minerva 0.2.0

Causal ordering for distributed systems
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
//! The order-of-magnitude scale probe (S181): the crdt-vision's scheduled
//! re-measure, one order of magnitude above the S110 session's 6,000 chars.
//!
//! Every number here is a deterministic count (byte lengths off the shipped
//! `to_bytes`, structural sizes, closed-form cost models), the measurements
//! module's own discipline; the wall-time companion is the `bench/` size
//! sweep this slice added (`typing_at_size`, `absorb_delta`, `order_cold`,
//! `wire_encode` / `wire_decode` at 4k/16k/64k). The document is built at
//! weave speed (direct [`Rhapsody::weave`] plus one covered
//! [`Dotted::try_new`]) because the composed write path is exactly the
//! pressure under measurement: `Composer::compose` merges every keystroke's
//! delta into the held state, and `Rhapsody::causal_merge` clones the whole
//! skeleton and rebuilds the whole child index (`from_parts`), so a
//! facade-built 65,536-char fixture would itself be quadratic.

extern crate alloc;

use crate::kairos::{Clock, TickCounter};
use crate::metis::{Anchor, Cut, Dot, DotSet, Dotted, Locus, Rhapsody};

use super::super::d;
use crate::metis::dot::RawDot;

/// One order of magnitude above the measured 6k-char session: an ordinary
/// editor source file, the scale the crdt-vision's arc table scheduled this
/// re-measure at.
const SCALE: u64 = 65_536;

/// The v2 frame's fixed per-locus widths (PRD 0017 / S127): header, an
/// origin-anchored record, and a dot-anchored record.
const FRAME_HEADER: usize = 5;
const ORIGIN_LOCUS: usize = 30;
const DOT_LOCUS: usize = 42;

/// A `SCALE`-element single-author document built at weave speed: the same
/// bytes the composed path produces (the bench crate's `woven_state` proves
/// that equality against the facade at a small prefix; here the builder is
/// the fixture, and the frame arithmetic below is checked against the codec's
/// own constants).
fn woven_document(station: u32, n: u64) -> Dotted<Rhapsody> {
    let clock = Clock::with_default_config(TickCounter::new(), station).unwrap();
    let mut rhapsody = Rhapsody::new();
    let mut context = DotSet::new();
    let mut prev: Option<Dot> = None;
    for index in 1..=n {
        let anchor = prev.map_or(Anchor::Origin, |dot| Anchor::After(dot.into()));
        let rank = clock.now(0u16);
        let dot = d(station, index);
        assert!(
            rhapsody.weave(dot, Locus { anchor, rank }),
            "every woven dot is fresh"
        );
        let _ = context.insert(dot);
        prev = Some(dot);
    }
    Dotted::try_new(rhapsody, context).unwrap()
}

/// The owed-delta measurements at scale (arc 10, S191): what one anti-entropy
/// probe ships against a peer one keystroke behind, bare and witnessed.
///
/// Bare: the survivor novelty is one element, but the fragment carries the
/// ordering skeleton WHOLE (a survivor context licenses no skeleton
/// sub-selection, the S190 outrun-heal law), so the owed fragment is
/// document-sized on both axes, the late-joiner snapshot re-shipped per
/// probe, per peer, even at one owed keystroke. Witnessed (ruling R-21): the
/// peer also states its recording possession (here its context, the
/// single-author no-deletion case), and the fragment collapses to exactly
/// the owed locus, a fixed-width frame instead of a snapshot. Returns
/// `(owed_skeleton, owed_frame, witnessed_skeleton, witnessed_frame)`.
fn owed_probe(state: &Dotted<Rhapsody>, scale: usize) -> (usize, usize, usize, usize) {
    let mut one_behind = DotSet::new();
    for index in 1..SCALE {
        let _ = one_behind.insert(d(1, index));
    }
    let owed = state.delta_for(&one_behind);
    let owed_skeleton = owed.store().skeleton_len();
    let owed_frame = owed.store().to_bytes().len();
    assert_eq!(
        owed_skeleton, scale,
        "one owed keystroke ships the whole skeleton through the bare owed read"
    );
    assert!(
        owed_frame > 2 * 1024 * 1024,
        "the one-keystroke owed fragment frames at snapshot size"
    );

