	995.807607	-0.004192393	0.004192393	4124
+82	17	1000	997.083024	-0.002916976	0.002916976	4124
+82	18	1000	995.807607	-0.004192393	0.004192393	4124
+82	19	1000	995.807607	-0.004192393	0.004192393	4124
+82	20	5000	5083.596191	0.016719238	0.016719238	4124
+82	21	5000	4910.857903	-0.017828419	0.017828419	4124
+82	22	5000	5001.399453	0.000279891	0.000279891	4124
+82	23	10000	9903.590659	-0.009640934	0.009640934	4124
+83	0	1000	994.532588	-0.005467412	0.005467412	4124
+83	1	1000	1003.466070	0.003466070	0.003466070	4124
+83	2	1000	1017.543884	0.017543884	0.017543884	4124
+83	3	1000	985.618547	-0.014381453	0.014381453	4124
+83	4	1000	994.532588	-0.005467412	0.005467412	4124
+83	5	1000	985.618547	-0.014381453	0.014381453	4124
+83	6	1000	991.983739	-0.008016261	0.008016261	4124
+83	7	1000	988.163437	-0.011836563	0.011836563	4124
+83	8	1000	1023.958921	0.023958921	0.023958921	4124
+83	9	1000	1031.670251	0.031670251	0.031670251	4124
+83	10	1000	994.532588	-0.005467412	0.005467412	4124
+83	11	1000	999.635049	-0.000364951	0.000364951	4124
+83	12	1000	1000.911658	0.000911658	0.000911658	4124
+83	13	1000	1006.022077	0.006022077	0.006022077	4124
+83	14	1000	1000.911658	0.000911658	0.000911658	4124
+83	15	1000	1011.138879	0.011138879	0.011138879	4124
+83	16	1000	1002.188665	0.002188665	0.002188665	4124
+83	17	1000	998.358838	-0.001641162	0.001641162	4124
+83	18	1000	1016.262082	0.016262082	0.016262082	4124
+83	19	1000	971.649847	-0.028350153	0.028350153	4124
+83	20	5000	5080.138191	0.016027638	0.016027638	4124
+83	21	5000	5011.584290	0.002316858	0.002316858	4124
+83	22	5000	5135.819593	0.027163919	0.027163919	4124
+83	23	10000	10040.517058	0.004051706	0.004051706	4124
+84	0	1000	997.083024	-0.002916976	0.002916976	4124
+84	1	1000	1007.300678	0.007300678	0.007300678	4124
+84	2	1000	986.890795	-0.013109205	0.013109205	4124
+84	3	1000	999.635049	-0.000364951	0.000364951	4124
+84	4	1000	993.257965	-0.006742035	0.006742035	4124
+84	5	1000	997.083024	-0.002916976	0.002916976	4124
+84	6	1000	1002.188665	0.002188665	0.002188665	4124
+84	7	1000	990.709909	-0.009290091	0.009290091	4124
+84	8	1000	1011.138879	0.011138879	0.011138879	4124
+84	9	1000	998.358838	-0.001641162	0.001641162	4124
+84	10	1000	1002.188665	0.002188665	0.002188665	4124
+84	11	1000	986.890795	-0.013109205	0.013109205	4124
+84	12	1000	998.358838	-0.001641162	0.001641162	4124
+84	13	1000	1013.699680	0.013699680	0.013699680	4124
+84	14	1000	990.709909	-0.009290091	0.009290091	4124
+84	15	1000	985.618547	-0.014381453	0.014381453	4124
+84	16	1000	1000.911658	0.000911658	0.000911658	4124
+84	17	1000	995.807607	-0.004192393	0.004192393	4124
+84	18	1000	998.358838	-0.001641162	0.001641162	4124
+84	19	1000	1006.022077	0.006022077	0.006022077	4124
+84	20	5000	5021.794515	0.004358903	0.004358903	4124
+84	21	5000	5142.833293	0.028566659	0.028566659	4124
+84	22	5000	5001.399453	0.000279891	0.000279891	4124
+84	23	10000	9695.738323	-0.030426168	0.030426168	4124
+85	0	1000	990.709909	-0.009290091	0.009290091	4124
+85	1	1000	1012.419079	0.012419079	0.012419079	4124
+85	2	1000	991.983739	-0.008016261	0.008016261	4124
+85	3	1000	986.890795	-0.013109205	0.013109205	4124
+85	4	1000	993.257965	-0.006742035	0.006742035	4124
+85	5	1000	1004.743874	0.004743874	0.004743874	4124
+85	6	1000	1011.138879	0.011138879	0.011138879	4124
+85	7	1000	1016.262082	0.016262082	0.016262082	4124
+85	8	1000	1006.022077	0.006022077	0.006022077	4124
+85	9	1000	994.532588	-0.005467412	0.005467412	4124
+85	10	1000	1017.543884	0.017543884	0.017543884	4124
+85	11	1000	976.723864	-0.023276136	0.023276136	4124
+85	12	1000	1007.300678	0.007300678	0.007300678	4124
+85	13	1000	989.436475	-0.010563525	0.010563525	4124
+85	14	1000	1013.699680	0.013699680	0.013699680	4124
+85	15	1000	1004.743874	0.004743874	0.004743874	4124
+85	16	1000	991.983739	-0.008016261	0.008016261	4124
+85	17	1000	997.083024	-0.002916976	0.002916976	4124
+85	18	1000	997.083024	-0.002916976	0.002916976	4124
+85	19	1000	999.635049	-0.000364951	0.000364951	4124
+85	20	5000	4994.623603	-0.001075279	0.001075279	4124
+85	21	5000	5093.987740	0.018797548	0.018797548	4124
+85	22	5000	4950.851711	-0.009829658	0.009829658	4124
+85	23	10000	10098.948862	0.009894886	0.009894886	4124
+86	0	1000	1008.579679	0.008579679	0.008579679	4124
+86	1	1000	981.804175	-0.018195825	0.018195825	4124
+86	2	1000	1029.098194	0.029098194	0.029098194	4124
+86	3	1000	979.263232	-0.020736768	0.020736768	4124
+86	4	1000	1007.300678	0.007300678	0.007300678	4124
+86	5	1000	1007.300678	0.007300678	0.007300678	4124
+86	6	1000	1004.743874	0.004743874	0.004743874	4124
+86	7	1000	976.723864	-0.023276136	0.023276136	4124
+86	8	1000	984.346695	-0.015653305	0.015653305	4124
+86	9	1000	1002.188665	0.002188665	0.002188665	4124
+86	10	1000	1012.419079	0.012419079	0.012419079	4124
+86	11	1000	993.257965	-0.006742035	0.006742035	4124
+86	12	1000	1012.419079	0.012419079	0.012419079	4124
+86	13	1000	998.358838	-0.001641162	0.001641162	4124
+86	14	1000	994.532588	-0.005467412	0.005467412	4124
+86	15	1000	1007.300678	0.007300678	0.007300678	4124
+86	16	1000	989.436475	-0.010563525	0.010563525	4124
+86	17	1000	1011.138879	0.011138879	0.011138879	4124
+86	18	1000	986.890795	-0.013109205	0.013109205	4124
+86	19	1000	1013.699680	0.013699680	0.013699680	4124
+86	20	5000	5035.447861	0.007089572	0.007089572	4124
+86	21	5000	5045.717821	0.009143564	0.009143564	4124
+86	22	5000	4957.555477	-0.008488905	0.008488905	4124
+86	23	10000	10230.510536	0.023051054	0.023051054	4124
+87	0	1000	1012.419079	0.012419079	0.012419079	4124
+87	1	1000	1000.911658	0.000911658	0.000911658	4124
+87	2	1000	1002.188665	0.002188665	0.002188665	4124
+87	3	1000	1011.138879	0.011138879	0.011138879	4124
+87	4	1000	1002.188665	0.002188665	0.002188665	4124
+87	5	1000	1018.826088	0.018826088	0.018826088	4124
+87	6	1000	998.358838	-0.001641162	0.001641162	4124
+87	7	1000	1004.743874	0.004743874	0.004743874	4124
+87	8	1000	993.257965	-0.006742035	0.006742035	4124
+87	9	1000	1000.911658	0.000911658	0.000911658	4124
+87	10	1000	1026.527751	0.026527751	0.026527751	4124
+87	11	1000	1012.419079	0.012419079	0.012419079	4124
+87	12	1000	1009.859079	0.009859079	0.009859079	4124
+87	13	1000	995.807607	-0.004192393	0.004192393	4124
+87	14	1000	995.807607	-0.004192393	0.004192393	4124
+87	15	1000	1011.138879	0.011138879	0.011138879	4124
+87	16	1000	1007.300678	0.007300678	0.007300678	4124
+87	17	1000	1009.859079	0.009859079	0.009859079	4124
+87	18	1000	1018.826088	0.018826088	0.018826088	4124
+87	19	1000	981.804175	-0.018195825	0.018195825	4124
+87	20	5000	5045.717821	0.009143564	0.009143564	4124
+87	21	5000	4960.911479	-0.007817704	0.007817704	4124
+87	22	5000	5021.794515	0.004358903	0.004358903	4124
+87	23	10000	10170.185440	0.017018544	0.017018544	4124
+88	0	1000	1003.466070	0.003466070	0.003466070	4124
+88	1	1000	994.532588	-0.005467412	0.005467412	4124
+88	2	1000	999.635049	-0.000364951	0.000364951	4124
+88	3	1000	1004.743874	0.004743874	0.004743874	4124
+88	4	1000	1003.466070	0.003466070	0.003466070	4124
+88	5	1000	997.083024	-0.002916976	0.002916976	4124
+88	6	1000	1020.108694	0.020108694	0.020108694	4124
+88	7	1000	1006.022077	0.006022077	0.006022077	4124
+88	8	1000	995.807607	-0.004192393	0.004192393	4124
+88	9	1000	1000.911658	0.000911658	0.000911658	4124
+88	10	1000	1009.859079	0.009859079	0.009859079	4124
+88	11	1000	991.983739	-0.008016261	0.008016261	4124
+88	12	1000	983.075238	-0.016924762	0.016924762	4124
+88	13	1000	985.618547	-0.014381453	0.014381453	4124
+88	14	1000	988.163437	-0.011836563	0.011836563	4124
+88	15	1000	1021.391701	0.021391701	0.021391701	4124
+88	16	1000	1016.262082	0.016262082	0.016262082	4124
+88	17	1000	991.983739	-0.008016261	0.008016261	4124
+88	18	1000	1004.743874	0.004743874	0.004743874	4124
+88	19	1000	1003.466070	0.003466070	0.003466070	4124
+88	20	5000	4920.819805	-0.015836039	0.015836039	4124
+88	21	5000	5056.013595	0.011202719	0.011202719	4124
+88	22	5000	4974.363051	-0.005127390	0.005127390	4124
+88	23	10000	9803.818473	-0.019618153	0.019618153	4124
+89	0	1000	1006.022077	0.006022077	0.006022077	4124
+89	1	1000	977.993351	-0.022006649	0.022006649	4124
+89	2	1000	1004.743874	0.004743874	0.004743874	4124
+89	3	1000	981.804175	-0.018195825	0.018195825	4124
+89	4	1000	991.983739	-0.008016261	0.008016261	4124
+89	5	1000	976.723864	-0.023276136	0.023276136	4124
+89	6	1000	1003.466070	0.003466070	0.003466070	4124
+89	7	1000	970.382324	-0.029617676	0.029617676	4124
+89	8	1000	1007.300678	0.007300678	0.007300678	4124
+89	9	1000	1004.743874	0.004743874	0.004743874	4124
+89	10	1000	1025.243135	0.025243135	0.025243135	4124
+89	11	1000	998.358838	-0.001641162	0.001641162	4124
+89	12	1000	1011.138879	0.011138879	0.011138879	4124
+89	13	1000	1004.743874	0.004743874	0.004743874	4124
+89	14	1000	991.983739	-0.008016261	0.008016261	4124
+89	15	1000	1004.743874	0.004743874	0.004743874	4124
+89	16	1000	1011.138879	0.011138879	0.011138879	4124
+89	17	1000	1009.859079	0.009859079	0.009859079	4124
+89	18	1000	1007.300678	0.007300678	0.007300678	4124
+89	19	1000	998.358838	-0.001641162	0.001641162	4124
+89	20	5000	5066.335314	0.013267063	0.013267063	4124
+89	21	5000	5080.138191	0.016027638	0.016027638	4124
+89	22	5000	5121.828119	0.024365624	0.024365624	4124
+89	23	10000	10040.517058	0.004051706	0.004051706	4124
+90	0	1000	995.807607	-0.004192393	0.004192393	4124
+90	1	1000	989.436475	-0.010563525	0.010563525	4124
+90	2	1000	1008.579679	0.008579679	0.008579679	4124
+90	3	1000	1011.138879	0.011138879	0.011138879	4124
+90	4	1000	1016.262082	0.016262082	0.016262082	4124
+90	5	1000	986.890795	-0.013109205	0.013109205	4124
+90	6	1000	997.083024	-0.002916976	0.002916976	4124
+90	7	1000	993.257965	-0.006742035	0.006742035	4124
+90	8	1000	995.807607	-0.004192393	0.004192393	4124
+90	9	1000	1007.300678	0.007300678	0.007300678	4124
+90	10	1000	1000.911658	0.000911658	0.000911658	4124
+90	11	1000	1002.188665	0.002188665	0.002188665	4124
+90	12	1000	993.257965	-0.006742035	0.006742035	4124
+90	13	1000	991.983739	-0.008016261	0.008016261	4124
+90	14	1000	1009.859079	0.009859079	0.009859079	4124
+90	15	1000	1012.419079	0.012419079	0.012419079	4124
+90	16	1000	1007.300678	0.007300678	0.007300678	4124
+90	17	1000	1013.699680	0.013699680	0.013699680	4124
+90	18	1000	1007.300678	0.007300678	0.007300678	4124
+90	19	1000	984.346695	-0.015653305	0.015653305	4124
+90	20	5000	4987.858944	-0.002428211	0.002428211	4124
+90	21	5000	4927.474558	-0.014505088	0.014505088	4124
+90	22	5000	5076.683109	0.015336622	0.015336622	4124
+90	23	10000	9948.726102	-0.005127390	0.005127390	4124
+91	0	1000	1013.699680	0.013699680	0.013699680	4124
+91	1	1000	999.635049	-0.000364951	0.000364951	4124
+91	2	1000	1009.859079	0.009859079	0.009859079	4124
+91	3	1000	980.533506	-0.019466494	0.019466494	4124
+91	4	1000	998.358838	-0.001641162	0.001641162	4124
+91	5	1000	1016.262082	0.016262082	0.016262082	4124
+91	6	1000	1009.859079	0.009859079	0.009859079	4124
+91	7	1000	1006.022077	0.006022077	0.006022077	4124
+91	8	1000	1009.859079	0.009859079	0.009859079	4124
+91	9	1000	1002.188665	0.002188665	0.002188665	4124
+91	10	1000	1011.138879	0.011138879	0.011138879	4124
+91	11	1000	993.257965	-0.006742035	0.006742035	4124
+91	12	1000	993.257965	-0.006742035	0.006742035	4124
+91	13	1000	995.807607	-0.004192393	0.004192393	4124
+91	14	1000	991.983739	-0.008016261	0.008016261	4124
+91	15	1000	981.804175	-0.018195825	0.018195825	4124
+91	16	1000	981.804175	-0.018195825	0.018195825	4124
+91	17	1000	1007.300678	0.007300678	0.007300678	4124
+91	18	1000	989.436475	-0.010563525	0.010563525	4124
+91	19	1000	1013.699680	0.013699680	0.013699680	4124
+91	20	5000	4954.202223	-0.009159555	0.009159555	4124
+91	21	5000	5025.203588	0.005040718	0.005040718	4124
+91	22	5000	4851.589988	-0.029682002	0.029682002	4124
+91	23	10000	9982.907107	-0.001709289	0.001709289	4124
+92	0	1000	990.709909	-0.009290091	0.009290091	4124
+92	1	1000	1009.859079	0.009859079	0.009859079	4124
+92	2	1000	984.346695	-0.015653305	0.015653305	4124
+92	3	1000	997.083024	-0.002916976	0.002916976	4124
+92	4	1000	1003.466070	0.003466070	0.003466070	4124
+92	5	1000	994.532588	-0.005467412	0.005467412	4124
+92	6	1000	1004.743874	0.004743874	0.004743874	4124
+92	7	1000	974.186070	-0.025813930	0.025813930	4124
+92	8	1000	999.635049	-0.000364951	0.000364951	4124
+92	9	1000	988.163437	-0.011836563	0.011836563	4124
+92	10	1000	1006.022077	0.006022077	0.006022077	4124
+92	11	1000	1009.859079	0.009859079	0.009859079	4124
+92	12	1000	1006.022077	0.006022077	0.006022077	4124
+92	13	1000	1023.958921	0.023958921	0.023958921	4124
+92	14	1000	988.163437	-0.011836563	0.011836563	4124
+92	15	1000	997.083024	-0.002916976	0.002916976	4124
+92	16	1000	999.635049	-0.000364951	0.000364951	4124
+92	17	1000	999.635049	-0.000364951	0.000364951	4124
+92	18	1000	994.532588	-0.005467412	0.005467412	4124
+92	19	1000	1004.743874	0.004743874	0.004743874	4124
+92	20	5000	4944.158899	-0.011168220	0.011168220	4124
+92	21	5000	5059.451279	0.011890256	0.011890256	4124
+92	22	5000	5052.578794	0.010515759	0.010515759	4124
+92	23	10000	10254.891561	0.025489156	0.025489156	4124
+93	0	1000	1002.188665	0.002188665	0.002188665	4124
+93	1	1000	979.263232	-0.020736768	0.020736768	4124
+93	2	1000	1014.980680	0.014980680	0.014980680	4124
+93	3	1000	1009.859079	0.009859079	0.009859079	4124
+93	4	1000	993.257965	-0.006742035	0.006742035	4124
+93	5	1000	986.890795	-0.013109205	0.013109205	4124
+93	6	1000	990.709909	-0.009290091	0.009290091	4124
+93	7	1000	993.257965	-0.006742035	0.006742035	4124
+93	8	1000	1004.743874	0.004743874	0.004743874	4124
+93	9	1000	997.083024	-0.002916976	0.002916976	4124
+93	10	1000	1002.188665	0.002188665	0.002188665	4124
+93	11	1000	1012.419079	0.012419079	0.012419079	4124
+93	12	1000	1016.262082	0.016262082	0.016262082	4124
+93	13	1000	984.346695	-0.015653305	0.015653305	4124
+93	14	1000	1003.466070	0.003466070	0.003466070	4124
+93	15	1000	1002.188665	0.002188665	0.002188665	4124
+93	16	1000	1003.466070	0.003466070	0.003466070	4124
+93	17	1000	994.532588	-0.005467412	0.005467412	4124
+93	18	1000	1018.826088	0.018826088	0.018826088	4124
+93	19	1000	1003.466070	0.003466070	0.003466070	4124
+93	20	5000	4981.105439	-0.003778912	0.003778912	4124
+93	21	5000	4944.158899	-0.011168220	0.011168220	4124
+93	22	5000	5059.451279	0.011890256	0.011890256	4124
+93	23	10000	9600.846049	-0.039915395	0.039915395	4124
+94	0	1000	1002.188665	0.002188665	0.002188665	4124
+94	1	1000	981.804175	-0.018195825	0.018195825	4124
+94	2	1000	990.709909	-0.009290091	0.009290091	4124
+94	3	1000	1006.022077	0.006022077	0.006022077	4124
+94	4	1000	990.709909	-0.009290091	0.009290091	4124
+94	5	1000	999.635049	-0.000364951	0.000364951	4124
+94	6	1000	994.532588	-0.005467412	0.005467412	4124
+94	7	1000	995.807607	-0.004192393	0.004192393	4124
+94	8	1000	1007.300678	0.007300678	0.007300678	4124
+94	9	1000	1003.466070	0.003466070	0.003466070	4124
+94	10	1000	1002.188665	0.002188665	0.002188665	4124
+94	11	1000	1002.188665	0.002188665	0.002188665	4124
+94	12	1000	984.346695	-0.015653305	0.015653305	4124
+94	13	1000	980.533506	-0.019466494	0.019466494	4124
+94	14	1000	1000.911658	0.000911658	0.000911658	4124
+94	15	1000	1006.022077	0.006022077	0.006022077	4124
+94	16	1000	991.983739	-0.008016261	0.008016261	4124
+94	17	1000	1013.699680	0.013699680	0.013699680	4124
+94	18	1000	983.075238	-0.016924762	0.016924762	4124
+94	19	1000	999.635049	-0.000364951	0.000364951	4124
+94	20	5000	5049.146871	0.009829374	0.009829374	4124
+94	21	5000	5038.868321	0.007773664	0.007773664	4124
+94	22	5000	5149.859024	0.029971805	0.029971805	4124
+94	23	10000	9926.096210	-0.007390379	0.007390379	4124
+95	0	1000	988.163437	-0.011836563	0.011836563	4124
+95	1	1000	991.983739	-0.008016261	0.008016261	4124
+95	2	1000	989.436475	-0.010563525	0.010563525	4124
+95	3	1000	1020.108694	0.020108694	0.020108694	4124
+95	4	1000	1021.391701	0.021391701	0.021391701	4124
+95	5	1000	993.257965	-0.006742035	0.006742035	4124
+95	6	1000	1011.138879	0.011138879	0.011138879	4124
+95	7	1000	993.257965	-0.006742035	0.006742035	4124
+95	8	1000	1004.743874	0.004743874	0.004743874	4124
+95	9	1000	1003.466070	0.003466070	0.003466070	4124
+95	10	1000	983.075238	-0.016924762	0.016924762	4124
+95	11	1000	995.807607	-0.004192393	0.004192393	4124
+95	12	1000	1021.391701	0.021391701	0.021391701	4124
+95	13	1000	1008.579679	0.008579679	0.008579679	4124
+95	14	1000	1011.138879	0.011138879	0.011138879	4124
+95	15	1000	990.709909	-0.009290091	0.009290091	4124
+95	16	1000	988.163437	-0.011836563	0.011836563	4124
+95	17	1000	984.346695	-0.015653305	0.015653305	4124
+95	18	1000	1021.391701	0.021391701	0.021391701	4124
+95	19	1000	1017.543884	0.017543884	0.017543884	4124
+95	20	5000	4947.503938	-0.010499212	0.010499212	4124
+95	21	5000	4967.631743	-0.006473651	0.006473651	4124
+95	22	5000	4910.857903	-0.017828419	0.017828419	4124
+95	23	10000	9903.590659	-0.009640934	0.009640934	4124
+96	0	1000	995.807607	-0.004192393	0.004192393	4124
+96	1	1000	974.186070	-0.025813930	0.025813930	4124
+96	2	1000	1011.138879	0.011138879	0.011138879	4124
+96	3	1000	997.083024	-0.002916976	0.002916976	4124
+96	4	1000	1003.466070	0.003466070	0.003466070	4124
+96	5	1000	1011.138879	0.011138879	0.011138879	4124
+96	6	1000	983.075238	-0.016924762	0.016924762	4124
+96	7	1000	998.358838	-0.001641162	0.001641162	4124
+96	8	1000	980.533506	-0.019466494	0.019466494	4124
+96	9	1000	1021.391701	0.021391701	0.021391701	4124
+96	10	1000	986.890795	-0.013109205	0.013109205	4124
+96	11	1000	984.346695	-0.015653305	0.015653305	4124
+96	12	1000	1008.579679	0.008579679	0.008579679	4124
+96	13	1000	984.346695	-0.015653305	0.015653305	4124
+96	14	1000	997.083024	-0.002916976	0.002916976	4124
+96	15	1000	1012.419079	0.012419079	0.012419079	4124
+96	16	1000	999.635049	-0.000364951	0.000364951	4124
+96	17	1000	1011.138879	0.011138879	0.011138879	4124
+96	18	1000	993.257965	-0.006742035	0.006742035	4124
+96	19	1000	1000.911658	0.000911658	0.000911658	4124
+96	20	5000	5142.833293	0.028566659	0.028566659	4124
+96	21	5000	4987.858944	-0.002428211	0.002428211	4124
+96	22	5000	4825.521483	-0.034895703	0.034895703	4124
+96	23	10000	9937.395527	-0.006260447	0.006260447	4124
+97	0	1000	1008.579679	0.008579679	0.008579679	4124
+97	1	1000	1002.188665	0.002188665	0.002188665	4124
+97	2	1000	1017.543884	0.017543884	0.017543884	4124
+97	3	1000	998.358838	-0.001641162	0.001641162	4124
+97	4	1000	1002.188665	0.002188665	0.002188665	4124
+97	5	1000	985.618547	-0.014381453	0.014381453	4124
+97	6	1000	997.083024	-0.002916976	0.002916976	4124
+97	7	1000	995.807607	-0.004192393	0.004192393	4124
+97	8	1000	998.358838	-0.001641162	0.001641162	4124
+97	9	1000	1004.743874	0.004743874	0.004743874	4124
+97	10	1000	1003.466070	0.003466070	0.003466070	4124
+97	11	1000	1003.466070	0.003466070	0.003466070	4124
+97	12	1000	989.436475	-0.010563525	0.010563525	4124
+97	13	1000	999.635049	-0.000364951	0.000364951	4124
+97	14	1000	1002.188665	0.002188665	0.002188665	4124
+97	15	1000	1006.022077	0.006022077	0.006022077	4124
+97	16	1000	988.163437	-0.011836563	0.011836563	4124
+97	17	1000	995.807607	-0.004192393	0.004192393	4124
+97	18	1000	993.257965	-0.006742035	0.006742035	4124
+97	19	1000	1012.419079	0.012419079	0.012419079	4124
+97	20	5000	5004.791585	0.000958317	0.000958317	4124
+97	21	5000	4984.480800	-0.003103840	0.003103840	4124
+97	22	5000	4974.363051	-0.005127390	0.005127390	4124
+97	23	10000	10017.375753	0.001737575	0.001737575	4124
+98	0	1000	995.807607	-0.004192393	0.004192393	4124
+98	1	1000	997.083024	-0.002916976	0.002916976	4124
+98	2	1000	995.807607	-0.004192393	0.004192393	4124
+98	3	1000	990.709909	-0.009290091	0.009290091	4124
+98	4	1000	1004.743874	0.004743874	0.004743874	4124
+98	5	1000	1012.419079	0.012419079	0.012419079	4124
+98	6	1000	1013.699680	0.013699680	0.013699680	4124
+98	7	1000	998.358838	-0.001641162	0.001641162	4124
+98	8	1000	994.532588	-0.005467412	0.005467412	4124
+98	9	1000	989.436475	-0.010563525	0.010563525	4124
+98	10	1000	1004.743874	0.004743874	0.004743874	4124
+98	11	1000	1018.826088	0.018826088	0.018826088	4124
+98	12	1000	990.709909	-0.009290091	0.009290091	4124
+98	13	1000	1008.579679	0.008579679	0.008579679	4124
+98	14	1000	1006.022077	0.006022077	0.006022077	4124
+98	15	1000	1012.419079	0.012419079	0.012419079	4124
+98	16	1000	1004.743874	0.004743874	0.004743874	4124
+98	17	1000	971.649847	-0.028350153	0.028350153	4124
+98	18	1000	983.075238	-0.016924762	0.016924762	4124
+98	19	1000	1008.579679	0.008579679	0.008579679	4124
+98	20	5000	5014.984871	0.002996974	0.002996974	4124
+98	21	5000	5052.578794	0.010515759	0.010515759	4124
+98	22	5000	5059.451279	0.011890256	0.011890256	4124
+98	23	10000	10063.789848	0.006378985	0.006378985	4124
+99	0	1000	997.083024	-0.002916976	0.002916976	4124
+99	1	1000	999.635049	-0.000364951	0.000364951	4124
+99	2	1000	1011.138879	0.011138879	0.011138879	4124
+99	3	1000	990.709909	-0.009290091	0.009290091	4124
+99	4	1000	984.346695	-0.015653305	0.015653305	4124
+99	5	1000	1011.138879	0.011138879	0.011138879	4124
+99	6	1000	991.983739	-0.008016261	0.008016261	4124
+99	7	1000	1007.300678	0.007300678	0.007300678	4124
+99	8	1000	993.257965	-0.006742035	0.006742035	4124
+99	9	1000	993.257965	-0.006742035	0.006742035	4124
+99	10	1000	1003.466070	0.003466070	0.003466070	4124
+99	11	1000	986.890795	-0.013109205	0.013109205	4124
+99	12	1000	1008.579679	0.008579679	0.008579679	4124
+99	13	1000	998.358838	-0.001641162	0.001641162	4124
+99	14	1000	1009.859079	0.009859079	0.009859079	4124
+99	15	1000	994.532588	-0.005467412	0.005467412	4124
+99	16	1000	1003.466070	0.003466070	0.003466070	4124
+99	17	1000	1008.579679	0.008579679	0.008579679	4124
+99	18	1000	998.358838	-0.001641162	0.001641162	4124
+99	19	1000	998.358838	-0.001641162	0.001641162	4124
+99	20	5000	5083.596191	0.016719238	0.016719238	4124
+99	21	5000	5004.791585	0.000958317	0.000958317	4124
+99	22	5000	4871.250825	-0.025749835	0.025749835	4124
+99	23	10000	9771.093931	-0.022890607	0.022890607	4124
+100	0	1000	998.358838	-0.001641162	0.001641162	4124
+100	1	1000	983.075238	-0.016924762	0.016924762	4124
+100	2	1000	1011.138879	0.011138879	0.011138879	4124
+100	3	1000	1006.022077	0.006022077	0.006022077	4124
+100	4	1000	986.890795	-0.013109205	0.013109205	4124
+100	5	1000	1007.300678	0.007300678	0.007300678	4124
+100	6	1000	995.807607	-0.004192393	0.004192393	4124
+100	7	1000	1023.958921	0.023958921	0.023958921	4124
+100	8	1000	984.346695	-0.015653305	0.015653305	4124
+100	9	1000	997.083024	-0.002916976	0.002916976	4124
+100	10	1000	1004.743874	0.004743874	0.004743874	4124
+100	11	1000	1006.022077	0.006022077	0.006022077	4124
+100	12	1000	989.436475	-0.010563525	0.010563525	4124
+100	13	1000	1012.419079	0.012419079	0.012419079	4124
+100	14	1000	985.618547	-0.014381453	0.014381453	4124
+100	15	1000	1006.022077	0.006022077	0.006022077	4124
+100	16	1000	998.358838	-0.001641162	0.001641162	4124
+100	17	1000	998.358838	-0.001641162	0.001641162	4124
+100	18	1000	1011.138879	0.011138879	0.011138879	4124
+100	19	1000	994.532588	-0.005467412	0.005467412	4124
+100	20	5000	5014.984871	0.002996974	0.002996974	4124
+100	21	5000	5059.451279	0.011890256	0.011890256	4124
+100	22	5000	4967.631743	-0.006473651	0.006473651	4124
+100	23	10000	10122.556996	0.012255700	0.012255700	4124
+101	0	1000	1011.138879	0.011138879	0.011138879	4124
+101	1	1000	1013.699680	0.013699680	0.013699680	4124
+101	2	1000	998.358838	-0.001641162	0.001641162	4124
+101	3	1000	1006.022077	0.006022077	0.006022077	4124
+101	4	1000	1007.300678	0.007300678	0.007300678	4124
+101	5	1000	980.533506	-0.019466494	0.019466494	4124
+101	6	1000	1006.022077	0.006022077	0.006022077	4124
+101	7	1000	1011.138879	0.011138879	0.011138879	4124
+101	8	1000	1000.911658	0.000911658	0.000911658	4124
+101	9	1000	997.083024	-0.002916976	0.002916976	4124
+101	10	1000	997.083024	-0.002916976	0.002916976	4124
+101	11	1000	1022.675110	0.022675110	0.022675110	4124
+101	12	1000	1013.699680	0.013699680	0.013699680	4124
+101	13	1000	1011.138879	0.011138879	0.011138879	4124
+101	14	1000	1016.262082	0.016262082	0.016262082	4124
+101	15	1000	984.346695	-0.015653305	0.015653305	4124
+101	16	1000	977.993351	-0.022006649	0.022006649	4124
+101	17	1000	976.723864	-0.023276136	0.023276136	4124
+101	18	1000	999.635049	-0.000364951	0.000364951	4124
+101	19	1000	990.709909	-0.009290091	0.009290091	4124
+101	20	5000	5121.828119	0.024365624	0.024365624	4124
+101	21	5000	4914.175845	-0.017164831	0.017164831	4124
+101	22	5000	5042.291639	0.008458328	0.008458328	4124
+101	23	10000	9903.590659	-0.009640934	0.009640934	4124
+102	0	1000	999.635049	-0.000364951	0.000364951	4124
+102	1	1000	993.257965	-0.006742035	0.006742035	4124
+102	2	1000	1008.579679	0.008579679	0.008579679	4124
+102	3	1000	1018.826088	0.018826088	0.018826088	4124
+102	4	1000	999.635049	-0.000364951	0.000364951	4124
+102	5	1000	1003.466070	0.003466070	0.003466070	4124
+102	6	1000	994.532588	-0.005467412	0.005467412	4124
+102	7	1000	999.635049	-0.000364951	0.000364951	4124
+102	8	1000	1003.466070	0.003466070	0.003466070	4124
+102	9	1000	1000.911658	0.000911658	0.000911658	4124
+102	10	1000	1008.579679	0.008579679	0.008579679	4124
+102	11	1000	1006.022077	0.006022077	0.006022077	4124
+102	12	1000	999.635049	-0.000364951	0.000364951	4124
+102	13	1000	1014.980680	0.014980680	0.014980680	4124
+102	14	1000	1004.743874	0.004743874	0.004743874	4124
+102	15	1000	995.807607	-0.004192393	0.004192393	4124
+102	16	1000	1006.022077	0.006022077	0.006022077	4124
+102	17	1000	980.533506	-0.019466494	0.019466494	4124
+102	18	1000	976.723864	-0.023276136	0.023276136	4124
+102	19	1000	1022.675110	0.022675110	0.022675110	4124
+102	20	5000	5045.717821	0.009143564	0.009143564	4124
+102	21	5000	5014.984871	0.002996974	0.002996974	4124
+102	22	5000	5001.399453	0.000279891	0.000279891	4124
+102	23	10000	9653.292348	-0.034670765	0.034670765	4124
+103	0	1000	976.723864	-0.023276136	0.023276136	4124
+103	1	1000	1006.022077	0.006022077	0.006022077	4124
+103	2	1000	1012.419079	0.012419079	0.012419079	4124
+103	3	1000	981.804175	-0.018195825	0.018195825	4124
+103	4	1000	1003.466070	0.003466070	0.003466070	4124
+103	5	1000	1014.980680	0.014980680	0.014980680	4124
+103	6	1000	1009.859079	0.009859079	0.009859079	4124
+103	7	1000	1009.859079	0.009859079	0.009859079	4124
+103	8	1000	977.993351	-0.022006649	0.022006649	4124
+103	9	1000	988.163437	-0.011836563	0.011836563	4124
+103	10	1000	1002.188665	0.002188665	0.002188665	4124
+103	11	1000	1017.543884	0.017543884	0.017543884	4124
+103	12	1000	1007.300678	0.007300678	0.007300678	4124
+103	13	1000	994.532588	-0.005467412	0.005467412	4124
+103	14	1000	995.807607	-0.004192393	0.004192393	4124
+103	15	1000	991.983739	-0.008016261	0.008016261	4124
+103	16	1000	989.436475	-0.010563525	0.010563525	4124
+103	17	1000	989.436475	-0.010563525	0.010563525	4124
+103	18	1000	984.346695	-0.015653305	0.015653305	4124
+103	19	1000	991.983739	-0.008016261	0.008016261	4124
+103	20	5000	5021.794515	0.004358903	0.004358903	4124
+103	21	5000	5004.791585	0.000958317	0.000958317	4124
+103	22	5000	4884.410676	-0.023117865	0.023117865	4124
+103	23	10000	9881.208089	-0.011879191	0.011879191	4124
+104	0	1000	1007.300678	0.007300678	0.007300678	4124
+104	1	1000	1007.300678	0.007300678	0.007300678	4124
+104	2	1000	991.983739	-0.008016261	0.008016261	4124
+104	3	1000	984.346695	-0.015653305	0.015653305	4124
+104	4	1000	1002.188665	0.002188665	0.002188665	4124
+104	5	1000	998.358838	-0.001641162	0.001641162	4124
+104	6	1000	1004.743874	0.004743874	0.004743874	4124
+104	7	1000	1021.391701	0.021391701	0.021391701	4124
+104	8	1000	997.083024	-0.002916976	0.002916976	4124
+104	9	1000	981.804175	-0.018195825	0.018195825	4124
+104	10	1000	1003.466070	0.003466070	0.003466070	4124
+104	11	1000	999.635049	-0.000364951	0.000364951	4124
+104	12	1000	1016.262082	0.016262082	0.016262082	4124
+104	13	1000	1011.138879	0.011138879	0.011138879	4124
+104	14	1000	994.532588	-0.005467412	0.005467412	4124
+104	15	1000	1000.911658	0.000911658	0.000911658	4124
+104	16	1000	980.533506	-0.019466494	0.019466494	4124
+104	17	1000	1000.911658	0.000911658	0.000911658	4124
+104	18	1000	1009.859079	0.009859079	0.009859079	4124
+104	19	1000	997.083024	-0.002916976	0.002916976	4124
+104	20	5000	4944.158899	-0.011168220	0.011168220	4124
+104	21	5000	5069.781675	0.013956335	0.013956335	4124
+104	22	5000	4950.851711	-0.009829658	0.009829658	4124
+104	23	10000	10316.486706	0.031648671	0.031648671	4124
+105	0	1000	989.436475	-0.010563525	0.010563525	4124
+105	1	1000	1006.022077	0.006022077	0.006022077	4124
+105	2	1000	991.983739	-0.008016261	0.008016261	4124
+105	3	1000	995.807607	-0.004192393	0.004192393	4124
+105	4	1000	990.709909	-0.009290091	0.009290091	4124
+105	5	1000	961.520630	-0.038479370	0.038479370	4124
+105	6	1000	1002.188665	0.002188665	0.002188665	4124
+105	7	1000	1006.022077	0.006022077	0.006022077	4124
+105	8	1000	1004.743874	0.004743874	0.004743874	4124
+105	9	1000	1006.022077	0.006022077	0.006022077	4124
+105	10	1000	997.083024	-0.002916976	0.002916976	4124
+105	11	1000	1032.956885	0.032956885	0.032956885	4124
+105	12	1000	989.436475	-0.010563525	0.010563525	4124
+105	13	1000	1007.300678	0.007300678	0.007300678	4124
+105	14	1000	1003.466070	0.003466070	0.003466070	4124
+105	15	1000	991.983739	-0.008016261	0.008016261	4124
+105	16	1000	998.358838	-0.001641162	0.001641162	4124
+105	17	1000	985.618547	-0.014381453	0.014381453	4124
+105	18	1000	993.257965	-0.006742035	0.006742035	4124
+105	19	1000	1004.743874	0.004743874	0.004743874	4124
+105	20	5000	5028.615500	0.005723100	0.005723100	4124
+105	21	5000	5149.859024	0.029971805	0.029971805	4124
+105	22	5000	4867.967458	-0.026406508	0.026406508	4124
+105	23	10000	10017.375753	0.001737575	0.001737575	4124
+106	0	1000	995.807607	-0.004192393	0.004192393	4124
+106	1	1000	994.532588	-0.005467412	0.005467412	4124
+106	2	1000	981.804175	-0.018195825	0.018195825	4124
+106	3	1000	1000.911658	0.000911658	0.000911658	4124
+106	4	1000	997.083024	-0.002916976	0.002916976	4124
+106	5	1000	990.709909	-0.009290091	0.009290091	4124
+106	6	1000	999.635049	-0.000364951	0.000364951	4124
+106	7	1000	990.709909	-0.009290091	0.009290091	4124
+106	8	1000	1017.543884	0.017543884	0.017543884	4124
+106	9	1000	1000.911658	0.000911658	0.000911658	4124
+106	10	1000	1002.188665	0.002188665	0.002188665	4124
+106	11	1000	1004.743874	0.004743874	0.004743874	4124
+106	12	1000	1009.859079	0.009859079	0.009859079	4124
+106	13	1000	990.709909	-0.009290091	0.009290091	4124
+106	14	1000	976.723864	-0.023276136	0.023276136	4124
+106	15	1000	997.083024	-0.002916976	0.002916976	4124
+106	16	1000	994.532588	-0.005467412	0.005467412	4124
+106	17	1000	1006.022077	0.006022077	0.006022077	4124
+106	18	1000	986.890795	-0.013109205	0.013109205	4124
+106	19	1000	1003.466070	0.003466070	0.003466070	4124
+106	20	5000	5080.138191	0.016027638	0.016027638	4124
+106	21	5000	5038.868321	0.007773664	0.007773664	4124
+106	22	5000	4984.480800	-0.003103840	0.003103840	4124
+106	23	10000	9994.364457	-0.000563554	0.000563554	4124
+107	0	1000	1016.262082	0.016262082	0.016262082	4124
+107	1	1000	977.993351	-0.022006649	0.022006649	4124
+107	2	1000	980.533506	-0.019466494	0.019466494	4124
+107	3	1000	1012.419079	0.012419079	0.012419079	4124
+107	4	1000	991.983739	-0.008016261	0.008016261	4124
+107	5	1000	1007.300678	0.007300678	0.007300678	4124
+107	6	1000	985.618547	-0.014381453	0.014381453	4124
+107	7	1000	997.083024	-0.002916976	0.002916976	4124
+107	8	1000	1000.911658	0.000911658	0.000911658	4124
+107	9	1000	1013.699680	0.013699680	0.013699680	4124
+107	10	1000	998.358838	-0.001641162	0.001641162	4124
+107	11	1000	1000.911658	0.000911658	0.000911658	4124
+107	12	1000	998.358838	-0.001641162	0.001641162	4124
+107	13	1000	991.983739	-0.008016261	0.008016261	4124
+107	14	1000	1022.675110	0.022675110	0.022675110	4124
+107	15	1000	1007.300678	0.007300678	0.007300678	4124
+107	16	1000	1013.699680	0.013699680	0.013699680	4124
+107	17	1000	1006.022077	0.006022077	0.006022077	4124
+107	18	1000	1000.911658	0.000911658	0.000911658	4124
+107	19	1000	1011.138879	0.011138879	0.011138879	4124
+107	20	5000	4910.857903	-0.017828419	0.017828419	4124
+107	21	5000	4984.480800	-0.003103840	0.003103840	4124
+107	22	5000	5052.578794	0.010515759	0.010515759	4124
+107	23	10000	10158.226307	0.015822631	0.015822631	4124
+108	0	1000	1022.675110	0.022675110	0.022675110	4124
+108	1	1000	997.083024	-0.002916976	0.002916976	4124
+108	2	1000	1004.743874	0.004743874	0.004743874	4124
+108	3	1000	1006.022077	0.006022077	0.006022077	4124
+108	4	1000	997.083024	-0.002916976	0.002916976	4124
+108	5	1000	998.358838	-0.001641162	0.001641162	4124
+108	6	1000	1004.743874	0.004743874	0.004743874	4124
+108	7	1000	1013.699680	0.013699680	0.013699680	4124
+108	8	1000	1007.300678	0.007300678	0.007300678	4124
+108	9	1000	986.890795	-0.013109205	0.013109205	4124
+108	10	1000	1000.911658	0.000911658	0.000911658	4124
+108	11	1000	1013.699680	0.013699680	0.013699680	4124
+108	12	1000	1016.262082	0.016262082	0.016262082	4124
+108	13	1000	995.807607	-0.004192393	0.004192393	4124
+108	14	1000	989.436475	-0.010563525	0.010563525	4124
+108	15	1000	1013.699680	0.013699680	0.013699680	4124
+108	16	1000	993.257965	-0.006742035	0.006742035	4124
+108	17	1000	1007.300678	0.007300678	0.007300678	4124
+108	18	1000	1020.108694	0.020108694	0.020108694	4124
+108	19	1000	1002.188665	0.002188665	0.002188665	4124
+108	20	5000	4848.322337	-0.030335533	0.030335533	4124
+108	21	5000	4984.480800	-0.003103840	0.003103840	4124
+108	22	5000	5018.388278	0.003677656	0.003677656	4124
+108	23	10000	9803.818473	-0.019618153	0.019618153	4124
+109	0	1000	999.635049	-0.000364951	0.000364951	4124
+109	1	1000	1000.911658	0.000911658	0.000911658	4124
+109	2	1000	997.083024	-0.002916976	0.002916976	4124
+109	3	1000	991.983739	-0.008016261	0.008016261	4124
+109	4	1000	1000.911658	0.000911658	0.000911658	4124
+109	5	1000	1007.300678	0.007300678	0.007300678	4124
+109	6	1000	1018.826088	0.018826088	0.018826088	4124
+109	7	1000	1014.980680	0.014980680	0.014980680	4124
+109	8	1000	1003.466070	0.003466070	0.003466070	4124
+109	9	1000	1011.138879	0.011138879	0.011138879	4124
+109	10	1000	983.075238	-0.016924762	0.016924762	4124
+109	11	1000	984.346695	-0.015653305	0.015653305	4124
+109	12	1000	1008.579679	0.008579679	0.008579679	4124
+109	13	1000	998.358838	-0.001641162	0.001641162	4124
+109	14	1000	1003.466070	0.003466070	0.003466070	4124
+109	15	1000	1000.911658	0.000911658	0.000911658	4124
+109	16	1000	999.635049	-0.000364951	0.000364951	4124
+109	17	1000	1038.107467	0.038107467	0.038107467	4124
+109	18	1000	999.635049	-0.000364951	0.000364951	4124
+109	19	1000	1017.543884	0.017543884	0.017543884	4124
+109	20	5000	4917.496478	-0.016500704	0.016500704	4124
+109	21	5000	5135.819593	0.027163919	0.027163919	4124
+109	22	5000	5042.291639	0.008458328	0.008458328	4124
+109	23	10000	10005.853945	0.000585395	0.000585395	4124
+110	0	1000	995.807607	-0.004192393	0.004192393	4124
+110	1	1000	1006.022077	0.006022077	0.006022077	4124
+110	2	1000	972.917762	-0.027082238	0.027082238	4124
+110	3	1000	1004.743874	0.004743874	0.004743874	4124
+110	4	1000	998.358838	-0.001641162	0.001641162	4124
+110	5	1000	1003.466070	0.003466070	0.003466070	4124
+110	6	1000	1016.262082	0.016262082	0.016262082	4124
+110	7	1000	1011.138879	0.011138879	0.011138879	4124
+110	8	1000	997.083024	-0.002916976	0.002916976	4124
+110	9	1000	997.083024	-0.002916976	0.002916976	4124
+110	10	1000	1009.859079	0.009859079	0.009859079	4124
+110	11	1000	1009.859079	0.009859079	0.009859079	4124
+110	12	1000	1000.911658	0.000911658	0.000911658	4124
+110	13	1000	984.346695	-0.015653305	0.015653305	4124
+110	14	1000	1006.022077	0.006022077	0.006022077	4124
+110	15	1000	1004.743874	0.004743874	0.004743874	4124
+110	16	1000	1022.675110	0.022675110	0.022675110	4124
+110	17	1000	995.807607	-0.004192393	0.004192393	4124
+110	18	1000	1000.911658	0.000911658	0.000911658	4124
+110	19	1000	1008.579679	0.008579679	0.008579679	4124
+110	20	5000	4987.858944	-0.002428211	0.002428211	4124
+110	21	5000	5080.138191	0.016027638	0.016027638	4124
+110	22	5000	5021.794515	0.004358903	0.004358903	4124
+110	23	10000	9727.863978	-0.027213602	0.027213602	4124
+111	0	1000	986.890795	-0.013109205	0.013109205	4124
+111	1	1000	1007.300678	0.007300678	0.007300678	4124
+111	2	1000	1018.826088	0.018826088	0.018826088	4124
+111	3	1000	1009.859079	0.009859079	0.009859079	4124
+111	4	1000	1011.138879	0.011138879	0.011138879	4124
+111	5	1000	1000.911658	0.000911658	0.000911658	4124
+111	6	1000	1013.699680	0.013699680	0.013699680	4124
+111	7	1000	994.532588	-0.005467412	0.005467412	4124
+111	8	1000	1013.699680	0.013699680	0.013699680	4124
+111	9	1000	1016.262082	0.016262082	0.016262082	4124
+111	10	1000	999.635049	-0.000364951	0.000364951	4124
+111	11	1000	1013.699680	0.013699680	0.013699680	4124
+111	12	1000	997.083024	-0.002916976	0.002916976	4124
+111	13	1000	1003.466070	0.003466070	0.003466070	4124
+111	14	1000	1021.391701	0.021391701	0.021391701	4124
+111	15	1000	995.807607	-0.004192393	0.004192393	4124
+111	16	1000	1011.138879	0.011138879	0.011138879	4124
+111	17	1000	977.993351	-0.022006649	0.022006649	4124
+111	18	1000	1004.743874	0.004743874	0.004743874	4124
+111	19	1000	1009.859079	0.009859079	0.009859079	4124
+111	20	5000	5028.615500	0.005723100	0.005723100	4124
+111	21	5000	5052.578794	0.010515759	0.010515759	4124
+111	22	5000	5073.230939	0.014646188	0.014646188	4124
+111	23	10000	9727.863978	-0.027213602	0.027213602	4124
+112	0	1000	1008.579679	0.008579679	0.008579679	4124
+112	1	1000	960.256237	-0.039743763	0.039743763	4124
+112	2	1000	985.618547	-0.014381453	0.014381453	4124
+112	3	1000	1017.543884	0.017543884	0.017543884	4124
+112	4	1000	1020.108694	0.020108694	0.020108694	4124
+112	5	1000	1006.022077	0.006022077	0.006022077	4124
+112	6	1000	999.635049	-0.000364951	0.000364951	4124
+112	7	1000	985.618547	-0.014381453	0.014381453	4124
+112	8	1000	999.635049	-0.000364951	0.000364951	4124
+112	9	1000	999.635049	-0.000364951	0.000364951	4124
+112	10	1000	1002.188665	0.002188665	0.002188665	4124
+112	11	1000	998.358838	-0.001641162	0.001641162	4124
+112	12	1000	991.983739	-0.008016261	0.008016261	4124
+112	13	1000	1002.188665	0.002188665	0.002188665	4124
+112	14	1000	1008.579679	0.008579679	0.008579679	4124
+112	15	1000	1002.188665	0.002188665	0.002188665	4124
+112	16	1000	1013.699680	0.013699680	0.013699680	4124
+112	17	1000	988.163437	-0.011836563	0.011836563	4124
+112	18	1000	1003.466070	0.003466070	0.003466070	4124
+112	19	1000	1012.419079	0.012419079	0.012419079	4124
+112	20	5000	4867.967458	-0.026406508	0.026406508	4124
+112	21	5000	5104.405719	0.020881144	0.020881144	4124
+112	22	5000	4934.140142	-0.013171972	0.013171972	4124
+112	23	10000	9653.292348	-0.034670765	0.034670765	4124
+113	0	1000	990.709909	-0.009290091	0.009290091	4124
+113	1	1000	972.917762	-0.027082238	0.027082238	4124
+113	2	1000	1006.022077	0.006022077	0.006022077	4124
+113	3	1000	988.163437	-0.011836563	0.011836563	4124
+113	4	1000	1011.138879	0.011138879	0.011138879	4124
+113	5	1000	1011.138879	0.011138879	0.011138879	4124
+113	6	1000	998.358838	-0.001641162	0.001641162	4124
+113	7	1000	995.807607	-0.004192393	0.004192393	4124
+113	8	1000	981.804175	-0.018195825	0.018195825	4124
+113	9	1000	986.890795	-0.013109205	0.013109205	4124
+113	10	1000	1007.300678	0.007300678	0.007300678	4124
+113	11	1000	991.983739	-0.008016261	0.008016261	4124
+113	12	1000	1006.022077	0.006022077	0.006022077	4124
+113	13	1000	1007.300678	0.007300678	0.007300678	4124
+113	14	1000	1008.579679	0.008579679	0.008579679	4124
+113	15	1000	986.890795	-0.013109205	0.013109205	4124
+113	16	1000	1026.527751	0.026527751	0.026527751	4124
+113	17	1000	1003.466070	0.003466070	0.003466070	4124
+113	18	1000	995.807607	-0.004192393	0.004192393	4124
+113	19	1000	1008.579679	0.008579679	0.008579679	4124
+113	20	5000	5014.984871	0.002996974	0.002996974	4124
+113	21	5000	5004.791585	0.000958317	0.000958317	4124
+113	22	5000	4934.140142	-0.013171972	0.013171972	4124
+113	23	10000	9749.421923	-0.025057808	0.025057808	4124
+114	0	1000	1017.543884	0.017543884	0.017543884	4124
+114	1	1000	1008.579679	0.008579679	0.008579679	4124
+114	2	1000	1002.188665	0.002188665	0.002188665	4124
+114	3	1000	986.890795	-0.013109205	0.013109205	4124
+114	4	1000	1011.138879	0.011138879	0.011138879	4124
+114	5	1000	1017.543884	0.017543884	0.017543884	4124
+114	6	1000	967.848454	-0.032151546	0.032151546	4124
+114	7	1000	993.257965	-0.006742035	0.006742035	4124
+114	8	1000	971.649847	-0.028350153	0.028350153	4124
+114	9	1000	1008.579679	0.008579679	0.008579679	4124
+114	10	1000	993.257965	-0.006742035	0.006742035	4124
+114	11	1000	1011.138879	0.011138879	0.011138879	4124
+114	12	1000	1000.911658	0.000911658	0.000911658	4124
+114	13	1000	1009.859079	0.009859079	0.009859079	4124
+114	14	1000	1009.859079	0.009859079	0.009859079	4124
+114	15	1000	1029.098194	0.029098194	0.029098194	4124
+114	16	1000	1008.579679	0.008579679	0.008579679	4124
+114	17	1000	997.083024	-0.002916976	0.002916976	4124
+114	18	1000	995.807607	-0.004192393	0.004192393	4124
+114	19	1000	998.358838	-0.001641162	0.001641162	4124
+114	20	5000	4934.140142	-0.013171972	0.013171972	4124
+114	21	5000	4967.631743	-0.006473651	0.006473651	4124
+114	22	5000	4881.116747	-0.023776651	0.023776651	4124
+114	23	10000	9538.784255	-0.046121574	0.046121574	4124
+115	0	1000	995.807607	-0.004192393	0.004192393	4124
+115	1	1000	994.532588	-0.005467412	0.005467412	4124
+115	2	1000	993.257965	-0.006742035	0.006742035	4124
+115	3	1000	977.993351	-0.022006649	0.022006649	4124
+115	4	1000	1009.859079	0.009859079	0.009859079	4124
+115	5	1000	989.436475	-0.010563525	0.010563525	4124
+115	6	1000	989.436475	-0.010563525	0.010563525	4124
+115	7	1000	1000.911658	0.000911658	0.000911658	4124
+115	8	1000	1000.911658	0.000911658	0.000911658	4124
+115	9	1000	989.436475	-0.010563525	0.010563525	4124
+115	10	1000	1003.466070	0.003466070	0.003466070	4124
+115	11	1000	1009.859079	0.009859079	0.009859079	4124
+115	12	1000	998.358838	-0.001641162	0.001641162	4124
+115	13	1000	995.807607	-0.004192393	0.004192393	4124
+115	14	1000	1008.579679	0.008579679	0.008579679	4124
+115	15	1000	998.358838	-0.001641162	0.001641162	4124
+115	16	1000	1006.022077	0.006022077	0.006022077	4124
+115	17	1000	989.436475	-0.010563525	0.010563525	4124
+115	18	1000	994.532588	-0.005467412	0.005467412	4124
+115	19	1000	1000.911658	0.000911658	0.000911658	4124
+115	20	5000	4998.010127	-0.000397975	0.000397975	4124
+115	21	5000	4937.477005	-0.012504599	0.012504599	4124
+115	22	5000	5028.615500	0.005723100	0.005723100	4124
+115	23	10000	10341.386479	0.034138648	0.034138648	4124
+116	0	1000	997.083024	-0.002916976	0.002916976	4124
+116	1	1000	1008.579679	0.008579679	0.008579679	4124
+116	2	1000	993.257965	-0.006742035	0.006742035	4124
+116	3	1000	989.436475	-0.010563525	0.010563525	4124
+116	4	1000	994.532588	-0.005467412	0.005467412	4124
+116	5	1000	1003.466070	0.003466070	0.003466070	4124
+116	6	1000	1009.859079	0.009859079	0.009859079	4124
+116	7	1000	1017.543884	0.017543884	0.017543884	4124
+116	8	1000	1025.243135	0.025243135	0.025243135	4124
+116	9	1000	1013.699680	0.013699680	0.013699680	4124
+116	10	1000	1009.859079	0.009859079	0.009859079	4124
+116	11	1000	971.649847	-0.028350153	0.028350153	4124
+116	12	1000	1012.419079	0.012419079	0.012419079	4124
+116	13	1000	997.083024	-0.002916976	0.002916976	4124
+116	14	1000	988.163437	-0.011836563	0.011836563	4124
+116	15	1000	1022.675110	0.022675110	0.022675110	4124
+116	16	1000	995.807607	-0.004192393	0.004192393	4124
+116	17	1000	1004.743874	0.004743874	0.004743874	4124
+116	18	1000	1006.022077	0.006022077	0.006022077	4124
+116	19	1000	1011.138879	0.011138879	0.011138879	4124
+116	20	5000	5100.930114	0.020186023	0.020186023	4124
+116	21	5000	5025.203588	0.005040718	0.005040718	4124
+116	22	5000	5059.451279	0.011890256	0.011890256	4124
+116	23	10000	10052.136924	0.005213692	0.005213692	4124
+117	0	1000	994.532588	-0.005467412	0.005467412	4124
+117	1	1000	989.436475	-0.010563525	0.010563525	4124
+117	2	1000	1006.022077	0.006022077	0.006022077	4124
+117	3	1000	1000.911658	0.000911658	0.000911658	4124
+117	4	1000	1008.579679	0.008579679	0.008579679	4124
+117	5	1000	999.635049	-0.000364951	0.000364951	4124
+117	6	1000	1004.743874	0.004743874	0.004743874	4124
+117	7	1000	1008.579679	0.008579679	0.008579679	4124
+117	8	1000	994.532588	-0.005467412	0.005467412	4124
+117	9	1000	971.649847	-0.028350153	0.028350153	4124
+117	10	1000	991.983739	-0.008016261	0.008016261	4124
+117	11	1000	1012.419079	0.012419079	0.012419079	4124
+117	12	1000	984.346695	-0.015653305	0.015653305	4124
+117	13	1000	980.533506	-0.019466494	0.019466494	4124
+117	14	1000	974.186070	-0.025813930	0.025813930	4124
+117	15	1000	1003.466070	0.003466070	0.003466070	4124
+117	16	1000	1011.138879	0.011138879	0.011138879	4124
+117	17	1000	997.083024	-0.002916976	0.002916976	4124
+117	18	1000	1002.188665	0.002188665	0.002188665	4124
+117	19	1000	994.532588	-0.005467412	0.005467412	4124
+117	20	5000	4967.631743	-0.006473651	0.006473651	4124
+117	21	5000	4987.858944	-0.002428211	0.002428211	4124
+117	22	5000	4994.623603	-0.001075279	0.001075279	4124
+117	23	10000	10110.735920	0.011073592	0.011073592	4124
+118	0	1000	1000.911658	0.000911658	0.000911658	4124
+118	1	1000	1014.980680	0.014980680	0.014980680	4124
+118	2	1000	990.709909	-0.009290091	0.009290091	4124
+118	3	1000	984.346695	-0.015653305	0.015653305	4124
+118	4	1000	1026.527751	0.026527751	0.026527751	4124
+118	5	1000	990.709909	-0.009290091	0.009290091	4124
+118	6	1000	1011.138879	0.011138879	0.011138879	4124
+118	7	1000	989.436475	-0.010563525	0.010563525	4124
+118	8	1000	1000.911658	0.000911658	0.000911658	4124
+118	9	1000	977.993351	-0.022006649	0.022006649	4124
+118	10	1000	980.533506	-0.019466494	0.019466494	4124
+118	11	1000	1004.743874	0.004743874	0.004743874	4124
+118	12	1000	1004.743874	0.004743874	0.004743874	4124
+118	13	1000	1009.859079	0.009859079	0.009859079	4124
+118	14	1000	999.635049	-0.000364951	0.000364951	4124
+118	15	1000	1004.743874	0.004743874	0.004743874	4124
+118	16	1000	1004.743874	0.004743874	0.004743874	4124
+118	17	1000	990.709909	-0.009290091	0.009290091	4124
+118	18	1000	1000.911658	0.000911658	0.000911658	4124
+118	19	1000	1004.743874	0.004743874	0.004743874	4124
+118	20	5000	5001.399453	0.000279891	0.000279891	4124
+118	21	5000	5018.388278	0.003677656	0.003677656	4124
+118	22	5000	4991.239877	-0.001752025	0.001752025	4124
+118	23	10000	9847.861908	-0.015213809	0.015213809	4124
+119	0	1000	1002.188665	0.002188665	0.002188665	4124
+119	1	1000	990.709909	-0.009290091	0.009290091	4124
+119	2	1000	983.075238	-0.016924762	0.016924762	4124
+119	3	1000	1002.188665	0.002188665	0.002188665	4124
+119	4	1000	999.635049	-0.000364951	0.000364951	4124
+119	5	1000	999.635049	-0.000364951	0.000364951	4124
+119	6	1000	1011.138879	0.011138879	0.011138879	4124
+119	7	1000	994.532588	-0.005467412	0.005467412	4124
+119	8	1000	986.890795	-0.013109205	0.013109205	4124
+119	9	1000	988.163437	-0.011836563	0.011836563	4124
+119	10	1000	989.436475	-0.010563525	0.010563525	4124
+119	11	1000	991.983739	-0.008016261	0.008016261	4124
+119	12	1000	1007.300678	0.007300678	0.007300678	4124
+119	13	1000	1000.911658	0.000911658	0.000911658	4124
+119	14	1000	1003.466070	0.003466070	0.003466070	4124
+119	15	1000	1000.911658	0.000911658	0.000911658	4124
+119	16	1000	972.917762	-0.027082238	0.027082238	4124
+119	17	1000	1011.138879	0.011138879	0.011138879	4124
+119	18	1000	1012.419079	0.012419079	0.012419079	4124
+119	19	1000	1025.243135	0.025243135	0.025243135	4124
+119	20	5000	5008.186530	0.001637306	0.001637306	4124
+119	21	5000	5132.317241	0.026463448	0.026463448	4124
+119	22	5000	4974.363051	-0.005127390	0.005127390	4124
+119	23	10000	10182.179592	0.018217959	0.018217959	4124
+120	0	1000	990.709909	-0.009290091	0.009290091	4124
+120	1	1000	975.454771	-0.024545229	0.024545229	4124
+120	2	1000	995.807607	-0.004192393	0.004192393	4124
+120	3	1000	999.635049	-0.000364951	0.000364951	4124
+120	4	1000	1009.859079	0.009859079	0.009859079	4124
+120	5	1000	1011.138879	0.011138879	0.011138879	4124
+120	6	1000	994.532588	-0.005467412	0.005467412	4124
+120	7	1000	1004.743874	0.004743874	0.004743874	4124
+120	8	1000	998.358838	-0.001641162	0.001641162	4124
+120	9	1000	983.075238	-0.016924762	0.016924762	4124
+120	10	1000	984.346695	-0.015653305	0.015653305	4124
+120	11	1000	1004.743874	0.004743874	0.004743874	4124
+120	12	1000	999.635049	-0.000364951	0.000364951	4124
+120	13	1000	1007.300678	0.007300678	0.007300678	4124
+120	14	1000	998.358838	-0.001641162	0.001641162	4124
+120	15	1000	999.635049	-0.000364951	0.000364951	4124
+120	16	1000	1003.466070	0.003466070	0.003466070	4124
+120	17	1000	998.358838	-0.001641162	0.001641162	4124
+120	18	1000	999.635049	-0.000364951	0.000364951	4124
+120	19	1000	975.454771	-0.024545229	0.024545229	4124
+120	20	5000	4944.158899	-0.011168220	0.011168220	4124
+120	21	5000	5001.399453	0.000279891	0.000279891	4124
+120	22	5000	5059.451279	0.011890256	0.011890256	4124
+120	23	10000	10052.136924	0.005213692	0.005213692	4124
+121	0	1000	990.709909	-0.009290091	0.009290091	4124
+121	1	1000	990.709909	-0.009290091	0.009290091	4124
+121	2	1000	1011.138879	0.011138879	0.011138879	4124
+121	3	1000	995.807607	-0.004192393	0.004192393	4124
+121	4	1000	1003.466070	0.003466070	0.003466070	4124
+121	5	1000	1007.300678	0.007300678	0.007300678	4124
+121	6	1000	1011.138879	0.011138879	0.011138879	4124
+121	7	1000	1011.138879	0.011138879	0.011138879	4124
+121	8	1000	1011.138879	0.011138879	0.011138879	4124
+121	9	1000	989.436475	-0.010563525	0.010563525	4124
+121	10	1000	980.533506	-0.019466494	0.019466494	4124
+121	11	1000	970.382324	-0.029617676	0.029617676	4124
+121	12	1000	989.436475	-0.010563525	0.010563525	4124
+121	13	1000	1012.419079	0.012419079	0.012419079	4124
+121	14	1000	1003.466070	0.003466070	0.003466070	4124
+121	15	1000	1016.262082	0.016262082	0.016262082	4124
+121	16	1000	1009.859079	0.009859079	0.009859079	4124
+121	17	1000	1006.022077	0.006022077	0.006022077	4124
+121	18	1000	1002.188665	0.002188665	0.002188665	4124
+121	19	1000	994.532588	-0.005467412	0.005467412	4124
+121	20	5000	5025.203588	0.005040718	0.005040718	4124
+121	21	5000	4984.480800	-0.003103840	0.003103840	4124
+121	22	5000	4917.496478	-0.016500704	0.016500704	4124
+121	23	10000	10028.930063	0.002893006	0.002893006	4124
+122	0	1000	988.163437	-0.011836563	0.011836563	4124
+122	1	1000	1022.675110	0.022675110	0.022675110	4124
+122	2	1000	1000.911658	0.000911658	0.000911658	4124
+122	3	1000	1011.138879	0.011138879	0.011138879	4124
+122	4	1000	1000.911658	0.000911658	0.000911658	4124
+122	5	1000	1009.859079	0.009859079	0.009859079	4124
+122	6	1000	986.890795	-0.013109205	0.013109205	4124
+122	7	1000	985.618547	-0.014381453	0.014381453	4124
+122	8	1000	1003.466070	0.003466070	0.003466070	4124
+122	9	1000	1004.743874	0.004743874	0.004743874	4124
+122	10	1000	995.807607	-0.004192393	0.004192393	4124
+122	11	1000	1006.022077	0.006022077	0.006022077	4124
+122	12	1000	1012.419079	0.012419079	0.012419079	4124
+122	13	1000	1013.699680	0.013699680	0.013699680	4124
+122	14	1000	995.807607	-0.004192393	0.004192393	4124
+122	15	1000	991.983739	-0.008016261	0.008016261	4124
+122	16	1000	1002.188665	0.002188665	0.002188665	4124
+122	17	1000	986.890795	-0.013109205	0.013109205	4124
+122	18	1000	995.807607	-0.004192393	0.004192393	4124
+122	19	1000	1000.911658	0.000911658	0.000911658	4124
+122	20	5000	5224.366059	0.044873212	0.044873212	4124
+122	21	5000	4887.707256	-0.022458549	0.022458549	4124
+122	22	5000	4957.555477	-0.008488905	0.008488905	4124
+122	23	10000	9982.907107	-0.001709289	0.001709289	4124
+123	0	1000	1004.743874	0.004743874	0.004743874	4124
+123	1	1000	991.983739	-0.008016261	0.008016261	4124
+123	2	1000	1007.300678	0.007300678	0.007300678	4124
+123	3	1000	991.983739	-0.008016261	0.008016261	4124
+123	4	1000	1014.980680	0.014980680	0.014980680	4124
+123	5	1000	988.163437	-0.011836563	0.011836563	4124
+123	6	1000	980.533506	-0.019466494	0.019466494	4124
+123	7	1000	1007.300678	0.007300678	0.007300678	4124
+123	8	1000	997.083024	-0.002916976	0.002916976	4124
+123	9	1000	1016.262082	0.016262082	0.016262082	4124
+123	10	1000	998.358838	-0.001641162	0.001641162	4124
+123	11	1000	1011.138879	0.011138879	0.011138879	4124
+123	12	1000	1012.419079	0.012419079	0.012419079	4124
+123	13	1000	1006.022077	0.006022077	0.006022077	4124
+123	14	1000	1008.579679	0.008579679	0.008579679	4124
+123	15	1000	984.346695	-0.015653305	0.015653305	4124
+123	16	1000	1011.138879	0.011138879	0.011138879	4124
+123	17	1000	1007.300678	0.007300678	0.007300678	4124
+123	18	1000	998.358838	-0.001641162	0.001641162	4124
+123	19	1000	1016.262082	0.016262082	0.016262082	4124
+123	20	5000	4900.920170	-0.019815966	0.019815966	4124
+123	21	5000	5049.146871	0.009829374	0.009829374	4124
+123	22	5000	5083.596191	0.016719238	0.016719238	4124
+123	23	10000	9937.395527	-0.006260447	0.006260447	4124
+124	0	1000	1008.579679	0.008579679	0.008579679	4124
+124	1	1000	1016.262082	0.016262082	0.016262082	4124
+124	2	1000	1008.579679	0.008579679	0.008579679	4124
+124	3	1000	1009.859079	0.009859079	0.009859079	4124
+124	4	1000	983.075238	-0.016924762	0.016924762	4124
+124	5	1000	1012.419079	0.012419079	0.012419079	4124
+124	6	1000	1009.859079	0.009859079	0.009859079	4124
+124	7	1000	1004.743874	0.004743874	0.004743874	4124
+124	8	1000	1002.188665	0.002188665	0.002188665	4124
+124	9	1000	999.635049	-0.000364951	0.000364951	4124
