conformance-ct: census-parity scaffolding needs an end state and a cleanup pass

[lann]

The migration-parity apparatus did its M1 job; what remains has no stated end state and several rough edges. Bundle, one area:

• No retirement plan. census_test.rs + the byte-frozen fixtures + plan::ROWS anchor the incumbent corpus. As growth accretes outside ROWS (by design), the protected share decays monotonically while the reading burden (16,433 + 776 frozen fixture lines, a near-duplicate prefix table) is permanent. Decide and record the end state: keep as a frozen historical anchor with a scope note, or retire once assertion-migration confidence is established.
• Inverted sync doc. plan.rs:5-9 claims the lib.rs #[case_row] list and ROWS "cannot drift from each other"; post-freeze they MUST drift (new rows are lib.rs-only). lib.rs has 57 prefixes, ROWS has 55. The census test's failure message ("cases not in census") does not say new rows belong outside ROWS.
• Stale counts. corpus.rs:23 says "55 census rows -> 46 vector-row blobs"; now 57/48 — exactly the machine-computed-counts-in-docs pattern AGENTS.md bans.
• preparsed mode is dead weight. Three corpus modes exist; rkyv ships (justfile/CI), the default JSON mode is structurally needed (the native census tests run under default features), preparsed (postcard) has zero consumers (no recipe, no CI). Its cost: parallel register()/vector_builder impls, the preparsed corpus table, dual-mode build.rs — every algorithm addition pays the parallel-path tax. Recorded reason is "measurement experiment" with no expiry or tracking. Retire it or record what measurement outcome would.
• signing-guest-ct duplication. census_test.rs is a 110-line verbatim copy (including the hand-rolled fixture parser, now maintained twice); plan.rs mirrors PlanCase/Row/ROWS/register. Labeled as mirroring but not as forced; a shared dev-dependency crate looks feasible.
• compare-census.py is expired in-tree tooling. Referenced by no gate; its own rules fail against the current tests.lock (post-cutover [[generated]] rows violate its "prefix covers no census case" check; its hardcoded DECLINES table diverges as declines grow). census_test.rs:6 still points readers at it. Delete or fix.
• build.rs mint-stub guard misattributed. build.rs:22-24 says the stub copy of ecdh_secret_jwk is "kept in sync by the census-parity test" — the census test compares ids/tags only and runs under default features where build.rs exits before blob generation. The real guard is vector execution in rkyv conformance runs (loud but distant, and failures point at ECDH imports, not the stub). Fix the comment; optionally add a direct stub-equality unit test.
• Probe idents stated twice. Each probe fn passes its own name as a string to plan::probe("...") (guest-ct/src/lib.rs, ~59 sites), resolved by a lookup that panics on a miss (plan.rs:336-344). Lock-check and census see only the fn-derived name, so a typo'd string passes both static gates and surfaces as a trap on the first full run. Adjacent to conformance: probe names are unlinked from probe bodies; getter, extractable-false and key-exhausted coverage gaps #84. A macro deriving the string from the ident removes the class.

[lann]

#327 lands the textual items: the inverted plan.rs sync doc (both suites — post-#324 wording: ROWS is the frozen incumbent share, post-cutover rows are lib.rs-only and leaf-pinned by tests.lock), corpus.rs's machine-computed counts, compare-census.py (deleted; the census_test doc line pointing at it now names tests.lock), and the build.rs mint-stub guard attribution (vector execution in rkyv runs, not the census test).

Still open here, each needing a decision rather than a sweep:

• the retirement end state for census_test.rs + the frozen fixtures + plan::ROWS (the protected-share decay argument);
• preparsed-mode retirement or a recorded measurement outcome that would retire it;
• the signing-guest-ct census_test/plan duplication (shared dev-dependency crate);
• the probe-ident macro (string-vs-ident, the trap-on-first-run class).