    let witnessed = state.delta_for_witnessed(&one_behind, &one_behind);
    let witnessed_skeleton = witnessed.store().skeleton_len();
    let witnessed_frame = witnessed.store().to_bytes().len();
    assert_eq!(
        witnessed_skeleton, 1,
        "one owed keystroke ships one locus through the witnessed read"
    );
    assert!(
        witnessed_frame < 128,
        "the witnessed one-keystroke fragment frames in tens of bytes"
    );
    assert_eq!(
        state.merge(&witnessed).store().order(),
        state.store().order(),
        "the witnessed fragment converges the peer exactly"
    );
    (
        owed_skeleton,
        owed_frame,
        witnessed_skeleton,
        witnessed_frame,
    )
}

/// The snapshot sibling codec (PRD 0023, arc 5): the probe's maximal chains
/// priced on the wire. The closed form is exact on the deterministic
/// two-author document: a 9-byte header, one 46-byte row per run, six bytes
/// per interior element, no free loci, and the 37-byte two-station visible
/// suffix; the v2 frame prices the same document at 42 bytes per
/// dot-anchored locus. The factoring agreement (codec runs == counted runs)
/// is the load-bearing arm: the wire's chain law and the probe's coalescing
/// definition must name the same runs on honest traffic. Returns the two
/// frames for the report.
fn snapshot_wire_pins(
    rhapsody: &Rhapsody,
    scale: usize,
    runs: usize,
) -> (alloc::vec::Vec<u8>, alloc::vec::Vec<u8>) {
    let snapshot = rhapsody.to_snapshot_bytes();
    let v2 = rhapsody.to_bytes();
    let suffix = 5 + 2 * 16;
    assert_eq!(v2.len(), 5 + 30 + (scale - 1) * 42 + suffix);
    assert_eq!(snapshot.len(), 9 + runs * 46 + (scale - runs) * 6 + suffix);
    assert!(
        snapshot.len() * 6 < v2.len(),
        "the late-joiner bootstrap compresses at least sixfold on honest traffic"
    );
    assert_eq!(
        Rhapsody::from_snapshot_bytes(&snapshot).as_ref(),
        Ok(rhapsody),
        "the editor-scale snapshot round-trips"
    );
    (snapshot, v2)
}

/// The two-author alternating session: stations 1 and 2 each append
/// `chunk`-char runs at the evolving tail, `chunks` turns in all, under the
/// visual-insert seam discipline (outrank the anchor's current top child),
/// so the document factors into exactly one maximal same-author run per
/// authored chunk: the collaborative-document shape the coalescing
/// instrument measures.
fn alternating_document(chunk: u64, chunks: u64) -> Rhapsody {
    let clock_a = Clock::with_default_config(TickCounter::new(), 1).unwrap();
    let clock_b = Clock::with_default_config(TickCounter::new(), 2).unwrap();
    let mut rhapsody = Rhapsody::new();
    let mut prev: Option<Dot> = None;
    let mut minted = [0u64; 2];
    for turn in 0..chunks {
        let station = u32::try_from(turn % 2).unwrap() + 1;
        let clock = if station == 1 { &clock_a } else { &clock_b };
        for _ in 0..chunk {
            // The seam discipline: outrank the anchor's current top child.
            if let Some(anchor) = prev
                && let Some(top) = rhapsody.children_of(Anchor::After(anchor.into())).next()
                && let Some(locus) = rhapsody.locus(top)
            {
                clock.observe(locus.rank);
            }
            minted[station as usize - 1] += 1;
            let dot = d(station, minted[station as usize - 1]);
            let anchor = prev.map_or(Anchor::Origin, |dot| Anchor::After(dot.into()));
            assert!(rhapsody.weave(
                dot,
                Locus {
                    anchor,
                    rank: clock.now(0u16),
                }
            ));
            prev = Some(dot);
        }
    }
    rhapsody
}