+124	10	1000	997.083024	-0.002916976	0.002916976	4124
+124	11	1000	990.709909	-0.009290091	0.009290091	4124
+124	12	1000	991.983739	-0.008016261	0.008016261	4124
+124	13	1000	988.163437	-0.011836563	0.011836563	4124
+124	14	1000	991.983739	-0.008016261	0.008016261	4124
+124	15	1000	1025.243135	0.025243135	0.025243135	4124
+124	16	1000	977.993351	-0.022006649	0.022006649	4124
+124	17	1000	998.358838	-0.001641162	0.001641162	4124
+124	18	1000	1009.859079	0.009859079	0.009859079	4124
+124	19	1000	1003.466070	0.003466070	0.003466070	4124
+124	20	5000	5052.578794	0.010515759	0.010515759	4124
+124	21	5000	5056.013595	0.011202719	0.011202719	4124
+124	22	5000	5062.891850	0.012578370	0.012578370	4124
+124	23	10000	9926.096210	-0.007390379	0.007390379	4124
+125	0	1000	1017.543884	0.017543884	0.017543884	4124
+125	1	1000	997.083024	-0.002916976	0.002916976	4124
+125	2	1000	999.635049	-0.000364951	0.000364951	4124
+125	3	1000	994.532588	-0.005467412	0.005467412	4124
+125	4	1000	999.635049	-0.000364951	0.000364951	4124
+125	5	1000	991.983739	-0.008016261	0.008016261	4124
+125	6	1000	1002.188665	0.002188665	0.002188665	4124
+125	7	1000	1014.980680	0.014980680	0.014980680	4124
+125	8	1000	1000.911658	0.000911658	0.000911658	4124
+125	9	1000	1002.188665	0.002188665	0.002188665	4124
+125	10	1000	997.083024	-0.002916976	0.002916976	4124
+125	11	1000	998.358838	-0.001641162	0.001641162	4124
+125	12	1000	989.436475	-0.010563525	0.010563525	4124
+125	13	1000	977.993351	-0.022006649	0.022006649	4124
+125	14	1000	990.709909	-0.009290091	0.009290091	4124
+125	15	1000	997.083024	-0.002916976	0.002916976	4124
+125	16	1000	985.618547	-0.014381453	0.014381453	4124
+125	17	1000	1016.262082	0.016262082	0.016262082	4124
+125	18	1000	990.709909	-0.009290091	0.009290091	4124
+125	19	1000	1007.300678	0.007300678	0.007300678	4124
+125	20	5000	4937.477005	-0.012504599	0.012504599	4124
+125	21	5000	5128.817882	0.025763576	0.025763576	4124
+125	22	5000	4947.503938	-0.010499212	0.010499212	4124
+125	23	10000	10087.195626	0.008719563	0.008719563	4124
+126	0	1000	993.257965	-0.006742035	0.006742035	4124
+126	1	1000	983.075238	-0.016924762	0.016924762	4124
+126	2	1000	1000.911658	0.000911658	0.000911658	4124
+126	3	1000	993.257965	-0.006742035	0.006742035	4124
+126	4	1000	1004.743874	0.004743874	0.004743874	4124
+126	5	1000	1004.743874	0.004743874	0.004743874	4124
+126	6	1000	997.083024	-0.002916976	0.002916976	4124
+126	7	1000	1023.958921	0.023958921	0.023958921	4124
+126	8	1000	1006.022077	0.006022077	0.006022077	4124
+126	9	1000	1011.138879	0.011138879	0.011138879	4124
+126	10	1000	1007.300678	0.007300678	0.007300678	4124
+126	11	1000	1007.300678	0.007300678	0.007300678	4124
+126	12	1000	1006.022077	0.006022077	0.006022077	4124
+126	13	1000	1006.022077	0.006022077	0.006022077	4124
+126	14	1000	1002.188665	0.002188665	0.002188665	4124
+126	15	1000	999.635049	-0.000364951	0.000364951	4124
+126	16	1000	997.083024	-0.002916976	0.002916976	4124
+126	17	1000	999.635049	-0.000364951	0.000364951	4124
+126	18	1000	1008.579679	0.008579679	0.008579679	4124
+126	19	1000	1009.859079	0.009859079	0.009859079	4124
+126	20	5000	4773.876985	-0.045224603	0.045224603	4124
+126	21	5000	4786.727191	-0.042654562	0.042654562	4124
+126	22	5000	4904.230070	-0.019153986	0.019153986	4124
+126	23	10000	10005.853945	0.000585395	0.000585395	4124
+127	0	1000	997.083024	-0.002916976	0.002916976	4124
+127	1	1000	1008.579679	0.008579679	0.008579679	4124
+127	2	1000	1007.300678	0.007300678	0.007300678	4124
+127	3	1000	1004.743874	0.004743874	0.004743874	4124
+127	4	1000	1021.391701	0.021391701	0.021391701	4124
+127	5	1000	1011.138879	0.011138879	0.011138879	4124
+127	6	1000	999.635049	-0.000364951	0.000364951	4124
+127	7	1000	998.358838	-0.001641162	0.001641162	4124
+127	8	1000	1013.699680	0.013699680	0.013699680	4124
+127	9	1000	1003.466070	0.003466070	0.003466070	4124
+127	10	1000	994.532588	-0.005467412	0.005467412	4124
+127	11	1000	999.635049	-0.000364951	0.000364951	4124
+127	12	1000	1003.466070	0.003466070	0.003466070	4124
+127	13	1000	1008.579679	0.008579679	0.008579679	4124
+127	14	1000	990.709909	-0.009290091	0.009290091	4124
+127	15	1000	1006.022077	0.006022077	0.006022077	4124
+127	16	1000	1027.812771	0.027812771	0.027812771	4124
+127	17	1000	1008.579679	0.008579679	0.008579679	4124
+127	18	1000	994.532588	-0.005467412	0.005467412	4124
+127	19	1000	980.533506	-0.019466494	0.019466494	4124
+127	20	5000	4917.496478	-0.016500704	0.016500704	4124
+127	21	5000	4977.732858	-0.004453428	0.004453428	4124
+127	22	5000	5052.578794	0.010515759	0.010515759	4124
+127	23	10000	10040.517058	0.004051706	0.004051706	4124
+128	0	1000	1007.300678	0.007300678	0.007300678	4124
+128	1	1000	1007.300678	0.007300678	0.007300678	4124
+128	2	1000	999.635049	-0.000364951	0.000364951	4124
+128	3	1000	1004.743874	0.004743874	0.004743874	4124
+128	4	1000	995.807607	-0.004192393	0.004192393	4124
+128	5	1000	1004.743874	0.004743874	0.004743874	4124
+128	6	1000	1002.188665	0.002188665	0.002188665	4124
+128	7	1000	998.358838	-0.001641162	0.001641162	4124
+128	8	1000	1000.911658	0.000911658	0.000911658	4124
+128	9	1000	1013.699680	0.013699680	0.013699680	4124
+128	10	1000	986.890795	-0.013109205	0.013109205	4124
+128	11	1000	1016.262082	0.016262082	0.016262082	4124
+128	12	1000	1020.108694	0.020108694	0.020108694	4124
+128	13	1000	999.635049	-0.000364951	0.000364951	4124
+128	14	1000	994.532588	-0.005467412	0.005467412	4124
+128	15	1000	993.257965	-0.006742035	0.006742035	4124
+128	16	1000	1011.138879	0.011138879	0.011138879	4124
+128	17	1000	1006.022077	0.006022077	0.006022077	4124
+128	18	1000	979.263232	-0.020736768	0.020736768	4124
+128	19	1000	1012.419079	0.012419079	0.012419079	4124
+128	20	5000	5093.987740	0.018797548	0.018797548	4124
+128	21	5000	4907.542646	-0.018491471	0.018491471	4124
+128	22	5000	5062.891850	0.012578370	0.012578370	4124
+128	23	10000	10194.208969	0.019420897	0.019420897	4124
+129	0	1000	990.709909	-0.009290091	0.009290091	4124
+129	1	1000	983.075238	-0.016924762	0.016924762	4124
+129	2	1000	994.532588	-0.005467412	0.005467412	4124
+129	3	1000	1000.911658	0.000911658	0.000911658	4124
+129	4	1000	997.083024	-0.002916976	0.002916976	4124
+129	5	1000	990.709909	-0.009290091	0.009290091	4124
+129	6	1000	993.257965	-0.006742035	0.006742035	4124
+129	7	1000	1017.543884	0.017543884	0.017543884	4124
+129	8	1000	998.358838	-0.001641162	0.001641162	4124
+129	9	1000	1027.812771	0.027812771	0.027812771	4124
+129	10	1000	1017.543884	0.017543884	0.017543884	4124
+129	11	1000	1002.188665	0.002188665	0.002188665	4124
+129	12	1000	1021.391701	0.021391701	0.021391701	4124
+129	13	1000	995.807607	-0.004192393	0.004192393	4124
+129	14	1000	997.083024	-0.002916976	0.002916976	4124
+129	15	1000	977.993351	-0.022006649	0.022006649	4124
+129	16	1000	994.532588	-0.005467412	0.005467412	4124
+129	17	1000	990.709909	-0.009290091	0.009290091	4124
+129	18	1000	998.358838	-0.001641162	0.001641162	4124
+129	19	1000	1014.980680	0.014980680	0.014980680	4124
+129	20	5000	4927.474558	-0.014505088	0.014505088	4124
+129	21	5000	4910.857903	-0.017828419	0.017828419	4124
+129	22	5000	5035.447861	0.007089572	0.007089572	4124
+129	23	10000	10040.517058	0.004051706	0.004051706	4124
+130	0	1000	1003.466070	0.003466070	0.003466070	4124
+130	1	1000	1016.262082	0.016262082	0.016262082	4124
+130	2	1000	995.807607	-0.004192393	0.004192393	4124
+130	3	1000	1000.911658	0.000911658	0.000911658	4124
+130	4	1000	1004.743874	0.004743874	0.004743874	4124
+130	5	1000	999.635049	-0.000364951	0.000364951	4124
+130	6	1000	993.257965	-0.006742035	0.006742035	4124
+130	7	1000	989.436475	-0.010563525	0.010563525	4124
+130	8	1000	1011.138879	0.011138879	0.011138879	4124
+130	9	1000	993.257965	-0.006742035	0.006742035	4124
+130	10	1000	1000.911658	0.000911658	0.000911658	4124
+130	11	1000	998.358838	-0.001641162	0.001641162	4124
+130	12	1000	990.709909	-0.009290091	0.009290091	4124
+130	13	1000	1006.022077	0.006022077	0.006022077	4124
+130	14	1000	1035.531366	0.035531366	0.035531366	4124
+130	15	1000	1007.300678	0.007300678	0.007300678	4124
+130	16	1000	1002.188665	0.002188665	0.002188665	4124
+130	17	1000	1000.911658	0.000911658	0.000911658	4124
+130	18	1000	995.807607	-0.004192393	0.004192393	4124
+130	19	1000	1009.859079	0.009859079	0.009859079	4124
+130	20	5000	4964.270233	-0.007145953	0.007145953	4124
+130	21	5000	5008.186530	0.001637306	0.001637306	4124
+130	22	5000	4977.732858	-0.004453428	0.004453428	4124
+130	23	10000	10206.273779	0.020627378	0.020627378	4124
+131	0	1000	991.983739	-0.008016261	0.008016261	4124
+131	1	1000	1004.743874	0.004743874	0.004743874	4124
+131	2	1000	990.709909	-0.009290091	0.009290091	4124
+131	3	1000	976.723864	-0.023276136	0.023276136	4124
+131	4	1000	1006.022077	0.006022077	0.006022077	4124
+131	5	1000	1006.022077	0.006022077	0.006022077	4124
+131	6	1000	998.358838	-0.001641162	0.001641162	4124
+131	7	1000	993.257965	-0.006742035	0.006742035	4124
+131	8	1000	975.454771	-0.024545229	0.024545229	4124
+131	9	1000	1009.859079	0.009859079	0.009859079	4124
+131	10	1000	994.532588	-0.005467412	0.005467412	4124
+131	11	1000	1003.466070	0.003466070	0.003466070	4124
+131	12	1000	989.436475	-0.010563525	0.010563525	4124
+131	13	1000	999.635049	-0.000364951	0.000364951	4124
+131	14	1000	998.358838	-0.001641162	0.001641162	4124
+131	15	1000	998.358838	-0.001641162	0.001641162	4124
+131	16	1000	985.618547	-0.014381453	0.014381453	4124
+131	17	1000	994.532588	-0.005467412	0.005467412	4124
+131	18	1000	1004.743874	0.004743874	0.004743874	4124
+131	19	1000	990.709909	-0.009290091	0.009290091	4124
+131	20	5000	5014.984871	0.002996974	0.002996974	4124
+131	21	5000	5038.868321	0.007773664	0.007773664	4124
+131	22	5000	4914.175845	-0.017164831	0.017164831	4124
+131	23	10000	10468.207755	0.046820776	0.046820776	4124
+132	0	1000	988.163437	-0.011836563	0.011836563	4124
+132	1	1000	998.358838	-0.001641162	0.001641162	4124
+132	2	1000	976.723864	-0.023276136	0.023276136	4124
+132	3	1000	984.346695	-0.015653305	0.015653305	4124
+132	4	1000	1004.743874	0.004743874	0.004743874	4124
+132	5	1000	991.983739	-0.008016261	0.008016261	4124
+132	6	1000	1002.188665	0.002188665	0.002188665	4124
+132	7	1000	998.358838	-0.001641162	0.001641162	4124
+132	8	1000	983.075238	-0.016924762	0.016924762	4124
+132	9	1000	999.635049	-0.000364951	0.000364951	4124
+132	10	1000	989.436475	-0.010563525	0.010563525	4124
+132	11	1000	984.346695	-0.015653305	0.015653305	4124
+132	12	1000	989.436475	-0.010563525	0.010563525	4124
+132	13	1000	1006.022077	0.006022077	0.006022077	4124
+132	14	1000	993.257965	-0.006742035	0.006742035	4124
+132	15	1000	1000.911658	0.000911658	0.000911658	4124
+132	16	1000	999.635049	-0.000364951	0.000364951	4124
+132	17	1000	1003.466070	0.003466070	0.003466070	4124
+132	18	1000	997.083024	-0.002916976	0.002916976	4124
+132	19	1000	1000.911658	0.000911658	0.000911658	4124
+132	20	5000	4914.175845	-0.017164831	0.017164831	4124
+132	21	5000	5001.399453	0.000279891	0.000279891	4124
+132	22	5000	4907.542646	-0.018491471	0.018491471	4124
+132	23	10000	10098.948862	0.009894886	0.009894886	4124
+133	0	1000	1013.699680	0.013699680	0.013699680	4124
+133	1	1000	1018.826088	0.018826088	0.018826088	4124
+133	2	1000	997.083024	-0.002916976	0.002916976	4124
+133	3	1000	1020.108694	0.020108694	0.020108694	4124
+133	4	1000	1008.579679	0.008579679	0.008579679	4124
+133	5	1000	993.257965	-0.006742035	0.006742035	4124
+133	6	1000	1006.022077	0.006022077	0.006022077	4124
+133	7	1000	1029.098194	0.029098194	0.029098194	4124
+133	8	1000	975.454771	-0.024545229	0.024545229	4124
+133	9	1000	1018.826088	0.018826088	0.018826088	4124
+133	10	1000	1000.911658	0.000911658	0.000911658	4124
+133	11	1000	997.083024	-0.002916976	0.002916976	4124
+133	12	1000	1008.579679	0.008579679	0.008579679	4124
+133	13	1000	989.436475	-0.010563525	0.010563525	4124
+133	14	1000	1020.108694	0.020108694	0.020108694	4124
+133	15	1000	997.083024	-0.002916976	0.002916976	4124
+133	16	1000	1014.980680	0.014980680	0.014980680	4124
+133	17	1000	1004.743874	0.004743874	0.004743874	4124
+133	18	1000	1006.022077	0.006022077	0.006022077	4124
+133	19	1000	1016.262082	0.016262082	0.016262082	4124
+133	20	5000	4984.480800	-0.003103840	0.003103840	4124
+133	21	5000	4987.858944	-0.002428211	0.002428211	4124
+133	22	5000	5111.365789	0.022273158	0.022273158	4124
+133	23	10000	9792.881217	-0.020711878	0.020711878	4124
+134	0	1000	988.163437	-0.011836563	0.011836563	4124
+134	1	1000	1006.022077	0.006022077	0.006022077	4124
+134	2	1000	995.807607	-0.004192393	0.004192393	4124
+134	3	1000	995.807607	-0.004192393	0.004192393	4124
+134	4	1000	1013.699680	0.013699680	0.013699680	4124
+134	5	1000	991.983739	-0.008016261	0.008016261	4124
+134	6	1000	989.436475	-0.010563525	0.010563525	4124
+134	7	1000	1013.699680	0.013699680	0.013699680	4124
+134	8	1000	986.890795	-0.013109205	0.013109205	4124
+134	9	1000	1008.579679	0.008579679	0.008579679	4124
+134	10	1000	1002.188665	0.002188665	0.002188665	4124
+134	11	1000	1006.022077	0.006022077	0.006022077	4124
+134	12	1000	1007.300678	0.007300678	0.007300678	4124
+134	13	1000	1009.859079	0.009859079	0.009859079	4124
+134	14	1000	1035.531366	0.035531366	0.035531366	4124
+134	15	1000	991.983739	-0.008016261	0.008016261	4124
+134	16	1000	984.346695	-0.015653305	0.015653305	4124
+134	17	1000	998.358838	-0.001641162	0.001641162	4124
+134	18	1000	1004.743874	0.004743874	0.004743874	4124
+134	19	1000	1003.466070	0.003466070	0.003466070	4124
+134	20	5000	4924.145830	-0.015170834	0.015170834	4124
+134	21	5000	4950.851711	-0.009829658	0.009829658	4124
+134	22	5000	4927.474558	-0.014505088	0.014505088	4124
+134	23	10000	10110.735920	0.011073592	0.011073592	4124
+135	0	1000	1000.911658	0.000911658	0.000911658	4124
+135	1	1000	1009.859079	0.009859079	0.009859079	4124
+135	2	1000	970.382324	-0.029617676	0.029617676	4124
+135	3	1000	1002.188665	0.002188665	0.002188665	4124
+135	4	1000	1004.743874	0.004743874	0.004743874	4124
+135	5	1000	997.083024	-0.002916976	0.002916976	4124
+135	6	1000	1009.859079	0.009859079	0.009859079	4124
+135	7	1000	995.807607	-0.004192393	0.004192393	4124
+135	8	1000	1020.108694	0.020108694	0.020108694	4124
+135	9	1000	994.532588	-0.005467412	0.005467412	4124
+135	10	1000	1017.543884	0.017543884	0.017543884	4124
+135	11	1000	1006.022077	0.006022077	0.006022077	4124
+135	12	1000	999.635049	-0.000364951	0.000364951	4124
+135	13	1000	1002.188665	0.002188665	0.002188665	4124
+135	14	1000	1000.911658	0.000911658	0.000911658	4124
+135	15	1000	998.358838	-0.001641162	0.001641162	4124
+135	16	1000	1017.543884	0.017543884	0.017543884	4124
+135	17	1000	989.436475	-0.010563525	0.010563525	4124
+135	18	1000	1003.466070	0.003466070	0.003466070	4124
+135	19	1000	990.709909	-0.009290091	0.009290091	4124
+135	20	5000	5087.057112	0.017411422	0.017411422	4124
+135	21	5000	5032.030256	0.006406051	0.006406051	4124
+135	22	5000	4960.911479	-0.007817704	0.007817704	4124
+135	23	10000	9937.395527	-0.006260447	0.006260447	4124
+136	0	1000	1022.675110	0.022675110	0.022675110	4124
+136	1	1000	981.804175	-0.018195825	0.018195825	4124
+136	2	1000	984.346695	-0.015653305	0.015653305	4124
+136	3	1000	985.618547	-0.014381453	0.014381453	4124
+136	4	1000	995.807607	-0.004192393	0.004192393	4124
+136	5	1000	983.075238	-0.016924762	0.016924762	4124
+136	6	1000	989.436475	-0.010563525	0.010563525	4124
+136	7	1000	1007.300678	0.007300678	0.007300678	4124
+136	8	1000	991.983739	-0.008016261	0.008016261	4124
+136	9	1000	1018.826088	0.018826088	0.018826088	4124
+136	10	1000	1009.859079	0.009859079	0.009859079	4124
+136	11	1000	1006.022077	0.006022077	0.006022077	4124
+136	12	1000	1006.022077	0.006022077	0.006022077	4124
+136	13	1000	969.115193	-0.030884807	0.030884807	4124
+136	14	1000	1012.419079	0.012419079	0.012419079	4124
+136	15	1000	1007.300678	0.007300678	0.007300678	4124
+136	16	1000	1006.022077	0.006022077	0.006022077	4124
+136	17	1000	1004.743874	0.004743874	0.004743874	4124
+136	18	1000	999.635049	-0.000364951	0.000364951	4124
+136	19	1000	1011.138879	0.011138879	0.011138879	4124
+136	20	5000	5001.399453	0.000279891	0.000279891	4124
+136	21	5000	5128.817882	0.025763576	0.025763576	4124
+136	22	5000	5035.447861	0.007089572	0.007089572	4124
+136	23	10000	10353.893359	0.035389336	0.035389336	4124
+137	0	1000	1006.022077	0.006022077	0.006022077	4124
+137	1	1000	990.709909	-0.009290091	0.009290091	4124
+137	2	1000	1026.527751	0.026527751	0.026527751	4124
+137	3	1000	1013.699680	0.013699680	0.013699680	4124
+137	4	1000	999.635049	-0.000364951	0.000364951	4124
+137	5	1000	988.163437	-0.011836563	0.011836563	4124
+137	6	1000	1011.138879	0.011138879	0.011138879	4124
+137	7	1000	995.807607	-0.004192393	0.004192393	4124
+137	8	1000	1000.911658	0.000911658	0.000911658	4124
+137	9	1000	988.163437	-0.011836563	0.011836563	4124
+137	10	1000	990.709909	-0.009290091	0.009290091	4124
+137	11	1000	975.454771	-0.024545229	0.024545229	4124
+137	12	1000	1009.859079	0.009859079	0.009859079	4124
+137	13	1000	1007.300678	0.007300678	0.007300678	4124
+137	14	1000	1009.859079	0.009859079	0.009859079	4124
+137	15	1000	1006.022077	0.006022077	0.006022077	4124
+137	16	1000	1009.859079	0.009859079	0.009859079	4124
+137	17	1000	1012.419079	0.012419079	0.012419079	4124
+137	18	1000	1007.300678	0.007300678	0.007300678	4124
+137	19	1000	999.635049	-0.000364951	0.000364951	4124
+137	20	5000	4998.010127	-0.000397975	0.000397975	4124
+137	21	5000	5032.030256	0.006406051	0.006406051	4124
+137	22	5000	5032.030256	0.006406051	0.006406051	4124
+137	23	10000	9914.827977	-0.008517202	0.008517202	4124
+138	0	1000	999.635049	-0.000364951	0.000364951	4124
+138	1	1000	990.709909	-0.009290091	0.009290091	4124
+138	2	1000	994.532588	-0.005467412	0.005467412	4124
+138	3	1000	1006.022077	0.006022077	0.006022077	4124
+138	4	1000	1009.859079	0.009859079	0.009859079	4124
+138	5	1000	1003.466070	0.003466070	0.003466070	4124
+138	6	1000	1007.300678	0.007300678	0.007300678	4124
+138	7	1000	1002.188665	0.002188665	0.002188665	4124
+138	8	1000	997.083024	-0.002916976	0.002916976	4124
+138	9	1000	1002.188665	0.002188665	0.002188665	4124
+138	10	1000	998.358838	-0.001641162	0.001641162	4124
+138	11	1000	997.083024	-0.002916976	0.002916976	4124
+138	12	1000	991.983739	-0.008016261	0.008016261	4124
+138	13	1000	998.358838	-0.001641162	0.001641162	4124
+138	14	1000	1000.911658	0.000911658	0.000911658	4124
+138	15	1000	993.257965	-0.006742035	0.006742035	4124
+138	16	1000	993.257965	-0.006742035	0.006742035	4124
+138	17	1000	985.618547	-0.014381453	0.014381453	4124
+138	18	1000	1013.699680	0.013699680	0.013699680	4124
+138	19	1000	1012.419079	0.012419079	0.012419079	4124
+138	20	5000	4984.480800	-0.003103840	0.003103840	4124
+138	21	5000	4944.158899	-0.011168220	0.011168220	4124
+138	22	5000	5011.584290	0.002316858	0.002316858	4124
+138	23	10000	9914.827977	-0.008517202	0.008517202	4124
+139	0	1000	1004.743874	0.004743874	0.004743874	4124
+139	1	1000	1021.391701	0.021391701	0.021391701	4124
+139	2	1000	999.635049	-0.000364951	0.000364951	4124
+139	3	1000	1004.743874	0.004743874	0.004743874	4124
+139	4	1000	998.358838	-0.001641162	0.001641162	4124
+139	5	1000	965.316151	-0.034683849	0.034683849	4124
+139	6	1000	985.618547	-0.014381453	0.014381453	4124
+139	7	1000	1012.419079	0.012419079	0.012419079	4124
+139	8	1000	998.358838	-0.001641162	0.001641162	4124
+139	9	1000	1002.188665	0.002188665	0.002188665	4124
+139	10	1000	1000.911658	0.000911658	0.000911658	4124
+139	11	1000	988.163437	-0.011836563	0.011836563	4124
+139	12	1000	988.163437	-0.011836563	0.011836563	4124
+139	13	1000	983.075238	-0.016924762	0.016924762	4124
+139	14	1000	1004.743874	0.004743874	0.004743874	4124
+139	15	1000	1020.108694	0.020108694	0.020108694	4124
+139	16	1000	1008.579679	0.008579679	0.008579679	4124
+139	17	1000	991.983739	-0.008016261	0.008016261	4124
+139	18	1000	998.358838	-0.001641162	0.001641162	4124
+139	19	1000	979.263232	-0.020736768	0.020736768	4124
+139	20	5000	4944.158899	-0.011168220	0.011168220	4124
+139	21	5000	5066.335314	0.013267063	0.013267063	4124
+139	22	5000	5032.030256	0.006406051	0.006406051	4124
+139	23	10000	10110.735920	0.011073592	0.011073592	4124
+140	0	1000	983.075238	-0.016924762	0.016924762	4124
+140	1	1000	1013.699680	0.013699680	0.013699680	4124
+140	2	1000	988.163437	-0.011836563	0.011836563	4124
+140	3	1000	990.709909	-0.009290091	0.009290091	4124
+140	4	1000	998.358838	-0.001641162	0.001641162	4124
+140	5	1000	1002.188665	0.002188665	0.002188665	4124
+140	6	1000	986.890795	-0.013109205	0.013109205	4124
+140	7	1000	995.807607	-0.004192393	0.004192393	4124
+140	8	1000	1009.859079	0.009859079	0.009859079	4124
+140	9	1000	994.532588	-0.005467412	0.005467412	4124
+140	10	1000	1011.138879	0.011138879	0.011138879	4124
+140	11	1000	997.083024	-0.002916976	0.002916976	4124
+140	12	1000	989.436475	-0.010563525	0.010563525	4124
+140	13	1000	1009.859079	0.009859079	0.009859079	4124
+140	14	1000	1007.300678	0.007300678	0.007300678	4124
+140	15	1000	1030.384020	0.030384020	0.030384020	4124
+140	16	1000	1014.980680	0.014980680	0.014980680	4124
+140	17	1000	1009.859079	0.009859079	0.009859079	4124
+140	18	1000	981.804175	-0.018195825	0.018195825	4124
+140	19	1000	998.358838	-0.001641162	0.001641162	4124
+140	20	5000	5049.146871	0.009829374	0.009829374	4124
+140	21	5000	4987.858944	-0.002428211	0.002428211	4124
+140	22	5000	4930.805994	-0.013838801	0.013838801	4124
+140	23	10000	10353.893359	0.035389336	0.035389336	4124
+141	0	1000	1006.022077	0.006022077	0.006022077	4124
+141	1	1000	1004.743874	0.004743874	0.004743874	4124
+141	2	1000	998.358838	-0.001641162	0.001641162	4124
+141	3	1000	999.635049	-0.000364951	0.000364951	4124
+141	4	1000	1003.466070	0.003466070	0.003466070	4124
+141	5	1000	1022.675110	0.022675110	0.022675110	4124
+141	6	1000	1000.911658	0.000911658	0.000911658	4124
+141	7	1000	1011.138879	0.011138879	0.011138879	4124
+141	8	1000	1007.300678	0.007300678	0.007300678	4124
+141	9	1000	995.807607	-0.004192393	0.004192393	4124
+141	10	1000	991.983739	-0.008016261	0.008016261	4124
+141	11	1000	998.358838	-0.001641162	0.001641162	4124
+141	12	1000	995.807607	-0.004192393	0.004192393	4124
+141	13	1000	1003.466070	0.003466070	0.003466070	4124
+141	14	1000	1002.188665	0.002188665	0.002188665	4124
+141	15	1000	991.983739	-0.008016261	0.008016261	4124
+141	16	1000	1003.466070	0.003466070	0.003466070	4124
+141	17	1000	984.346695	-0.015653305	0.015653305	4124
+141	18	1000	994.532588	-0.005467412	0.005467412	4124
+141	19	1000	994.532588	-0.005467412	0.005467412	4124
+141	20	5000	4874.536826	-0.025092635	0.025092635	4124
+141	21	5000	4960.911479	-0.007817704	0.007817704	4124
+141	22	5000	5038.868321	0.007773664	0.007773664	4124
+141	23	10000	10110.735920	0.011073592	0.011073592	4124
+142	0	1000	1007.300678	0.007300678	0.007300678	4124
+142	1	1000	1013.699680	0.013699680	0.013699680	4124
+142	2	1000	1000.911658	0.000911658	0.000911658	4124
+142	3	1000	1009.859079	0.009859079	0.009859079	4124
+142	4	1000	1007.300678	0.007300678	0.007300678	4124
+142	5	1000	1007.300678	0.007300678	0.007300678	4124
+142	6	1000	1004.743874	0.004743874	0.004743874	4124
+142	7	1000	988.163437	-0.011836563	0.011836563	4124
+142	8	1000	994.532588	-0.005467412	0.005467412	4124
+142	9	1000	985.618547	-0.014381453	0.014381453	4124
+142	10	1000	1004.743874	0.004743874	0.004743874	4124
+142	11	1000	998.358838	-0.001641162	0.001641162	4124
+142	12	1000	989.436475	-0.010563525	0.010563525	4124
+142	13	1000	1013.699680	0.013699680	0.013699680	4124
+142	14	1000	1004.743874	0.004743874	0.004743874	4124
+142	15	1000	980.533506	-0.019466494	0.019466494	4124
+142	16	1000	991.983739	-0.008016261	0.008016261	4124
+142	17	1000	1011.138879	0.011138879	0.011138879	4124
+142	18	1000	985.618547	-0.014381453	0.014381453	4124
+142	19	1000	1020.108694	0.020108694	0.020108694	4124
+142	20	5000	5035.447861	0.007089572	0.007089572	4124
+142	21	5000	4838.534996	-0.032293001	0.032293001	4124
+142	22	5000	5125.321509	0.025064302	0.025064302	4124
+142	23	10000	9727.863978	-0.027213602	0.027213602	4124
+143	0	1000	984.346695	-0.015653305	0.015653305	4124
+143	1	1000	989.436475	-0.010563525	0.010563525	4124
+143	2	1000	1012.419079	0.012419079	0.012419079	4124
+143	3	1000	995.807607	-0.004192393	0.004192393	4124
+143	4	1000	1009.859079	0.009859079	0.009859079	4124
+143	5	1000	1007.300678	0.007300678	0.007300678	4124
+143	6	1000	1000.911658	0.000911658	0.000911658	4124
+143	7	1000	986.890795	-0.013109205	0.013109205	4124
+143	8	1000	1012.419079	0.012419079	0.012419079	4124
+143	9	1000	1002.188665	0.002188665	0.002188665	4124
+143	10	1000	1011.138879	0.011138879	0.011138879	4124
+143	11	1000	1016.262082	0.016262082	0.016262082	4124
+143	12	1000	1008.579679	0.008579679	0.008579679	4124
+143	13	1000	1011.138879	0.011138879	0.011138879	4124
+143	14	1000	974.186070	-0.025813930	0.025813930	4124
+143	15	1000	998.358838	-0.001641162	0.001641162	4124
+143	16	1000	998.358838	-0.001641162	0.001641162	4124
+143	17	1000	990.709909	-0.009290091	0.009290091	4124
+143	18	1000	1009.859079	0.009859079	0.009859079	4124
+143	19	1000	989.436475	-0.010563525	0.010563525	4124
+143	20	5000	4944.158899	-0.011168220	0.011168220	4124
+143	21	5000	5021.794515	0.004358903	0.004358903	4124
+143	22	5000	5042.291639	0.008458328	0.008458328	4124
+143	23	10000	9994.364457	-0.000563554	0.000563554	4124
+144	0	1000	1002.188665	0.002188665	0.002188665	4124
+144	1	1000	1000.911658	0.000911658	0.000911658	4124
+144	2	1000	1011.138879	0.011138879	0.011138879	4124
+144	3	1000	986.890795	-0.013109205	0.013109205	4124
+144	4	1000	1011.138879	0.011138879	0.011138879	4124
+144	5	1000	1026.527751	0.026527751	0.026527751	4124
+144	6	1000	970.382324	-0.029617676	0.029617676	4124
+144	7	1000	995.807607	-0.004192393	0.004192393	4124
+144	8	1000	1011.138879	0.011138879	0.011138879	4124
+144	9	1000	988.163437	-0.011836563	0.011836563	4124
+144	10	1000	1014.980680	0.014980680	0.014980680	4124
+144	11	1000	1013.699680	0.013699680	0.013699680	4124
+144	12	1000	1006.022077	0.006022077	0.006022077	4124
+144	13	1000	1004.743874	0.004743874	0.004743874	4124
+144	14	1000	1011.138879	0.011138879	0.011138879	4124
+144	15	1000	993.257965	-0.006742035	0.006742035	4124
+144	16	1000	988.163437	-0.011836563	0.011836563	4124
+144	17	1000	1004.743874	0.004743874	0.004743874	4124
+144	18	1000	998.358838	-0.001641162	0.001641162	4124
+144	19	1000	993.257965	-0.006742035	0.006742035	4124
+144	20	5000	5292.965282	0.058593056	0.058593056	4124
+144	21	5000	4987.858944	-0.002428211	0.002428211	4124
+144	22	5000	4924.145830	-0.015170834	0.015170834	4124
+144	23	10000	9994.364457	-0.000563554	0.000563554	4124
+145	0	1000	998.358838	-0.001641162	0.001641162	4124
+145	1	1000	1018.826088	0.018826088	0.018826088	4124
+145	2	1000	1003.466070	0.003466070	0.003466070	4124
+145	3	1000	985.618547	-0.014381453	0.014381453	4124
+145	4	1000	1000.911658	0.000911658	0.000911658	4124
+145	5	1000	981.804175	-0.018195825	0.018195825	4124
+145	6	1000	1020.108694	0.020108694	0.020108694	4124
+145	7	1000	1012.419079	0.012419079	0.012419079	4124
+145	8	1000	1027.812771	0.027812771	0.027812771	4124
+145	9	1000	984.346695	-0.015653305	0.015653305	4124
+145	10	1000	985.618547	-0.014381453	0.014381453	4124
+145	11	1000	1031.670251	0.031670251	0.031670251	4124
+145	12	1000	991.983739	-0.008016261	0.008016261	4124
+145	13	1000	1004.743874	0.004743874	0.004743874	4124
+145	14	1000	1006.022077	0.006022077	0.006022077	4124
+145	15	1000	998.358838	-0.001641162	0.001641162	4124
+145	16	1000	999.635049	-0.000364951	0.000364951	4124
+145	17	1000	1006.022077	0.006022077	0.006022077	4124
+145	18	1000	1013.699680	0.013699680	0.013699680	4124
+145	19	1000	988.163437	-0.011836563	0.011836563	4124
+145	20	5000	5100.930114	0.020186023	0.020186023	4124
+145	21	5000	5028.615500	0.005723100	0.005723100	4124
+145	22	5000	4977.732858	-0.004453428	0.004453428	4124
+145	23	10000	10063.789848	0.006378985	0.006378985	4124
+146	0	1000	995.807607	-0.004192393	0.004192393	4124
+146	1	1000	990.709909	-0.009290091	0.009290091	4124
+146	2	1000	989.436475	-0.010563525	0.010563525	4124
+146	3	1000	1003.466070	0.003466070	0.003466070	4124
+146	4	1000	998.358838	-0.001641162	0.001641162	4124
+146	5	1000	994.532588	-0.005467412	0.005467412	4124
+146	6	1000	1022.675110	0.022675110	0.022675110	4124
+146	7	1000	980.533506	-0.019466494	0.019466494	4124
+146	8	1000	989.436475	-0.010563525	0.010563525	4124
+146	9	1000	971.649847	-0.028350153	0.028350153	4124
+146	10	1000	1014.980680	0.014980680	0.014980680	4124
+146	11	1000	1011.138879	0.011138879	0.011138879	4124
+146	12	1000	1014.980680	0.014980680	0.014980680	4124
+146	13	1000	1007.300678	0.007300678	0.007300678	4124
+146	14	1000	998.358838	-0.001641162	0.001641162	4124
+146	15	1000	1009.859079	0.009859079	0.009859079	4124
+146	16	1000	981.804175	-0.018195825	0.018195825	4124
+146	17	1000	1002.188665	0.002188665	0.002188665	4124
+146	18	1000	1003.466070	0.003466070	0.003466070	4124
+146	19	1000	977.993351	-0.022006649	0.022006649	4124
+146	20	5000	5011.584290	0.002316858	0.002316858	4124
+146	21	5000	4940.816590	-0.011836682	0.011836682	4124
+146	22	5000	4954.202223	-0.009159555	0.009159555	4124
+146	23	10000	10075.476018	0.007547602	0.007547602	4124
+147	0	1000	1016.262082	0.016262082	0.016262082	4124
+147	1	1000	999.635049	-0.000364951	0.000364951	4124
+147	2	1000	1000.911658	0.000911658	0.000911658	4124
+147	3	1000	998.358838	-0.001641162	0.001641162	4124
+147	4	1000	1000.911658	0.000911658	0.000911658	4124
+147	5	1000	1006.022077	0.006022077	0.006022077	4124
+147	6	1000	1012.419079	0.012419079	0.012419079	4124
+147	7	1000	970.382324	-0.029617676	0.029617676	4124
+147	8	1000	1022.675110	0.022675110	0.022675110	4124
+147	9	1000	1008.579679	0.008579679	0.008579679	4124
+147	10	1000	998.358838	-0.001641162	0.001641162	4124
+147	11	1000	1002.188665	0.002188665	0.002188665	4124
+147	12	1000	1003.466070	0.003466070	0.003466070	4124
+147	13	1000	1002.188665	0.002188665	0.002188665	4124
+147	14	1000	1006.022077	0.006022077	0.006022077	4124
+147	15	1000	1009.859079	0.009859079	0.009859079	4124
+147	16	1000	980.533506	-0.019466494	0.019466494	4124
+147	17	1000	989.436475	-0.010563525	0.010563525	4124
+147	18	1000	1017.543884	0.017543884	0.017543884	4124
+147	19	1000	1012.419079	0.012419079	0.012419079	4124
+147	20	5000	4981.105439	-0.003778912	0.003778912	4124
+147	21	5000	5128.817882	0.025763576	0.025763576	4124
+147	22	5000	5014.984871	0.002996974	0.002996974	4124
+147	23	10000	9994.364457	-0.000563554	0.000563554	4124
+148	0	1000	998.358838	-0.001641162	0.001641162	4124
+148	1	1000	1012.419079	0.012419079	0.012419079	4124
+148	2	1000	986.890795	-0.013109205	0.013109205	4124
+148	3	1000	989.436475	-0.010563525	0.010563525	4124
+148	4	1000	993.257965	-0.006742035	0.006742035	4124
+148	5	1000	984.346695	-0.015653305	0.015653305	4124
+148	6	1000	986.890795	-0.013109205	0.013109205	4124
+148	7	1000	980.533506	-0.019466494	0.019466494	4124
+148	8	1000	1000.911658	0.000911658	0.000911658	4124
+148	9	1000	1002.188665	0.002188665	0.002188665	4124
+148	10	1000	1003.466070	0.003466070	0.003466070	4124
+148	11	1000	1009.859079	0.009859079	0.009859079	4124
+148	12	1000	1008.579679	0.008579679	0.008579679	4124
+148	13	1000	999.635049	-0.000364951	0.000364951	4124
+148	14	1000	999.635049	-0.000364951	0.000364951	4124
+148	15	1000	1004.743874	0.004743874	0.004743874	4124
+148	16	1000	1013.699680	0.013699680	0.013699680	4124
+148	17	1000	986.890795	-0.013109205	0.013109205	4124
+148	18	1000	999.635049	-0.000364951	0.000364951	4124
+148	19	1000	999.635049	-0.000364951	0.000364951	4124
+148	20	5000	4981.105439	-0.003778912	0.003778912	4124
+148	21	5000	5021.794515	0.004358903	0.004358903	4124
+148	22	5000	5001.399453	0.000279891	0.000279891	4124
+148	23	10000	10075.476018	0.007547602	0.007547602	4124
+149	0	1000	998.358838	-0.001641162	0.001641162	4124
+149	1	1000	1014.980680	0.014980680	0.014980680	4124
+149	2	1000	1027.812771	0.027812771	0.027812771	4124
+149	3	1000	995.807607	-0.004192393	0.004192393	4124
+149	4	1000	989.436475	-0.010563525	0.010563525	4124
+149	5	1000	1023.958921	0.023958921	0.023958921	4124
+149	6	1000	986.890795	-0.013109205	0.013109205	4124
+149	7	1000	990.709909	-0.009290091	0.009290091	4124
+149	8	1000	1026.527751	0.026527751	0.026527751	4124
+149	9	1000	1007.300678	0.007300678	0.007300678	4124
+149	10	1000	1000.911658	0.000911658	0.000911658	4124
+149	11	1000	1020.108694	0.020108694	0.020108694	4124
+149	12	1000	1007.300678	0.007300678	0.007300678	4124
+149	13	1000	1000.911658	0.000911658	0.000911658	4124
+149	14	1000	1002.188665	0.002188665	0.002188665	4124
+149	15	1000	1008.579679	0.008579679	0.008579679	4124
+149	16	1000	986.890795	-0.013109205	0.013109205	4124
+149	17	1000	1020.108694	0.020108694	0.020108694	4124
+149	18	1000	981.804175	-0.018195825	0.018195825	4124
+149	19	1000	975.454771	-0.024545229	0.024545229	4124
+149	20	5000	5004.791585	0.000958317	0.000958317	4124
+149	21	5000	4900.920170	-0.019815966	0.019815966	4124
+149	22	5000	4900.920170	-0.019815966	0.019815966	4124
+149	23	10000	10158.226307	0.015822631	0.015822631	4124
+150	0	1000	1008.579679	0.008579679	0.008579679	4124
+150	1	1000	991.983739	-0.008016261	0.008016261	4124
+150	2	1000	1006.022077	0.006022077	0.006022077	4124
+150	3	1000	990.709909	-0.009290091	0.009290091	4124
+150	4	1000	1008.579679	0.008579679	0.008579679	4124
+150	5	1000	995.807607	-0.004192393	0.004192393	4124
+150	6	1000	993.257965	-0.006742035	0.006742035	4124
+150	7	1000	1000.911658	0.000911658	0.000911658	4124
+150	8	1000	1012.419079	0.012419079	0.012419079	4124
+150	9	1000	1003.466070	0.003466070	0.003466070	4124
+150	10	1000	1030.384020	0.030384020	0.030384020	4124
+150	11	1000	994.532588	-0.005467412	0.005467412	4124
+150	12	1000	1000.911658	0.000911658	0.000911658	4124
+150	13	1000	995.807607	-0.004192393	0.004192393	4124
+150	14	1000	1009.859079	0.009859079	0.009859079	4124
+150	15	1000	993.257965	-0.006742035	0.006742035	4124
+150	16	1000	1007.300678	0.007300678	0.007300678	4124
+150	17	1000	997.083024	-0.002916976	0.002916976	4124
+150	18	1000	1008.579679	0.008579679	0.008579679	4124
+150	19	1000	986.890795	-0.013109205	0.013109205	4124
+150	20	5000	4887.707256	-0.022458549	0.022458549	4124
+150	21	5000	4881.116747	-0.023776651	0.023776651	4124
+150	22	5000	5045.717821	0.009143564	0.009143564	4124
+150	23	10000	10017.375753	0.001737575	0.001737575	4124
+151	0	1000	998.358838	-0.001641162	0.001641162	4124
+151	1	1000	995.807607	-0.004192393	0.004192393	4124
+151	2	1000	1017.543884	0.017543884	0.017543884	4124
+151	3	1000	990.709909	-0.009290091	0.009290091	4124
+151	4	1000	991.983739	-0.008016261	0.008016261	4124
+151	5	1000	985.618547	-0.014381453	0.014381453	4124
+151	6	1000	991.983739	-0.008016261	0.008016261	4124
+151	7	1000	1004.743874	0.004743874	0.004743874	4124
+151	8	1000	1000.911658	0.000911658	0.000911658	4124
+151	9	1000	1020.108694	0.020108694	0.020108694	4124
+151	10	1000	1004.743874	0.004743874	0.004743874	4124
+151	11	1000	993.257965	-0.006742035	0.006742035	4124
+151	12	1000	1006.022077	0.006022077	0.006022077	4124
+151	13	1000	1011.138879	0.011138879	0.011138879	4124
+151	14	1000	988.163437	-0.011836563	0.011836563	4124
+151	15	1000	1002.188665	0.002188665	0.002188665	4124
+151	16	1000	993.257965	-0.006742035	0.006742035	4124
+151	17	1000	999.635049	-0.000364951	0.000364951	4124
+151	18	1000	1002.188665	0.002188665	0.002188665	4124
+151	19	1000	1012.419079	0.012419079	0.012419079	4124
+151	20	5000	5032.030256	0.006406051	0.006406051	4124
+151	21	5000	4930.805994	-0.013838801	0.013838801	4124
+151	22	5000	4841.794845	-0.031641031	0.031641031	4124
+151	23	10000	9971.481716	-0.002851828	0.002851828	4124
+152	0	1000	993.257965	-0.006742035	0.006742035	4124
+152	1	1000	1007.300678	0.007300678	0.007300678	4124
+152	2	1000	981.804175	-0.018195825	0.018195825	4124
+152	3	1000	993.257965	-0.006742035	0.006742035	4124
+152	4	1000	999.635049	-0.000364951	0.000364951	4124
+152	5	1000	1017.543884	0.017543884	0.017543884	4124
+152	6	1000	1026.527751	0.026527751	0.026527751	4124
+152	7	1000	995.807607	-0.004192393	0.004192393	4124
+152	8	1000	1016.262082	0.016262082	0.016262082	4124
+152	9	1000	981.804175	-0.018195825	0.018195825	4124
+152	10	1000	997.083024	-0.002916976	0.002916976	4124
+152	11	1000	993.257965	-0.006742035	0.006742035	4124
+152	12	1000	985.618547	-0.014381453	0.014381453	4124
+152	13	1000	1012.419079	0.012419079	0.012419079	4124
+152	14	1000	1014.980680	0.014980680	0.014980680	4124
+152	15	1000	1006.022077	0.006022077	0.006022077	4124
+152	16	1000	989.436475	-0.010563525	0.010563525	4124
+152	17	1000	1014.980680	0.014980680	0.014980680	4124
+152	18	1000	997.083024	-0.002916976	0.002916976	4124
+152	19	1000	1007.300678	0.007300678	0.007300678	4124
+152	20	5000	4900.920170	-0.019815966	0.019815966	4124
+152	21	5000	5076.683109	0.015336622	0.015336622	4124
+152	22	5000	4930.805994	-0.013838801	0.013838801	4124
+152	23	10000	9847.861908	-0.015213809	0.015213809	4124
+153	0	1000	990.709909	-0.009290091	0.009290091	4124
+153	1	1000	998.358838	-0.001641162	0.001641162	4124
+153	2	1000	994.532588	-0.005467412	0.005467412	4124
+153	3	1000	998.358838	-0.001641162	0.001641162	4124
+153	4	1000	994.532588	-0.005467412	0.005467412	4124
+153	5	1000	1011.138879	0.011138879	0.011138879	4124
+153	6	1000	1000.911658	0.000911658	0.000911658	4124
+153	7	1000	1011.138879	0.011138879	0.011138879	4124
+153	8	1000	1002.188665	0.002188665	0.002188665	4124
+153	9	1000	1000.911658	0.000911658	0.000911658	4124
+153	10	1000	986.890795	-0.013109205	0.013109205	4124
+153	11	1000	990.709909	-0.009290091	0.009290091	4124
+153	12	1000	1014.980680	0.014980680	0.014980680	4124
+153	13	1000	984.346695	-0.015653305	0.015653305	4124
+153	14	1000	999.635049	-0.000364951	0.000364951	4124
+153	15	1000	1000.911658	0.000911658	0.000911658	4124
+153	16	1000	1026.527751	0.026527751	0.026527751	4124
+153	17	1000	990.709909	-0.009290091	0.009290091	4124
+153	18	1000	1003.466070	0.003466070	0.003466070	4124
+153	19	1000	998.358838	-0.001641162	0.001641162	4124
+153	20	5000	5028.615500	0.005723100	0.005723100	4124
+153	21	5000	5014.984871	0.002996974	0.002996974	4124
+153	22	5000	5042.291639	0.008458328	0.008458328	4124
+153	23	10000	10075.476018	0.007547602	0.007547602	4124
+154	0	1000	1009.859079	0.009859079	0.009859079	4124
+154	1	1000	998.358838	-0.001641162	0.001641162	4124
+154	2	1000	994.532588	-0.005467412	0.005467412	4124
+154	3	1000	983.075238	-0.016924762	0.016924762	4124
+154	4	1000	1008.579679	0.008579679	0.008579679	4124
+154	5	1000	1002.188665	0.002188665	0.002188665	4124
+154	6	1000	998.358838	-0.001641162	0.001641162	4124
+154	7	1000	998.358838	-0.001641162	0.001641162	4124
+154	8	1000	1017.543884	0.017543884	0.017543884	4124
+154	9	1000	983.075238	-0.016924762	0.016924762	4124
+154	10	1000	1011.138879	0.011138879	0.011138879	4124
+154	11	1000	1018.826088	0.018826088	0.018826088	4124
+154	12	1000	990.709909	-0.009290091	0.009290091	4124
+154	13	1000	1011.138879	0.011138879	0.011138879	4124
+154	14	1000	1012.419079	0.012419079	0.012419079	4124
+154	15	1000	984.346695	-0.015653305	0.015653305	4124
+154	16	1000	1004.743874	0.004743874	0.004743874	4124
+154	17	1000	1013.699680	0.013699680	0.013699680	4124
+154	18	1000	1009.859079	0.009859079	0.009859079	4124
+154	19	1000	1004.743874	0.004743874	0.004743874	4124
+154	20	5000	5001.399453	0.000279891	0.000279891	4124
+154	21	5000	4900.920170	-0.019815966	0.019815966	4124
+154	22	5000	5056.013595	0.011202719	0.011202719	4124
+154	23	10000	9948.726102	-0.005127390	0.005127390	4124
+155	0	1000	1003.466070	0.003466070	0.003466070	4124
+155	1	1000	1003.466070	0.003466070	0.003466070	4124
+155	2	1000	989.436475	-0.010563525	0.010563525	4124
+155	3	1000	981.804175	-0.018195825	0.018195825	4124
+155	4	1000	1004.743874	0.004743874	0.004743874	4124
+155	5	1000	1003.466070	0.003466070	0.003466070	4124
+155	6	1000	989.436475	-0.010563525	0.010563525	4124
+155	7	1000	998.358838	-0.001641162	0.001641162	4124
+155	8	1000	1011.138879	0.011138879	0.011138879	4124
+155	9	1000	998.358838	-0.001641162	0.001641162	4124
+155	10	1000	995.807607	-0.004192393	0.004192393	4124
+155	11	1000	998.358838	-0.001641162	0.001641162	4124
+155	12	1000	993.257965	-0.006742035	0.006742035	4124
+155	13	1000	1020.108694	0.020108694	0.020108694	4124
+155	14	1000	971.649847	-0.028350153	0.028350153	4124
+155	15	1000	998.358838	-0.001641162	0.001641162	4124
+155	16	1000	1000.911658	0.000911658	0.000911658	4124
+155	17	1000	1009.859079	0.009859079	0.009859079	4124
+155	18	1000	980.533506	-0.019466494	0.019466494	4124
+155	19	1000	1009.859079	0.009859079	0.009859079	4124
+155	20	5000	5069.781675	0.013956335	0.013956335	4124
+155	21	5000	5125.321509	0.025064302	0.025064302	4124
+155	22	5000	5146.344652	0.029268930	0.029268930	4124
+155	23	10000	9858.947165	-0.014105284	0.014105284	4124
+156	0	1000	1003.466070	0.003466070	0.003466070	4124
+156	1	1000	997.083024	-0.002916976	0.002916976	4124
+156	2	1000	1003.466070	0.003466070	0.003466070	4124
+156	3	1000	1011.138879	0.011138879	0.011138879	4124
+156	4	1000	1006.022077	0.006022077	0.006022077	4124
+156	5	1000	1004.743874	0.004743874	0.004743874	4124
+156	6	1000	994.532588	-0.005467412	0.005467412	4124
+156	7	1000	1009.859079	0.009859079	0.009859079	4124
+156	8	1000	1000.911658	0.000911658	0.000911658	4124
+156	9	1000	984.346695	-0.015653305	0.015653305	4124
+156	10	1000	1023.958921	0.023958921	0.023958921	4124
+156	11	1000	981.804175	-0.018195825	0.018195825	4124
+156	12	1000	981.804175	-0.018195825	0.018195825	4124
+156	13	1000	999.635049	-0.000364951	0.000364951	4124
+156	14	1000	997.083024	-0.002916976	0.002916976	4124
+156	15	1000	989.436475	-0.010563525	0.010563525	4124
+156	16	1000	1004.743874	0.004743874	0.004743874	4124
+156	17	1000	1017.543884	0.017543884	0.017543884	4124
+156	18	1000	986.890795	-0.013109205	0.013109205	4124
+156	19	1000	989.436475	-0.010563525	0.010563525	4124
+156	20	5000	4914.175845	-0.017164831	0.017164831	4124
+156	21	5000	4914.175845	-0.017164831	0.017164831	4124
+156	22	5000	4977.732858	-0.004453428	0.004453428	4124
+156	23	10000	9903.590659	-0.009640934	0.009640934	4124
+157	0	1000	990.709909	-0.009290091	0.009290091	4124
+157	1	1000	997.083024	-0.002916976	0.002916976	4124
+157	2	1000	998.358838	-0.001641162	0.001641162	4124
+157	3	1000	998.358838	-0.001641162	0.001641162	4124
+157	4	1000	1009.859079	0.009859079	0.009859079	4124
+157	5	1000	995.807607	-0.004192393	0.004192393	4124
+157	6	1000	993.257965	-0.006742035	0.006742035	4124
+157	7	1000	1002.188665	0.002188665	0.002188665	4124
+157	8	1000	993.257965	-0.006742035	0.006742035	4124
+157	9	1000	1007.300678	0.007300678	0.007300678	4124
+157	10	1000	994.532588	-0.005467412	0.005467412	4124
+157	11	1000	1011.138879	0.011138879	0.011138879	4124
+157	12	1000	986.890795	-0.013109205	0.013109205	4124
+157	13	1000	1003.466070	0.003466070	0.003466070	4124
+157	14	1000	1002.188665	0.002188665	0.002188665	4124
+157	15	1000	1023.958921	0.023958921	0.023958921	4124
+157	16	1000	976.723864	-0.023276136	0.023276136	4124
+157	17	1000	995.807607	-0.004192393	0.004192393	4124
+157	18	1000	993.257965	-0.006742035	0.006742035	4124
+157	19	1000	994.532588	-0.005467412	0.005467412	4124
+157	20	5000	4987.858944	-0.002428211	0.002428211	4124
+157	21	5000	5049.146871	0.009829374	0.009829374	4124
+157	22	5000	5035.447861	0.007089572	0.007089572	4124
+157	23	10000	10254.891561	0.025489156	0.025489156	4124
+158	0	1000	969.115193	-0.030884807	0.030884807	4124
+158	1	1000	1014.980680	0.014980680	0.014980680	4124
+158	2	1000	1011.138879	0.011138879	0.011138879	4124
+158	3	1000	1007.300678	0.007300678	0.007300678	4124
+158	4	1000	989.436475	-0.010563525	0.010563525	4124
+158	5	1000	1002.188665	0.002188665	0.002188665	4124
+158	6	1000	1014.980680	0.014980680	0.014980680	4124
+158	7	1000	980.533506	-0.019466494	0.019466494	4124
+158	8	1000	997.083024	-0.002916976	0.002916976	4124
+158	9	1000	986.890795	-0.013109205	0.013109205	4124
+158	10	1000	1014.980680	0.014980680	0.014980680	4124
+158	11	1000	1008.579679	0.008579679	0.008579679	4124
+158	12	1000	1007.300678	0.007300678	0.007300678	4124
+158	13	1000	1009.859079	0.009859079	0.009859079	4124
+158	14	1000	974.186070	-0.025813930	0.025813930	4124
+158	15	1000	1004.743874	0.004743874	0.004743874	4124
+158	16	1000	1000.911658	0.000911658	0.000911658	4124
+158	17	1000	995.807607	-0.004192393	0.004192393	4124
+158	18	1000	1004.743874	0.004743874	0.004743874	4124
+158	19	1000	1008.579679	0.008579679	0.008579679	4124
+158	20	5000	4950.851711	-0.009829658	0.009829658	4124
+158	21	5000	5028.615500	0.005723100	0.005723100	4124
+158	22	5000	5056.013595	0.011202719	0.011202719	4124
+158	23	10000	10182.179592	0.018217959	0.018217959	4124
+159	0	1000	995.807607	-0.004192393	0.004192393	4124
+159	1	1000	994.532588	-0.005467412	0.005467412	4124
+159	2	1000	1002.188665	0.002188665	0.002188665	4124
+159	3	1000	990.709909	-0.009290091	0.009290091	4124
+159	4	1000	997.083024	-0.002916976	0.002916976	4124
+159	5	1000	993.257965	-0.006742035	0.006742035	4124
+159	6	1000	986.890795	-0.013109205	0.013109205	4124
+159	7	1000	995.807607	-0.004192393	0.004192393	4124
+159	8	1000	986.890795	-0.013109205	0.013109205	4124
+159	9	1000	1021.391701	0.021391701	0.021391701	4124
+159	10	1000	1004.743874	0.004743874	0.004743874	4124
+159	11	1000	989.436475	-0.010563525	0.010563525	4124
+159	12	1000	1002.188665	0.002188665	0.002188665	4124
+159	13	1000	1006.022077	0.006022077	0.006022077	4124
+159	14	1000	997.083024	-0.002916976	0.002916976	4124
+159	15	1000	983.075238	-0.016924762	0.016924762	4124
+159	16	1000	1004.743874	0.004743874	0.004743874	4124
+159	17	1000	1000.911658	0.000911658	0.000911658	4124
+159	18	1000	1011.138879	0.011138879	0.011138879	4124
+159	19	1000	997.083024	-0.002916976	0.002916976	4124
+159	20	5000	4897.612944	-0.020477411	0.020477411	4124
+159	21	5000	4934.140142	-0.013171972	0.013171972	4124
+159	22	5000	5018.388278	0.003677656	0.003677656	4124
+159	23	10000	9982.907107	-0.001709289	0.001709289	4124
+160	0	1000	989.436475	-0.010563525	0.010563525	4124
+160	1	1000	999.635049	-0.000364951	0.000364951	4124
+160	2	1000	1011.138879	0.011138879	0.011138879	4124
+160	3	1000	989.436475	-0.010563525	0.010563525	4124
+160	4	1000	995.807607	-0.004192393	0.004192393	4124
+160	5	1000	1007.300678	0.007300678	0.007300678	4124
+160	6	1000	994.532588	-0.005467412	0.005467412	4124
+160	7	1000	991.983739	-0.008016261	0.008016261	4124
+160	8	1000	998.358838	-0.001641162	0.001641162	4124
+160	9	1000	983.075238	-0.016924762	0.016924762	4124
+160	10	1000	994.532588	-0.005467412	0.005467412	4124
+160	11	1000	1006.022077	0.006022077	0.006022077	4124
+160	12	1000	1008.579679	0.008579679	0.008579679	4124
+160	13	1000	998.358838	-0.001641162	0.001641162	4124
+160	14	1000	983.075238	-0.016924762	0.016924762	4124
+160	15	1000	1026.527751	0.026527751	0.026527751	4124
+160	16	1000	988.163437	-0.011836563	0.011836563	4124
+160	17	1000	1003.466070	0.003466070	0.003466070	4124
+160	18	1000	999.635049	-0.000364951	0.000364951	4124
+160	19	1000	981.804175	-0.018195825	0.018195825	4124
+160	20	5000	4981.105439	-0.003778912	0.003778912	4124
+160	21	5000	5011.584290	0.002316858	0.002316858	4124
+160	22	5000	5080.138191	0.016027638	0.016027638	4124
+160	23	10000	10182.179592	0.018217959	0.018217959	4124
+161	0	1000	1017.543884	0.017543884	0.017543884	4124
+161	1	1000	1003.466070	0.003466070	0.003466070	4124
+161	2	1000	991.983739	-0.008016261	0.008016261	4124
+161	3	1000	1008.579679	0.008579679	0.008579679	4124
+161	4	1000	1013.699680	0.013699680	0.013699680	4124
+161	5	1000	1007.300678	0.007300678	0.007300678	4124
+161	6	1000	1008.579679	0.008579679	0.008579679	4124
+161	7	1000	1009.859079	0.009859079	0.009859079	4124
+161	8	1000	981.804175	-0.018195825	0.018195825	4124
+161	9	1000	989.436475	-0.010563525	0.010563525	4124
+161	10	1000	999.635049	-0.000364951	0.000364951	4124
+161	11	1000	986.890795	-0.013109205	0.013109205	4124
+161	12	1000	990.709909	-0.009290091	0.009290091	4124
+161	13	1000	999.635049	-0.000364951	0.000364951	4124
+161	14	1000	1006.022077	0.006022077	0.006022077	4124
+161	15	1000	993.257965	-0.006742035	0.006742035	4124
+161	16	1000	991.983739	-0.008016261	0.008016261	4124
+161	17	1000	994.532588	-0.005467412	0.005467412	4124
+161	18	1000	998.358838	-0.001641162	0.001641162	4124
+161	19	1000	1007.300678	0.007300678	0.007300678	4124
+161	20	5000	5025.203588	0.005040718	0.005040718	4124
+161	21	5000	5114.850264	0.022970053	0.022970053	4124
+161	22	5000	5049.146871	0.009829374	0.009829374	4124
+161	23	10000	9994.364457	-0.000563554	0.000563554	4124
+162	0	1000	1016.262082	0.016262082	0.016262082	4124
+162	1	1000	988.163437	-0.011836563	0.011836563	4124
+162	2	1000	1004.743874	0.004743874	0.004743874	4124
+162	3	1000	1018.826088	0.018826088	0.018826088	4124
+162	4	1000	995.807607	-0.004192393	0.004192393	4124
+162	5	1000	1008.579679	0.008579679	0.008579679	4124
+162	6	1000	999.635049	-0.000364951	0.000364951	4124
+162	7	1000	1002.188665	0.002188665	0.002188665	4124
+162	8	1000	989.436475	-0.010563525	0.010563525	4124
+162	9	1000	997.083024	-0.002916976	0.002916976	4124
+162	10	1000	994.532588	-0.005467412	0.005467412	4124
+162	11	1000	997.083024	-0.002916976	0.002916976	4124
+162	12	1000	1020.108694	0.020108694	0.020108694	4124
+162	13	1000	999.635049	-0.000364951	0.000364951	4124
+162	14	1000	1012.419079	0.012419079	0.012419079	4124
+162	15	1000	995.807607	-0.004192393	0.004192393	4124
+162	16	1000	1007.300678	0.007300678	0.007300678	4124
+162	17	1000	1000.911658	0.000911658	0.000911658	4124
+162	18	1000	990.709909	-0.009290091	0.009290091	4124
+162	19	1000	990.709909	-0.009290091	0.009290091	4124
+162	20	5000	5045.717821	0.009143564	0.009143564	4124
+162	21	5000	4967.631743	-0.006473651	0.006473651	4124
+162	22	5000	5076.683109	0.015336622	0.015336622	4124
+162	23	10000	9914.827977	-0.008517202	0.008517202	4124
+163	0	1000	1009.859079	0.009859079	0.009859079	4124
+163	1	1000	986.890795	-0.013109205	0.013109205	4124
+163	2	1000	1009.859079	0.009859079	0.009859079	4124
+163	3	1000	993.257965	-0.006742035	0.006742035	4124
+163	4	1000	1004.743874	0.004743874	0.004743874	4124
+163	5	1000	980.533506	-0.019466494	0.019466494	4124
+163	6	1000	990.709909	-0.009290091	0.009290091	4124
+163	7	1000	974.186070	-0.025813930	0.025813930	4124
+163	8	1000	991.983739	-0.008016261	0.008016261	4124
+163	9	1000	1002.188665	0.002188665	0.002188665	4124
+163	10	1000	988.163437	-0.011836563	0.011836563	4124
+163	11	1000	1004.743874	0.004743874	0.004743874	4124
+163	12	1000	1011.138879	0.011138879	0.011138879	4124
+163	13	1000	1009.859079	0.009859079	0.009859079	4124
+163	14	1000	991.983739	-0.008016261	0.008016261	4124
+163	15	1000	1000.911658	0.000911658	0.000911658	4124
+163	16	1000	993.257965	-0.006742035	0.006742035	4124
+163	17	1000	980.533506	-0.019466494	0.019466494	4124
+163	18	1000	1007.300678	0.007300678	0.007300678	4124
+163	19	1000	997.083024	-0.002916976	0.002916976	4124
+163	20	5000	4960.911479	-0.007817704	0.007817704	4124
+163	21	5000	4930.805994	-0.013838801	0.013838801	4124
+163	22	5000	4964.270233	-0.007145953	0.007145953	4124
+163	23	10000	9926.096210	-0.007390379	0.007390379	4124
+164	0	1000	995.807607	-0.004192393	0.004192393	4124
+164	1	1000	1007.300678	0.007300678	0.007300678	4124
+164	2	1000	991.983739	-0.008016261	0.008016261	4124
+164	3	1000	1008.579679	0.008579679	0.008579679	4124
+164	4	1000	1003.466070	0.003466070	0.003466070	4124
+164	5	1000	1004.743874	0.004743874	0.004743874	4124
+164	6	1000	1016.262082	0.016262082	0.016262082	4124
+164	7	1000	1003.466070	0.003466070	0.003466070	4124
+164	8	1000	1004.743874	0.004743874	0.004743874	4124
+164	9	1000	1007.300678	0.007300678	0.007300678	4124
+164	10	1000	1004.743874	0.004743874	0.004743874	4124
+164	11	1000	986.890795	-0.013109205	0.013109205	4124
+164	12	1000	989.436475	-0.010563525	0.010563525	4124
+164	13	1000	1012.419079	0.012419079	0.012419079	4124
+164	14	1000	994.532588	-0.005467412	0.005467412	4124
+164	15	1000	1023.958921	0.023958921	0.023958921	4124
+164	16	1000	984.346695	-0.015653305	0.015653305	4124
+164	17	1000	1003.466070	0.003466070	0.003466070	4124
+164	18	1000	1004.743874	0.004743874	0.004743874	4124
+164	19	1000	990.709909	-0.009290091	0.009290091	4124
+164	20	5000	4954.202223	-0.009159555	0.009159555	4124
+164	21	5000	4934.140142	-0.013171972	0.013171972	4124
+164	22	5000	5004.791585	0.000958317	0.000958317	4124
+164	23	10000	9803.818473	-0.019618153	0.019618153	4124
+165	0	1000	981.804175	-0.018195825	0.018195825	4124
+165	1	1000	1007.300678	0.007300678	0.007300678	4124
+165	2	1000	986.890795	-0.013109205	0.013109205	4124
+165	3	1000	1007.300678	0.007300678	0.007300678	4124
+165	4	1000	1020.108694	0.020108694	0.020108694	4124
+165	5	1000	999.635049	-0.000364951	0.000364951	4124
+165	6	1000	1016.262082	0.016262082	0.016262082	4124
+165	7	1000	991.983739	-0.008016261	0.008016261	4124
+165	8	1000	1004.743874	0.004743874	0.004743874	4124
+165	9	1000	994.532588	-0.005467412	0.005467412	4124
+165	10	1000	993.257965	-0.006742035	0.006742035	4124
+165	11	1000	998.358838	-0.001641162	0.001641162	4124
+165	12	1000	985.618547	-0.014381453	0.014381453	4124
+165	13	1000	998.358838	-0.001641162	0.001641162	4124
+165	14	1000	1004.743874	0.004743874	0.004743874	4124
+165	15	1000	957.728622	-0.042271378	0.042271378	4124
+165	16	1000	989.436475	-0.010563525	0.010563525	4124
+165	17	1000	1006.022077	0.006022077	0.006022077	4124
+165	18	1000	993.257965	-0.006742035	0.006742035	4124
