docs(#770): delete slot.rs's false backstop claim, name the canonical spelling in guild.rs's assert

[djhenry]

Closes #770. Round 3: an independent reviewer requested changes on the round-2 fix (head
6bfc5c2), finding round 1's two code defects genuinely fixed, but round 2's own fix for B1
reintroduced a false universal for the same underlying reason as the original defect, and round
2's B2 fix dropped a load-bearing clause from the issue's own sentence while this body claimed the
opposite. Both are fixed below — see the "Round 3 correction" subsections inside Item 1/B2 and Item
3/B1. The rest of round 1's and round 2's sections are kept as-is (the reviewer confirmed both are
otherwise complete and contain no further false claims); only the two false sentences are corrected
in place, since a future reader would otherwise take them as still accurate.

Item 1 / B2 — the slot.rs paragraph's deletion was incomplete

Round 1 deleted the trailing clause claiming a "guarantee" backstops a blind write, but left two
other claims standing in the same paragraph: that the static rule is "a redundant early-warning on
top of" the behavioural test, and that eqoxide-http's reflow-coverage-loss argument "does not
transfer here." The reviewer proved both false by adding a newly-added, un-annotated blind write to
a domain module, wrapping it across lines the way rustfmt wraps a long receiver chain, and running
the crate: 46 passed, 0 failed — fully green. Neither the static line-scan nor the behavioural
universal caught it, because a blind writer returns ()/u64, not bool, so it was never in
every_no_overwrite_request_refuses_a_second_write's coverage set to begin with. That is not
"redundant," and the eqoxide-http argument transfers exactly.

Fix: deleted both remaining claims, composing no replacement justification.

Round 3 correction. This PR body then said the paragraph "now closes on the issue's own
accepted-limit sentence, unchanged," quoting "this static rule is the only defence for a blind
write, and that is an accepted limit, not a backstopped one." That quote silently dropped a clause
from the issue's actual sentence — the issue reads "...this static rule is the only defence for a
blind write, and a reflow does cost it, and that is an accepted limit, not a backstopped one."
The round-2 edit to slot.rs had in fact dropped that clause from the source comment too, not just
from this body's quote of it. Both are now fixed: the comment in slot.rs again states the reflow
cost explicitly, with the measured detail that makes it a claim rather than an assumption:

...this crate's blind writes are not among them, so for a blind write this static rule is the
only defence and a reflow does cost it — measured, not assumed: an un-annotated blind write
added to a domain module and wrapped across lines the way rustfmt wraps a long receiver chain
passes this crate's tests fully green, because the wrap breaks this rule's *self. anchor and a
blind writer was never in the behavioural universal's coverage set to begin with. That is an
accepted limit, not a backstopped one.

This restates the reviewer's own round-2 reflow-mutation proof (46 passed; 0 failed on a wrapped,
un-annotated blind write, re-run independently by the reviewer against this branch's head) rather
than re-running it a third time on an unchanged code path — that would not add information.

Re-measured the blind-write table directly from this branch's head rather than copying either the
issue's or round-1's figures (grep -n "lock().unwrap() = Some(" lifecycle.rs nav.rs social.rs):
six methods, seven write lines, none returning bool — same set round 1 reported, unchanged.

Correcting round 1's own claim about this same table (see B4 below): it said "only the line numbers
moved... a handful of lines later than the issue cites." False for two of the three files it named.
Measured against the issue's own cited write lines: lifecycle.rs's request_camp write and both
social.rs writes (request_who, request_friends_who) sit on the EXACT lines the issue cites,
unmoved. Only nav.rs's three writes (request_goto, request_follow's two writes,
request_zone_cross) moved, and moved by twenty lines uniformly, not "a handful."

Item 2 / B3 — the 1575/0/45 figure: measured at the actual commit, not substituted

Round 1 measured the workspace on this branch's own head (built from main plus this PR's commits)
and called that "close to apples-to-apples" to b0246bc, then claimed there was "no way to
retroactively verify" the figure at b0246bc itself. Both were false: b0246bc is an immutable,
reachable commit, and a substitution justified by proximity is exactly the reasoned-not-measured
defect #770 was filed to fix.

Built a detached worktree at b0246bc itself (not this branch, not main) and ran the full
workspace suite there, --locked --no-fail-fast:

• Finished \test` profile [unoptimized + debuginfo] target(s) in 20m 22s`
• 50 test result: lines — expected 50 (37 Running binaries + 13 Doc-tests targets, cross-checked
  against 50 running N tests/running 1 test headers — b0246bc itself already emits this same
  37+13=50 split, so the historical "49" is not explained by any commits merged after this PR; see
  the correction to that claim below)
• 0 non-canonical (none spliced, truncated, or missing a count) · 15 all-zero lines, reported
  separately as benign empty targets
• 1628 passed + 0 failed + 45 ignored + 0 filtered = 1673
• no error: / panicked at anywhere in the log

Replaced the block appended to #758 with this measurement (see below) and removed the impossibility
claim entirely. (CLEARED by round 3's independent review — the reviewer's own snapshot diff of the
#758 edit showed one hunk changed, accurately dated/retracted, no local detail; no further change
made this round.)

Item 3 / B1 — the assert message named one spelling, the guard accepts two

Round 1's fix named .refused( as "the one accepted spelling" in the offender message. The guard's
conjunct 2 accepts either .refused( or .refused_json( — five real call sites in this crate
(two in merchant.rs, one in interact.rs, two in combat.rs) use refused_json because their
handlers return Response, not (StatusCode, String). Applying the round-1 message's suggestion
literally at a refused_json site fails to compile (expected Response<Body>, found (StatusCode, String)), reproduced independently by the reviewer.

Round 2's fix (superseded — see the correction below): Site recorded which terminator conjunct 2
actually found at that call site, and the offender message echoed that one back, labelled as
guaranteed to compile because it was exactly the terminator the flagged handler already called.
Only when neither was present did the message show both accepted shapes side by side.