/// The order thread at scale (arc 11 phase three, S200; endpoint plane
/// run-coalesced in phase five, S202): the positional plane's fragments
/// coalesce at the same rate as everything else (walk-contiguity
/// coincides with chain runs on honest traffic), so the O(log) offset
/// reads ride on O(run segments) fragment memory plus O(segments) region
/// state, one segment per maximal chain run, with insertion-position
/// lookup still logarithmic amortized at independent deep seams.
/// The fragments-equal-runs assertion below is exact BECAUSE the probe's
/// 64-char chunks tile the 64-slot fragment cap; in general a run costs
/// one fragment per 64-slot segment, so a future chunk-size change here
/// moves this arm's expectation, not the thread. Reads are
/// pinned against `order()` at the edges and a sample of offsets; the
/// property suite owns the exhaustive law, this arm prices and pins it at
/// the probe's own scale.
fn order_thread_pins(rhapsody: &Rhapsody, order: &[Dot], scale: usize, runs: usize) {
    assert_eq!(
        rhapsody.order_thread_fragments(),
        runs,
        "the order thread coalesces to exactly the maximal chain runs"
    );
    assert_eq!(
        rhapsody.order_thread_region_nodes(),
        scale,
        "the region segments cover every placed dot exactly once"
    );
    // The segmented endpoint plane (arc 11 phase five): successor-shaped
    // ends edges are arithmetic, so the honest document's region state is
    // one segment per maximal chain run, one stored edge per run boundary,
    // and no starts nodes at all (chain interiors have no Before children).
    // The factoring agreement gains its fifth voice: region segments ==
    // child-plane explicit children == locus-column runs == thread
    // fragments == the wire's run count.
    assert_eq!(
        rhapsody.order_thread_region_segments(),
        runs,
        "the endpoint plane coalesces to exactly the maximal chain runs"
    );
    assert_eq!(
        rhapsody.order_thread_region_forest_nodes(),
        runs,
        "one link-cut node per run-boundary edge endpoint, none elsewhere"
    );
    // The endpoint closed forms: the S200 per-dot plane paid two 12-byte
    // link nodes, a 16-byte dot entry, and a 20-byte floored index entry
    // per placed dot; the segmented plane pays a heads entry, a breaks
    // entry, one link node, and one head-table entry per segment. The
    // sixty-fold undercut is asserted with headroom at thirty-two.
    let region_dot = core::mem::size_of::<(u32, u64)>();
    let node_id = core::mem::size_of::<u32>();
    let link_node = 3 * node_id;
    let endpoint_before = scale * (2 * link_node + region_dot + (region_dot + node_id));
    let endpoint_after = runs * ((region_dot + node_id) + region_dot + link_node + region_dot);
    assert!(
        endpoint_after * 32 < endpoint_before,
        "the segmented endpoint plane undercuts the per-dot form at document scale \
         ({endpoint_after} against {endpoint_before} bytes)"
    );
    #[cfg(feature = "std")]
    std::println!(
        "endpoint plane:      {endpoint_after} bytes exact ({runs} segments) against the per-dot form's {endpoint_before} (arc 11 phase five)"
    );
    assert_eq!(rhapsody.order_len(), scale);
    for offset in [0usize, 1, 63, 64, scale / 2, scale - 2, scale - 1] {
        let dot = rhapsody.order_at(offset).expect("in-range offsets resolve");
        assert_eq!(order[offset], dot);
        assert_eq!(rhapsody.offset_of(dot), Some(offset));
    }
    assert_eq!(rhapsody.order_at(scale), None);
    assert_eq!(
        rhapsody
            .order_walk_rev()
            .take(3)
            .collect::<alloc::vec::Vec<_>>(),
        [order[scale - 1], order[scale - 2], order[scale - 3]],
        "the reverse walk reads the tail without an order() pass"
    );
}