+165	19	1000	1013.699680	0.013699680	0.013699680	4124
+165	20	5000	4998.010127	-0.000397975	0.000397975	4124
+165	21	5000	5052.578794	0.010515759	0.010515759	4124
+165	22	5000	5042.291639	0.008458328	0.008458328	4124
+165	23	10000	9937.395527	-0.006260447	0.006260447	4124
+166	0	1000	1008.579679	0.008579679	0.008579679	4124
+166	1	1000	1002.188665	0.002188665	0.002188665	4124
+166	2	1000	1002.188665	0.002188665	0.002188665	4124
+166	3	1000	1007.300678	0.007300678	0.007300678	4124
+166	4	1000	1009.859079	0.009859079	0.009859079	4124
+166	5	1000	986.890795	-0.013109205	0.013109205	4124
+166	6	1000	1011.138879	0.011138879	0.011138879	4124
+166	7	1000	995.807607	-0.004192393	0.004192393	4124
+166	8	1000	1013.699680	0.013699680	0.013699680	4124
+166	9	1000	983.075238	-0.016924762	0.016924762	4124
+166	10	1000	1012.419079	0.012419079	0.012419079	4124
+166	11	1000	990.709909	-0.009290091	0.009290091	4124
+166	12	1000	1006.022077	0.006022077	0.006022077	4124
+166	13	1000	1007.300678	0.007300678	0.007300678	4124
+166	14	1000	993.257965	-0.006742035	0.006742035	4124
+166	15	1000	981.804175	-0.018195825	0.018195825	4124
+166	16	1000	994.532588	-0.005467412	0.005467412	4124
+166	17	1000	1004.743874	0.004743874	0.004743874	4124
+166	18	1000	1007.300678	0.007300678	0.007300678	4124
+166	19	1000	990.709909	-0.009290091	0.009290091	4124
+166	20	5000	5045.717821	0.009143564	0.009143564	4124
+166	21	5000	4960.911479	-0.007817704	0.007817704	4124
+166	22	5000	4967.631743	-0.006473651	0.006473651	4124
+166	23	10000	9858.947165	-0.014105284	0.014105284	4124
+167	0	1000	991.983739	-0.008016261	0.008016261	4124
+167	1	1000	1008.579679	0.008579679	0.008579679	4124
+167	2	1000	1003.466070	0.003466070	0.003466070	4124
+167	3	1000	994.532588	-0.005467412	0.005467412	4124
+167	4	1000	979.263232	-0.020736768	0.020736768	4124
+167	5	1000	977.993351	-0.022006649	0.022006649	4124
+167	6	1000	993.257965	-0.006742035	0.006742035	4124
+167	7	1000	990.709909	-0.009290091	0.009290091	4124
+167	8	1000	1014.980680	0.014980680	0.014980680	4124
+167	9	1000	1008.579679	0.008579679	0.008579679	4124
+167	10	1000	1023.958921	0.023958921	0.023958921	4124
+167	11	1000	997.083024	-0.002916976	0.002916976	4124
+167	12	1000	990.709909	-0.009290091	0.009290091	4124
+167	13	1000	991.983739	-0.008016261	0.008016261	4124
+167	14	1000	972.917762	-0.027082238	0.027082238	4124
+167	15	1000	990.709909	-0.009290091	0.009290091	4124
+167	16	1000	998.358838	-0.001641162	0.001641162	4124
+167	17	1000	986.890795	-0.013109205	0.013109205	4124
+167	18	1000	994.532588	-0.005467412	0.005467412	4124
+167	19	1000	1016.262082	0.016262082	0.016262082	4124
+167	20	5000	4934.140142	-0.013171972	0.013171972	4124
+167	21	5000	4947.503938	-0.010499212	0.010499212	4124
+167	22	5000	4910.857903	-0.017828419	0.017828419	4124
+167	23	10000	9771.093931	-0.022890607	0.022890607	4124
+168	0	1000	1011.138879	0.011138879	0.011138879	4124
+168	1	1000	1000.911658	0.000911658	0.000911658	4124
+168	2	1000	1000.911658	0.000911658	0.000911658	4124
+168	3	1000	994.532588	-0.005467412	0.005467412	4124
+168	4	1000	1011.138879	0.011138879	0.011138879	4124
+168	5	1000	1007.300678	0.007300678	0.007300678	4124
+168	6	1000	998.358838	-0.001641162	0.001641162	4124
+168	7	1000	1006.022077	0.006022077	0.006022077	4124
+168	8	1000	991.983739	-0.008016261	0.008016261	4124
+168	9	1000	1009.859079	0.009859079	0.009859079	4124
+168	10	1000	991.983739	-0.008016261	0.008016261	4124
+168	11	1000	980.533506	-0.019466494	0.019466494	4124
+168	12	1000	1022.675110	0.022675110	0.022675110	4124
+168	13	1000	1022.675110	0.022675110	0.022675110	4124
+168	14	1000	1011.138879	0.011138879	0.011138879	4124
+168	15	1000	1008.579679	0.008579679	0.008579679	4124
+168	16	1000	986.890795	-0.013109205	0.013109205	4124
+168	17	1000	1013.699680	0.013699680	0.013699680	4124
+168	18	1000	1007.300678	0.007300678	0.007300678	4124
+168	19	1000	990.709909	-0.009290091	0.009290091	4124
+168	20	5000	4957.555477	-0.008488905	0.008488905	4124
+168	21	5000	5100.930114	0.020186023	0.020186023	4124
+168	22	5000	4927.474558	-0.014505088	0.014505088	4124
+168	23	10000	10194.208969	0.019420897	0.019420897	4124
+169	0	1000	999.635049	-0.000364951	0.000364951	4124
+169	1	1000	988.163437	-0.011836563	0.011836563	4124
+169	2	1000	989.436475	-0.010563525	0.010563525	4124
+169	3	1000	1000.911658	0.000911658	0.000911658	4124
+169	4	1000	995.807607	-0.004192393	0.004192393	4124
+169	5	1000	999.635049	-0.000364951	0.000364951	4124
+169	6	1000	979.263232	-0.020736768	0.020736768	4124
+169	7	1000	984.346695	-0.015653305	0.015653305	4124
+169	8	1000	1002.188665	0.002188665	0.002188665	4124
+169	9	1000	998.358838	-0.001641162	0.001641162	4124
+169	10	1000	1003.466070	0.003466070	0.003466070	4124
+169	11	1000	1003.466070	0.003466070	0.003466070	4124
+169	12	1000	994.532588	-0.005467412	0.005467412	4124
+169	13	1000	999.635049	-0.000364951	0.000364951	4124
+169	14	1000	1003.466070	0.003466070	0.003466070	4124
+169	15	1000	1009.859079	0.009859079	0.009859079	4124
+169	16	1000	1009.859079	0.009859079	0.009859079	4124
+169	17	1000	975.454771	-0.024545229	0.024545229	4124
+169	18	1000	1009.859079	0.009859079	0.009859079	4124
+169	19	1000	1034.243923	0.034243923	0.034243923	4124
+169	20	5000	4981.105439	-0.003778912	0.003778912	4124
+169	21	5000	4877.825466	-0.024434907	0.024434907	4124
+169	22	5000	4947.503938	-0.010499212	0.010499212	4124
+169	23	10000	10005.853945	0.000585395	0.000585395	4124
+170	0	1000	993.257965	-0.006742035	0.006742035	4124
+170	1	1000	1004.743874	0.004743874	0.004743874	4124
+170	2	1000	1000.911658	0.000911658	0.000911658	4124
+170	3	1000	967.848454	-0.032151546	0.032151546	4124
+170	4	1000	1018.826088	0.018826088	0.018826088	4124
+170	5	1000	995.807607	-0.004192393	0.004192393	4124
+170	6	1000	991.983739	-0.008016261	0.008016261	4124
+170	7	1000	1007.300678	0.007300678	0.007300678	4124
+170	8	1000	1021.391701	0.021391701	0.021391701	4124
+170	9	1000	1000.911658	0.000911658	0.000911658	4124
+170	10	1000	1006.022077	0.006022077	0.006022077	4124
+170	11	1000	1009.859079	0.009859079	0.009859079	4124
+170	12	1000	1004.743874	0.004743874	0.004743874	4124
+170	13	1000	997.083024	-0.002916976	0.002916976	4124
+170	14	1000	981.804175	-0.018195825	0.018195825	4124
+170	15	1000	969.115193	-0.030884807	0.030884807	4124
+170	16	1000	997.083024	-0.002916976	0.002916976	4124
+170	17	1000	1012.419079	0.012419079	0.012419079	4124
+170	18	1000	998.358838	-0.001641162	0.001641162	4124
+170	19	1000	977.993351	-0.022006649	0.022006649	4124
+170	20	5000	5062.891850	0.012578370	0.012578370	4124
+170	21	5000	5121.828119	0.024365624	0.024365624	4124
+170	22	5000	5025.203588	0.005040718	0.005040718	4124
+170	23	10000	10017.375753	0.001737575	0.001737575	4124
+171	0	1000	1023.958921	0.023958921	0.023958921	4124
+171	1	1000	993.257965	-0.006742035	0.006742035	4124
+171	2	1000	999.635049	-0.000364951	0.000364951	4124
+171	3	1000	995.807607	-0.004192393	0.004192393	4124
+171	4	1000	1002.188665	0.002188665	0.002188665	4124
+171	5	1000	976.723864	-0.023276136	0.023276136	4124
+171	6	1000	1008.579679	0.008579679	0.008579679	4124
+171	7	1000	1007.300678	0.007300678	0.007300678	4124
+171	8	1000	998.358838	-0.001641162	0.001641162	4124
+171	9	1000	988.163437	-0.011836563	0.011836563	4124
+171	10	1000	1009.859079	0.009859079	0.009859079	4124
+171	11	1000	1006.022077	0.006022077	0.006022077	4124
+171	12	1000	1006.022077	0.006022077	0.006022077	4124
+171	13	1000	999.635049	-0.000364951	0.000364951	4124
+171	14	1000	998.358838	-0.001641162	0.001641162	4124
+171	15	1000	997.083024	-0.002916976	0.002916976	4124
+171	16	1000	995.807607	-0.004192393	0.004192393	4124
+171	17	1000	1002.188665	0.002188665	0.002188665	4124
+171	18	1000	1014.980680	0.014980680	0.014980680	4124
+171	19	1000	1009.859079	0.009859079	0.009859079	4124
+171	20	5000	5087.057112	0.017411422	0.017411422	4124
+171	21	5000	5021.794515	0.004358903	0.004358903	4124
+171	22	5000	5001.399453	0.000279891	0.000279891	4124
+171	23	10000	9792.881217	-0.020711878	0.020711878	4124
+172	0	1000	1004.743874	0.004743874	0.004743874	4124
+172	1	1000	995.807607	-0.004192393	0.004192393	4124
+172	2	1000	997.083024	-0.002916976	0.002916976	4124
+172	3	1000	981.804175	-0.018195825	0.018195825	4124
+172	4	1000	1014.980680	0.014980680	0.014980680	4124
+172	5	1000	995.807607	-0.004192393	0.004192393	4124
+172	6	1000	994.532588	-0.005467412	0.005467412	4124
+172	7	1000	993.257965	-0.006742035	0.006742035	4124
+172	8	1000	1002.188665	0.002188665	0.002188665	4124
+172	9	1000	1027.812771	0.027812771	0.027812771	4124
+172	10	1000	1002.188665	0.002188665	0.002188665	4124
+172	11	1000	1017.543884	0.017543884	0.017543884	4124
+172	12	1000	994.532588	-0.005467412	0.005467412	4124
+172	13	1000	997.083024	-0.002916976	0.002916976	4124
+172	14	1000	990.709909	-0.009290091	0.009290091	4124
+172	15	1000	991.983739	-0.008016261	0.008016261	4124
+172	16	1000	989.436475	-0.010563525	0.010563525	4124
+172	17	1000	1000.911658	0.000911658	0.000911658	4124
+172	18	1000	993.257965	-0.006742035	0.006742035	4124
+172	19	1000	1004.743874	0.004743874	0.004743874	4124
+172	20	5000	5032.030256	0.006406051	0.006406051	4124
+172	21	5000	5042.291639	0.008458328	0.008458328	4124
+172	22	5000	4934.140142	-0.013171972	0.013171972	4124
+172	23	10000	9590.436894	-0.040956311	0.040956311	4124
+173	0	1000	1007.300678	0.007300678	0.007300678	4124
+173	1	1000	1012.419079	0.012419079	0.012419079	4124
+173	2	1000	1000.911658	0.000911658	0.000911658	4124
+173	3	1000	981.804175	-0.018195825	0.018195825	4124
+173	4	1000	1003.466070	0.003466070	0.003466070	4124
+173	5	1000	991.983739	-0.008016261	0.008016261	4124
+173	6	1000	999.635049	-0.000364951	0.000364951	4124
+173	7	1000	976.723864	-0.023276136	0.023276136	4124
+173	8	1000	993.257965	-0.006742035	0.006742035	4124
+173	9	1000	999.635049	-0.000364951	0.000364951	4124
+173	10	1000	1007.300678	0.007300678	0.007300678	4124
+173	11	1000	986.890795	-0.013109205	0.013109205	4124
+173	12	1000	988.163437	-0.011836563	0.011836563	4124
+173	13	1000	1002.188665	0.002188665	0.002188665	4124
+173	14	1000	1004.743874	0.004743874	0.004743874	4124
+173	15	1000	1004.743874	0.004743874	0.004743874	4124
+173	16	1000	1003.466070	0.003466070	0.003466070	4124
+173	17	1000	1000.911658	0.000911658	0.000911658	4124
+173	18	1000	998.358838	-0.001641162	0.001641162	4124
+173	19	1000	974.186070	-0.025813930	0.025813930	4124
+173	20	5000	4930.805994	-0.013838801	0.013838801	4124
+173	21	5000	5025.203588	0.005040718	0.005040718	4124
+173	22	5000	4877.825466	-0.024434907	0.024434907	4124
+173	23	10000	9858.947165	-0.014105284	0.014105284	4124
+174	0	1000	977.993351	-0.022006649	0.022006649	4124
+174	1	1000	1009.859079	0.009859079	0.009859079	4124
+174	2	1000	1002.188665	0.002188665	0.002188665	4124
+174	3	1000	1007.300678	0.007300678	0.007300678	4124
+174	4	1000	999.635049	-0.000364951	0.000364951	4124
+174	5	1000	1003.466070	0.003466070	0.003466070	4124
+174	6	1000	1012.419079	0.012419079	0.012419079	4124
+174	7	1000	995.807607	-0.004192393	0.004192393	4124
+174	8	1000	1013.699680	0.013699680	0.013699680	4124
+174	9	1000	1009.859079	0.009859079	0.009859079	4124
+174	10	1000	983.075238	-0.016924762	0.016924762	4124
+174	11	1000	984.346695	-0.015653305	0.015653305	4124
+174	12	1000	991.983739	-0.008016261	0.008016261	4124
+174	13	1000	1004.743874	0.004743874	0.004743874	4124
+174	14	1000	999.635049	-0.000364951	0.000364951	4124
+174	15	1000	1004.743874	0.004743874	0.004743874	4124
+174	16	1000	1002.188665	0.002188665	0.002188665	4124
+174	17	1000	997.083024	-0.002916976	0.002916976	4124
+174	18	1000	1003.466070	0.003466070	0.003466070	4124
+174	19	1000	1002.188665	0.002188665	0.002188665	4124
+174	20	5000	4799.617839	-0.040076432	0.040076432	4124
+174	21	5000	5080.138191	0.016027638	0.016027638	4124
+174	22	5000	5032.030256	0.006406051	0.006406051	4124
+174	23	10000	10379.022272	0.037902227	0.037902227	4124
+175	0	1000	1003.466070	0.003466070	0.003466070	4124
+175	1	1000	1000.911658	0.000911658	0.000911658	4124
+175	2	1000	998.358838	-0.001641162	0.001641162	4124
+175	3	1000	986.890795	-0.013109205	0.013109205	4124
+175	4	1000	998.358838	-0.001641162	0.001641162	4124
+175	5	1000	999.635049	-0.000364951	0.000364951	4124
+175	6	1000	1002.188665	0.002188665	0.002188665	4124
+175	7	1000	986.890795	-0.013109205	0.013109205	4124
+175	8	1000	1002.188665	0.002188665	0.002188665	4124
+175	9	1000	991.983739	-0.008016261	0.008016261	4124
+175	10	1000	1020.108694	0.020108694	0.020108694	4124
+175	11	1000	1013.699680	0.013699680	0.013699680	4124
+175	12	1000	1017.543884	0.017543884	0.017543884	4124
+175	13	1000	994.532588	-0.005467412	0.005467412	4124
+175	14	1000	1004.743874	0.004743874	0.004743874	4124
+175	15	1000	986.890795	-0.013109205	0.013109205	4124
+175	16	1000	1012.419079	0.012419079	0.012419079	4124
+175	17	1000	980.533506	-0.019466494	0.019466494	4124
+175	18	1000	994.532588	-0.005467412	0.005467412	4124
+175	19	1000	989.436475	-0.010563525	0.010563525	4124
+175	20	5000	4858.133120	-0.028373376	0.028373376	4124
+175	21	5000	5097.457456	0.019491491	0.019491491	4124
+175	22	5000	4917.496478	-0.016500704	0.016500704	4124
+175	23	10000	9580.054126	-0.041994587	0.041994587	4124
+176	0	1000	1004.743874	0.004743874	0.004743874	4124
+176	1	1000	1002.188665	0.002188665	0.002188665	4124
+176	2	1000	989.436475	-0.010563525	0.010563525	4124
+176	3	1000	1000.911658	0.000911658	0.000911658	4124
+176	4	1000	1017.543884	0.017543884	0.017543884	4124
+176	5	1000	1009.859079	0.009859079	0.009859079	4124
+176	6	1000	1006.022077	0.006022077	0.006022077	4124
+176	7	1000	1000.911658	0.000911658	0.000911658	4124
+176	8	1000	1011.138879	0.011138879	0.011138879	4124
+176	9	1000	979.263232	-0.020736768	0.020736768	4124
+176	10	1000	997.083024	-0.002916976	0.002916976	4124
+176	11	1000	1007.300678	0.007300678	0.007300678	4124
+176	12	1000	1003.466070	0.003466070	0.003466070	4124
+176	13	1000	1025.243135	0.025243135	0.025243135	4124
+176	14	1000	990.709909	-0.009290091	0.009290091	4124
+176	15	1000	997.083024	-0.002916976	0.002916976	4124
+176	16	1000	1002.188665	0.002188665	0.002188665	4124
+176	17	1000	1009.859079	0.009859079	0.009859079	4124
+176	18	1000	1013.699680	0.013699680	0.013699680	4124
+176	19	1000	1014.980680	0.014980680	0.014980680	4124
+176	20	5000	5076.683109	0.015336622	0.015336622	4124
+176	21	5000	5132.317241	0.026463448	0.026463448	4124
+176	22	5000	4977.732858	-0.004453428	0.004453428	4124
+176	23	10000	10087.195626	0.008719563	0.008719563	4124
+177	0	1000	1007.300678	0.007300678	0.007300678	4124
+177	1	1000	989.436475	-0.010563525	0.010563525	4124
+177	2	1000	994.532588	-0.005467412	0.005467412	4124
+177	3	1000	1000.911658	0.000911658	0.000911658	4124
+177	4	1000	991.983739	-0.008016261	0.008016261	4124
+177	5	1000	997.083024	-0.002916976	0.002916976	4124
+177	6	1000	1016.262082	0.016262082	0.016262082	4124
+177	7	1000	1004.743874	0.004743874	0.004743874	4124
+177	8	1000	997.083024	-0.002916976	0.002916976	4124
+177	9	1000	985.618547	-0.014381453	0.014381453	4124
+177	10	1000	983.075238	-0.016924762	0.016924762	4124
+177	11	1000	998.358838	-0.001641162	0.001641162	4124
+177	12	1000	1004.743874	0.004743874	0.004743874	4124
+177	13	1000	1021.391701	0.021391701	0.021391701	4124
+177	14	1000	997.083024	-0.002916976	0.002916976	4124
+177	15	1000	1002.188665	0.002188665	0.002188665	4124
+177	16	1000	981.804175	-0.018195825	0.018195825	4124
+177	17	1000	1002.188665	0.002188665	0.002188665	4124
+177	18	1000	1014.980680	0.014980680	0.014980680	4124
+177	19	1000	1004.743874	0.004743874	0.004743874	4124
+177	20	5000	5011.584290	0.002316858	0.002316858	4124
+177	21	5000	5090.520960	0.018104192	0.018104192	4124
+177	22	5000	5100.930114	0.020186023	0.020186023	4124
+177	23	10000	10242.682908	0.024268291	0.024268291	4124
+178	0	1000	993.257965	-0.006742035	0.006742035	4124
+178	1	1000	986.890795	-0.013109205	0.013109205	4124
+178	2	1000	1007.300678	0.007300678	0.007300678	4124
+178	3	1000	1002.188665	0.002188665	0.002188665	4124
+178	4	1000	993.257965	-0.006742035	0.006742035	4124
+178	5	1000	1013.699680	0.013699680	0.013699680	4124
+178	6	1000	995.807607	-0.004192393	0.004192393	4124
+178	7	1000	1016.262082	0.016262082	0.016262082	4124
+178	8	1000	1021.391701	0.021391701	0.021391701	4124
+178	9	1000	991.983739	-0.008016261	0.008016261	4124
+178	10	1000	975.454771	-0.024545229	0.024545229	4124
+178	11	1000	984.346695	-0.015653305	0.015653305	4124
+178	12	1000	1002.188665	0.002188665	0.002188665	4124
+178	13	1000	1006.022077	0.006022077	0.006022077	4124
+178	14	1000	1004.743874	0.004743874	0.004743874	4124
+178	15	1000	994.532588	-0.005467412	0.005467412	4124
+178	16	1000	977.993351	-0.022006649	0.022006649	4124
+178	17	1000	1016.262082	0.016262082	0.016262082	4124
+178	18	1000	1012.419079	0.012419079	0.012419079	4124
+178	19	1000	1022.675110	0.022675110	0.022675110	4124
+178	20	5000	4944.158899	-0.011168220	0.011168220	4124
+178	21	5000	5153.376413	0.030675283	0.030675283	4124
+178	22	5000	5083.596191	0.016719238	0.016719238	4124
+178	23	10000	9948.726102	-0.005127390	0.005127390	4124
+179	0	1000	1000.911658	0.000911658	0.000911658	4124
+179	1	1000	1009.859079	0.009859079	0.009859079	4124
+179	2	1000	993.257965	-0.006742035	0.006742035	4124
+179	3	1000	1008.579679	0.008579679	0.008579679	4124
+179	4	1000	1002.188665	0.002188665	0.002188665	4124
+179	5	1000	983.075238	-0.016924762	0.016924762	4124
+179	6	1000	983.075238	-0.016924762	0.016924762	4124
+179	7	1000	999.635049	-0.000364951	0.000364951	4124
+179	8	1000	1007.300678	0.007300678	0.007300678	4124
+179	9	1000	1016.262082	0.016262082	0.016262082	4124
+179	10	1000	1009.859079	0.009859079	0.009859079	4124
+179	11	1000	1020.108694	0.020108694	0.020108694	4124
+179	12	1000	1017.543884	0.017543884	0.017543884	4124
+179	13	1000	980.533506	-0.019466494	0.019466494	4124
+179	14	1000	1008.579679	0.008579679	0.008579679	4124
+179	15	1000	1013.699680	0.013699680	0.013699680	4124
+179	16	1000	1007.300678	0.007300678	0.007300678	4124
+179	17	1000	1008.579679	0.008579679	0.008579679	4124
+179	18	1000	993.257965	-0.006742035	0.006742035	4124
+179	19	1000	1002.188665	0.002188665	0.002188665	4124
+179	20	5000	4994.623603	-0.001075279	0.001075279	4124
+179	21	5000	4900.920170	-0.019815966	0.019815966	4124
+179	22	5000	5032.030256	0.006406051	0.006406051	4124
+179	23	10000	9937.395527	-0.006260447	0.006260447	4124
+180	0	1000	1004.743874	0.004743874	0.004743874	4124
+180	1	1000	999.635049	-0.000364951	0.000364951	4124
+180	2	1000	988.163437	-0.011836563	0.011836563	4124
+180	3	1000	995.807607	-0.004192393	0.004192393	4124
+180	4	1000	981.804175	-0.018195825	0.018195825	4124
+180	5	1000	1004.743874	0.004743874	0.004743874	4124
+180	6	1000	989.436475	-0.010563525	0.010563525	4124
+180	7	1000	997.083024	-0.002916976	0.002916976	4124
+180	8	1000	1023.958921	0.023958921	0.023958921	4124
+180	9	1000	989.436475	-0.010563525	0.010563525	4124
+180	10	1000	995.807607	-0.004192393	0.004192393	4124
+180	11	1000	1007.300678	0.007300678	0.007300678	4124
+180	12	1000	986.890795	-0.013109205	0.013109205	4124
+180	13	1000	993.257965	-0.006742035	0.006742035	4124
+180	14	1000	1006.022077	0.006022077	0.006022077	4124
+180	15	1000	994.532588	-0.005467412	0.005467412	4124
+180	16	1000	1011.138879	0.011138879	0.011138879	4124
+180	17	1000	1008.579679	0.008579679	0.008579679	4124
+180	18	1000	1009.859079	0.009859079	0.009859079	4124
+180	19	1000	993.257965	-0.006742035	0.006742035	4124
+180	20	5000	4981.105439	-0.003778912	0.003778912	4124
+180	21	5000	5066.335314	0.013267063	0.013267063	4124
+180	22	5000	4974.363051	-0.005127390	0.005127390	4124
+180	23	10000	9870.062504	-0.012993750	0.012993750	4124
+181	0	1000	1009.859079	0.009859079	0.009859079	4124
+181	1	1000	1011.138879	0.011138879	0.011138879	4124
+181	2	1000	1003.466070	0.003466070	0.003466070	4124
+181	3	1000	1017.543884	0.017543884	0.017543884	4124
+181	4	1000	995.807607	-0.004192393	0.004192393	4124
+181	5	1000	994.532588	-0.005467412	0.005467412	4124
+181	6	1000	1006.022077	0.006022077	0.006022077	4124
+181	7	1000	995.807607	-0.004192393	0.004192393	4124
+181	8	1000	1008.579679	0.008579679	0.008579679	4124
+181	9	1000	1011.138879	0.011138879	0.011138879	4124
+181	10	1000	1012.419079	0.012419079	0.012419079	4124
+181	11	1000	1012.419079	0.012419079	0.012419079	4124
+181	12	1000	993.257965	-0.006742035	0.006742035	4124
+181	13	1000	1004.743874	0.004743874	0.004743874	4124
+181	14	1000	1003.466070	0.003466070	0.003466070	4124
+181	15	1000	1009.859079	0.009859079	0.009859079	4124
+181	16	1000	1017.543884	0.017543884	0.017543884	4124
+181	17	1000	990.709909	-0.009290091	0.009290091	4124
+181	18	1000	1004.743874	0.004743874	0.004743874	4124
+181	19	1000	1002.188665	0.002188665	0.002188665	4124
+181	20	5000	4854.860247	-0.029027951	0.029027951	4124
+181	21	5000	5059.451279	0.011890256	0.011890256	4124
+181	22	5000	5001.399453	0.000279891	0.000279891	4124
+181	23	10000	9814.785012	-0.018521499	0.018521499	4124
+182	0	1000	998.358838	-0.001641162	0.001641162	4124
+182	1	1000	1022.675110	0.022675110	0.022675110	4124
+182	2	1000	985.618547	-0.014381453	0.014381453	4124
+182	3	1000	979.263232	-0.020736768	0.020736768	4124
+182	4	1000	1007.300678	0.007300678	0.007300678	4124
+182	5	1000	999.635049	-0.000364951	0.000364951	4124
+182	6	1000	989.436475	-0.010563525	0.010563525	4124
+182	7	1000	1016.262082	0.016262082	0.016262082	4124
+182	8	1000	1002.188665	0.002188665	0.002188665	4124
+182	9	1000	997.083024	-0.002916976	0.002916976	4124
+182	10	1000	1009.859079	0.009859079	0.009859079	4124
+182	11	1000	966.582107	-0.033417893	0.033417893	4124
+182	12	1000	986.890795	-0.013109205	0.013109205	4124
+182	13	1000	1009.859079	0.009859079	0.009859079	4124
+182	14	1000	986.890795	-0.013109205	0.013109205	4124
+182	15	1000	986.890795	-0.013109205	0.013109205	4124
+182	16	1000	997.083024	-0.002916976	0.002916976	4124
+182	17	1000	1009.859079	0.009859079	0.009859079	4124
+182	18	1000	1006.022077	0.006022077	0.006022077	4124
+182	19	1000	1003.466070	0.003466070	0.003466070	4124
+182	20	5000	5093.987740	0.018797548	0.018797548	4124
+182	21	5000	5004.791585	0.000958317	0.000958317	4124
+182	22	5000	4934.140142	-0.013171972	0.013171972	4124
+182	23	10000	9892.384085	-0.010761591	0.010761591	4124
+183	0	1000	1011.138879	0.011138879	0.011138879	4124
+183	1	1000	979.263232	-0.020736768	0.020736768	4124
+183	2	1000	1006.022077	0.006022077	0.006022077	4124
+183	3	1000	998.358838	-0.001641162	0.001641162	4124
+183	4	1000	981.804175	-0.018195825	0.018195825	4124
+183	5	1000	1018.826088	0.018826088	0.018826088	4124
+183	6	1000	1012.419079	0.012419079	0.012419079	4124
+183	7	1000	994.532588	-0.005467412	0.005467412	4124
+183	8	1000	1000.911658	0.000911658	0.000911658	4124
+183	9	1000	1011.138879	0.011138879	0.011138879	4124
+183	10	1000	1017.543884	0.017543884	0.017543884	4124
+183	11	1000	985.618547	-0.014381453	0.014381453	4124
+183	12	1000	988.163437	-0.011836563	0.011836563	4124
+183	13	1000	1002.188665	0.002188665	0.002188665	4124
+183	14	1000	980.533506	-0.019466494	0.019466494	4124
+183	15	1000	1009.859079	0.009859079	0.009859079	4124
+183	16	1000	989.436475	-0.010563525	0.010563525	4124
+183	17	1000	994.532588	-0.005467412	0.005467412	4124
+183	18	1000	1002.188665	0.002188665	0.002188665	4124
+183	19	1000	1003.466070	0.003466070	0.003466070	4124
+183	20	5000	5062.891850	0.012578370	0.012578370	4124
+183	21	5000	5153.376413	0.030675283	0.030675283	4124
+183	22	5000	4917.496478	-0.016500704	0.016500704	4124
+183	23	10000	10267.136712	0.026713671	0.026713671	4124
+184	0	1000	1003.466070	0.003466070	0.003466070	4124
+184	1	1000	990.709909	-0.009290091	0.009290091	4124
+184	2	1000	998.358838	-0.001641162	0.001641162	4124
+184	3	1000	1000.911658	0.000911658	0.000911658	4124
+184	4	1000	1002.188665	0.002188665	0.002188665	4124
+184	5	1000	1023.958921	0.023958921	0.023958921	4124
+184	6	1000	1002.188665	0.002188665	0.002188665	4124
+184	7	1000	983.075238	-0.016924762	0.016924762	4124
+184	8	1000	985.618547	-0.014381453	0.014381453	4124
+184	9	1000	1013.699680	0.013699680	0.013699680	4124
+184	10	1000	1012.419079	0.012419079	0.012419079	4124
+184	11	1000	990.709909	-0.009290091	0.009290091	4124
+184	12	1000	989.436475	-0.010563525	0.010563525	4124
+184	13	1000	1007.300678	0.007300678	0.007300678	4124
+184	14	1000	994.532588	-0.005467412	0.005467412	4124
+184	15	1000	1006.022077	0.006022077	0.006022077	4124
+184	16	1000	991.983739	-0.008016261	0.008016261	4124
+184	17	1000	1000.911658	0.000911658	0.000911658	4124
+184	18	1000	990.709909	-0.009290091	0.009290091	4124
+184	19	1000	1039.396125	0.039396125	0.039396125	4124
+184	20	5000	4957.555477	-0.008488905	0.008488905	4124
+184	21	5000	5042.291639	0.008458328	0.008458328	4124
+184	22	5000	4914.175845	-0.017164831	0.017164831	4124
+184	23	10000	10063.789848	0.006378985	0.006378985	4124
+185	0	1000	1000.911658	0.000911658	0.000911658	4124
+185	1	1000	997.083024	-0.002916976	0.002916976	4124
+185	2	1000	1003.466070	0.003466070	0.003466070	4124
+185	3	1000	1017.543884	0.017543884	0.017543884	4124
+185	4	1000	1018.826088	0.018826088	0.018826088	4124
+185	5	1000	1017.543884	0.017543884	0.017543884	4124
+185	6	1000	1013.699680	0.013699680	0.013699680	4124
+185	7	1000	980.533506	-0.019466494	0.019466494	4124
+185	8	1000	997.083024	-0.002916976	0.002916976	4124
+185	9	1000	1017.543884	0.017543884	0.017543884	4124
+185	10	1000	993.257965	-0.006742035	0.006742035	4124
+185	11	1000	998.358838	-0.001641162	0.001641162	4124
+185	12	1000	989.436475	-0.010563525	0.010563525	4124
+185	13	1000	998.358838	-0.001641162	0.001641162	4124
+185	14	1000	1003.466070	0.003466070	0.003466070	4124
+185	15	1000	1021.391701	0.021391701	0.021391701	4124
+185	16	1000	1004.743874	0.004743874	0.004743874	4124
+185	17	1000	997.083024	-0.002916976	0.002916976	4124
+185	18	1000	1004.743874	0.004743874	0.004743874	4124
+185	19	1000	1014.980680	0.014980680	0.014980680	4124
+185	20	5000	4977.732858	-0.004453428	0.004453428	4124
+185	21	5000	4910.857903	-0.017828419	0.017828419	4124
+185	22	5000	5025.203588	0.005040718	0.005040718	4124
+185	23	10000	10005.853945	0.000585395	0.000585395	4124
+186	0	1000	997.083024	-0.002916976	0.002916976	4124
+186	1	1000	999.635049	-0.000364951	0.000364951	4124
+186	2	1000	1009.859079	0.009859079	0.009859079	4124
+186	3	1000	993.257965	-0.006742035	0.006742035	4124
+186	4	1000	983.075238	-0.016924762	0.016924762	4124
+186	5	1000	1004.743874	0.004743874	0.004743874	4124
+186	6	1000	1002.188665	0.002188665	0.002188665	4124
+186	7	1000	994.532588	-0.005467412	0.005467412	4124
+186	8	1000	1000.911658	0.000911658	0.000911658	4124
+186	9	1000	1017.543884	0.017543884	0.017543884	4124
+186	10	1000	1003.466070	0.003466070	0.003466070	4124
+186	11	1000	995.807607	-0.004192393	0.004192393	4124
+186	12	1000	1000.911658	0.000911658	0.000911658	4124
+186	13	1000	981.804175	-0.018195825	0.018195825	4124
+186	14	1000	998.358838	-0.001641162	0.001641162	4124
+186	15	1000	1012.419079	0.012419079	0.012419079	4124
+186	16	1000	990.709909	-0.009290091	0.009290091	4124
+186	17	1000	1004.743874	0.004743874	0.004743874	4124
+186	18	1000	1025.243135	0.025243135	0.025243135	4124
+186	19	1000	1012.419079	0.012419079	0.012419079	4124
+186	20	5000	4924.145830	-0.015170834	0.015170834	4124
+186	21	5000	4937.477005	-0.012504599	0.012504599	4124
+186	22	5000	5001.399453	0.000279891	0.000279891	4124
+186	23	10000	10098.948862	0.009894886	0.009894886	4124
+187	0	1000	995.807607	-0.004192393	0.004192393	4124
+187	1	1000	1006.022077	0.006022077	0.006022077	4124
+187	2	1000	969.115193	-0.030884807	0.030884807	4124
+187	3	1000	1000.911658	0.000911658	0.000911658	4124
+187	4	1000	1000.911658	0.000911658	0.000911658	4124
+187	5	1000	1007.300678	0.007300678	0.007300678	4124
+187	6	1000	1003.466070	0.003466070	0.003466070	4124
+187	7	1000	994.532588	-0.005467412	0.005467412	4124
+187	8	1000	988.163437	-0.011836563	0.011836563	4124
+187	9	1000	997.083024	-0.002916976	0.002916976	4124
+187	10	1000	993.257965	-0.006742035	0.006742035	4124
+187	11	1000	1006.022077	0.006022077	0.006022077	4124
+187	12	1000	988.163437	-0.011836563	0.011836563	4124
+187	13	1000	985.618547	-0.014381453	0.014381453	4124
+187	14	1000	1008.579679	0.008579679	0.008579679	4124
+187	15	1000	1007.300678	0.007300678	0.007300678	4124
+187	16	1000	983.075238	-0.016924762	0.016924762	4124
+187	17	1000	980.533506	-0.019466494	0.019466494	4124
+187	18	1000	990.709909	-0.009290091	0.009290091	4124
+187	19	1000	1016.262082	0.016262082	0.016262082	4124
+187	20	5000	5032.030256	0.006406051	0.006406051	4124
+187	21	5000	5008.186530	0.001637306	0.001637306	4124
+187	22	5000	5018.388278	0.003677656	0.003677656	4124
+187	23	10000	9781.973088	-0.021802691	0.021802691	4124
+188	0	1000	1011.138879	0.011138879	0.011138879	4124
+188	1	1000	988.163437	-0.011836563	0.011836563	4124
+188	2	1000	995.807607	-0.004192393	0.004192393	4124
+188	3	1000	1013.699680	0.013699680	0.013699680	4124
+188	4	1000	988.163437	-0.011836563	0.011836563	4124
+188	5	1000	1003.466070	0.003466070	0.003466070	4124
+188	6	1000	1007.300678	0.007300678	0.007300678	4124
+188	7	1000	997.083024	-0.002916976	0.002916976	4124
+188	8	1000	1004.743874	0.004743874	0.004743874	4124
+188	9	1000	989.436475	-0.010563525	0.010563525	4124
+188	10	1000	988.163437	-0.011836563	0.011836563	4124
+188	11	1000	998.358838	-0.001641162	0.001641162	4124
+188	12	1000	1007.300678	0.007300678	0.007300678	4124
+188	13	1000	1011.138879	0.011138879	0.011138879	4124
+188	14	1000	985.618547	-0.014381453	0.014381453	4124
+188	15	1000	1004.743874	0.004743874	0.004743874	4124
+188	16	1000	1007.300678	0.007300678	0.007300678	4124
+188	17	1000	1016.262082	0.016262082	0.016262082	4124
+188	18	1000	1006.022077	0.006022077	0.006022077	4124
+188	19	1000	1021.391701	0.021391701	0.021391701	4124
+188	20	5000	5025.203588	0.005040718	0.005040718	4124
+188	21	5000	4964.270233	-0.007145953	0.007145953	4124
+188	22	5000	5035.447861	0.007089572	0.007089572	4124
+188	23	10000	10182.179592	0.018217959	0.018217959	4124
+189	0	1000	999.635049	-0.000364951	0.000364951	4124
+189	1	1000	1000.911658	0.000911658	0.000911658	4124
+189	2	1000	1009.859079	0.009859079	0.009859079	4124
+189	3	1000	1004.743874	0.004743874	0.004743874	4124
+189	4	1000	1012.419079	0.012419079	0.012419079	4124
+189	5	1000	975.454771	-0.024545229	0.024545229	4124
+189	6	1000	1012.419079	0.012419079	0.012419079	4124
+189	7	1000	998.358838	-0.001641162	0.001641162	4124
+189	8	1000	1018.826088	0.018826088	0.018826088	4124
+189	9	1000	1007.300678	0.007300678	0.007300678	4124
+189	10	1000	998.358838	-0.001641162	0.001641162	4124
+189	11	1000	991.983739	-0.008016261	0.008016261	4124
+189	12	1000	997.083024	-0.002916976	0.002916976	4124
+189	13	1000	998.358838	-0.001641162	0.001641162	4124
+189	14	1000	1008.579679	0.008579679	0.008579679	4124
+189	15	1000	1008.579679	0.008579679	0.008579679	4124
+189	16	1000	994.532588	-0.005467412	0.005467412	4124
+189	17	1000	991.983739	-0.008016261	0.008016261	4124
+189	18	1000	997.083024	-0.002916976	0.002916976	4124
+189	19	1000	977.993351	-0.022006649	0.022006649	4124
+189	20	5000	5080.138191	0.016027638	0.016027638	4124
+189	21	5000	5001.399453	0.000279891	0.000279891	4124
+189	22	5000	4944.158899	-0.011168220	0.011168220	4124
+189	23	10000	10158.226307	0.015822631	0.015822631	4124
+190	0	1000	999.635049	-0.000364951	0.000364951	4124
+190	1	1000	988.163437	-0.011836563	0.011836563	4124
+190	2	1000	1012.419079	0.012419079	0.012419079	4124
+190	3	1000	1003.466070	0.003466070	0.003466070	4124
+190	4	1000	1007.300678	0.007300678	0.007300678	4124
+190	5	1000	1022.675110	0.022675110	0.022675110	4124
+190	6	1000	977.993351	-0.022006649	0.022006649	4124
+190	7	1000	990.709909	-0.009290091	0.009290091	4124
+190	8	1000	1004.743874	0.004743874	0.004743874	4124
+190	9	1000	1011.138879	0.011138879	0.011138879	4124
+190	10	1000	991.983739	-0.008016261	0.008016261	4124
+190	11	1000	1016.262082	0.016262082	0.016262082	4124
+190	12	1000	1011.138879	0.011138879	0.011138879	4124
+190	13	1000	1006.022077	0.006022077	0.006022077	4124
+190	14	1000	1016.262082	0.016262082	0.016262082	4124
+190	15	1000	1012.419079	0.012419079	0.012419079	4124
+190	16	1000	1014.980680	0.014980680	0.014980680	4124
+190	17	1000	1009.859079	0.009859079	0.009859079	4124
+190	18	1000	1000.911658	0.000911658	0.000911658	4124
+190	19	1000	999.635049	-0.000364951	0.000364951	4124
+190	20	5000	5018.388278	0.003677656	0.003677656	4124
+190	21	5000	5066.335314	0.013267063	0.013267063	4124
+190	22	5000	5018.388278	0.003677656	0.003677656	4124
+190	23	10000	9881.208089	-0.011879191	0.011879191	4124
+191	0	1000	998.358838	-0.001641162	0.001641162	4124
+191	1	1000	990.709909	-0.009290091	0.009290091	4124
+191	2	1000	993.257965	-0.006742035	0.006742035	4124
+191	3	1000	1013.699680	0.013699680	0.013699680	4124
+191	4	1000	991.983739	-0.008016261	0.008016261	4124
+191	5	1000	999.635049	-0.000364951	0.000364951	4124
+191	6	1000	1014.980680	0.014980680	0.014980680	4124
+191	7	1000	980.533506	-0.019466494	0.019466494	4124
+191	8	1000	998.358838	-0.001641162	0.001641162	4124
+191	9	1000	994.532588	-0.005467412	0.005467412	4124
+191	10	1000	1013.699680	0.013699680	0.013699680	4124
+191	11	1000	1007.300678	0.007300678	0.007300678	4124
+191	12	1000	999.635049	-0.000364951	0.000364951	4124
+191	13	1000	1002.188665	0.002188665	0.002188665	4124
+191	14	1000	995.807607	-0.004192393	0.004192393	4124
+191	15	1000	1002.188665	0.002188665	0.002188665	4124
+191	16	1000	1013.699680	0.013699680	0.013699680	4124
+191	17	1000	1007.300678	0.007300678	0.007300678	4124
+191	18	1000	1007.300678	0.007300678	0.007300678	4124
+191	19	1000	995.807607	-0.004192393	0.004192393	4124
+191	20	5000	4960.911479	-0.007817704	0.007817704	4124
+191	21	5000	4920.819805	-0.015836039	0.015836039	4124
+191	22	5000	5038.868321	0.007773664	0.007773664	4124
+191	23	10000	9621.744053	-0.037825595	0.037825595	4124
+192	0	1000	995.807607	-0.004192393	0.004192393	4124
+192	1	1000	989.436475	-0.010563525	0.010563525	4124
+192	2	1000	990.709909	-0.009290091	0.009290091	4124
+192	3	1000	999.635049	-0.000364951	0.000364951	4124
+192	4	1000	1004.743874	0.004743874	0.004743874	4124
+192	5	1000	1000.911658	0.000911658	0.000911658	4124
+192	6	1000	1006.022077	0.006022077	0.006022077	4124
+192	7	1000	998.358838	-0.001641162	0.001641162	4124
+192	8	1000	986.890795	-0.013109205	0.013109205	4124
+192	9	1000	1021.391701	0.021391701	0.021391701	4124
+192	10	1000	1013.699680	0.013699680	0.013699680	4124
+192	11	1000	997.083024	-0.002916976	0.002916976	4124
+192	12	1000	1004.743874	0.004743874	0.004743874	4124
+192	13	1000	1007.300678	0.007300678	0.007300678	4124
+192	14	1000	995.807607	-0.004192393	0.004192393	4124
+192	15	1000	991.983739	-0.008016261	0.008016261	4124
+192	16	1000	993.257965	-0.006742035	0.006742035	4124
+192	17	1000	1000.911658	0.000911658	0.000911658	4124
+192	18	1000	1009.859079	0.009859079	0.009859079	4124
+192	19	1000	1011.138879	0.011138879	0.011138879	4124
+192	20	5000	4987.858944	-0.002428211	0.002428211	4124
+192	21	5000	4984.480800	-0.003103840	0.003103840	4124
+192	22	5000	4950.851711	-0.009829658	0.009829658	4124
+192	23	10000	10218.374231	0.021837423	0.021837423	4124
+193	0	1000	1000.911658	0.000911658	0.000911658	4124
+193	1	1000	993.257965	-0.006742035	0.006742035	4124
+193	2	1000	991.983739	-0.008016261	0.008016261	4124
+193	3	1000	993.257965	-0.006742035	0.006742035	4124
+193	4	1000	1023.958921	0.023958921	0.023958921	4124
+193	5	1000	999.635049	-0.000364951	0.000364951	4124
+193	6	1000	1017.543884	0.017543884	0.017543884	4124
+193	7	1000	1004.743874	0.004743874	0.004743874	4124
+193	8	1000	990.709909	-0.009290091	0.009290091	4124
+193	9	1000	1017.543884	0.017543884	0.017543884	4124
+193	10	1000	1008.579679	0.008579679	0.008579679	4124
+193	11	1000	991.983739	-0.008016261	0.008016261	4124
+193	12	1000	990.709909	-0.009290091	0.009290091	4124
+193	13	1000	1016.262082	0.016262082	0.016262082	4124
+193	14	1000	983.075238	-0.016924762	0.016924762	4124
+193	15	1000	991.983739	-0.008016261	0.008016261	4124
+193	16	1000	994.532588	-0.005467412	0.005467412	4124
+193	17	1000	1014.980680	0.014980680	0.014980680	4124
+193	18	1000	1007.300678	0.007300678	0.007300678	4124
+193	19	1000	981.804175	-0.018195825	0.018195825	4124
+193	20	5000	4977.732858	-0.004453428	0.004453428	4124
+193	21	5000	4991.239877	-0.001752025	0.001752025	4124
+193	22	5000	5018.388278	0.003677656	0.003677656	4124
+193	23	10000	10052.136924	0.005213692	0.005213692	4124
+194	0	1000	983.075238	-0.016924762	0.016924762	4124
+194	1	1000	1004.743874	0.004743874	0.004743874	4124
+194	2	1000	991.983739	-0.008016261	0.008016261	4124
+194	3	1000	1002.188665	0.002188665	0.002188665	4124
+194	4	1000	1008.579679	0.008579679	0.008579679	4124
+194	5	1000	993.257965	-0.006742035	0.006742035	4124
+194	6	1000	989.436475	-0.010563525	0.010563525	4124
+194	7	1000	980.533506	-0.019466494	0.019466494	4124
+194	8	1000	997.083024	-0.002916976	0.002916976	4124
+194	9	1000	1007.300678	0.007300678	0.007300678	4124
+194	10	1000	1016.262082	0.016262082	0.016262082	4124
+194	11	1000	1011.138879	0.011138879	0.011138879	4124
+194	12	1000	986.890795	-0.013109205	0.013109205	4124
+194	13	1000	993.257965	-0.006742035	0.006742035	4124
+194	14	1000	1014.980680	0.014980680	0.014980680	4124
+194	15	1000	991.983739	-0.008016261	0.008016261	4124
+194	16	1000	1012.419079	0.012419079	0.012419079	4124
+194	17	1000	1013.699680	0.013699680	0.013699680	4124
+194	18	1000	997.083024	-0.002916976	0.002916976	4124
+194	19	1000	995.807607	-0.004192393	0.004192393	4124
+194	20	5000	4920.819805	-0.015836039	0.015836039	4124
+194	21	5000	5045.717821	0.009143564	0.009143564	4124
+194	22	5000	5073.230939	0.014646188	0.014646188	4124
+194	23	10000	9803.818473	-0.019618153	0.019618153	4124
+195	0	1000	1003.466070	0.003466070	0.003466070	4124
+195	1	1000	1027.812771	0.027812771	0.027812771	4124
+195	2	1000	1000.911658	0.000911658	0.000911658	4124
+195	3	1000	989.436475	-0.010563525	0.010563525	4124
+195	4	1000	1011.138879	0.011138879	0.011138879	4124
+195	5	1000	990.709909	-0.009290091	0.009290091	4124
+195	6	1000	999.635049	-0.000364951	0.000364951	4124
+195	7	1000	1000.911658	0.000911658	0.000911658	4124
+195	8	1000	1011.138879	0.011138879	0.011138879	4124
+195	9	1000	1013.699680	0.013699680	0.013699680	4124
+195	10	1000	1020.108694	0.020108694	0.020108694	4124
+195	11	1000	986.890795	-0.013109205	0.013109205	4124
+195	12	1000	999.635049	-0.000364951	0.000364951	4124
+195	13	1000	1014.980680	0.014980680	0.014980680	4124
+195	14	1000	1022.675110	0.022675110	0.022675110	4124
+195	15	1000	1008.579679	0.008579679	0.008579679	4124
+195	16	1000	1014.980680	0.014980680	0.014980680	4124
+195	17	1000	1016.262082	0.016262082	0.016262082	4124
+195	18	1000	1004.743874	0.004743874	0.004743874	4124
+195	19	1000	990.709909	-0.009290091	0.009290091	4124
+195	20	5000	4920.819805	-0.015836039	0.015836039	4124
+195	21	5000	4964.270233	-0.007145953	0.007145953	4124
+195	22	5000	5062.891850	0.012578370	0.012578370	4124
+195	23	10000	9971.481716	-0.002851828	0.002851828	4124
+196	0	1000	1002.188665	0.002188665	0.002188665	4124
+196	1	1000	1000.911658	0.000911658	0.000911658	4124
+196	2	1000	974.186070	-0.025813930	0.025813930	4124
+196	3	1000	991.983739	-0.008016261	0.008016261	4124
+196	4	1000	1014.980680	0.014980680	0.014980680	4124
+196	5	1000	1009.859079	0.009859079	0.009859079	4124
+196	6	1000	991.983739	-0.008016261	0.008016261	4124
+196	7	1000	985.618547	-0.014381453	0.014381453	4124
+196	8	1000	1013.699680	0.013699680	0.013699680	4124
+196	9	1000	990.709909	-0.009290091	0.009290091	4124
+196	10	1000	1008.579679	0.008579679	0.008579679	4124
+196	11	1000	986.890795	-0.013109205	0.013109205	4124
+196	12	1000	1022.675110	0.022675110	0.022675110	4124
+196	13	1000	977.993351	-0.022006649	0.022006649	4124
+196	14	1000	989.436475	-0.010563525	0.010563525	4124
+196	15	1000	988.163437	-0.011836563	0.011836563	4124
+196	16	1000	1013.699680	0.013699680	0.013699680	4124
+196	17	1000	981.804175	-0.018195825	0.018195825	4124
+196	18	1000	999.635049	-0.000364951	0.000364951	4124
+196	19	1000	1026.527751	0.026527751	0.026527751	4124
+196	20	5000	4954.202223	-0.009159555	0.009159555	4124
+196	21	5000	4910.857903	-0.017828419	0.017828419	4124
+196	22	5000	5093.987740	0.018797548	0.018797548	4124
+196	23	10000	9937.395527	-0.006260447	0.006260447	4124
+197	0	1000	1006.022077	0.006022077	0.006022077	4124
+197	1	1000	995.807607	-0.004192393	0.004192393	4124
+197	2	1000	976.723864	-0.023276136	0.023276136	4124
+197	3	1000	989.436475	-0.010563525	0.010563525	4124
+197	4	1000	1007.300678	0.007300678	0.007300678	4124
+197	5	1000	1008.579679	0.008579679	0.008579679	4124
+197	6	1000	993.257965	-0.006742035	0.006742035	4124
+197	7	1000	1004.743874	0.004743874	0.004743874	4124
+197	8	1000	1008.579679	0.008579679	0.008579679	4124
+197	9	1000	990.709909	-0.009290091	0.009290091	4124
+197	10	1000	989.436475	-0.010563525	0.010563525	4124
+197	11	1000	995.807607	-0.004192393	0.004192393	4124
+197	12	1000	1004.743874	0.004743874	0.004743874	4124
+197	13	1000	1022.675110	0.022675110	0.022675110	4124
+197	14	1000	1000.911658	0.000911658	0.000911658	4124
+197	15	1000	995.807607	-0.004192393	0.004192393	4124
+197	16	1000	990.709909	-0.009290091	0.009290091	4124
+197	17	1000	999.635049	-0.000364951	0.000364951	4124
+197	18	1000	998.358838	-0.001641162	0.001641162	4124
+197	19	1000	984.346695	-0.015653305	0.015653305	4124
+197	20	5000	5083.596191	0.016719238	0.016719238	4124
+197	21	5000	4864.686721	-0.027062656	0.027062656	4124
+197	22	5000	4957.555477	-0.008488905	0.008488905	4124
+197	23	10000	9982.907107	-0.001709289	0.001709289	4124
+198	0	1000	1002.188665	0.002188665	0.002188665	4124
+198	1	1000	1021.391701	0.021391701	0.021391701	4124
+198	2	1000	995.807607	-0.004192393	0.004192393	4124
+198	3	1000	1007.300678	0.007300678	0.007300678	4124
+198	4	1000	990.709909	-0.009290091	0.009290091	4124
+198	5	1000	999.635049	-0.000364951	0.000364951	4124
+198	6	1000	994.532588	-0.005467412	0.005467412	4124
+198	7	1000	1022.675110	0.022675110	0.022675110	4124
+198	8	1000	1017.543884	0.017543884	0.017543884	4124
+198	9	1000	995.807607	-0.004192393	0.004192393	4124
+198	10	1000	1011.138879	0.011138879	0.011138879	4124
+198	11	1000	995.807607	-0.004192393	0.004192393	4124
+198	12	1000	1000.911658	0.000911658	0.000911658	4124
+198	13	1000	995.807607	-0.004192393	0.004192393	4124
+198	14	1000	997.083024	-0.002916976	0.002916976	4124
+198	15	1000	998.358838	-0.001641162	0.001641162	4124
+198	16	1000	998.358838	-0.001641162	0.001641162	4124
+198	17	1000	1016.262082	0.016262082	0.016262082	4124
+198	18	1000	999.635049	-0.000364951	0.000364951	4124
+198	19	1000	995.807607	-0.004192393	0.004192393	4124
+198	20	5000	5001.399453	0.000279891	0.000279891	4124
+198	21	5000	4927.474558	-0.014505088	0.014505088	4124
+198	22	5000	4984.480800	-0.003103840	0.003103840	4124
+198	23	10000	9960.088106	-0.003991189	0.003991189	4124
+199	0	1000	990.709909	-0.009290091	0.009290091	4124
+199	1	1000	1012.419079	0.012419079	0.012419079	4124
+199	2	1000	1000.911658	0.000911658	0.000911658	4124
+199	3	1000	1014.980680	0.014980680	0.014980680	4124
+199	4	1000	998.358838	-0.001641162	0.001641162	4124
+199	5	1000	1021.391701	0.021391701	0.021391701	4124
+199	6	1000	990.709909	-0.009290091	0.009290091	4124
+199	7	1000	979.263232	-0.020736768	0.020736768	4124
+199	8	1000	1020.108694	0.020108694	0.020108694	4124
+199	9	1000	1006.022077	0.006022077	0.006022077	4124
+199	10	1000	1000.911658	0.000911658	0.000911658	4124
+199	11	1000	989.436475	-0.010563525	0.010563525	4124
+199	12	1000	990.709909	-0.009290091	0.009290091	4124
+199	13	1000	993.257965	-0.006742035	0.006742035	4124
+199	14	1000	991.983739	-0.008016261	0.008016261	4124
+199	15	1000	1008.579679	0.008579679	0.008579679	4124
+199	16	1000	1011.138879	0.011138879	0.011138879	4124
+199	17	1000	1003.466070	0.003466070	0.003466070	4124
+199	18	1000	986.890795	-0.013109205	0.013109205	4124
+199	19	1000	1004.743874	0.004743874	0.004743874	4124
+199	20	5000	5014.984871	0.002996974	0.002996974	4124
+199	21	5000	5018.388278	0.003677656	0.003677656	4124
+199	22	5000	4930.805994	-0.013838801	0.013838801	4124
+199	23	10000	10146.301990	0.014630199	0.014630199	4124
+200	0	1000	994.532588	-0.005467412	0.005467412	4124
+200	1	1000	993.257965	-0.006742035	0.006742035	4124
+200	2	1000	1011.138879	0.011138879	0.011138879	4124
+200	3	1000	1008.579679	0.008579679	0.008579679	4124
+200	4	1000	1011.138879	0.011138879	0.011138879	4124
+200	5	1000	1020.108694	0.020108694	0.020108694	4124
+200	6	1000	1009.859079	0.009859079	0.009859079	4124
+200	7	1000	986.890795	-0.013109205	0.013109205	4124
+200	8	1000	983.075238	-0.016924762	0.016924762	4124
+200	9	1000	997.083024	-0.002916976	0.002916976	4124
+200	10	1000	994.532588	-0.005467412	0.005467412	4124
+200	11	1000	997.083024	-0.002916976	0.002916976	4124
+200	12	1000	988.163437	-0.011836563	0.011836563	4124
+200	13	1000	993.257965	-0.006742035	0.006742035	4124
+200	14	1000	1012.419079	0.012419079	0.012419079	4124
+200	15	1000	984.346695	-0.015653305	0.015653305	4124
+200	16	1000	1022.675110	0.022675110	0.022675110	4124
+200	17	1000	991.983739	-0.008016261	0.008016261	4124
+200	18	1000	1018.826088	0.018826088	0.018826088	4124
+200	19	1000	1000.911658	0.000911658	0.000911658	4124
+200	20	5000	5001.399453	0.000279891	0.000279891	4124
+200	21	5000	4914.175845	-0.017164831	0.017164831	4124
+200	22	5000	4917.496478	-0.016500704	0.016500704	4124
+200	23	10000	10304.093353	0.030409335	0.030409335	4124
+201	0	1000	989.436475	-0.010563525	0.010563525	4124
+201	1	1000	993.257965	-0.006742035	0.006742035	4124
+201	2	1000	1013.699680	0.013699680	0.013699680	4124
+201	3	1000	1009.859079	0.009859079	0.009859079	4124
+201	4	1000	1007.300678	0.007300678	0.007300678	4124
+201	5	1000	1011.138879	0.011138879	0.011138879	4124
+201	6	1000	994.532588	-0.005467412	0.005467412	4124
+201	7	1000	991.983739	-0.008016261	0.008016261	4124
+201	8	1000	989.436475	-0.010563525	0.010563525	4124
+201	9	1000	1013.699680	0.013699680	0.013699680	4124
+201	10	1000	995.807607	-0.004192393	0.004192393	4124
+201	11	1000	1006.022077	0.006022077	0.006022077	4124
+201	12	1000	994.532588	-0.005467412	0.005467412	4124
+201	13	1000	1003.466070	0.003466070	0.003466070	4124
+201	14	1000	1025.243135	0.025243135	0.025243135	4124
+201	15	1000	995.807607	-0.004192393	0.004192393	4124
+201	16	1000	993.257965	-0.006742035	0.006742035	4124
+201	17	1000	1006.022077	0.006022077	0.006022077	4124
+201	18	1000	1008.579679	0.008579679	0.008579679	4124
+201	19	1000	998.358838	-0.001641162	0.001641162	4124
+201	20	5000	5066.335314	0.013267063	0.013267063	4124
+201	21	5000	4910.857903	-0.017828419	0.017828419	4124
+201	22	5000	5014.984871	0.002996974	0.002996974	4124
+201	23	10000	9695.738323	-0.030426168	0.030426168	4124
+202	0	1000	993.257965	-0.006742035	0.006742035	4124
+202	1	1000	995.807607	-0.004192393	0.004192393	4124
+202	2	1000	981.804175	-0.018195825	0.018195825	4124
+202	3	1000	998.358838	-0.001641162	0.001641162	4124
+202	4	1000	995.807607	-0.004192393	0.004192393	4124
+202	5	1000	997.083024	-0.002916976	0.002916976	4124
+202	6	1000	997.083024	-0.002916976	0.002916976	4124
+202	7	1000	1014.980680	0.014980680	0.014980680	4124
+202	8	1000	1000.911658	0.000911658	0.000911658	4124
+202	9	1000	993.257965	-0.006742035	0.006742035	4124
+202	10	1000	1013.699680	0.013699680	0.013699680	4124
+202	11	1000	990.709909	-0.009290091	0.009290091	4124
+202	12	1000	998.358838	-0.001641162	0.001641162	4124
+202	13	1000	990.709909	-0.009290091	0.009290091	4124
+202	14	1000	1018.826088	0.018826088	0.018826088	4124
+202	15	1000	1000.911658	0.000911658	0.000911658	4124
+202	16	1000	998.358838	-0.001641162	0.001641162	4124
+202	17	1000	1020.108694	0.020108694	0.020108694	4124
+202	18	1000	981.804175	-0.018195825	0.018195825	4124
+202	19	1000	999.635049	-0.000364951	0.000364951	4124
+202	20	5000	5021.794515	0.004358903	0.004358903	4124
+202	21	5000	4934.140142	-0.013171972	0.013171972	4124
+202	22	5000	5014.984871	0.002996974	0.002996974	4124
+202	23	10000	9781.973088	-0.021802691	0.021802691	4124
+203	0	1000	1020.108694	0.020108694	0.020108694	4124
+203	1	1000	1008.579679	0.008579679	0.008579679	4124
+203	2	1000	1008.579679	0.008579679	0.008579679	4124
+203	3	1000	988.163437	-0.011836563	0.011836563	4124
+203	4	1000	1003.466070	0.003466070	0.003466070	4124
+203	5	1000	1014.980680	0.014980680	0.014980680	4124
+203	6	1000	983.075238	-0.016924762	0.016924762	4124
+203	7	1000	1002.188665	0.002188665	0.002188665	4124
+203	8	1000	1012.419079	0.012419079	0.012419079	4124
+203	9	1000	989.436475	-0.010563525	0.010563525	4124
+203	10	1000	986.890795	-0.013109205	0.013109205	4124
+203	11	1000	1006.022077	0.006022077	0.006022077	4124
+203	12	1000	989.436475	-0.010563525	0.010563525	4124
+203	13	1000	989.436475	-0.010563525	0.010563525	4124
+203	14	1000	1000.911658	0.000911658	0.000911658	4124
+203	15	1000	1004.743874	0.004743874	0.004743874	4124
+203	16	1000	989.436475	-0.010563525	0.010563525	4124
+203	17	1000	1000.911658	0.000911658	0.000911658	4124
+203	18	1000	997.083024	-0.002916976	0.002916976	4124
+203	19	1000	1000.911658	0.000911658	0.000911658	4124
+203	20	5000	5056.013595	0.011202719	0.011202719	4124
+203	21	5000	5004.791585	0.000958317	0.000958317	4124
+203	22	5000	4950.851711	-0.009829658	0.009829658	4124
+203	23	10000	10134.412287	0.013441229	0.013441229	4124
+204	0	1000	981.804175	-0.018195825	0.018195825	4124
+204	1	1000	1022.675110	0.022675110	0.022675110	4124
+204	2	1000	1002.188665	0.002188665	0.002188665	4124
+204	3	1000	995.807607	-0.004192393	0.004192393	4124
+204	4	1000	997.083024	-0.002916976	0.002916976	4124
+204	5	1000	989.436475	-0.010563525	0.010563525	4124
+204	6	1000	995.807607	-0.004192393	0.004192393	4124
+204	7	1000	993.257965	-0.006742035	0.006742035	4124
+204	8	1000	998.358838	-0.001641162	0.001641162	4124
+204	9	1000	1002.188665	0.002188665	0.002188665	4124
+204	10	1000	995.807607	-0.004192393	0.004192393	4124
+204	11	1000	1004.743874	0.004743874	0.004743874	4124
+204	12	1000	993.257965	-0.006742035	0.006742035	4124
+204	13	1000	981.804175	-0.018195825	0.018195825	4124
+204	14	1000	1023.958921	0.023958921	0.023958921	4124
+204	15	1000	993.257965	-0.006742035	0.006742035	4124
+204	16	1000	979.263232	-0.020736768	0.020736768	4124
+204	17	1000	1006.022077	0.006022077	0.006022077	4124
+204	18	1000	997.083024	-0.002916976	0.002916976	4124
+204	19	1000	995.807607	-0.004192393	0.004192393	4124
+204	20	5000	5073.230939	0.014646188	0.014646188	4124
+204	21	5000	4981.105439	-0.003778912	0.003778912	4124
+204	22	5000	4930.805994	-0.013838801	0.013838801	4124
+204	23	10000	9870.062504	-0.012993750	0.012993750	4124
+205	0	1000	1003.466070	0.003466070	0.003466070	4124
+205	1	1000	1003.466070	0.003466070	0.003466070	4124
+205	2	1000	1002.188665	0.002188665	0.002188665	4124
+205	3	1000	993.257965	-0.006742035	0.006742035	4124
+205	4	1000	1008.579679	0.008579679	0.008579679	4124
+205	5	1000	1009.859079	0.009859079	0.009859079	4124
+205	6	1000	983.075238	-0.016924762	0.016924762	4124
+205	7	1000	980.533506	-0.019466494	0.019466494	4124
+205	8	1000	1003.466070	0.003466070	0.003466070	4124
+205	9	1000	1034.243923	0.034243923	0.034243923	4124
+205	10	1000	1012.419079	0.012419079	0.012419079	4124
+205	11	1000	1009.859079	0.009859079	0.009859079	4124
+205	12	1000	1008.579679	0.008579679	0.008579679	4124
+205	13	1000	1004.743874	0.004743874	0.004743874	4124
+205	14	1000	1006.022077	0.006022077	0.006022077	4124
+205	15	1000	1006.022077	0.006022077	0.006022077	4124
+205	16	1000	993.257965	-0.006742035	0.006742035	4124
+205	17	1000	1012.419079	0.012419079	0.012419079	4124
+205	18	1000	983.075238	-0.016924762	0.016924762	4124
+205	19	1000	1006.022077	0.006022077	0.006022077	4124
+205	20	5000	5083.596191	0.016719238	0.016719238	4124
+205	21	5000	4954.202223	-0.009159555	0.009159555	4124
+205	22	5000	5021.794515	0.004358903	0.004358903	4124
+205	23	10000	9982.907107	-0.001709289	0.001709289	4124
+206	0	1000	988.163437	-0.011836563	0.011836563	4124
+206	1	1000	1008.579679	0.008579679	0.008579679	4124
+206	2	1000	993.257965	-0.006742035	0.006742035	4124
+206	3	1000	1002.188665	0.002188665	0.002188665	4124
+206	4	1000	985.618547	-0.014381453	0.014381453	4124
+206	5	1000	990.709909	-0.009290091	0.009290091	4124
+206	6	1000	1002.188665	0.002188665	0.002188665	4124
+206	7	1000	995.807607	-0.004192393	0.004192393	4124
+206	8	1000	997.083024	-0.002916976	0.002916976	4124
+206	9	1000	1000.911658	0.000911658	0.000911658	4124
+206	10	1000	995.807607	-0.004192393	0.004192393	4124
+206	11	1000	999.635049	-0.000364951	0.000364951	4124
+206	12	1000	993.257965	-0.006742035	0.006742035	4124
+206	13	1000	1025.243135	0.025243135	0.025243135	4124
+206	14	1000	1003.466070	0.003466070	0.003466070	4124
+206	15	1000	993.257965	-0.006742035	0.006742035	4124
+206	16	1000	988.163437	-0.011836563	0.011836563	4124
+206	17	1000	993.257965	-0.006742035	0.006742035	4124
+206	18	1000	990.709909	-0.009290091	0.009290091	4124
+206	19	1000	1008.579679	0.008579679	0.008579679	4124
+206	20	5000	4947.503938	-0.010499212	0.010499212	4124
+206	21	5000	4920.819805	-0.015836039	0.015836039	4124
+206	22	5000	5056.013595	0.011202719	0.011202719	4124
+206	23	10000	9367.883393	-0.063211661	0.063211661	4124
+207	0	1000	1002.188665	0.002188665	0.002188665	4124
+207	1	1000	1013.699680	0.013699680	0.013699680	4124
+207	2	1000	1006.022077	0.006022077	0.006022077	4124
+207	3	1000	1008.579679	0.008579679	0.008579679	4124
+207	4	1000	977.993351	-0.022006649	0.022006649	4124
