@woosh/meep-engine 2.168.1 → 2.169.1

package/src/REVIEW_2026_08_06/adv-core.md

@@ -0,0 +1,511 @@
+# Adversarial verification — core reports
+
+Method: throwaway jest specs (`__advcheck_*.spec.js`, run from `H:/git/moh` with
+`node_modules/.bin/jest --config jest.conf.json`, since deleted) plus direct source reading.
+Note: asserts ARE live under the jest harness (verified — `BIN-5` threw an assert error), so any
+finding whose only manifestation is an assert throw was checked for the production behaviour
+separately.
+
+Scope checked: all 13 CRITICALs, plus every MAJOR asserting "never / always / cannot".
+No finding was refuted outright. Six are downgraded for severity inflation.
+
+---
+
+## core-collection
+
+### COLL-1
+- **Verdict**: CONFIRMED-BUT-DOWNGRADED
+- **Corrected severity**: MAJOR
+- **Evidence**: Ran the exact scenario. `p.output.asArray()` → `[5,7,4,1,3]` (expected `[1,3,4,5,7]`).
+  `binarySearchLowIndex` (`core/collection/array/binarySearchLowIndex.js`) is self-documented as
+  returning "index of the largest element <= el … or -1"; `handleAddition` passes that straight to
+  `List.insert`. `List.insert(-1, el)` reaches the `else` branch → `splice(-1,0,el)`. All as claimed.
+- **Reason for downgrade**: ground 5. The class has **zero** real consumers in the repo — the single
+  grep hit (`engine/network/time/JitterBuffer.js:65`) is a *comment* referencing the pattern, not an
+  import. Nothing shipped is affected; this is a wholly broken public-API class, not a live defect.
+
+### COLL-2
+- **Verdict**: CONFIRMED-BUT-DOWNGRADED
+- **Corrected severity**: MAJOR
+- **Evidence**: `m.set('a',1)` then `m.get('a') === undefined`, `m.getValueByKey('a') === undefined`,
+  `m.getKeyByValue(1) === undefined` — all measured. Swapped usage works: `m.getKeyByValue('a') === 1`,
+  `m.getValueByKey(1) === 'a'`. The JSDoc field types (`forward: Map<K,V>`, `backward: Map<V,K>`) and
+  `add(key, value)` param names are indeed inverted relative to the writes.
+- **Reason for downgrade**: ground 5. This is a **naming/JSDoc inversion**, not data loss: the map is
+  fully self-consistent under `add(value, key)`, nothing is dropped, and the sole in-repo consumer
+  (`core/binary/EncodingBinaryBuffer.js`) already calls it in the working orientation. Note that
+  core-binary.md's own "found sound" list states the BiMap orientation "is self-consistent in both
+  directions" — the two reports agree on the facts and disagree only on framing. "Every accessor
+  returns `undefined`" is true only for documented-name usage.
+
+### COLL-3
+- **Verdict**: CONFIRMED-BUT-DOWNGRADED
+- **Corrected severity**: MAJOR
+- **Evidence**: `a.merge(b); m.add((...args)=>…); a.send1(42)` → handler received `[{ '0': 42 }]`
+  (one element, an `arguments` object). `Signal.dispatch(...args)` is variadic (`Signal.js:328`), so
+  `result.dispatch(arguments)` genuinely lands the whole arguments object in `args[0]`.
+- **Reason for downgrade**: ground 5. `Signal.prototype.merge` has no in-repo caller
+  (`grep '\.merge('` finds only unrelated `merge()` methods). Total break of an unused public method.
+
+### COLL-4
+- **Verdict**: CONFIRMED
+- **Evidence**: `new Deque().removeFirst()` → `undefined`, then `isEmpty() === false`, `size() === 15`.
+  `removeFirst`'s JSDoc is `@returns {T|undefined}`, so calling it on an empty deque is in-contract.
+
+### COLL-5
+- **Verdict**: CONFIRMED
+- **Evidence**: `new BinaryHeap(x=>x.score).pop()` → `undefined`, then `size() === -1`,
+  `isEmpty() === false`, and the next `push({score:7})` threw
+  `TypeError: Cannot read properties of undefined (reading 'score')`. `BinaryHeap.spec.js` itself
+  asserts `pop()` on an empty heap is `undefined` (twice) and uses the
+  `while ((x = h.pop()) !== undefined)` drain pattern, so popping past empty is sanctioned.