/// The coalesced child plane at scale (arc 11 phase four): a chain
/// interior's sole-child bucket is the identity plane's own entry, so the
/// child share leaves the closed form for every element but the run
/// boundaries. The factoring agreement now spans three planes and the
/// wire: locus column explicit entries == child-plane explicit children ==
/// thread fragments == frame run count, because all four speak the one
/// chain law. Takes the phase-four closed form the caller computed (the
/// identity-plane bytes plus the per-run-boundary child share) and pins
/// the fourfold undercut of the phase-two form.
fn child_plane_pins(
    rhapsody: &Rhapsody,
    scale: usize,
    runs: usize,
    coalesced_document: usize,
    phase_four_document: usize,
) {
    let child_explicit = rhapsody.child_explicit_children();
    assert_eq!(
        child_explicit, runs,
        "the child plane stores exactly the run-boundary children"
    );
    assert_eq!(
        rhapsody.child_explicit_buckets(),
        runs,
        "each run-boundary child is the sole exception under its own anchor"
    );
    // The child term falls by the chunk length, and with the child share
    // paid per run boundary the whole ordering closed form undercuts the
    // phase-two form at least fourfold on the honest two-author document.
    assert_eq!(scale % child_explicit, 0);
    assert!(
        phase_four_document * 4 < coalesced_document,
        "the coalesced child plane undercuts the phase-two form at document scale \
         ({phase_four_document} against {coalesced_document} bytes)"
    );
}

/// Maximal chain runs of a document order: consecutive order neighbors
/// continue a run iff same station, consecutive dot, and anchored After
/// the predecessor (the S192 coalescing instrument's definition, the one
/// the codec's chain law and every coalesced plane must agree with).
fn count_maximal_runs(rhapsody: &Rhapsody, order: &[Dot]) -> usize {
    let mut runs = 1usize;
    for pair in order.windows(2) {
        let (prev, next) = (pair[0], pair[1]);
        let continues = next.station() == prev.station()
            && next.counter() == prev.counter() + 1
            && rhapsody.locus(next).map(|l| l.anchor) == Some(Anchor::After(prev.into()));
        if !continues {
            runs += 1;
        }
    }
    runs
}

/// Arc 11's closed forms and the run-coalescing rate, as code-checked facts
/// (the instrument slice's remaining deterministic half, S192).
///
/// The closed forms: the per-woven-element ordering state's `size_of` floor
/// (skeleton entry plus child-index share plus the woven have-set's
/// amortized share), before any `BTreeMap` node overhead, so the recorded
/// ~128-bytes-per-character figure has a compiler-checked lower bound the
/// substructure ruling can cite; since phase one landed (S194, ruling R-22)
/// the same probe pins the interned plane's own closed form beside it and
/// asserts the shell undercuts the map form it replaced. The coalescing rate: a two-author session
/// alternating 64-char chunks at the shared tail (the collaborative-document
/// shape) yields exactly one maximal same-author consecutive-dot run per
/// chunk, so a run-coalesced skeleton (arc 11 phase two) carries
/// `chunks` explicit entries where the flat skeleton carries `chars`: the
/// number that says how much the run bet buys on honest traffic. Since
/// phase two landed (S199) the probe asserts that count EXACTLY off the
/// plane's own accounting (explicit column entries equal the maximal
/// runs; every interior element rides as a four-byte inline step), and
/// pins the coalesced closed form beside the two it supersedes. Since
/// phase four (the coalesced child plane) it asserts the child-plane
/// accounting at the same count and pins the closed form with the child
/// share paid per run boundary instead of per element.
#[cfg_attr(miri, ignore)]
#[test]
fn ordering_closed_forms_and_run_coalescing() {
    let entry = core::mem::size_of::<((u32, u64), Locus)>();
    let child_share = core::mem::size_of::<(u32, u64)>();
    let floor_per_char = entry + child_share;
    assert!(
        floor_per_char >= 48,
        "the size_of floor per woven element holds ({floor_per_char} bytes)"
    );
    let scale = usize::try_from(SCALE).unwrap();
    let document_floor = floor_per_char * scale;
    assert!(
        document_floor > 3 * 1024 * 1024,
        "a 65,536-char document's ordering state floors in megabytes before map overhead"
    );

    // The interned identity plane (arc 11 phase one, S194): the carried form
    // is a 4-byte page slot (the `Option<NonZeroU32>` niche, asserted at its
    // type) plus one exact `Locus` column entry, and the map's per-node
    // overhead leaves the identity plane entirely; the child-index share is
    // unchanged. The closed form is a genuine bound for dense fibers (a page
    // is 64 slots, so honest minting keeps slots occupied), not merely a
    // floor with unstated overhead on top.
    let slot = core::mem::size_of::<Option<core::num::NonZeroU32>>();
    let column = core::mem::size_of::<Locus>();
    let interned_per_char = slot + column + child_share;
    assert!(
        interned_per_char < floor_per_char,
        "the interned plane undercuts the map form's own floor \
         ({interned_per_char} against {floor_per_char} bytes)"
    );
    let interned_document = interned_per_char * scale;
    assert!(
        interned_document < document_floor,
        "the interned plane undercuts the map floor at document scale \
         ({interned_document} against {document_floor} bytes)"
    );