+207	5	1000	1008.579679	0.008579679	0.008579679	4124
+207	6	1000	1004.743874	0.004743874	0.004743874	4124
+207	7	1000	1003.466070	0.003466070	0.003466070	4124
+207	8	1000	1003.466070	0.003466070	0.003466070	4124
+207	9	1000	990.709909	-0.009290091	0.009290091	4124
+207	10	1000	1022.675110	0.022675110	0.022675110	4124
+207	11	1000	993.257965	-0.006742035	0.006742035	4124
+207	12	1000	999.635049	-0.000364951	0.000364951	4124
+207	13	1000	994.532588	-0.005467412	0.005467412	4124
+207	14	1000	990.709909	-0.009290091	0.009290091	4124
+207	15	1000	993.257965	-0.006742035	0.006742035	4124
+207	16	1000	1003.466070	0.003466070	0.003466070	4124
+207	17	1000	997.083024	-0.002916976	0.002916976	4124
+207	18	1000	976.723864	-0.023276136	0.023276136	4124
+207	19	1000	1007.300678	0.007300678	0.007300678	4124
+207	20	5000	5114.850264	0.022970053	0.022970053	4124
+207	21	5000	4998.010127	-0.000397975	0.000397975	4124
+207	22	5000	4947.503938	-0.010499212	0.010499212	4124
+207	23	10000	9926.096210	-0.007390379	0.007390379	4124
+208	0	1000	1003.466070	0.003466070	0.003466070	4124
+208	1	1000	1007.300678	0.007300678	0.007300678	4124
+208	2	1000	986.890795	-0.013109205	0.013109205	4124
+208	3	1000	997.083024	-0.002916976	0.002916976	4124
+208	4	1000	993.257965	-0.006742035	0.006742035	4124
+208	5	1000	989.436475	-0.010563525	0.010563525	4124
+208	6	1000	984.346695	-0.015653305	0.015653305	4124
+208	7	1000	1014.980680	0.014980680	0.014980680	4124
+208	8	1000	999.635049	-0.000364951	0.000364951	4124
+208	9	1000	990.709909	-0.009290091	0.009290091	4124
+208	10	1000	977.993351	-0.022006649	0.022006649	4124
+208	11	1000	1008.579679	0.008579679	0.008579679	4124
+208	12	1000	1008.579679	0.008579679	0.008579679	4124
+208	13	1000	1000.911658	0.000911658	0.000911658	4124
+208	14	1000	1009.859079	0.009859079	0.009859079	4124
+208	15	1000	1000.911658	0.000911658	0.000911658	4124
+208	16	1000	1006.022077	0.006022077	0.006022077	4124
+208	17	1000	976.723864	-0.023276136	0.023276136	4124
+208	18	1000	998.358838	-0.001641162	0.001641162	4124
+208	19	1000	1006.022077	0.006022077	0.006022077	4124
+208	20	5000	4897.612944	-0.020477411	0.020477411	4124
+208	21	5000	4897.612944	-0.020477411	0.020477411	4124
+208	22	5000	5021.794515	0.004358903	0.004358903	4124
+208	23	10000	10158.226307	0.015822631	0.015822631	4124
+209	0	1000	983.075238	-0.016924762	0.016924762	4124
+209	1	1000	1003.466070	0.003466070	0.003466070	4124
+209	2	1000	985.618547	-0.014381453	0.014381453	4124
+209	3	1000	1000.911658	0.000911658	0.000911658	4124
+209	4	1000	1002.188665	0.002188665	0.002188665	4124
+209	5	1000	997.083024	-0.002916976	0.002916976	4124
+209	6	1000	1030.384020	0.030384020	0.030384020	4124
+209	7	1000	988.163437	-0.011836563	0.011836563	4124
+209	8	1000	998.358838	-0.001641162	0.001641162	4124
+209	9	1000	991.983739	-0.008016261	0.008016261	4124
+209	10	1000	989.436475	-0.010563525	0.010563525	4124
+209	11	1000	1008.579679	0.008579679	0.008579679	4124
+209	12	1000	984.346695	-0.015653305	0.015653305	4124
+209	13	1000	1007.300678	0.007300678	0.007300678	4124
+209	14	1000	1011.138879	0.011138879	0.011138879	4124
+209	15	1000	994.532588	-0.005467412	0.005467412	4124
+209	16	1000	1007.300678	0.007300678	0.007300678	4124
+209	17	1000	981.804175	-0.018195825	0.018195825	4124
+209	18	1000	993.257965	-0.006742035	0.006742035	4124
+209	19	1000	1029.098194	0.029098194	0.029098194	4124
+209	20	5000	4981.105439	-0.003778912	0.003778912	4124
+209	21	5000	5004.791585	0.000958317	0.000958317	4124
+209	22	5000	4940.816590	-0.011836682	0.011836682	4124
+209	23	10000	10028.930063	0.002893006	0.002893006	4124
+210	0	1000	989.436475	-0.010563525	0.010563525	4124
+210	1	1000	989.436475	-0.010563525	0.010563525	4124
+210	2	1000	997.083024	-0.002916976	0.002916976	4124
+210	3	1000	994.532588	-0.005467412	0.005467412	4124
+210	4	1000	976.723864	-0.023276136	0.023276136	4124
+210	5	1000	989.436475	-0.010563525	0.010563525	4124
+210	6	1000	1014.980680	0.014980680	0.014980680	4124
+210	7	1000	986.890795	-0.013109205	0.013109205	4124
+210	8	1000	1012.419079	0.012419079	0.012419079	4124
+210	9	1000	1018.826088	0.018826088	0.018826088	4124
+210	10	1000	1002.188665	0.002188665	0.002188665	4124
+210	11	1000	989.436475	-0.010563525	0.010563525	4124
+210	12	1000	990.709909	-0.009290091	0.009290091	4124
+210	13	1000	1008.579679	0.008579679	0.008579679	4124
+210	14	1000	1000.911658	0.000911658	0.000911658	4124
+210	15	1000	1016.262082	0.016262082	0.016262082	4124
+210	16	1000	1011.138879	0.011138879	0.011138879	4124
+210	17	1000	1006.022077	0.006022077	0.006022077	4124
+210	18	1000	980.533506	-0.019466494	0.019466494	4124
+210	19	1000	1003.466070	0.003466070	0.003466070	4124
+210	20	5000	4977.732858	-0.004453428	0.004453428	4124
+210	21	5000	5049.146871	0.009829374	0.009829374	4124
+210	22	5000	4977.732858	-0.004453428	0.004453428	4124
+210	23	10000	10098.948862	0.009894886	0.009894886	4124
+211	0	1000	994.532588	-0.005467412	0.005467412	4124
+211	1	1000	1006.022077	0.006022077	0.006022077	4124
+211	2	1000	1003.466070	0.003466070	0.003466070	4124
+211	3	1000	1007.300678	0.007300678	0.007300678	4124
+211	4	1000	998.358838	-0.001641162	0.001641162	4124
+211	5	1000	995.807607	-0.004192393	0.004192393	4124
+211	6	1000	986.890795	-0.013109205	0.013109205	4124
+211	7	1000	1002.188665	0.002188665	0.002188665	4124
+211	8	1000	993.257965	-0.006742035	0.006742035	4124
+211	9	1000	975.454771	-0.024545229	0.024545229	4124
+211	10	1000	983.075238	-0.016924762	0.016924762	4124
+211	11	1000	1004.743874	0.004743874	0.004743874	4124
+211	12	1000	1006.022077	0.006022077	0.006022077	4124
+211	13	1000	1006.022077	0.006022077	0.006022077	4124
+211	14	1000	1006.022077	0.006022077	0.006022077	4124
+211	15	1000	1016.262082	0.016262082	0.016262082	4124
+211	16	1000	1009.859079	0.009859079	0.009859079	4124
+211	17	1000	1006.022077	0.006022077	0.006022077	4124
+211	18	1000	1011.138879	0.011138879	0.011138879	4124
+211	19	1000	995.807607	-0.004192393	0.004192393	4124
+211	20	5000	5125.321509	0.025064302	0.025064302	4124
+211	21	5000	5028.615500	0.005723100	0.005723100	4124
+211	22	5000	4967.631743	-0.006473651	0.006473651	4124
+211	23	10000	10254.891561	0.025489156	0.025489156	4124
+212	0	1000	1006.022077	0.006022077	0.006022077	4124
+212	1	1000	1013.699680	0.013699680	0.013699680	4124
+212	2	1000	1016.262082	0.016262082	0.016262082	4124
+212	3	1000	1000.911658	0.000911658	0.000911658	4124
+212	4	1000	983.075238	-0.016924762	0.016924762	4124
+212	5	1000	1006.022077	0.006022077	0.006022077	4124
+212	6	1000	990.709909	-0.009290091	0.009290091	4124
+212	7	1000	990.709909	-0.009290091	0.009290091	4124
+212	8	1000	1017.543884	0.017543884	0.017543884	4124
+212	9	1000	1006.022077	0.006022077	0.006022077	4124
+212	10	1000	990.709909	-0.009290091	0.009290091	4124
+212	11	1000	976.723864	-0.023276136	0.023276136	4124
+212	12	1000	1026.527751	0.026527751	0.026527751	4124
+212	13	1000	1012.419079	0.012419079	0.012419079	4124
+212	14	1000	1011.138879	0.011138879	0.011138879	4124
+212	15	1000	1013.699680	0.013699680	0.013699680	4124
+212	16	1000	1011.138879	0.011138879	0.011138879	4124
+212	17	1000	1012.419079	0.012419079	0.012419079	4124
+212	18	1000	991.983739	-0.008016261	0.008016261	4124
+212	19	1000	1009.859079	0.009859079	0.009859079	4124
+212	20	5000	5011.584290	0.002316858	0.002316858	4124
+212	21	5000	5001.399453	0.000279891	0.000279891	4124
+212	22	5000	5100.930114	0.020186023	0.020186023	4124
+212	23	10000	10075.476018	0.007547602	0.007547602	4124
+213	0	1000	995.807607	-0.004192393	0.004192393	4124
+213	1	1000	1008.579679	0.008579679	0.008579679	4124
+213	2	1000	998.358838	-0.001641162	0.001641162	4124
+213	3	1000	1002.188665	0.002188665	0.002188665	4124
+213	4	1000	977.993351	-0.022006649	0.022006649	4124
+213	5	1000	1017.543884	0.017543884	0.017543884	4124
+213	6	1000	993.257965	-0.006742035	0.006742035	4124
+213	7	1000	981.804175	-0.018195825	0.018195825	4124
+213	8	1000	999.635049	-0.000364951	0.000364951	4124
+213	9	1000	1004.743874	0.004743874	0.004743874	4124
+213	10	1000	999.635049	-0.000364951	0.000364951	4124
+213	11	1000	997.083024	-0.002916976	0.002916976	4124
+213	12	1000	1009.859079	0.009859079	0.009859079	4124
+213	13	1000	994.532588	-0.005467412	0.005467412	4124
+213	14	1000	1003.466070	0.003466070	0.003466070	4124
+213	15	1000	1002.188665	0.002188665	0.002188665	4124
+213	16	1000	998.358838	-0.001641162	0.001641162	4124
+213	17	1000	985.618547	-0.014381453	0.014381453	4124
+213	18	1000	995.807607	-0.004192393	0.004192393	4124
+213	19	1000	1009.859079	0.009859079	0.009859079	4124
+213	20	5000	5028.615500	0.005723100	0.005723100	4124
+213	21	5000	5090.520960	0.018104192	0.018104192	4124
+213	22	5000	4947.503938	-0.010499212	0.010499212	4124
+213	23	10000	9914.827977	-0.008517202	0.008517202	4124
+214	0	1000	1007.300678	0.007300678	0.007300678	4124
+214	1	1000	994.532588	-0.005467412	0.005467412	4124
+214	2	1000	981.804175	-0.018195825	0.018195825	4124
+214	3	1000	997.083024	-0.002916976	0.002916976	4124
+214	4	1000	998.358838	-0.001641162	0.001641162	4124
+214	5	1000	999.635049	-0.000364951	0.000364951	4124
+214	6	1000	986.890795	-0.013109205	0.013109205	4124
+214	7	1000	998.358838	-0.001641162	0.001641162	4124
+214	8	1000	1007.300678	0.007300678	0.007300678	4124
+214	9	1000	995.807607	-0.004192393	0.004192393	4124
+214	10	1000	1007.300678	0.007300678	0.007300678	4124
+214	11	1000	1008.579679	0.008579679	0.008579679	4124
+214	12	1000	998.358838	-0.001641162	0.001641162	4124
+214	13	1000	994.532588	-0.005467412	0.005467412	4124
+214	14	1000	1008.579679	0.008579679	0.008579679	4124
+214	15	1000	975.454771	-0.024545229	0.024545229	4124
+214	16	1000	980.533506	-0.019466494	0.019466494	4124
+214	17	1000	991.983739	-0.008016261	0.008016261	4124
+214	18	1000	1002.188665	0.002188665	0.002188665	4124
+214	19	1000	1021.391701	0.021391701	0.021391701	4124
+214	20	5000	4944.158899	-0.011168220	0.011168220	4124
+214	21	5000	5001.399453	0.000279891	0.000279891	4124
+214	22	5000	5025.203588	0.005040718	0.005040718	4124
+214	23	10000	10052.136924	0.005213692	0.005213692	4124
+215	0	1000	980.533506	-0.019466494	0.019466494	4124
+215	1	1000	1009.859079	0.009859079	0.009859079	4124
+215	2	1000	1002.188665	0.002188665	0.002188665	4124
+215	3	1000	1016.262082	0.016262082	0.016262082	4124
+215	4	1000	1000.911658	0.000911658	0.000911658	4124
+215	5	1000	1018.826088	0.018826088	0.018826088	4124
+215	6	1000	1000.911658	0.000911658	0.000911658	4124
+215	7	1000	981.804175	-0.018195825	0.018195825	4124
+215	8	1000	995.807607	-0.004192393	0.004192393	4124
+215	9	1000	1002.188665	0.002188665	0.002188665	4124
+215	10	1000	1000.911658	0.000911658	0.000911658	4124
+215	11	1000	1000.911658	0.000911658	0.000911658	4124
+215	12	1000	994.532588	-0.005467412	0.005467412	4124
+215	13	1000	1000.911658	0.000911658	0.000911658	4124
+215	14	1000	997.083024	-0.002916976	0.002916976	4124
+215	15	1000	1009.859079	0.009859079	0.009859079	4124
+215	16	1000	1004.743874	0.004743874	0.004743874	4124
+215	17	1000	1013.699680	0.013699680	0.013699680	4124
+215	18	1000	1014.980680	0.014980680	0.014980680	4124
+215	19	1000	1002.188665	0.002188665	0.002188665	4124
+215	20	5000	5021.794515	0.004358903	0.004358903	4124
+215	21	5000	5100.930114	0.020186023	0.020186023	4124
+215	22	5000	4937.477005	-0.012504599	0.012504599	4124
+215	23	10000	10087.195626	0.008719563	0.008719563	4124
+216	0	1000	989.436475	-0.010563525	0.010563525	4124
+216	1	1000	1013.699680	0.013699680	0.013699680	4124
+216	2	1000	997.083024	-0.002916976	0.002916976	4124
+216	3	1000	1013.699680	0.013699680	0.013699680	4124
+216	4	1000	993.257965	-0.006742035	0.006742035	4124
+216	5	1000	1016.262082	0.016262082	0.016262082	4124
+216	6	1000	983.075238	-0.016924762	0.016924762	4124
+216	7	1000	1029.098194	0.029098194	0.029098194	4124
+216	8	1000	995.807607	-0.004192393	0.004192393	4124
+216	9	1000	1007.300678	0.007300678	0.007300678	4124
+216	10	1000	1006.022077	0.006022077	0.006022077	4124
+216	11	1000	990.709909	-0.009290091	0.009290091	4124
+216	12	1000	993.257965	-0.006742035	0.006742035	4124
+216	13	1000	1004.743874	0.004743874	0.004743874	4124
+216	14	1000	993.257965	-0.006742035	0.006742035	4124
+216	15	1000	998.358838	-0.001641162	0.001641162	4124
+216	16	1000	994.532588	-0.005467412	0.005467412	4124
+216	17	1000	1007.300678	0.007300678	0.007300678	4124
+216	18	1000	998.358838	-0.001641162	0.001641162	4124
+216	19	1000	974.186070	-0.025813930	0.025813930	4124
+216	20	5000	5059.451279	0.011890256	0.011890256	4124
+216	21	5000	5132.317241	0.026463448	0.026463448	4124
+216	22	5000	4897.612944	-0.020477411	0.020477411	4124
+216	23	10000	9870.062504	-0.012993750	0.012993750	4124
+217	0	1000	994.532588	-0.005467412	0.005467412	4124
+217	1	1000	985.618547	-0.014381453	0.014381453	4124
+217	2	1000	1000.911658	0.000911658	0.000911658	4124
+217	3	1000	989.436475	-0.010563525	0.010563525	4124
+217	4	1000	994.532588	-0.005467412	0.005467412	4124
+217	5	1000	984.346695	-0.015653305	0.015653305	4124
+217	6	1000	975.454771	-0.024545229	0.024545229	4124
+217	7	1000	985.618547	-0.014381453	0.014381453	4124
+217	8	1000	1016.262082	0.016262082	0.016262082	4124
+217	9	1000	1002.188665	0.002188665	0.002188665	4124
+217	10	1000	1009.859079	0.009859079	0.009859079	4124
+217	11	1000	980.533506	-0.019466494	0.019466494	4124
+217	12	1000	990.709909	-0.009290091	0.009290091	4124
+217	13	1000	980.533506	-0.019466494	0.019466494	4124
+217	14	1000	993.257965	-0.006742035	0.006742035	4124
+217	15	1000	999.635049	-0.000364951	0.000364951	4124
+217	16	1000	1000.911658	0.000911658	0.000911658	4124
+217	17	1000	986.890795	-0.013109205	0.013109205	4124
+217	18	1000	1013.699680	0.013699680	0.013699680	4124
+217	19	1000	1000.911658	0.000911658	0.000911658	4124
+217	20	5000	4957.555477	-0.008488905	0.008488905	4124
+217	21	5000	4920.819805	-0.015836039	0.015836039	4124
+217	22	5000	5153.376413	0.030675283	0.030675283	4124
+217	23	10000	10194.208969	0.019420897	0.019420897	4124
+218	0	1000	1021.391701	0.021391701	0.021391701	4124
+218	1	1000	989.436475	-0.010563525	0.010563525	4124
+218	2	1000	1016.262082	0.016262082	0.016262082	4124
+218	3	1000	985.618547	-0.014381453	0.014381453	4124
+218	4	1000	1007.300678	0.007300678	0.007300678	4124
+218	5	1000	998.358838	-0.001641162	0.001641162	4124
+218	6	1000	976.723864	-0.023276136	0.023276136	4124
+218	7	1000	999.635049	-0.000364951	0.000364951	4124
+218	8	1000	990.709909	-0.009290091	0.009290091	4124
+218	9	1000	1014.980680	0.014980680	0.014980680	4124
+218	10	1000	989.436475	-0.010563525	0.010563525	4124
+218	11	1000	1013.699680	0.013699680	0.013699680	4124
+218	12	1000	1008.579679	0.008579679	0.008579679	4124
+218	13	1000	985.618547	-0.014381453	0.014381453	4124
+218	14	1000	1016.262082	0.016262082	0.016262082	4124
+218	15	1000	1000.911658	0.000911658	0.000911658	4124
+218	16	1000	994.532588	-0.005467412	0.005467412	4124
+218	17	1000	1007.300678	0.007300678	0.007300678	4124
+218	18	1000	984.346695	-0.015653305	0.015653305	4124
+218	19	1000	991.983739	-0.008016261	0.008016261	4124
+218	20	5000	4957.555477	-0.008488905	0.008488905	4124
+218	21	5000	5076.683109	0.015336622	0.015336622	4124
+218	22	5000	5001.399453	0.000279891	0.000279891	4124
+218	23	10000	10040.517058	0.004051706	0.004051706	4124
+219	0	1000	1003.466070	0.003466070	0.003466070	4124
+219	1	1000	1002.188665	0.002188665	0.002188665	4124
+219	2	1000	994.532588	-0.005467412	0.005467412	4124
+219	3	1000	1009.859079	0.009859079	0.009859079	4124
+219	4	1000	1021.391701	0.021391701	0.021391701	4124
+219	5	1000	1012.419079	0.012419079	0.012419079	4124
+219	6	1000	1009.859079	0.009859079	0.009859079	4124
+219	7	1000	1017.543884	0.017543884	0.017543884	4124
+219	8	1000	1003.466070	0.003466070	0.003466070	4124
+219	9	1000	1026.527751	0.026527751	0.026527751	4124
+219	10	1000	1004.743874	0.004743874	0.004743874	4124
+219	11	1000	993.257965	-0.006742035	0.006742035	4124
+219	12	1000	1004.743874	0.004743874	0.004743874	4124
+219	13	1000	1000.911658	0.000911658	0.000911658	4124
+219	14	1000	1007.300678	0.007300678	0.007300678	4124
+219	15	1000	986.890795	-0.013109205	0.013109205	4124
+219	16	1000	1003.466070	0.003466070	0.003466070	4124
+219	17	1000	997.083024	-0.002916976	0.002916976	4124
+219	18	1000	1003.466070	0.003466070	0.003466070	4124
+219	19	1000	1008.579679	0.008579679	0.008579679	4124
+219	20	5000	4998.010127	-0.000397975	0.000397975	4124
+219	21	5000	5004.791585	0.000958317	0.000958317	4124
+219	22	5000	5001.399453	0.000279891	0.000279891	4124
+219	23	10000	9580.054126	-0.041994587	0.041994587	4124
+220	0	1000	994.532588	-0.005467412	0.005467412	4124
+220	1	1000	993.257965	-0.006742035	0.006742035	4124
+220	2	1000	1008.579679	0.008579679	0.008579679	4124
+220	3	1000	980.533506	-0.019466494	0.019466494	4124
+220	4	1000	1007.300678	0.007300678	0.007300678	4124
+220	5	1000	1007.300678	0.007300678	0.007300678	4124
+220	6	1000	1006.022077	0.006022077	0.006022077	4124
+220	7	1000	1000.911658	0.000911658	0.000911658	4124
+220	8	1000	997.083024	-0.002916976	0.002916976	4124
+220	9	1000	991.983739	-0.008016261	0.008016261	4124
+220	10	1000	993.257965	-0.006742035	0.006742035	4124
+220	11	1000	997.083024	-0.002916976	0.002916976	4124
+220	12	1000	1003.466070	0.003466070	0.003466070	4124
+220	13	1000	1018.826088	0.018826088	0.018826088	4124
+220	14	1000	995.807607	-0.004192393	0.004192393	4124
+220	15	1000	997.083024	-0.002916976	0.002916976	4124
+220	16	1000	989.436475	-0.010563525	0.010563525	4124
+220	17	1000	974.186070	-0.025813930	0.025813930	4124
+220	18	1000	985.618547	-0.014381453	0.014381453	4124
+220	19	1000	989.436475	-0.010563525	0.010563525	4124
+220	20	5000	5025.203588	0.005040718	0.005040718	4124
+220	21	5000	5062.891850	0.012578370	0.012578370	4124
+220	22	5000	4984.480800	-0.003103840	0.003103840	4124
+220	23	10000	9727.863978	-0.027213602	0.027213602	4124
+221	0	1000	993.257965	-0.006742035	0.006742035	4124
+221	1	1000	1018.826088	0.018826088	0.018826088	4124
+221	2	1000	990.709909	-0.009290091	0.009290091	4124
+221	3	1000	979.263232	-0.020736768	0.020736768	4124
+221	4	1000	985.618547	-0.014381453	0.014381453	4124
+221	5	1000	1007.300678	0.007300678	0.007300678	4124
+221	6	1000	986.890795	-0.013109205	0.013109205	4124
+221	7	1000	1025.243135	0.025243135	0.025243135	4124
+221	8	1000	994.532588	-0.005467412	0.005467412	4124
+221	9	1000	1008.579679	0.008579679	0.008579679	4124
+221	10	1000	993.257965	-0.006742035	0.006742035	4124
+221	11	1000	1002.188665	0.002188665	0.002188665	4124
+221	12	1000	1009.859079	0.009859079	0.009859079	4124
+221	13	1000	997.083024	-0.002916976	0.002916976	4124
+221	14	1000	1002.188665	0.002188665	0.002188665	4124
+221	15	1000	999.635049	-0.000364951	0.000364951	4124
+221	16	1000	991.983739	-0.008016261	0.008016261	4124
+221	17	1000	1007.300678	0.007300678	0.007300678	4124
+221	18	1000	991.983739	-0.008016261	0.008016261	4124
+221	19	1000	993.257965	-0.006742035	0.006742035	4124
+221	20	5000	5032.030256	0.006406051	0.006406051	4124
+221	21	5000	5042.291639	0.008458328	0.008458328	4124
+221	22	5000	5100.930114	0.020186023	0.020186023	4124
+221	23	10000	10087.195626	0.008719563	0.008719563	4124
+222	0	1000	983.075238	-0.016924762	0.016924762	4124
+222	1	1000	1020.108694	0.020108694	0.020108694	4124
+222	2	1000	1013.699680	0.013699680	0.013699680	4124
+222	3	1000	1013.699680	0.013699680	0.013699680	4124
+222	4	1000	986.890795	-0.013109205	0.013109205	4124
+222	5	1000	994.532588	-0.005467412	0.005467412	4124
+222	6	1000	1002.188665	0.002188665	0.002188665	4124
+222	7	1000	991.983739	-0.008016261	0.008016261	4124
+222	8	1000	980.533506	-0.019466494	0.019466494	4124
+222	9	1000	1011.138879	0.011138879	0.011138879	4124
+222	10	1000	1007.300678	0.007300678	0.007300678	4124
+222	11	1000	999.635049	-0.000364951	0.000364951	4124
+222	12	1000	1004.743874	0.004743874	0.004743874	4124
+222	13	1000	1030.384020	0.030384020	0.030384020	4124
+222	14	1000	997.083024	-0.002916976	0.002916976	4124
+222	15	1000	983.075238	-0.016924762	0.016924762	4124
+222	16	1000	995.807607	-0.004192393	0.004192393	4124
+222	17	1000	999.635049	-0.000364951	0.000364951	4124
+222	18	1000	994.532588	-0.005467412	0.005467412	4124
+222	19	1000	995.807607	-0.004192393	0.004192393	4124
+222	20	5000	5011.584290	0.002316858	0.002316858	4124
+222	21	5000	4960.911479	-0.007817704	0.007817704	4124
+222	22	5000	5059.451279	0.011890256	0.011890256	4124
+222	23	10000	9948.726102	-0.005127390	0.005127390	4124
+223	0	1000	1004.743874	0.004743874	0.004743874	4124
+223	1	1000	1012.419079	0.012419079	0.012419079	4124
+223	2	1000	1009.859079	0.009859079	0.009859079	4124
+223	3	1000	988.163437	-0.011836563	0.011836563	4124
+223	4	1000	1018.826088	0.018826088	0.018826088	4124
+223	5	1000	1002.188665	0.002188665	0.002188665	4124
+223	6	1000	994.532588	-0.005467412	0.005467412	4124
+223	7	1000	1021.391701	0.021391701	0.021391701	4124
+223	8	1000	1002.188665	0.002188665	0.002188665	4124
+223	9	1000	994.532588	-0.005467412	0.005467412	4124
+223	10	1000	1022.675110	0.022675110	0.022675110	4124
+223	11	1000	1000.911658	0.000911658	0.000911658	4124
+223	12	1000	1021.391701	0.021391701	0.021391701	4124
+223	13	1000	1000.911658	0.000911658	0.000911658	4124
+223	14	1000	1017.543884	0.017543884	0.017543884	4124
+223	15	1000	983.075238	-0.016924762	0.016924762	4124
+223	16	1000	1003.466070	0.003466070	0.003466070	4124
+223	17	1000	1002.188665	0.002188665	0.002188665	4124
+223	18	1000	998.358838	-0.001641162	0.001641162	4124
+223	19	1000	986.890795	-0.013109205	0.013109205	4124
+223	20	5000	5042.291639	0.008458328	0.008458328	4124
+223	21	5000	4967.631743	-0.006473651	0.006473651	4124
+223	22	5000	5062.891850	0.012578370	0.012578370	4124
+223	23	10000	10170.185440	0.017018544	0.017018544	4124
+224	0	1000	1026.527751	0.026527751	0.026527751	4124
+224	1	1000	1013.699680	0.013699680	0.013699680	4124
+224	2	1000	997.083024	-0.002916976	0.002916976	4124
+224	3	1000	994.532588	-0.005467412	0.005467412	4124
+224	4	1000	1004.743874	0.004743874	0.004743874	4124
+224	5	1000	1013.699680	0.013699680	0.013699680	4124
+224	6	1000	994.532588	-0.005467412	0.005467412	4124
+224	7	1000	998.358838	-0.001641162	0.001641162	4124
+224	8	1000	977.993351	-0.022006649	0.022006649	4124
+224	9	1000	991.983739	-0.008016261	0.008016261	4124
+224	10	1000	1008.579679	0.008579679	0.008579679	4124
+224	11	1000	999.635049	-0.000364951	0.000364951	4124
+224	12	1000	979.263232	-0.020736768	0.020736768	4124
+224	13	1000	1009.859079	0.009859079	0.009859079	4124
+224	14	1000	1014.980680	0.014980680	0.014980680	4124
+224	15	1000	1017.543884	0.017543884	0.017543884	4124
+224	16	1000	976.723864	-0.023276136	0.023276136	4124
+224	17	1000	1012.419079	0.012419079	0.012419079	4124
+224	18	1000	1007.300678	0.007300678	0.007300678	4124
+224	19	1000	999.635049	-0.000364951	0.000364951	4124
+224	20	5000	4947.503938	-0.010499212	0.010499212	4124
+224	21	5000	5032.030256	0.006406051	0.006406051	4124
+224	22	5000	5011.584290	0.002316858	0.002316858	4124
+224	23	10000	9994.364457	-0.000563554	0.000563554	4124
+225	0	1000	1000.911658	0.000911658	0.000911658	4124
+225	1	1000	988.163437	-0.011836563	0.011836563	4124
+225	2	1000	994.532588	-0.005467412	0.005467412	4124
+225	3	1000	1008.579679	0.008579679	0.008579679	4124
+225	4	1000	1013.699680	0.013699680	0.013699680	4124
+225	5	1000	986.890795	-0.013109205	0.013109205	4124
+225	6	1000	1006.022077	0.006022077	0.006022077	4124
+225	7	1000	1012.419079	0.012419079	0.012419079	4124
+225	8	1000	1000.911658	0.000911658	0.000911658	4124
+225	9	1000	998.358838	-0.001641162	0.001641162	4124
+225	10	1000	993.257965	-0.006742035	0.006742035	4124
+225	11	1000	990.709909	-0.009290091	0.009290091	4124
+225	12	1000	1013.699680	0.013699680	0.013699680	4124
+225	13	1000	995.807607	-0.004192393	0.004192393	4124
+225	14	1000	994.532588	-0.005467412	0.005467412	4124
+225	15	1000	1008.579679	0.008579679	0.008579679	4124
+225	16	1000	1000.911658	0.000911658	0.000911658	4124
+225	17	1000	999.635049	-0.000364951	0.000364951	4124
+225	18	1000	1025.243135	0.025243135	0.025243135	4124
+225	19	1000	1006.022077	0.006022077	0.006022077	4124
+225	20	5000	5059.451279	0.011890256	0.011890256	4124
+225	21	5000	5125.321509	0.025064302	0.025064302	4124
+225	22	5000	5069.781675	0.013956335	0.013956335	4124
+225	23	10000	10005.853945	0.000585395	0.000585395	4124
+226	0	1000	995.807607	-0.004192393	0.004192393	4124
+226	1	1000	989.436475	-0.010563525	0.010563525	4124
+226	2	1000	1002.188665	0.002188665	0.002188665	4124
+226	3	1000	1006.022077	0.006022077	0.006022077	4124
+226	4	1000	999.635049	-0.000364951	0.000364951	4124
+226	5	1000	998.358838	-0.001641162	0.001641162	4124
+226	6	1000	988.163437	-0.011836563	0.011836563	4124
+226	7	1000	997.083024	-0.002916976	0.002916976	4124
+226	8	1000	989.436475	-0.010563525	0.010563525	4124
+226	9	1000	999.635049	-0.000364951	0.000364951	4124
+226	10	1000	1007.300678	0.007300678	0.007300678	4124
+226	11	1000	1013.699680	0.013699680	0.013699680	4124
+226	12	1000	998.358838	-0.001641162	0.001641162	4124
+226	13	1000	994.532588	-0.005467412	0.005467412	4124
+226	14	1000	984.346695	-0.015653305	0.015653305	4124
+226	15	1000	993.257965	-0.006742035	0.006742035	4124
+226	16	1000	986.890795	-0.013109205	0.013109205	4124
+226	17	1000	989.436475	-0.010563525	0.010563525	4124
+226	18	1000	1008.579679	0.008579679	0.008579679	4124
+226	19	1000	986.890795	-0.013109205	0.013109205	4124
+226	20	5000	5035.447861	0.007089572	0.007089572	4124
+226	21	5000	5014.984871	0.002996974	0.002996974	4124
+226	22	5000	4937.477005	-0.012504599	0.012504599	4124
+226	23	10000	10017.375753	0.001737575	0.001737575	4124
+227	0	1000	1008.579679	0.008579679	0.008579679	4124
+227	1	1000	1007.300678	0.007300678	0.007300678	4124
+227	2	1000	988.163437	-0.011836563	0.011836563	4124
+227	3	1000	997.083024	-0.002916976	0.002916976	4124
+227	4	1000	1004.743874	0.004743874	0.004743874	4124
+227	5	1000	1018.826088	0.018826088	0.018826088	4124
+227	6	1000	998.358838	-0.001641162	0.001641162	4124
+227	7	1000	986.890795	-0.013109205	0.013109205	4124
+227	8	1000	986.890795	-0.013109205	0.013109205	4124
+227	9	1000	1002.188665	0.002188665	0.002188665	4124
+227	10	1000	1006.022077	0.006022077	0.006022077	4124
+227	11	1000	1007.300678	0.007300678	0.007300678	4124
+227	12	1000	991.983739	-0.008016261	0.008016261	4124
+227	13	1000	1016.262082	0.016262082	0.016262082	4124
+227	14	1000	999.635049	-0.000364951	0.000364951	4124
+227	15	1000	1003.466070	0.003466070	0.003466070	4124
+227	16	1000	990.709909	-0.009290091	0.009290091	4124
+227	17	1000	998.358838	-0.001641162	0.001641162	4124
+227	18	1000	993.257965	-0.006742035	0.006742035	4124
+227	19	1000	999.635049	-0.000364951	0.000364951	4124
+227	20	5000	5035.447861	0.007089572	0.007089572	4124
+227	21	5000	4871.250825	-0.025749835	0.025749835	4124
+227	22	5000	5032.030256	0.006406051	0.006406051	4124
+227	23	10000	10242.682908	0.024268291	0.024268291	4124
+228	0	1000	1008.579679	0.008579679	0.008579679	4124
+228	1	1000	1006.022077	0.006022077	0.006022077	4124
+228	2	1000	984.346695	-0.015653305	0.015653305	4124
+228	3	1000	998.358838	-0.001641162	0.001641162	4124
+228	4	1000	1003.466070	0.003466070	0.003466070	4124
+228	5	1000	1009.859079	0.009859079	0.009859079	4124
+228	6	1000	1013.699680	0.013699680	0.013699680	4124
+228	7	1000	1016.262082	0.016262082	0.016262082	4124
+228	8	1000	1006.022077	0.006022077	0.006022077	4124
+228	9	1000	1007.300678	0.007300678	0.007300678	4124
+228	10	1000	990.709909	-0.009290091	0.009290091	4124
+228	11	1000	1002.188665	0.002188665	0.002188665	4124
+228	12	1000	984.346695	-0.015653305	0.015653305	4124
+228	13	1000	1014.980680	0.014980680	0.014980680	4124
+228	14	1000	990.709909	-0.009290091	0.009290091	4124
+228	15	1000	981.804175	-0.018195825	0.018195825	4124
+228	16	1000	986.890795	-0.013109205	0.013109205	4124
+228	17	1000	994.532588	-0.005467412	0.005467412	4124
+228	18	1000	984.346695	-0.015653305	0.015653305	4124
+228	19	1000	1017.543884	0.017543884	0.017543884	4124
+228	20	5000	5062.891850	0.012578370	0.012578370	4124
+228	21	5000	4924.145830	-0.015170834	0.015170834	4124
+228	22	5000	4994.623603	-0.001075279	0.001075279	4124
+228	23	10000	10052.136924	0.005213692	0.005213692	4124
+229	0	1000	1011.138879	0.011138879	0.011138879	4124
+229	1	1000	1000.911658	0.000911658	0.000911658	4124
+229	2	1000	1003.466070	0.003466070	0.003466070	4124
+229	3	1000	1030.384020	0.030384020	0.030384020	4124
+229	4	1000	988.163437	-0.011836563	0.011836563	4124
+229	5	1000	988.163437	-0.011836563	0.011836563	4124
+229	6	1000	988.163437	-0.011836563	0.011836563	4124
+229	7	1000	1012.419079	0.012419079	0.012419079	4124
+229	8	1000	1011.138879	0.011138879	0.011138879	4124
+229	9	1000	1012.419079	0.012419079	0.012419079	4124
+229	10	1000	1003.466070	0.003466070	0.003466070	4124
+229	11	1000	986.890795	-0.013109205	0.013109205	4124
+229	12	1000	986.890795	-0.013109205	0.013109205	4124
+229	13	1000	1017.543884	0.017543884	0.017543884	4124
+229	14	1000	1007.300678	0.007300678	0.007300678	4124
+229	15	1000	1008.579679	0.008579679	0.008579679	4124
+229	16	1000	974.186070	-0.025813930	0.025813930	4124
+229	17	1000	1009.859079	0.009859079	0.009859079	4124
+229	18	1000	988.163437	-0.011836563	0.011836563	4124
+229	19	1000	1002.188665	0.002188665	0.002188665	4124
+229	20	5000	4924.145830	-0.015170834	0.015170834	4124
+229	21	5000	5042.291639	0.008458328	0.008458328	4124
+229	22	5000	4934.140142	-0.013171972	0.013171972	4124
+229	23	10000	10170.185440	0.017018544	0.017018544	4124
+230	0	1000	998.358838	-0.001641162	0.001641162	4124
+230	1	1000	1003.466070	0.003466070	0.003466070	4124
+230	2	1000	979.263232	-0.020736768	0.020736768	4124
+230	3	1000	983.075238	-0.016924762	0.016924762	4124
+230	4	1000	988.163437	-0.011836563	0.011836563	4124
+230	5	1000	990.709909	-0.009290091	0.009290091	4124
+230	6	1000	1008.579679	0.008579679	0.008579679	4124
+230	7	1000	979.263232	-0.020736768	0.020736768	4124
+230	8	1000	984.346695	-0.015653305	0.015653305	4124
+230	9	1000	1007.300678	0.007300678	0.007300678	4124
+230	10	1000	998.358838	-0.001641162	0.001641162	4124
+230	11	1000	985.618547	-0.014381453	0.014381453	4124
+230	12	1000	986.890795	-0.013109205	0.013109205	4124
+230	13	1000	983.075238	-0.016924762	0.016924762	4124
+230	14	1000	1022.675110	0.022675110	0.022675110	4124
+230	15	1000	995.807607	-0.004192393	0.004192393	4124
+230	16	1000	1023.958921	0.023958921	0.023958921	4124
+230	17	1000	1004.743874	0.004743874	0.004743874	4124
+230	18	1000	994.532588	-0.005467412	0.005467412	4124
+230	19	1000	1011.138879	0.011138879	0.011138879	4124
+230	20	5000	4954.202223	-0.009159555	0.009159555	4124
+230	21	5000	5032.030256	0.006406051	0.006406051	4124
+230	22	5000	4957.555477	-0.008488905	0.008488905	4124
+230	23	10000	9803.818473	-0.019618153	0.019618153	4124
+231	0	1000	1007.300678	0.007300678	0.007300678	4124
+231	1	1000	979.263232	-0.020736768	0.020736768	4124
+231	2	1000	1006.022077	0.006022077	0.006022077	4124
+231	3	1000	971.649847	-0.028350153	0.028350153	4124
+231	4	1000	1018.826088	0.018826088	0.018826088	4124
+231	5	1000	1009.859079	0.009859079	0.009859079	4124
+231	6	1000	1009.859079	0.009859079	0.009859079	4124
+231	7	1000	998.358838	-0.001641162	0.001641162	4124
+231	8	1000	1002.188665	0.002188665	0.002188665	4124
+231	9	1000	983.075238	-0.016924762	0.016924762	4124
+231	10	1000	1016.262082	0.016262082	0.016262082	4124
+231	11	1000	984.346695	-0.015653305	0.015653305	4124
+231	12	1000	991.983739	-0.008016261	0.008016261	4124
+231	13	1000	1003.466070	0.003466070	0.003466070	4124
+231	14	1000	999.635049	-0.000364951	0.000364951	4124
+231	15	1000	1012.419079	0.012419079	0.012419079	4124
+231	16	1000	989.436475	-0.010563525	0.010563525	4124
+231	17	1000	993.257965	-0.006742035	0.006742035	4124
+231	18	1000	991.983739	-0.008016261	0.008016261	4124
+231	19	1000	1002.188665	0.002188665	0.002188665	4124
+231	20	5000	5011.584290	0.002316858	0.002316858	4124
+231	21	5000	4991.239877	-0.001752025	0.001752025	4124
+231	22	5000	4954.202223	-0.009159555	0.009159555	4124
+231	23	10000	9814.785012	-0.018521499	0.018521499	4124
+232	0	1000	986.890795	-0.013109205	0.013109205	4124
+232	1	1000	991.983739	-0.008016261	0.008016261	4124
+232	2	1000	1013.699680	0.013699680	0.013699680	4124
+232	3	1000	981.804175	-0.018195825	0.018195825	4124
+232	4	1000	1003.466070	0.003466070	0.003466070	4124
+232	5	1000	1018.826088	0.018826088	0.018826088	4124
+232	6	1000	990.709909	-0.009290091	0.009290091	4124
+232	7	1000	1002.188665	0.002188665	0.002188665	4124
+232	8	1000	1011.138879	0.011138879	0.011138879	4124
+232	9	1000	995.807607	-0.004192393	0.004192393	4124
+232	10	1000	1021.391701	0.021391701	0.021391701	4124
+232	11	1000	997.083024	-0.002916976	0.002916976	4124
+232	12	1000	1003.466070	0.003466070	0.003466070	4124
+232	13	1000	1011.138879	0.011138879	0.011138879	4124
+232	14	1000	1012.419079	0.012419079	0.012419079	4124
+232	15	1000	991.983739	-0.008016261	0.008016261	4124
+232	16	1000	997.083024	-0.002916976	0.002916976	4124
+232	17	1000	1006.022077	0.006022077	0.006022077	4124
+232	18	1000	1007.300678	0.007300678	0.007300678	4124
+232	19	1000	979.263232	-0.020736768	0.020736768	4124
+232	20	5000	5114.850264	0.022970053	0.022970053	4124
+232	21	5000	5093.987740	0.018797548	0.018797548	4124
+232	22	5000	4944.158899	-0.011168220	0.011168220	4124
+232	23	10000	10017.375753	0.001737575	0.001737575	4124
+233	0	1000	990.709909	-0.009290091	0.009290091	4124
+233	1	1000	995.807607	-0.004192393	0.004192393	4124
+233	2	1000	1011.138879	0.011138879	0.011138879	4124
+233	3	1000	1007.300678	0.007300678	0.007300678	4124
+233	4	1000	1012.419079	0.012419079	0.012419079	4124
+233	5	1000	994.532588	-0.005467412	0.005467412	4124
+233	6	1000	998.358838	-0.001641162	0.001641162	4124
+233	7	1000	1017.543884	0.017543884	0.017543884	4124
+233	8	1000	991.983739	-0.008016261	0.008016261	4124
+233	9	1000	993.257965	-0.006742035	0.006742035	4124
+233	10	1000	1016.262082	0.016262082	0.016262082	4124
+233	11	1000	997.083024	-0.002916976	0.002916976	4124
+233	12	1000	1000.911658	0.000911658	0.000911658	4124
+233	13	1000	1029.098194	0.029098194	0.029098194	4124
+233	14	1000	1007.300678	0.007300678	0.007300678	4124
+233	15	1000	1000.911658	0.000911658	0.000911658	4124
+233	16	1000	1021.391701	0.021391701	0.021391701	4124
+233	17	1000	1027.812771	0.027812771	0.027812771	4124
+233	18	1000	997.083024	-0.002916976	0.002916976	4124
+233	19	1000	1018.826088	0.018826088	0.018826088	4124
+233	20	5000	4940.816590	-0.011836682	0.011836682	4124
+233	21	5000	5111.365789	0.022273158	0.022273158	4124
+233	22	5000	4904.230070	-0.019153986	0.019153986	4124
+233	23	10000	10134.412287	0.013441229	0.013441229	4124
+234	0	1000	991.983739	-0.008016261	0.008016261	4124
+234	1	1000	1009.859079	0.009859079	0.009859079	4124
+234	2	1000	1022.675110	0.022675110	0.022675110	4124
+234	3	1000	1000.911658	0.000911658	0.000911658	4124
+234	4	1000	1000.911658	0.000911658	0.000911658	4124
+234	5	1000	998.358838	-0.001641162	0.001641162	4124
+234	6	1000	988.163437	-0.011836563	0.011836563	4124
+234	7	1000	1016.262082	0.016262082	0.016262082	4124
+234	8	1000	998.358838	-0.001641162	0.001641162	4124
+234	9	1000	995.807607	-0.004192393	0.004192393	4124
+234	10	1000	1027.812771	0.027812771	0.027812771	4124
+234	11	1000	1008.579679	0.008579679	0.008579679	4124
+234	12	1000	1026.527751	0.026527751	0.026527751	4124
+234	13	1000	998.358838	-0.001641162	0.001641162	4124
+234	14	1000	977.993351	-0.022006649	0.022006649	4124
+234	15	1000	1021.391701	0.021391701	0.021391701	4124
+234	16	1000	999.635049	-0.000364951	0.000364951	4124
+234	17	1000	999.635049	-0.000364951	0.000364951	4124
+234	18	1000	1002.188665	0.002188665	0.002188665	4124
+234	19	1000	997.083024	-0.002916976	0.002916976	4124
+234	20	5000	4954.202223	-0.009159555	0.009159555	4124
+234	21	5000	5121.828119	0.024365624	0.024365624	4124
+234	22	5000	4954.202223	-0.009159555	0.009159555	4124
+234	23	10000	10017.375753	0.001737575	0.001737575	4124
+235	0	1000	1009.859079	0.009859079	0.009859079	4124
+235	1	1000	1016.262082	0.016262082	0.016262082	4124
+235	2	1000	989.436475	-0.010563525	0.010563525	4124
+235	3	1000	995.807607	-0.004192393	0.004192393	4124
+235	4	1000	997.083024	-0.002916976	0.002916976	4124
+235	5	1000	1012.419079	0.012419079	0.012419079	4124
+235	6	1000	990.709909	-0.009290091	0.009290091	4124
+235	7	1000	995.807607	-0.004192393	0.004192393	4124
+235	8	1000	1013.699680	0.013699680	0.013699680	4124
+235	9	1000	997.083024	-0.002916976	0.002916976	4124
+235	10	1000	997.083024	-0.002916976	0.002916976	4124
+235	11	1000	983.075238	-0.016924762	0.016924762	4124
+235	12	1000	988.163437	-0.011836563	0.011836563	4124
+235	13	1000	989.436475	-0.010563525	0.010563525	4124
+235	14	1000	981.804175	-0.018195825	0.018195825	4124
+235	15	1000	976.723864	-0.023276136	0.023276136	4124
+235	16	1000	1018.826088	0.018826088	0.018826088	4124
+235	17	1000	1008.579679	0.008579679	0.008579679	4124
+235	18	1000	1012.419079	0.012419079	0.012419079	4124
+235	19	1000	988.163437	-0.011836563	0.011836563	4124
+235	20	5000	5118.337705	0.023667541	0.023667541	4124
+235	21	5000	5001.399453	0.000279891	0.000279891	4124
+235	22	5000	5066.335314	0.013267063	0.013267063	4124
+235	23	10000	9487.774879	-0.051222512	0.051222512	4124
+236	0	1000	1020.108694	0.020108694	0.020108694	4124
+236	1	1000	984.346695	-0.015653305	0.015653305	4124
+236	2	1000	1016.262082	0.016262082	0.016262082	4124
+236	3	1000	1008.579679	0.008579679	0.008579679	4124
+236	4	1000	1007.300678	0.007300678	0.007300678	4124
+236	5	1000	1009.859079	0.009859079	0.009859079	4124
+236	6	1000	998.358838	-0.001641162	0.001641162	4124
+236	7	1000	1020.108694	0.020108694	0.020108694	4124
+236	8	1000	1007.300678	0.007300678	0.007300678	4124
+236	9	1000	1006.022077	0.006022077	0.006022077	4124
+236	10	1000	991.983739	-0.008016261	0.008016261	4124
+236	11	1000	988.163437	-0.011836563	0.011836563	4124
+236	12	1000	988.163437	-0.011836563	0.011836563	4124
+236	13	1000	1003.466070	0.003466070	0.003466070	4124
+236	14	1000	1026.527751	0.026527751	0.026527751	4124
+236	15	1000	993.257965	-0.006742035	0.006742035	4124
+236	16	1000	1000.911658	0.000911658	0.000911658	4124
+236	17	1000	981.804175	-0.018195825	0.018195825	4124
+236	18	1000	986.890795	-0.013109205	0.013109205	4124
+236	19	1000	1016.262082	0.016262082	0.016262082	4124
+236	20	5000	4957.555477	-0.008488905	0.008488905	4124
+236	21	5000	5045.717821	0.009143564	0.009143564	4124
+236	22	5000	4947.503938	-0.010499212	0.010499212	4124
+236	23	10000	9926.096210	-0.007390379	0.007390379	4124
+237	0	1000	1003.466070	0.003466070	0.003466070	4124
+237	1	1000	1003.466070	0.003466070	0.003466070	4124
+237	2	1000	993.257965	-0.006742035	0.006742035	4124
+237	3	1000	1018.826088	0.018826088	0.018826088	4124
+237	4	1000	1013.699680	0.013699680	0.013699680	4124
+237	5	1000	980.533506	-0.019466494	0.019466494	4124
+237	6	1000	989.436475	-0.010563525	0.010563525	4124
+237	7	1000	989.436475	-0.010563525	0.010563525	4124
+237	8	1000	1006.022077	0.006022077	0.006022077	4124
+237	9	1000	1004.743874	0.004743874	0.004743874	4124
+237	10	1000	1006.022077	0.006022077	0.006022077	4124
+237	11	1000	998.358838	-0.001641162	0.001641162	4124
+237	12	1000	986.890795	-0.013109205	0.013109205	4124
+237	13	1000	1020.108694	0.020108694	0.020108694	4124
+237	14	1000	993.257965	-0.006742035	0.006742035	4124
+237	15	1000	984.346695	-0.015653305	0.015653305	4124
+237	16	1000	1011.138879	0.011138879	0.011138879	4124
+237	17	1000	997.083024	-0.002916976	0.002916976	4124
+237	18	1000	1002.188665	0.002188665	0.002188665	4124
+237	19	1000	1022.675110	0.022675110	0.022675110	4124
+237	20	5000	5056.013595	0.011202719	0.011202719	4124
+237	21	5000	4987.858944	-0.002428211	0.002428211	4124
+237	22	5000	4957.555477	-0.008488905	0.008488905	4124
+237	23	10000	10291.737386	0.029173739	0.029173739	4124
+238	0	1000	1002.188665	0.002188665	0.002188665	4124
+238	1	1000	985.618547	-0.014381453	0.014381453	4124
+238	2	1000	1007.300678	0.007300678	0.007300678	4124
+238	3	1000	990.709909	-0.009290091	0.009290091	4124
+238	4	1000	999.635049	-0.000364951	0.000364951	4124
+238	5	1000	979.263232	-0.020736768	0.020736768	4124
+238	6	1000	1014.980680	0.014980680	0.014980680	4124
+238	7	1000	999.635049	-0.000364951	0.000364951	4124
+238	8	1000	983.075238	-0.016924762	0.016924762	4124
+238	9	1000	989.436475	-0.010563525	0.010563525	4124
+238	10	1000	986.890795	-0.013109205	0.013109205	4124
+238	11	1000	1027.812771	0.027812771	0.027812771	4124
+238	12	1000	984.346695	-0.015653305	0.015653305	4124
+238	13	1000	993.257965	-0.006742035	0.006742035	4124
+238	14	1000	1007.300678	0.007300678	0.007300678	4124
+238	15	1000	1018.826088	0.018826088	0.018826088	4124
+238	16	1000	1008.579679	0.008579679	0.008579679	4124
+238	17	1000	994.532588	-0.005467412	0.005467412	4124
+238	18	1000	1009.859079	0.009859079	0.009859079	4124
+238	19	1000	993.257965	-0.006742035	0.006742035	4124
+238	20	5000	5038.868321	0.007773664	0.007773664	4124
+238	21	5000	5038.868321	0.007773664	0.007773664	4124
+238	22	5000	4874.536826	-0.025092635	0.025092635	4124
+238	23	10000	10316.486706	0.031648671	0.031648671	4124
+239	0	1000	1003.466070	0.003466070	0.003466070	4124
+239	1	1000	972.917762	-0.027082238	0.027082238	4124
+239	2	1000	1000.911658	0.000911658	0.000911658	4124
+239	3	1000	993.257965	-0.006742035	0.006742035	4124
+239	4	1000	989.436475	-0.010563525	0.010563525	4124
+239	5	1000	980.533506	-0.019466494	0.019466494	4124
+239	6	1000	1004.743874	0.004743874	0.004743874	4124
+239	7	1000	1011.138879	0.011138879	0.011138879	4124
+239	8	1000	1013.699680	0.013699680	0.013699680	4124
+239	9	1000	997.083024	-0.002916976	0.002916976	4124
+239	10	1000	998.358838	-0.001641162	0.001641162	4124
+239	11	1000	990.709909	-0.009290091	0.009290091	4124
+239	12	1000	1004.743874	0.004743874	0.004743874	4124
+239	13	1000	969.115193	-0.030884807	0.030884807	4124
+239	14	1000	991.983739	-0.008016261	0.008016261	4124
+239	15	1000	1012.419079	0.012419079	0.012419079	4124
+239	16	1000	994.532588	-0.005467412	0.005467412	4124
+239	17	1000	995.807607	-0.004192393	0.004192393	4124
+239	18	1000	997.083024	-0.002916976	0.002916976	4124
+239	19	1000	995.807607	-0.004192393	0.004192393	4124
+239	20	5000	4927.474558	-0.014505088	0.014505088	4124
+239	21	5000	5001.399453	0.000279891	0.000279891	4124
+239	22	5000	5014.984871	0.002996974	0.002996974	4124
+239	23	10000	9914.827977	-0.008517202	0.008517202	4124
diff --git a/developer-simulation/runs/2026-08-17--mergeable-unique-installation-reach-rollups/evidence/summary.txt b/developer-simulation/runs/2026-08-17--mergeable-unique-installation-reach-rollups/evidence/summary.txt
new file mode 100644
index 0000000..16edf58
--- /dev/null
+++ b/developer-simulation/runs/2026-08-17--mergeable-unique-installation-reach-rollups/evidence/summary.txt
@@ -0,0 +1,56 @@
+format_version=1
+state_file_version=2
+hash_algorithm=splitmix64-avalanche-v1
+hash_seed=0xbb67ae8584caa73b
+load_generator_seed=0x243f6a8885a308d3
+tuning_generator_seed=0x13198a2e03707344
+held_out_generator_seed=0x082efa98ec4e6c89
+tuning_median_absolute_error=0.008579679
+tuning_p95_absolute_error=0.026713671
+tuning_worst_absolute_error=0.056260706
+tuning_positive_count=1575
+tuning_negative_count=1305
+tuning_positive_mean=0.010413124
+tuning_negative_mean=-0.011394220
+tuning_worst_positive_case=(19, 10000, 22, 0.05593784505962885)
+tuning_worst_negative_case=(17, 10000, 0, -0.056260706026888326)
+heldout_median_absolute_error=0.008579679
+heldout_p95_absolute_error=0.027082238
+heldout_worst_absolute_error=0.061240184
+heldout_positive_count=1548
+heldout_negative_count=1332
+heldout_positive_mean=0.010418403
+heldout_negative_mean=-0.011276463
+heldout_worst_positive_case=(13, 10000, 12, 0.061240184476527244)
+heldout_worst_negative_case=(2, 10000, 17, -0.05925414200532286)
+load_records=12000000
+load_unique_bucket_occurrences=10800000
+load_buckets=5760
+load_1k_buckets=4800
+load_5k_buckets=720
+load_10k_buckets=240
+state_size_max=4124
+total_serialized_bucket_state=23754240
+duplicates_byte_identical=true
+direct_sharded_byte_identical=true
+merge_permutations=50
+merge_permutations_all_equal=true
+repeated_state_byte_identical=true
+repeated_report_byte_identical=true
+state_digest=ecda69b5ba1467d1
+report_digest=6219b8fa82ef6a79
+summary_digest=ca4d7c625e0eec4d
+load_error_median=0.008016261
+load_error_p95=0.023276136
+load_error_worst=0.063211661
+load_positive_count=2895
+load_negative_count=2865
+load_positive_mean=0.009667501
+load_negative_mean=-0.009513402
+adversarial_id_patterns=4
+adversarial_worst_absolute_error=0.027941858
+reverse_order_byte_identical=true
+thousand_duplicates_byte_identical=true
+hot_shard_merge_byte_identical=true
+empty_input_is_empty=true
+one_bucket_is_one_bucket=true
diff --git a/developer-simulation/runs/2026-08-17--mergeable-unique-installation-reach-rollups/src/lib.rs b/developer-simulation/runs/2026-08-17--mergeable-unique-installation-reach-rollups/src/lib.rs
new file mode 100644
index 0000000..3063f10
--- /dev/null
+++ b/developer-simulation/runs/2026-08-17--mergeable-unique-installation-reach-rollups/src/lib.rs
@@ -0,0 +1,1251 @@
+#![forbid(unsafe_code)]
+// These pedantic lints conflict with bounded numeric domains and evidence-result
+// structs in this self-contained prototype; all other Clippy lints stay denied.
+#![allow(
+    clippy::cast_precision_loss,
+    clippy::missing_errors_doc,
+    clippy::missing_panics_doc,
+    clippy::naive_bytecount,
+    clippy::similar_names,
+    clippy::struct_excessive_bools
+)]
+
+use std::collections::{BTreeMap, HashSet};
+use std::error::Error;
+use std::fmt::{Display, Formatter, Write as FmtWrite};
+use std::io::{Read, Write};
+use std::path::Path;
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, PartialOrd, Ord, Hash)]
+pub struct BucketKey {
+    pub tenant_id: u32,
+    pub unix_hour: i64,
+}
+
+impl BucketKey {
+    #[must_use]
+    pub const fn new(tenant_id: u32, unix_hour: i64) -> Self {
+        Self {
+            tenant_id,
+            unix_hour,
+        }
+    }
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, PartialOrd, Ord)]
+pub struct Record {
+    pub tenant_id: u32,
+    pub unix_hour: i64,
+    pub installation_id: [u8; 16],
+}
+
+impl Record {
+    #[must_use]
+    pub const fn new(tenant_id: u32, unix_hour: i64, installation_id: [u8; 16]) -> Self {
+        Self {
+            tenant_id,
+            unix_hour,
+            installation_id,
+        }
+    }
+
+    #[must_use]
+    pub const fn key(self) -> BucketKey {
+        BucketKey::new(self.tenant_id, self.unix_hour)
+    }
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub struct DayWindow {
+    start_hour: i64,
+    end_hour: i64,
+    min_tenant: u32,
+    max_tenant: u32,
+}
+
+impl DayWindow {
+    pub fn new(start_hour: i64, min_tenant: u32, max_tenant: u32) -> Result<Self, LabError> {
+        if min_tenant > max_tenant {
+            return Err(LabError::InvalidWindow);
+        }
+        let end_hour = start_hour.checked_add(23).ok_or(LabError::InvalidWindow)?;
+        Ok(Self {
+            start_hour,
+            end_hour,
+            min_tenant,
+            max_tenant,
+        })
+    }
+
+    fn validate(self, record: Record) -> Result<(), LabError> {
+        if !(self.min_tenant..=self.max_tenant).contains(&record.tenant_id)
+            || !(self.start_hour..=self.end_hour).contains(&record.unix_hour)
+        {
+            return Err(LabError::InvalidRecord(record.key()));
+        }
+        Ok(())
+    }
+}
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub enum LabError {
+    InvalidWindow,
+    InvalidRecord(BucketKey),
+    IncompatibleState,
+    InvalidState(&'static str),
+    InvalidStateFile(&'static str),
+    InvalidRecordFile(&'static str),
+    MissingOracle(BucketKey),
+    Publication(&'static str),
+    PublicationInterrupted,
+}
+
+impl Display for LabError {
+    fn fmt(&self, f: &mut Formatter<'_>) -> std::fmt::Result {
+        match self {
+            Self::InvalidWindow => f.write_str("invalid day window"),
+            Self::InvalidRecord(key) => write!(
+                f,
+                "record outside declared window: tenant={} hour={}",
+                key.tenant_id, key.unix_hour
+            ),
+            Self::IncompatibleState => f.write_str("incompatible sketch state"),
+            Self::InvalidState(reason) => write!(f, "invalid sketch state: {reason}"),
+            Self::InvalidStateFile(reason) => write!(f, "invalid state file: {reason}"),
+            Self::InvalidRecordFile(reason) => write!(f, "invalid record file: {reason}"),
+            Self::MissingOracle(key) => write!(
+                f,
+                "missing exact oracle bucket: tenant={} hour={}",
+                key.tenant_id, key.unix_hour
+            ),
+            Self::Publication(reason) => write!(f, "report publication failed: {reason}"),
+            Self::PublicationInterrupted => f.write_str("simulated interruption before rename"),
+        }
+    }
+}
+
+const HLL_PRECISION: u8 = 12;
+const HLL_REGISTER_COUNT: usize = 1 << HLL_PRECISION;
+const HLL_MAX_REGISTER: u8 = 65 - HLL_PRECISION;
+const STATE_HEADER_LEN: usize = 28;
+const STATE_VERSION: u8 = 1;
+const HASH_ALGORITHM: u16 = 1;
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct HllState {
+    hash_seed: u64,
+    registers: Box<[u8; HLL_REGISTER_COUNT]>,
+}
+
+impl HllState {
+    #[must_use]
+    pub fn new(hash_seed: u64) -> Self {
+        Self {
+            hash_seed,
+            registers: Box::new([0; HLL_REGISTER_COUNT]),
+        }
+    }
+
+    pub fn add(&mut self, installation_id: [u8; 16]) {
+        let hash = hash_installation(installation_id, self.hash_seed);
+        let index = usize::try_from(hash >> (u64::BITS - u32::from(HLL_PRECISION)))
+            .expect("12-bit register index fits usize");
+        let shifted = hash << HLL_PRECISION;
+        let rank = (shifted.leading_zeros() + 1).min(u32::from(HLL_MAX_REGISTER));
+        self.registers[index] =
+            self.registers[index].max(u8::try_from(rank).expect("rank is capped at 53"));
+    }
+
+    pub fn merge(&mut self, other: &Self) -> Result<(), LabError> {
+        if self.hash_seed != other.hash_seed {
+            return Err(LabError::IncompatibleState);
+        }
+        for (register, incoming) in self.registers.iter_mut().zip(other.registers.iter()) {
+            *register = (*register).max(*incoming);
+        }
+        Ok(())
+    }
+
+    #[must_use]
+    pub fn estimate(&self) -> f64 {
+        let register_count = 4_096.0;
+        let harmonic_sum: f64 = self
+            .registers
+            .iter()
+            .map(|&register| 2_f64.powi(-i32::from(register)))
+            .sum();
+        let alpha = 0.7213 / (1.0 + 1.079 / register_count);
+        let raw = alpha * register_count * register_count / harmonic_sum;
+        let zero_count = self
+            .registers
+            .iter()
+            .filter(|&&register| register == 0)
+            .count();
+        if zero_count > 0 {
+            let zero_count = u32::try_from(zero_count).expect("register count fits u32");
+            let linear = register_count * (register_count / f64::from(zero_count)).ln();
+            if linear <= 12_000.0 {
+                return linear;
+            }
+        }
+        raw
+    }
+
+    #[must_use]
+    pub fn to_bytes(&self) -> Vec<u8> {
+        let mut bytes = Vec::with_capacity(STATE_HEADER_LEN + HLL_REGISTER_COUNT);
+        bytes.extend_from_slice(b"RCHS");
+        bytes.push(STATE_VERSION);
+        bytes.push(HLL_PRECISION);
+        bytes.extend_from_slice(&HASH_ALGORITHM.to_le_bytes());
+        bytes.extend_from_slice(&self.hash_seed.to_le_bytes());
+        bytes.extend_from_slice(&4_096_u32.to_le_bytes());
+        bytes.extend_from_slice(&0_u64.to_le_bytes());
+        bytes.extend_from_slice(self.registers.as_slice());
+        let checksum = state_checksum(&bytes[..20], &bytes[STATE_HEADER_LEN..]);
+        bytes[20..STATE_HEADER_LEN].copy_from_slice(&checksum.to_le_bytes());
+        bytes
+    }
+
+    pub fn from_bytes(bytes: &[u8]) -> Result<Self, LabError> {
+        if bytes.len() != STATE_HEADER_LEN + HLL_REGISTER_COUNT {
+            return Err(LabError::InvalidState("wrong length"));
+        }
+        if &bytes[..4] != b"RCHS" {
+            return Err(LabError::InvalidState("wrong magic"));
+        }
+        if bytes[4] != STATE_VERSION {
+            return Err(LabError::InvalidState("unknown version"));
+        }
+        if bytes[5] != HLL_PRECISION {
+            return Err(LabError::InvalidState("unsupported precision"));
+        }
+        let algorithm = u16::from_le_bytes(bytes[6..8].try_into().expect("fixed slice"));
+        if algorithm != HASH_ALGORITHM {
+            return Err(LabError::InvalidState("unknown hash algorithm"));
+        }
+        let payload_len = u32::from_le_bytes(bytes[16..20].try_into().expect("fixed slice"));
+        if payload_len as usize != HLL_REGISTER_COUNT {
+            return Err(LabError::InvalidState("wrong register count"));
+        }
+        let expected_checksum =
+            u64::from_le_bytes(bytes[20..STATE_HEADER_LEN].try_into().expect("fixed slice"));
+        if state_checksum(&bytes[..20], &bytes[STATE_HEADER_LEN..]) != expected_checksum {
+            return Err(LabError::InvalidState("checksum mismatch"));
+        }
+        if bytes[STATE_HEADER_LEN..]