Compile-verified at both site types in one mutation run (round 2; temporarily rewrote both
post_attack_on's .refused( call and post_target_name's .refused_json( call to an equivalent
match form):

thread 'guild::no_silent_overwrite_guard::every_refusable_command_request_is_checked_by_its_http_caller' panicked at crates/eqoxide-http/src/guild.rs:614:9:
these HTTP handlers call a refusable CommandState::request_* and throw away the refusal, so a dropped command is still answered 200 (#347 step 2):
  combat.rs:134: request_target — not the canonical refusal (violates conjunct(s) [1, 3] of refusal_shape_faults). The accepted shape is:
    if let Some(busy) = s.command.request_target(..).refused_json(MSG) { return busy; }
  combat.rs:155: request_attack — not the canonical refusal (violates conjunct(s) [1, 3] of refusal_shape_faults). The accepted shape is:
    if let Some(busy) = s.command.request_attack(..).refused(MSG) { return busy; }
test result: FAILED. 0 passed; 1 failed; 0 ignored; 0 measured; 244 filtered out; finished in 3.60s

Round 2 then claimed reverting and rerunning the 3-test module "confirm[ed] the terminator-detection
plumbing agrees with canonical() on every real call site in the crate, including the refused_json
ones" — this claim is retracted below; it was unsupported.

Round 3 correction — round 2's own fix was false, and has been replaced

Round 3 review found the round-2 fix above false, for two reasons:

1. Untested. The message-construction code (the terminator field plus the echo logic) lived
   entirely inside the !canonical branch of
   every_refusable_command_request_is_checked_by_its_http_caller, which is dead code on this
   (canonical) tree — no test in this PR ever executed it. The claim quoted above, that a green
   3 passed run "confirms the plumbing... including the refused_json ones," was therefore
   unsupported: the run never entered that branch at all.
2. The compile guarantee is false by construction. refusal_sites's statement span ends at the
   first ; after the opening brace. When the flagged call's own block is missing that
   semicolon — exactly the malformed shape conjunct 3 exists to flag, e.g. { return busy with no
   trailing ; — the span runs past the flagged statement into the next one and can pick up
   its terminator instead. The reviewer reproduced this directly: a
   match ... { Some(busy) => return busy, None => () } (no trailing ;) immediately followed by
   an unrelated .refused_json( call caused the message to claim .refused_json( for a site that
   actually calls .refused(. Applying that message's suggestion literally does not compile.

Fix chosen, of the three the reviewer offered (always print both shapes and delete the guarantee
claim; keep the echo but describe it honestly as "the terminator found in the scanned span," not
the call's own; or fix the span itself, a behaviour change out of place in a docs-only PR):
always print both accepted shapes, and delete any guarantee claim. This is not a weaker version
of the round-2 design; it structurally removes the defect class, since the message no longer
asserts anything about which terminator belongs to which site — the exact thing the span bug could
get wrong. Concretely:

• Removed the terminator field from Site and the terminator-detection code from
  refusal_sites, replacing it with a doc comment on refusal_sites explaining why the field must
  not come back.
• Extracted the message text into a standalone offender_message(file, line, name, faults) -> String function, specifically so a unit test can call it directly with fabricated arguments —
  pinning its exact text without depending on the integration scanner finding a real non-canonical
  site on this clean tree. This is what makes the branch not-dead:
  offender_message_names_both_accepted_shapes now calls it directly and fails if the text drifts
  from either accepted shape, or if it starts claiming to know which one applies to a given site.
• The message no longer says "guaranteed" or singles out one shape; it always names both,
  generically, by the call's own name (s.command.{name}(..)).

Mutation-checked both directions:

• RED — temporarily rewrote offender_message back to the round-2 single-shape, "guaranteed to
  compile" design and ran the new test: it failed immediately on the text mismatch, confirming the
  test would have caught round 2's own defect had it existed at the time.

• GREEN — reverted the mutation (copy-aside + md5sum-verified copy-back, confirmed
  git diff --stat empty for the file afterward) and reran: 4 passed; 0 failed for
  no_silent_overwrite_guard (the 3 original tests plus the new one).

• Reproduced the reviewer's exact adversarial construction (the un-terminated match in
  post_attack_on followed immediately by an unrelated refused_json call) against the new code,
  in combat.rs, then reverted the same way (copy-aside + md5sum-verified copy-back). Both
  flagged sites now show both accepted shapes, with no single wrong guess:

  combat.rs:152: request_attack — not the canonical refusal (violates conjunct(s) [1, 3] of refusal_shape_faults). The accepted shape is one of:
    if let Some(busy) = s.command.request_attack(..).refused(MSG) { return busy; } // handler returns (StatusCode, String)
    if let Some(busy) = s.command.request_attack(..).refused_json(json!({ .. })) { return busy; } // handler returns Response
  combat.rs:153: request_consider — not the canonical refusal (violates conjunct(s) [1, 3] of refusal_shape_faults). The accepted shape is one of:
    if let Some(busy) = s.command.request_consider(..).refused(MSG) { return busy; } // handler returns (StatusCode, String)
    if let Some(busy) = s.command.request_consider(..).refused_json(json!({ .. })) { return busy; } // handler returns Response
  

  (request_consider is flagged too, spuriously, only because the missing ; makes the scanner
  treat it as part of the same malformed statement — expected, given the scanner's known span
  limitation; not a new claim, just the visible effect of the limitation this section is about.)

The N4 non-blocking note below (the .. placeholder parsing as Rust but not typechecking) still
applies to both shapes as printed; unchanged.

(Non-blocking N4, not fixed: the .. placeholder in the suggested snippet parses as Rust — a range
expression — and then fails to typecheck, so it still reads as paste-ready code when it is not. This
matches the pre-existing convention in this module's other doc comments; left as-is since fixing it
was not requested and touches a different part of the message.)

Two more false claims in round 1's own body (B4), and three non-blocking notes (N1–N3)

Round 1's body itself asserted two things that turned out false when actually checked, both
independent of the code changes above:

1. It said the jump from 49 to 50 test result: blocks was "expected, since two commits landed on
   main after the PR merged." Measured directly (see item 2 above): b0246bc itself already emits
   50 blocks, with the identical 37+13 split. The two post-merge commits explain nothing here — that
   was a mechanism reasoned backwards to reconcile two numbers, not one actually traced.
2. It said "only the line numbers moved... e.g. the lifecycle.rs write and the nav.rs writes are
   each a handful of lines later than the issue cites." Also false: lifecycle.rs's write and both
   social.rs writes sit on exactly the lines the issue cites; only nav.rs's three writes moved,
   and they moved by twenty lines, not "a handful." The table had also silently switched from citing
   the issue's write lines to declaration lines without saying so; item 1 above restates the
   table on write lines to match the issue's own convention.