+
+### COLL-6
+- **Verdict**: CONFIRMED
+- **Evidence**: `new FilteredListProjection(new List([1,2,3]), new List())` with `deferred=false`;
+  after `input.add(4)` the console showed
+  `Failed to dispatch handler [Function: update] TypeError: a.equals is not a function` at
+  `invokeObjectEquals.js:9` via `array_set_diff.js:30`, and `p.output` stayed `[1,2,3]`. Silent stale
+  output, exactly as described.
+
+### COLL-7
+- **Verdict**: CONFIRMED
+- **Evidence**: `link(); input.add(3); input.add(5); input.remove(0)` → input `[5]`, output unchanged
+  `[5,3]`. `link()`/`unlink()` only touch `input.on.added`.
+
+### COLL-8
+- **Verdict**: CONFIRMED
+- **Evidence**: `it.initialize(['a','b','c']); it.initialize(['x','y'])` then draining yields three
+  items `["x","y",<undefined>]` from a two-element array.
+
+### COLL-9
+- **Verdict**: CONFIRMED
+- **Evidence**: reproduced the exact numbers — `a.equals(b) === true`, `a.hash() === -13796099888`,
+  `b.hash() === 4190943312`. Hash/equals contract broken; hash is also not an int32.
+
+### COLL-10
+- **Verdict**: CONFIRMED
+- **Evidence**: BigEndian-spec table with one `Uint32` row of value `1`, serialized and deserialized:
+  `t2.spec.endianType` came back as LittleEndian and `t2.readCellValue(0,0) === 16777216`.
+
+### COLL-11
+- **Verdict**: CONFIRMED
+- **Evidence**: `s.ensureCapacity(1); s.increment(0); s.frequency(3)` → **1** for an element never
+  incremented. With a 1-word table the table index is identical for both, so the only differentiator
+  is the counter offset — under the documented 16-counters-per-slot layout element 3 lands on
+  counters 8..11 and must read 0. Source confirms `start = (hash & 3) << 2` with `start+i ∈ 0..15`
+  and shift `(start+i) << 2 ∈ 0..60` against a `Uint32Array` (JS shifts mod 32).
+
+---
+
+## core-binary
+
+### BIN-1
+- **Verdict**: CONFIRMED
+- **Corrected severity**: CRITICAL (stands)
+- **Evidence**: `b.writeUTF8String("Ж".repeat(3000)); b.position=0; b.readUTF8String()` → `""`
+  (length 0). Same buffer with 3000 ASCII chars round-trips fine. Source confirms the mechanism:
+  `setCapacity` copies `Math.min(oldLen, newLen, this.position)` bytes while `this.position` is still
+  at the string-body start; `this.position = cursor` only happens after the loop. `BinaryBuffer` is
+  core serialization infra with many live consumers — CRITICAL is warranted.
+
+### BIN-2
+- **Verdict**: CONFIRMED-BUT-DOWNGRADED
+- **Corrected severity**: MAJOR
+- **Evidence** (static — executing it hangs by construction): `Localization.js:140-143` is
+  `let _path = path.trim(); while (_path.endsWith('/') || _path.endsWith('\\')) { _path.slice(0, _path.length - 1); }`.
+  `slice` is non-mutating and the result is discarded, so the guard can never become false. Infinite
+  loop is certain.
+- **Reason for downgrade**: ground 5. Requires a caller to pass a trailing separator; the default
+  argument has none and no in-repo caller supplies one. Real hang, narrow trigger.
+
+### BIN-3
+- **Verdict**: CONFIRMED
+- **Evidence**: `writeUTF8String("\uD800abc"); writeUint32(0x41414141)` then read back →
+  `"abcA"` and `0x00414141`. Stream desync exactly as described.
+
+### BIN-4
+- **Verdict**: CONFIRMED
+- **Evidence**: `new StructureBuilder("Foo").build()` → `ReferenceError: type is not defined`.