+            .iter()
+            .any(|&register| register > HLL_MAX_REGISTER)
+        {
+            return Err(LabError::InvalidState("impossible register value"));
+        }
+        let hash_seed = u64::from_le_bytes(bytes[8..16].try_into().expect("fixed slice"));
+        let mut registers = Box::new([0_u8; HLL_REGISTER_COUNT]);
+        registers.copy_from_slice(&bytes[STATE_HEADER_LEN..]);
+        Ok(Self {
+            hash_seed,
+            registers,
+        })
+    }
+}
+
+fn hash_installation(id: [u8; 16], seed: u64) -> u64 {
+    let low = u64::from_le_bytes(id[..8].try_into().expect("fixed slice"));
+    let high = u64::from_le_bytes(id[8..].try_into().expect("fixed slice"));
+    avalanche(
+        avalanche(low ^ seed) ^ avalanche(high ^ seed.rotate_left(29) ^ 0x9e37_79b9_7f4a_7c15),
+    )
+}
+
+fn avalanche(mut value: u64) -> u64 {
+    value ^= value >> 30;
+    value = value.wrapping_mul(0xbf58_476d_1ce4_e5b9);
+    value ^= value >> 27;
+    value = value.wrapping_mul(0x94d0_49bb_1331_11eb);
+    value ^ (value >> 31)
+}
+
+fn state_checksum(header: &[u8], registers: &[u8]) -> u64 {
+    let mut hash = 0xcbf2_9ce4_8422_2325_u64;
+    for byte in header.iter().chain(registers) {
+        hash ^= u64::from(*byte);
+        hash = hash.wrapping_mul(0x0000_0100_0000_01b3);
+    }
+    hash
+}
+
+impl Error for LabError {}
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct ApproxRollup {
+    window: DayWindow,
+    hash_seed: u64,
+    buckets: BTreeMap<BucketKey, HllState>,
+}
+
+impl ApproxRollup {
+    #[must_use]
+    pub fn new(window: DayWindow, hash_seed: u64) -> Self {
+        Self {
+            window,
+            hash_seed,
+            buckets: BTreeMap::new(),
+        }
+    }
+
+    pub fn add(&mut self, record: Record) -> Result<(), LabError> {
+        self.window.validate(record)?;
+        self.buckets
+            .entry(record.key())
+            .or_insert_with(|| HllState::new(self.hash_seed))
+            .add(record.installation_id);
+        Ok(())
+    }
+
+    pub fn merge(&mut self, other: &Self) -> Result<(), LabError> {
+        if self.window != other.window || self.hash_seed != other.hash_seed {
+            return Err(LabError::IncompatibleState);
+        }
+        for (key, state) in &other.buckets {
+            self.buckets
+                .entry(*key)
+                .or_insert_with(|| HllState::new(self.hash_seed))
+                .merge(state)?;
+        }
+        Ok(())
+    }
+
+    #[must_use]
+    pub fn state_file_bytes(&self) -> Vec<u8> {
+        let per_bucket = 12 + STATE_HEADER_LEN + HLL_REGISTER_COUNT;
+        let mut bytes = Vec::with_capacity(20 + self.buckets.len() * per_bucket);
+        bytes.extend_from_slice(b"RCHF");
+        bytes.push(2);
+        bytes.extend_from_slice(&[0; 3]);
+        let bucket_count = u32::try_from(self.buckets.len()).expect("bucket count fits u32");
+        bytes.extend_from_slice(&bucket_count.to_le_bytes());
+        bytes.extend_from_slice(&0_u64.to_le_bytes());
+        for (key, state) in &self.buckets {
+            bytes.extend_from_slice(&key.tenant_id.to_le_bytes());
+            bytes.extend_from_slice(&key.unix_hour.to_le_bytes());
+            bytes.extend_from_slice(&state.to_bytes());
+        }
+        let checksum = state_checksum(&bytes[..12], &bytes[20..]);
+        bytes[12..20].copy_from_slice(&checksum.to_le_bytes());
+        bytes
+    }
+
+    pub fn report_bytes(&self, exact: &ExactRollup) -> Result<Vec<u8>, LabError> {
+        if self.window != exact.window {
+            return Err(LabError::Publication("candidate/oracle bucket mismatch"));
+        }
+        let counts: BTreeMap<_, _> = exact
+            .buckets
+            .iter()
+            .map(|(key, ids)| (*key, ids.len()))
+            .collect();
+        self.report_from_counts(&counts)
+    }
+
+    pub fn report_from_counts(
+        &self,
+        counts: &BTreeMap<BucketKey, usize>,
+    ) -> Result<Vec<u8>, LabError> {
+        if self.buckets.len() != counts.len() {
+            return Err(LabError::Publication("candidate/oracle bucket mismatch"));
+        }
+        let mut report = String::from(
+            "tenant_id\tunix_hour\texact_count\testimate\tsigned_relative_error\tabsolute_relative_error\tserialized_size\n",
+        );
+        for (key, exact_count) in counts {
+            let state = self.buckets.get(key).ok_or(LabError::MissingOracle(*key))?;
+            let estimate = state.estimate();
+            let signed_error = (estimate - *exact_count as f64) / *exact_count as f64;
+            writeln!(
+                report,
+                "{}\t{}\t{}\t{estimate:.6}\t{signed_error:.9}\t{:.9}\t{}",
+                key.tenant_id,
+                key.unix_hour,
+                exact_count,
+                signed_error.abs(),
+                state.to_bytes().len()
+            )
+            .expect("writing to String cannot fail");
+        }
+        Ok(report.into_bytes())
+    }
+
+    pub fn from_state_file_bytes(
+        window: DayWindow,
+        hash_seed: u64,
+        bytes: &[u8],
+    ) -> Result<Self, LabError> {
+        if bytes.len() < 20 || &bytes[..4] != b"RCHF" {
+            return Err(LabError::InvalidStateFile("wrong header"));
+        }
+        if bytes[4] != 2 || bytes[5..8] != [0; 3] {
+            return Err(LabError::InvalidStateFile("unsupported version"));
+        }
+        let count = usize::try_from(u32::from_le_bytes(
+            bytes[8..12].try_into().expect("fixed slice"),
+        ))
+        .expect("u32 fits usize on supported targets");
+        let row_len = 12 + STATE_HEADER_LEN + HLL_REGISTER_COUNT;
+        let expected_len = 20_usize
+            .checked_add(
+                count
+                    .checked_mul(row_len)
+                    .ok_or(LabError::InvalidStateFile("length overflow"))?,
+            )
+            .ok_or(LabError::InvalidStateFile("length overflow"))?;
+        if bytes.len() != expected_len {
+            return Err(LabError::InvalidStateFile("wrong length"));
+        }
+        let expected_checksum = u64::from_le_bytes(bytes[12..20].try_into().expect("fixed slice"));
+        if state_checksum(&bytes[..12], &bytes[20..]) != expected_checksum {
+            return Err(LabError::InvalidStateFile("file checksum mismatch"));
+        }
+        let mut rollup = Self::new(window, hash_seed);
+        let mut last_key = None;
+        for row in bytes[20..].chunks_exact(row_len) {
+            let tenant_id = u32::from_le_bytes(row[..4].try_into().expect("fixed slice"));
+            let unix_hour = i64::from_le_bytes(row[4..12].try_into().expect("fixed slice"));
+            let key = BucketKey::new(tenant_id, unix_hour);
+            window.validate(Record::new(tenant_id, unix_hour, [0; 16]))?;
+            if last_key.is_some_and(|previous| previous >= key) {
+                return Err(LabError::InvalidStateFile("noncanonical or duplicate key"));
+            }
+            let state = HllState::from_bytes(&row[12..])?;
+            if state.hash_seed != hash_seed {
+                return Err(LabError::IncompatibleState);
+            }
+            rollup.buckets.insert(key, state);
+            last_key = Some(key);
+        }
+        Ok(rollup)
+    }
+
+    #[must_use]
+    pub fn bucket_count(&self) -> usize {
+        self.buckets.len()
+    }
+
+    #[must_use]
+    pub fn max_serialized_bucket_size(&self) -> usize {
+        self.buckets
+            .values()
+            .map(|state| state.to_bytes().len())
+            .max()
+            .unwrap_or(0)
+    }
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum PublishMode {
+    Commit,
+    InterruptAfterTemp,
+}
+
+pub fn publish_report(
+    path: &Path,
+    approx: &ApproxRollup,
+    exact: &ExactRollup,
+    mode: PublishMode,
+) -> Result<(), LabError> {
+    let bytes = approx.report_bytes(exact)?;
+    publish_atomic(path, &bytes, mode)
+}
+
+fn publish_atomic(path: &Path, bytes: &[u8], mode: PublishMode) -> Result<(), LabError> {
+    let temporary = path.with_extension("tmp");
+    let mut file = std::fs::File::create(&temporary)
+        .map_err(|_| LabError::Publication("create temporary report"))?;
+    file.write_all(bytes)
+        .map_err(|_| LabError::Publication("write temporary report"))?;
+    file.sync_all()
+        .map_err(|_| LabError::Publication("sync temporary report"))?;
+    drop(file);
+    if mode == PublishMode::InterruptAfterTemp {
+        let _ = std::fs::remove_file(&temporary);
+        return Err(LabError::PublicationInterrupted);
+    }
+    std::fs::rename(&temporary, path).map_err(|_| LabError::Publication("rename validated report"))
+}
+
+#[must_use]
+pub fn digest_bytes(bytes: &[u8]) -> u64 {
+    let mut hash = 0xcbf2_9ce4_8422_2325_u64;
+    for byte in bytes {
+        hash ^= u64::from(*byte);
+        hash = hash.wrapping_mul(0x0000_0100_0000_01b3);
+    }
+    hash
+}
+
+pub const ACCURACY_CARDINALITIES: [u64; 6] = [100, 500, 1_000, 5_000, 10_000, 50_000];
+pub const ACCURACY_SEEDS: u32 = 20;
+pub const ACCURACY_BUCKETS_PER_CARDINALITY: u32 = 24;
+
+#[derive(Debug, Clone)]
+pub struct AccuracyObservation {
+    pub seed: u32,
+    pub cardinality: u64,
+    pub bucket: u32,
+    pub estimate: f64,
+    pub signed_relative_error: f64,
+    pub absolute_relative_error: f64,
+}
+
+#[derive(Debug, Clone)]
+pub struct AccuracySummary {
+    pub median_absolute_error: f64,
+    pub p95_absolute_error: f64,
+    pub worst_absolute_error: f64,
+    pub positive_count: usize,
+    pub negative_count: usize,
+    pub positive_mean_error: f64,
+    pub negative_mean_error: f64,
+    pub worst_positive_case: (u32, u64, u32, f64),
+    pub worst_negative_case: (u32, u64, u32, f64),
+}
+
+#[derive(Debug, Clone)]
+pub struct AccuracyRun {
+    pub observations: Vec<AccuracyObservation>,
+    pub summary: AccuracySummary,
+}
+
+impl AccuracyRun {
+    #[must_use]
+    pub fn to_tsv(&self) -> String {
+        let mut output = String::from(
+            "seed\tcardinality\tbucket\testimate\tsigned_relative_error\tabsolute_relative_error\n",
+        );
+        for observation in &self.observations {
+            writeln!(
+                output,
+                "{}\t{}\t{}\t{:.6}\t{:.9}\t{:.9}",
+                observation.seed,
+                observation.cardinality,
+                observation.bucket,
+                observation.estimate,
+                observation.signed_relative_error,
+                observation.absolute_relative_error
+            )
+            .expect("writing to String cannot fail");
+        }
+        output
+    }
+}
+
+#[must_use]
+pub fn run_accuracy_matrix(hash_seed: u64, generator_seed: u64) -> AccuracyRun {
+    let capacity = usize::try_from(
+        u64::from(ACCURACY_SEEDS)
+            * u64::from(ACCURACY_BUCKETS_PER_CARDINALITY)
+            * ACCURACY_CARDINALITIES.len() as u64,
+    )
+    .expect("accuracy matrix fits usize");
+    let mut observations = Vec::with_capacity(capacity);
+    for seed in 0..ACCURACY_SEEDS {
+        for &cardinality in &ACCURACY_CARDINALITIES {
+            for bucket in 0..ACCURACY_BUCKETS_PER_CARDINALITY {
+                let mut state = HllState::new(hash_seed);
+                for id in 0..cardinality {
+                    state.add(accuracy_id(generator_seed, seed, cardinality, bucket, id));
+                }
+                for id in 0..(cardinality / 4) {
+                    state.add(accuracy_id(generator_seed, seed, cardinality, bucket, id));
+                }
+                let estimate = state.estimate();
+                let signed_relative_error = (estimate - cardinality as f64) / cardinality as f64;
+                observations.push(AccuracyObservation {
+                    seed,
+                    cardinality,
+                    bucket,
+                    estimate,
+                    signed_relative_error,
+                    absolute_relative_error: signed_relative_error.abs(),
+                });
+            }
+        }
+    }
+    let summary = summarize_accuracy(&observations);
+    AccuracyRun {
+        observations,
+        summary,
+    }
+}
+
+fn accuracy_id(generator_seed: u64, seed: u32, cardinality: u64, bucket: u32, id: u64) -> [u8; 16] {
+    let namespace = generator_seed
+        ^ u64::from(seed).rotate_left(11)
+        ^ cardinality.rotate_left(27)
+        ^ u64::from(bucket).rotate_left(43);
+    let input = namespace ^ id.wrapping_mul(0x9e37_79b9_7f4a_7c15);
+    let mut bytes = [0_u8; 16];
+    bytes[..8].copy_from_slice(&avalanche(input).to_le_bytes());
+    bytes[8..].copy_from_slice(&avalanche(input ^ 0xa409_3822_299f_31d0).to_le_bytes());
+    bytes
+}
+
+fn summarize_accuracy(observations: &[AccuracyObservation]) -> AccuracySummary {
+    let mut absolute: Vec<_> = observations
+        .iter()
+        .map(|observation| observation.absolute_relative_error)
+        .collect();
+    absolute.sort_by(f64::total_cmp);
+    let positive: Vec<_> = observations
+        .iter()
+        .filter(|observation| observation.signed_relative_error >= 0.0)
+        .collect();
+    let negative: Vec<_> = observations
+        .iter()
+        .filter(|observation| observation.signed_relative_error < 0.0)
+        .collect();
+    let worst_positive = positive
+        .iter()
+        .max_by(|left, right| {
+            left.signed_relative_error
+                .total_cmp(&right.signed_relative_error)
+        })
+        .expect("matrix has positive errors");
+    let worst_negative = negative
+        .iter()
+        .min_by(|left, right| {
+            left.signed_relative_error
+                .total_cmp(&right.signed_relative_error)
+        })
+        .expect("matrix has negative errors");
+    AccuracySummary {
+        median_absolute_error: nearest_rank(&absolute, 1, 2),
+        p95_absolute_error: nearest_rank(&absolute, 95, 100),
+        worst_absolute_error: *absolute.last().expect("matrix is nonempty"),
+        positive_count: positive.len(),
+        negative_count: negative.len(),
+        positive_mean_error: positive
+            .iter()
+            .map(|observation| observation.signed_relative_error)
+            .sum::<f64>()
+            / positive.len() as f64,
+        negative_mean_error: negative
+            .iter()
+            .map(|observation| observation.signed_relative_error)
+            .sum::<f64>()
+            / negative.len() as f64,
+        worst_positive_case: (
+            worst_positive.seed,
+            worst_positive.cardinality,
+            worst_positive.bucket,
+            worst_positive.signed_relative_error,
+        ),
+        worst_negative_case: (
+            worst_negative.seed,
+            worst_negative.cardinality,
+            worst_negative.bucket,
+            worst_negative.signed_relative_error,
+        ),
+    }
+}
+
+#[derive(Debug, Clone)]
+pub struct LoadErrorSummary {
+    pub median_absolute_error: f64,
+    pub p95_absolute_error: f64,
+    pub worst_absolute_error: f64,
+    pub positive_count: usize,
+    pub negative_count: usize,
+    pub positive_mean_error: f64,
+    pub negative_mean_error: f64,
+}
+
+#[derive(Debug, Clone)]
+pub struct LoadVerification {
+    pub record_count: u64,
+    pub unique_bucket_occurrences: usize,
+    pub bucket_count: usize,
+    pub cardinality_1k_buckets: usize,
+    pub cardinality_5k_buckets: usize,
+    pub cardinality_10k_buckets: usize,
+    pub duplicates_byte_identical: bool,
+    pub direct_and_sharded_byte_identical: bool,
+    pub merge_permutation_digests: Vec<u64>,
+    pub repeated_state_byte_identical: bool,
+    pub repeated_report_byte_identical: bool,
+    pub max_serialized_bucket_size: usize,
+    pub total_serialized_bucket_state: usize,
+    pub state_digest: u64,
+    pub report_digest: u64,
+    pub summary_digest: u64,
+    pub errors: LoadErrorSummary,
+    pub report_bytes: Vec<u8>,
+}
+
+#[derive(Debug, Clone)]
+pub struct BenchmarkResult {
+    pub mode: &'static str,
+    pub record_count: u64,
+    pub bucket_count: usize,
+    pub unique_bucket_occurrences: Option<usize>,
+    pub max_serialized_bucket_size: Option<usize>,
+    pub digest: u64,
+}
+
+pub fn run_exact_benchmark() -> Result<BenchmarkResult, LabError> {
+    let window = DayWindow::new(0, 0, 239)?;
+    let corpus = LoadCorpus::new(0x243f_6a88_85a3_08d3);
+    let mut rollup = ExactRollup::new(window);
+    let mut record_count = 0_u64;
+    for shard in 0..LOAD_SHARDS {
+        for record in corpus.shard(shard)? {
+            rollup.add(record)?;
+            record_count += 1;
+        }
+    }
+    let counts = rollup.into_counts();
+    let unique_bucket_occurrences = counts.values().sum();
+    let mut canonical_counts = Vec::with_capacity(counts.len() * 20);
+    for (key, count) in &counts {
+        canonical_counts.extend_from_slice(&key.tenant_id.to_le_bytes());
+        canonical_counts.extend_from_slice(&key.unix_hour.to_le_bytes());
+        canonical_counts.extend_from_slice(&(*count as u64).to_le_bytes());
+    }
+    Ok(BenchmarkResult {
+        mode: "exact",
+        record_count,
+        bucket_count: counts.len(),
+        unique_bucket_occurrences: Some(unique_bucket_occurrences),
+        max_serialized_bucket_size: None,
+        digest: digest_bytes(&canonical_counts),
+    })
+}
+
+pub fn run_candidate_benchmark() -> Result<BenchmarkResult, LabError> {
+    let window = DayWindow::new(0, 0, 239)?;
+    let corpus = LoadCorpus::new(0x243f_6a88_85a3_08d3);
+    let rollup = aggregate_candidate_all(corpus, window, 0xbb67_ae85_84ca_a73b)?;
+    let state_bytes = rollup.state_file_bytes();
+    Ok(BenchmarkResult {
+        mode: "candidate",
+        record_count: LOAD_RECORDS,
+        bucket_count: rollup.bucket_count(),
+        unique_bucket_occurrences: None,
+        max_serialized_bucket_size: Some(rollup.max_serialized_bucket_size()),
+        digest: digest_bytes(&state_bytes),
+    })
+}
+
+pub fn run_load_verification(temporary: &Path) -> Result<LoadVerification, LabError> {
+    if temporary.exists() {
+        std::fs::remove_dir_all(temporary)
+            .map_err(|_| LabError::Publication("clear load temporary directory"))?;
+    }
+    std::fs::create_dir_all(temporary)
+        .map_err(|_| LabError::Publication("create load temporary directory"))?;
+    let result = run_load_verification_inner(temporary);
+    let cleanup = std::fs::remove_dir_all(temporary)
+        .map_err(|_| LabError::Publication("remove load temporary directory"));
+    match (result, cleanup) {
+        (Ok(value), Ok(())) => Ok(value),
+        (Err(error), _) | (Ok(_), Err(error)) => Err(error),
+    }
+}
+
+fn run_load_verification_inner(temporary: &Path) -> Result<LoadVerification, LabError> {
+    const ID_SEED: u64 = 0x243f_6a88_85a3_08d3;
+    const HASH_SEED: u64 = 0xbb67_ae85_84ca_a73b;
+    let window = DayWindow::new(0, 0, 239)?;
+    let corpus = LoadCorpus::new(ID_SEED);
+
+    let mut exact = ExactRollup::new(window);
+    let mut record_count = 0_u64;
+    for shard in 0..LOAD_SHARDS {
+        for record in corpus.shard(shard)? {
+            exact.add(record)?;
+            record_count += 1;
+        }
+    }
+    let counts = exact.into_counts();
+    let unique_bucket_occurrences: usize = counts.values().sum();
+    let cardinality_1k_buckets = counts.values().filter(|&&count| count == 1_000).count();
+    let cardinality_5k_buckets = counts.values().filter(|&&count| count == 5_000).count();
+    let cardinality_10k_buckets = counts.values().filter(|&&count| count == 10_000).count();
+
+    let direct = aggregate_candidate_all(corpus, window, HASH_SEED)?;
+    let direct_bytes = direct.state_file_bytes();
+    let report_bytes = direct.report_from_counts(&counts)?;
+    let errors = load_error_summary(&direct, &counts)?;
+    let max_serialized_bucket_size = direct.max_serialized_bucket_size();
+    let total_serialized_bucket_state = max_serialized_bucket_size * direct.bucket_count();
+    let state_digest = digest_bytes(&direct_bytes);
+    let report_digest = digest_bytes(&report_bytes);
+
+    let mut unique_only = ApproxRollup::new(window, HASH_SEED);
+    for index in 0..LOAD_UNIQUE_OCCURRENCES {
+        unique_only.add(
+            corpus
+                .logical(index)
+                .ok_or(LabError::InvalidRecordFile("missing unique record"))?,
+        )?;
+    }
+    let duplicates_byte_identical = unique_only.state_file_bytes() == direct_bytes;
+    drop(unique_only);
+    drop(direct);
+
+    for shard in 0..LOAD_SHARDS {
+        let mut shard_rollup = ApproxRollup::new(window, HASH_SEED);
+        for record in corpus.shard(shard)? {
+            shard_rollup.add(record)?;
+        }
+        std::fs::write(
+            temporary.join(format!("shard-{shard}.state")),
+            shard_rollup.state_file_bytes(),
+        )
+        .map_err(|_| LabError::Publication("write temporary shard state"))?;
+    }
+
+    let direct_reference = ApproxRollup::from_state_file_bytes(window, HASH_SEED, &direct_bytes)?;
+    let mut merged = ApproxRollup::new(window, HASH_SEED);
+    for shard in 0..LOAD_SHARDS {
+        let shard_rollup = read_shard_rollup(temporary, shard, window, HASH_SEED)?;
+        merged.merge(&shard_rollup)?;
+    }
+    let direct_and_sharded_byte_identical = merged.state_file_bytes() == direct_bytes;
+    drop(merged);
+
+    let mut merge_permutation_digests = Vec::with_capacity(50);
+    for seed in 0_u64..50 {
+        let mut permuted = ApproxRollup::new(window, HASH_SEED);
+        for shard in shuffled_shard_order(seed + 1) {
+            let shard_rollup = read_shard_rollup(temporary, shard, window, HASH_SEED)?;
+            permuted.merge(&shard_rollup)?;
+        }
+        if permuted != direct_reference {
+            return Err(LabError::InvalidStateFile("merge permutation mismatch"));
+        }
+        merge_permutation_digests.push(digest_bytes(&permuted.state_file_bytes()));
+    }
+
+    let repeated = aggregate_candidate_all(corpus, window, HASH_SEED)?;
+    let repeated_state_byte_identical = repeated.state_file_bytes() == direct_bytes;
+    let repeated_report_byte_identical = repeated.report_from_counts(&counts)? == report_bytes;
+
+    let summary_bytes = format!(
+        "records={record_count}\nunique={unique_bucket_occurrences}\nbuckets={}\nstate_digest={state_digest:016x}\nreport_digest={report_digest:016x}\n",
+        counts.len()
+    );
+    Ok(LoadVerification {
+        record_count,
+        unique_bucket_occurrences,
+        bucket_count: counts.len(),
+        cardinality_1k_buckets,
+        cardinality_5k_buckets,
+        cardinality_10k_buckets,
+        duplicates_byte_identical,
+        direct_and_sharded_byte_identical,
+        merge_permutation_digests,
+        repeated_state_byte_identical,
+        repeated_report_byte_identical,
+        max_serialized_bucket_size,
+        total_serialized_bucket_state,
+        state_digest,
+        report_digest,
+        summary_digest: digest_bytes(summary_bytes.as_bytes()),
+        errors,
+        report_bytes,
+    })
+}
+
+fn aggregate_candidate_all(
+    corpus: LoadCorpus,
+    window: DayWindow,
+    hash_seed: u64,
+) -> Result<ApproxRollup, LabError> {
+    let mut rollup = ApproxRollup::new(window, hash_seed);
+    for shard in 0..LOAD_SHARDS {
+        for record in corpus.shard(shard)? {
+            rollup.add(record)?;
+        }
+    }
+    Ok(rollup)
+}
+
+fn read_shard_rollup(
+    temporary: &Path,
+    shard: usize,
+    window: DayWindow,
+    hash_seed: u64,
+) -> Result<ApproxRollup, LabError> {
+    let bytes = std::fs::read(temporary.join(format!("shard-{shard}.state")))
+        .map_err(|_| LabError::Publication("read temporary shard state"))?;
+    ApproxRollup::from_state_file_bytes(window, hash_seed, &bytes)
+}
+
+fn shuffled_shard_order(seed: u64) -> [usize; LOAD_SHARDS] {
+    let mut order = [0, 1, 2, 3, 4, 5, 6, 7];
+    let mut state = seed;
+    for index in (1..LOAD_SHARDS).rev() {
+        state ^= state >> 12;
+        state ^= state << 25;
+        state ^= state >> 27;
+        let modulus = u64::try_from(index + 1).expect("shard index fits u64");
+        let swap = usize::try_from(state.wrapping_mul(0x2545_f491_4f6c_dd1d) % modulus)
+            .expect("swap index fits usize");
+        order.swap(index, swap);
+    }
+    order
+}
+
+fn load_error_summary(
+    rollup: &ApproxRollup,
+    counts: &BTreeMap<BucketKey, usize>,
+) -> Result<LoadErrorSummary, LabError> {
+    let mut signed = Vec::with_capacity(counts.len());
+    for (key, exact_count) in counts {
+        let state = rollup
+            .buckets
+            .get(key)
+            .ok_or(LabError::MissingOracle(*key))?;
+        signed.push((state.estimate() - *exact_count as f64) / *exact_count as f64);
+    }
+    let mut absolute: Vec<_> = signed.iter().map(|error| error.abs()).collect();
+    absolute.sort_by(f64::total_cmp);
+    let positive: Vec<_> = signed
+        .iter()
+        .copied()
+        .filter(|error| *error >= 0.0)
+        .collect();
+    let negative: Vec<_> = signed
+        .iter()
+        .copied()
+        .filter(|error| *error < 0.0)
+        .collect();
+    Ok(LoadErrorSummary {
+        median_absolute_error: nearest_rank(&absolute, 1, 2),
+        p95_absolute_error: nearest_rank(&absolute, 95, 100),
+        worst_absolute_error: *absolute.last().expect("load has buckets"),
+        positive_count: positive.len(),
+        negative_count: negative.len(),
+        positive_mean_error: positive.iter().sum::<f64>() / positive.len() as f64,
+        negative_mean_error: negative.iter().sum::<f64>() / negative.len() as f64,
+    })
+}
+
+#[derive(Debug, Clone)]
+pub struct AdversarialVerification {
+    pub id_pattern_cases: usize,
+    pub worst_absolute_error: f64,
+    pub reverse_order_byte_identical: bool,
+    pub thousand_duplicates_byte_identical: bool,
+    pub hot_shard_merge_byte_identical: bool,
+    pub empty_input_is_empty: bool,
+    pub one_bucket_is_one_bucket: bool,
+}
+
+pub fn run_adversarial_verification() -> Result<AdversarialVerification, LabError> {
+    const HASH_SEED: u64 = 0xbb67_ae85_84ca_a73b;
+    let sequential: Vec<_> = (0_u64..10_000).map(sequential_id).collect();
+    let shared_prefix: Vec<_> = (0_u8..=u8::MAX)
+        .map(|last| {
+            let mut id = [0xab; 16];
+            id[15] = last;
+            id
+        })
+        .collect();
+    let one_changing_byte: Vec<_> = std::iter::once([0_u8; 16])
+        .chain((0_usize..16).flat_map(|position| {
+            (1_u8..=u8::MAX).map(move |value| {
+                let mut id = [0_u8; 16];
+                id[position] = value;
+                id
+            })
+        }))
+        .collect();
+    let mut reverse = sequential.clone();
+    reverse.reverse();
+    let patterns = [&sequential, &shared_prefix, &one_changing_byte, &reverse];
+    let mut worst_absolute_error = 0.0_f64;
+    for pattern in patterns {
+        let mut state = HllState::new(HASH_SEED);
+        for &id in pattern {
+            state.add(id);
+        }
+        let error = (state.estimate() - pattern.len() as f64).abs() / pattern.len() as f64;
+        worst_absolute_error = worst_absolute_error.max(error);
+    }
+
+    let mut forward_state = HllState::new(HASH_SEED);
+    let mut reverse_state = HllState::new(HASH_SEED);
+    for &id in &sequential {
+        forward_state.add(id);
+    }
+    for &id in &reverse {
+        reverse_state.add(id);
+    }
+    let reverse_order_byte_identical = forward_state.to_bytes() == reverse_state.to_bytes();
+
+    let mut duplicated = HllState::new(HASH_SEED);
+    for &id in sequential.iter().take(128) {
+        duplicated.add(id);
+    }
+    let before_duplicates = duplicated.to_bytes();
+    for _ in 0..1_000 {
+        for &id in sequential.iter().take(128) {
+            duplicated.add(id);
+        }
+    }
+    let thousand_duplicates_byte_identical = duplicated.to_bytes() == before_duplicates;
+
+    let window = DayWindow::new(0, 0, 1)?;
+    let mut direct = ApproxRollup::new(window, HASH_SEED);
+    let mut shards: Vec<_> = (0..LOAD_SHARDS)
+        .map(|_| ApproxRollup::new(window, HASH_SEED))
+        .collect();
+    for value in 0_u64..2_000 {
+        let record = Record::new(0, 0, sequential_id(value));
+        direct.add(record)?;
+        shards[0].add(record)?;
+    }
+    for value in 0_u64..100 {
+        let record = Record::new(1, 0, sequential_id(value ^ (1_u64 << 63)));
+        direct.add(record)?;
+        let shard = 1 + usize::try_from(value % 7).expect("value modulo seven fits usize");
+        shards[shard].add(record)?;
+    }
+    let mut hot_merged = ApproxRollup::new(window, HASH_SEED);
+    for shard in shards {
+        hot_merged.merge(&shard)?;
+    }
+    let hot_shard_merge_byte_identical = hot_merged.state_file_bytes() == direct.state_file_bytes();
+
+    let empty = ApproxRollup::new(window, HASH_SEED);
+    let empty_input_is_empty = empty.bucket_count() == 0 && empty.state_file_bytes().len() == 20;
+    let mut one = ApproxRollup::new(window, HASH_SEED);
+    one.add(Record::new(0, 0, [7; 16]))?;
+
+    Ok(AdversarialVerification {
+        id_pattern_cases: 4,
+        worst_absolute_error,
+        reverse_order_byte_identical,
+        thousand_duplicates_byte_identical,
+        hot_shard_merge_byte_identical,
+        empty_input_is_empty,
+        one_bucket_is_one_bucket: one.bucket_count() == 1,
+    })
+}
+
+fn sequential_id(value: u64) -> [u8; 16] {
+    let mut id = [0_u8; 16];
+    id[8..].copy_from_slice(&value.to_be_bytes());
+    id
+}
+
+fn nearest_rank(sorted: &[f64], numerator: usize, denominator: usize) -> f64 {
+    let rank = sorted.len().saturating_mul(numerator).div_ceil(denominator);
+    sorted[rank.saturating_sub(1)]
+}
+
+pub const LOAD_UNIQUE_OCCURRENCES: u64 = 10_800_000;
+pub const LOAD_RECORDS: u64 = 12_000_000;
+pub const LOAD_SHARDS: usize = 8;
+const LOAD_RECORDS_PER_SHARD: u64 = LOAD_RECORDS / LOAD_SHARDS as u64;
+const UNIQUE_PER_TENANT: u64 = 45_000;
+const SHUFFLE_MULTIPLIER: u64 = 1_000_003;
+
+#[derive(Debug, Clone, Copy)]
+pub struct LoadCorpus {
+    id_seed: u64,
+}
+
+impl LoadCorpus {
+    #[must_use]
+    pub const fn new(id_seed: u64) -> Self {
+        Self { id_seed }
+    }
+
+    #[must_use]
+    pub fn logical(self, index: u64) -> Option<Record> {
+        if index >= LOAD_RECORDS {
+            return None;
+        }
+        let unique_index = if index < LOAD_UNIQUE_OCCURRENCES {
+            index
+        } else {
+            (index - LOAD_UNIQUE_OCCURRENCES).wrapping_mul(SHUFFLE_MULTIPLIER)
+                % LOAD_UNIQUE_OCCURRENCES
+        };
+        let tenant_id = u32::try_from(unique_index / UNIQUE_PER_TENANT).ok()?;
+        let within_tenant = unique_index % UNIQUE_PER_TENANT;
+        let (unix_hour, within_bucket) = if within_tenant < 20_000 {
+            (within_tenant / 1_000, within_tenant % 1_000)
+        } else if within_tenant < 35_000 {
+            let offset = within_tenant - 20_000;
+            (20 + offset / 5_000, offset % 5_000)
+        } else {
+            (23, within_tenant - 35_000)
+        };
+        let bucket_ordinal = u64::from(tenant_id) * 24 + unix_hour;
+        let id_input = (bucket_ordinal << 32) ^ within_bucket ^ self.id_seed;
+        let low = avalanche(id_input);
+        let high = avalanche(id_input ^ 0xd1b5_4a32_d192_ed03);
+        let mut installation_id = [0_u8; 16];
+        installation_id[..8].copy_from_slice(&low.to_le_bytes());
+        installation_id[8..].copy_from_slice(&high.to_le_bytes());
+        Some(Record::new(
+            tenant_id,
+            i64::try_from(unix_hour).expect("hour is at most 23"),
+            installation_id,
+        ))
+    }
+
+    pub fn shard(self, shard: usize) -> Result<ShardRecords, LabError> {
+        if shard >= LOAD_SHARDS {
+            return Err(LabError::InvalidRecordFile("shard index out of range"));
+        }
+        Ok(ShardRecords {
+            corpus: self,
+            shard,
+            position: 0,
+        })
+    }
+}
+
+pub struct ShardRecords {
+    corpus: LoadCorpus,
+    shard: usize,
+    position: u64,
+}
+
+impl Iterator for ShardRecords {
+    type Item = Record;
+
+    fn next(&mut self) -> Option<Self::Item> {
+        if self.position >= LOAD_RECORDS_PER_SHARD {
+            return None;
+        }
+        let offset = (self.shard as u64 * 104_729 + 17) % LOAD_RECORDS_PER_SHARD;
+        let shuffled =
+            (self.position.wrapping_mul(SHUFFLE_MULTIPLIER) + offset) % LOAD_RECORDS_PER_SHARD;
+        let logical_index = shuffled * LOAD_SHARDS as u64 + self.shard as u64;
+        self.position += 1;
+        self.corpus.logical(logical_index)
+    }
+
+    fn size_hint(&self) -> (usize, Option<usize>) {
+        let remaining = LOAD_RECORDS_PER_SHARD - self.position;
+        let remaining = usize::try_from(remaining).expect("shard length fits usize");
+        (remaining, Some(remaining))
+    }
+}
+
+impl ExactSizeIterator for ShardRecords {}
+
+const RECORD_HEADER_LEN: usize = 16;
+const RECORD_LEN: usize = 28;
+
+#[must_use]
+pub fn encode_record_file(records: &[Record]) -> Vec<u8> {
+    let mut bytes = Vec::with_capacity(RECORD_HEADER_LEN + RECORD_LEN * records.len());
+    bytes.extend_from_slice(b"RREC");
+    bytes.push(1);
+    bytes.extend_from_slice(&[0; 3]);
+    bytes.extend_from_slice(&(records.len() as u64).to_le_bytes());
+    for record in records {
+        bytes.extend_from_slice(&record.tenant_id.to_le_bytes());
+        bytes.extend_from_slice(&record.unix_hour.to_le_bytes());
+        bytes.extend_from_slice(&record.installation_id);
+    }
+    bytes
+}
+
+pub fn stream_record_file<R, F>(
+    mut reader: R,
+    window: DayWindow,
+    mut consume: F,
+) -> Result<u64, LabError>
+where
+    R: Read,
+    F: FnMut(Record) -> Result<(), LabError>,
+{
+    let mut header = [0_u8; RECORD_HEADER_LEN];
+    read_fully(&mut reader, &mut header, "truncated header")?;
+    if &header[..4] != b"RREC" {
+        return Err(LabError::InvalidRecordFile("wrong magic"));
+    }
+    if header[4] != 1 {
+        return Err(LabError::InvalidRecordFile("unknown version"));
+    }
+    if header[5..8] != [0; 3] {
+        return Err(LabError::InvalidRecordFile("nonzero reserved bytes"));
+    }
+    let count = u64::from_le_bytes(header[8..16].try_into().expect("fixed slice"));
+    let mut encoded = [0_u8; RECORD_LEN];
+    for _ in 0..count {
+        read_fully(&mut reader, &mut encoded, "truncated record")?;
+        let tenant_id = u32::from_le_bytes(encoded[..4].try_into().expect("fixed slice"));
+        let unix_hour = i64::from_le_bytes(encoded[4..12].try_into().expect("fixed slice"));
+        let installation_id = encoded[12..].try_into().expect("fixed slice");
+        let record = Record::new(tenant_id, unix_hour, installation_id);
+        window.validate(record)?;
+        consume(record)?;
+    }
+    let mut trailing = [0_u8; 1];
+    match reader.read(&mut trailing) {
+        Ok(0) => Ok(count),
+        Ok(_) => Err(LabError::InvalidRecordFile("trailing bytes")),
+        Err(_) => Err(LabError::InvalidRecordFile("read failure")),
+    }
+}
+
+fn read_fully(
+    reader: &mut impl Read,
+    bytes: &mut [u8],
+    reason: &'static str,
+) -> Result<(), LabError> {
+    reader
+        .read_exact(bytes)
+        .map_err(|_| LabError::InvalidRecordFile(reason))
+}
+
+#[derive(Debug)]
+pub struct ExactRollup {
+    window: DayWindow,
+    buckets: BTreeMap<BucketKey, HashSet<[u8; 16]>>,
+}
+
+impl ExactRollup {
+    #[must_use]
+    pub fn new(window: DayWindow) -> Self {
+        Self {
+            window,
+            buckets: BTreeMap::new(),
+        }
+    }
+
+    pub fn add(&mut self, record: Record) -> Result<(), LabError> {
+        self.window.validate(record)?;
+        self.buckets
+            .entry(record.key())
+            .or_default()
+            .insert(record.installation_id);
+        Ok(())
+    }
+
+    #[must_use]
+    pub fn count(&self, key: BucketKey) -> Option<usize> {
+        self.buckets.get(&key).map(HashSet::len)
+    }
+
+    #[must_use]
+    pub fn bucket_count(&self) -> usize {
+        self.buckets.len()
+    }
+
+    #[must_use]
+    pub fn into_counts(self) -> BTreeMap<BucketKey, usize> {
+        self.buckets
+            .into_iter()
+            .map(|(key, ids)| (key, ids.len()))
+            .collect()
+    }
+}
diff --git a/developer-simulation/runs/2026-08-17--mergeable-unique-installation-reach-rollups/src/main.rs b/developer-simulation/runs/2026-08-17--mergeable-unique-installation-reach-rollups/src/main.rs
new file mode 100644
index 0000000..3507ee2
--- /dev/null
+++ b/developer-simulation/runs/2026-08-17--mergeable-unique-installation-reach-rollups/src/main.rs
@@ -0,0 +1,332 @@
+use std::fmt::Write as _;
+use std::path::Path;
+use std::process::ExitCode;
+
+use reach_rollup_lab::{
+    AccuracyRun, AdversarialVerification, BenchmarkResult, LoadErrorSummary, LoadVerification,
+    run_accuracy_matrix, run_adversarial_verification, run_candidate_benchmark,
+    run_exact_benchmark, run_load_verification,
+};
+
+const HASH_SEED: u64 = 0xbb67_ae85_84ca_a73b;
+const TUNING_GENERATOR_SEED: u64 = 0x1319_8a2e_0370_7344;
+const HELD_OUT_GENERATOR_SEED: u64 = 0x082e_fa98_ec4e_6c89;
+
+fn main() -> ExitCode {
+    let arguments: Vec<_> = std::env::args().skip(1).collect();
+    match run(&arguments) {
+        Ok(()) => ExitCode::SUCCESS,
+        Err(error) => {
+            eprintln!("{error}");
+            ExitCode::FAILURE
+        }
+    }
+}
+
+fn run(arguments: &[String]) -> Result<(), String> {
+    match arguments {
+        [flag] if flag == "--help" || flag == "-h" => {
+            print_help();
+            Ok(())
+        }
+        [command] if command == "bench-exact" => {
+            print_benchmark(&run_exact_benchmark().map_err(|error| error.to_string())?);
+            Ok(())
+        }
+        [command] if command == "bench-candidate" => {
+            print_benchmark(&run_candidate_benchmark().map_err(|error| error.to_string())?);
+            Ok(())
+        }
+        [command, evidence, temporary] if command == "demo" => {
+            run_demo(Path::new(evidence), Path::new(temporary))
+        }
+        [] => {
+            print_help();
+            Ok(())
+        }
+        [command, ..] => Err(format!("unknown command or wrong arguments: {command}")),
+    }
+}
+
+fn print_help() {
+    println!(
+        "reach-rollup-lab\n\n  demo <evidence-dir> <temporary-dir>\n  bench-exact\n  bench-candidate"
+    );
+}
+
+fn print_benchmark(result: &BenchmarkResult) {
+    println!("mode={}", result.mode);
+    println!("records={}", result.record_count);
+    println!("buckets={}", result.bucket_count);
+    if let Some(unique) = result.unique_bucket_occurrences {
+        println!("unique_bucket_occurrences={unique}");
+    }
+    if let Some(size) = result.max_serialized_bucket_size {
+        println!("max_serialized_bucket_size={size}");
+    }
+    println!("digest={:016x}", result.digest);
+}
+
+fn run_demo(evidence: &Path, temporary: &Path) -> Result<(), String> {
+    std::fs::create_dir_all(evidence).map_err(|error| error.to_string())?;
+    let tuning = run_accuracy_matrix(HASH_SEED, TUNING_GENERATOR_SEED);
+    let held_out = run_accuracy_matrix(HASH_SEED, HELD_OUT_GENERATOR_SEED);
+    require_accuracy_gate("tuning", &tuning)?;
+    require_accuracy_gate("held-out", &held_out)?;
+    write_atomic(
+        &evidence.join("accuracy-tuning.tsv"),
+        tuning.to_tsv().as_bytes(),
+    )?;
+    write_atomic(
+        &evidence.join("accuracy-heldout.tsv"),
+        held_out.to_tsv().as_bytes(),
+    )?;
+
+    let load = run_load_verification(temporary).map_err(|error| error.to_string())?;
+    let adversarial = run_adversarial_verification().map_err(|error| error.to_string())?;
+    write_atomic(&evidence.join("load-report.tsv"), &load.report_bytes)?;
+    let mut summary = String::new();
+    writeln!(summary, "format_version=1").unwrap();
+    writeln!(summary, "state_file_version=2").unwrap();
+    writeln!(summary, "hash_algorithm=splitmix64-avalanche-v1").unwrap();
+    writeln!(summary, "hash_seed={HASH_SEED:#018x}").unwrap();
+    writeln!(
+        summary,
+        "load_generator_seed={:#018x}",
+        0x243f_6a88_85a3_08d3_u64
+    )
+    .unwrap();
+    writeln!(
+        summary,
+        "tuning_generator_seed={TUNING_GENERATOR_SEED:#018x}"
+    )
+    .unwrap();
+    writeln!(
+        summary,
+        "held_out_generator_seed={HELD_OUT_GENERATOR_SEED:#018x}"
+    )
+    .unwrap();
+    append_accuracy_summary(&mut summary, "tuning", &tuning);
+    append_accuracy_summary(&mut summary, "heldout", &held_out);
+    append_load_summary(&mut summary, &load);
+    append_adversarial_summary(&mut summary, &adversarial);
+    write_atomic(&evidence.join("summary.txt"), summary.as_bytes())?;
+    print!("{summary}");
+    Ok(())
+}
+
+fn append_load_summary(summary: &mut String, load: &LoadVerification) {
+    writeln!(summary, "load_records={}", load.record_count).unwrap();
+    writeln!(
+        summary,
+        "load_unique_bucket_occurrences={}",
+        load.unique_bucket_occurrences
+    )
+    .unwrap();
+    writeln!(summary, "load_buckets={}", load.bucket_count).unwrap();
+    writeln!(summary, "load_1k_buckets={}", load.cardinality_1k_buckets).unwrap();
+    writeln!(summary, "load_5k_buckets={}", load.cardinality_5k_buckets).unwrap();
+    writeln!(summary, "load_10k_buckets={}", load.cardinality_10k_buckets).unwrap();
+    writeln!(
+        summary,
+        "state_size_max={}",
+        load.max_serialized_bucket_size
+    )
+    .unwrap();
+    writeln!(
+        summary,
+        "total_serialized_bucket_state={}",
+        load.total_serialized_bucket_state
+    )
+    .unwrap();
+    writeln!(
+        summary,
+        "duplicates_byte_identical={}",
+        load.duplicates_byte_identical
+    )
+    .unwrap();
+    writeln!(
+        summary,
+        "direct_sharded_byte_identical={}",
+        load.direct_and_sharded_byte_identical
+    )
+    .unwrap();
+    writeln!(
+        summary,
+        "merge_permutations={}",
+        load.merge_permutation_digests.len()
+    )
+    .unwrap();
+    writeln!(
+        summary,
+        "merge_permutations_all_equal={}",
+        load.merge_permutation_digests
+            .iter()
+            .all(|digest| *digest == load.state_digest)
+    )
+    .unwrap();
+    writeln!(
+        summary,
+        "repeated_state_byte_identical={}",
+        load.repeated_state_byte_identical
+    )
+    .unwrap();
+    writeln!(
+        summary,
+        "repeated_report_byte_identical={}",
+        load.repeated_report_byte_identical
+    )
+    .unwrap();
+    writeln!(summary, "state_digest={:016x}", load.state_digest).unwrap();
+    writeln!(summary, "report_digest={:016x}", load.report_digest).unwrap();
+    writeln!(summary, "summary_digest={:016x}", load.summary_digest).unwrap();
+    append_load_error_summary(summary, &load.errors);
+}
+
+fn append_load_error_summary(summary: &mut String, errors: &LoadErrorSummary) {
+    writeln!(
+        summary,
+        "load_error_median={:.9}",
+        errors.median_absolute_error
+    )
+    .unwrap();
+    writeln!(summary, "load_error_p95={:.9}", errors.p95_absolute_error).unwrap();
+    writeln!(
+        summary,
+        "load_error_worst={:.9}",
+        errors.worst_absolute_error
+    )
+    .unwrap();
+    writeln!(summary, "load_positive_count={}", errors.positive_count).unwrap();
+    writeln!(summary, "load_negative_count={}", errors.negative_count).unwrap();
+    writeln!(
+        summary,
+        "load_positive_mean={:.9}",
+        errors.positive_mean_error
+    )
+    .unwrap();
+    writeln!(
+        summary,
+        "load_negative_mean={:.9}",
+        errors.negative_mean_error
+    )
+    .unwrap();
+}
+
+fn append_adversarial_summary(summary: &mut String, adversarial: &AdversarialVerification) {
+    writeln!(
+        summary,
+        "adversarial_id_patterns={}",
+        adversarial.id_pattern_cases
+    )
+    .unwrap();
+    writeln!(
+        summary,
+        "adversarial_worst_absolute_error={:.9}",
+        adversarial.worst_absolute_error
+    )
+    .unwrap();
+    writeln!(
+        summary,
+        "reverse_order_byte_identical={}",
+        adversarial.reverse_order_byte_identical
+    )
+    .unwrap();
+    writeln!(
+        summary,
+        "thousand_duplicates_byte_identical={}",
+        adversarial.thousand_duplicates_byte_identical
+    )
+    .unwrap();
+    writeln!(
+        summary,
+        "hot_shard_merge_byte_identical={}",
+        adversarial.hot_shard_merge_byte_identical
+    )
+    .unwrap();
+    writeln!(
+        summary,
+        "empty_input_is_empty={}",
+        adversarial.empty_input_is_empty
+    )
+    .unwrap();
+    writeln!(
+        summary,
+        "one_bucket_is_one_bucket={}",
+        adversarial.one_bucket_is_one_bucket
+    )
+    .unwrap();
+}
+
+fn require_accuracy_gate(label: &str, run: &AccuracyRun) -> Result<(), String> {
+    if run.summary.median_absolute_error > 0.015
+        || run.summary.p95_absolute_error > 0.035
+        || run.summary.worst_absolute_error > 0.08
+    {
+        return Err(format!("{label} accuracy gate failed: {:?}", run.summary));
+    }
+    Ok(())
+}
+
+fn append_accuracy_summary(output: &mut String, label: &str, run: &AccuracyRun) {
+    writeln!(
+        output,
+        "{label}_median_absolute_error={:.9}",
+        run.summary.median_absolute_error
+    )
+    .unwrap();
+    writeln!(
+        output,
+        "{label}_p95_absolute_error={:.9}",
+        run.summary.p95_absolute_error
+    )
+    .unwrap();
+    writeln!(
+        output,
+        "{label}_worst_absolute_error={:.9}",
+        run.summary.worst_absolute_error
+    )
+    .unwrap();
+    writeln!(
+        output,
+        "{label}_positive_count={}",
+        run.summary.positive_count
+    )
+    .unwrap();
+    writeln!(
+        output,
+        "{label}_negative_count={}",
+        run.summary.negative_count
+    )
+    .unwrap();
+    writeln!(
+        output,
+        "{label}_positive_mean={:.9}",
+        run.summary.positive_mean_error
+    )
+    .unwrap();
+    writeln!(
+        output,
+        "{label}_negative_mean={:.9}",
+        run.summary.negative_mean_error
+    )
+    .unwrap();
+    writeln!(
+        output,
+        "{label}_worst_positive_case={:?}",
+        run.summary.worst_positive_case
+    )
+    .unwrap();
+    writeln!(
+        output,
+        "{label}_worst_negative_case={:?}",
+        run.summary.worst_negative_case
+    )
+    .unwrap();
+}
+
+fn write_atomic(path: &Path, bytes: &[u8]) -> Result<(), String> {
+    let temporary = path.with_extension("tmp");
+    std::fs::write(&temporary, bytes).map_err(|error| error.to_string())?;
+    std::fs::rename(&temporary, path).map_err(|error| error.to_string())
+}
diff --git a/developer-simulation/runs/2026-08-17--mergeable-unique-installation-reach-rollups/tests/accuracy.rs b/developer-simulation/runs/2026-08-17--mergeable-unique-installation-reach-rollups/tests/accuracy.rs
new file mode 100644
index 0000000..826e67c
--- /dev/null
+++ b/developer-simulation/runs/2026-08-17--mergeable-unique-installation-reach-rollups/tests/accuracy.rs
@@ -0,0 +1,28 @@
+use reach_rollup_lab::run_accuracy_matrix;
+
+#[test]
+fn full_accuracy_matrix_meets_the_declared_contract() {
+    // Catches a candidate that succeeds only on handpicked cardinalities or seeds.
+    let run = run_accuracy_matrix(0xbb67_ae85_84ca_a73b, 0x1319_8a2e_0370_7344);
+    assert_eq!(run.observations.len(), 2_880);
+    assert!(
+        run.summary.median_absolute_error <= 0.015,
+        "{:?}",
+        run.summary
+    );
+    assert!(run.summary.p95_absolute_error <= 0.035, "{:?}", run.summary);
+    assert!(
+        run.summary.worst_absolute_error <= 0.08,
+        "{:?}",
+        run.summary
+    );
+    assert!(run.summary.positive_count > 0);
+    assert!(run.summary.negative_count > 0);
+
+    let evidence = run.to_tsv();
+    assert_eq!(evidence.lines().count(), 2_881);
+    assert!(evidence.starts_with(
+        "seed\tcardinality\tbucket\testimate\tsigned_relative_error\tabsolute_relative_error\n"
+    ));
+    assert_eq!(evidence, run.to_tsv());
+}
diff --git a/developer-simulation/runs/2026-08-17--mergeable-unique-installation-reach-rollups/tests/adversarial.rs b/developer-simulation/runs/2026-08-17--mergeable-unique-installation-reach-rollups/tests/adversarial.rs
new file mode 100644
index 0000000..8dac29e
--- /dev/null
+++ b/developer-simulation/runs/2026-08-17--mergeable-unique-installation-reach-rollups/tests/adversarial.rs
@@ -0,0 +1,14 @@
+use reach_rollup_lab::run_adversarial_verification;
+
+#[test]
+fn declared_adversarial_id_and_shard_cases_hold() {
+    // Catches hashing or merge behavior that only works for pseudorandom, balanced examples.
+    let result = run_adversarial_verification().unwrap();
+    assert_eq!(result.id_pattern_cases, 4);
+    assert!(result.worst_absolute_error <= 0.08, "{result:?}");
+    assert!(result.reverse_order_byte_identical);
+    assert!(result.thousand_duplicates_byte_identical);
+    assert!(result.hot_shard_merge_byte_identical);
+    assert!(result.empty_input_is_empty);
+    assert!(result.one_bucket_is_one_bucket);
+}
diff --git a/developer-simulation/runs/2026-08-17--mergeable-unique-installation-reach-rollups/tests/baseline.rs b/developer-simulation/runs/2026-08-17--mergeable-unique-installation-reach-rollups/tests/baseline.rs
new file mode 100644
index 0000000..b74a510
--- /dev/null
+++ b/developer-simulation/runs/2026-08-17--mergeable-unique-installation-reach-rollups/tests/baseline.rs
@@ -0,0 +1,41 @@
+use reach_rollup_lab::{BucketKey, DayWindow, ExactRollup, Record};
+
+#[test]
+fn exact_rollup_counts_unique_ids_per_bucket() {
+    // Catches replacing set insertion with a raw record counter.
+    let window = DayWindow::new(0, 0, 1).unwrap();
+    let mut rollup = ExactRollup::new(window);
+    let a = Record::new(0, 0, [1; 16]);
+    let duplicate_a = Record::new(0, 0, [1; 16]);
+    let b = Record::new(0, 0, [2; 16]);
+
+    rollup.add(a).unwrap();
+    rollup.add(duplicate_a).unwrap();
+    rollup.add(b).unwrap();
+
+    assert_eq!(rollup.count(BucketKey::new(0, 0)), Some(2));
+}
+
+#[test]
+fn exact_rollup_rejects_records_outside_declared_day_and_tenants() {
+    // Catches accepting bad routing keys and silently publishing a partial day.
+    let window = DayWindow::new(100, 7, 9).unwrap();
+    let mut rollup = ExactRollup::new(window);
+
+    assert!(rollup.add(Record::new(7, 99, [0; 16])).is_err());
+    assert!(rollup.add(Record::new(10, 100, [0; 16])).is_err());
+    assert!(rollup.add(Record::new(9, 123, [0; 16])).is_ok());
+    assert!(rollup.add(Record::new(9, 124, [0; 16])).is_err());
+    assert!(rollup.add(Record::new(7, i64::MIN, [0; 16])).is_err());
+    assert!(rollup.add(Record::new(7, i64::MAX, [0; 16])).is_err());
+}
+
+#[test]
+fn day_window_accepts_full_u32_tenant_range() {
+    // Catches range validation that overflows or excludes either declared edge.
+    let window = DayWindow::new(-12, u32::MIN, u32::MAX).unwrap();
+    let mut rollup = ExactRollup::new(window);
+    rollup.add(Record::new(u32::MIN, -12, [3; 16])).unwrap();
+    rollup.add(Record::new(u32::MAX, 11, [4; 16])).unwrap();
+    assert_eq!(rollup.bucket_count(), 2);
+}
diff --git a/developer-simulation/runs/2026-08-17--mergeable-unique-installation-reach-rollups/tests/benchmark.rs b/developer-simulation/runs/2026-08-17--mergeable-unique-installation-reach-rollups/tests/benchmark.rs
new file mode 100644
index 0000000..3446286
--- /dev/null
+++ b/developer-simulation/runs/2026-08-17--mergeable-unique-installation-reach-rollups/tests/benchmark.rs
@@ -0,0 +1,16 @@
+use reach_rollup_lab::{run_candidate_benchmark, run_exact_benchmark};
+
+#[test]
+#[ignore = "representative 12-million-record benchmark; run explicitly in release mode"]
+fn benchmark_modes_process_the_identical_complete_corpus() {
+    // Catches benchmark modes that compare different inputs or optimize work away.
+    let exact = run_exact_benchmark().unwrap();
+    let candidate = run_candidate_benchmark().unwrap();
+    assert_eq!(exact.record_count, 12_000_000);
+    assert_eq!(candidate.record_count, exact.record_count);
+    assert_eq!(candidate.bucket_count, exact.bucket_count);
+    assert_eq!(exact.unique_bucket_occurrences, Some(10_800_000));
+    assert_eq!(candidate.max_serialized_bucket_size, Some(4_124));
+    assert_ne!(exact.digest, 0);
+    assert_ne!(candidate.digest, 0);
+}
diff --git a/developer-simulation/runs/2026-08-17--mergeable-unique-installation-reach-rollups/tests/cli.rs b/developer-simulation/runs/2026-08-17--mergeable-unique-installation-reach-rollups/tests/cli.rs
new file mode 100644
index 0000000..d9b8f94
--- /dev/null
+++ b/developer-simulation/runs/2026-08-17--mergeable-unique-installation-reach-rollups/tests/cli.rs
@@ -0,0 +1,30 @@
+use std::process::Command;
+
+#[test]
+fn command_line_exposes_reproducible_demo_and_benchmark_recipes() {
+    // Catches a prototype whose required evidence can only be regenerated by undocumented code changes.
+    let output = Command::new(env!("CARGO_BIN_EXE_reach-rollup-lab"))
+        .arg("--help")
+        .output()
+        .unwrap();
+    assert!(output.status.success());
+    let stdout = String::from_utf8(output.stdout).unwrap();
+    assert!(stdout.contains("demo <evidence-dir> <temporary-dir>"));
+    assert!(stdout.contains("bench-exact"));
+    assert!(stdout.contains("bench-candidate"));
+}
+
+#[test]
+fn command_line_rejects_unknown_mode_without_side_effects() {
+    // Catches silently running an unintended expensive mode after a typo.
+    let output = Command::new(env!("CARGO_BIN_EXE_reach-rollup-lab"))
+        .arg("unknown")
+        .output()
+        .unwrap();
+    assert!(!output.status.success());
+    assert!(
+        String::from_utf8(output.stderr)
+            .unwrap()
+            .contains("unknown command")
+    );
+}
diff --git a/developer-simulation/runs/2026-08-17--mergeable-unique-installation-reach-rollups/tests/generator_reader.rs b/developer-simulation/runs/2026-08-17--mergeable-unique-installation-reach-rollups/tests/generator_reader.rs
new file mode 100644
index 0000000..366f3fe
--- /dev/null
+++ b/developer-simulation/runs/2026-08-17--mergeable-unique-installation-reach-rollups/tests/generator_reader.rs
@@ -0,0 +1,81 @@
+use std::io::Cursor;
+
+use reach_rollup_lab::{
+    LOAD_RECORDS, LOAD_SHARDS, LOAD_UNIQUE_OCCURRENCES, LoadCorpus, Record, encode_record_file,
+    stream_record_file,
+};
+
+#[test]
+fn load_generator_has_exact_shape_and_shuffled_equal_shards() {
+    // Catches count drift, an uneven partition, or accidentally sorted shard input.
+    let corpus = LoadCorpus::new(0x243f_6a88_85a3_08d3);
+    assert_eq!(LOAD_UNIQUE_OCCURRENCES, 10_800_000);
+    assert_eq!(LOAD_RECORDS, 12_000_000);
+    assert_eq!(LOAD_SHARDS, 8);
+    for shard in 0..LOAD_SHARDS {
+        let records = corpus.shard(shard).unwrap();
+        assert_eq!(records.len(), 1_500_000);
+        let first: Vec<_> = records.take(4).collect();
+        assert!(first.windows(2).any(|pair| pair[0] > pair[1]));
+    }
+}
+
+#[test]
+fn load_generator_assigns_required_bucket_cardinalities_and_only_valid_duplicates() {
+    // Catches an off-by-one in bucket layout or a "duplicate" that creates a new ID.
+    let corpus = LoadCorpus::new(0x243f_6a88_85a3_08d3);
+    let first_small: Vec<_> = (0..1_000)
+        .map(|index| corpus.logical(index).unwrap())
+        .collect();
+    assert!(
+        first_small
+            .iter()
+            .all(|record| record.tenant_id == 0 && record.unix_hour == 0)
+    );
+    assert_eq!(
+        first_small
+            .iter()
+            .map(|record| record.installation_id)
+            .collect::<std::collections::HashSet<_>>()
+            .len(),
+        1_000
+    );
+
+    let first_medium = corpus.logical(20_000).unwrap();
+    let first_large = corpus.logical(35_000).unwrap();
+    assert_eq!((first_medium.tenant_id, first_medium.unix_hour), (0, 20));
+    assert_eq!((first_large.tenant_id, first_large.unix_hour), (0, 23));
+
+    let duplicate = corpus.logical(LOAD_UNIQUE_OCCURRENCES).unwrap();
+    assert_eq!(duplicate, corpus.logical(0).unwrap());
+    assert!(corpus.logical(LOAD_RECORDS).is_none());
+}
+
+#[test]
+fn streaming_reader_round_trips_and_rejects_malformed_files() {
+    // Catches buffered-only parsing, unknown versions, truncation, trailing bytes, or late validation.
+    let records = [Record::new(2, 100, [1; 16]), Record::new(3, 123, [2; 16])];
+    let bytes = encode_record_file(&records);
+    let window = reach_rollup_lab::DayWindow::new(100, 2, 3).unwrap();
+    let mut seen = Vec::new();
+    stream_record_file(Cursor::new(&bytes), window, |record| {
+        seen.push(record);
+        Ok(())
+    })
+    .unwrap();
+    assert_eq!(seen, records);
+
+    let mut unknown_version = bytes.clone();
+    unknown_version[4] = 2;
+    assert!(stream_record_file(Cursor::new(unknown_version), window, |_| Ok(())).is_err());
+    assert!(
+        stream_record_file(Cursor::new(&bytes[..bytes.len() - 1]), window, |_| Ok(())).is_err()
+    );
+
+    let mut trailing = bytes.clone();
+    trailing.push(0);
+    assert!(stream_record_file(Cursor::new(trailing), window, |_| Ok(())).is_err());
+
+    let invalid = encode_record_file(&[Record::new(2, 124, [0; 16])]);
+    assert!(stream_record_file(Cursor::new(invalid), window, |_| Ok(())).is_err());
+}
diff --git a/developer-simulation/runs/2026-08-17--mergeable-unique-installation-reach-rollups/tests/load_contract.rs b/developer-simulation/runs/2026-08-17--mergeable-unique-installation-reach-rollups/tests/load_contract.rs
new file mode 100644
index 0000000..e7469e1
--- /dev/null
+++ b/developer-simulation/runs/2026-08-17--mergeable-unique-installation-reach-rollups/tests/load_contract.rs
@@ -0,0 +1,39 @@
+use std::fs;
+
+use reach_rollup_lab::run_load_verification;
+
+#[test]
+fn complete_load_corpus_meets_non_performance_contract() {
+    // Catches a scale-only drift in cardinalities, duplicates, mergeability, or determinism.
+    let temporary =
+        std::env::temp_dir().join(format!("reach-load-contract-{}", std::process::id()));
+    let _ = fs::remove_dir_all(&temporary);
+    let result = run_load_verification(&temporary).unwrap();
+    assert_eq!(result.record_count, 12_000_000);
+    assert_eq!(result.unique_bucket_occurrences, 10_800_000);
+    assert_eq!(result.bucket_count, 5_760);
+    assert_eq!(result.cardinality_1k_buckets, 4_800);
+    assert_eq!(result.cardinality_5k_buckets, 720);
+    assert_eq!(result.cardinality_10k_buckets, 240);
+    assert!(result.duplicates_byte_identical);
+    assert!(result.direct_and_sharded_byte_identical);
+    assert_eq!(result.merge_permutation_digests.len(), 50);
+    assert!(
+        result
+            .merge_permutation_digests
+            .iter()
+            .all(|digest| *digest == result.state_digest)
+    );
+    assert!(result.repeated_state_byte_identical);
+    assert!(result.repeated_report_byte_identical);
+    assert_eq!(result.max_serialized_bucket_size, 4_124);
+    assert!(result.max_serialized_bucket_size <= 4_160);
+    assert_eq!(result.total_serialized_bucket_state, 23_754_240);
+    assert_eq!(
+        String::from_utf8_lossy(&result.report_bytes)
+            .lines()
+            .count(),
+        5_761
+    );
+    assert!(!temporary.exists(), "temporary shard states were retained");
+}
diff --git a/developer-simulation/runs/2026-08-17--mergeable-unique-installation-reach-rollups/tests/rollup_report.rs b/developer-simulation/runs/2026-08-17--mergeable-unique-installation-reach-rollups/tests/rollup_report.rs
new file mode 100644
index 0000000..e550b80
--- /dev/null
+++ b/developer-simulation/runs/2026-08-17--mergeable-unique-installation-reach-rollups/tests/rollup_report.rs
@@ -0,0 +1,126 @@
+use std::fs;
+
+use reach_rollup_lab::{
+    ApproxRollup, DayWindow, ExactRollup, PublishMode, Record, digest_bytes, publish_report,
+};
+
+const HASH_SEED: u64 = 0xbb67_ae85_84ca_a73b;
+
+fn records() -> Vec<Record> {
+    let mut records = Vec::new();
+    for tenant in 0_u32..2 {
+        for hour in 0_u32..2 {
+            for id in 0_u64..30 {
+                let mut installation = [0_u8; 16];
+                installation[..8].copy_from_slice(&id.to_le_bytes());
+                installation[8..12].copy_from_slice(&tenant.to_le_bytes());
+                installation[12..].copy_from_slice(&hour.to_le_bytes());
+                records.push(Record::new(tenant, i64::from(hour), installation));
+                if id % 3 == 0 {
+                    records.push(Record::new(tenant, i64::from(hour), installation));
+                }
+            }
+        }
+    }
+    records
+}
+
+fn shuffled<T>(mut values: Vec<T>, seed: u64) -> Vec<T> {
+    let mut state = seed;
+    for index in (1..values.len()).rev() {
+        state ^= state >> 12;
+        state ^= state << 25;
+        state ^= state >> 27;
+        let modulus = u64::try_from(index + 1).unwrap();
+        let swap = usize::try_from(state.wrapping_mul(0x2545_f491_4f6c_dd1d) % modulus).unwrap();
+        values.swap(index, swap);
+    }
+    values
+}
+
+#[test]
+fn fifty_input_and_shard_merge_orders_have_identical_state_bytes() {
+    // Catches hidden dependence on input order, shard order, or map iteration order.
+    let window = DayWindow::new(0, 0, 1).unwrap();
+    let source = records();
+    let mut reference = ApproxRollup::new(window, HASH_SEED);
+    for record in &source {
+        reference.add(*record).unwrap();
+    }
+    let expected = reference.state_file_bytes();
+
+    for seed in 0..50 {
+        let mut direct = ApproxRollup::new(window, HASH_SEED);
+        for record in shuffled(source.clone(), seed) {
+            direct.add(record).unwrap();
+        }
+        assert_eq!(direct.state_file_bytes(), expected, "input seed {seed}");
+    }
+
+    let mut shards: Vec<_> = (0..8)
+        .map(|_| ApproxRollup::new(window, HASH_SEED))
+        .collect();
+    for (index, record) in source.into_iter().enumerate() {
+        shards[index % 8].add(record).unwrap();
+    }
+    for seed in 0..50 {
+        let mut merged = ApproxRollup::new(window, HASH_SEED);
+        for shard in shuffled(shards.clone(), seed) {
+            merged.merge(&shard).unwrap();
+        }
+        assert_eq!(merged.state_file_bytes(), expected, "merge seed {seed}");
+    }
+}
+
+#[test]
+fn report_is_canonical_complete_and_repeatable() {
+    // Catches nondeterministic rows, missing buckets, or digesting a different byte stream.
+    let window = DayWindow::new(0, 0, 1).unwrap();
+    let mut exact = ExactRollup::new(window);
+    let mut approx = ApproxRollup::new(window, HASH_SEED);
+    for record in records() {
+        exact.add(record).unwrap();
+        approx.add(record).unwrap();
+    }
+    let first = approx.report_bytes(&exact).unwrap();
+    let second = approx.report_bytes(&exact).unwrap();
+    assert_eq!(first, second);
+    assert_eq!(digest_bytes(&first), digest_bytes(&second));
+    let text = String::from_utf8(first).unwrap();
+    let rows: Vec<_> = text.lines().collect();
+    assert_eq!(rows.len(), 5);
+    assert!(rows[1].starts_with("0\t0\t30\t"));
+    assert!(rows[2].starts_with("0\t1\t30\t"));
+    assert!(rows[3].starts_with("1\t0\t30\t"));
+    assert!(rows[4].starts_with("1\t1\t30\t"));
+}
+
+#[test]
+fn invalid_or_interrupted_publication_preserves_previous_complete_report() {
+    // Catches writing the final path before validation or before an atomic rename.
+    let root = std::env::temp_dir().join(format!("reach-publish-test-{}", std::process::id()));
+    let _ = fs::remove_dir_all(&root);
+    fs::create_dir_all(&root).unwrap();
+    let path = root.join("report.tsv");
+    fs::write(&path, b"previous complete report\n").unwrap();
+
+    let window = DayWindow::new(0, 0, 0).unwrap();
+    let mut approx = ApproxRollup::new(window, HASH_SEED);
+    approx.add(Record::new(0, 0, [1; 16])).unwrap();
+    let empty_exact = ExactRollup::new(window);
+    assert!(publish_report(&path, &approx, &empty_exact, PublishMode::Commit).is_err());
+    assert_eq!(fs::read(&path).unwrap(), b"previous complete report\n");
+
+    let mut exact = ExactRollup::new(window);
+    exact.add(Record::new(0, 0, [1; 16])).unwrap();
+    assert!(publish_report(&path, &approx, &exact, PublishMode::InterruptAfterTemp).is_err());
+    assert_eq!(fs::read(&path).unwrap(), b"previous complete report\n");
+
+    publish_report(&path, &approx, &exact, PublishMode::Commit).unwrap();
+    assert!(
+        fs::read(&path)
+            .unwrap()
+            .starts_with(b"tenant_id\tunix_hour")
+    );
+    fs::remove_dir_all(&root).unwrap();
+}
diff --git a/developer-simulation/runs/2026-08-17--mergeable-unique-installation-reach-rollups/tests/sketch.rs b/developer-simulation/runs/2026-08-17--mergeable-unique-installation-reach-rollups/tests/sketch.rs
new file mode 100644
index 0000000..8d3fe12
--- /dev/null
+++ b/developer-simulation/runs/2026-08-17--mergeable-unique-installation-reach-rollups/tests/sketch.rs
@@ -0,0 +1,87 @@
+use reach_rollup_lab::{HllState, LabError};
+
+const SEED: u64 = 0x6a09_e667_f3bc_c909;
+
+fn sequential_id(value: u64) -> [u8; 16] {
+    let mut id = [0_u8; 16];
+    id[8..].copy_from_slice(&value.to_be_bytes());
+    id
+}
+
+#[test]
+fn estimate_is_close_for_sequential_ids() {
+    // Catches a biased hash/rank calculation or missing small-range correction.
+    let mut state = HllState::new(SEED);
+    for value in 0..10_000 {
+        state.add(sequential_id(value));
+    }
+    let estimate = state.estimate();
+    assert!((9_200.0..=10_800.0).contains(&estimate), "{estimate}");
+}
+
+#[test]
+fn duplicates_and_self_merge_are_byte_idempotent() {
+    // Catches counters or non-idempotent merge operations masquerading as a set sketch.
+    let mut state = HllState::new(SEED);
+    for value in 0..500 {
+        state.add(sequential_id(value));
+    }
+    let original = state.to_bytes();
+    for _ in 0..1_000 {
+        for value in 0..500 {
+            state.add(sequential_id(value));
+        }
+    }
+    assert_eq!(state.to_bytes(), original);
+    let copy = HllState::from_bytes(&original).unwrap();
+    state.merge(&copy).unwrap();
+    assert_eq!(state.to_bytes(), original);
+}
+
+#[test]
+fn direct_and_merged_states_are_identical() {
+    // Catches order-sensitive state updates or a merge that re-estimates counts.
+    let mut direct = HllState::new(SEED);
+    let mut left = HllState::new(SEED);
+    let mut right = HllState::new(SEED);
+    for value in 0..5_000 {
+        let id = sequential_id(value);
+        direct.add(id);
+        if value % 2 == 0 {
+            left.add(id);
+        } else {
+            right.add(id);
+        }
+    }
+    left.merge(&right).unwrap();
+    assert_eq!(left.to_bytes(), direct.to_bytes());
+}
+
+#[test]
+fn serialization_is_bounded_and_rejects_incompatible_or_corrupt_state() {
+    // Catches loss of format/hash identity and accepting malformed state bytes.
+    let mut state = HllState::new(SEED);
+    state.add(sequential_id(7));
+    let bytes = state.to_bytes();
+    assert!(bytes.len() <= 4_160, "state was {} bytes", bytes.len());
+    assert_eq!(HllState::from_bytes(&bytes).unwrap().to_bytes(), bytes);
+
+    let mut other_seed = HllState::new(SEED + 1);
+    assert!(matches!(
+        other_seed.merge(&state),
+        Err(LabError::IncompatibleState)
+    ));
+
+    let mut unknown_version = bytes.clone();
+    unknown_version[4] = 2;
+    assert!(HllState::from_bytes(&unknown_version).is_err());
+
+    let mut impossible_register = bytes.clone();
+    *impossible_register.last_mut().unwrap() = 255;
+    assert!(HllState::from_bytes(&impossible_register).is_err());
+
+    let mut checksum_mismatch = bytes.clone();
+    checksum_mismatch[28] ^= 1;
+    assert!(HllState::from_bytes(&checksum_mismatch).is_err());
+    assert!(HllState::from_bytes(&bytes[..bytes.len() - 1]).is_err());
+}
diff --git a/developer-simulation/runs/2026-08-17--mergeable-unique-installation-reach-rollups/tests/state_file.rs b/developer-simulation/runs/2026-08-17--mergeable-unique-installation-reach-rollups/tests/state_file.rs
new file mode 100644
index 0000000..8452b3d
--- /dev/null
+++ b/developer-simulation/runs/2026-08-17--mergeable-unique-installation-reach-rollups/tests/state_file.rs
@@ -0,0 +1,63 @@
+use std::collections::BTreeMap;
+
+use reach_rollup_lab::{ApproxRollup, BucketKey, DayWindow, ExactRollup, Record};
+
+#[test]
+fn candidate_state_file_round_trips_and_rejects_corruption() {
+    // Catches a state-file format that cannot safely carry shard results between processes.
+    let window = DayWindow::new(10, 4, 4).unwrap();
+    let mut rollup = ApproxRollup::new(window, 17);
+    rollup.add(Record::new(4, 10, [1; 16])).unwrap();
+    rollup.add(Record::new(4, 11, [2; 16])).unwrap();
+    let bytes = rollup.state_file_bytes();
+    let decoded = ApproxRollup::from_state_file_bytes(window, 17, &bytes).unwrap();
+    assert_eq!(decoded.state_file_bytes(), bytes);
+
+    let mut bad_version = bytes.clone();
+    bad_version[4] = 9;
+    assert!(ApproxRollup::from_state_file_bytes(window, 17, &bad_version).is_err());
+    assert!(ApproxRollup::from_state_file_bytes(window, 18, &bytes).is_err());
+    assert!(ApproxRollup::from_state_file_bytes(window, 17, &bytes[..bytes.len() - 1]).is_err());
+}
+
+#[test]
+fn state_file_checksum_binds_valid_in_window_tenant_and_hour_keys() {
+    // Catches corruption that silently reassigns valid sketch bytes to another valid bucket.
+    let window = DayWindow::new(0, 0, 1).unwrap();
+    let mut rollup = ApproxRollup::new(window, 17);
+    rollup.add(Record::new(0, 0, [3; 16])).unwrap();
+    let bytes = rollup.state_file_bytes();
+    assert_eq!(bytes[4], 2, "the complete-binding format must be v2");
+
+    let mut changed_tenant = bytes.clone();
+    changed_tenant[20..24].copy_from_slice(&1_u32.to_le_bytes());
+    assert!(ApproxRollup::from_state_file_bytes(window, 17, &changed_tenant).is_err());
+
+    let mut changed_hour = bytes.clone();
+    changed_hour[24..32].copy_from_slice(&1_i64.to_le_bytes());
+    assert!(ApproxRollup::from_state_file_bytes(window, 17, &changed_hour).is_err());
+
+    let mut changed_file_checksum = bytes.clone();
+    changed_file_checksum[12] ^= 1;
+    assert!(ApproxRollup::from_state_file_bytes(window, 17, &changed_file_checksum).is_err());
+}
+
+#[test]
+fn compact_exact_counts_still_drive_complete_report_comparison() {
+    // Catches a scale harness that keeps raw IDs alive or loses oracle completeness after compaction.
+    let window = DayWindow::new(0, 0, 0).unwrap();
+    let mut exact = ExactRollup::new(window);
+    let mut approx = ApproxRollup::new(window, 17);
+    for value in 0_u8..10 {
+        let record = Record::new(0, 0, [value; 16]);
+        exact.add(record).unwrap();
+        approx.add(record).unwrap();
+    }
+    let counts = exact.into_counts();
+    assert_eq!(counts.get(&BucketKey::new(0, 0)), Some(&10));
+    let report = approx.report_from_counts(&counts).unwrap();
+    assert!(String::from_utf8(report).unwrap().contains("0\t0\t10\t"));
+
+    let missing = BTreeMap::new();
+    assert!(approx.report_from_counts(&missing).is_err());
+}
diff --git a/developer-simulation/runs/2026-08-18--freight-capacity-batch-clearing/BRIEF.md b/developer-simulation/runs/2026-08-18--freight-capacity-batch-clearing/BRIEF.md
new file mode 100644
index 0000000..900c36f
--- /dev/null
+++ b/developer-simulation/runs/2026-08-18--freight-capacity-batch-clearing/BRIEF.md
@@ -0,0 +1,82 @@
+# Trial 2: Deterministic batch clearing for a freight-capacity marketplace
+
+## Developer role and exact Rust experience
+
+You are a freight-marketplace backend developer with six years of production Ruby and PostgreSQL experience. You have used Rust for exactly five months, completed one instructor-led intermediate course, and built three internal batch utilities; you have never operated a Rust service in production and have not written unsafe Rust.
+
+## Existing system and baseline
+
+An existing marketplace lets shippers submit buy orders for pallet capacity and carriers submit sell offers for a lane and service date. PostgreSQL remains authoritative for orders, bookings, and payments. A Ruby batch worker clears an immutable snapshot every fifteen minutes and writes a proposed allocation for an operator to approve. Approval and booking occur in a separate existing system.
+
+For this trial, a product-owner-signed price-time specification and a slow Ruby reference evaluator are authoritative. Each independent market is identified by `(lane_id, service_date)`. Buy orders rank by descending limit price, then ascending `submitted_sequence`, then ascending bytewise `order_id`. Sell offers rank by ascending ask price, then the same two tie breakers. While the best remaining buy price is at least the best remaining sell price, transfer the smaller remaining quantity at the seller's ask price. Stop when one side is empty or the best prices do not cross.
+
+## Concrete pain
+
+The Ruby worker inherits database arrival order when prices and timestamps tie, so a retry can choose different winners. It also materializes several copies of the batch, taking about nine minutes and more than 2.8 GiB on a large rehearsal. Operators need an advisory prototype that proves stable tie handling, exact capacity conservation, bounded resources, and all-or-nothing report publication before considering a worker rewrite.
+
+## Workload and data shape
+
+The benchmark snapshot contains exactly 650,000 orders across exactly 5,000 nonempty markets:
+
+- 400,000 buy orders and 250,000 sell offers; `400,000 + 250,000 = 650,000`.
+- Every market has at least one buy and one sell.
+- Each row has `order_id`, `lane_id`, `service_date`, `side`, `submitted_sequence`, `quantity`, and `limit_price_cents`.
+- IDs and lane IDs are nonempty ASCII. Order IDs are globally unique. Service dates use canonical `YYYY-MM-DD` text and are treated as labels, not local times.
+- Quantity is an integer from 1 through 1,000,000 pallet units. Price is an integer from 1 through 10,000,000 cents per unit. Use checked arithmetic; aggregate value fields use `u128`.
+- A fill records market key, monotonically increasing per-market fill index, buy ID, sell ID, integer quantity, and seller ask price.
+
+One fill exhausts at least one currently active order. With both sides present, a market containing `B` buys and `S` sells can therefore emit at most `B + S - 1` fills. Across the fixture's 5,000 markets, the global cap is `400,000 + 250,000 - 5,000 = 645,000` fills. The program must reject a generated or hand-written result that exceeds this bound.
+
+## Operational constraints
+
+- Run offline on a declared two-core Linux machine with no network or database access.
+- Treat the PostgreSQL snapshot export as immutable and advisory. Do not reserve capacity, create bookings, charge money, send notifications, or modify the source files.
+- Ignore input row order. The declared ranking keys are the only priority source; do not use map iteration order, process timing, locale collation, or wall-clock time.
+- Validate the full batch before clearing. Duplicate IDs, invalid dates, unknown sides, zero or out-of-range values, invalid ASCII fields, overlong lines, or inconsistent declared counts are run-level failures.
+- Publish one complete canonical proposal or leave the previous complete proposal untouched, using a sibling temporary file and atomic same-filesystem rename.
+- Use safe Rust only and no subprocesses. The batch must remain exactly reproducible without an external queue, cache, or service.
+
+## Measurable acceptance criteria
+
+### Correctness
+
+1. Match the slow Ruby reference evaluator byte for byte on 10,000 generated small markets and all 40 hand-written golden markets, after canonical output ordering by market key and fill index.
+2. For every fill, prove that both orders belong to the same market, the buy limit is at least the sell ask, the fill price equals the sell ask, and the quantity is positive and no greater than either order's remaining quantity.
+3. For every order, the sum of filled quantity must be no greater than its offered quantity. For every market, total quantity filled on the buy side must equal total quantity filled on the sell side exactly.
+4. After the final fill in a market, at least one side must be exhausted or the best remaining buy price must be below the best remaining sell price. No eligible higher-priority order may be bypassed.
+5. On the main benchmark, emit no more than 645,000 fills. Recompute gross value as checked `u128` from `quantity * price_cents` and match the reference manifest exactly.
+6. Cover partial fills, one order filling several counterparties, both orders exhausting together, noncrossing markets, equal prices, equal sequences resolved by ID, extreme accepted quantities and prices, and empty remainder on either side.