    // The two-author alternating session: A and B each append 64-char chunks
    // at the evolving tail, 512 chunks in all (65,536 elements).
    let chunk = 64u64;
    let chunks = SCALE / chunk;
    let rhapsody = alternating_document(chunk, chunks);

    let order = rhapsody.order();
    assert_eq!(order.len(), scale);
    let runs = count_maximal_runs(&rhapsody, &order);
    let chunks = usize::try_from(chunks).unwrap();
    assert_eq!(
        runs, chunks,
        "honest alternating traffic coalesces to exactly one run per authored chunk"
    );

    // The run-coalesced plane (arc 11 phase two, S199): the plane's own
    // accounting agrees with the walk-derived run count exactly, so on this
    // document the locus column holds one explicit entry per run and every
    // interior element is a four-byte inline step. The coalesced closed
    // form (exact, not floored: slots plus the explicit column; the child
    // share stays, phase three's territory) undercuts the phase-one form
    // by the chunk length on the locus column.
    let explicit = rhapsody.skeleton_explicit_entries();
    assert_eq!(
        explicit, runs,
        "the plane's explicit entries are exactly the maximal chain runs"
    );
    let coalesced_document = scale * slot + explicit * column + scale * child_share;
    assert!(
        coalesced_document < interned_document,
        "the coalesced plane undercuts the phase-one form at document scale \
         ({coalesced_document} against {interned_document} bytes)"
    );

    let child_explicit = rhapsody.child_explicit_children();
    let phase_four_document = scale * slot + explicit * column + child_explicit * child_share;
    child_plane_pins(
        &rhapsody,
        scale,
        runs,
        coalesced_document,
        phase_four_document,
    );

    order_thread_pins(&rhapsody, &order, scale, runs);

    let (snapshot, v2) = snapshot_wire_pins(&rhapsody, scale, runs);
    // The PRD 0023 interlock, asserted end to end: the frame's run-count
    // field and the plane's explicit column describe the same factoring,
    // because the wire and the memory layout speak one chain law; and the
    // v2 locus count is the whole skeleton, the form the runs compress.
    assert_eq!(
        snapshot[1..5],
        u32::try_from(explicit).unwrap().to_be_bytes()
    );
    assert_eq!(v2[1..5], u32::try_from(scale).unwrap().to_be_bytes());

    #[cfg(feature = "std")]
    {
        std::println!("\n=== ORDERING CLOSED FORMS (arc 11, S192) ===");
        std::println!(
            "size_of floor/char:  {floor_per_char} B (entry {entry} + child share {child_share}; map overhead on top)"
        );
        std::println!("65,536-char floor:   {document_floor} bytes");
        std::println!(
            "interned plane/char: {interned_per_char} B (slot {slot} + locus column {column} + child share {child_share}; no map overhead on the identity plane)"
        );
        std::println!("65,536-char interned: {interned_document} bytes");
        std::println!(
            "coalesced plane:     {coalesced_document} bytes exact ({scale} slots x {slot} B + {explicit} explicit loci x {column} B + child share; arc 11 phase two)"
        );
        std::println!(
            "coalesced children:  {phase_four_document} bytes exact ({child_explicit} explicit children x {child_share} B replace the {scale}-element child share; arc 11 phase four)"
        );
        std::println!(
            "run coalescing:      {scale} elements / {runs} runs = {} elements/run",
            scale / runs
        );
        std::println!(
            "snapshot frame:      {} bytes against v2's {} ({}x; arc 5, PRD 0023)",
            snapshot.len(),
            v2.len(),
            v2.len() / snapshot.len()
        );
        std::println!("============================================\n");
    }
}

