v0.9.0 - relocations are verified, deltas are measured
Two fixes to the audit, both found by dogfooding it against a real 59,065-char CLAUDE.md. Closes #7 and #8.
Relocations are now proved, not assumed. A move is two writes - remove from the source, append to the destination - so a failed destination write makes the file smaller, and every size check reads that as success. Shrinking is the failure signature of data loss, which made wc -c structurally incapable of catching the thing it was guarding.
The audit now backs up every file a run removes content from before the first write, then after applying checks that each destination grew by at least the bytes that left (a point probe cannot bound a truncated tail), that distinctive strings picked beforehand now hit their destination, and that they are gone from the source - the inverse failure, where the append lands but the removal does not, otherwise passes silently as an under-delivering estimate. A failure restores that one relocation and reports the loss instead of the size win.
Rewrites that legitimately shorten text in place are classified as compressions and never probed, so a correct edit is not destroyed by a false failure.
Deltas are measured rather than felt. The report format demanded a number 'computed from the diff text' at a stage where no diff exists yet, so every row except index compression was guessed - about 19% optimistic on the real run, which turned a promised one-pass landing into four. Each of the seven tactics now has a stated method built on one principle: the content being removed is always measurable, and the line replacing it is always short enough to draft at report time. Rows whose replacement length was assumed carry a ~, projections are labelled estimates, and converging over two or three passes is documented as expected rather than treated as a failure.
New: scripts/verify.sh is the single local gate - manifest, ASCII, cross-references, and mutation tests that build each data-loss scenario and assert the procedure catches it.