Both are corrected in the item sections above rather than left standing. Non-blocking, addressed
here rather than filed further: the 1575/0/45 correction appended to #758 previously said "dated"
without containing a date — it now carries one; the run measured at b0246bc is at that commit
alone, no other commits present, so the earlier ambiguity about "current main plus this PR's own
commit" does not apply to it. (CLEARED by round 3's independent review — re-derived and matches; no
further change made this round.)

What was NOT measured (or re-measured) this round

• Round 2's b0246bc figures (1628/0/45, the 50-block/37+13 split) were not re-run a third time —
  they are unrelated to B1/B2, and the reviewer independently re-measured 6bfc5c2 this round with
  its own figures (1633 passed + 0 failed + 45 ignored, 50 blocks, 0 non-canonical, 15 all-zero),
  which is a fresh independent measurement, not a rerun of this PR's own.
• The reflow-mutation proof underlying B2 was not re-run a third time on this branch — the
  reviewer's own fresh reproduction this round (46 passed; 0 failed) already re-confirmed it
  independently; re-deriving it again on an unchanged code path would not add information.
• The provenance of how the original false clauses were written in the first place — not
  re-investigated, since it is not load-bearing for this fix.
• No live client run — this PR touches only doc comments, one struct field, one extracted function,
  and one assert-message string; there is no new observable runtime behaviour to exercise end-to-end.
• Every rbuild run behind the claims in this body was judged by log content (test result: lines,
  absence of error[/error:/FAILED), never by exit code alone, per the known hazard that
  rbuild can exit 0 on a run that failed to compile.

[djhenry]

Independent review — REQUEST CHANGES

Reviewed at head be5fa1a in my own detached worktree, plus two further worktrees for mutations and
for a run at b0246bc. I did not write this change and did not work in the author's worktree.

Four blocking findings. Three are false claims left standing in prose (the pattern this PR was filed
to fix); one is a failure message that instructs the reader to write code that does not compile.

---

BLOCKING

B1 — the new assert message names one accepted spelling, the guard accepts two, and the one it names does not compile at five real call sites

refusal_shape_faults's conjunct 2 accepts either .refused( or .refused_json(. Five
refusal sites in this crate use refused_json — two in merchant.rs, one in interact.rs, two in
combat.rs — because their handlers return Response rather than (StatusCode, String).

Reproduced the author's mutation myself (rewrote the attack-on handler's refusal to an equivalent
match) and added a second mutation on a refused_json site (the target-by-name handler), one
run, real output:

these HTTP handlers call a refusable CommandState::request_* and throw away the refusal, so a dropped command is still answered 200 (#347 step 2):
  combat.rs:134: request_target — not the canonical refusal (violates conjunct(s) [1, 3] of refusal_shape_faults). The one accepted spelling is:
    if let Some(busy) = s.command.request_target(..).refused(MSG) { return busy; }
  combat.rs:152: request_attack — not the canonical refusal (violates conjunct(s) [1, 3] of refusal_shape_faults). The one accepted spelling is:
    if let Some(busy) = s.command.request_attack(..).refused(MSG) { return busy; }
test result: FAILED. 0 passed; 1 failed; 0 ignored; 0 measured; 244 filtered out; finished in 1.43s

The request_attack line matches the author's captured output exactly, so item 3's reproduction is
confirmed. The request_target line is the defect. I then applied that suggestion literally at the
site it names, with the placeholders filled in as any reader would fill them:

error[E0308]: mismatched types
   --> crates/eqoxide-http/src/combat.rs:134:94
    |
122 | ) -> Response {
    |      -------- expected `Response<axum::body::Body>` because of return type
...
134 |             if let Some(busy) = s.command.request_target(m.id).refused(BUSY_TARGET) { return busy; }
    |                                                                                              ^^^^ expected `Response<Body>`, found `(StatusCode, String)`

So on a fifth of the crate's refusal sites the message hands the developer a non-compiling fix and
calls it "the one accepted spelling" — a confident falsehood in the exact artifact item 3 exists to
improve, and one that costs the reader a compile cycle plus a wrong mental model of what the guard
requires. The pre-existing doc comment on refusal_shape_faults uses the same loose phrase, but it
sits inches from the predicate that contradicts it; substituting a concrete method name into a
runtime failure string turns a loose gloss into a specific, actionable, wrong instruction.

Fix: say "accepted shape" rather than "the one accepted spelling", and either name both terminators
or pick the one that matches the offending handler.

B2 — the deletion is incomplete: the surviving sentence still asserts what the issue falsified

The clause is gone, but the sentence it hung off still reads that the static rule is a redundant
early-warning on top of the behavioural test, in the same breath as naming the newly-added blind
write. And the paragraph still opens by saying the eqoxide-http argument — the guard was the ONLY
thing standing behind those call sites, so a formatting change could delete a check — does not
transfer here. Measured against the tree, it transfers exactly.

I demonstrated it rather than reasoned it. In a scratch worktree I added a newly added,
un-annotated blind command-slot write to a domain module, wrapped across lines the way rustfmt
wraps a long receiver chain, and ran the crate:

    Finished `test` profile [unoptimized + debuginfo] target(s) in 5m 32s
test result: ok. 46 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.30s

Green. The static guard never enumerated it (its first predicate anchors on *self. at the start of
the trimmed line, and the reflow puts *self alone on its own line), and the behavioural universal
never saw it either, because a blind writer does not return bool and so is not in the coverage set.
Nothing caught it. That is the definition of not redundant: for the blind-write class this static
rule is the sole defence, and a reflow removes it.

So the cut removed the sentence's tail and left its head making the same claim. This is the failure
mode the deletion was chosen to avoid. The issue's own suggested replacement covers precisely this;
if the objection to it is that a replacement clause re-instantiates the finding, then the honest
alternative is to delete further — through the "redundant … on top of it" characterisation and the
"that argument does not transfer here" framing — not to stop halfway.

B3 — "there is no way to retroactively verify it now" is false, and the truth is 53 tests away from the figure

Both the block appended to #758 and this PR's body rest on that sentence. b0246bc is an immutable,
reachable commit; a worktree at it plus one workspace run answers the question directly. I ran it:

    Finished `test` profile [unoptimized + debuginfo] target(s) in 28m 55s

• 50 test result: lines; expected 50 (37 Running binaries + 13 Doc-tests targets)
• 0 non-canonical (none spliced, truncated, or missing a count); 15 all-zero lines, reported separately
• 1628 passed + 0 failed + 45 ignored + 0 filtered = 1673 ✅
• no error: and no panicked at anywhere in the log

So the workspace total at the merged head is 1628 / 0 / 45, not 1575 / 0 / 45. The reasoned
prediction in #758 — "the round-3 commit adds and removes no test function, so the total should be
unchanged" — was not merely unmeasured, it was wrong by 53 passed tests, and wrong for a reason
the reasoning never had in view: 1575 was measured on the round-2 branch head, while b0246bc is
a squash onto a main that had itself moved. The whole argument turned on the diff between two
commits and ignored the base.