+
+### Failure behavior
+
+1. Pass all 80 supplied negative fixtures, including truncated NDJSON, invalid UTF-8, overlong lines, duplicate IDs, unknown sides, malformed dates, zero and excessive quantities, zero and excessive prices, malformed sequences, inconsistent manifest counts, forced read errors, forced write errors, and a deliberately over-cap result.
+2. Every invalid batch must exit nonzero before publishing a proposal. If a prior proposal exists, its byte digest must remain unchanged.
+3. Checked-arithmetic failure, allocation invariant failure, or reference-manifest mismatch must fail the whole run; no market may be published separately.
+4. With injected exits after validation, after 1 percent and 50 percent of markets, and after temporary-file sync but before rename, rerunning must yield the canonical complete proposal and readers must never observe a partial file at the final path.
+
+### Deterministic and runnable evidence
+
+1. Provide `cargo test` as a single command that runs parsing, ordering, reference comparison, arithmetic, invariants, negative fixtures, and publication tests.
+2. Provide a fixed-seed generator for the 650,000-order fixture and its manifest, plus one documented release-mode benchmark command. The manifest records market count, side counts, maximum fill count, and SHA-256 digests.
+3. Shuffle all 650,000 input rows with each of ten fixed seeds. Every run must produce a byte-identical proposal. Repeat one shuffled input three times and show the same SHA-256 digest each time.
+4. Run a property test over at least 10,000 generated small markets and compare every fill with the deliberately slow reference matcher. Store the seed on failure so the exact case can be rerun.
+5. The benchmark command must emit machine-readable counts, elapsed time, peak resident memory from the supplied harness, scratch bytes, proposal digest, and pass/fail status. Evidence must run from a clean checkout with no supporting service.
+
+### Performance and resources
+
+1. Validate, clear, and publish the full 650,000-order snapshot in at most 20 seconds on the declared two-core machine.
+2. Peak resident memory must not exceed 512 MiB. Scratch storage excluding the final proposal must not exceed 1 GiB, and the program may have at most 32 scratch files open at once.
+3. The final proposal must not exceed 645,000 fill rows or 160 MiB, whichever is reached first. Exceeding either gate is a failure rather than permission to truncate.
+4. On the same machine, the full run must finish in no more than one-third of the supplied Ruby worker's median time over three runs. Record all three baseline times and all three prototype times; use medians without extrapolation.
+
+## Explicit non-goals
+
+- Do not replace PostgreSQL, the approval workflow, booking, settlement, payment, notification, or carrier integrations.
+- Do not optimize routes, predict prices, infer demand, rank participants by reputation, or add machine learning.
+- Do not introduce partial fills smaller than the exact integer quantity rules, alternate auction pricing, hidden orders, all-or-none orders, cancellations during a batch, or cross-market substitution.
+- Do not build a server, scheduler, queue consumer, distributed coordinator, user interface, or long-lived database.
+- Do not publish the prototype into the production clearing path or act on its proposal.
+
+## Compact self-contained prototype boundary
+
+Build one safe-Rust CLI with a small testable library. It reads `orders.ndjson` and `manifest.json`, validates the entire immutable snapshot, groups orders by market, applies the exact declared matcher, checks conservation and the fill bound, and atomically writes canonical `proposal.ndjson`. Include a fixed-seed large-fixture generator, the deliberately slow reference matcher, 40 golden markets, 80 negative fixtures, property tests, a benchmark harness, and a short README containing exact test and benchmark commands. Stop at this advisory file-to-file boundary.
diff --git a/developer-simulation/runs/2026-08-18--freight-capacity-batch-clearing/Cargo.toml b/developer-simulation/runs/2026-08-18--freight-capacity-batch-clearing/Cargo.toml
new file mode 100644
index 0000000..f250e75
--- /dev/null
+++ b/developer-simulation/runs/2026-08-18--freight-capacity-batch-clearing/Cargo.toml
@@ -0,0 +1,13 @@
+[package]
+name = "freight-clearing"
+version = "0.1.0"
+edition = "2024"
+publish = false
+
+[dependencies]
+serde = { version = "1", features = ["derive"] }
+serde_json = "1"
+sha2 = "0.10"
+
+[dev-dependencies]
+tempfile = "3"
diff --git a/developer-simulation/runs/2026-08-18--freight-capacity-batch-clearing/DISCOVERY.md b/developer-simulation/runs/2026-08-18--freight-capacity-batch-clearing/DISCOVERY.md
new file mode 100644
index 0000000..c0ddb89
--- /dev/null
+++ b/developer-simulation/runs/2026-08-18--freight-capacity-batch-clearing/DISCOVERY.md
@@ -0,0 +1,53 @@
+# Baseline-first discovery hypothesis
+
+## Problem restatement before inspecting BogKit internals
+
+The authoritative job is a bounded, offline, immutable-snapshot transformation. It must reject the whole batch on invalid input, rank each market with explicit bytewise keys, match quantities exactly, check invariants and limits, then replace one advisory output atomically. Neither arrival order nor long-lived mutable state belongs in the result.
+
+My baseline is therefore a small safe-Rust command-line program using ordinary owned records, a deterministic ordered map keyed by `(lane_id, service_date)`, explicit sorting of both sides, checked integer arithmetic, a deliberately separate slow reference matcher, and a sibling temporary output followed by same-filesystem rename. This is the simplest architecture I expect to make auditable and reproducible.
+
+## Initial testable hypothesis
+
+1. A straightforward `BTreeMap<MarketKey, Market>` plus sorted `Vec<Order>` sides will eliminate the retry-winner defect because all priority and output order is explicit.
+2. The brief's fill bound follows directly from the matcher exhausting at least one active order per fill, but the implementation must still reject an over-cap result rather than trusting that proof.
+3. Full validation before matching and publication plus a sibling temporary file should preserve an existing proposal on all pre-rename failures.
+4. The baseline should comfortably prove core correctness on representative and generated small cases. The stated 650,000-row, two-core Linux performance and memory gates require the supplied target machine, Ruby evaluator, fixtures, and harness; this macOS host can provide representative measurements only.
+
+## Components to consider only after this hypothesis
+
+- **Fold:** potentially relevant only if its transactional materialized views make grouping or atomic batch state simpler without weakening deterministic ordering or adding persistent scratch state. The README presents it as an incremental, durable stream engine; this batch is a one-shot immutable transform, so I expect poor product fit unless its API removes meaningful work.
+- **ESE:** static text embeddings do not participate in price-time matching, validation, conservation, or publication. Expected no fit.
+- **ANNy:** approximate nearest-neighbor search conflicts with the exact ranking and matching specification and has no expected role. Expected no fit.
+
+## What would change the decision
+
+I will inspect only the public APIs and tests needed to answer whether Fold offers a deterministic, bounded, one-shot grouping/materialization path with less code than the baseline. I would use it only if that path is directly supported and preserves the brief's failure boundary. ESE or ANNy would be used only if their actual public contracts reveal a direct exact-data-processing capability missing from the README, which is unlikely.
+
+## Post-hypothesis component decision
+
+After recording the hypothesis, I inspected the components' public crate entry points and the Fold stream, keying, aggregation, and table contracts needed to test it.
+
+1. **Fold — considered, not used.** Its public contract opens an embedded fjall database, persists every sink, and makes incremental delta transactions crash-safe. It can group and materialize records, but it does not perform the specified two-sided sorted match or atomic canonical file publication. Adding it would create a database/scratch lifecycle while leaving validation, exact ordering, matching, invariants, and publication custom. That is more mechanism at this immutable advisory boundary, not less.
+2. **ESE — considered, not used.** Its public API turns text into embedding vectors. No validation or matching requirement uses semantic similarity.
+3. **ANNy — considered, not used.** Its public modules implement HNSW approximate nearest-neighbor search. Approximation is incompatible with the authoritative exact priority order.
+
+The baseline hypothesis held. The fit decision is grounded **no fit for this prototype**, not a claim that the components are defective.
+
+## Ordered discovery and friction
+
+1. The public examples quickly established that BogKit is optimized for persistent incremental views and search, while the brief is an offline snapshot transform.
+2. The exact matcher was small and directly testable with ordinary ordered collections.
+3. Full-batch validation and atomic final-path publication dominated the operational design; none of the three components removed that work.
+4. A first full-host measurement found that retaining a second complete expected-fill vector raised peak RSS to 652,476,416 bytes. A market-at-a-time validation refactor preserved all tests and reduced the clear-only high-water mark to 481,624,064 bytes.
+5. The checkout contained no authoritative Ruby evaluator, Ruby timing harness, or set of 80 negative fixtures. Equivalent local evidence can exercise the design, but it cannot replace those acceptance artifacts.
+
+## Skeptical-review repair audit
+
+The initial external review supported the `no_fit` decision but found four prototype-boundary defects. Repairing them did not make any BogKit component more relevant:
+
+1. Proposal/input alias rejection and existing-file identity checks belong to the file publisher, not an incremental database or search component.
+2. Normalizing relative parents, retaining the directory handle, and distinguishing prepublication failure from post-rename durability uncertainty are ordinary file lifecycle responsibilities.
+3. The 4 KiB validation guarantee required a bounded `fill_buf` loop; Fold, ESE, and ANNy do not own source-line buffering.
+4. Requiring the SHA-256 and authoritative gross value at `run_files`/CLI is an evidence-boundary rule, not a persistent-state need.
+
+All four now have permanent regressions in `freight-clearing/tests/reviewer_repairs.rs`. The workload-specific decision remains **no fit**.
diff --git a/developer-simulation/runs/2026-08-18--freight-capacity-batch-clearing/README.md b/developer-simulation/runs/2026-08-18--freight-capacity-batch-clearing/README.md
new file mode 100644
index 0000000..ed06958
--- /dev/null
+++ b/developer-simulation/runs/2026-08-18--freight-capacity-batch-clearing/README.md
@@ -0,0 +1,57 @@
+# Deterministic freight clearing prototype
+
+This is an advisory, file-to-file safe-Rust prototype. It validates an immutable NDJSON snapshot and JSON manifest, clears each `(lane_id, service_date)` market using the exact declared priority rules, rechecks fills and checked gross value, then atomically replaces a canonical NDJSON proposal. Before any temporary output is created, it rejects proposal paths that resolve to either input or identify the same existing file. It does not connect to PostgreSQL or perform booking, payment, notification, or approval work.
+
+The crate is intentionally standalone and uses no BogKit component. Fold's durable incremental database adds a persistent state lifecycle that this one-shot batch does not need. ESE and ANNy solve text-embedding and approximate-search problems, not exact price-time matching.
+
+## Verify
+
+Run from this directory:
+
+```console
+cargo test --offline --locked --manifest-path ../../Cargo.toml --package freight-clearing --all-targets
+cargo fmt --manifest-path ../../Cargo.toml --package freight-clearing -- --check
+cargo clippy --offline --locked --manifest-path ../../Cargo.toml --package freight-clearing --all-targets --all-features -- -D warnings -D clippy::all -D clippy::pedantic
+```
+
+`cargo test` includes 40 literal golden markets, 10,000 fixed-seed generated markets compared with the deliberately slow scan reference, validation and bound cases, fixed-seed shuffle determinism, publication failure injection, forced I/O errors, and the real CLI. It also permanently retains the skeptical-review regressions for input aliasing, relative output, post-rename durability state, bounded one-MiB corrupt input, and missing or malformed integrity fields.
+
+## Generate the exact large fixture
+
+```console
+cargo run --release --offline --locked --manifest-path ../../Cargo.toml --package freight-clearing -- generate /tmp/freight-fixture
+```
+
+The defaults are exactly 5,000 markets, 400,000 buys, 250,000 sells, and seed `104372539623448`. A custom shuffle seed uses:
+
+```console
+cargo run --release --offline --locked --manifest-path ../../Cargo.toml --package freight-clearing -- generate /tmp/freight-fixture 5000 400000 250000 1
+```
+
+The seed changes only row order; the underlying orders remain the same. The generated manifest records counts, the 645,000-fill cap, expected checked gross value, and the order-file SHA-256 digest. The `clear` and `benchmark` boundaries require a non-null expected gross value and a syntactically valid 64-hex order digest; narrow library tests may construct optional manifests without invoking those evidence-producing boundaries.
+
+## Clear an existing fixture
+
+```console
+cargo run --release --offline --locked --manifest-path ../../Cargo.toml --package freight-clearing -- clear /tmp/freight-fixture/orders.ndjson /tmp/freight-fixture/manifest.json /tmp/freight-fixture/proposal.ndjson
+```
+
+The command prints a single JSON result. Relative proposal filenames are supported. Pre-rename errors have `RunErrorState::NotPublished`, display with `NOT_PUBLISHED:`, and preserve the prior final path. A directory-sync failure after rename has `RunErrorState::PublishedDurabilityUncertain` and displays with `PUBLISHED_DURABILITY_UNCERTAIN:`: the new complete proposal is already visible, but its directory-entry durability is uncertain. These states are intentionally not described as equivalent failures. On Linux the result reads the process high-water mark from `/proc/self/status` without unsafe code; on other hosts that field is `null` and should be supplied by the OS harness.
+
+## Benchmark
+
+```console
+cargo run --release --offline --locked --manifest-path ../../Cargo.toml --package freight-clearing -- benchmark /tmp/freight-fixture
+```
+
+This generates the default large fixture, times the validate/clear/publish phase, and prints machine-readable counts, elapsed milliseconds, peak RSS when Linux exposes it, maximum temporary bytes, proposal bytes/digest, and gate status. For a clear-only macOS peak-memory measurement, excluding fixture generation:
+
+```console
+/usr/bin/time -l ../../target/release/freight-clearing clear /tmp/freight-fixture/orders.ndjson /tmp/freight-fixture/manifest.json /tmp/freight-fixture/proposal.ndjson
+```
+
+For the declared Linux target, run `clear` as a fresh process so its `peak_resident_memory_bytes` covers the clearing phase only. Run the supplied Ruby reference and Ruby baseline separately on that same machine before making an acceptance decision.
+
+## Evidence boundary
+
+The retained tests and generator are runnable without a service. The repaired 2026-08-18 trial reran the full 650,000-row shape and all ten shuffle seeds on macOS; the proposal digest remained `e7ce11984ca3e04197df9dd43013361b123e5ecf4b877f3a36f0a08dd64ebcad`. A fresh repaired clear took 1.03 seconds and measured 445,087,744 bytes peak RSS on this host. The authoritative Ruby evaluator, 80 supplied negative fixtures, declared two-core Linux machine, and three Ruby baseline runs were not present in this checkout, so their acceptance gates remain explicitly unverified.
diff --git a/developer-simulation/runs/2026-08-18--freight-capacity-batch-clearing/TRIAL_REPORT.md b/developer-simulation/runs/2026-08-18--freight-capacity-batch-clearing/TRIAL_REPORT.md
new file mode 100644
index 0000000..cd4e6f2
--- /dev/null
+++ b/developer-simulation/runs/2026-08-18--freight-capacity-batch-clearing/TRIAL_REPORT.md
@@ -0,0 +1,231 @@
+# Trial 2 repaired report — deterministic freight-capacity clearing
+
+Date: 2026-08-18
+Repair round: 1 of 5
+Detached checkout: `/private/tmp/bogkit-sim-2026-08-18-trial2.2S4LeW`
+BogKit HEAD throughout: `20f2ca50d5d06f51edfe8b8570c0fb48caf9eb81`
+Review source: `/private/tmp/bogkit-sim-2026-08-18-review.Qji3Ki/review.md`
+
+## Repaired outcome
+
+The original safe-Rust advisory prototype remains at `simulation-output/freight-clearing/`. Repair round 1 closes the four Important Trial 2 defects reproduced by the skeptical reviewer and normalizes the Minor report issue. Each code repair began with a permanent failing regression in `tests/reviewer_repairs.rs`, then passed its focused GREEN run and the complete suite.
+
+The workload-specific decision remains **no fit** for Fold, ESE, and ANNy. The review agreed with that decision; its rejection concerned prototype and report quality, not pressure to adopt a component.
+
+This handoff is repaired and locally verified, but it is not self-approved for archival. The same skeptical reviewer must recheck the frozen repaired tree.
+
+## Repair summary
+
+| Reviewer finding | Category | Prior severity | Current severity | Repair state |
+|---|---|---|---|---|
+| T2-I1 proposal can overwrite an input | correctness defect | Important | None | Repaired; reviewer recheck pending |
+| T2-I2 relative output reports a post-publication failure as nonpublication | correctness defect | Important | None | Repaired; reviewer recheck pending |
+| T2-I3 4 KiB check follows unbounded line buffering | performance problem | Important | None | Repaired; reviewer recheck pending |
+| T2-I4 required reference-integrity fields are optional | correctness defect | Important | None | Repaired; reviewer recheck pending |
+| T2-M1 finding severities/resolved states are not normalized | documentation gap | Minor | None | Repaired; reviewer recheck pending |
+
+The earlier global duplicate-proposal memory issue is also normalized below as prior `Important`, current `None`. Evidence that was not supplied remains in Evidence limits and is not counted as a product finding.
+
+## What changed
+
+### T2-I1 — Input alias protection
+
+- `run_files` rejects a proposal path that resolves to the orders or manifest input before temporary-file creation.
+- Existing output identity is compared where supported; the Unix implementation compares device and inode, catching hard links as well as symlinks/resolved names.
+- Permanent tests cover the ordinary orders alias, a lexically different resolved manifest alias, and a hard link to orders. The orders and manifest digests remain unchanged.
+
+### T2-I2 — Publication lifecycle and relative paths
+
+- A proposal with no explicit parent uses `.`.
+- The proposal directory is opened before temporary-file creation and its handle is retained across rename for directory sync.
+- `RunErrorState::NotPublished` identifies errors before rename, displays with `NOT_PUBLISHED:`, and retains the previous final bytes.
+- `RunErrorState::PublishedDurabilityUncertain` displays with `PUBLISHED_DURABILITY_UNCERTAIN:` and identifies an error after the complete proposal was renamed but before its directory entry was durably synced. It does not claim the prior file was preserved.
+- Permanent tests cover relative CLI publication, pre-rename preservation, and injected post-rename durability uncertainty with the new complete proposal already visible.
+
+### T2-I3 — Bounded line reading
+
+- `read_until` was replaced with a `fill_buf`/`consume` loop whose retained buffer is capped at `MAX_LINE_BYTES + 1`.
+- A one-MiB corrupt-line regression exposes the whole source slice but proves the validator consumes no more than 4,097 bytes before rejection. The old implementation consumed all 1,048,577 bytes.
+
+### T2-I4 — Required evidence integrity
+
+- `run_files` and therefore the CLI require `orders_sha256` and `expected_gross_value_cents`.
+- The digest must be exactly 64 hexadecimal characters before the order file is hashed and compared.
+- Missing digest, null digest, short digest, nonhex digest, missing expected value, and null expected value have permanent nonpublication regressions.
+- `validate_orders` remains reusable for narrow unit tests with optional reference fields; the relaxation cannot reach the evidence-producing `run_files` boundary.
+
+### Adjacent lifecycle audit
+
+- Alias checks cover ordinary, resolved/symlink, and existing hard-link identity cases.
+- The parent directory is opened before a sibling temporary file can appear.
+- Pre-rename errors remove the sibling temporary file. Post-rename uncertainty does not misreport nonpublication; the temporary name no longer exists because it became the complete final proposal.
+- A missing output parent fails before temporary-file creation or rename.
+- Digest/value validation occurs before orders are parsed, matched, or any proposal temporary file is created.
+
+## Test-driven repair evidence
+
+Focused RED observations before implementation:
+
+1. Ordinary orders alias, resolved manifest alias, and hard-link alias all returned success and replaced the input identity.
+2. Relative CLI output exited nonzero after `proposal.ndjson` had appeared.
+3. The post-rename injected state did not exist and initially returned success.
+4. The one-MiB corrupt line consumed all 1,048,577 bytes before `line too long`.
+5. Missing/null digest and missing/null expected gross were accepted; malformed digest was reported only as a value mismatch.
+
+Focused GREEN runs then passed, and `cargo test --offline --locked` passed all retained suites: 33 integration tests plus unit/doc targets. This includes:
+
+- 12 skeptical-review repair regressions.
+- 40 literal golden markets.
+- 10,000 generated small markets compared fill-for-fill with an independently structured slow scanner.
+- Partial fills, one order spanning counterparties, equal-price and bytewise-ID ties, noncrossing markets, exact exhaustion, extrema, checked gross value, and the fill cap.
+- Full validation, invalid UTF-8, truncated NDJSON, invalid dates/sides/sequences/values, duplicate IDs, bounded overlong input, inconsistent counts, and hand-written over-cap output.
+- Failure injection after validation, 1 percent and 50 percent of markets, temporary sync, and rename-before-directory-sync.
+- Forced read/write errors, relative publication, input aliases, deterministic shuffles, repeats, and the real CLI.
+
+The named supplied corpus of 80 negative fixtures was not present. The retained cases are not relabelled as that corpus.
+
+## Repaired full-shape evidence
+
+Host: macOS, not the declared two-core Linux machine. Each seed permuted the same 650,000 orders across 5,000 nonempty markets.
+
+| Shuffle seed | Validate/clear/publish ms | Proposal SHA-256 |
+|---:|---:|---|
+| 1 | 1,019 | `e7ce11984ca3e04197df9dd43013361b123e5ecf4b877f3a36f0a08dd64ebcad` |
+| 2 | 1,080 | same |
+| 3 | 1,030 | same |
+| 4 | 1,040 | same |
+| 5 | 1,025 | same |
+| 6 | 1,001 | same |
+| 7 | 1,059 | same |
+| 8 | 983 | same |
+| 9 | 1,038 | same |
+| 10 | 1,053 | same |
+
+Selected repaired prototype times before reporting: 983 ms, 1,038 ms, and 1,053 ms; median 1,038 ms. Three additional clears of the seed-10 source emitted the identical digest.
+
+- Orders: 650,000, comprising 400,000 buys and 250,000 sells.
+- Markets: 5,000.
+- Fills: 498,521, below 645,000.
+- Self-generated checked gross value: 312,220,517,981,477,594 cents.
+- Proposal size: 80,960,196 bytes, below 160 MiB.
+- Maximum sibling temporary bytes: 80,960,196, below 1 GiB.
+- Maximum scratch files open: one proposal temporary.
+- Fresh repaired clear wall time under `/usr/bin/time -l`: 1.03 seconds.
+- Fresh repaired clear peak RSS: 445,087,744 bytes, below 512 MiB on this host.
+- The digest, counts, gross value, and proposal size did not change after repair.
+
+Machine output reports `measured_acceptance_pass:null` on macOS. `verified_gates_pass:true` covers only locally measured count/time/size gates and is not an overall acceptance claim. The self-generated manifest value does not replace the unavailable authoritative Ruby result.
+
+## Exact final verification commands
+
+From `simulation-output/freight-clearing/`:
+
+```console
+cargo test --offline --locked
+# exit 0; all retained targets and 33 integration tests passed
+
+cargo fmt --all -- --check
+# exit 0
+
+cargo clippy --offline --locked --all-targets --all-features -- -D warnings -D clippy::all -D clippy::pedantic
+# exit 0; no warnings
+
+cargo build --release --offline --locked
+# exit 0
+
+target/release/freight-clearing benchmark /private/tmp/bogkit-trial2-repair-bench.rcl7jr 5000 400000 250000 SEED
+# exit 0 for SEED 1 through 10; digest and measurements above
+
+target/release/freight-clearing clear /private/tmp/bogkit-trial2-repair-bench.rcl7jr/orders.ndjson /private/tmp/bogkit-trial2-repair-bench.rcl7jr/manifest.json /private/tmp/bogkit-trial2-repair-bench.rcl7jr/proposal.ndjson
+# exit 0 for three repeats; identical digest
+
+/usr/bin/time -l target/release/freight-clearing clear /private/tmp/bogkit-trial2-repair-bench.rcl7jr/orders.ndjson /private/tmp/bogkit-trial2-repair-bench.rcl7jr/manifest.json /private/tmp/bogkit-trial2-repair-bench.rcl7jr/proposal.ndjson
+# exit 0; 1.03 real seconds; 445087744 maximum resident set size
+```
+
+## Component fit and decision audit
+
+- **Fold: considered, not used.** A persistent fjall-backed incremental stream would add state and scratch lifecycle while leaving validation, exact two-sided sorting/matching, conservation, integrity verification, and canonical file publication custom.
+- **ESE: considered, not used.** Text embeddings do not participate in exact integer price-time clearing.
+- **ANNy: considered, not used.** Approximate nearest-neighbor search conflicts with the exact authoritative priority order.
+- The skeptical repairs concern the prototype's file and evidence boundaries. They do not reproduce a BogKit defect or justify a BogKit source/example change.
+- The program uses safe Rust only and launches no subprocess. It does not book, reserve, charge, notify, connect to a service, or alter the source snapshot.
+- No tracked repository file, commit, GitHub state, or automation state was changed.
+
+## Normalized findings
+
+### T2-I1 — Proposal/input aliasing
+
+- Category: **correctness defect**
+- Prior severity: **Important**
+- Current severity: **None**
+- Confidence: high
+- Repair state: repaired locally; reviewer recheck pending.
+- Retained reproduction: `tests/reviewer_repairs.rs` tests `proposal_equal_to_orders_is_rejected_without_changing_orders`, `resolved_proposal_equal_to_manifest_is_rejected_without_changing_manifest`, and `existing_hard_link_to_orders_is_rejected_by_file_identity`.
+- Smallest improvement: implemented resolved-path and existing-file identity rejection before temporary output.
+
+### T2-I2 — Publication state and relative output
+
+- Category: **correctness defect**
+- Prior severity: **Important**
+- Current severity: **None**
+- Confidence: high
+- Repair state: repaired locally; reviewer recheck pending.
+- Retained reproduction: `relative_proposal_path_publishes_successfully`, `pre_rename_failure_reports_not_published_and_preserves_previous_bytes`, and `post_rename_failure_reports_durability_uncertainty_not_nonpublication`.
+- Smallest improvement: implemented `.` normalization, a retained directory handle, and distinct pre/post-rename error states.
+
+### T2-I3 — Unbounded overlong-line buffering
+
+- Category: **performance problem**
+- Prior severity: **Important**
+- Current severity: **None**
+- Confidence: high
+- Repair state: repaired locally; reviewer recheck pending.
+- Retained reproduction: `one_mib_overlong_line_is_rejected_without_consuming_beyond_the_bound`.
+- Smallest improvement: implemented bounded `fill_buf` reading capped at 4,097 retained/consumed bytes.
+
+### T2-I4 — Optional reference-integrity fields
+
+- Category: **correctness defect**
+- Prior severity: **Important**
+- Current severity: **None**
+- Confidence: high
+- Repair state: repaired locally; reviewer recheck pending.
+- Retained reproduction: the six missing/null/short/nonhex digest and missing/null gross cases in `tests/reviewer_repairs.rs`.
+- Smallest improvement: implemented required, syntactically validated digest and required gross value at `run_files`/CLI.
+
+### T2-M1 — Unnormalized findings
+
+- Category: **documentation gap**
+- Prior severity: **Minor**
+- Current severity: **None**
+- Confidence: high
+- Repair state: repaired locally; reviewer recheck pending.
+- Retained reproduction: this report uses only Critical/Important/Minor/None for severity and records repair state separately.
+- Smallest improvement: normalized every retained finding and moved missing supplied evidence out of findings.
+
+### T2-P1 — Duplicate global proposal retained during validation
+
+- Category: **performance problem**
+- Prior severity: **Important**
+- Current severity: **None**
+- Confidence: high
+- Repair state: repaired before initial skeptical review and retained.
+- Retained reproduction: full-shape clear-only `/usr/bin/time -l`; initial 652,476,416 bytes, market-at-a-time validation now 445,087,744 bytes on the repaired tree.
+- Smallest improvement: retain only one market's expected fills during validation.
+
+The workload-specific `no_fit` conclusion is a decision, not an unresolved product finding.
+
+## Evidence limits
+
+- The production Ruby evaluator, its authoritative outputs, three same-host Ruby timings, supplied 80-fixture negative corpus, and declared two-core Linux runner were unavailable.
+- The local slow Rust oracle and self-generated manifest do not establish Ruby byte parity or the one-third runtime criterion.
+- macOS timing and RSS are host observations, not Linux qualification or a production capacity claim.
+- Injected returned errors model lifecycle points but are not process kills, disk-full, permission races, or power-loss qualification.
+- Post-rename directory-sync failure means a complete new final file is visible with durability uncertainty; it does not mean the prior file was preserved.
+
+## Cleanup, repository state, and frozen identity
+
+The full benchmark directory and crate `target/` are removed before handoff. Only Rust source/tests, Cargo metadata, README, discovery, repaired report, and the retained tree-identity manifest remain under `simulation-output/`. No corpus, proposal, database, temporary file, binary, secret-like file, symlink, or file above 1 MiB remains.
+
+Final HEAD is `20f2ca50d5d06f51edfe8b8570c0fb48caf9eb81`. `git diff --exit-code` is clean; `git status --short` contains only untracked `BRIEF.md` and `simulation-output/`. The stable retained-file hashes are recorded in `simulation-output/TREE_IDENTITY.sha256` for reviewer comparison.
diff --git a/developer-simulation/runs/2026-08-18--freight-capacity-batch-clearing/src/lib.rs b/developer-simulation/runs/2026-08-18--freight-capacity-batch-clearing/src/lib.rs
new file mode 100644
index 0000000..77a1bd6
--- /dev/null
+++ b/developer-simulation/runs/2026-08-18--freight-capacity-batch-clearing/src/lib.rs
@@ -0,0 +1,993 @@
+use std::{
+    collections::{BTreeMap, HashSet},
+    fs::{self, File, OpenOptions},
+    io::{BufRead, BufReader, BufWriter, Read, Write},
+    path::Path,
+    path::PathBuf,
+};
+
+use serde::{Deserialize, Serialize};
+use sha2::{Digest, Sha256};
+
+const MAX_LINE_BYTES: usize = 4_096;
+const MAX_QUANTITY: u64 = 1_000_000;
+const MAX_PRICE_CENTS: u64 = 10_000_000;
+const MAX_PROPOSAL_BYTES: u64 = 160 * 1024 * 1024;
+const FIXTURE_DATA_SEED: u64 = 0xd37e_5eed_2026_0818;
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "lowercase")]
+pub enum Side {
+    Buy,
+    Sell,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+pub struct Order {
+    pub order_id: String,
+    pub lane_id: String,
+    pub service_date: String,
+    pub side: Side,
+    pub submitted_sequence: u64,
+    pub quantity: u64,
+    pub limit_price_cents: u64,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, PartialOrd, Ord, Serialize, Deserialize)]
+pub struct MarketKey {
+    pub lane_id: String,
+    pub service_date: String,
+}
+
+impl MarketKey {
+    #[must_use]
+    pub fn new(lane_id: &str, service_date: &str) -> Self {
+        Self {
+            lane_id: lane_id.to_owned(),
+            service_date: service_date.to_owned(),
+        }
+    }
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+pub struct Fill {
+    pub lane_id: String,
+    pub service_date: String,
+    pub fill_index: u64,
+    pub buy_id: String,
+    pub sell_id: String,
+    pub quantity: u64,
+    pub price_cents: u64,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+pub struct Proposal {
+    pub fills: Vec<Fill>,
+    pub gross_value_cents: u128,
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum FailurePoint {
+    None,
+    AfterValidation,
+    AfterOnePercent,
+    AfterHalf,
+    AfterTempSync,
+    AfterRenameBeforeDirectorySync,
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum RunErrorState {
+    NotPublished,
+    PublishedDurabilityUncertain,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct RunError {
+    state: RunErrorState,
+    message: String,
+}
+
+impl RunError {
+    fn not_published(message: impl Into<String>) -> Self {
+        Self {
+            state: RunErrorState::NotPublished,
+            message: message.into(),
+        }
+    }
+
+    fn durability_uncertain(message: impl Into<String>) -> Self {
+        Self {
+            state: RunErrorState::PublishedDurabilityUncertain,
+            message: message.into(),
+        }
+    }
+
+    #[must_use]
+    pub const fn state(&self) -> RunErrorState {
+        self.state
+    }
+
+    #[must_use]
+    pub const fn is_durability_uncertain(&self) -> bool {
+        matches!(self.state, RunErrorState::PublishedDurabilityUncertain)
+    }
+
+    #[must_use]
+    pub fn contains(&self, pattern: &str) -> bool {
+        self.message.contains(pattern)
+    }
+}
+
+impl From<String> for RunError {
+    fn from(message: String) -> Self {
+        Self::not_published(message)
+    }
+}
+
+impl std::fmt::Display for RunError {
+    fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        let state = match self.state {
+            RunErrorState::NotPublished => "NOT_PUBLISHED",
+            RunErrorState::PublishedDurabilityUncertain => "PUBLISHED_DURABILITY_UNCERTAIN",
+        };
+        write!(formatter, "{state}: {}", self.message)
+    }
+}
+
+impl std::error::Error for RunError {}
+
+#[derive(Debug, Clone)]
+pub struct RunPaths {
+    pub orders: PathBuf,
+    pub manifest: PathBuf,
+    pub proposal: PathBuf,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize)]
+pub struct RunResult {
+    pub order_count: usize,
+    pub market_count: usize,
+    pub fill_count: usize,
+    pub gross_value_cents: u128,
+    pub proposal_sha256: String,
+    pub proposal_bytes: u64,
+    pub peak_resident_memory_bytes: Option<u64>,
+}
+
+#[must_use]
+pub fn parse_linux_peak_rss_bytes(status: &str) -> Option<u64> {
+    let kibibytes = status.lines().find_map(|line| {
+        line.strip_prefix("VmHWM:")?
+            .split_whitespace()
+            .next()?
+            .parse::<u64>()
+            .ok()
+    })?;
+    kibibytes.checked_mul(1_024)
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub struct FixtureSpec {
+    pub market_count: usize,
+    pub buy_count: usize,
+    pub sell_count: usize,
+    pub seed: u64,
+}
+
+#[derive(Debug, Clone)]
+pub struct GeneratedFixture {
+    pub paths: RunPaths,
+    pub manifest: Manifest,
+}
+
+/// Writes a deterministic snapshot and its reference manifest.
+///
+/// # Errors
+///
+/// Returns an error for invalid counts, arithmetic overflow, I/O failure, or
+/// if the generated snapshot does not validate and clear successfully.
+pub fn generate_fixture(directory: &Path, spec: FixtureSpec) -> Result<GeneratedFixture, String> {
+    if spec.market_count == 0
+        || spec.buy_count < spec.market_count
+        || spec.sell_count < spec.market_count
+    {
+        return Err("fixture needs at least one buy and sell per market".to_owned());
+    }
+    let order_count = spec
+        .buy_count
+        .checked_add(spec.sell_count)
+        .ok_or_else(|| "fixture order count overflow".to_owned())?;
+    fs::create_dir_all(directory)
+        .map_err(|error| format!("create fixture directory {}: {error}", directory.display()))?;
+    let paths = RunPaths {
+        orders: directory.join("orders.ndjson"),
+        manifest: directory.join("manifest.json"),
+        proposal: directory.join("proposal.ndjson"),
+    };
+    let orders_file = File::create(&paths.orders)
+        .map_err(|error| format!("create {}: {error}", paths.orders.display()))?;
+    let mut writer = BufWriter::new(orders_file);
+    let mut digest = Sha256::new();
+    let total = u64::try_from(order_count).map_err(|_| "too many fixture orders")?;
+    let mut multiplier = (spec.seed % total).max(1);
+    while gcd(multiplier, total) != 1 {
+        multiplier = (multiplier + 1) % total;
+        if multiplier == 0 {
+            multiplier = 1;
+        }
+    }
+    let offset = spec.seed.rotate_left(17) % total;
+    for position in 0..total {
+        let original = multiplier
+            .checked_mul(position)
+            .ok_or_else(|| "fixture permutation overflow".to_owned())?
+            .wrapping_add(offset)
+            % total;
+        let buy_count_u64 = u64::try_from(spec.buy_count).map_err(|_| "too many buys")?;
+        let (side, side_index) = if original < buy_count_u64 {
+            (Side::Buy, original)
+        } else {
+            (Side::Sell, original - buy_count_u64)
+        };
+        let market_count_u64 = u64::try_from(spec.market_count).map_err(|_| "too many markets")?;
+        let market = side_index % market_count_u64;
+        let random = mix64(FIXTURE_DATA_SEED ^ original);
+        let order = Order {
+            order_id: match side {
+                Side::Buy => format!("buy-{side_index:010}"),
+                Side::Sell => format!("sell-{side_index:010}"),
+            },
+            lane_id: format!("lane-{market:05}"),
+            service_date: format!("2026-09-{:02}", 1 + market % 28),
+            side,
+            submitted_sequence: random % 100_000,
+            quantity: 1 + random.rotate_left(13) % MAX_QUANTITY,
+            limit_price_cents: match side {
+                Side::Buy => 5_000_001 + random.rotate_left(29) % 5_000_000,
+                Side::Sell => 1 + random.rotate_left(29) % 5_000_000,
+            },
+        };
+        let mut line =
+            serde_json::to_vec(&order).map_err(|error| format!("serialize order: {error}"))?;
+        line.push(b'\n');
+        digest.update(&line);
+        writer
+            .write_all(&line)
+            .map_err(|error| format!("write {}: {error}", paths.orders.display()))?;
+    }
+    writer
+        .flush()
+        .map_err(|error| format!("flush {}: {error}", paths.orders.display()))?;
+    writer
+        .get_ref()
+        .sync_all()
+        .map_err(|error| format!("sync {}: {error}", paths.orders.display()))?;
+
+    let mut manifest = Manifest {
+        order_count,
+        buy_count: spec.buy_count,
+        sell_count: spec.sell_count,
+        market_count: spec.market_count,
+        max_fill_count: order_count - spec.market_count,
+        expected_gross_value_cents: None,
+        orders_sha256: Some(format!("{:x}", digest.finalize())),
+    };
+    let orders_file =
+        File::open(&paths.orders).map_err(|error| format!("open generated orders: {error}"))?;
+    let batch = validate_orders(BufReader::new(orders_file), &manifest)?;
+    manifest.expected_gross_value_cents = Some(clear_batch(&batch, &manifest)?.gross_value_cents);
+    let mut manifest_bytes = serde_json::to_vec_pretty(&manifest)
+        .map_err(|error| format!("serialize manifest: {error}"))?;
+    manifest_bytes.push(b'\n');
+    fs::write(&paths.manifest, manifest_bytes)
+        .map_err(|error| format!("write {}: {error}", paths.manifest.display()))?;
+    Ok(GeneratedFixture { paths, manifest })
+}
+
+const fn gcd(mut left: u64, mut right: u64) -> u64 {
+    while right != 0 {
+        let remainder = left % right;
+        left = right;
+        right = remainder;
+    }
+    left
+}
+
+const fn mix64(mut value: u64) -> u64 {
+    value = value.wrapping_add(0x9e37_79b9_7f4a_7c15);
+    value = (value ^ (value >> 30)).wrapping_mul(0xbf58_476d_1ce4_e5b9);
+    value = (value ^ (value >> 27)).wrapping_mul(0x94d0_49bb_1331_11eb);
+    value ^ (value >> 31)
+}
+
+/// Validates, clears, checks, and atomically publishes one snapshot.
+///
+/// # Errors
+///
+/// Returns an error for input, validation, clearing, invariant, publication,
+/// or deliberately injected failures. The final path is untouched until the
+/// atomic rename.
+pub fn run_files(paths: &RunPaths, failure: FailurePoint) -> Result<RunResult, RunError> {
+    reject_input_aliases(paths)?;
+    let manifest_file = File::open(&paths.manifest)
+        .map_err(|error| format!("open manifest {}: {error}", paths.manifest.display()))?;
+    let manifest: Manifest = serde_json::from_reader(BufReader::new(manifest_file))
+        .map_err(|error| format!("parse manifest {}: {error}", paths.manifest.display()))?;
+    let expected_digest = manifest
+        .orders_sha256
+        .as_deref()
+        .ok_or_else(|| "orders_sha256 is required".to_owned())?;
+    if expected_digest.len() != 64 || !expected_digest.bytes().all(|byte| byte.is_ascii_hexdigit())
+    {
+        return Err("orders_sha256 must be valid 64-hex".to_owned().into());
+    }
+    if manifest.expected_gross_value_cents.is_none() {
+        return Err("expected_gross_value_cents is required".to_owned().into());
+    }
+    let actual_digest = sha256_file(&paths.orders)?;
+    if !actual_digest.eq_ignore_ascii_case(expected_digest) {
+        return Err("orders SHA-256 does not match manifest".to_owned().into());
+    }
+    let orders_file = File::open(&paths.orders)
+        .map_err(|error| format!("open orders {}: {error}", paths.orders.display()))?;
+    let batch = validate_orders(BufReader::new(orders_file), &manifest)?;
+    if failure == FailurePoint::AfterValidation {
+        return Err("injected exit after validation".to_owned().into());
+    }
+
+    let proposal = clear_batch_with_failure(&batch, &manifest, failure)?;
+    let parent = normalized_parent(&paths.proposal)?;
+    let directory = File::open(parent)
+        .map_err(|error| format!("open proposal directory {}: {error}", parent.display()))?;
+    let (temporary_path, temporary_file) = create_sibling_temp(&paths.proposal, parent)?;
+    let publication = write_and_publish(
+        &temporary_path,
+        temporary_file,
+        &paths.proposal,
+        &directory,
+        &proposal,
+        failure,
+    );
+    if publication.is_err() {
+        let _ = fs::remove_file(&temporary_path);
+    }
+    let (proposal_sha256, proposal_bytes) = publication?;
+    Ok(RunResult {
+        order_count: batch.order_count(),
+        market_count: batch.market_count(),
+        fill_count: proposal.fills.len(),
+        gross_value_cents: proposal.gross_value_cents,
+        proposal_sha256,
+        proposal_bytes,
+        peak_resident_memory_bytes: linux_peak_rss_bytes(),
+    })
+}
+
+fn reject_input_aliases(paths: &RunPaths) -> Result<(), String> {
+    for input in [&paths.orders, &paths.manifest] {
+        let input_resolved = fs::canonicalize(input)
+            .map_err(|error| format!("resolve input {}: {error}", input.display()))?;
+        if let Ok(proposal_resolved) = fs::canonicalize(&paths.proposal)
+            && proposal_resolved == input_resolved
+        {
+            return Err(format!(
+                "proposal path aliases an input: {}",
+                input.display()
+            ));
+        }
+        if same_existing_file(&paths.proposal, input)? {
+            return Err(format!(
+                "proposal path aliases an input: {}",
+                input.display()
+            ));
+        }
+    }
+    Ok(())
+}
+
+#[cfg(unix)]
+fn same_existing_file(left: &Path, right: &Path) -> Result<bool, String> {
+    use std::os::unix::fs::MetadataExt;
+
+    let left_metadata = match fs::metadata(left) {
+        Ok(metadata) => metadata,
+        Err(error) if error.kind() == std::io::ErrorKind::NotFound => return Ok(false),
+        Err(error) => return Err(format!("inspect proposal identity: {error}")),
+    };
+    let right_metadata = fs::metadata(right)
+        .map_err(|error| format!("inspect input identity {}: {error}", right.display()))?;
+    Ok(left_metadata.dev() == right_metadata.dev() && left_metadata.ino() == right_metadata.ino())
+}
+
+#[cfg(not(unix))]
+fn same_existing_file(left: &Path, right: &Path) -> Result<bool, String> {
+    let left_resolved = match fs::canonicalize(left) {
+        Ok(path) => path,
+        Err(error) if error.kind() == std::io::ErrorKind::NotFound => return Ok(false),
+        Err(error) => return Err(format!("inspect proposal identity: {error}")),
+    };
+    let right_resolved = fs::canonicalize(right)
+        .map_err(|error| format!("inspect input identity {}: {error}", right.display()))?;
+    Ok(left_resolved == right_resolved)
+}
+
+fn linux_peak_rss_bytes() -> Option<u64> {
+    let status = fs::read_to_string("/proc/self/status").ok()?;
+    parse_linux_peak_rss_bytes(&status)
+}
+
+fn clear_batch_with_failure(
+    batch: &ValidatedBatch,
+    manifest: &Manifest,
+    failure: FailurePoint,
+) -> Result<Proposal, String> {
+    let one_percent = batch.market_count().div_ceil(100).max(1);
+    let half = batch.market_count().div_ceil(2).max(1);
+    let mut fills = Vec::new();
+    for (index, (key, orders)) in batch.markets.iter().enumerate() {
+        fills.extend(clear_market(key, orders)?);
+        if fills.len() > manifest.max_fill_count {
+            return Err("proposal exceeds maximum fill count".to_owned());
+        }
+        let completed = index + 1;
+        if failure == FailurePoint::AfterOnePercent && completed >= one_percent {
+            return Err("injected exit after one percent of markets".to_owned());
+        }
+        if failure == FailurePoint::AfterHalf && completed >= half {
+            return Err("injected exit after half of markets".to_owned());
+        }
+    }
+    let gross_value_cents = fills.iter().try_fold(0_u128, |gross, fill| {
+        let fill_value = u128::from(fill.quantity)
+            .checked_mul(u128::from(fill.price_cents))
+            .ok_or_else(|| "gross value multiplication overflow".to_owned())?;
+        gross
+            .checked_add(fill_value)
+            .ok_or_else(|| "gross value addition overflow".to_owned())
+    })?;
+    let proposal = Proposal {
+        fills,
+        gross_value_cents,
+    };
+    validate_proposal(batch, &proposal, manifest)?;
+    Ok(proposal)
+}
+
+fn normalized_parent(path: &Path) -> Result<&Path, String> {
+    let parent = path
+        .parent()
+        .ok_or_else(|| "proposal path has no parent".to_owned())?;
+    if parent.as_os_str().is_empty() {
+        Ok(Path::new("."))
+    } else {
+        Ok(parent)
+    }
+}
+
+fn create_sibling_temp(final_path: &Path, parent: &Path) -> Result<(PathBuf, File), String> {
+    let name = final_path
+        .file_name()
+        .and_then(|name| name.to_str())
+        .ok_or_else(|| "proposal filename must be UTF-8".to_owned())?;
+    for attempt in 0..100_u32 {
+        let path = parent.join(format!(".{name}.tmp-{}-{attempt}", std::process::id()));
+        match OpenOptions::new().write(true).create_new(true).open(&path) {
+            Ok(file) => return Ok((path, file)),
+            Err(error) if error.kind() == std::io::ErrorKind::AlreadyExists => {}
+            Err(error) => return Err(format!("create sibling temporary file: {error}")),
+        }
+    }
+    Err("could not reserve sibling temporary filename".to_owned())
+}
+
+fn write_and_publish(
+    temporary_path: &Path,
+    temporary_file: File,
+    final_path: &Path,
+    directory: &File,
+    proposal: &Proposal,
+    failure: FailurePoint,
+) -> Result<(String, u64), RunError> {
+    let mut writer = BufWriter::new(temporary_file);
+    let mut digest = Sha256::new();
+    let mut bytes_written = 0_u64;
+    for fill in &proposal.fills {
+        let mut line =
+            serde_json::to_vec(fill).map_err(|error| format!("serialize fill: {error}"))?;
+        line.push(b'\n');
+        let line_len =
+            u64::try_from(line.len()).map_err(|_| "proposal line too large".to_owned())?;
+        bytes_written = bytes_written
+            .checked_add(line_len)
+            .ok_or_else(|| "proposal byte count overflow".to_owned())?;
+        if bytes_written > MAX_PROPOSAL_BYTES {
+            return Err("proposal exceeds 160 MiB".to_owned().into());
+        }
+        digest.update(&line);
+        writer
+            .write_all(&line)
+            .map_err(|error| format!("write temporary proposal: {error}"))?;
+    }
+    writer
+        .flush()
+        .map_err(|error| format!("flush temporary proposal: {error}"))?;
+    writer
+        .get_ref()
+        .sync_all()
+        .map_err(|error| format!("sync temporary proposal: {error}"))?;
+    if failure == FailurePoint::AfterTempSync {
+        return Err("injected exit after temporary-file sync".to_owned().into());
+    }
+    drop(writer);
+    fs::rename(temporary_path, final_path)
+        .map_err(|error| format!("atomic proposal rename: {error}"))?;
+    if failure == FailurePoint::AfterRenameBeforeDirectorySync {
+        return Err(RunError::durability_uncertain(
+            "proposal published but directory durability is uncertain: injected after rename",
+        ));
+    }
+    directory.sync_all().map_err(|error| {
+        RunError::durability_uncertain(format!(
+            "proposal published but directory durability is uncertain: {error}"
+        ))
+    })?;
+    Ok((format!("{:x}", digest.finalize()), bytes_written))
+}
+
+fn sha256_file(path: &Path) -> Result<String, String> {
+    let mut file = File::open(path).map_err(|error| format!("open {}: {error}", path.display()))?;
+    let mut digest = Sha256::new();
+    let mut buffer = vec![0_u8; 64 * 1024].into_boxed_slice();
+    loop {
+        let count = file
+            .read(&mut buffer)
+            .map_err(|error| format!("read {}: {error}", path.display()))?;
+        if count == 0 {
+            break;
+        }
+        digest.update(&buffer[..count]);
+    }
+    Ok(format!("{:x}", digest.finalize()))
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+pub struct Manifest {
+    pub order_count: usize,
+    pub buy_count: usize,
+    pub sell_count: usize,
+    pub market_count: usize,
+    pub max_fill_count: usize,
+    pub expected_gross_value_cents: Option<u128>,
+    pub orders_sha256: Option<String>,
+}
+
+#[derive(Debug, Clone)]
+pub struct ValidatedBatch {
+    markets: BTreeMap<MarketKey, Vec<Order>>,
+    order_count: usize,
+}
+
+impl ValidatedBatch {
+    #[must_use]
+    pub const fn order_count(&self) -> usize {
+        self.order_count
+    }
+
+    #[must_use]
+    pub fn market_count(&self) -> usize {
+        self.markets.len()
+    }
+}
+
+/// Clears every market in canonical market-key order.
+///
+/// # Errors
+///
+/// Returns an error if fill bounds, checked arithmetic, reference-manifest
+/// value, or allocation invariants fail.
+pub fn clear_batch(batch: &ValidatedBatch, manifest: &Manifest) -> Result<Proposal, String> {
+    let mut fills = Vec::new();
+    for (key, orders) in &batch.markets {
+        fills.extend(clear_market(key, orders)?);
+        if fills.len() > manifest.max_fill_count {
+            return Err("proposal exceeds maximum fill count".to_owned());
+        }
+    }
+    let gross_value_cents = fills.iter().try_fold(0_u128, |gross, fill| {
+        let value = u128::from(fill.quantity)
+            .checked_mul(u128::from(fill.price_cents))
+            .ok_or_else(|| "gross value multiplication overflow".to_owned())?;
+        gross
+            .checked_add(value)
+            .ok_or_else(|| "gross value addition overflow".to_owned())
+    })?;
+    let proposal = Proposal {
+        fills,
+        gross_value_cents,
+    };
+    validate_proposal(batch, &proposal, manifest)?;
+    Ok(proposal)
+}
+
+/// Rechecks all fills against the validated input and canonical matcher.
+///
+/// # Errors
+///
+/// Returns an error for a bound, identity, market, price, quantity, priority,
+/// conservation, ordering, arithmetic, or manifest mismatch.
+pub fn validate_proposal(
+    batch: &ValidatedBatch,
+    proposal: &Proposal,
+    manifest: &Manifest,
+) -> Result<(), String> {
+    if proposal.fills.len() > manifest.max_fill_count {
+        return Err("proposal exceeds maximum fill count".to_owned());
+    }
+    let mut fill_cursor = 0_usize;
+    let mut gross = 0_u128;
+    for (key, orders) in &batch.markets {
+        let expected = clear_market(key, orders)?;
+        let fill_end = fill_cursor
+            .checked_add(expected.len())
+            .ok_or_else(|| "proposal fill cursor overflow".to_owned())?;
+        let actual = proposal
+            .fills
+            .get(fill_cursor..fill_end)
+            .ok_or_else(|| "proposal is missing canonical fills".to_owned())?;
+        if actual != expected {
+            return Err("proposal bypasses priority or is not canonically ordered".to_owned());
+        }
+        let mut orders_by_id = std::collections::HashMap::new();
+        let mut remaining = std::collections::HashMap::new();
+        for order in orders {
+            orders_by_id.insert(order.order_id.as_str(), order);
+            remaining.insert(order.order_id.as_str(), order.quantity);
+        }
+        for fill in actual {
+            if fill.quantity == 0 {
+                return Err("fill quantity must be positive".to_owned());
+            }
+            let buy = orders_by_id
+                .get(fill.buy_id.as_str())
+                .ok_or_else(|| "fill references unknown buy".to_owned())?;
+            let sell = orders_by_id
+                .get(fill.sell_id.as_str())
+                .ok_or_else(|| "fill references unknown sell".to_owned())?;
+            if buy.side != Side::Buy || sell.side != Side::Sell {
+                return Err("fill references wrong order sides".to_owned());
+            }
+            if buy.lane_id != fill.lane_id
+                || sell.lane_id != fill.lane_id
+                || buy.service_date != fill.service_date
+                || sell.service_date != fill.service_date
+            {
+                return Err("fill crosses market boundaries".to_owned());
+            }
+            if buy.limit_price_cents < sell.limit_price_cents
+                || fill.price_cents != sell.limit_price_cents
+            {
+                return Err("fill violates crossing or seller-ask price".to_owned());
+            }
+            let buy_remaining = remaining
+                .get_mut(fill.buy_id.as_str())
+                .ok_or_else(|| "buy remaining quantity missing".to_owned())?;
+            if fill.quantity > *buy_remaining {
+                return Err("fill exceeds buy remaining quantity".to_owned());
+            }
+            *buy_remaining -= fill.quantity;
+            let sell_remaining = remaining
+                .get_mut(fill.sell_id.as_str())
+                .ok_or_else(|| "sell remaining quantity missing".to_owned())?;
+            if fill.quantity > *sell_remaining {
+                return Err("fill exceeds sell remaining quantity".to_owned());
+            }
+            *sell_remaining -= fill.quantity;
+            gross = gross
+                .checked_add(
+                    u128::from(fill.quantity)
+                        .checked_mul(u128::from(fill.price_cents))
+                        .ok_or_else(|| "gross value multiplication overflow".to_owned())?,
+                )
+                .ok_or_else(|| "gross value addition overflow".to_owned())?;
+        }
+        fill_cursor = fill_end;
+    }
+    if fill_cursor != proposal.fills.len() {
+        return Err("proposal contains fills after the canonical market sequence".to_owned());
+    }
+    if gross != proposal.gross_value_cents {
+        return Err("proposal gross value does not match fills".to_owned());
+    }
+    if manifest
+        .expected_gross_value_cents
+        .is_some_and(|expected_gross| expected_gross != gross)
+    {
+        return Err("proposal gross value does not match reference manifest".to_owned());
+    }
+    Ok(())
+}
+
+/// Parses and validates the complete immutable order stream.
+///
+/// # Errors
+///
+/// Returns an error for malformed input, invalid fields, duplicates,
+/// incomplete markets, or inconsistent manifest counts and bounds.
+pub fn validate_orders<R: BufRead>(
+    mut reader: R,
+    manifest: &Manifest,
+) -> Result<ValidatedBatch, String> {
+    let mut markets: BTreeMap<MarketKey, Vec<Order>> = BTreeMap::new();
+    let mut order_count = 0_usize;
+    let mut buy_count = 0_usize;
+    let mut sell_count = 0_usize;
+    let mut order_ids = HashSet::new();
+    let mut buffer = Vec::with_capacity(MAX_LINE_BYTES + 1);
+    let mut index = 0_usize;
+    loop {
+        buffer.clear();
+        let bytes_read = read_bounded_line(&mut reader, &mut buffer, index + 1)?;
+        if bytes_read == 0 {
+            break;
+        }
+        index += 1;
+        if buffer.last() != Some(&b'\n') {
+            return Err(format!("line {index}: missing final newline"));
+        }
+        buffer.pop();
+        if buffer.len() > MAX_LINE_BYTES {
+            return Err(format!("line {index}: line too long"));
+        }
+        let line = std::str::from_utf8(&buffer)
+            .map_err(|error| format!("line {index}: invalid UTF-8: {error}"))?;
+        let order: Order =
+            serde_json::from_str(line).map_err(|error| format!("line {index}: {error}"))?;
+        validate_order(&order).map_err(|error| format!("line {index}: {error}"))?;
+        if !order_ids.insert(order.order_id.clone()) {
+            return Err(format!("duplicate order_id: {}", order.order_id));
+        }
+        order_count += 1;
+        match order.side {
+            Side::Buy => buy_count += 1,
+            Side::Sell => sell_count += 1,
+        }
+        markets
+            .entry(MarketKey {
+                lane_id: order.lane_id.clone(),
+                service_date: order.service_date.clone(),
+            })
+            .or_default()
+            .push(order);
+    }
+    if order_count != manifest.order_count
+        || buy_count != manifest.buy_count
+        || sell_count != manifest.sell_count
+        || markets.len() != manifest.market_count
+    {
+        return Err("manifest counts do not match orders".to_owned());
+    }
+    for orders in markets.values() {
+        let has_buy = orders.iter().any(|order| order.side == Side::Buy);
+        let has_sell = orders.iter().any(|order| order.side == Side::Sell);
+        if !has_buy || !has_sell {
+            return Err("every market must contain a buy and a sell".to_owned());
+        }
+    }
+    let derived_fill_cap = order_count
+        .checked_sub(markets.len())
+        .ok_or_else(|| "invalid market count".to_owned())?;
+    if manifest.max_fill_count != derived_fill_cap {
+        return Err("manifest maximum fill count is inconsistent".to_owned());
+    }
+    Ok(ValidatedBatch {
+        markets,
+        order_count,
+    })
+}
+
+fn read_bounded_line<R: BufRead>(
+    reader: &mut R,
+    buffer: &mut Vec<u8>,
+    line_number: usize,
+) -> Result<usize, String> {
+    loop {
+        let available = reader
+            .fill_buf()
+            .map_err(|error| format!("line {line_number}: {error}"))?;
+        if available.is_empty() {
+            return Ok(buffer.len());
+        }
+        let newline = available.iter().position(|byte| *byte == b'\n');
+        let chunk_length = newline.map_or(available.len(), |position| position + 1);
+        if buffer.len().saturating_add(chunk_length) > MAX_LINE_BYTES + 1 {
+            return Err(format!("line {line_number}: line too long"));
+        }
+        buffer.extend_from_slice(&available[..chunk_length]);
+        reader.consume(chunk_length);
+        if newline.is_some() {
+            return Ok(buffer.len());
+        }
+    }
+}
+
+fn validate_order(order: &Order) -> Result<(), String> {
+    if order.order_id.is_empty() {
+        return Err("order_id must be nonempty".to_owned());
+    }
+    if order.lane_id.is_empty() {
+        return Err("lane_id must be nonempty".to_owned());
+    }
+    if !order.order_id.is_ascii() || !order.lane_id.is_ascii() {
+        return Err("order_id and lane_id must be ASCII".to_owned());
+    }
+    if !valid_date(&order.service_date) {
+        return Err("service_date must be a canonical YYYY-MM-DD date".to_owned());
+    }
+    if !(1..=MAX_QUANTITY).contains(&order.quantity) {
+        return Err("quantity must be in 1..=1000000".to_owned());
+    }
+    if !(1..=MAX_PRICE_CENTS).contains(&order.limit_price_cents) {
+        return Err("limit_price_cents must be in 1..=10000000".to_owned());
+    }
+    Ok(())
+}
+
+fn valid_date(date: &str) -> bool {
+    let bytes = date.as_bytes();
+    if bytes.len() != 10
+        || bytes[4] != b'-'
+        || bytes[7] != b'-'
+        || !bytes
+            .iter()
+            .enumerate()
+            .all(|(index, byte)| index == 4 || index == 7 || byte.is_ascii_digit())
+    {
+        return false;
+    }
+    let number = |start: usize, end: usize| -> Option<u32> {
+        std::str::from_utf8(&bytes[start..end]).ok()?.parse().ok()
+    };
+    let (Some(year), Some(month), Some(day)) = (number(0, 4), number(5, 7), number(8, 10)) else {
+        return false;
+    };
+    if year == 0 || !(1..=12).contains(&month) {
+        return false;
+    }
+    let leap = year % 4 == 0 && (year % 100 != 0 || year % 400 == 0);
+    let days = match month {
+        2 if leap => 29,
+        2 => 28,
+        4 | 6 | 9 | 11 => 30,
+        _ => 31,
+    };
+    (1..=days).contains(&day)
+}
+
+/// Applies the exact price-time matcher to one market.
+///
+/// # Errors
+///
+/// Returns an error if the fill index cannot be represented as `u64`.
+pub fn clear_market(key: &MarketKey, orders: &[Order]) -> Result<Vec<Fill>, String> {
+    let mut buys: Vec<(&Order, u64)> = orders
+        .iter()
+        .filter(|order| order.side == Side::Buy)
+        .map(|order| (order, order.quantity))
+        .collect();
+    let mut sells: Vec<(&Order, u64)> = orders
+        .iter()
+        .filter(|order| order.side == Side::Sell)
+        .map(|order| (order, order.quantity))
+        .collect();
+
+    buys.sort_by(|(a, _), (b, _)| {
+        b.limit_price_cents
+            .cmp(&a.limit_price_cents)
+            .then_with(|| a.submitted_sequence.cmp(&b.submitted_sequence))
+            .then_with(|| a.order_id.as_bytes().cmp(b.order_id.as_bytes()))
+    });
+    sells.sort_by(|(a, _), (b, _)| {
+        a.limit_price_cents
+            .cmp(&b.limit_price_cents)
+            .then_with(|| a.submitted_sequence.cmp(&b.submitted_sequence))
+            .then_with(|| a.order_id.as_bytes().cmp(b.order_id.as_bytes()))
+    });
+
+    let (mut buy_index, mut sell_index) = (0, 0);
+    let mut fills = Vec::new();
+    while buy_index < buys.len() && sell_index < sells.len() {
+        let (buy, buy_remaining) = &mut buys[buy_index];
+        let (sell, sell_remaining) = &mut sells[sell_index];
+        if buy.limit_price_cents < sell.limit_price_cents {
+            break;
+        }
+        let quantity = (*buy_remaining).min(*sell_remaining);
+        fills.push(Fill {
+            lane_id: key.lane_id.clone(),
+            service_date: key.service_date.clone(),
+            fill_index: u64::try_from(fills.len()).map_err(|_| "too many fills")?,
+            buy_id: buy.order_id.clone(),
+            sell_id: sell.order_id.clone(),
+            quantity,
+            price_cents: sell.limit_price_cents,
+        });
+        *buy_remaining -= quantity;
+        *sell_remaining -= quantity;
+        if *buy_remaining == 0 {
+            buy_index += 1;
+        }
+        if *sell_remaining == 0 {
+            sell_index += 1;
+        }
+    }
+    Ok(fills)
+}
+
+/// Deliberately scans all active orders on every step as an independent oracle.
+///
+/// # Errors
+///
+/// Returns an error if the fill index cannot be represented as `u64`.
+pub fn slow_reference_market(key: &MarketKey, orders: &[Order]) -> Result<Vec<Fill>, String> {
+    let mut remaining: Vec<u64> = orders.iter().map(|order| order.quantity).collect();
+    let mut fills = Vec::new();
+    loop {
+        let mut best_buy = None;
+        let mut best_sell = None;
+        for (index, order) in orders.iter().enumerate() {
+            if remaining[index] == 0 {
+                continue;
+            }
+            match order.side {
+                Side::Buy => {
+                    let is_better = best_buy.is_none_or(|previous: usize| {
+                        let prior = &orders[previous];
+                        order.limit_price_cents > prior.limit_price_cents
+                            || (order.limit_price_cents == prior.limit_price_cents
+                                && (order.submitted_sequence < prior.submitted_sequence
+                                    || (order.submitted_sequence == prior.submitted_sequence
+                                        && order.order_id.as_bytes() < prior.order_id.as_bytes())))
+                    });
+                    if is_better {
+                        best_buy = Some(index);
+                    }
+                }
+                Side::Sell => {
+                    let is_better = best_sell.is_none_or(|previous: usize| {
+                        let prior = &orders[previous];
+                        order.limit_price_cents < prior.limit_price_cents
+                            || (order.limit_price_cents == prior.limit_price_cents
+                                && (order.submitted_sequence < prior.submitted_sequence
+                                    || (order.submitted_sequence == prior.submitted_sequence
+                                        && order.order_id.as_bytes() < prior.order_id.as_bytes())))
+                    });
+                    if is_better {
+                        best_sell = Some(index);
+                    }
+                }
+            }
+        }
+        let (Some(buy_index), Some(sell_index)) = (best_buy, best_sell) else {
+            break;
+        };
+        let buy = &orders[buy_index];
+        let sell = &orders[sell_index];
+        if buy.limit_price_cents < sell.limit_price_cents {
+            break;
+        }
+        let quantity = remaining[buy_index].min(remaining[sell_index]);
+        fills.push(Fill {
+            lane_id: key.lane_id.clone(),
+            service_date: key.service_date.clone(),
+            fill_index: u64::try_from(fills.len()).map_err(|_| "too many fills")?,
+            buy_id: buy.order_id.clone(),
+            sell_id: sell.order_id.clone(),
+            quantity,
+            price_cents: sell.limit_price_cents,
+        });
+        remaining[buy_index] -= quantity;
+        remaining[sell_index] -= quantity;
+    }
+    Ok(fills)
+}
diff --git a/developer-simulation/runs/2026-08-18--freight-capacity-batch-clearing/src/main.rs b/developer-simulation/runs/2026-08-18--freight-capacity-batch-clearing/src/main.rs
new file mode 100644
index 0000000..744f2af
--- /dev/null
+++ b/developer-simulation/runs/2026-08-18--freight-capacity-batch-clearing/src/main.rs
@@ -0,0 +1,112 @@
+use std::{path::PathBuf, time::Instant};
+
+use freight_clearing::{FailurePoint, FixtureSpec, RunPaths, generate_fixture, run_files};
+
+fn main() {
+    if let Err(error) = run() {
+        eprintln!("{error}");
+        std::process::exit(1);
+    }
+}
+
+fn run() -> Result<(), String> {
+    let mut arguments = std::env::args().skip(1);
+    let command = arguments.next().ok_or_else(usage)?;
+    match command.as_str() {
+        "clear" => {
+            let paths = RunPaths {
+                orders: PathBuf::from(arguments.next().ok_or_else(usage)?),
+                manifest: PathBuf::from(arguments.next().ok_or_else(usage)?),
+                proposal: PathBuf::from(arguments.next().ok_or_else(usage)?),
+            };
+            if arguments.next().is_some() {
+                return Err(usage());
+            }
+            let result =
+                run_files(&paths, FailurePoint::None).map_err(|error| error.to_string())?;
+            println!(
+                "{}",
+                serde_json::to_string(&result).map_err(|error| error.to_string())?
+            );
+        }
+        "generate" | "benchmark" => {
+            let directory = PathBuf::from(arguments.next().ok_or_else(usage)?);
+            let remaining: Vec<String> = arguments.collect();
+            let spec = parse_fixture_spec(&remaining)?;
+            let fixture = generate_fixture(&directory, spec)?;
+            if command == "generate" {
+                println!(
+                    "{}",
+                    serde_json::to_string(&fixture.manifest).map_err(|error| error.to_string())?
+                );
+            } else {
+                let started = Instant::now();
+                let result = run_files(&fixture.paths, FailurePoint::None)
+                    .map_err(|error| error.to_string())?;
+                let elapsed_ms = u64::try_from(started.elapsed().as_millis())
+                    .map_err(|_| "elapsed duration does not fit u64".to_owned())?;
+                let verified_gates_pass = elapsed_ms <= 20_000
+                    && result.proposal_bytes <= 160 * 1024 * 1024
+                    && result.fill_count <= fixture.manifest.max_fill_count;
+                let measured_acceptance_pass = result
+                    .peak_resident_memory_bytes
+                    .map(|peak| verified_gates_pass && peak <= 512 * 1024 * 1024);
+                let output = serde_json::json!({
+                    "order_count": result.order_count,
+                    "market_count": result.market_count,
+                    "buy_count": fixture.manifest.buy_count,
+                    "sell_count": fixture.manifest.sell_count,
+                    "fill_count": result.fill_count,
+                    "maximum_fill_count": fixture.manifest.max_fill_count,
+                    "gross_value_cents": result.gross_value_cents,
+                    "elapsed_ms": elapsed_ms,
+                    "peak_resident_memory_bytes": result.peak_resident_memory_bytes,
+                    "peak_resident_memory_note": "Linux reads VmHWM; other hosts require the documented OS harness",
+                    "scratch_bytes": result.proposal_bytes,
+                    "scratch_files_open_max": 1,
+                    "proposal_bytes": result.proposal_bytes,
+                    "proposal_sha256": result.proposal_sha256,
+                    "verified_gates_pass": verified_gates_pass,
+                    "measured_acceptance_pass": measured_acceptance_pass,
+                    "acceptance_status": "target Linux, Ruby baseline, and peak-RSS gates not available on this host",
+                    "host_os": std::env::consts::OS,
+                });
+                println!("{output}");
+            }
+        }
+        _ => return Err(usage()),
+    }
+    Ok(())
+}
+
+fn parse_fixture_spec(arguments: &[String]) -> Result<FixtureSpec, String> {
+    if arguments.is_empty() {
+        return Ok(FixtureSpec {
+            market_count: 5_000,
+            buy_count: 400_000,
+            sell_count: 250_000,
+            seed: 0x5eed_2026_0818,
+        });
+    }
+    if arguments.len() != 4 {
+        return Err(usage());
+    }
+    Ok(FixtureSpec {
+        market_count: arguments[0]
+            .parse()
+            .map_err(|_| "invalid market count".to_owned())?,
+        buy_count: arguments[1]
+            .parse()
+            .map_err(|_| "invalid buy count".to_owned())?,
+        sell_count: arguments[2]
+            .parse()
+            .map_err(|_| "invalid sell count".to_owned())?,
+        seed: arguments[3]
+            .parse()
+            .map_err(|_| "invalid seed".to_owned())?,
+    })
+}
+
+fn usage() -> String {
+    "usage: freight-clearing clear ORDERS MANIFEST PROPOSAL | generate DIR [MARKETS BUYS SELLS SEED] | benchmark DIR [MARKETS BUYS SELLS SEED]".to_owned()
+}
diff --git a/developer-simulation/runs/2026-08-18--freight-capacity-batch-clearing/tests/batch.rs b/developer-simulation/runs/2026-08-18--freight-capacity-batch-clearing/tests/batch.rs
new file mode 100644
index 0000000..638c8a4
--- /dev/null
+++ b/developer-simulation/runs/2026-08-18--freight-capacity-batch-clearing/tests/batch.rs
@@ -0,0 +1,61 @@
+use std::io::Cursor;
+
+use freight_clearing::{Manifest, Proposal, clear_batch, validate_orders, validate_proposal};
+
+#[test]
+fn batch_output_is_canonical_and_checked_against_manifest_value() {
+    // Catches map/input-order leakage, unchecked gross value, and accepting a
+    // result that was not independently validated before publication.
+    let input = concat!(
+        "{\"order_id\":\"z-sell\",\"lane_id\":\"z-lane\",\"service_date\":\"2026-09-02\",\"side\":\"sell\",\"submitted_sequence\":1,\"quantity\":4,\"limit_price_cents\":200}\n",
+        "{\"order_id\":\"a-buy\",\"lane_id\":\"a-lane\",\"service_date\":\"2026-09-01\",\"side\":\"buy\",\"submitted_sequence\":1,\"quantity\":3,\"limit_price_cents\":100}\n",
+        "{\"order_id\":\"z-buy\",\"lane_id\":\"z-lane\",\"service_date\":\"2026-09-02\",\"side\":\"buy\",\"submitted_sequence\":1,\"quantity\":4,\"limit_price_cents\":190}\n",
+        "{\"order_id\":\"a-sell\",\"lane_id\":\"a-lane\",\"service_date\":\"2026-09-01\",\"side\":\"sell\",\"submitted_sequence\":1,\"quantity\":3,\"limit_price_cents\":90}\n",
+    );
+    let manifest = Manifest {
+        order_count: 4,
+        buy_count: 2,
+        sell_count: 2,
+        market_count: 2,
+        max_fill_count: 2,
+        expected_gross_value_cents: Some(270),
+        orders_sha256: None,
+    };
+    let batch = validate_orders(Cursor::new(input.as_bytes()), &manifest).expect("valid batch");
+
+    let proposal = clear_batch(&batch, &manifest).expect("valid proposal");
+    validate_proposal(&batch, &proposal, &manifest).expect("validated proposal");
+
+    assert_eq!(proposal.fills.len(), 1);
+    assert_eq!(proposal.fills[0].lane_id, "a-lane");
+    assert_eq!(proposal.gross_value_cents, 270);
+}
+
+#[test]
+fn hand_written_over_cap_result_is_rejected() {
+    // Catches treating the mathematical fill bound as documentation instead
+    // of enforcing it against a loaded or generated result.