+  Source: `buildConstructorFunction(structure)` calls `buildTypePrototype(type, lines)`; `type` is
+  only a parameter name of `buildTypePrototype` and is not in scope (ESM is strict mode).
+
+### BIN-5
+- **Verdict**: CONFIRMED
+- **Evidence**: `new Type("Foo").clone()` → `Error: Name must be of type "string", instead was
+  "undefined"` under live asserts. Source `Type.js:74-78` copies only `fields`; in a production
+  bundle the assert is stripped and the clone silently carries `name === undefined`.
+
+### BIN-6
+- **Verdict**: CONFIRMED
+- **Evidence**: `new DataViewStructAccessor({v: BinaryDataType.Uint64}).v` →
+  `TypeError: this.$data.getUint64 is not a function`;
+  `{v: BinaryDataType.Float16}` → `TypeError: this.$data.undefined is not a function`;
+  `Uint32` control returns `0`. `DataType2DataViewReaders.js` indeed maps to the non-existent
+  `getUint64`/`getInt64` and has no `Float16` entry.
+
+### BIN-7
+- **Verdict**: CONFIRMED
+- **Evidence**: `s.set(5,true); s.shift(-1,0,10)` → only bit **6** set. Source `BitSet.js:547-553`:
+  both branches of `shift` call `shift_right`.
+
+### BIN-8
+- **Verdict**: CONFIRMED
+- **Evidence**: with a hashable key object, `capacity:1`: after `add(k,"v1"); add(k,"v2")` →
+  `get(k) === undefined`, `size === 1`, and `clear()` threw
+  `TypeError: Cannot read properties of undefined (reading 'indexOf')`. Source order confirms:
+  `elements` is resolved at `:135`, eviction (`__removeElement` → `data.delete(key)`) at `:150`,
+  push into the now-detached array at `:171`.
+
+### BIN-9
+- **Verdict**: CONFIRMED
+- **Evidence**: `new ObservedEnum(7, {ONE:1, SEVEN:7}).hash()` →
+  `TypeError: this.__validSet is not iterable`.
+
+### BIN-10
+- **Verdict**: CONFIRMED
+- **Evidence**: `stringify({a: undefined})` → `{"a":"null"}` (quoted string).
+
+### BIN-11
+- **Verdict**: CONFIRMED
+- **Evidence**: `stringify({'a"b': 1})` → `{"a"b":1}`; `JSON.parse` of it threw
+  `SyntaxError: Expected ':' after property name in JSON at position 4`.
+
+### BIN-12
+- **Verdict**: CONFIRMED
+- **Evidence**: `write_property({a:{b:0}}, ['x','a','b'], 1, 2, 31)` threw
+  `Error: No no property or getter found for 'x' on [0]'x/a'`; the `part_offset === 0` control
+  (`['a','b'], 0, 2`) correctly produced `{"a":{"b":31}}`.
+
+### BIN-13
+- **Verdict**: CONFIRMED
+- **Evidence**: `a=new BoundedValue(0,10,0); b=new BoundedValue(5,10,2); a.copy(b)` →
+  `a.equals(b) === false`, `a.getFraction() === 0.5` vs `b.getFraction() === 0.375`.
+  `b.toJSON()` → `{"value":5,"limit":10}` (no lower limit). Binary round-trip yields
+  `lower === 0`, `equals(b) === false`.
+
+### BIN-14
+- **Verdict**: CONFIRMED
+- **Evidence** (read): `ConnectedBoxLayouter.js:132` is literally
+  `const b1_cost_after = this.__compute_box_cost(b0);` two lines after the identical `b0` call, and
+  the accept test at `:134` uses `b0_cost + b1_cost <= b0_cost_after + b1_cost_after`.
+
+### BIN-15
+- **Verdict**: CONFIRMED
+- **Evidence**: `string_format_kebab_to_underscore("a-b-c")` → `"a_b-c"`.
+
+### BIN-16
+- **Verdict**: CONFIRMED
+- **Evidence**: `engine.setLocaleDataset("en", new LocaleDataset()); engine.resolve("en","greeting")`
+  → `undefined`. `LocalizationEngine.resolve` indexes `locale[fragment_key]` directly; `LocaleDataset`
+  exposes only `hasKey`/`get` over a `#map` private field (verified: its prototype has exactly
+  `['constructor','hasKey','get']` — there is not even a way to populate it).