That is also why the substitution is not defensible. The proximity argument ("main had advanced
only 2 commits, so a fresh run was still close to apples-to-apples") is itself reasoned, not
measured, and the run was on this PR's branch, which carries its own commit on top. The issue offered
two dispositions; the measurable one was available the entire time. Please replace the appended block
with the b0246bc figure above (or take disposition 2 and delete the bold total), and delete the
"no way to retroactively verify" sentence.

B4 — two false claims in this PR's own body

Both are live artifacts under the same ruling this PR invokes.

1. "50 test result: lines (one more block than the PR body's historical count of 49 — expected,
   since two commits landed on main after the PR merged)." Measured: b0246bc itself already
   emits 50 blocks, with the identical 37 + 13 split. The extra block did not come from the two
   post-merge commits. This is a mechanism reasoned backwards to reconcile two numbers.
2. "only the line numbers moved … e.g. the lifecycle.rs write and the nav.rs writes are each a
   handful of lines later than the issue cites." Measured at this head: the lifecycle.rs write and
   both social.rs writes sit on exactly the lines the issue cites; only the three nav.rs writes
   moved, and those moved twenty lines. The re-measured table quietly switched from the issue's
   write lines to declaration lines, and the example chosen to illustrate the shift is one that
   did not shift — in the author's own numbering it moved the other way.

---

NON-BLOCKING

N1 — the correction block is not dated. This PR's body says it appended "a dated correction". The
block is headed **Update (#770).** and contains no date; the fetched body has zero occurrences of
the year. Either date it or drop the word.

N2 — the 50-vs-37 question: the orchestrator is right and the author's explanation is invented.
On my run of this head: Running <binary> = 37, Doc-tests <crate> = 13, running N tests
headers = 50, test result: = 50. 37 + 13 = 50, and the same structure holds at b0246bc.
No binary emits multiple result blocks — each emits exactly one running N header and exactly one
test result:. The gap is the doc-test targets (twelve crates plus the root package), which cargo
announces with Doc-tests, not Running. The correct cross-check for test result: is the
running N header count, or Running + Doc-tests. Non-blocking only because this explanation is
absent from the PR body and from the #758 block, which correctly claims nothing more than that every
expected crate's unittest binary appears in the Running list.

N3 — scope of the #758 block's run. It says "on a branch built from current main". It was
main plus this PR's own unmerged commit. Doc-only, so the number is unaffected, but state it.

N4 — the .. placeholder. request_attack(..) parses as Rust (.. is a range expression) and
then fails to typecheck, so it reads as code and is not. On its own this matches the convention
already used in the surrounding doc comments and I would not block on it; combined with B1 it is what
makes the message look paste-ready when it is not.

---

Attacked and found nothing

• The blind-write table. Re-derived independently from the sources at this head rather than
  copied. Six methods, seven write lines: the camp toggle in lifecycle.rs (returns unit); goto,
  follow and zone-cross in nav.rs (each returns the goal id, u64); and the two who-request
  registrations in social.rs (both return unit). Not one returns bool, so not one is in the
  coverage set. Complete: the only other slot mutations in the crate are the respawn flag (a bool,
  not an Option slot), the chat queue (a push, not an overwrite), and nav's deliberate = None
  cancels, which the module doc already scopes out.
• The two-rows-into-one collapse. A real merge, not a lost row: the follow method contains two
  adjacent writes (target and entity) and the table is keyed by method signature.
• declared_no_overwrite_requests. Confirmed by reading it: it scans the crate's own src/*.rs,
  keys on a pub fn request_ line prefix, accumulates the signature to the opening brace so
  multi-line *_await signatures are handled, and keeps those containing -> bool.
• The author's restore of the mutated combat handler. My own copy of the pristine file hashes to
  the same md5 the author reported, so the restore is independently confirmed, and the file is clean
  in git.
• This head's total. I reproduce the author's 1633 / 0 / 45 / 0 = 1678 exactly.
• Merge-order interaction with fix(#731): observe the asset-server login, so a hung login stops reading as an idle client (supersedes #743) #755. None. That PR's diff contains no s.command.request_ call
  site, no refused/refused_json, and does not touch the guard or its site floor; it adds GET-side
  observability only. The floor is a lower bound, so new canonical sites cannot turn it red. Nothing
  in fix(#661): the qcat pocket swimmer escapes — floaters never enter the depenetration net, and a blocked swimmer can duck UNDER an obstruction #767, fix(#768,#769): ground a static model ON its stored z, not a model height above it #773 or fix(#766): retire nav_local with the goal — a zone change no longer publishes the previous zone's fine-tier verdict #774 touches this guard either.

---

Verification figures

Run A — PR head be5fa1a, full workspace, --locked --no-fail-fast

• Finished \test` profile [unoptimized + debuginfo] target(s) in 29m 12s`
• 50 test result: lines — expected 50 (37 Running + 13 Doc-tests, cross-checked against
  50 running N tests headers)
• 0 non-canonical (none spliced, truncated, or missing a count) · 15 all-zero lines, reported
  separately as benign empty targets
• 1633 passed + 0 failed + 45 ignored + 0 filtered = 1678 ✅
• no error: / panicked at in the log

Run B — b0246bc, same invocation (the run this PR says is impossible)

• Finished \test` profile [unoptimized + debuginfo] target(s) in 28m 55s`
• 50 test result: lines — expected 50 (37 + 13; 50 running N tests headers)
• 0 non-canonical · 15 all-zero
• 1628 passed + 0 failed + 45 ignored + 0 filtered = 1673 ✅
• no error: / panicked at in the log

Limit of the standard: these equalities show arithmetic consistency, not completeness. A
wholly lost test binary drops its running N header and its summary together and the equality still
holds.

Difference between the two runs is accounted for. Head minus merged head is +5 passed, and it
localises to the four crates the intervening nav-goal retirement commit touches — nav +2, and one
each in command, http and net. The doc-only steering commit and this PR add no tests. Nothing
unaccounted.