+    let input = concat!(
+        "{\"order_id\":\"b\",\"lane_id\":\"lane\",\"service_date\":\"2026-09-01\",\"side\":\"buy\",\"submitted_sequence\":1,\"quantity\":3,\"limit_price_cents\":100}\n",
+        "{\"order_id\":\"s\",\"lane_id\":\"lane\",\"service_date\":\"2026-09-01\",\"side\":\"sell\",\"submitted_sequence\":1,\"quantity\":3,\"limit_price_cents\":90}\n",
+    );
+    let manifest = Manifest {
+        order_count: 2,
+        buy_count: 1,
+        sell_count: 1,
+        market_count: 1,
+        max_fill_count: 1,
+        expected_gross_value_cents: None,
+        orders_sha256: None,
+    };
+    let batch = validate_orders(Cursor::new(input.as_bytes()), &manifest).expect("valid batch");
+    let valid = clear_batch(&batch, &manifest).expect("valid proposal");
+    let proposal = Proposal {
+        fills: vec![valid.fills[0].clone(), valid.fills[0].clone()],
+        gross_value_cents: 540,
+    };
+
+    let error = validate_proposal(&batch, &proposal, &manifest).expect_err("over cap must fail");
+
+    assert!(error.contains("maximum fill count"), "{error}");
+}
diff --git a/developer-simulation/runs/2026-08-18--freight-capacity-batch-clearing/tests/cli.rs b/developer-simulation/runs/2026-08-18--freight-capacity-batch-clearing/tests/cli.rs
new file mode 100644
index 0000000..7c5f3d6
--- /dev/null
+++ b/developer-simulation/runs/2026-08-18--freight-capacity-batch-clearing/tests/cli.rs
@@ -0,0 +1,46 @@
+use std::{fs, process::Command};
+
+use sha2::{Digest, Sha256};
+
+#[test]
+fn clear_command_publishes_and_prints_machine_readable_result() {
+    // Catches a CLI that cannot exercise the tested library boundary or emits
+    // only human prose for the harness.
+    let directory = tempfile::tempdir().unwrap();
+    let orders = directory.path().join("orders.ndjson");
+    let manifest = directory.path().join("manifest.json");
+    let proposal = directory.path().join("proposal.ndjson");
+    let order_bytes = concat!(
+        "{\"order_id\":\"b\",\"lane_id\":\"lane\",\"service_date\":\"2026-09-01\",\"side\":\"buy\",\"submitted_sequence\":1,\"quantity\":3,\"limit_price_cents\":100}\n",
+        "{\"order_id\":\"s\",\"lane_id\":\"lane\",\"service_date\":\"2026-09-01\",\"side\":\"sell\",\"submitted_sequence\":1,\"quantity\":3,\"limit_price_cents\":90}\n",
+    )
+    .as_bytes();
+    fs::write(&orders, order_bytes).unwrap();
+    let order_digest = format!("{:x}", Sha256::digest(order_bytes));
+    fs::write(
+        &manifest,
+        format!(
+            "{{\"order_count\":2,\"buy_count\":1,\"sell_count\":1,\"market_count\":1,\"max_fill_count\":1,\"expected_gross_value_cents\":270,\"orders_sha256\":\"{order_digest}\"}}\n"
+        ),
+    )
+    .unwrap();
+
+    let output = Command::new(env!("CARGO_BIN_EXE_freight-clearing"))
+        .args([
+            "clear",
+            orders.to_str().unwrap(),
+            manifest.to_str().unwrap(),
+            proposal.to_str().unwrap(),
+        ])
+        .output()
+        .expect("run CLI");
+
+    assert!(
+        output.status.success(),
+        "{}",
+        String::from_utf8_lossy(&output.stderr)
+    );
+    let result: serde_json::Value = serde_json::from_slice(&output.stdout).expect("JSON stdout");
+    assert_eq!(result["fill_count"], 1);
+    assert!(proposal.exists());
+}
diff --git a/developer-simulation/runs/2026-08-18--freight-capacity-batch-clearing/tests/generator.rs b/developer-simulation/runs/2026-08-18--freight-capacity-batch-clearing/tests/generator.rs
new file mode 100644
index 0000000..46ecb82
--- /dev/null
+++ b/developer-simulation/runs/2026-08-18--freight-capacity-batch-clearing/tests/generator.rs
@@ -0,0 +1,56 @@
+use std::fs;
+
+use freight_clearing::{FailurePoint, FixtureSpec, generate_fixture, run_files};
+
+#[test]
+fn fixed_seed_generator_produces_exact_counts_and_identical_bytes() {
+    // Catches off-by-one market/side counts or hidden nondeterminism in the
+    // benchmark fixture generator.
+    let first = tempfile::tempdir().unwrap();
+    let second = tempfile::tempdir().unwrap();
+    let spec = FixtureSpec {
+        market_count: 5,
+        buy_count: 40,
+        sell_count: 25,
+        seed: 0x0818,
+    };
+
+    let first_fixture = generate_fixture(first.path(), spec).expect("first fixture");
+    let second_fixture = generate_fixture(second.path(), spec).expect("second fixture");
+
+    assert_eq!(first_fixture.manifest.order_count, 65);
+    assert_eq!(first_fixture.manifest.market_count, 5);
+    assert_eq!(first_fixture.manifest.max_fill_count, 60);
+    assert_eq!(first_fixture.manifest.buy_count, 40);
+    assert_eq!(first_fixture.manifest.sell_count, 25);
+    assert_eq!(
+        fs::read(first_fixture.paths.orders).unwrap(),
+        fs::read(second_fixture.paths.orders).unwrap()
+    );
+}
+
+#[test]
+fn generator_seed_shuffles_one_stable_snapshot_without_changing_proposal() {
+    // Catches a supposed shuffle seed that silently changes order contents,
+    // which would make the ten-seed determinism evidence meaningless.
+    let first = tempfile::tempdir().unwrap();
+    let second = tempfile::tempdir().unwrap();
+    let base = FixtureSpec {
+        market_count: 5,
+        buy_count: 40,
+        sell_count: 25,
+        seed: 1,
+    };
+    let first_fixture = generate_fixture(first.path(), base).expect("seed one fixture");
+    let second_fixture =
+        generate_fixture(second.path(), FixtureSpec { seed: 2, ..base }).expect("seed two fixture");
+
+    let first_result = run_files(&first_fixture.paths, FailurePoint::None).expect("first clear");
+    let second_result = run_files(&second_fixture.paths, FailurePoint::None).expect("second clear");
+
+    assert_ne!(
+        fs::read(first_fixture.paths.orders).unwrap(),
+        fs::read(second_fixture.paths.orders).unwrap()
+    );
+    assert_eq!(first_result.proposal_sha256, second_result.proposal_sha256);
+}
diff --git a/developer-simulation/runs/2026-08-18--freight-capacity-batch-clearing/tests/golden.rs b/developer-simulation/runs/2026-08-18--freight-capacity-batch-clearing/tests/golden.rs
new file mode 100644
index 0000000..ffb2513
--- /dev/null
+++ b/developer-simulation/runs/2026-08-18--freight-capacity-batch-clearing/tests/golden.rs
@@ -0,0 +1,95 @@
+use freight_clearing::{MarketKey, Order, Side, clear_market};
+
+type GoldenCase = (u64, u64, u64, u64, Option<(u64, u64)>);
+
+#[test]
+fn forty_hand_checked_golden_markets() {
+    // Each tuple is (buy quantity, sell quantity, buy limit, sell ask,
+    // expected fill quantity and seller-ask price). Expectations are literal,
+    // not computed with matcher helpers.
+    let cases: [GoldenCase; 40] = [
+        (1, 1, 100, 90, Some((1, 90))),
+        (2, 1, 100, 90, Some((1, 90))),
+        (1, 2, 100, 90, Some((1, 90))),
+        (9, 4, 100, 100, Some((4, 100))),
+        (4, 9, 100, 100, Some((4, 100))),
+        (7, 7, 55, 54, Some((7, 54))),
+        (7, 7, 55, 56, None),
+        (1, 1, 1, 1, Some((1, 1))),
+        (1, 1, 1, 2, None),
+        (1_000_000, 1, 10_000_000, 1, Some((1, 1))),
+        (1, 1_000_000, 10_000_000, 1, Some((1, 1))),
+        (
+            1_000_000,
+            1_000_000,
+            10_000_000,
+            10_000_000,
+            Some((1_000_000, 10_000_000)),
+        ),
+        (13, 8, 501, 500, Some((8, 500))),
+        (8, 13, 501, 500, Some((8, 500))),
+        (21, 21, 300, 299, Some((21, 299))),
+        (34, 21, 300, 301, None),
+        (55, 34, 700, 600, Some((34, 600))),
+        (34, 55, 700, 600, Some((34, 600))),
+        (89, 89, 42, 42, Some((89, 42))),
+        (144, 89, 42, 43, None),
+        (233, 144, 999, 1, Some((144, 1))),
+        (144, 233, 999, 1, Some((144, 1))),
+        (377, 377, 2, 2, Some((377, 2))),
+        (610, 377, 2, 3, None),
+        (987, 610, 5_000, 4_999, Some((610, 4_999))),
+        (610, 987, 5_000, 4_999, Some((610, 4_999))),
+        (1_597, 1_597, 73, 73, Some((1_597, 73))),
+        (2_584, 1_597, 73, 74, None),
+        (4_181, 2_584, 8_888, 7_777, Some((2_584, 7_777))),
+        (2_584, 4_181, 8_888, 7_777, Some((2_584, 7_777))),
+        (6_765, 6_765, 222, 111, Some((6_765, 111))),
+        (10_946, 6_765, 222, 223, None),
+        (17_711, 10_946, 91_001, 91_000, Some((10_946, 91_000))),
+        (10_946, 17_711, 91_001, 91_000, Some((10_946, 91_000))),
+        (28_657, 28_657, 6, 6, Some((28_657, 6))),
+        (46_368, 28_657, 6, 7, None),
+        (75_025, 46_368, 700_000, 699_999, Some((46_368, 699_999))),
+        (46_368, 75_025, 700_000, 699_999, Some((46_368, 699_999))),
+        (121_393, 121_393, 3_333, 3_333, Some((121_393, 3_333))),
+        (196_418, 121_393, 3_333, 3_334, None),
+    ];
+
+    for (index, (buy_quantity, sell_quantity, buy_price, sell_price, expected)) in
+        cases.into_iter().enumerate()
+    {
+        let lane_id = format!("golden-{index:02}");
+        let key = MarketKey::new(&lane_id, "2026-09-01");
+        let orders = [
+            Order {
+                order_id: format!("buy-{index:02}"),
+                lane_id: lane_id.clone(),
+                service_date: key.service_date.clone(),
+                side: Side::Buy,
+                submitted_sequence: 1,
+                quantity: buy_quantity,
+                limit_price_cents: buy_price,
+            },
+            Order {
+                order_id: format!("sell-{index:02}"),
+                lane_id: lane_id.clone(),
+                service_date: key.service_date.clone(),
+                side: Side::Sell,
+                submitted_sequence: 1,
+                quantity: sell_quantity,
+                limit_price_cents: sell_price,
+            },
+        ];
+
+        let fills = clear_market(&key, &orders).expect("valid golden market");
+        match expected {
+            Some((quantity, price)) => {
+                assert_eq!(fills.len(), 1, "golden market {index}");
+                assert_eq!(fills[0].quantity, quantity, "golden market {index}");
+                assert_eq!(fills[0].price_cents, price, "golden market {index}");
+            }
+            None => assert!(fills.is_empty(), "golden market {index}"),
+        }
+    }
+}
diff --git a/developer-simulation/runs/2026-08-18--freight-capacity-batch-clearing/tests/linux_metrics.rs b/developer-simulation/runs/2026-08-18--freight-capacity-batch-clearing/tests/linux_metrics.rs
new file mode 100644
index 0000000..f7932bb
--- /dev/null
+++ b/developer-simulation/runs/2026-08-18--freight-capacity-batch-clearing/tests/linux_metrics.rs
@@ -0,0 +1,10 @@
+use freight_clearing::parse_linux_peak_rss_bytes;
+
+#[test]
+fn linux_vmhwm_is_converted_from_kibibytes_to_bytes() {
+    // Catches reporting the Linux high-water mark in KiB while labelling it
+    // as bytes in machine-readable benchmark output.
+    let status = "Name:\tfreight\nVmRSS:\t 120000 kB\nVmHWM:\t 123456 kB\n";
+
+    assert_eq!(parse_linux_peak_rss_bytes(status), Some(126_418_944));
+}
diff --git a/developer-simulation/runs/2026-08-18--freight-capacity-batch-clearing/tests/matcher.rs b/developer-simulation/runs/2026-08-18--freight-capacity-batch-clearing/tests/matcher.rs
new file mode 100644
index 0000000..db41a6a
--- /dev/null
+++ b/developer-simulation/runs/2026-08-18--freight-capacity-batch-clearing/tests/matcher.rs
@@ -0,0 +1,52 @@
+use freight_clearing::{MarketKey, Order, Side, clear_market};
+
+fn order(id: &str, side: Side, sequence: u64, quantity: u64, price: u64) -> Order {
+    Order {
+        order_id: id.to_owned(),
+        lane_id: "sea-nyc".to_owned(),
+        service_date: "2026-09-01".to_owned(),
+        side,
+        submitted_sequence: sequence,
+        quantity,
+        limit_price_cents: price,
+    }
+}
+
+#[test]
+fn seller_ask_and_partial_quantities_follow_the_specification() {
+    // Catches using the buyer price, skipping the partially remaining buy,
+    // or losing quantity when one buy spans multiple sells.
+    let key = MarketKey::new("sea-nyc", "2026-09-01");
+    let orders = vec![
+        order("buy", Side::Buy, 1, 7, 120),
+        order("sell-a", Side::Sell, 2, 3, 100),
+        order("sell-b", Side::Sell, 3, 4, 110),
+    ];
+
+    let fills = clear_market(&key, &orders).expect("valid market");
+
+    assert_eq!(fills.len(), 2);
+    assert_eq!(fills[0].buy_id, "buy");
+    assert_eq!(fills[0].sell_id, "sell-a");
+    assert_eq!(fills[0].quantity, 3);
+    assert_eq!(fills[0].price_cents, 100);
+    assert_eq!(fills[1].sell_id, "sell-b");
+    assert_eq!(fills[1].quantity, 4);
+    assert_eq!(fills[1].price_cents, 110);
+}
+
+#[test]
+fn equal_price_and_sequence_use_bytewise_order_id() {
+    // Catches inheriting insertion order for the final priority tie-breaker.
+    let key = MarketKey::new("sea-nyc", "2026-09-01");
+    let orders = vec![
+        order("buy-z", Side::Buy, 9, 1, 100),
+        order("buy-a", Side::Buy, 9, 1, 100),
+        order("sell", Side::Sell, 1, 1, 100),
+    ];
+
+    let fills = clear_market(&key, &orders).expect("valid market");
+
+    assert_eq!(fills.len(), 1);
+    assert_eq!(fills[0].buy_id, "buy-a");
+}
diff --git a/developer-simulation/runs/2026-08-18--freight-capacity-batch-clearing/tests/publication.rs b/developer-simulation/runs/2026-08-18--freight-capacity-batch-clearing/tests/publication.rs
new file mode 100644
index 0000000..6aa86b4
--- /dev/null
+++ b/developer-simulation/runs/2026-08-18--freight-capacity-batch-clearing/tests/publication.rs
@@ -0,0 +1,122 @@
+use std::fs;
+
+use freight_clearing::{FailurePoint, RunPaths, run_files};
+use sha2::{Digest, Sha256};
+
+fn write_valid_snapshot(directory: &std::path::Path) -> RunPaths {
+    let orders = directory.join("orders.ndjson");
+    let manifest = directory.join("manifest.json");
+    let proposal = directory.join("proposal.ndjson");
+    let order_bytes = concat!(
+        "{\"order_id\":\"s1\",\"lane_id\":\"lane\",\"service_date\":\"2026-09-01\",\"side\":\"sell\",\"submitted_sequence\":2,\"quantity\":3,\"limit_price_cents\":90}\n",
+        "{\"order_id\":\"b1\",\"lane_id\":\"lane\",\"service_date\":\"2026-09-01\",\"side\":\"buy\",\"submitted_sequence\":1,\"quantity\":3,\"limit_price_cents\":100}\n",
+    )
+    .as_bytes();
+    fs::write(&orders, order_bytes).unwrap();
+    let order_digest = format!("{:x}", Sha256::digest(order_bytes));
+    fs::write(
+        &manifest,
+        format!(
+            "{{\"order_count\":2,\"buy_count\":1,\"sell_count\":1,\"market_count\":1,\"max_fill_count\":1,\"expected_gross_value_cents\":270,\"orders_sha256\":\"{order_digest}\"}}\n"
+        ),
+    )
+    .unwrap();
+    RunPaths {
+        orders,
+        manifest,
+        proposal,
+    }
+}
+
+#[test]
+fn exit_after_temp_sync_preserves_previous_proposal_and_removes_temp_file() {
+    // Catches writing to the final path early or leaking an ambiguous sibling
+    // file after a crash-window simulation.
+    let directory = tempfile::tempdir().unwrap();
+    let paths = write_valid_snapshot(directory.path());
+    fs::write(&paths.proposal, b"previous-complete-proposal\n").unwrap();
+
+    let error = run_files(&paths, FailurePoint::AfterTempSync)
+        .expect_err("injected pre-rename exit must fail");
+
+    assert!(error.contains("injected"), "{error}");
+    assert_eq!(
+        fs::read(&paths.proposal).unwrap(),
+        b"previous-complete-proposal\n"
+    );
+    let names: Vec<_> = fs::read_dir(directory.path())
+        .unwrap()
+        .map(|entry| entry.unwrap().file_name())
+        .collect();
+    assert_eq!(names.len(), 3, "temporary output leaked: {names:?}");
+}
+
+#[test]
+fn every_injected_prepublication_exit_preserves_previous_bytes() {
+    // Catches exposing partially cleared output at the final path.
+    for failure in [
+        FailurePoint::AfterValidation,
+        FailurePoint::AfterOnePercent,
+        FailurePoint::AfterHalf,
+    ] {
+        let directory = tempfile::tempdir().unwrap();
+        let paths = write_valid_snapshot(directory.path());
+        fs::write(&paths.proposal, b"stable\n").unwrap();
+
+        run_files(&paths, failure).expect_err("injected exit must fail");
+
+        assert_eq!(fs::read(&paths.proposal).unwrap(), b"stable\n");
+    }
+}
+
+#[test]
+fn shuffled_input_and_repeat_runs_publish_identical_bytes() {
+    // Catches arrival-order or process-state leakage into canonical output.
+    let directory = tempfile::tempdir().unwrap();
+    let paths = write_valid_snapshot(directory.path());
+
+    let first = run_files(&paths, FailurePoint::None).expect("first run");
+    let first_bytes = fs::read(&paths.proposal).unwrap();
+    let lines: Vec<_> = fs::read_to_string(&paths.orders)
+        .unwrap()
+        .lines()
+        .map(str::to_owned)
+        .collect();
+    let shuffled = format!("{}\n{}\n", lines[1], lines[0]);
+    fs::write(&paths.orders, &shuffled).unwrap();
+    let mut manifest: serde_json::Value =
+        serde_json::from_slice(&fs::read(&paths.manifest).unwrap()).unwrap();
+    manifest["orders_sha256"] =
+        serde_json::Value::String(format!("{:x}", Sha256::digest(shuffled.as_bytes())));
+    fs::write(
+        &paths.manifest,
+        serde_json::to_vec_pretty(&manifest).unwrap(),
+    )
+    .unwrap();
+    let second = run_files(&paths, FailurePoint::None).expect("shuffled run");
+    let second_bytes = fs::read(&paths.proposal).unwrap();
+    let third = run_files(&paths, FailurePoint::None).expect("repeat run");
+
+    assert_eq!(first_bytes, second_bytes);
+    assert_eq!(first.proposal_sha256, second.proposal_sha256);
+    assert_eq!(second.proposal_sha256, third.proposal_sha256);
+}
+
+#[test]
+fn forced_read_and_write_errors_never_replace_a_prior_proposal() {
+    // Catches error paths that touch the final output before all I/O succeeds.
+    let directory = tempfile::tempdir().unwrap();
+    let mut paths = write_valid_snapshot(directory.path());
+    fs::write(&paths.proposal, b"prior\n").unwrap();
+    paths.orders = directory.path().to_path_buf();
+    run_files(&paths, FailurePoint::None).expect_err("directory read must fail");
+    assert_eq!(fs::read(&paths.proposal).unwrap(), b"prior\n");
+
+    let paths = write_valid_snapshot(directory.path());
+    let unwritable = RunPaths {
+        proposal: directory.path().join("missing-parent/proposal.ndjson"),
+        ..paths
+    };
+    run_files(&unwritable, FailurePoint::None).expect_err("missing output parent must fail");
+    assert!(!unwritable.proposal.exists());
+}
diff --git a/developer-simulation/runs/2026-08-18--freight-capacity-batch-clearing/tests/reference.rs b/developer-simulation/runs/2026-08-18--freight-capacity-batch-clearing/tests/reference.rs
new file mode 100644
index 0000000..556d5de
--- /dev/null
+++ b/developer-simulation/runs/2026-08-18--freight-capacity-batch-clearing/tests/reference.rs
@@ -0,0 +1,90 @@
+use freight_clearing::{MarketKey, Order, Side, clear_market, slow_reference_market};
+
+fn order(id: &str, side: Side, sequence: u64, quantity: u64, price: u64) -> Order {
+    Order {
+        order_id: id.to_owned(),
+        lane_id: "lax-chi".to_owned(),
+        service_date: "2026-10-02".to_owned(),
+        side,
+        submitted_sequence: sequence,
+        quantity,
+        limit_price_cents: price,
+    }
+}
+
+#[test]
+fn optimized_matcher_matches_independent_scan_reference() {
+    // Catches a sorting or cursor mutation that disagrees with an
+    // independently structured, deliberately slow priority scan.
+    let key = MarketKey::new("lax-chi", "2026-10-02");
+    let orders = vec![
+        order("b2", Side::Buy, 2, 7, 110),
+        order("s2", Side::Sell, 4, 5, 105),
+        order("b1", Side::Buy, 1, 3, 110),
+        order("s1", Side::Sell, 3, 8, 100),
+    ];
+
+    let actual = clear_market(&key, &orders).expect("optimized matcher");
+    let reference = slow_reference_market(&key, &orders).expect("reference matcher");
+
+    assert_eq!(actual, reference);
+}
+
+#[test]
+fn ten_thousand_fixed_seed_markets_match_the_slow_reference() {
+    // Catches priority and remaining-quantity interactions outside the
+    // hand-written examples. The seed is printed in every mismatch message.
+    const SEED: u64 = 0x5eed_f012_2026_0818;
+    let mut rng = Lcg(SEED);
+    for market_number in 0..10_000_u64 {
+        let key = MarketKey::new(&format!("lane-{market_number}"), "2026-10-02");
+        let buy_count = 1 + rng.range(4);
+        let sell_count = 1 + rng.range(4);
+        let mut orders = Vec::new();
+        for index in 0..buy_count {
+            orders.push(Order {
+                order_id: format!("b-{market_number}-{index}"),
+                lane_id: key.lane_id.clone(),
+                service_date: key.service_date.clone(),
+                side: Side::Buy,
+                submitted_sequence: rng.range(4),
+                quantity: 1 + rng.range(10),
+                limit_price_cents: 1 + rng.range(20),
+            });
+        }
+        for index in 0..sell_count {
+            orders.push(Order {
+                order_id: format!("s-{market_number}-{index}"),
+                lane_id: key.lane_id.clone(),
+                service_date: key.service_date.clone(),
+                side: Side::Sell,
+                submitted_sequence: rng.range(4),
+                quantity: 1 + rng.range(10),
+                limit_price_cents: 1 + rng.range(20),
+            });
+        }
+        for index in (1..orders.len()).rev() {
+            let swap_with = usize::try_from(rng.range(u64::try_from(index + 1).unwrap())).unwrap();
+            orders.swap(index, swap_with);
+        }
+
+        let actual = clear_market(&key, &orders).expect("optimized matcher");
+        let reference = slow_reference_market(&key, &orders).expect("reference matcher");
+        assert_eq!(
+            actual, reference,
+            "seed={SEED:#x}, market_number={market_number}"
+        );
+    }
+}
+
+struct Lcg(u64);
+
+impl Lcg {
+    fn range(&mut self, upper: u64) -> u64 {
+        self.0 = self
+            .0
+            .wrapping_mul(6_364_136_223_846_793_005)
+            .wrapping_add(1_442_695_040_888_963_407);
+        self.0 % upper
+    }
+}
diff --git a/developer-simulation/runs/2026-08-18--freight-capacity-batch-clearing/tests/reviewer_repairs.rs b/developer-simulation/runs/2026-08-18--freight-capacity-batch-clearing/tests/reviewer_repairs.rs
new file mode 100644
index 0000000..6ec3831
--- /dev/null
+++ b/developer-simulation/runs/2026-08-18--freight-capacity-batch-clearing/tests/reviewer_repairs.rs
@@ -0,0 +1,312 @@
+use std::{
+    fs,
+    io::{self, BufRead, Read},
+    path::Path,
+    process::Command,
+};
+
+use freight_clearing::{
+    FailurePoint, FixtureSpec, Manifest, RunErrorState, RunPaths, generate_fixture, run_files,
+    validate_orders,
+};
+use sha2::{Digest, Sha256};
+
+fn small_fixture(directory: &Path) -> RunPaths {
+    generate_fixture(
+        directory,
+        FixtureSpec {
+            market_count: 1,
+            buy_count: 1,
+            sell_count: 1,
+            seed: 7,
+        },
+    )
+    .expect("generate fixture")
+    .paths
+}
+
+fn digest(path: &Path) -> String {
+    format!("{:x}", Sha256::digest(fs::read(path).expect("read source")))
+}
+
+fn edit_manifest(
+    paths: &RunPaths,
+    edit: impl FnOnce(&mut serde_json::Map<String, serde_json::Value>),
+) {
+    let mut value: serde_json::Value =
+        serde_json::from_slice(&fs::read(&paths.manifest).unwrap()).unwrap();
+    edit(value.as_object_mut().expect("manifest object"));
+    fs::write(&paths.manifest, serde_json::to_vec_pretty(&value).unwrap()).unwrap();
+}
+
+#[test]
+fn proposal_equal_to_orders_is_rejected_without_changing_orders() {
+    // Catches replacing the immutable order snapshot when output and input
+    // are the same ordinary path.
+    let directory = tempfile::tempdir().unwrap();
+    let fixture = small_fixture(directory.path());
+    let before = digest(&fixture.orders);
+    let paths = RunPaths {
+        proposal: fixture.orders.clone(),
+        ..fixture
+    };
+
+    let error = run_files(&paths, FailurePoint::None).expect_err("orders alias must fail");
+
+    assert!(error.contains("aliases an input"), "{error}");
+    assert_eq!(digest(&paths.orders), before);
+}
+
+#[test]
+fn resolved_proposal_equal_to_manifest_is_rejected_without_changing_manifest() {
+    // Catches a lexical spelling difference bypassing the manifest alias
+    // guard after path resolution.
+    let directory = tempfile::tempdir().unwrap();
+    let fixture = small_fixture(directory.path());
+    let before = digest(&fixture.manifest);
+    let paths = RunPaths {
+        proposal: directory.path().join("subdir/../manifest.json"),
+        ..fixture
+    };
+    fs::create_dir(directory.path().join("subdir")).unwrap();
+
+    let error = run_files(&paths, FailurePoint::None).expect_err("manifest alias must fail");
+
+    assert!(error.contains("aliases an input"), "{error}");
+    assert_eq!(digest(&paths.manifest), before);
+}
+
+#[cfg(unix)]
+#[test]
+fn existing_hard_link_to_orders_is_rejected_by_file_identity() {
+    // Catches comparing only canonical path strings when two existing names
+    // refer to one inode.
+    let directory = tempfile::tempdir().unwrap();
+    let fixture = small_fixture(directory.path());
+    let proposal = directory.path().join("proposal.ndjson");
+    fs::hard_link(&fixture.orders, &proposal).unwrap();
+    let before = digest(&fixture.orders);
+    let paths = RunPaths {
+        proposal,
+        ..fixture
+    };
+
+    let error = run_files(&paths, FailurePoint::None).expect_err("hard-link alias must fail");
+
+    assert!(error.contains("aliases an input"), "{error}");
+    assert_eq!(digest(&paths.orders), before);
+    assert_eq!(digest(&paths.proposal), before);
+}
+
+#[test]
+fn relative_proposal_path_publishes_successfully() {
+    // Catches treating Path::parent("") as an invalid directory after the
+    // complete proposal has already been renamed into place.
+    let directory = tempfile::tempdir().unwrap();
+    small_fixture(directory.path());
+
+    let output = Command::new(env!("CARGO_BIN_EXE_freight-clearing"))
+        .current_dir(directory.path())
+        .args(["clear", "orders.ndjson", "manifest.json", "proposal.ndjson"])
+        .output()
+        .expect("run clear CLI");
+
+    assert!(
+        output.status.success(),
+        "stderr: {}",
+        String::from_utf8_lossy(&output.stderr)
+    );
+    assert!(directory.path().join("proposal.ndjson").is_file());
+}
+
+#[test]
+fn post_rename_failure_reports_durability_uncertainty_not_nonpublication() {
+    // Catches collapsing a directory-sync failure after rename into the same
+    // error state as a failure that preserved the previous proposal.
+    let directory = tempfile::tempdir().unwrap();
+    let paths = small_fixture(directory.path());
+    fs::write(&paths.proposal, b"previous\n").unwrap();
+
+    let error = run_files(&paths, FailurePoint::AfterRenameBeforeDirectorySync)
+        .expect_err("post-rename injection must report uncertainty");
+
+    assert!(error.is_durability_uncertain(), "{error}");
+    assert!(
+        error
+            .to_string()
+            .starts_with("PUBLISHED_DURABILITY_UNCERTAIN:"),
+        "{error}"
+    );
+    let published = fs::read_to_string(&paths.proposal).unwrap();
+    assert!(published.contains("\"fill_index\":0"), "{published}");
+    assert_ne!(published.as_bytes(), b"previous\n");
+}
+
+#[test]
+fn pre_rename_failure_reports_not_published_and_preserves_previous_bytes() {
+    // Catches accidentally labelling a modeled pre-rename failure as an
+    // uncertain publication after adding the post-rename state.
+    let directory = tempfile::tempdir().unwrap();
+    let paths = small_fixture(directory.path());
+    fs::write(&paths.proposal, b"previous\n").unwrap();
+
+    let error =
+        run_files(&paths, FailurePoint::AfterTempSync).expect_err("pre-rename injection must fail");
+
+    assert_eq!(error.state(), RunErrorState::NotPublished);
+    assert_eq!(fs::read(&paths.proposal).unwrap(), b"previous\n");
+}
+
+struct CountingBufRead {
+    bytes: Vec<u8>,
+    position: usize,
+    consumed: usize,
+}
+
+impl Read for CountingBufRead {
+    fn read(&mut self, output: &mut [u8]) -> io::Result<usize> {
+        let available = self.fill_buf()?;
+        let count = available.len().min(output.len());
+        output[..count].copy_from_slice(&available[..count]);
+        self.consume(count);
+        Ok(count)
+    }
+}
+
+impl BufRead for CountingBufRead {
+    fn fill_buf(&mut self) -> io::Result<&[u8]> {
+        Ok(&self.bytes[self.position..])
+    }
+
+    fn consume(&mut self, amount: usize) {
+        self.position += amount;
+        self.consumed += amount;
+    }
+}
+
+#[test]
+fn one_mib_overlong_line_is_rejected_without_consuming_beyond_the_bound() {
+    // Catches read_until allocating and consuming the complete corrupt line
+    // before applying the advertised 4 KiB limit.
+    let mut bytes = vec![b'x'; 1024 * 1024];
+    bytes.push(b'\n');
+    let mut reader = CountingBufRead {
+        bytes,
+        position: 0,
+        consumed: 0,
+    };
+    let manifest = Manifest {
+        order_count: 0,
+        buy_count: 0,
+        sell_count: 0,
+        market_count: 0,
+        max_fill_count: 0,
+        expected_gross_value_cents: None,
+        orders_sha256: None,
+    };
+
+    let error = validate_orders(&mut reader, &manifest).expect_err("overlong line must fail");
+
+    assert!(error.contains("line too long"), "{error}");
+    assert!(
+        reader.consumed <= 4_097,
+        "consumed {} bytes before rejection",
+        reader.consumed
+    );
+}
+
+#[test]
+fn run_boundary_rejects_missing_orders_digest_without_touching_orders() {
+    // Catches treating a missing reference-integrity digest as permission to
+    // publish evidence without checking the immutable snapshot.
+    let directory = tempfile::tempdir().unwrap();
+    let paths = small_fixture(directory.path());
+    let orders_before = digest(&paths.orders);
+    edit_manifest(&paths, |manifest| {
+        manifest.remove("orders_sha256");
+    });
+
+    let error = run_files(&paths, FailurePoint::None).expect_err("missing digest must fail");
+
+    assert!(error.contains("orders_sha256 is required"), "{error}");
+    assert_eq!(digest(&paths.orders), orders_before);
+    assert!(!paths.proposal.exists());
+}
+
+#[test]
+fn run_boundary_rejects_null_orders_digest() {
+    // Catches serde Option treating an explicit null integrity field as valid
+    // evidence configuration.
+    let directory = tempfile::tempdir().unwrap();
+    let paths = small_fixture(directory.path());
+    edit_manifest(&paths, |manifest| {
+        manifest.insert("orders_sha256".to_owned(), serde_json::Value::Null);
+    });
+
+    let error = run_files(&paths, FailurePoint::None).expect_err("null digest must fail");
+
+    assert!(error.contains("orders_sha256 is required"), "{error}");
+    assert!(!paths.proposal.exists());
+}
+
+#[test]
+fn run_boundary_rejects_malformed_orders_digest_before_comparison() {
+    // Catches reporting a reference mismatch for a field that was not a
+    // syntactically valid SHA-256 digest in the first place.
+    for malformed in ["abc".to_owned(), "g".repeat(64)] {
+        let directory = tempfile::tempdir().unwrap();
+        let paths = small_fixture(directory.path());
+        edit_manifest(&paths, |manifest| {
+            manifest.insert(
+                "orders_sha256".to_owned(),
+                serde_json::Value::String(malformed),
+            );
+        });
+
+        let error = run_files(&paths, FailurePoint::None).expect_err("malformed digest must fail");
+
+        assert!(error.contains("valid 64-hex"), "{error}");
+        assert!(!paths.proposal.exists());
+    }
+}
+
+#[test]
+fn run_boundary_rejects_missing_expected_gross_value() {
+    // Catches publishing a proposal that was never compared with the
+    // authoritative gross-value field at the evidence boundary.
+    let directory = tempfile::tempdir().unwrap();
+    let paths = small_fixture(directory.path());
+    edit_manifest(&paths, |manifest| {
+        manifest.remove("expected_gross_value_cents");
+    });
+
+    let error =
+        run_files(&paths, FailurePoint::None).expect_err("missing expected gross must fail");
+
+    assert!(
+        error.contains("expected_gross_value_cents is required"),
+        "{error}"
+    );
+    assert!(!paths.proposal.exists());
+}
+
+#[test]
+fn run_boundary_rejects_null_expected_gross_value() {
+    // Catches an explicit null bypassing the required authoritative value.
+    let directory = tempfile::tempdir().unwrap();
+    let paths = small_fixture(directory.path());
+    edit_manifest(&paths, |manifest| {
+        manifest.insert(
+            "expected_gross_value_cents".to_owned(),
+            serde_json::Value::Null,
+        );
+    });
+
+    let error = run_files(&paths, FailurePoint::None).expect_err("null expected gross must fail");
+
+    assert!(
+        error.contains("expected_gross_value_cents is required"),
+        "{error}"
+    );
+    assert!(!paths.proposal.exists());
+}
diff --git a/developer-simulation/runs/2026-08-18--freight-capacity-batch-clearing/tests/validation.rs b/developer-simulation/runs/2026-08-18--freight-capacity-batch-clearing/tests/validation.rs
new file mode 100644
index 0000000..b6b6f66
--- /dev/null
+++ b/developer-simulation/runs/2026-08-18--freight-capacity-batch-clearing/tests/validation.rs
@@ -0,0 +1,160 @@
+use std::io::Cursor;
+
+use freight_clearing::{Manifest, validate_orders};
+
+fn single_buy_manifest() -> Manifest {
+    Manifest {
+        order_count: 1,
+        buy_count: 1,
+        sell_count: 0,
+        market_count: 1,
+        max_fill_count: 0,
+        expected_gross_value_cents: None,
+        orders_sha256: None,
+    }
+}
+
+#[test]
+fn valid_complete_ndjson_is_grouped_only_after_manifest_counts_match() {
+    // Catches trusting input arrival order or accepting a batch whose declared
+    // counts were never checked.
+    let input = concat!(
+        "{\"order_id\":\"s1\",\"lane_id\":\"lane\",\"service_date\":\"2026-09-01\",\"side\":\"sell\",\"submitted_sequence\":2,\"quantity\":3,\"limit_price_cents\":90}\n",
+        "{\"order_id\":\"b1\",\"lane_id\":\"lane\",\"service_date\":\"2026-09-01\",\"side\":\"buy\",\"submitted_sequence\":1,\"quantity\":3,\"limit_price_cents\":100}\n",
+    );
+    let manifest = Manifest {
+        order_count: 2,
+        buy_count: 1,
+        sell_count: 1,
+        market_count: 1,
+        max_fill_count: 1,
+        expected_gross_value_cents: None,
+        orders_sha256: None,
+    };
+
+    let batch = validate_orders(Cursor::new(input.as_bytes()), &manifest).expect("valid batch");
+
+    assert_eq!(batch.order_count(), 2);
+    assert_eq!(batch.market_count(), 1);
+}
+
+#[test]
+fn duplicate_global_order_id_rejects_the_whole_batch() {
+    // Catches checking uniqueness only within one side or market.
+    let input = concat!(
+        "{\"order_id\":\"same\",\"lane_id\":\"lane-a\",\"service_date\":\"2026-09-01\",\"side\":\"sell\",\"submitted_sequence\":2,\"quantity\":3,\"limit_price_cents\":90}\n",
+        "{\"order_id\":\"same\",\"lane_id\":\"lane-b\",\"service_date\":\"2026-09-02\",\"side\":\"buy\",\"submitted_sequence\":1,\"quantity\":3,\"limit_price_cents\":100}\n",
+    );
+    let manifest = Manifest {
+        order_count: 2,
+        buy_count: 1,
+        sell_count: 1,
+        market_count: 2,
+        max_fill_count: 0,
+        expected_gross_value_cents: None,
+        orders_sha256: None,
+    };
+
+    let error = validate_orders(Cursor::new(input.as_bytes()), &manifest)
+        .expect_err("duplicate ID must fail");
+
+    assert!(error.contains("duplicate order_id"), "{error}");
+}
+
+#[test]
+fn record_without_final_newline_is_rejected_as_truncated() {
+    // Catches accepting an NDJSON export that may have been cut mid-write.
+    let input = "{\"order_id\":\"b1\",\"lane_id\":\"lane\",\"service_date\":\"2026-09-01\",\"side\":\"buy\",\"submitted_sequence\":1,\"quantity\":3,\"limit_price_cents\":100}";
+    let manifest = Manifest {
+        order_count: 1,
+        buy_count: 1,
+        sell_count: 0,
+        market_count: 1,
+        max_fill_count: 0,
+        expected_gross_value_cents: None,
+        orders_sha256: None,
+    };
+
+    let error = validate_orders(Cursor::new(input.as_bytes()), &manifest)
+        .expect_err("truncated NDJSON must fail");
+
+    assert!(error.contains("final newline"), "{error}");
+}
+
+#[test]
+fn invalid_fields_are_rejected_before_any_market_is_cleared() {
+    // Catches silently accepting a malformed snapshot row and deferring the
+    // failure until after some market work has already happened.
+    let cases = [
+        (
+            "{\"order_id\":\"\",\"lane_id\":\"lane\",\"service_date\":\"2026-09-01\",\"side\":\"buy\",\"submitted_sequence\":1,\"quantity\":3,\"limit_price_cents\":100}\n",
+            "order_id",
+        ),
+        (
+            "{\"order_id\":\"b1\",\"lane_id\":\"\",\"service_date\":\"2026-09-01\",\"side\":\"buy\",\"submitted_sequence\":1,\"quantity\":3,\"limit_price_cents\":100}\n",
+            "lane_id",
+        ),
+        (
+            "{\"order_id\":\"bé\",\"lane_id\":\"lane\",\"service_date\":\"2026-09-01\",\"side\":\"buy\",\"submitted_sequence\":1,\"quantity\":3,\"limit_price_cents\":100}\n",
+            "ASCII",
+        ),
+        (
+            "{\"order_id\":\"b1\",\"lane_id\":\"lane\",\"service_date\":\"2026-02-30\",\"side\":\"buy\",\"submitted_sequence\":1,\"quantity\":3,\"limit_price_cents\":100}\n",
+            "service_date",
+        ),
+        (
+            "{\"order_id\":\"b1\",\"lane_id\":\"lane\",\"service_date\":\"2026-09-01\",\"side\":\"hold\",\"submitted_sequence\":1,\"quantity\":3,\"limit_price_cents\":100}\n",
+            "unknown variant",
+        ),
+        (
+            "{\"order_id\":\"b1\",\"lane_id\":\"lane\",\"service_date\":\"2026-09-01\",\"side\":\"buy\",\"submitted_sequence\":-1,\"quantity\":3,\"limit_price_cents\":100}\n",
+            "invalid value",
+        ),
+        (
+            "{\"order_id\":\"b1\",\"lane_id\":\"lane\",\"service_date\":\"2026-09-01\",\"side\":\"buy\",\"submitted_sequence\":1,\"quantity\":0,\"limit_price_cents\":100}\n",
+            "quantity",
+        ),
+        (
+            "{\"order_id\":\"b1\",\"lane_id\":\"lane\",\"service_date\":\"2026-09-01\",\"side\":\"buy\",\"submitted_sequence\":1,\"quantity\":1000001,\"limit_price_cents\":100}\n",
+            "quantity",
+        ),
+        (
+            "{\"order_id\":\"b1\",\"lane_id\":\"lane\",\"service_date\":\"2026-09-01\",\"side\":\"buy\",\"submitted_sequence\":1,\"quantity\":3,\"limit_price_cents\":0}\n",
+            "limit_price_cents",
+        ),
+        (
+            "{\"order_id\":\"b1\",\"lane_id\":\"lane\",\"service_date\":\"2026-09-01\",\"side\":\"buy\",\"submitted_sequence\":1,\"quantity\":3,\"limit_price_cents\":10000001}\n",
+            "limit_price_cents",
+        ),
+    ];
+
+    for (input, expected) in cases {
+        let error = validate_orders(Cursor::new(input.as_bytes()), &single_buy_manifest())
+            .expect_err("invalid field must fail");
+        assert!(
+            error.contains(expected),
+            "expected {expected:?} in {error:?}"
+        );
+    }
+}
+
+#[test]
+fn invalid_utf8_is_rejected() {
+    // Catches lossy decoding that could alter bytewise order IDs.
+    let input = vec![0xff, b'\n'];
+    let error = validate_orders(Cursor::new(input), &single_buy_manifest())
+        .expect_err("invalid UTF-8 must fail");
+    assert!(error.contains("invalid UTF-8"), "{error}");
+}
+
+#[test]
+fn overlong_line_is_rejected_before_json_parsing() {
+    // Catches unbounded line buffering on a corrupt export.
+    let input = format!(
+        "{{\"order_id\":\"b1\",\"lane_id\":\"lane\",\"service_date\":\"2026-09-01\",\"side\":\"buy\",\"submitted_sequence\":1,\"quantity\":3,\"limit_price_cents\":100,\"padding\":\"{}\"}}\n",
+        "x".repeat(5_000)
+    );
+    let error = validate_orders(Cursor::new(input.as_bytes()), &single_buy_manifest())
+        .expect_err("overlong line must fail");
+    assert!(error.contains("line too long"), "{error}");
+}
diff --git a/developer-simulation/runs/2026-08-18--laboratory-unit-conversion-gate/BRIEF.md b/developer-simulation/runs/2026-08-18--laboratory-unit-conversion-gate/BRIEF.md
new file mode 100644
index 0000000..c1026f0
--- /dev/null
+++ b/developer-simulation/runs/2026-08-18--laboratory-unit-conversion-gate/BRIEF.md
@@ -0,0 +1,79 @@
+# Trial 1: Exact laboratory-unit conversion admission gate
+
+## Developer role and exact Rust experience
+
+You are a healthcare-interface developer who has maintained Java and SQL integrations for eight years. You have used Rust part-time for exactly four months, completed the Rust Book, and shipped two internal command-line import validators; you have not shipped a Rust service or unsafe Rust code.
+
+## Existing system and baseline
+
+A regional laboratory network receives observation exports from instrument gateways. PostgreSQL reference tables and a Java 17 conversion service remain authoritative. The Java service parses decimal values, selects a mapping by `(source_system, analyte_code, source_unit)`, checks the declared physical dimension, applies a configured rational affine transform, and rounds to the analyte's declared decimal scale.
+
+Before onboarding a new gateway, operators run a Node.js batch preflight against an immutable export. It is advisory: it emits normalized preview rows and review reasons but never changes the reference tables or clinical records. A frozen slow Java evaluator and signed expected-output fixtures define the required behavior for this trial.
+
+## Concrete pain
+
+The Node.js preflight uses binary floating point and has drifted from the Java service on half-way rounding and large negative values. It also lets an unknown unit fall through as an unconverted string in one code path. A million-row migration rehearsal takes about eleven minutes and peaks above 1.4 GiB, so teams sample the data instead of checking the entire file. The prototype must show whether a small Rust CLI can give operators a complete, exact, fail-closed report before a source is admitted.
+
+## Workload and data shape
+
+The self-contained benchmark contains:
+
+- One immutable reference snapshot with exactly 12,000 unique mapping rows, 250 unit symbols, and 300 analyte definitions.
+- Exactly 1,000,000 NDJSON observations: 950,000 ordinary valid conversions, 25,000 valid boundary conversions, and 25,000 expected record-level rejections. The three classes sum to 1,000,000.
+- Observation fields `observation_id`, `source_system`, `analyte_code`, `source_unit`, `declared_dimension`, and `value`. IDs are nonempty ASCII and globally unique. A line is at most 1,024 bytes.
+- Decimal values with at most 29 significant digits and scale 0 through 9. Scientific notation, `NaN`, and infinity are outside the accepted input grammar.
+- A unique mapping key, target unit, expected dimension, target scale from 0 through 9, positive rational multiplier, and signed rational offset. Numerators and denominators are bounded in the fixture so checked `i128` arithmetic is sufficient; denominators are never zero.
+
+For an admitted row, compute `target = source * multiplier + offset` as exact rational arithmetic, then round once to the target scale using round-half-to-even. Do not round an intermediate. An unknown mapping, incompatible observation-declared dimension, or invalid observation value becomes a record-level rejection. A malformed or internally inconsistent reference snapshot, duplicate observation ID, unreadable input, or structurally invalid NDJSON invalidates the whole run.
+
+## Operational constraints
+
+- Run offline on a declared two-core Linux machine with no network access.
+- Treat the PostgreSQL export and signed fixtures as immutable inputs; the prototype must not connect to a database.
+- Never emit patient names or raw free-text fields. Fixtures contain synthetic IDs only, and diagnostics may contain an observation ID, field name, and stable reason code.
+- Validate the full reference snapshot before processing observations. A mapping-key duplicate, unknown unit symbol, mapping-to-analyte dimension mismatch, zero denominator, invalid scale, or transform coefficient outside the declared arithmetic bounds is a run-level failure.
+- Produce one complete canonical report or leave the previous complete report untouched. Publication uses a sibling temporary file and an atomic rename on the same filesystem.
+- Use safe Rust only. No subprocess, locale-sensitive number parsing, wall-clock decision, or environment-dependent ordering is permitted.
+
+## Measurable acceptance criteria
+
+### Correctness
+
+1. On all signed fixtures, output exactly one normalized row or rejection row for every observation ID and match the frozen Java evaluator byte for byte after canonical sorting by `observation_id`.
+2. On the million-row benchmark, report exactly 975,000 conversions and 25,000 rejections; `950,000 + 25,000 = 975,000`, and `975,000 + 25,000 = 1,000,000`.
+3. Pass at least 20,000 generated arithmetic cases covering positive and negative values, zero, maximum accepted magnitude, every output scale, exact half-way values with even and odd retained digits, non-half remainders, nonzero offsets, and non-integer multipliers. Every result must equal the supplied slow rational reference evaluator.
+4. Never produce a normalized row for an unknown mapping, incompatible dimension, invalid decimal, or checked-arithmetic overflow. Each must receive the exact stable reason code in the fixture.
+5. Parse decimal input without an intermediate binary floating-point value. A source review check and tests around values such as `0.1`, `-2.5`, and long 29-digit coefficients must demonstrate this.
+
+### Failure behavior
+
+1. Pass all 60 supplied negative fixture files, including truncated NDJSON, invalid UTF-8, overlong lines, duplicate IDs, duplicate mapping keys, unknown unit symbols, zero denominators, invalid scales, inconsistent dimensions, out-of-range coefficients, and forced read or write errors.
+2. For every run-level failure, exit nonzero, publish no new report, and preserve the byte digest of a pre-existing report.
+3. For record-level failures, continue through the valid remainder of a structurally sound file and include the rejected ID and stable reason without echoing the raw value.
+4. With injected exits after 1 percent and 50 percent of rows and after temporary-file sync but before rename, a rerun must produce the same complete report and leave no path that readers can mistake for a complete partial report.
+
+### Deterministic and runnable evidence
+
+1. Provide `cargo test` as a single command that runs parsing, exact arithmetic, rounding, mapping validation, negative fixtures, publication, and slow-reference comparison tests.
+2. Provide a deterministic fixture generator with a fixed default seed and a release-mode benchmark command documented in the README. The generator must also write a manifest containing input counts and SHA-256 digests.
+3. Shuffle the 1,000,000 observation lines with each of five fixed seeds. All five runs must produce byte-identical canonical reports. Three repeated runs of one shuffle must also have identical SHA-256 digests.
+4. The benchmark command must print only machine-readable counts, elapsed time, peak resident memory as measured by the supplied harness, output digest, and pass/fail status. The evidence must be reproducible from a clean checkout with no services running.
+
+### Performance and resources
+
+1. Process the complete 1,000,000-observation benchmark in at most 30 seconds on the declared two-core machine.
+2. Peak resident memory must not exceed 256 MiB; temporary storage excluding the final report must not exceed 512 MiB; no input line may cause more than 2 MiB additional live memory.
+3. Report size must be at most the input observation-file size plus 25 percent. The harness measures file bytes and fails the run above that bound.
+4. A 100,000-row warm run must be no more than 1.5 times slower than the supplied Java batch evaluator on the same machine. Record both times; do not substitute a different machine or extrapolate from a smaller input.
+
+## Explicit non-goals
+
+- Do not replace the Java service, PostgreSQL tables, or clinical interface engine.
+- Do not make treatment decisions, interpret reference ranges, infer units, or repair rejected observations.
+- Do not implement the full UCUM specification, arbitrary symbolic algebra, fuzzy matching, or machine learning.
+- Do not add a web server, background worker, database, distributed execution, or live gateway integration.
+- Do not process real patient data or publish the prototype into the production admission path.
+
+## Compact self-contained prototype boundary
+
+Build one safe-Rust CLI with a small library behind it. It reads `units.ndjson`, `analytes.ndjson`, `mappings.ndjson`, and `observations.ndjson`; validates the reference snapshot; streams observations; and atomically publishes canonical `report.ndjson`. Include a fixed-seed synthetic fixture generator, a deliberately slow exact rational evaluator used only by tests, the 60 negative fixtures, a benchmark harness, and a short README with the exact test and benchmark commands. Stop at this boundary even if a production service would need authentication, schema management, monitoring, or database access.
diff --git a/developer-simulation/runs/2026-08-18--laboratory-unit-conversion-gate/Cargo.toml b/developer-simulation/runs/2026-08-18--laboratory-unit-conversion-gate/Cargo.toml
new file mode 100644
index 0000000..0ffa72d
--- /dev/null
+++ b/developer-simulation/runs/2026-08-18--laboratory-unit-conversion-gate/Cargo.toml
@@ -0,0 +1,16 @@
+[package]
+name = "lab-unit-gate"
+version = "0.1.0"
+edition = "2024"
+publish = false
+
+[dependencies]
+serde = { version = "1", features = ["derive"] }
+serde_json = "1"
+sha2 = "0.10"
+
+[dev-dependencies]
+tempfile = "3"
+
+[lints.rust]
+unsafe_code = "forbid"
diff --git a/developer-simulation/runs/2026-08-18--laboratory-unit-conversion-gate/DISCOVERY.md b/developer-simulation/runs/2026-08-18--laboratory-unit-conversion-gate/DISCOVERY.md
new file mode 100644
index 0000000..6c0120f
--- /dev/null
+++ b/developer-simulation/runs/2026-08-18--laboratory-unit-conversion-gate/DISCOVERY.md
@@ -0,0 +1,53 @@
+# Baseline-first discovery hypothesis
+
+## Starting point
+
+I am evaluating this as a healthcare-interface developer with eight years of Java and SQL integration work and four months of part-time Rust use. Before writing this note I read only the trial brief, the public root README, and the public examples. I have not inspected Fold, ESE, or ANNy implementation code, and I have not read any earlier lab run or the other trial.
+
+The authoritative baseline is a frozen Java exact evaluator plus signed expected-output fixtures. The current advisory Node.js preflight is known to disagree on decimal half-way rounding and large negative values, can allow an unknown unit through unconverted, takes about eleven minutes for one million rows, and peaks above 1.4 GiB. The admission gate therefore needs proof of exactness and fail-closed behavior before speed matters.
+
+## Problem-first hypothesis
+
+A small standalone safe-Rust streaming CLI should be able to improve this baseline without a database runtime:
+
+1. Parse the restricted decimal grammar directly into a signed `i128` coefficient and base-10 scale, never through binary floating point.
+2. Represent each configured affine transform as bounded rational integers, combine source value, multiplier, and offset with checked arithmetic, and round exactly once with round-half-to-even.
+3. Fully validate small reference tables in memory, then stream observation rows while retaining only mapping/analyte lookups, duplicate-ID state, and sortable report records.
+4. Reject record-level value/mapping/dimension problems using stable codes, but fail the whole run for structural input/reference/publication faults.
+5. Produce canonical output through a same-directory sibling temporary file, sync it, and atomically rename it only after the complete run succeeds.
+
+The main technical risk is canonical sorting under a 256 MiB peak-memory limit. An in-memory million-row report may be too large. A production-shaped implementation would likely require bounded external sorting or exploit a fixture ordering guarantee, but no such guarantee is stated. For the smallest meaningful prototype I will first prove the error-prone core: exact decimal arithmetic, fail-closed admission, stable record rejections, deterministic canonical ordering on representative data, and preservation of a prior report on run failure. I will explicitly leave million-row/two-core/Java-comparison gates unclaimed unless they can actually be run on matching supplied inputs and hardware.
+
+## BogKit component consideration before implementation inspection
+
+- **Fold:** potentially relevant only if its persistent incremental materialization can simplify deterministic keyed admission/report state. The workload is immutable batch input with one final atomic report, so persistence and eager view maintenance may add storage, memory, recovery, and API cost without solving exact arithmetic or atomic publication. I will inspect its public API after this hypothesis and use it only if it materially reduces the prototype.
+- **ESE:** text embeddings do not help exact numeric conversion, validation, canonical ordering, or atomic publication. Expected no fit.
+- **ANNy:** approximate nearest-neighbor search is incompatible with exact mapping selection and fail-closed clinical preflight behavior. Expected no fit.
+
+Grounded use/no-use decisions will follow public API inspection. A `no_fit` result is acceptable if a plain Rust solution best matches the brief.
+
+## Finishing criteria for this bounded trial
+
+- Tests are written first and observed failing for each retained behavior before implementation.
+- A runnable safe-Rust crate demonstrates exact decimal parsing, checked rational affine conversion, round-half-to-even boundaries, reference validation, stable record-level rejection, duplicate-ID run failure, deterministic canonical output, slow independent reference comparison, and prior-report preservation.
+- The crate has a fixed-seed generator or deterministic representative fixture path and a runnable demo/benchmark command.
+- `cargo test`, formatting, strict Clippy (warnings plus all/pedantic denied), and the demo/benchmark pass.
+- The report records exact commands/results, measurements, limitations, ordered friction, component fit, one-category findings, and cleanup proof without claiming unrun target gates.
+
+## Post-hypothesis component decision
+
+After recording the hypothesis, I inspected each component's public crate documentation and top-level API:
+
+- Fold is a persistent, transactional, incrementally maintained dataflow over an embedded Fjall store. Its strengths are changing streams, retractions, and durable materialized views. This trial is a one-shot immutable batch whose hard parts are exact arithmetic, bounded canonical sorting, duplicate detection, and atomic file publication. Adding Fold would introduce a database and persistent runtime without removing those hard parts, conflicting with the compact no-database boundary.
+- ESE converts text into floating-point embedding vectors. It cannot contribute to exact decimal conversion or exact mapping selection.
+- ANNy is approximate vector-neighbor search. Approximation is specifically unsuitable for a fail-closed exact mapping key.
+
+Final component result: **no_fit** for Fold, ESE, and ANNy. The prototype deliberately has no BogKit component dependency. This is a product-fit result, not a claim that the components are defective.
+
+## Skeptical-review repair trail
+
+The initial reviewer reproduced three prototype/evidence defects without challenging the component decision: an output could alias and replace an immutable input, a bare relative output reported a directory-sync error after the report had already appeared, and the benchmark printed acceptance `pass` despite missing authority and an externally measured memory-gate failure. The reviewer also identified two report-quality problems: missing supplied evidence was misclassified as a product finding, and 60 retained files duplicated one parser-error class.
+
+Repair remained outside BogKit components. Test-first regressions now cover direct and resolved input aliases, an existing hard-link identity, the adjacent sibling-temporary alias, a bare relative output, and an explicitly labeled post-rename durability-uncertain state. Benchmark output separates completed execution from `unverified` or `failed` acceptance and has a known over-limit regression. The redundant fixture set is replaced by one named unknown-field example; the absent supplied corpus remains an evidence limit.
+
+These repairs strengthen the standalone file-transform boundary and leave the grounded **no_fit** decision unchanged. They do not turn missing Java, signed-fixture, or target-Linux evidence into a component defect or adoption result.
diff --git a/developer-simulation/runs/2026-08-18--laboratory-unit-conversion-gate/README.md b/developer-simulation/runs/2026-08-18--laboratory-unit-conversion-gate/README.md
new file mode 100644
index 0000000..569e4b2
--- /dev/null
+++ b/developer-simulation/runs/2026-08-18--laboratory-unit-conversion-gate/README.md
@@ -0,0 +1,55 @@
+# Exact laboratory-unit admission gate prototype
+
+This is a bounded safe-Rust prototype for exact, fail-closed preview conversion. It does not use Fold, ESE, or ANNy because the workload is an immutable exact batch rather than an incremental database, embedding, or nearest-neighbor problem.
+
+The CLI validates the entire unit/analyte/mapping snapshot, reads bounded NDJSON observation lines, parses decimals without floating point, applies a checked rational affine transform, rounds once with round-half-to-even, sorts report rows by observation ID, and atomically replaces the complete report through a sibling temporary file. Before creating that temporary file it rejects final or temporary paths that resolve to, or share an existing file identity with, any immutable input. Invalid values, unknown mappings, incompatible dimensions, and arithmetic overflow become stable record rejections without echoing the raw value.
+
+Prepublication errors leave the previous report untouched. The parent directory is opened before temporary-file creation and retained through rename and directory sync; a bare relative output uses `.`. A failure after rename is reported separately as `POST_RENAME_DURABILITY_UNCERTAIN` with publication state `PublishedDurabilityUncertain`, because the new report is already visible and preservation of the previous report can no longer be claimed.
+
+## Verify
+
+Run from this directory with no services or network access:
+
+```sh
+cargo test --offline --locked --manifest-path ../../Cargo.toml --package lab-unit-gate --all-targets
+cargo fmt --manifest-path ../../Cargo.toml --package lab-unit-gate -- --check
+cargo clippy --offline --locked --manifest-path ../../Cargo.toml --package lab-unit-gate --all-targets --all-features -- -D warnings -D clippy::all -D clippy::pedantic
+```
+
+`cargo test` includes exact parsing and half-even boundaries, 20,000 deterministic arithmetic comparisons against a separately implemented slow rational evaluator, reference and NDJSON failures, one retained named unknown-field fixture, additional generated negative cases, read/write faults, duplicate IDs, final/resolved/hard-link/temporary alias probes, relative-path publication, explicit post-rename state, 1 percent/50 percent/pre-rename injected exits, five fixed input shuffles, three repeated digest checks, and the CLI.
+
+## Small runnable demo
+
+Choose an empty directory outside the checkout, then build, generate a 10,000-row fixture, and run the machine-readable benchmark:
+
+```sh
+cargo build --offline --locked --manifest-path ../../Cargo.toml --package lab-unit-gate --release
+../../target/release/lab-unit-gate generate /tmp/lab-unit-gate-demo 9500 250 250 42
+../../target/release/lab-unit-gate bench /tmp/lab-unit-gate-demo /tmp/lab-unit-gate-demo/report.ndjson
+```
+
+The generator always writes exactly 250 units, 300 analytes, and 12,000 unique mappings. Its four input digests and class counts are recorded in `manifest.json`. The five numeric arguments are `ordinary`, `boundary`, `rejected`, and `seed`; the default trial shape is expressed explicitly below.
+
+## Full synthetic shape
+
+```sh
+../../target/release/lab-unit-gate generate /tmp/lab-unit-gate-full 950000 25000 25000 42
+../../target/release/lab-unit-gate bench /tmp/lab-unit-gate-full /tmp/lab-unit-gate-full/report.ndjson
+```
+
+The benchmark prints one JSON line. `run_status:"complete"` means the transform finished and published. `acceptance` is `failed` when an internally measured peak exceeds 256 MiB and otherwise remains `unverified`, because signed-fixture parity, the Java comparison, and the declared two-core Linux environment are not available to this command. It never emits acceptance `pass`. On Linux the process reads peak resident bytes from `/proc/self/status`; on macOS `peak_rss_bytes` is `null`, so use `/usr/bin/time -l` for separately labeled host evidence.
+
+## Input schema
+
+- `units.ndjson`: `symbol`
+- `analytes.ndjson`: `analyte_code`, `dimension`, `target_scale`
+- `mappings.ndjson`: `source_system`, `analyte_code`, `source_unit`, `target_unit`, `expected_dimension`, `multiplier_num`, `multiplier_den`, `offset_num`, `offset_den`
+- `observations.ndjson`: `observation_id`, `source_system`, `analyte_code`, `source_unit`, `declared_dimension`, `value`
+
+Every field is required and unknown fields are rejected. Observation IDs must be nonempty ASCII and unique. A line may contain at most 1,024 bytes. Decimal values accept an optional leading minus, digits, and an optional fractional part; scientific notation, plus signs, NaN, infinity, more than 29 significant digits, and scale above nine are rejected.
+
+## Evidence boundary
+
+The supplied checkout did not include the signed fixtures, frozen Java evaluator, target two-core Linux harness, or Java 100,000-row baseline. Therefore byte parity with Java, all named supplied negative fixtures, target-machine timing/memory, and the 1.5-times Java comparison remain unverified.
+
+The repaired macOS arm64 million-row run was fast and deterministic but used about 277.7 MiB peak resident memory, above the 256 MiB target. Five full shuffles plus three full repeats produced the same canonical report digest. The prototype keeps report rows and duplicate IDs in memory to stay small and inspectable. A production candidate would need bounded external merge sorting that detects duplicate IDs during merge before this gate could be considered passed.
diff --git a/developer-simulation/runs/2026-08-18--laboratory-unit-conversion-gate/TRIAL_REPORT.md b/developer-simulation/runs/2026-08-18--laboratory-unit-conversion-gate/TRIAL_REPORT.md
new file mode 100644
index 0000000..d84430d
--- /dev/null
+++ b/developer-simulation/runs/2026-08-18--laboratory-unit-conversion-gate/TRIAL_REPORT.md
@@ -0,0 +1,208 @@
+# Trial 1 repaired report: exact laboratory-unit conversion admission gate
+
+## Stable handoff
+
+- **Repair round:** 1 of 5, addressing the complete initial skeptical review.
+- **Fit decision:** `no_fit` for Fold, ESE, and ANNy; unchanged by repair.
+- **Prototype:** `simulation-output/lab-unit-gate/`
+- **Baseline-first discovery and repair trail:** `simulation-output/DISCOVERY.md`
+- **Runnable instructions:** `simulation-output/lab-unit-gate/README.md`
+- **Frozen source identity:** `simulation-output/TREE_MANIFEST.sha256`
+- **BogKit HEAD:** `20f2ca50d5d06f51edfe8b8570c0fb48caf9eb81`
+- **Tracked repository files changed:** none.
+- **Admission decision:** not proven. The repaired prototype closes the review's publication and evidence-labeling defects, but measured peak memory still exceeds 256 MiB and authoritative Java/signed-fixture/target-Linux evidence remains unavailable.
+
+## Repair verdict
+
+Every Trial 1 reviewer finding was addressed without adding a BogKit component:
+
+| Review item | Category | Prior severity | Current severity | Repaired evidence |
+|---|---|---|---|---|
+| T1-I1 output could overwrite immutable input | correctness defect | Important | None | Direct observation, resolved reference, existing hard-link identity, and sibling-temporary alias regressions now reject before temporary creation and preserve input bytes. |
+| T1-I2 relative output failed after publication | correctness defect | Important | None | Bare relative CLI output now succeeds; the directory handle is opened before temporary creation and retained through rename/sync. A post-rename failpoint returns a distinct published-but-durability-uncertain state. |
+| T1-I3 benchmark false-passed hard/missing gates | correctness defect | Important | None | Output now separates `run_status:"complete"` from `acceptance:"unverified"` or `"failed"`; no acceptance `pass` exists. A known over-limit unit regression is retained. |
+| T1-I4 absent authority was called a product finding | documentation gap | Important | None | Missing Java, signed fixtures, reason codes, and target runner are now only Evidence limits. |
+| T1-M1 60 files duplicated one parser class | documentation gap | Minor | None | The 60 padding files were removed and replaced with one named unknown-field fixture with one exact expected outcome. |
+
+The remaining open finding is the already-disclosed million-row memory failure, normalized in the Findings section.
+
+## Repaired publication boundary
+
+Before any sibling temporary file is removed or created, the runner derives both final and temporary paths and compares each with all four inputs:
+
+- ordinary path equality;
+- resolved canonical equality, including `..` components and symlinks when resolvable;
+- existing Unix file identity using device and inode, covering hard links.
+
+Aliases return `OUTPUT_ALIASES_INPUT` or `OUTPUT_TEMPORARY_ALIASES_INPUT`, publication state `NotPublished`, and leave input bytes unchanged. The adjacent temporary-path check also prevents stale-temp cleanup from deleting an immutable input.
+
+The output parent is normalized from an empty relative parent to `.`, opened before temporary creation, and retained. The temporary report is written, flushed, file-synced, and renamed. The retained directory handle is then synced.
+
+Prepublication errors remain ordinary `RunError` values with publication state `NotPublished`; the prior report is preserved by the retained duplicate-ID, read/write, alias, row failpoint, and pre-rename failpoint tests. A directory-sync failure after successful rename cannot make that claim. It is returned as `POST_RENAME_DURABILITY_UNCERTAIN` with `PublishedDurabilityUncertain`; the post-rename regression proves the new final report is already visible.
+
+## Test-driven repair audit
+
+The repair followed observed RED/GREEN cycles:
+
+1. direct observation output alias returned success and replaced its input; the new regression failed, then passed after preflight alias rejection;
+2. resolved reference alias and an existing hard-link identity returned success; retained regressions now pass with unchanged input bytes;
+3. an input at the sibling temporary path was deleted/replaced by cleanup; the adjacent regression now passes with the input untouched;
+4. the relative-path CLI regression failed with `DIRECTORY_SYNC_ERROR` after the report appeared; it now succeeds after `.` normalization and early directory open;
+5. the new post-rename state API first failed to compile, then the failpoint returned success; it now returns the distinct durability-uncertain error and state after publication;
+6. the benchmark integration test failed because `run_status` and `acceptance` were absent and `status:"pass"` remained; it now emits complete/unverified on this host and no `status` field;
+7. the known-over-limit test first lacked the assessment function, then reproduced `pass`; it now returns `failed` for any internally measured peak over 268,435,456 bytes and `unverified` when authority is incomplete;
+8. the single named unknown-field fixture regression first failed because the meaningful file was absent; the 60 same-class files were removed and the exact one-file regression passed.
+
+No production code path was added before its corresponding reproducer failed.
+
+## Complete verification
+
+All commands ran from `simulation-output/lab-unit-gate/`.
+
+```text
+cargo test --offline --locked
+```
+
+Result: **20 tests passed, 0 failed**, plus doc tests. Coverage includes:
+
+- exact decimal grammar, checked rational transforms, positive/negative half-even boundaries, and 20,000 independent slow-reference comparisons;
+- 1,024-byte bounded line buffering, invalid UTF-8, structural/reference faults, forced read/write errors, duplicate IDs, and one named retained unknown-field fixture;
+- direct/resolved/existing-identity/temporary alias probes with byte preservation;
+- relative output success and explicit prepublication versus post-rename state;
+- injected exits at 1 percent, 50 percent, pre-rename, and post-rename/pre-directory-sync;
+- fixed-seed generation, five shuffles, three repeats, canonical digest checks, and CLI benchmark semantics.
+
+```text
+cargo fmt --all -- --check
+```
+
+Result: pass; no formatting difference.
+
+```text
+cargo clippy --offline --locked --all-targets --all-features -- -D warnings -D clippy::all -D clippy::pedantic
+```
+
+Result: pass; warnings, all, and pedantic lints denied.
+
+```text
+cargo build --offline --locked --release
+```
+
+Result: pass.
+
+Static production review found no `f32`, `f64`, floating-point parse, unsafe block, or subprocess use. Both production roots retain `#![forbid(unsafe_code)]`.
+
+## Release demo
+
+```text
+target/release/lab-unit-gate generate /private/tmp/lab-unit-gate-repair1.yHyxPR 9500 250 250 42
+target/release/lab-unit-gate bench /private/tmp/lab-unit-gate-repair1.yHyxPR /private/tmp/lab-unit-gate-repair1.yHyxPR/report.ndjson
+```
+
+Result:
+
+```json
+{"acceptance":"unverified","converted":9750,"elapsed_ms":32,"missing_gates":["signed_fixture_parity","java_comparison","declared_two_core_linux"],"output_digest":"256be30a4b0845bb13d4e999587042cdd60f9c6512f2ffc1e8da8a54379b71a0","peak_rss_bytes":null,"rejected":250,"run_status":"complete","total":10000}
+```
+
+The run completed successfully; acceptance remains unverified rather than passing.