+
+### BIN-17
+- **Verdict**: CONFIRMED
+- **Evidence**: `compileReactiveToJS(ReactiveNegate.from(ReactiveLiteralNumber.from(-5)))` →
+  `"--5"` (a SyntaxError when handed to `new Function`). Source `compileNegate` is
+  `` return `-${compileExpression(exp.source)}`; `` with no parentheses, so the nested-negation
+  `--this.a` case follows directly.
+
+---
+
+## core-process
+
+### PROC-1
+- **Verdict**: CONFIRMED-BUT-DOWNGRADED
+- **Corrected severity**: MAJOR
+- **Evidence**: `anything().matches(42)` → `false`; `nothing().matches(42)` → `true`.
+  `IsAnything.matches()` is `return false;` unconditionally.
+- **Reason for downgrade**: ground 5 (with a nod to ground 3). `anything()`/`nothing()` have **zero**
+  in-repo callers, and every in-repo matcher use (`ObservedInteger.js`, `iteratorTask.js`) goes
+  through `assert.that(...)`, which is compiled out of production. So the stated impact — "assert.that
+  throws for every x" / "a guard that is supposed to be unreachable silently passes everything" — is a
+  development-build-only concern. The matcher itself is genuinely inverted, so the defect is real.
+
+### PROC-2
+- **Verdict**: CONFIRMED
+- **Evidence**: `allOf(isIn([3,7]), not(equalTo(7))).matches(2)` →
+  `TypeError: Cannot read properties of undefined (reading 'appendDescriptionOf')`;
+  `hasItem(1).matches([])` → `TypeError: … (reading 'appendText')`. Default parameter values are not
+  inherited by overrides, as claimed.
+- **Note**: same caveat as PROC-1 — the in-repo reach is `assert.that`, i.e. dev builds. MAJOR is fine
+  for a public matcher API whose documented single-arg form throws.
+
+### PROC-3
+- **Verdict**: CONFIRMED
+- **Evidence**: `new DescribeAs("value must be %0 or %1", equalTo(1), ["A","B"]).describeTo(d)` wrote
+  the literal `"value must be %0 or %1"`. All three sub-defects are visible in the source
+  (`matchAll` iterator has no `.length`; `match.groups[1]`; `textStart = match[0].length`).
+
+### PROC-4 (MINOR, verified opportunistically)
+- **Verdict**: CONFIRMED
+- **Evidence**: `new InMemoryDescriptor().appendValue(undefined).value` → `"null"`.
+
+### PROC-6
+- **Verdict**: CONFIRMED
+- **Corrected severity**: CRITICAL (stands)
+- **Evidence**: `A = failingTask(); B.addDependency(A); ex.run(A); ex.run(B)` →
+  `A.state === 3 (FAILED)`, `B.state === 0 (INITIAL)`, `ex.contains(B) === false`,
+  `queueUnresolved.length === 0`, and neither `B.on.failed` nor `B.on.completed` fired.
+  `ConcurrentExecutor.js:286` FAILED branch only splices. `ConcurrentExecutor` is live engine infra.
+
+### PROC-7
+- **Verdict**: CONFIRMED
+- **Evidence**: `emptyTask().executeSync()` leaves `state.getValue() === 0` (INITIAL);
+  `TaskState.SUCCEEDED === 4`. Source `Task.js:214` never assigns `this.state`.
+
+### PROC-8
+- **Verdict**: CONFIRMED
+- **Evidence**: `ignoreFailureTask(failingTask(new Error("boom")))`, initialized then `cycle()` →
+  the wrapper rethrows `Error: boom`. `failingTask` is the repo's own canonical failing task and it
+  fails by throwing, so the wrapper does not cover its own package's failure idiom.
+
+### PROC-9
+- **Verdict**: CONFIRMED
+- **Evidence**: `new RemainingTimeEstimator(10); e.update(1000, 0.5); e.estimate(0.5)` → `9999.9995`
+  (correct answer 1000). `estimate` divides by `sampleCount`, never by the number of filled slots.