Mutation runs. The refusal-guard mutation is quoted under B1; the reflowed-blind-write mutation
under B2. Both were applied in throwaway worktrees, never in the shared checkout, and reverted by
copy-back with md5 re-verified and git status clean.

No live client was run: this change is a doc comment and an assertion string, with no new observable
runtime behaviour to exercise.

[djhenry]

Independent review, round 2 — head 6bfc5c2, base main 44003f7 (Closes #770)

I did not write this change. I re-reviewed the whole head, not the round-1→round-2 delta, and I tried to break it rather than to confirm it. Three blocking findings, two of them new, one a re-statement of round 2's own subject. One item I was asked to treat as potentially blocking — the edit to already-merged #758 — is cleared by measurement.

Round 1's two code defects are genuinely fixed: the hardcoded .refused(MSG) is gone, and the two false claims in the PR body are retracted. The problem is that the fix for the first one introduced a new universal, and it is false for the same reason the old one was.

---

B1 (BLOCKING) — the per-site terminator echo is untested, and its "guaranteed to compile" claim is false

(a) The code the PR adds is never executed by any test.

terminator and the shape construction live inside the else arm at guild.rs:586-609 — the arm reached only when !canonical. On a clean tree offenders must be empty, so that arm is dead code: a green run of every_refusable_command_request_is_checked_by_its_http_caller proves the 38 sites are canonical and proves nothing about the terminator plumbing. And no other test asserts on the field — terminator appears at guild.rs:331,337,370,381,581,595 and in {site:?} failure text, never in an assertion.

So this claim in the PR body is not supported by the run it cites:

the plumbing agrees with canonical() on every real call site in the crate, including the refused_json ones, not only the two sites mutated

A 3 passed; 0 failed module run cannot establish that. The module test at guild.rs:496-513 compares faults against a table and cross-checks canonical() against faults; it never builds a shape and never looks at terminator.

(b) "Guaranteed to typecheck" is falsified by construction.

guild.rs:589-591:

echo that one back (it is guaranteed to typecheck, since it is the terminator the handler already calls)

and the PR body:

it is guaranteed to compile, because it is exactly the terminator the flagged handler already calls

terminator records what is in the scanner's statement span, not what the flagged call uses. refusal_sites ends a statement at the first ; after the opening brace when a brace precedes the next ; — so when the offending form's block contains no ;, the span runs on into the following statement and picks up its terminator.

Mutation (applied in my own worktree at 6bfc5c2, reverted after, md5-verified):

match s.command.request_attack(true).refused(BUSY_ATTACK) { Some(busy) => return busy, None => () }
let _ = s.command.request_consider(0).refused_json(serde_json::json!({ "status": "refused" }));

Measured output:

combat.rs:152: request_attack — not the canonical refusal (violates conjunct(s) [1, 3] of
  refusal_shape_faults). The accepted shape is:
    if let Some(busy) = s.command.request_attack(..).refused_json(MSG) { return busy; }

combat.rs:152 calls .refused(, not .refused_json(, and its handler post_attack_on returns (StatusCode, String). Applying the printed line literally — which is the entire purpose of printing it — does not compile. cargo check -p eqoxide-http --locked, on the message's own suggestion:

error[E0308]: mismatched types
   --> crates/eqoxide-http/src/combat.rs:101:67
    |    ... .refused_json(BUSY_TARGET) ...   expected `Value`, found `&str`
error[E0308]: mismatched types
   --> crates/eqoxide-http/src/combat.rs:101:89
 86 | ) -> (StatusCode, String) {
    |      -------------------- expected `(StatusCode, std::string::String)` because of return type
101 | ... { return busy; }
    |              ^^^^ expected `(StatusCode, String)`, found `Response<Body>`
error: could not compile `eqoxide-http` (lib) due to 3 previous errors

This is round 1's defect reproduced at round 2's head: a suggestion that reads fine and does not build.

The trigger is not exotic. Conjunct 3 tests for { return busy;. Omitting that one semicolon — a single character, and one of the three things the guard exists to flag — extends the span into the next statement. If the next statement uses the other terminator, the message names the wrong one. During a refused → refused_json migration, adjacent mixed-terminator sites are the normal case.

Cheapest honest fixes, in order of preference:

1. Always print both shapes (the existing None arm, with its // if the handler returns … hints) and delete the guarantee sentence. Costs one line of message width, removes an unbacked universal, and is correct at every site.
2. Keep the echo, but say what it actually is: "the terminator found in this site's scanned statement span — verify against the handler's return type, the span can over-run the flagged call."
3. Fix the span computation. That is a behaviour change and does not belong in a docs PR.

Whichever you choose, if the branch stays it needs a test that reaches it. A snippet-level test over refusal_sites asserting terminator on a mixed-terminator pair would have caught this in seconds — including the case above.

---

B2 (BLOCKING) — the paragraph does not close on the issue's sentence, and the body says it does

PR body:

now closes on the issue's own accepted-limit sentence, unchanged: "this static rule is the only defence for a blind write, and that is an accepted limit, not a backstopped one."

Issue #770's sentence:

so for a blind write this static rule is the only defence and a reflow does cost it. That is an accepted limit, not a backstopped one.

The clause "and a reflow does cost it" was dropped, in the one paragraph whose entire subject is reflow — and the body asserts the quote is unchanged. #770 states the same point in its own voice at another line: "a reflow costs not a line but the only defence there is."

I re-ran the reflow construction against this head. New method in lifecycle.rs, no LAST-WINS annotation, wrapped exactly as rustfmt wraps a long receiver chain:

pub fn request_reviewer_r2_blind(&self, cmd: CampCmd) {
    *self
        .lifecycle
        .camp
        .lock()
        .unwrap() = Some(cmd);
}

test slot::tests::no_domain_module_blind_writes_a_command_slot ... ok
test slot::tests::every_no_overwrite_request_refuses_a_second_write ... ok
test result: ok. 46 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 1.18s

Green. The guard is per-line with code.starts_with("*self.") (slot.rs:180-185), so the wrapped write never matches, and nothing else in the crate covers it.

The round-1 deletion is now complete and the surviving text is not false — I checked every clause. "That argument does not transfer here" and "a redundant early-warning on top of it" are both gone; grep -i 'reflow\|formatting\|wrap' over slot.rs returns only :154 and :156, and both are about eqoxide-http's guard, not this one. The -> bool coverage-set claim is accurate (declared_no_overwrite_requests, slot.rs:250, filters on -> bool).