+
+## Full one-million-row evidence
+
+Available host: `Darwin arm64`, Rust/Cargo 1.95.0. It is not the declared two-core Linux target.
+
+Seed 42 generated exactly 250 units, 300 analytes, 12,000 mappings, 950,000 ordinary conversions, 25,000 boundary conversions, and 25,000 expected rejections. Observation digest remained `f0474b988a85d6548a0f9df3900fcf55c9a022435a4eb3abd5fd25ac7fd0e473`.
+
+```text
+/usr/bin/time -l target/release/lab-unit-gate bench /private/tmp/lab-unit-gate-repair1.yHyxPR /private/tmp/lab-unit-gate-repair1.yHyxPR/report.ndjson
+```
+
+Machine-readable output:
+
+```json
+{"acceptance":"unverified","converted":975000,"elapsed_ms":1186,"missing_gates":["signed_fixture_parity","java_comparison","declared_two_core_linux"],"output_digest":"b9c8adf790c0717818cdaaeb83d5bbb612aa3780eb60e4eba3d97732c1446eb5","peak_rss_bytes":null,"rejected":25000,"run_status":"complete","total":1000000}
+```
+
+External macOS evidence: 1.19 seconds real and 291,176,448 bytes maximum resident size (about 277.7 MiB). This exceeds 268,435,456 bytes by 22,740,992 bytes, about 8.5 percent. Because the program cannot observe the external macOS measurement, its acceptance remains `unverified`; it no longer claims `pass`. On Linux, an internally observed over-limit `VmHWM` produces `acceptance:"failed"`.
+
+Input observations were 140,975,000 bytes. The final report was 93,065,000 bytes, about 66.0 percent of input. Output digest remained `b9c8adf790c0717818cdaaeb83d5bbb612aa3780eb60e4eba3d97732c1446eb5`.
+
+## Full-shape shuffle evidence
+
+The repaired release binary ran five full one-million-row shuffles with seeds 11, 22, 33, 44, and 55, followed by three further full seed-11 repeats. Internal elapsed times were 1310, 1189, 1100, 1087, 1095, 1097, 1111, and 1099 milliseconds.
+
+All eight runs produced exactly:
+
+- 975,000 conversions;
+- 25,000 rejections;
+- 1,000,000 report rows;
+- 93,065,000 report bytes;
+- SHA-256 `b9c8adf790c0717818cdaaeb83d5bbb612aa3780eb60e4eba3d97732c1446eb5`;
+- `run_status:"complete"` and `acceptance:"unverified"`, never acceptance `pass`.
+
+This closes the local full-shape determinism gap. It does not establish Java parity or target qualification.
+
+## Benchmark state semantics
+
+- `run_status:"complete"`: parsing, evaluation, and atomic rename completed.
+- `acceptance:"failed"`: at least one applicable internally measured hard gate failed; currently this is emitted for peak RSS above 256 MiB on Linux.
+- `acceptance:"unverified"`: no measured hard failure was observed, but one or more required authorities are absent.
+- `missing_gates`: explicitly names signed-fixture parity, Java comparison, and declared two-core Linux execution.
+
+The program has no acceptance `pass` state while these gates are missing.
+
+## Evidence limits
+
+The following were not supplied and are not prototype or BogKit findings:
+
+- frozen Java evaluator and authoritative byte output;
+- signed fixtures and authoritative rejection-code spellings;
+- the supplied 60-file negative corpus;
+- the declared offline two-core Linux machine/harness;
+- the same-machine 100,000-row Java timing.
+
+The one retained negative text fixture is explicitly a candidate-authored unknown-field example, not a substitute for the absent corpus. Other negative cases are created narrowly by tests with exact expected codes.
+
+Memory/timing figures are single-host macOS observations. The deterministic failpoints are returned errors, not operating-system kills, disk-full, permission changes, or power-loss qualification. The post-rename regression establishes lifecycle labeling, not filesystem durability under power loss.
+
+## Component consideration and fit
+
+| Component | Evidence considered | Decision |
+|---|---|---|
+| Fold | Persistent Fjall-backed incremental views, transactional changes, and consistent snapshots. | `no_fit`: an immutable exact batch still owns arithmetic, bounded sorting, duplicate detection, input identity, and file publication. |
+| ESE | Floating-point text embeddings. | `no_fit`: unrelated to exact numeric conversion and mapping. |
+| ANNy | Approximate HNSW vector search. | `no_fit`: incompatible with exact fail-closed mapping keys. |
+
+No BogKit component was used or modified. None of the repaired issues is a BogKit defect.
+
+## Decision audit
+
+| Decision | Evidence | Residual uncertainty |
+|---|---|---|
+| Reject final and temporary input aliases before publication | Direct, `..`-resolved, hard-link, and adjacent temporary regressions preserve source bytes. | Adversarial filesystem changes racing after preflight are outside this offline immutable-input prototype. |
+| Retain parent directory handle before rename | Relative CLI output passes; post-rename state is explicit. | Power-loss durability remains unqualified. |
+| Separate completion from acceptance | Integration and over-limit tests prevent acceptance `pass`. | macOS peak remains externally measured and therefore machine acceptance stays unverified. |
+| Keep one meaningful fixture | One exact unknown-field case remains; generated tests own other candidate-authored cases. | Supplied negative corpus remains absent. |
+| Keep in-memory canonical sort | Smallest transparent implementation and stable output bytes. | Peak memory still fails the gate. |
+| Preserve `no_fit` | Repairs concern application publication/evidence semantics, not component capability. | No adoption conclusion without authoritative evidence. |
+
+## Findings
+
+### F-01 — million-row peak memory exceeds the admission gate
+
+- **Category:** performance problem
+- **Prior severity:** Important
+- **Current severity:** Important
+- **Confidence:** high
+- **Reproduction:** build release, generate `950000 25000 25000 42`, then run the README's full benchmark under `/usr/bin/time -l` on macOS or the supplied harness when available.
+- **Evidence:** repaired seed-42 binary used 291,176,448 bytes maximum resident memory for exactly 1,000,000 observations; the reviewer independently reproduced the same class at 291,667,968 bytes.
+- **Retained reproduction pointer:** `simulation-output/lab-unit-gate/README.md`, “Full synthetic shape,” and `simulation-output/lab-unit-gate/src/lib.rs::run`.
+- **Smallest improvement:** write bounded sorted report runs and merge them by observation ID while detecting adjacent duplicates, replacing both the full row vector and ID hash set. This remains database-free and should fit within the 512 MiB temporary-storage allowance.
+
+This is the only retained current finding. It uses exactly one allowed category.
+
+## Cleanup and freeze proof
+
+The final handoff retains source, tests, Cargo manifest/lockfile, README, discovery/report text, one small negative fixture, and `TREE_MANIFEST.sha256`. Build `target/`, generated corpora/reports, runtime databases, temporary output, binaries, and the external repair evidence directory were removed after verification.
+
+`git diff --exit-code` passes, so tracked BogKit files are unchanged. Final Git status contains only untracked `BRIEF.md` and `simulation-output/`. The checksum manifest freezes every retained output file other than itself for the scoped re-review.
diff --git a/developer-simulation/runs/2026-08-18--laboratory-unit-conversion-gate/fixtures/negative/unknown-field-observation.ndjson b/developer-simulation/runs/2026-08-18--laboratory-unit-conversion-gate/fixtures/negative/unknown-field-observation.ndjson
new file mode 100644
index 0000000..4b8c060
--- /dev/null
+++ b/developer-simulation/runs/2026-08-18--laboratory-unit-conversion-gate/fixtures/negative/unknown-field-observation.ndjson
@@ -0,0 +1 @@
+{"unexpected":"field"}
diff --git a/developer-simulation/runs/2026-08-18--laboratory-unit-conversion-gate/src/lib.rs b/developer-simulation/runs/2026-08-18--laboratory-unit-conversion-gate/src/lib.rs
new file mode 100644
index 0000000..628a244
--- /dev/null
+++ b/developer-simulation/runs/2026-08-18--laboratory-unit-conversion-gate/src/lib.rs
@@ -0,0 +1,995 @@
+#![forbid(unsafe_code)]
+
+use std::collections::{BTreeMap, HashMap, HashSet};
+use std::fs::{self, File, OpenOptions};
+use std::io::{BufRead, BufReader, BufWriter, Write};
+use std::path::{Path, PathBuf};
+
+use serde::Deserialize;
+use serde::de::DeserializeOwned;
+use sha2::{Digest, Sha256};
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub struct Decimal {
+    pub coefficient: i128,
+    pub scale: u32,
+}
+
+impl Decimal {
+    #[must_use]
+    pub fn to_fixed(self) -> String {
+        let negative = self.coefficient.is_negative();
+        let mut digits = self.coefficient.unsigned_abs().to_string();
+        if self.scale > 0 {
+            let minimum = usize::try_from(self.scale).unwrap_or(usize::MAX) + 1;
+            if digits.len() < minimum {
+                digits.insert_str(0, &"0".repeat(minimum - digits.len()));
+            }
+            let split = digits.len() - usize::try_from(self.scale).unwrap_or(0);
+            digits.insert(split, '.');
+        }
+        if negative {
+            digits.insert(0, '-');
+        }
+        digits
+    }
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub struct Transform {
+    multiplier_num: i128,
+    multiplier_den: i128,
+    offset_num: i128,
+    offset_den: i128,
+}
+
+impl Transform {
+    #[must_use]
+    pub const fn new(
+        multiplier_num: i128,
+        multiplier_den: i128,
+        offset_num: i128,
+        offset_den: i128,
+    ) -> Self {
+        Self {
+            multiplier_num,
+            multiplier_den,
+            offset_num,
+            offset_den,
+        }
+    }
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub struct ArithmeticError;
+
+/// Applies a bounded rational affine transform and rounds once to `target_scale`.
+///
+/// # Errors
+///
+/// Returns an error when a denominator is invalid or checked `i128` arithmetic overflows.
+pub fn convert_decimal(
+    source: Decimal,
+    transform: Transform,
+    target_scale: u32,
+) -> Result<Decimal, ArithmeticError> {
+    if transform.multiplier_num <= 0 || transform.multiplier_den <= 0 || transform.offset_den <= 0 {
+        return Err(ArithmeticError);
+    }
+    let source_den = checked_power_of_ten(source.scale)?;
+    let left = source
+        .coefficient
+        .checked_mul(transform.multiplier_num)
+        .and_then(|value| value.checked_mul(transform.offset_den))
+        .ok_or(ArithmeticError)?;
+    let right = transform
+        .offset_num
+        .checked_mul(source_den)
+        .and_then(|value| value.checked_mul(transform.multiplier_den))
+        .ok_or(ArithmeticError)?;
+    let numerator = left.checked_add(right).ok_or(ArithmeticError)?;
+    let denominator = source_den
+        .checked_mul(transform.multiplier_den)
+        .and_then(|value| value.checked_mul(transform.offset_den))
+        .ok_or(ArithmeticError)?;
+    let target_factor = checked_power_of_ten(target_scale)?;
+    let scaled = numerator
+        .checked_mul(target_factor)
+        .ok_or(ArithmeticError)?;
+    let mut coefficient = scaled / denominator;
+    let remainder = scaled % denominator;
+    let twice_remainder = remainder
+        .checked_abs()
+        .and_then(|value| value.checked_mul(2))
+        .ok_or(ArithmeticError)?;
+    let round_away =
+        twice_remainder > denominator || (twice_remainder == denominator && coefficient % 2 != 0);
+    if round_away {
+        coefficient = coefficient
+            .checked_add(if scaled.is_negative() { -1 } else { 1 })
+            .ok_or(ArithmeticError)?;
+    }
+    Ok(Decimal {
+        coefficient,
+        scale: target_scale,
+    })
+}
+
+fn checked_power_of_ten(scale: u32) -> Result<i128, ArithmeticError> {
+    10_i128.checked_pow(scale).ok_or(ArithmeticError)
+}
+
+#[derive(Debug, Clone)]
+pub struct InputPaths {
+    pub units: PathBuf,
+    pub analytes: PathBuf,
+    pub mappings: PathBuf,
+    pub observations: PathBuf,
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum FailPoint {
+    None,
+    AfterRows(usize),
+    BeforeRename,
+    AfterRenameBeforeDirectorySync,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct RunSummary {
+    pub total: usize,
+    pub converted: usize,
+    pub rejected: usize,
+    pub output_sha256: String,
+}
+
+#[derive(Debug)]
+pub struct RunError {
+    pub code: &'static str,
+    pub publication_state: PublicationState,
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum PublicationState {
+    NotPublished,
+    PublishedDurabilityUncertain,
+}
+
+impl RunError {
+    const fn new(code: &'static str) -> Self {
+        Self {
+            code,
+            publication_state: PublicationState::NotPublished,
+        }
+    }
+
+    const fn post_rename(code: &'static str) -> Self {
+        Self {
+            code,
+            publication_state: PublicationState::PublishedDurabilityUncertain,
+        }
+    }
+}
+
+impl std::fmt::Display for RunError {
+    fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        formatter.write_str(self.code)
+    }
+}
+
+impl std::error::Error for RunError {}
+
+/// Validates all input and atomically publishes a canonical report.
+///
+/// # Errors
+///
+/// Returns a stable run-level error for malformed input, invalid references, duplicate IDs,
+/// injected exits, or publication failures.
+pub fn run(
+    inputs: &InputPaths,
+    output: &Path,
+    fail_point: FailPoint,
+) -> Result<RunSummary, RunError> {
+    let temporary = temporary_path(output)?;
+    ensure_publication_paths_do_not_alias_inputs(inputs, output, &temporary)?;
+    let units: Vec<Unit> = read_ndjson(&inputs.units)?;
+    let analytes: Vec<Analyte> = read_ndjson(&inputs.analytes)?;
+    let mappings: Vec<Mapping> = read_ndjson(&inputs.mappings)?;
+    let reference = Reference::validate(units, analytes, mappings)?;
+
+    let file = File::open(&inputs.observations).map_err(|_| RunError::new("READ_ERROR"))?;
+    let mut reader = BufReader::new(file);
+    let mut buffer = Vec::with_capacity(1_025);
+    let mut seen_ids = HashSet::new();
+    let mut rows = Vec::new();
+    loop {
+        let bytes = read_limited_line(&mut reader, &mut buffer)?;
+        if bytes == 0 {
+            break;
+        }
+        trim_line_ending(&mut buffer);
+        if buffer.len() > 1_024 {
+            return Err(RunError::new("OVERLONG_LINE"));
+        }
+        let observation: Observation =
+            serde_json::from_slice(&buffer).map_err(|_| RunError::new("INVALID_NDJSON"))?;
+        validate_observation_id(&observation.id)?;
+        if !seen_ids.insert(observation.id.clone()) {
+            return Err(RunError::new("DUPLICATE_OBSERVATION_ID"));
+        }
+        rows.push(reference.evaluate(observation));
+        if matches!(fail_point, FailPoint::AfterRows(count) if rows.len() == count) {
+            return Err(RunError::new("INJECTED_EXIT_AFTER_ROWS"));
+        }
+        buffer.clear();
+    }
+    rows.sort_unstable_by(|left, right| left.observation_id().cmp(right.observation_id()));
+
+    let converted = rows
+        .iter()
+        .filter(|row| matches!(row, ReportRow::Normalized { .. }))
+        .count();
+    let rejected = rows.len() - converted;
+    let output_parent = output
+        .parent()
+        .filter(|parent| !parent.as_os_str().is_empty())
+        .unwrap_or_else(|| Path::new("."));
+    let output_directory =
+        File::open(output_parent).map_err(|_| RunError::new("OUTPUT_DIRECTORY_OPEN_ERROR"))?;
+    let _ = fs::remove_file(&temporary);
+    let temporary_file = OpenOptions::new()
+        .write(true)
+        .create_new(true)
+        .open(&temporary)
+        .map_err(|_| RunError::new("WRITE_ERROR"))?;
+    let mut writer = BufWriter::new(temporary_file);
+    let mut hasher = Sha256::new();
+    for row in &rows {
+        let line = row.canonical_line()?;
+        writer
+            .write_all(&line)
+            .and_then(|()| writer.write_all(b"\n"))
+            .map_err(|_| RunError::new("WRITE_ERROR"))?;
+        hasher.update(&line);
+        hasher.update(b"\n");
+    }
+    writer.flush().map_err(|_| RunError::new("WRITE_ERROR"))?;
+    writer
+        .get_ref()
+        .sync_all()
+        .map_err(|_| RunError::new("WRITE_ERROR"))?;
+    if fail_point == FailPoint::BeforeRename {
+        return Err(RunError::new("INJECTED_EXIT_BEFORE_RENAME"));
+    }
+    fs::rename(&temporary, output).map_err(|_| RunError::new("RENAME_ERROR"))?;
+    if fail_point == FailPoint::AfterRenameBeforeDirectorySync {
+        return Err(RunError::post_rename("POST_RENAME_DURABILITY_UNCERTAIN"));
+    }
+    output_directory
+        .sync_all()
+        .map_err(|_| RunError::post_rename("POST_RENAME_DURABILITY_UNCERTAIN"))?;
+    Ok(RunSummary {
+        total: rows.len(),
+        converted,
+        rejected,
+        output_sha256: format!("{:x}", hasher.finalize()),
+    })
+}
+
+const MAX_TRANSFORM_COEFFICIENT: i128 = 1_000_000_000_000_000_000;
+
+#[derive(Debug, Deserialize)]
+#[serde(deny_unknown_fields)]
+struct Unit {
+    symbol: String,
+}
+
+#[derive(Debug, Deserialize)]
+#[serde(deny_unknown_fields)]
+struct Analyte {
+    #[serde(rename = "analyte_code")]
+    code: String,
+    dimension: String,
+    target_scale: u32,
+}
+
+#[derive(Debug, Deserialize)]
+#[serde(deny_unknown_fields)]
+struct Mapping {
+    source_system: String,
+    analyte_code: String,
+    source_unit: String,
+    target_unit: String,
+    expected_dimension: String,
+    multiplier_num: i128,
+    multiplier_den: i128,
+    offset_num: i128,
+    offset_den: i128,
+}
+
+#[derive(Debug, Deserialize)]
+#[serde(deny_unknown_fields)]
+struct Observation {
+    #[serde(rename = "observation_id")]
+    id: String,
+    source_system: String,
+    analyte_code: String,
+    source_unit: String,
+    declared_dimension: String,
+    value: String,
+}
+
+#[derive(Debug)]
+struct ValidatedMapping {
+    target_unit: String,
+    expected_dimension: String,
+    target_scale: u32,
+    transform: Transform,
+}
+
+type MappingKey = (String, String, String);
+
+#[derive(Debug)]
+struct Reference {
+    mappings: HashMap<MappingKey, ValidatedMapping>,
+}
+
+impl Reference {
+    fn validate(
+        units: Vec<Unit>,
+        analytes: Vec<Analyte>,
+        mappings: Vec<Mapping>,
+    ) -> Result<Self, RunError> {
+        let mut unit_symbols = HashSet::new();
+        for unit in units {
+            if unit.symbol.is_empty() || !unit_symbols.insert(unit.symbol) {
+                return Err(RunError::new("INVALID_UNIT_SNAPSHOT"));
+            }
+        }
+        let mut analyte_by_code = HashMap::new();
+        for analyte in analytes {
+            if analyte.code.is_empty()
+                || analyte.dimension.is_empty()
+                || analyte.target_scale > 9
+                || analyte_by_code
+                    .insert(analyte.code.clone(), analyte)
+                    .is_some()
+            {
+                return Err(RunError::new("INVALID_ANALYTE_SNAPSHOT"));
+            }
+        }
+        let mut validated = HashMap::new();
+        for mapping in mappings {
+            let Some(analyte) = analyte_by_code.get(&mapping.analyte_code) else {
+                return Err(RunError::new("UNKNOWN_ANALYTE"));
+            };
+            if !unit_symbols.contains(&mapping.source_unit)
+                || !unit_symbols.contains(&mapping.target_unit)
+            {
+                return Err(RunError::new("UNKNOWN_UNIT_SYMBOL"));
+            }
+            if mapping.expected_dimension != analyte.dimension {
+                return Err(RunError::new("INCONSISTENT_DIMENSION"));
+            }
+            if mapping.multiplier_num <= 0 || mapping.multiplier_den <= 0 || mapping.offset_den <= 0
+            {
+                return Err(RunError::new("INVALID_DENOMINATOR_OR_MULTIPLIER"));
+            }
+            for coefficient in [
+                mapping.multiplier_num,
+                mapping.multiplier_den,
+                mapping.offset_num,
+                mapping.offset_den,
+            ] {
+                if coefficient.unsigned_abs() > MAX_TRANSFORM_COEFFICIENT as u128 {
+                    return Err(RunError::new("COEFFICIENT_OUT_OF_RANGE"));
+                }
+            }
+            let key = (
+                mapping.source_system,
+                mapping.analyte_code,
+                mapping.source_unit,
+            );
+            let value = ValidatedMapping {
+                target_unit: mapping.target_unit,
+                expected_dimension: mapping.expected_dimension,
+                target_scale: analyte.target_scale,
+                transform: Transform::new(
+                    mapping.multiplier_num,
+                    mapping.multiplier_den,
+                    mapping.offset_num,
+                    mapping.offset_den,
+                ),
+            };
+            if validated.insert(key, value).is_some() {
+                return Err(RunError::new("DUPLICATE_MAPPING_KEY"));
+            }
+        }
+        Ok(Self {
+            mappings: validated,
+        })
+    }
+
+    fn evaluate(&self, observation: Observation) -> ReportRow {
+        let id = observation.id;
+        let key = (
+            observation.source_system,
+            observation.analyte_code,
+            observation.source_unit,
+        );
+        let Some(mapping) = self.mappings.get(&key) else {
+            return ReportRow::rejected(id, "UNKNOWN_MAPPING");
+        };
+        if observation.declared_dimension != mapping.expected_dimension {
+            return ReportRow::rejected(id, "INCOMPATIBLE_DIMENSION");
+        }
+        let Ok(source) = parse_decimal(&observation.value) else {
+            return ReportRow::rejected(id, "INVALID_VALUE");
+        };
+        let Ok(converted) = convert_decimal(source, mapping.transform, mapping.target_scale) else {
+            return ReportRow::rejected(id, "ARITHMETIC_OVERFLOW");
+        };
+        ReportRow::Normalized {
+            observation_id: id,
+            target_unit: mapping.target_unit.clone(),
+            value: converted.to_fixed(),
+        }
+    }
+}
+
+#[derive(Debug)]
+enum ReportRow {
+    Normalized {
+        observation_id: String,
+        target_unit: String,
+        value: String,
+    },
+    Rejected {
+        observation_id: String,
+        reason: &'static str,
+    },
+}
+
+impl ReportRow {
+    fn rejected(observation_id: String, reason: &'static str) -> Self {
+        Self::Rejected {
+            observation_id,
+            reason,
+        }
+    }
+
+    fn observation_id(&self) -> &str {
+        match self {
+            Self::Normalized { observation_id, .. } | Self::Rejected { observation_id, .. } => {
+                observation_id
+            }
+        }
+    }
+
+    fn canonical_line(&self) -> Result<Vec<u8>, RunError> {
+        match self {
+            Self::Normalized {
+                observation_id,
+                target_unit,
+                value,
+            } => serde_json::to_vec(&NormalizedOutput {
+                observation_id,
+                status: "normalized",
+                target_unit,
+                value,
+            }),
+            Self::Rejected {
+                observation_id,
+                reason,
+            } => serde_json::to_vec(&RejectedOutput {
+                observation_id,
+                reason,
+                status: "rejected",
+            }),
+        }
+        .map_err(|_| RunError::new("SERIALIZE_ERROR"))
+    }
+}
+
+#[derive(serde::Serialize)]
+struct NormalizedOutput<'a> {
+    observation_id: &'a str,
+    status: &'static str,
+    target_unit: &'a str,
+    value: &'a str,
+}
+
+#[derive(serde::Serialize)]
+struct RejectedOutput<'a> {
+    observation_id: &'a str,
+    reason: &'a str,
+    status: &'static str,
+}
+
+fn read_ndjson<T: DeserializeOwned>(path: &Path) -> Result<Vec<T>, RunError> {
+    let file = File::open(path).map_err(|_| RunError::new("READ_ERROR"))?;
+    let mut reader = BufReader::new(file);
+    let mut rows = Vec::new();
+    let mut buffer = Vec::with_capacity(1_025);
+    loop {
+        let bytes = read_limited_line(&mut reader, &mut buffer)?;
+        if bytes == 0 {
+            break;
+        }
+        trim_line_ending(&mut buffer);
+        if buffer.len() > 1_024 {
+            return Err(RunError::new("OVERLONG_LINE"));
+        }
+        rows.push(serde_json::from_slice(&buffer).map_err(|_| RunError::new("INVALID_NDJSON"))?);
+        buffer.clear();
+    }
+    Ok(rows)
+}
+
+fn trim_line_ending(buffer: &mut Vec<u8>) {
+    if buffer.last() == Some(&b'\n') {
+        buffer.pop();
+    }
+    if buffer.last() == Some(&b'\r') {
+        buffer.pop();
+    }
+}
+
+fn read_limited_line<R: BufRead>(reader: &mut R, buffer: &mut Vec<u8>) -> Result<usize, RunError> {
+    loop {
+        let available = reader.fill_buf().map_err(|_| RunError::new("READ_ERROR"))?;
+        if available.is_empty() {
+            return Ok(buffer.len());
+        }
+        let newline = available.iter().position(|byte| *byte == b'\n');
+        let chunk_length = newline.map_or(available.len(), |position| position + 1);
+        if buffer.len().saturating_add(chunk_length) > 1_025 {
+            return Err(RunError::new("OVERLONG_LINE"));
+        }
+        buffer.extend_from_slice(&available[..chunk_length]);
+        reader.consume(chunk_length);
+        if newline.is_some() {
+            return Ok(buffer.len());
+        }
+    }
+}
+
+fn validate_observation_id(id: &str) -> Result<(), RunError> {
+    if id.is_empty() || !id.is_ascii() {
+        return Err(RunError::new("INVALID_OBSERVATION_ID"));
+    }
+    Ok(())
+}
+
+fn temporary_path(output: &Path) -> Result<PathBuf, RunError> {
+    let name = output
+        .file_name()
+        .and_then(|name| name.to_str())
+        .ok_or_else(|| RunError::new("INVALID_OUTPUT_PATH"))?;
+    Ok(output.with_file_name(format!(".{name}.temporary")))
+}
+
+fn ensure_publication_paths_do_not_alias_inputs(
+    inputs: &InputPaths,
+    output: &Path,
+    temporary: &Path,
+) -> Result<(), RunError> {
+    for input in [
+        inputs.units.as_path(),
+        inputs.analytes.as_path(),
+        inputs.mappings.as_path(),
+        inputs.observations.as_path(),
+    ] {
+        if paths_alias(output, input) {
+            return Err(RunError::new("OUTPUT_ALIASES_INPUT"));
+        }
+        if paths_alias(temporary, input) {
+            return Err(RunError::new("OUTPUT_TEMPORARY_ALIASES_INPUT"));
+        }
+    }
+    Ok(())
+}
+
+fn paths_alias(left: &Path, right: &Path) -> bool {
+    if left == right {
+        return true;
+    }
+    if let (Ok(left), Ok(right)) = (fs::canonicalize(left), fs::canonicalize(right))
+        && left == right
+    {
+        return true;
+    }
+    same_existing_file(left, right)
+}
+
+#[cfg(unix)]
+fn same_existing_file(left: &Path, right: &Path) -> bool {
+    use std::os::unix::fs::MetadataExt;
+
+    let (Ok(left), Ok(right)) = (fs::metadata(left), fs::metadata(right)) else {
+        return false;
+    };
+    left.dev() == right.dev() && left.ino() == right.ino()
+}
+
+#[cfg(not(unix))]
+const fn same_existing_file(_left: &Path, _right: &Path) -> bool {
+    false
+}
+
+#[derive(Debug, Clone, Copy)]
+pub struct GenerationConfig {
+    pub seed: u64,
+    pub ordinary: usize,
+    pub boundary: usize,
+    pub rejected: usize,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, serde::Serialize)]
+pub struct FixtureManifest {
+    pub seed: u64,
+    pub reference: ReferenceCounts,
+    pub observations: ObservationCounts,
+    pub digests: BTreeMap<String, String>,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, serde::Serialize)]
+pub struct ReferenceCounts {
+    pub units: usize,
+    pub analytes: usize,
+    pub mappings: usize,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, serde::Serialize)]
+pub struct ObservationCounts {
+    pub ordinary: usize,
+    pub boundary: usize,
+    pub rejected: usize,
+    pub total: usize,
+}
+
+/// Writes a deterministic synthetic reference snapshot, observations, and SHA-256 manifest.
+///
+/// # Errors
+///
+/// Returns an error when counts overflow or a fixture file cannot be created or written.
+pub fn generate_fixture(
+    directory: &Path,
+    config: GenerationConfig,
+) -> Result<FixtureManifest, RunError> {
+    fs::create_dir_all(directory).map_err(|_| RunError::new("WRITE_ERROR"))?;
+    let mut digests = BTreeMap::new();
+    digests.insert(
+        "units.ndjson".to_string(),
+        write_and_hash(&directory.join("units.ndjson"), |writer| {
+            for unit in 0..250 {
+                writeln!(writer, "{{\"symbol\":\"U{unit:03}\"}}")?;
+            }
+            Ok(())
+        })?,
+    );
+    digests.insert(
+        "analytes.ndjson".to_string(),
+        write_and_hash(&directory.join("analytes.ndjson"), |writer| {
+            for analyte in 0..300 {
+                let dimension = analyte % 12;
+                let scale = analyte % 10;
+                writeln!(
+                    writer,
+                    "{{\"analyte_code\":\"A{analyte:03}\",\"dimension\":\"D{dimension:02}\",\"target_scale\":{scale}}}"
+                )?;
+            }
+            Ok(())
+        })?,
+    );
+    digests.insert(
+        "mappings.ndjson".to_string(),
+        write_and_hash(&directory.join("mappings.ndjson"), |writer| {
+            for mapping in 0..12_000 {
+                let source = mapping / 300;
+                let analyte = mapping % 300;
+                let unit = mapping % 250;
+                let dimension = analyte % 12;
+                writeln!(
+                    writer,
+                    "{{\"source_system\":\"G{source:03}\",\"analyte_code\":\"A{analyte:03}\",\"source_unit\":\"U{unit:03}\",\"target_unit\":\"U000\",\"expected_dimension\":\"D{dimension:02}\",\"multiplier_num\":1,\"multiplier_den\":1,\"offset_num\":0,\"offset_den\":1}}"
+                )?;
+            }
+            Ok(())
+        })?,
+    );
+    let total = config
+        .ordinary
+        .checked_add(config.boundary)
+        .and_then(|count| count.checked_add(config.rejected))
+        .ok_or_else(|| RunError::new("COUNT_OVERFLOW"))?;
+    digests.insert(
+        "observations.ndjson".to_string(),
+        write_and_hash(&directory.join("observations.ndjson"), |writer| {
+            for position in 0..total {
+                let index = permuted_index(position, total, config.seed);
+                let mapping = index % 12_000;
+                let source = mapping / 300;
+                let analyte = mapping % 300;
+                let unit = mapping % 250;
+                let dimension = analyte % 12;
+                let (source_unit, value) = if index < config.ordinary {
+                    (format!("U{unit:03}"), "1.25")
+                } else if index < config.ordinary + config.boundary {
+                    (format!("U{unit:03}"), "2.5")
+                } else {
+                    ("UNKNOWN".to_string(), "1")
+                };
+                writeln!(
+                    writer,
+                    "{{\"observation_id\":\"obs-{index:07}\",\"source_system\":\"G{source:03}\",\"analyte_code\":\"A{analyte:03}\",\"source_unit\":\"{source_unit}\",\"declared_dimension\":\"D{dimension:02}\",\"value\":\"{value}\"}}"
+                )?;
+            }
+            Ok(())
+        })?,
+    );
+    let manifest = FixtureManifest {
+        seed: config.seed,
+        reference: ReferenceCounts {
+            units: 250,
+            analytes: 300,
+            mappings: 12_000,
+        },
+        observations: ObservationCounts {
+            ordinary: config.ordinary,
+            boundary: config.boundary,
+            rejected: config.rejected,
+            total,
+        },
+        digests,
+    };
+    let manifest_file =
+        File::create(directory.join("manifest.json")).map_err(|_| RunError::new("WRITE_ERROR"))?;
+    serde_json::to_writer_pretty(manifest_file, &manifest)
+        .map_err(|_| RunError::new("WRITE_ERROR"))?;
+    Ok(manifest)
+}
+
+fn write_and_hash(
+    path: &Path,
+    write_contents: impl FnOnce(&mut HashingWriter<BufWriter<File>>) -> std::io::Result<()>,
+) -> Result<String, RunError> {
+    let file = File::create(path).map_err(|_| RunError::new("WRITE_ERROR"))?;
+    let mut writer = HashingWriter::new(BufWriter::new(file));
+    write_contents(&mut writer).map_err(|_| RunError::new("WRITE_ERROR"))?;
+    writer.flush().map_err(|_| RunError::new("WRITE_ERROR"))?;
+    Ok(writer.finish())
+}
+
+struct HashingWriter<W> {
+    inner: W,
+    hasher: Sha256,
+}
+
+impl<W> HashingWriter<W> {
+    fn new(inner: W) -> Self {
+        Self {
+            inner,
+            hasher: Sha256::new(),
+        }
+    }
+
+    fn finish(self) -> String {
+        format!("{:x}", self.hasher.finalize())
+    }
+}
+
+impl<W: Write> Write for HashingWriter<W> {
+    fn write(&mut self, buffer: &[u8]) -> std::io::Result<usize> {
+        let written = self.inner.write(buffer)?;
+        self.hasher.update(&buffer[..written]);
+        Ok(written)
+    }
+
+    fn flush(&mut self) -> std::io::Result<()> {
+        self.inner.flush()
+    }
+}
+
+fn permuted_index(position: usize, total: usize, seed: u64) -> usize {
+    if total == 0 {
+        return 0;
+    }
+    let mut multiplier = usize::try_from(seed | 1).unwrap_or(1) % total;
+    if multiplier == 0 {
+        multiplier = 1;
+    }
+    while greatest_common_divisor(multiplier, total) != 1 {
+        multiplier = (multiplier + 2) % total;
+        if multiplier == 0 {
+            multiplier = 1;
+        }
+    }
+    let offset = usize::try_from(seed % u64::try_from(total).unwrap_or(u64::MAX)).unwrap_or(0);
+    (position.wrapping_mul(multiplier).wrapping_add(offset)) % total
+}
+
+const fn greatest_common_divisor(mut left: usize, mut right: usize) -> usize {
+    while right != 0 {
+        let remainder = left % right;
+        left = right;
+        right = remainder;
+    }
+    left
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub struct ParseDecimalError;
+
+/// Parses the accepted non-scientific decimal grammar without binary floating point.
+///
+/// # Errors
+///
+/// Returns an error for invalid grammar, over 29 significant digits, scale above nine, or an
+/// `i128` coefficient overflow.
+pub fn parse_decimal(input: &str) -> Result<Decimal, ParseDecimalError> {
+    let (negative, unsigned) = input
+        .strip_prefix('-')
+        .map_or((false, input), |rest| (true, rest));
+    if unsigned.is_empty() || unsigned.starts_with('+') || unsigned.matches('.').count() > 1 {
+        return Err(ParseDecimalError);
+    }
+    let (whole, fractional) = unsigned
+        .split_once('.')
+        .map_or((unsigned, ""), |parts| parts);
+    if whole.is_empty()
+        || (!fractional.is_empty() && fractional.len() > 9)
+        || (unsigned.contains('.') && fractional.is_empty())
+        || !whole.bytes().all(|byte| byte.is_ascii_digit())
+        || !fractional.bytes().all(|byte| byte.is_ascii_digit())
+    {
+        return Err(ParseDecimalError);
+    }
+    let digits = format!("{whole}{fractional}");
+    let significant_digits = digits.trim_start_matches('0').len().max(1);
+    if significant_digits > 29 {
+        return Err(ParseDecimalError);
+    }
+    let magnitude = digits.parse::<i128>().map_err(|_| ParseDecimalError)?;
+    let coefficient = if negative { -magnitude } else { magnitude };
+    Ok(Decimal {
+        coefficient,
+        scale: u32::try_from(fractional.len()).map_err(|_| ParseDecimalError)?,
+    })
+}
+
+#[cfg(test)]
+mod tests {
+    use super::{Decimal, Transform, convert_decimal, parse_decimal, read_limited_line};
+
+    #[test]
+    fn decimal_parser_preserves_base_ten_coefficient_and_scale() {
+        let parsed = parse_decimal("-1234567890123456789012345678.9").expect("valid decimal");
+        assert_eq!(
+            parsed.coefficient,
+            -12_345_678_901_234_567_890_123_456_789_i128
+        );
+        assert_eq!(parsed.scale, 1);
+    }
+
+    #[test]
+    fn decimal_parser_rejects_outside_the_declared_grammar() {
+        for invalid in [
+            "",
+            "-",
+            ".1",
+            "1.",
+            "+1",
+            "1e3",
+            "NaN",
+            "inf",
+            "1.1234567890",
+            "123456789012345678901234567890",
+        ] {
+            assert!(parse_decimal(invalid).is_err(), "accepted {invalid:?}");
+        }
+    }
+
+    #[test]
+    fn affine_conversion_rounds_once_with_half_to_even() {
+        let identity = Transform::new(1, 1, 0, 1);
+        for (source, scale, expected) in [
+            ("2.5", 0, "2"),
+            ("3.5", 0, "4"),
+            ("-2.5", 0, "-2"),
+            ("-3.5", 0, "-4"),
+            ("1.249", 2, "1.25"),
+        ] {
+            let actual = convert_decimal(parse_decimal(source).unwrap(), identity, scale)
+                .expect("bounded conversion");
+            assert_eq!(actual.to_fixed(), expected, "source {source}");
+        }
+
+        let non_integer_with_offset = Transform::new(3, 2, -1, 4);
+        let actual = convert_decimal(parse_decimal("1.25").unwrap(), non_integer_with_offset, 3)
+            .expect("bounded conversion");
+        assert_eq!(actual.to_fixed(), "1.625");
+    }
+
+    #[test]
+    fn twenty_thousand_generated_cases_match_independent_slow_reference() {
+        let mut state = 0x5eed_2026_0818_u64;
+        for case in 0..20_000_u32 {
+            state = state
+                .wrapping_mul(6_364_136_223_846_793_005)
+                .wrapping_add(1_442_695_040_888_963_407);
+            let target_scale = case % 10;
+            let coefficient = if case % 97 == 0 {
+                0
+            } else if case % 13 == 0 {
+                i128::from(case % 1_000) * 2 + 1
+            } else {
+                i128::from(state % 2_000_000_000_001) - 1_000_000_000_000
+            };
+            let source = Decimal {
+                coefficient,
+                scale: target_scale,
+            };
+            let transform = if case % 13 == 0 {
+                Transform::new(1, 2, 0, 1)
+            } else {
+                Transform::new(
+                    i128::from(state % 17 + 1),
+                    i128::from(state.rotate_left(9) % 19 + 1),
+                    i128::from(state.rotate_left(17) % 101) - 50,
+                    i128::from(state.rotate_left(27) % 11 + 1),
+                )
+            };
+            let fast = convert_decimal(source, transform, target_scale).expect("bounded case");
+            let slow = slow_reference(source, transform, target_scale);
+            assert_eq!(fast, slow, "generated case {case}");
+        }
+
+        let maximum = Decimal {
+            coefficient: 99_999_999_999_999_999_999_999_999_999,
+            scale: 9,
+        };
+        assert_eq!(
+            convert_decimal(maximum, Transform::new(1, 1, 0, 1), 9).unwrap(),
+            slow_reference(maximum, Transform::new(1, 1, 0, 1), 9)
+        );
+    }
+
+    fn slow_reference(source: Decimal, transform: Transform, target_scale: u32) -> Decimal {
+        let source_denominator = 10_i128.pow(source.scale);
+        let multiplied_numerator = source.coefficient * transform.multiplier_num;
+        let multiplied_denominator = source_denominator * transform.multiplier_den;
+        let numerator = multiplied_numerator * transform.offset_den
+            + transform.offset_num * multiplied_denominator;
+        let denominator = multiplied_denominator * transform.offset_den;
+        let scaled_magnitude = (numerator * 10_i128.pow(target_scale)).unsigned_abs();
+        let denominator = u128::try_from(denominator).expect("positive denominator");
+        let mut rounded_magnitude = scaled_magnitude / denominator;
+        let remainder = scaled_magnitude % denominator;
+        if remainder * 2 > denominator
+            || (remainder * 2 == denominator && rounded_magnitude % 2 == 1)
+        {
+            rounded_magnitude += 1;
+        }
+        let rounded = i128::try_from(rounded_magnitude).expect("bounded reference");
+        Decimal {
+            coefficient: if numerator.is_negative() {
+                -rounded
+            } else {
+                rounded
+            },
+            scale: target_scale,
+        }
+    }
+
+    #[test]
+    fn limited_reader_never_buffers_more_than_the_declared_line_limit() {
+        let mut reader = std::io::BufReader::new(std::io::Cursor::new(vec![b'x'; 3 * 1024 * 1024]));
+        let mut buffer = Vec::with_capacity(1_025);
+
+        let error = read_limited_line(&mut reader, &mut buffer).unwrap_err();
+
+        assert_eq!(error.code, "OVERLONG_LINE");
+        assert!(buffer.len() <= 1_025);
+    }
+}
diff --git a/developer-simulation/runs/2026-08-18--laboratory-unit-conversion-gate/src/main.rs b/developer-simulation/runs/2026-08-18--laboratory-unit-conversion-gate/src/main.rs
new file mode 100644
index 0000000..dcd02b7
--- /dev/null
+++ b/developer-simulation/runs/2026-08-18--laboratory-unit-conversion-gate/src/main.rs
@@ -0,0 +1,134 @@
+#![forbid(unsafe_code)]
+
+use std::path::Path;
+use std::process::ExitCode;
+use std::time::Instant;
+
+use lab_unit_gate::{FailPoint, GenerationConfig, InputPaths, generate_fixture, run};
+use serde_json::json;
+
+const MAX_PEAK_RSS_BYTES: u64 = 256 * 1024 * 1024;
+
+const fn benchmark_acceptance(peak_rss_bytes: Option<u64>) -> &'static str {
+    match peak_rss_bytes {
+        Some(bytes) if bytes > MAX_PEAK_RSS_BYTES => "failed",
+        Some(_) | None => "unverified",
+    }
+}
+
+fn main() -> ExitCode {
+    let arguments: Vec<_> = std::env::args().skip(1).collect();
+    match execute(&arguments) {
+        Ok(()) => ExitCode::SUCCESS,
+        Err(error) => {
+            eprintln!("{error}");
+            ExitCode::from(2)
+        }
+    }
+}
+
+fn execute(arguments: &[String]) -> Result<(), String> {
+    match arguments {
+        [command, directory, ordinary, boundary, rejected, seed] if command == "generate" => {
+            let config = GenerationConfig {
+                seed: parse_number(seed, "seed")?,
+                ordinary: parse_number(ordinary, "ordinary")?,
+                boundary: parse_number(boundary, "boundary")?,
+                rejected: parse_number(rejected, "rejected")?,
+            };
+            let manifest = generate_fixture(Path::new(directory), config)
+                .map_err(|error| error.to_string())?;
+            println!(
+                "{}",
+                serde_json::to_string(&manifest).map_err(|error| error.to_string())?
+            );
+            Ok(())
+        }
+        [command, directory, output] if command == "run" => {
+            let summary = run(
+                &paths(Path::new(directory)),
+                Path::new(output),
+                FailPoint::None,
+            )
+            .map_err(|error| error.to_string())?;
+            println!(
+                "{}",
+                json!({
+                    "converted": summary.converted,
+                    "output_digest": summary.output_sha256,
+                    "rejected": summary.rejected,
+                    "total": summary.total,
+                })
+            );
+            Ok(())
+        }
+        [command, directory, output] if command == "bench" => {
+            let started = Instant::now();
+            let summary = run(
+                &paths(Path::new(directory)),
+                Path::new(output),
+                FailPoint::None,
+            )
+            .map_err(|error| error.to_string())?;
+            let peak_rss_bytes = peak_rss_bytes();
+            println!(
+                "{}",
+                json!({
+                    "acceptance": benchmark_acceptance(peak_rss_bytes),
+                    "converted": summary.converted,
+                    "elapsed_ms": started.elapsed().as_millis(),
+                    "missing_gates": [
+                        "signed_fixture_parity",
+                        "java_comparison",
+                        "declared_two_core_linux",
+                    ],
+                    "output_digest": summary.output_sha256,
+                    "peak_rss_bytes": peak_rss_bytes,
+                    "rejected": summary.rejected,
+                    "run_status": "complete",
+                    "total": summary.total,
+                })
+            );
+            Ok(())
+        }
+        _ => Err("usage: lab-unit-gate generate DIR ORDINARY BOUNDARY REJECTED SEED | run DIR REPORT | bench DIR REPORT".to_string()),
+    }
+}
+
+fn parse_number<T: std::str::FromStr>(input: &str, name: &str) -> Result<T, String> {
+    input.parse().map_err(|_| format!("invalid {name}"))
+}
+
+fn paths(directory: &Path) -> InputPaths {
+    InputPaths {
+        units: directory.join("units.ndjson"),
+        analytes: directory.join("analytes.ndjson"),
+        mappings: directory.join("mappings.ndjson"),
+        observations: directory.join("observations.ndjson"),
+    }
+}
+
+#[cfg(target_os = "linux")]
+fn peak_rss_bytes() -> Option<u64> {
+    let status = std::fs::read_to_string("/proc/self/status").ok()?;
+    let line = status.lines().find(|line| line.starts_with("VmHWM:"))?;
+    let kilobytes = line.split_whitespace().nth(1)?.parse::<u64>().ok()?;
+    kilobytes.checked_mul(1_024)
+}
+
+#[cfg(not(target_os = "linux"))]
+const fn peak_rss_bytes() -> Option<u64> {
+    None
+}
+
+#[cfg(test)]
+mod tests {
+    use super::{MAX_PEAK_RSS_BYTES, benchmark_acceptance};
+
+    #[test]
+    fn measured_over_limit_memory_can_never_emit_acceptance_pass() {
+        assert_eq!(benchmark_acceptance(Some(MAX_PEAK_RSS_BYTES + 1)), "failed");
+        assert_eq!(benchmark_acceptance(None), "unverified");
+        assert_eq!(benchmark_acceptance(Some(MAX_PEAK_RSS_BYTES)), "unverified");
+    }
+}
diff --git a/developer-simulation/runs/2026-08-18--laboratory-unit-conversion-gate/tests/cli.rs b/developer-simulation/runs/2026-08-18--laboratory-unit-conversion-gate/tests/cli.rs
new file mode 100644
index 0000000..abb8ee2
--- /dev/null
+++ b/developer-simulation/runs/2026-08-18--laboratory-unit-conversion-gate/tests/cli.rs
@@ -0,0 +1,78 @@
+use std::process::Command;
+
+use tempfile::tempdir;
+
+#[test]
+fn benchmark_command_emits_one_machine_readable_summary() {
+    let dir = tempdir().unwrap();
+    let binary = env!("CARGO_BIN_EXE_lab-unit-gate");
+    let generated = Command::new(binary)
+        .args([
+            "generate",
+            dir.path().to_str().unwrap(),
+            "95",
+            "3",
+            "2",
+            "42",
+        ])
+        .output()
+        .unwrap();
+    assert!(generated.status.success());
+
+    let benchmark = Command::new(binary)
+        .args([
+            "bench",
+            dir.path().to_str().unwrap(),
+            dir.path().join("report.ndjson").to_str().unwrap(),
+        ])
+        .output()
+        .unwrap();
+    assert!(benchmark.status.success());
+    assert!(benchmark.stderr.is_empty());
+    let stdout = String::from_utf8(benchmark.stdout).unwrap();
+    assert_eq!(stdout.lines().count(), 1);
+    let value: serde_json::Value = serde_json::from_str(&stdout).unwrap();
+    assert_eq!(value["converted"], 98);
+    assert_eq!(value["rejected"], 2);
+    assert_eq!(value["total"], 100);
+    assert_eq!(value["run_status"], "complete");
+    assert_eq!(value["acceptance"], "unverified");
+    assert!(value.get("status").is_none());
+    assert_eq!(value["output_digest"].as_str().unwrap().len(), 64);
+    assert!(value.get("elapsed_ms").is_some());
+    assert!(value.get("peak_rss_bytes").is_some());
+}
+
+#[test]
+fn relative_output_path_publishes_successfully() {
+    let dir = tempdir().unwrap();
+    let binary = env!("CARGO_BIN_EXE_lab-unit-gate");
+    let generated = Command::new(binary)
+        .args([
+            "generate",
+            dir.path().to_str().unwrap(),
+            "95",
+            "3",
+            "2",
+            "42",
+        ])
+        .output()
+        .unwrap();
+    assert!(generated.status.success());
+
+    let run = Command::new(binary)
+        .current_dir(dir.path())
+        .args(["run", ".", "report.ndjson"])
+        .output()
+        .unwrap();
+
+    assert!(
+        run.status.success(),
+        "stderr: {}",
+        String::from_utf8_lossy(&run.stderr)
+    );
+    assert!(run.stderr.is_empty());
+    assert!(dir.path().join("report.ndjson").is_file());
+    let summary: serde_json::Value = serde_json::from_slice(&run.stdout).unwrap();
+    assert_eq!(summary["total"], 100);
+}
diff --git a/developer-simulation/runs/2026-08-18--laboratory-unit-conversion-gate/tests/gate.rs b/developer-simulation/runs/2026-08-18--laboratory-unit-conversion-gate/tests/gate.rs
new file mode 100644
index 0000000..8e8bc23
--- /dev/null
+++ b/developer-simulation/runs/2026-08-18--laboratory-unit-conversion-gate/tests/gate.rs
@@ -0,0 +1,194 @@
+use std::fmt::Write as _;
+use std::fs;
+
+use lab_unit_gate::{FailPoint, InputPaths, PublicationState, run};
+use tempfile::tempdir;
+
+fn write_inputs(root: &std::path::Path, observations: &str) {
+    fs::write(
+        root.join("units.ndjson"),
+        "{\"symbol\":\"mg/dL\"}\n{\"symbol\":\"mmol/L\"}\n{\"symbol\":\"huge\"}\n",
+    )
+    .unwrap();
+    fs::write(
+        root.join("analytes.ndjson"),
+        "{\"analyte_code\":\"GLU\",\"dimension\":\"mass_concentration\",\"target_scale\":1}\n",
+    )
+    .unwrap();
+    fs::write(
+        root.join("mappings.ndjson"),
+        concat!(
+            "{\"source_system\":\"gateway-a\",\"analyte_code\":\"GLU\",\"source_unit\":\"mg/dL\",\"target_unit\":\"mmol/L\",\"expected_dimension\":\"mass_concentration\",\"multiplier_num\":1,\"multiplier_den\":2,\"offset_num\":0,\"offset_den\":1}\n",
+            "{\"source_system\":\"gateway-a\",\"analyte_code\":\"GLU\",\"source_unit\":\"huge\",\"target_unit\":\"mmol/L\",\"expected_dimension\":\"mass_concentration\",\"multiplier_num\":1000000000000000000,\"multiplier_den\":1,\"offset_num\":0,\"offset_den\":1}\n",
+        ),
+    )
+    .unwrap();
+    fs::write(root.join("observations.ndjson"), observations).unwrap();
+}
+
+fn paths(root: &std::path::Path) -> InputPaths {
+    InputPaths {
+        units: root.join("units.ndjson"),
+        analytes: root.join("analytes.ndjson"),
+        mappings: root.join("mappings.ndjson"),
+        observations: root.join("observations.ndjson"),
+    }
+}
+
+#[test]
+fn complete_run_sorts_rows_and_rejects_unsafe_records() {
+    let dir = tempdir().unwrap();
+    write_inputs(
+        dir.path(),
+        concat!(
+            "{\"observation_id\":\"z\",\"source_system\":\"gateway-a\",\"analyte_code\":\"GLU\",\"source_unit\":\"mg/dL\",\"declared_dimension\":\"mass_concentration\",\"value\":\"1\"}\n",
+            "{\"observation_id\":\"a\",\"source_system\":\"gateway-a\",\"analyte_code\":\"GLU\",\"source_unit\":\"bogus\",\"declared_dimension\":\"mass_concentration\",\"value\":\"1\"}\n",
+            "{\"observation_id\":\"m\",\"source_system\":\"gateway-a\",\"analyte_code\":\"GLU\",\"source_unit\":\"mg/dL\",\"declared_dimension\":\"amount_concentration\",\"value\":\"1\"}\n",
+            "{\"observation_id\":\"b\",\"source_system\":\"gateway-a\",\"analyte_code\":\"GLU\",\"source_unit\":\"mg/dL\",\"declared_dimension\":\"mass_concentration\",\"value\":\"NaN\"}\n",
+            "{\"observation_id\":\"c\",\"source_system\":\"gateway-a\",\"analyte_code\":\"GLU\",\"source_unit\":\"huge\",\"declared_dimension\":\"mass_concentration\",\"value\":\"99999999999999999999999999999\"}\n",
+        ),
+    );
+    let report = dir.path().join("report.ndjson");
+
+    let summary = run(&paths(dir.path()), &report, FailPoint::None).expect("complete run");
+
+    assert_eq!(summary.total, 5);
+    assert_eq!(summary.converted, 1);
+    assert_eq!(summary.rejected, 4);
+    assert_eq!(
+        fs::read_to_string(report).unwrap(),
+        concat!(
+            "{\"observation_id\":\"a\",\"reason\":\"UNKNOWN_MAPPING\",\"status\":\"rejected\"}\n",
+            "{\"observation_id\":\"b\",\"reason\":\"INVALID_VALUE\",\"status\":\"rejected\"}\n",
+            "{\"observation_id\":\"c\",\"reason\":\"ARITHMETIC_OVERFLOW\",\"status\":\"rejected\"}\n",
+            "{\"observation_id\":\"m\",\"reason\":\"INCOMPATIBLE_DIMENSION\",\"status\":\"rejected\"}\n",
+            "{\"observation_id\":\"z\",\"status\":\"normalized\",\"target_unit\":\"mmol/L\",\"value\":\"0.5\"}\n",
+        )
+    );
+}
+
+#[test]
+fn run_level_failure_preserves_an_existing_complete_report() {
+    let dir = tempdir().unwrap();
+    let duplicate = "{\"observation_id\":\"same\",\"source_system\":\"gateway-a\",\"analyte_code\":\"GLU\",\"source_unit\":\"mg/dL\",\"declared_dimension\":\"mass_concentration\",\"value\":\"1\"}\n";
+    write_inputs(dir.path(), &format!("{duplicate}{duplicate}"));
+    let report = dir.path().join("report.ndjson");
+    fs::write(&report, b"previous-complete-report\n").unwrap();
+
+    let error = run(&paths(dir.path()), &report, FailPoint::None).unwrap_err();
+    assert_eq!(error.publication_state, PublicationState::NotPublished);
+    assert_eq!(fs::read(&report).unwrap(), b"previous-complete-report\n");
+}
+
+#[test]
+fn injected_exits_never_publish_a_partial_report_and_rerun_recovers() {
+    let dir = tempdir().unwrap();
+    let mut valid = String::new();
+    for index in 0..100 {
+        writeln!(
+            valid,
+            "{{\"observation_id\":\"obs-{index:03}\",\"source_system\":\"gateway-a\",\"analyte_code\":\"GLU\",\"source_unit\":\"mg/dL\",\"declared_dimension\":\"mass_concentration\",\"value\":\"1\"}}"
+        )
+        .unwrap();
+    }
+    write_inputs(dir.path(), &valid);
+    let report = dir.path().join("report.ndjson");
+    fs::write(&report, b"previous-complete-report\n").unwrap();
+
+    assert!(run(&paths(dir.path()), &report, FailPoint::AfterRows(1)).is_err());
+    assert_eq!(fs::read(&report).unwrap(), b"previous-complete-report\n");
+
+    assert!(run(&paths(dir.path()), &report, FailPoint::AfterRows(50)).is_err());
+    assert_eq!(fs::read(&report).unwrap(), b"previous-complete-report\n");
+
+    assert!(run(&paths(dir.path()), &report, FailPoint::BeforeRename).is_err());
+    assert_eq!(fs::read(&report).unwrap(), b"previous-complete-report\n");
+
+    let summary = run(&paths(dir.path()), &report, FailPoint::None).expect("clean rerun");
+    assert_eq!((summary.converted, summary.rejected), (100, 0));
+    assert!(!dir.path().join(".report.ndjson.temporary").exists());
+}
+
+#[test]
+fn output_cannot_alias_observations_or_a_resolved_reference_path() {
+    let dir = tempdir().unwrap();
+    let observation = "{\"observation_id\":\"one\",\"source_system\":\"gateway-a\",\"analyte_code\":\"GLU\",\"source_unit\":\"mg/dL\",\"declared_dimension\":\"mass_concentration\",\"value\":\"1\"}\n";
+    write_inputs(dir.path(), observation);
+    let inputs = paths(dir.path());
+    let observation_bytes = fs::read(&inputs.observations).unwrap();
+
+    let observation_error = run(&inputs, &inputs.observations, FailPoint::None).unwrap_err();
+
+    assert_eq!(observation_error.code, "OUTPUT_ALIASES_INPUT");
+    assert_eq!(fs::read(&inputs.observations).unwrap(), observation_bytes);
+    assert!(!dir.path().join(".observations.ndjson.temporary").exists());
+
+    fs::create_dir(dir.path().join("nested")).unwrap();
+    let resolved_units = dir.path().join("nested/../units.ndjson");
+    let unit_bytes = fs::read(&inputs.units).unwrap();
+
+    let reference_error = run(&inputs, &resolved_units, FailPoint::None).unwrap_err();
+
+    assert_eq!(reference_error.code, "OUTPUT_ALIASES_INPUT");
+    assert_eq!(fs::read(&inputs.units).unwrap(), unit_bytes);
+}
+
+#[test]
+fn existing_output_identity_and_temporary_aliases_are_rejected() {
+    let dir = tempdir().unwrap();
+    let observation = "{\"observation_id\":\"one\",\"source_system\":\"gateway-a\",\"analyte_code\":\"GLU\",\"source_unit\":\"mg/dL\",\"declared_dimension\":\"mass_concentration\",\"value\":\"1\"}\n";
+    write_inputs(dir.path(), observation);
+    let inputs = paths(dir.path());
+    let hard_link_output = dir.path().join("hard-link-report.ndjson");
+    fs::hard_link(&inputs.mappings, &hard_link_output).unwrap();
+    let mapping_bytes = fs::read(&inputs.mappings).unwrap();
+
+    let identity_error = run(&inputs, &hard_link_output, FailPoint::None).unwrap_err();
+
+    assert_eq!(identity_error.code, "OUTPUT_ALIASES_INPUT");
+    assert_eq!(fs::read(&inputs.mappings).unwrap(), mapping_bytes);
+    assert_eq!(fs::read(&hard_link_output).unwrap(), mapping_bytes);
+
+    let output = dir.path().join("report.ndjson");
+    let temporary_input = dir.path().join(".report.ndjson.temporary");
+    fs::rename(&inputs.units, &temporary_input).unwrap();
+    let adjacent_inputs = InputPaths {
+        units: temporary_input.clone(),
+        ..inputs
+    };
+    let temporary_bytes = fs::read(&temporary_input).unwrap();
+
+    let temporary_error = run(&adjacent_inputs, &output, FailPoint::None).unwrap_err();
+
+    assert_eq!(temporary_error.code, "OUTPUT_TEMPORARY_ALIASES_INPUT");
+    assert_eq!(fs::read(&temporary_input).unwrap(), temporary_bytes);
+    assert!(!output.exists());
+}
+
+#[test]
+fn post_rename_uncertainty_is_distinct_from_prepublication_failure() {
+    let dir = tempdir().unwrap();
+    let observation = "{\"observation_id\":\"one\",\"source_system\":\"gateway-a\",\"analyte_code\":\"GLU\",\"source_unit\":\"mg/dL\",\"declared_dimension\":\"mass_concentration\",\"value\":\"1\"}\n";
+    write_inputs(dir.path(), observation);
+    let report = dir.path().join("report.ndjson");
+    fs::write(&report, b"previous-complete-report\n").unwrap();
+
+    let error = run(
+        &paths(dir.path()),
+        &report,
+        FailPoint::AfterRenameBeforeDirectorySync,
+    )
+    .unwrap_err();
+
+    assert_eq!(error.code, "POST_RENAME_DURABILITY_UNCERTAIN");
+    assert_eq!(
+        error.publication_state,
+        PublicationState::PublishedDurabilityUncertain
+    );
+    assert_ne!(fs::read(&report).unwrap(), b"previous-complete-report\n");
+    assert!(
+        fs::read_to_string(&report)
+            .unwrap()
+            .contains("\"status\":\"normalized\"")
+    );
+}
diff --git a/developer-simulation/runs/2026-08-18--laboratory-unit-conversion-gate/tests/generator.rs b/developer-simulation/runs/2026-08-18--laboratory-unit-conversion-gate/tests/generator.rs
new file mode 100644
index 0000000..ca621cf
--- /dev/null
+++ b/developer-simulation/runs/2026-08-18--laboratory-unit-conversion-gate/tests/generator.rs
@@ -0,0 +1,62 @@
+use std::fs;
+
+use lab_unit_gate::{FailPoint, GenerationConfig, InputPaths, generate_fixture, run};
+use tempfile::tempdir;
+
+#[test]
+fn fixed_seed_generator_writes_declared_counts_and_sha256_manifest() {
+    let first = tempdir().unwrap();
+    let second = tempdir().unwrap();
+    let config = GenerationConfig {
+        seed: 42,
+        ordinary: 95,
+        boundary: 3,
+        rejected: 2,
+    };
+
+    let first_manifest = generate_fixture(first.path(), config).expect("first fixture");
+    let second_manifest = generate_fixture(second.path(), config).expect("second fixture");
+
+    assert_eq!(first_manifest.observations.total, 100);
+    assert_eq!(first_manifest.observations.ordinary, 95);
+    assert_eq!(first_manifest.observations.boundary, 3);
+    assert_eq!(first_manifest.observations.rejected, 2);
+    assert_eq!(first_manifest.reference.mappings, 12_000);
+    assert_eq!(first_manifest.reference.units, 250);
+    assert_eq!(first_manifest.reference.analytes, 300);
+    assert_eq!(first_manifest.digests, second_manifest.digests);
+    assert_eq!(
+        fs::read(first.path().join("observations.ndjson")).unwrap(),
+        fs::read(second.path().join("observations.ndjson")).unwrap()
+    );
+    assert_eq!(first_manifest.digests["observations.ndjson"].len(), 64);
+    assert!(first.path().join("manifest.json").is_file());
+}
+
+#[test]
+fn five_fixed_shuffles_and_three_repeats_produce_identical_reports() {
+    let mut digests = Vec::new();
+    for seed in [11, 22, 33, 44, 55, 11, 11, 11] {
+        let dir = tempdir().unwrap();
+        generate_fixture(
+            dir.path(),
+            GenerationConfig {
+                seed,
+                ordinary: 950,
+                boundary: 25,
+                rejected: 25,
+            },
+        )
+        .unwrap();
+        let inputs = InputPaths {
+            units: dir.path().join("units.ndjson"),
+            analytes: dir.path().join("analytes.ndjson"),
+            mappings: dir.path().join("mappings.ndjson"),
+            observations: dir.path().join("observations.ndjson"),
+        };
+        let summary = run(&inputs, &dir.path().join("report.ndjson"), FailPoint::None).unwrap();
+        assert_eq!((summary.converted, summary.rejected), (975, 25));
+        digests.push(summary.output_sha256);
+    }
+    assert!(digests.windows(2).all(|pair| pair[0] == pair[1]));
+}
diff --git a/developer-simulation/runs/2026-08-18--laboratory-unit-conversion-gate/tests/negative_fixtures.rs b/developer-simulation/runs/2026-08-18--laboratory-unit-conversion-gate/tests/negative_fixtures.rs
new file mode 100644
index 0000000..d969949
--- /dev/null
+++ b/developer-simulation/runs/2026-08-18--laboratory-unit-conversion-gate/tests/negative_fixtures.rs
@@ -0,0 +1,152 @@
+use std::fs;
+use std::path::Path;
+
+use lab_unit_gate::{FailPoint, InputPaths, run};
+use tempfile::tempdir;
+
+fn write_reference(root: &Path) {
+    fs::write(root.join("units.ndjson"), "{\"symbol\":\"U0\"}\n").unwrap();
+    fs::write(
+        root.join("analytes.ndjson"),
+        "{\"analyte_code\":\"A0\",\"dimension\":\"D0\",\"target_scale\":0}\n",
+    )
+    .unwrap();
+    fs::write(
+        root.join("mappings.ndjson"),
+        "{\"source_system\":\"G0\",\"analyte_code\":\"A0\",\"source_unit\":\"U0\",\"target_unit\":\"U0\",\"expected_dimension\":\"D0\",\"multiplier_num\":1,\"multiplier_den\":1,\"offset_num\":0,\"offset_den\":1}\n",
+    )
+    .unwrap();
+}
+
+fn input_paths(root: &Path) -> InputPaths {
+    InputPaths {
+        units: root.join("units.ndjson"),
+        analytes: root.join("analytes.ndjson"),
+        mappings: root.join("mappings.ndjson"),
+        observations: root.join("observations.ndjson"),
+    }
+}
+
+#[test]
+fn retained_unknown_field_fixture_has_one_exact_outcome() {
+    let fixture = Path::new(env!("CARGO_MANIFEST_DIR"))
+        .join("fixtures/negative/unknown-field-observation.ndjson");
+    let dir = tempdir().unwrap();
+    write_reference(dir.path());
+    fs::copy(&fixture, dir.path().join("observations.ndjson")).unwrap();
+    let report = dir.path().join("report.ndjson");
+    fs::write(&report, b"previous\n").unwrap();
+
+    let error = run(&input_paths(dir.path()), &report, FailPoint::None).unwrap_err();
+
+    assert_eq!(error.code, "INVALID_NDJSON");
+    assert_eq!(fs::read(&report).unwrap(), b"previous\n");
+}
+
+#[test]
+fn invalid_utf8_and_overlong_lines_are_run_level_failures() {
+    for (bytes, expected) in [
+        (vec![0xff, b'\n'], "INVALID_NDJSON"),
+        (vec![b'x'; 1_025], "OVERLONG_LINE"),
+    ] {
+        let dir = tempdir().unwrap();
+        write_reference(dir.path());
+        fs::write(dir.path().join("observations.ndjson"), bytes).unwrap();
+        let error = run(
+            &input_paths(dir.path()),
+            &dir.path().join("report.ndjson"),
+            FailPoint::None,
+        )
+        .unwrap_err();
+        assert_eq!(error.code, expected);
+    }
+}
+
+#[test]
+fn malformed_reference_variants_fail_before_observation_processing() {
+    let valid_observation = "{\"observation_id\":\"x\",\"source_system\":\"G0\",\"analyte_code\":\"A0\",\"source_unit\":\"U0\",\"declared_dimension\":\"D0\",\"value\":\"1\"}\n";
+    let cases = [
+        (
+            "units.ndjson",
+            "{\"symbol\":\"U0\"}\n{\"symbol\":\"U0\"}\n",
+            "INVALID_UNIT_SNAPSHOT",
+        ),
+        (
+            "mappings.ndjson",
+            "{\"source_system\":\"G0\",\"analyte_code\":\"A0\",\"source_unit\":\"U0\",\"target_unit\":\"MISSING\",\"expected_dimension\":\"D0\",\"multiplier_num\":1,\"multiplier_den\":1,\"offset_num\":0,\"offset_den\":1}\n",
+            "UNKNOWN_UNIT_SYMBOL",
+        ),
+        (
+            "mappings.ndjson",
+            "{\"source_system\":\"G0\",\"analyte_code\":\"A0\",\"source_unit\":\"U0\",\"target_unit\":\"U0\",\"expected_dimension\":\"D0\",\"multiplier_num\":1,\"multiplier_den\":0,\"offset_num\":0,\"offset_den\":1}\n",
+            "INVALID_DENOMINATOR_OR_MULTIPLIER",
+        ),
+        (
+            "analytes.ndjson",
+            "{\"analyte_code\":\"A0\",\"dimension\":\"D0\",\"target_scale\":10}\n",
+            "INVALID_ANALYTE_SNAPSHOT",
+        ),
+        (
+            "mappings.ndjson",
+            "{\"source_system\":\"G0\",\"analyte_code\":\"A0\",\"source_unit\":\"U0\",\"target_unit\":\"U0\",\"expected_dimension\":\"WRONG\",\"multiplier_num\":1,\"multiplier_den\":1,\"offset_num\":0,\"offset_den\":1}\n",
+            "INCONSISTENT_DIMENSION",
+        ),
+        (
+            "mappings.ndjson",
+            concat!(
+                "{\"source_system\":\"G0\",\"analyte_code\":\"A0\",\"source_unit\":\"U0\",\"target_unit\":\"U0\",\"expected_dimension\":\"D0\",\"multiplier_num\":1,\"multiplier_den\":1,\"offset_num\":0,\"offset_den\":1}\n",
+                "{\"source_system\":\"G0\",\"analyte_code\":\"A0\",\"source_unit\":\"U0\",\"target_unit\":\"U0\",\"expected_dimension\":\"D0\",\"multiplier_num\":1,\"multiplier_den\":1,\"offset_num\":0,\"offset_den\":1}\n",
+            ),
+            "DUPLICATE_MAPPING_KEY",
+        ),
+        (
+            "mappings.ndjson",
+            "{\"source_system\":\"G0\",\"analyte_code\":\"A0\",\"source_unit\":\"U0\",\"target_unit\":\"U0\",\"expected_dimension\":\"D0\",\"multiplier_num\":1000000000000000001,\"multiplier_den\":1,\"offset_num\":0,\"offset_den\":1}\n",
+            "COEFFICIENT_OUT_OF_RANGE",
+        ),
+    ];
+    for (file, replacement, expected) in cases {
+        let dir = tempdir().unwrap();
+        write_reference(dir.path());
+        fs::write(dir.path().join(file), replacement).unwrap();
+        fs::write(dir.path().join("observations.ndjson"), valid_observation).unwrap();
+        let error = run(
+            &input_paths(dir.path()),
+            &dir.path().join("report.ndjson"),
+            FailPoint::None,
+        )
+        .unwrap_err();
+        assert_eq!(error.code, expected);
+    }
+}
+
+#[test]
+fn forced_read_and_write_failures_return_nonzero_equivalent_errors() {
+    let missing = tempdir().unwrap();
+    write_reference(missing.path());
+    let prior = missing.path().join("report.ndjson");
+    fs::write(&prior, b"previous\n").unwrap();
+    let read_error = run(&input_paths(missing.path()), &prior, FailPoint::None).unwrap_err();
+    assert_eq!(read_error.code, "READ_ERROR");
+    assert_eq!(fs::read(&prior).unwrap(), b"previous\n");
+
+    let blocked = tempdir().unwrap();
+    write_reference(blocked.path());
+    fs::write(
+        blocked.path().join("observations.ndjson"),
+        "{\"observation_id\":\"x\",\"source_system\":\"G0\",\"analyte_code\":\"A0\",\"source_unit\":\"U0\",\"declared_dimension\":\"D0\",\"value\":\"1\"}\n",
+    )
+    .unwrap();
+    fs::write(blocked.path().join("not-a-directory"), b"sentinel").unwrap();
+    let write_error = run(
+        &input_paths(blocked.path()),
+        &blocked.path().join("not-a-directory/report.ndjson"),
+        FailPoint::None,
+    )
+    .unwrap_err();
+    assert_eq!(write_error.code, "WRITE_ERROR");
+    assert_eq!(
+        fs::read(blocked.path().join("not-a-directory")).unwrap(),
+        b"sentinel"
+    );
+}