+
+### PROC-10
+- **Verdict**: CONFIRMED
+- **Corrected severity**: CRITICAL (stands)
+- **Evidence**: end-to-end `do(A); do(B); mark("m1"); undo(); do(C)` →
+  `history.length === 1`, `cursor === 1`, `marks === [2]`; the following `redo()` threw
+  `TypeError: Cannot read properties of undefined (reading 'apply')`. Ordinary editor sequence;
+  `ActionProcessor` is referenced by 51 files.
+
+### PROC-11
+- **Verdict**: CONFIRMED
+- **Corrected severity**: CRITICAL (stands)
+- **Evidence**: `ap.doMany([good, throwing])` — after 60 ms the returned promise is still `pending`
+  and jest reported the escaped `action boom` rejection. A subsequent `ap.do(...)` is also still
+  `pending` after 60 ms with `history.length` stuck at 1: the processor is bricked.
+
+### PROC-12
+- **Verdict**: CONFIRMED
+- **Evidence**: with `historyMarkLimit = 2`, 6 do+mark pairs leave `marks.length === 6`,
+  `history.length === 6`. With `historyMemoryLimit = 3000` and 10×1000-byte actions,
+  `historyMemoryUsage === 10000`, `history.length === 10`, no throw. Both caps inert, as claimed;
+  `lastMark = min2(marks.length, historyMemoryLimit) - 1` makes `lastMark + 1 < marks.length` always
+  false.
+
+### PROC-15
+- **Verdict**: CONFIRMED
+- **Evidence**: `new Future((res, rej) => { rej(new Error("nope")); res(42); }); f.resolve();` →
+  `f.state === 2 (RESOLVED)` and `f.then(ok, err)` invoked the **ok** branch with `42`.
+
+### PROC-16
+- **Verdict**: CONFIRMED
+- **Evidence**: a watchdog whose action calls `wd.start()` to re-arm — after 80 ms with a 5 ms
+  timeout, `barks === 1` and `isActive() === false`. Silently dead after the first bark.
+
+### PROC-17
+- **Verdict**: CONFIRMED
+- **Evidence**: minimal node repro of the exact shape (`p.catch(()=>{})` by the caller +
+  `p.finally(cb)` discarded) produced `unhandledRejection count = 1`. Both cited sites
+  (`PromiseWatcher.js:45`, `OnDemandWorkerManager.js:135`) discard the derived promise.
+
+### PROC-18
+- **Verdict**: CONFIRMED
+- **Evidence**: `CompositeProcess([a,b])` through `initialize(); startup(); finalize()` →
+  composite `"finalized"`, children `"stopped"` (not `"finalized"`). The path through
+  `BaseProcess.finalize` → `this.shutdown()` (the override) is exactly as described.
+
+### PROC-19
+- **Verdict**: CONFIRMED-BUT-DOWNGRADED
+- **Corrected severity**: MAJOR
+- **Evidence**: `extractTransferables({a: null}, [])` →
+  `TypeError: Cannot read properties of null (reading 'buffer')`. Confirmed.
+- **Reason for downgrade**: ground 5. `core/process/worker/extractTransferables.js` has **no
+  importer anywhere in the repo** — the only occurrences of the name are inside `WorkerBuilder.js`'s
+  generated worker source string (line 120), which carries its own `obj === null` guard. So the
+  stated blast radius ("any worker payload containing a null field crashes before the message is
+  posted") is unreachable on the shipped path.
+
+### PROC-20
+- **Verdict**: CONFIRMED
+- **Corrected severity**: CRITICAL (stands, with a narrow trigger)
+- **Evidence** (read; needs a real Worker to execute): `WorkerProxy.js:136-159` — inside the
+  `new Promise` executor, `if (!trySendMessage(...)) { array_remove_first(pending, request); }` and
+  nothing else. Neither `resolve` nor `reject` runs, and the request is no longer reachable by
+  `__handleMessage`/`__failAllPending`. `WorkerProxy` is used by 9 files. The trigger requires
+  `postMessage` to throw (non-cloneable payload), which PROC-21 makes reachable.