What is left is a paragraph that explains why the other guard could not stay line-based, states that this one did, and then never says what that costs — while the body claims it quoted the sentence that says exactly that. Restore the clause.

---

CLEARED — the gh pr edit 758 on an already-merged PR

You were right to flag this; it is the kind of thing no CI check catches. It is clean, and I can prove the non-destructive part because I snapshotted that body in round 1 before the edit existed.

Diffing my round-1 snapshot against the live body: one hunk changed (the #770 correction block), plus one trailing newline. Nothing else in the ~450-line body was altered, reordered, or truncated — every table, figure and mutation row is byte-identical.

• Accurate: the new block reports b0246bc measured at b0246bc, in a detached worktree at that commit. 1628 + 0 + 45 + 0 = 1673.
• Marked as a later correction: headed **Update (#770), 2026-07-28.**, and it explicitly retracts its own earlier version rather than quietly replacing it — "An earlier version of this correction compounded the same defect… claimed there was 'no way to retroactively verify' the figure at b0246bc itself — false, since b0246bc is an immutable, reachable commit." It is not presented as what was originally written.
• No local detail: scanned for paths, hosts, IPs, ports and account names. Clean.

On whether the exact agreement with my 1673 is genuine: I measured 1628 / 0 / 45 / 1673 at b0246bc first and independently, before the author's block existed, so the figure's correctness does not rest on their run. Exact agreement is the expected outcome of two correct runs of a deterministic suite — it is not by itself evidence of independence, and I would not have accepted it as such. The differing wall clock (20m 22s vs my 28m 55s) is weak positive evidence of a separate real run. Either way the number stands on my measurement.

---

CLEARED — B4, the line table

Re-derived at 6bfc5c2 from the sources, not from the body. Writes: lifecycle.rs:30, social.rs:26, social.rs:33, nav.rs:190/200/201/257 — 7 write lines across 6 methods, none returning bool. Declarations: lifecycle.rs:26, social.rs:22, social.rs:31, nav.rs:186/198/254. Matches the body. Round 1's two false body claims (the "50 vs 49" arithmetic and the lifecycle.rs line-drift example) are correctly retracted.

---

Verification figures — full workspace at 6bfc5c2, --locked --no-fail-fast

Finished `test` profile [unoptimized + debuginfo] target(s) in 60m 56s	present
test result: lines	50 — expected 50 (37 Running binaries + 13 Doc-tests targets)
running N tests headers	50, and every header's N equals its block's passed+failed+ignored (0 mismatches)
non-canonical result lines (spliced/truncated/missing a count)	0
all-zero blocks (benign empty targets)	15
totals	1633 passed + 0 failed + 45 ignored + 0 filtered = 1678, equal to the sum of the header Ns
error: / panicked at	none

What that does and does not establish. The equality is internal consistency, not completeness. It does catch a binary lost mid-run — that binary prints running N and never prints a summary, so the counts diverge. It does not catch a binary that was never enumerated at all, which is why the Running list is checked against the expected target set separately. (The corresponding sentence now sitting in #758 — "a wholly lost test binary would drop its running N header and its summary together" — understates the check; that wording is mine, from round 1, and I own it. Worth tightening there when someone is next in that body; not blocking on this PR.)

Process note, since it bit me here: rbuild exited 0 on the run whose output was error: could not compile eqoxide-http (lib) due to 3 previous errors. Judge the log, never the exit code.

---

Merge order

#775 touches crates/eqoxide-command/src/slot.rs and crates/eqoxide-http/src/guild.rs, and changes no behaviour — doc text plus one assert message.

• fix(#731): observe the asset-server login, so a hung login stops reading as an idle client (supersedes #743) #755 — no shared file, and no added line matches command.request_ or the blind-write predicate. Disjoint.
• fix(#768,#769): ground a static model ON its stored z, not a model height above it #773 — renderer crate only. Disjoint.
• fix(#766): retire nav_local with the goal — a zone change no longer publishes the previous zone's fine-tier verdict #774 — touches crates/eqoxide-command/src/nav.rs, which both slot.rs guards scan. Its one added = Some(..) write is *nav.goto_target… in a test, which the *self.-anchored predicate does not match, and it adds no pub fn request_*. slot.rs cites no line numbers, so nothing there goes stale. Disjoint.
• fix(#760): pin the health clock in test fixtures so a handler's HTTP status cannot depend on machine load #778 — same crate as guild.rs but a different file; its combat.rs changes are test-only additions and touch no refusal site. CANONICAL_SITES is a >= lower bound, so added canonical sites cannot turn it red. Disjoint.

#775 → #774 → #778 is fine on these grounds. Whoever lands second re-runs the workspace on the merged tree.

---

Verdict

Request changes. I could break it, so I am not giving you a squash message. Two of the three blocking items are one-line fixes:

1. B1 — drop the "guaranteed to typecheck" / "guaranteed to compile" claim (code comment and body). Either always print both shapes, or describe the echo as the span's terminator rather than the call's. If the branch stays, give it a test that reaches it.
2. B2 — restore "and a reflow does cost it", and fix the body's "unchanged".
3. B1(a) — drop the body's claim that the module run confirms the plumbing at every real site; it cannot.

Nit (non-blocking): the MSG placeholder means &'static str in the .refused( shape and serde_json::Value in the .refused_json( one. Applied literally at a genuine .refused_json( site with a message constant it is error[E0308]: expected 'Value', found '&str' — measured. If the shapes are printed side by side, spell the json one refused_json(json!({ … })).

Mutations were applied only in my own worktrees at the PR head and reverted by md5-verified copy-back; the shared checkout and the author's worktree were never touched.

[djhenry]

Independent review, round 3 — head 6c9b4e6 (Closes #770)

I did not write this change. I reviewed the whole head, not the round-2→round-3 delta, and I tried to break it — specifically hunting for a third instance of this PR's recurring defect: a printed suggestion that reads fine and does not compile.

APPROVED. I could not break it. Hand-written squash message at the bottom.

Three non-blocking notes, none of which changes that. I have separated what I measured, what I verified by inspection, and what I am taking on the author's word.

---

B1 — the deletion is real, complete, and not relocated

I grepped the concept, not the field name, across every .rs and .md in the workspace: terminator, "which one/shape", "echo(es) back", "guaranteed to compile/typecheck". Every surviving hit in guild.rs is prose about why the field must not come back (:344-353, :386-390) or the new test's anti-vacuity comment (:580-581). Zero live logic. No relocation into refusal_sites, refusal_shape_faults, the route-coverage test, or any other crate.