+
+### PROC-21
+- **Verdict**: CONFIRMED
+- **Evidence** (read): `WorkerProxy.js:40` is
+  `if (value.hasOwnProperty('toJSON') && value.toJSON === "function")` — comparing a function value
+  against the string `"function"`. Unreachable branch; the `toJSON` sanitisation path is dead.
+
+### PROC-22
+- **Verdict**: CONFIRMED
+- **Evidence**: nodes `X,P,Q,R` with `Forward` edges `P→X`, `X→Q`, `X→R` → `colorizeGraph` returned
+  `[1,1,2,2]` and the library's own `validateGraphColoring(colors, graph)` returned **false** on that
+  output. `graphToMatrix` writes only `data[i*V + otherIdx]`.
+
+### PROC-23
+- **Verdict**: CONFIRMED
+- **Evidence**: a graph with `createEdge("A","B", EdgeDirectionType.Backward)` produced DOT with both
+  node declarations and **zero** `->` lines. `Backward` is a first-class enum member
+  (`graph/Edge.js:8-12`).
+
+### PROC-24
+- **Verdict**: CONFIRMED
+- **Evidence**: `A`,`B` joined by two parallel undirected edges →
+  `graph_compute_laplacian_matrix` gave `[[2,-1],[-1,2]]`, row sums `1`; `graph.getNodeDegree("A")`
+  is `2`. Correct Laplacian is `[[2,-2],[-2,2]]`.
+- **Note**: the finding files this against `graph_compute_adjacency_matrix.js`, but that function's
+  JSDoc explicitly documents "Writes 1 to matrix elements where nodes are connected" — it behaves as
+  specified. The actual defect is in the *composition* inside `graph_compute_laplacian_matrix.js`,
+  whose own comment ("Uint32 prevents silent overflow for high-degree or **multi-edge** graphs")
+  shows multigraphs are in scope. Severity unchanged; fix site is the Laplacian.
+
+### PROC-25
+- **Verdict**: CONFIRMED
+- **Evidence**: reproduced the heap semantics directly — min-heap on `-weight`, elements
+  `{10, 3, 5}`, then raised the leaf's weight `3 → 11` and called only `bubbleDown(index)` as
+  `mn_graph_collapse_weighted_edge.js:69` does. Heap array stayed `[10, 11, 5]` and `pop()` returned
+  **10**, not 11. `BinaryHeap.updateElementScore` (which does `bubbleUp` then `bubbleDown`) exists
+  and is the right call.
+
+### PROC-26
+- **Verdict**: CONFIRMED
+- **Evidence** (read; browser-only): `obtainClipBoard.js:8` runs the permission queries **only** when
+  `navigator.clipboard === undefined`, then unconditionally `return navigator.clipboard;`. The guard
+  is inverted against the function's own doc line ("verifying read/write permissions are granted when
+  necessary"): on the common path (clipboard present) it verifies nothing, and on the branch it does
+  take it can only ever return `undefined`.
+- **Caveat on the stated scenario**: the specific "resolves with `undefined`" outcome additionally
+  requires `navigator.permissions.query({name:"clipboard-read"})` to resolve `"granted"` in an
+  environment with no `navigator.clipboard`. In environments where `permissions` is missing or the
+  name is unsupported the promise rejects and the file-picker fallback *is* reached. Not demonstrated;
+  the inverted guard itself is not in doubt.
+
+---
+
+## core-math
+
+### MATH-1
+- **Verdict**: CONFIRMED
+- **Corrected severity**: CRITICAL (stands)
+- **Evidence**: `sdnoise1(d, -0.9)` → **-22.0446**. Sweep of `x ∈ [-5,5]` at 1e5 points →
+  range `[-323.94, +242.86]`; the same sweep over `[0,5]` → `[-0.173, +0.401]`.
+  `sdnoise3` max adjacent step over `[-3,3]` = **0.2335** vs **0.00154** over `[1,7]` — a 150×
+  discontinuity. Live consumer chain verified: `core/math/noise/curl_noise_3d.js:18` samples
+  `sdnoise3(p_z0, x - 231.141, …)` and is imported by
+  `engine/graphics/particles/particular/engine/simulator/SimulationStepCurlNoiseAcceleration.js:7`.
+
+### MATH-2
+- **Verdict**: CONFIRMED-BUT-DOWNGRADED
+- **Corrected severity**: MAJOR
+- **Evidence**: `hammersley_sequence(i,2,8)` for `i=0..7` → `[0, 0.625, 0.125, 0.5625, 0.625,
+  0.3125, 0.5625, 0.4375]` — **6 distinct values out of 8**. The sibling `halton_sequence(2,i)`
+  correctly gives `[0, 0.5, 0.25, 0.75, 0.125, 0.625, 0.375, 0.875]`.
+- **Reason for downgrade**: ground 5. `hammersley_sequence` has **no importer in the repo**
+  (`grep 'from .*hammersley_sequence.js'` → nothing). The report's implied live consumers are wrong:
+  `hammersley_sequence_2d.js` does *not* call it — it uses `radical_inverse_VdC_base_2` — and
+  `generate_hammersley_jitter.js` goes through `hammersley_sequence_2d`. So nothing shipped samples
+  the broken sequence.
+
+### MATH-3
+- **Verdict**: CONFIRMED
+- **Evidence**: with `[1..10]` — `(0.9,0.9)` → **10** (the maximum); `(0.5,0.5)` → **6** while
+  `computeStatisticalMedian` on the same data → **5**; `(0,0.4)` → **3**. Existing spec cases on
+  `[0..9]` (`(0,0.5) → 2`, `(0.5,1) → 7`) are as the report states.
+
+### MATH-4
+- **Verdict**: CONFIRMED
+- **Evidence**: `roundFair(-2.3, ()=>0.9)` → `-3`, `roundFair(-2.3, ()=>0.1)` → `-3`;
+  mean over 10 000 `Math.random` draws = **-3.0** exactly (expected -2.3). Positive control
+  `roundFair(2.3, …)` mean = 2.3067, so only the negative path is broken.
+
+### MATH-5
+- **Verdict**: CONFIRMED
+- **Evidence**: `fract(-0.1)` → `-0.1`; `fract(1e10)` → **8589934592**;
+  `fract(2147483648.5)` → **4294967296.5**.
+- **Note on ground 4**: `fract.spec.js` does pin the negative-truncation behaviour
+  (`expect(fract(-0.1)).toBeCloseTo(-0.1)`), which contradicts the JSDoc's own
+  "calculated as x - floor(x)" + GLSL citation. That half is genuinely contested. The 2³¹ wrap is not:
+  the result is not even in `(-1,1)` under any reading. Finding stands.
+
+### MATH-6
+- **Verdict**: CONFIRMED-BUT-DOWNGRADED
+- **Corrected severity**: MINOR
+- **Evidence**: `squirrel3(0)` → 436901382, `squirrel3(1)` → 1910996822; over inputs `0..199999` it
+  emits **199 763** distinct values (237 collisions), whereas an `Math.imul`/`>>>` implementation of
+  the same construction is a bijection on 32 bits. Source confirms `value * BIT_NOISE1` /
+  `hash *= BIT_NOISE3` are double multiplies and both shifts are arithmetic `>>`.
+- **Reason for downgrade**: ground 5. `squirrel3` has **zero** importers in the repo; nothing
+  contractual promises a bijection (`@returns {number} signed 32-bit integer`); and the file's own
+  header already records the symptom ("Personally I found it to have low entropy"). This is a hash
+  *quality* deviation, not a wrong-answer defect.
+
+### MATH-7
+- **Verdict**: CONFIRMED
+- **Evidence**: `m = [1,-2,5,3]`; after `m2_svd(U,S,V,sig,m)`, reconstructing with the *exact* helper
+  from `m2_svd.spec.js` (`m2_transpose` + two `m2_multiply`) gives **`[1,5,-2,3]`** — the transpose of
+  `m`, while the JSDoc asserts `m = U * Σ * V^T`. For `m = [1,2,3,4]`, `m2_polar_decomp` gives
+  `S*R = [0.15385, 2.23077, 1.23077, 4.84615]` (neither `m` nor `mᵀ`) while `R*S = [1,3,2,4] = mᵀ`;
+  the two polar JSDocs state `m = S*R` and `m = R*S` respectively, so at most one can be right and in
+  fact neither holds. The existing spec only reconstructs symmetric inputs, where the transpose is
+  invisible.