I also checked for the defect class rather than the instance — grep -rniE 'accepted shape|the accepted (spelling|form)|canonical shape is' over crates/ src/ tests/. offender_message is the only suggestion-printer in the workspace. There is no third instance hiding elsewhere.

refusal_shape_faults's conjunct 2 (guild.rs:317) and the route test's refuses closure (guild.rs:711) still test .refused( or .refused_json( — correctly, since those are booleans over "is either present", not inferences about which.

The decisive measurement — my own adversarial construction, re-run at this head. Same mutation as round 2: an un-terminated match in post_attack_on (no ; inside the block) followed immediately by an unrelated .refused_json( statement.

combat.rs:155: request_attack — not the canonical refusal (violates conjunct(s) [1, 3] of refusal_shape_faults). The accepted shape is one of:
    if let Some(busy) = s.command.request_attack(..).refused(MSG) { return busy; } // handler returns (StatusCode, String)
    if let Some(busy) = s.command.request_attack(..).refused_json(json!({ .. })) { return busy; } // handler returns Response
  combat.rs:156: request_consider — not the canonical refusal ... The accepted shape is one of:
    ... both shapes, same as above ...

test result: FAILED. 3 passed; 1 failed; 0 ignored; 0 measured; 242 filtered out; finished in 0.20s

On exactly the input that broke round 2, the message now makes no wrong single guess. Both shapes, each labelled with the handler return type it applies to — and those labels are correct against refusal.rs:91 (fn refused(self, msg: &'static str) -> Option<(StatusCode, String)>) and refusal.rs:97 (fn refused_json(self, body: serde_json::Value) -> Option<Response>). The word "guarantee" is gone. offender_message_names_both_accepted_shapes passed in the same run.

B1 is closed by measurement, not by argument.

B1's dead-code half — the body claims slightly more than it has (non-blocking)

You asked me to attack the "not dead" claim directly. It does not survive as written in the body, though it does in the source.

The else arm of every_refusable_command_request_is_checked_by_its_http_caller is still executed zero times by the suite on a canonical tree. Extracting offender_message makes the function live; it does not make the arm live. The tracked comment at guild.rs:561-566 says this precisely and honestly — it states outright that the branch is never reached and that direct calling is what provides the coverage. The PR body (line 146) says extraction "is what makes the branch not-dead", which is a step further than the source claims and than is true. It also sits two paragraphs after the body's own correct statement that the branch "is dead code on this (canonical) tree."

The residual uncovered surface this leaves is real but small: the call at guild.rs:633 is offender_message(&file, line, &name, &faults), and file/name are both string-ish, so transposing them compiles and yields a garbled message that no committed test would catch. I verified that wiring end to end myself — the run above printed the right filename, the right names, and lines 155/156, which are exactly the two lines my mutation occupies. So the claim's substance is fine; only its attribution is loose. One-word fix in the body: "makes the message not-dead."

B2 — restored, and the "not re-measured" reasoning holds by measurement

slot.rs again states the reflow cost, with the measured detail attached. I did not take "unchanged code path" on trust — I measured it: git diff 6bfc5c2 6c9b4e6 -- crates/eqoxide-command/src/slot.rs touches 8 lines, 0 of them non-doc. The guard body is byte-identical to the tree where I measured a wrapped, un-annotated blind write passing 46 passed; 0 failed. The proof therefore transfers by construction and a third run would have added nothing. The author's reasoning here is correct.

The restored sentence's mechanism — "the wrap breaks this rule's *self. anchor and a blind writer was never in the behavioural universal's coverage set to begin with" — matches the code: slot.rs:184 anchors on code.starts_with("*self.") per line, and declared_no_overwrite_requests (slot.rs:250) filters on -> bool.

PR body — corrections are inline, and no round-2 sentence stands uncorrected

I read the rendered body, not the diff. All three retracted round-2 claims survive only inside explicit correction framing: the "unchanged" quote at line 25 is quoted as the thing being corrected; "guaranteed to compile" at line 92 is under "Round 2's fix (superseded — see the correction below)"; the canonical()-plumbing claim at line 110 is immediately followed by "this claim is retracted below; it was unsupported." No round-3 correction contradicts a sentence still standing elsewhere. Hand-scanned for local paths, hosts, IPs, ports and account names — clean (and worth noting check-no-local-detail.sh never sees a PR body, so CI green is not evidence here).

---

Verification figures — full workspace at 6c9b4e6, --locked --no-fail-fast

Finished `test` profile [unoptimized + debuginfo] target(s) in 17m 24s	present
test result: lines	50 — expected 50 (37 Running binaries + 13 Doc-tests targets)
running N tests headers	50, and every header's N equals its block's passed+failed+ignored (0 mismatches)
non-canonical (visibly CORRUPT)	0
all-zero (empty targets)	15
totals	1634 passed + 0 failed + 45 ignored + 0 filtered = 1679, equal to the sum of the header Ns
error[/error:/panicked at	0 · 0 FAILED blocks

Re-derived, not quoted: round 2's 6bfc5c2 figure was 1633. The delta is exactly +1, and it is offender_message_names_both_accepted_shapes — independent arithmetic corroboration that this round adds one test and changes nothing else that executes.

CI on the head: test SUCCESS, no-local-detail SUCCESS.

Merge with current main (3d60bfd, i.e. #773 already landed)

Verified rather than assumed. git merge-tree --write-tree 3d60bfd 6c9b4e6 produces a clean tree, no conflict. That merged tree differs from this PR's head in exactly four files, all of them #773's renderer files, and the blobs for slot.rs, guild.rs and combat.rs are identical between the merged tree and the head. Neither guard can see the renderer: guild.rs scans crates/eqoxide-http/src/ and slot.rs scans its own CARGO_MANIFEST_DIR/src. Disjoint in files and in behaviour. #775 → #774 → #778 still holds; the next lander re-runs the workspace on the merged tree.