+- **Note**: I verified the in-package inconsistency and the doc contradiction directly. The claimed
+  downstream MLS-MPM consequence is outside my scope and was not independently verified.
+
+### MATH-8
+- **Verdict**: CONFIRMED-BUT-DOWNGRADED
+- **Corrected severity**: MINOR
+- **Evidence**: round-tripped tables of 255 / 256 / 257 entries through
+  `toBinaryBuffer`/`fromBinaryBuffer`: data length after = 255 / **0** / 257. Exactly-256 entries
+  reconstruct as an empty table, silently.
+- **Reason for downgrade**: ground 4/5. Both methods are marked
+  `@deprecated Use serialization adapter instead`, so the broken path is not the supported one.
+
+### MATH-9 / MATH-10 (MINOR, verified opportunistically)
+- **Verdict**: CONFIRMED. `copysign(3,0)` → `-3`, `copysign(3,NaN)` → `-3`;
+  `softmax([1000,1],0,2)` → `NaN`, `softmax([800,801],1,2)` → `NaN`.
+
+---
+
+## core-science
+
+### SCI-1
+- **Verdict**: CONFIRMED
+- **Evidence**: `c = new Color(1,0,0,0.25)` → `color_darken(c,0.5).a`, `color_lighten(c,0.5).a`,
+  `color_saturate(c,0.5).a`, `color_desaturate(c,0.5).a` all measured **1**, while
+  `color_darken(c,0).a === 0.25` (the fast path returns the input). The alpha discontinuity at
+  `amount → 0` is real.
+
+### SCI-2
+- **Verdict**: CONFIRMED
+- **Evidence**: `Color.parse('rgba(0,0,0,1)')` with a listener attached, then
+  `c.parse('rgba(0,0,0,0.5)')` → `c.a === 0.5` but the listener fired **0** times.
+  `new Color(0,0,0,1).parse('#FF000080')` fired with payload
+  `[1, 0, 0, 0.50196, 0, 0, 0, 0.50196]` — the 8th argument (previous alpha) should be `1`.
+
+### SCI-3
+- **Verdict**: CONFIRMED
+- **Evidence**: round-tripping through the module's own forward model —
+  `kelvin_to_rgb` at 1500 K → `[1, 0.419469, 0]` → `rgb_to_kelvin` → **1000**;
+  1900 K → **1000**; 2000 K → **1000**; 3000 K → 3000 and 5000 K → 5000 round-trip exactly.
+  The collapse is confined to the `b === 0` band exactly as described.
+
+### SCI-5 / SCI-6 / SCI-7 (MINOR, verified opportunistically)
+- **Verdict**: CONFIRMED. `new Color(1,0,0,1).toUint32()` → `-16776961`, white → `-1`.
+  `setHCL(-1e-17, 1, 0.5)` produced NaN channels (caught by `assert.notNaN` under the dev harness;
+  stripped in production, so the NaN lands). `parse_color('#fff')` → `[255, 15, NaN, 1]`.
+
+---
+
+## Tally
+
+67 findings checked — all 13 CRITICALs, 45 MAJORs, and 9 MINORs verified opportunistically.
+**58 confirmed as stated, 9 confirmed with corrected (lower) severity, 0 refuted.**
+
+Downgraded: COLL-1, COLL-2, COLL-3, BIN-2, PROC-1, PROC-19, MATH-2, MATH-6, MATH-8.
+Every downgrade is ground-5 severity inflation: the defect is real but the stated blast radius does
+not exist on any shipped path (no importer / assert-only reach / guarded duplicate is what actually
+ships), or the code is deprecated, or the API is self-consistent under a different naming.
+
+CRITICALs that survive at CRITICAL: BIN-1, PROC-6, PROC-10, PROC-11, PROC-20, MATH-1 (6 of 13).
+Downgraded to MAJOR: COLL-1, COLL-2, COLL-3, BIN-2, PROC-1, PROC-19, MATH-2 (7 of 13).