---

Non-blocking

N-A — the closest thing to a third instance, and the one I'd take. The printed json shape is refused_json(json!({ .. })), unqualified. serde_json::json is imported nowhere in eqoxide-http, and all eight real .refused_json( call sites in the crate write serde_json::json!(…). So even after a reader fills the placeholders, that line needs a use the surrounding module does not have. It is a rustc one-liner with a fix-it, not a type puzzle, and it does not misname the API the way rounds 1–2 did — and the body's own N4 already discloses that the snippet is not paste-ready — so I am not blocking on it. Costs one token to make it match every existing site verbatim: serde_json::json!({ .. }) (and the pinned string in offender_message_names_both_accepted_shapes alongside it).

N-B — "the branch not-dead", above. One word in the body.

N-C — the round-3 correction re-quotes #770 inexactly. The body renders it as "…this static rule is the only defence for a blind write, and a reflow does cost it, and that is an accepted limit…". #770 actually reads "…so for a blind write this static rule is the only defence and a reflow does cost it. That is an accepted limit, not a backstopped one." Same meaning; different word order and sentence split, inside quotation marks introduced by "the issue reads". I weighed this against the standing bar and it does not block: the clause at issue is correctly restored to slot.rs, and no behavioural claim turns on it. But in a correction whose entire subject is a clause dropped from a quotation, the quotation should be exact.

---

What I measured · verified by inspection · took on the author's word

Measured myself, this round, at 6c9b4e6: the adversarial span-bleed re-run and its full offender text; the argument wiring of the !canonical arm; the workspace figures; the +1 test delta; the concept-grep for relocation; the absence of any other suggestion-printer; that slot.rs's guard code is byte-identical to where the reflow proof was taken; the clean merge against 3d60bfd and its exact file delta; serde_json::json's absence from the crate; the PR body's local-detail scan; CI's two green checks.

Verified by inspection rather than execution: the RED direction. I did not run the author's reverted-to-round-2 mutation. I do not need to — the new test asserts the message text by exact equality and asserts msg.contains(".refused_json(json!({ .. }))") and !msg.to_lowercase().contains("guarantee"). The round-2 design emitted a single shape and could not satisfy any of the three. It is unrepresentable for round 2's message to pass this test.

Taken on the author's word: that their own mutations were reverted by md5-verified copy-back and left git diff --stat empty. I did not inspect their worktree — but my own independent run at the pushed head is green with the expected +1, which is the outcome that matters, and the pushed tree is what merges.

Not attempted: any live client run. Correct call — this PR adds no runtime behaviour.

---

Squash message — hand-written

Deliberately not a concatenation of the three round commits: the default would carry round 2's retracted "guaranteed to typecheck" design into main's history alongside its own retraction. That design was reverted inside this PR and never shipped; the log should record the change that landed, with the trap noted once so nobody re-invents it.

Subject

docs(#770): stop guessing which refusal terminator a call site uses; delete slot.rs's false backstop claim (#775)

Body

Two guard comments asserted things that were not true, and one assert message
named an API that does not exist at the site it was printed for.

crates/eqoxide-http/src/guild.rs — the offender message for a non-canonical
refusal used to name ONE accepted spelling. Conjunct 2 accepts two, and they are
not interchangeable: `.refused(` yields `Option<(StatusCode, String)>`,
`.refused_json(` yields `Option<Response>`. Printing the wrong one at a handler
with the other return type produced advice that does not compile. It now prints
both shapes, each labelled with the handler return type it applies to, and
asserts nothing about which one belongs to the flagged site.

It cannot assert that, and the comment on `refusal_sites` now records why so the
field does not come back: the statement span ends at the first `;` AFTER the
opening brace, so a site missing that semicolon — the very malformation conjunct
3 exists to flag — lets the span run into the following statement and adopt its
terminator. An echo of "the terminator this span contains" is therefore not "the
terminator this call site uses". Bounding the span to the offending statement's
own closing brace would fix it and is a behaviour change, deliberately not made
here.

The message text is extracted into `offender_message` so a unit test can pin it
directly. The branch that calls it is unreachable on a canonical tree, which is
how a false claim about it went unnoticed; the test calls the function with
fabricated arguments and fails if the text drifts from either accepted shape or
starts claiming to know which applies.

crates/eqoxide-command/src/slot.rs — the blind-write guard's comment claimed a
behavioural test backstopped it and that eqoxide-http's reflow-coverage argument
did not transfer. Both false, and measured false: a newly added, un-annotated
blind write wrapped across lines the way rustfmt wraps a long receiver chain
passes the crate fully green, because the wrap breaks the `*self.` line anchor
and a blind writer returns `()`, never `bool`, so it was never in the
behavioural universal's coverage set. The comment now says that a reflow does
cost this check, and that this is an accepted limit rather than a backstopped
one.

No runtime behaviour changes. One test added.

[djhenry]

Orchestrator merge-check — re-verified against current main, then merging.

The round-3 review verified the merge against 3d60bfd. main has since moved to 644ba2c (#755 landed). That gap matters more than usual on this PR specifically: refusal_sites' caller does not include_str! a fixed file list — it walks eqoxide-http/src from CARGO_MANIFEST_DIR at runtime (guild.rs:126, :149), so it reads whatever is in that directory when it runs. #755 added 635 lines to observe.rs, inside that directory.

A grep is the wrong evidence for a guard PR, so I built the actual merged tree (6c9b4e6 + origin/main → c53d3a7, tree matching the merge-tree --write-tree prediction) in a throwaway worktree and ran the full workspace, --locked --no-fail-fast:

• Finished \test` profile … in 61m 44s` — 1
• 50 test result: lines against 50 running N headers — 50 expected
• 0 non-canonical (corrupt) · 15 all-zero (empty targets) — separate figures
• 1664 passed + 0 failed + 45 ignored + 0 filtered = 1709 = the header sum (1709), so no binary was lost mid-run
• 0 error lines, 0 failures, 0 panics

main at 644ba2c is 1663 passed. This tree is 1664 — exactly +1, the single test this PR adds. That is independent arithmetic corroboration that #755's growth in a scanned directory arms neither guard, which is the thing the earlier verification could not have covered.

One log artifact worth recording rather than smoothing over: a line-start count of Running/Doc-tests gives 48, not 50. Both missing lines are spliced into passing test … ok lines (eqoxide_renderer-ae0aaf1aefdd94bf and tests/shadow_caster_selection.rs), and counting occurrences anywhere on the line restores 37 Running + 13 Doc-tests = 50. The test result: lines themselves were all canonical. Header-vs-summary parity is what actually catches a lost binary here; the Running line count does not survive cargo's interleaving.

Merging with a hand-written squash subject and body, per the review. Closes #770 added — the review's body omitted it.