// Ignored under Miri: the probe is pure safe byte arithmetic at deliberate
// scale (65,536 weaves plus one pure whole-document merge), which Miri
// interprets at a cost of tens of minutes while checking nothing the small
// example tests do not already cover on the same paths (the cfg(miri)
// volume discipline, S86).
#[cfg_attr(miri, ignore)]
#[test]
fn editor_scale_probe() {
    let state = woven_document(1, SCALE);
    let scale = usize::try_from(SCALE).unwrap();
    assert_eq!(state.store().skeleton_len(), scale);
    assert_eq!(state.store().visible_len(), scale);

    // The late-joiner snapshot: the whole-state v2 frame at editor scale. The
    // visible suffix is the gap-free have-set frame (per-station floor form,
    // scale-invariant); every locus costs its fixed v2 width, so the frame is
    // linear in the skeleton at 42 bytes per dot-anchored element, megabytes
    // for an ordinary source file. This is the measured number that moves the
    // late-joiner arc from parked to watched: steady-state deltas stay tiny
    // (asserted below), so the snapshot is where wire scale actually bites.
    let frame = state.store().to_bytes();
    let suffix = state.context().to_bytes().len();
    assert_eq!(
        frame.len(),
        FRAME_HEADER + ORIGIN_LOCUS + DOT_LOCUS * (scale - 1) + suffix,
        "the v2 snapshot frame is linear at 42 bytes per dot-anchored locus"
    );
    assert!(
        frame.len() > 2 * 1024 * 1024,
        "a 65,536-char document snapshot exceeds two megabytes"
    );

    // The per-render read at scale: order() emits the whole document, so one
    // caret movement's re-render walks every woven element. The walk is the
    // read's contract (emitting the whole order is O(n)); at this scale the
    // number said a windowed consumer cannot afford it per keystroke, the
    // editor-shaped read gap this probe recorded and S183 closed (arc 9): the
    // windowed walk below resumes mid-document and reads a viewport without
    // visiting the rest.
    let order = state.store().order();
    assert_eq!(order.len(), scale, "one render visits every woven element");

    // The windowed read at scale (S183): resume immediately after an element
    // deep in the document and take a viewport. The window agrees with the
    // whole-order slice (the suffix law, property-pinned in the rhapsody
    // suite), and the walk yields it lazily: a per-keystroke re-render pays
    // for the resume plus the viewport, not the 65,536-element order. The
    // wall-time companion is the bench sweep's `order_window` point.
    let viewport = 100;
    let anchor_slot = scale / 2;
    let resume = order[anchor_slot - 1];
    let window: alloc::vec::Vec<Dot> = state
        .store()
        .order_walk_after(resume)
        .expect("a placed element resumes")
        .take(viewport)
        .collect();
    assert_eq!(
        window,
        order[anchor_slot..anchor_slot + viewport],
        "the mid-document viewport agrees with the whole-order slice"
    );

    // Steady-state deltas stay flat at scale: a remote keystroke's floored
    // context frame is tens of bytes against a 65k document (the gap-free
    // floor form is scale-invariant, the arc-5 verdict re-confirmed an order
    // of magnitude up).
    let cut = Cut::floor_of(state.context());
    let mut remote = Rhapsody::new();
    let remote_clock = Clock::with_default_config(TickCounter::new(), 2).unwrap();
    assert!(
        remote.weave(
            d(2, 1),
            Locus {
                anchor: Anchor::After(RawDot {
                    station: 1,
                    counter: SCALE
                }),
                rank: remote_clock.now(0u16),
            },
        ),
        "the remote keystroke weaves fresh"
    );
    let mut remote_context = DotSet::new();
    let _ = remote_context.insert(d(2, 1));
    let delta = Dotted::try_new(remote, remote_context).unwrap();
    let merged = state.merge(&delta);
    let floored = merged.delta_for_since(&cut);
    assert!(
        floored.context().to_bytes().len() <= 64,
        "the floored per-keystroke context frame stays tens of bytes at 65k chars"
    );

    // The owed-delta read at scale (arc 10): what one anti-entropy probe
    // ships and touches, bare and witnessed (the helper owns the asserts).
    let (owed_skeleton, owed_frame, witnessed_skeleton, witnessed_frame) =
        owed_probe(&state, scale);
    assert!(
        owed_skeleton > witnessed_skeleton && owed_frame > witnessed_frame,
        "the witnessed read is smaller on both loci and bytes"
    );

    // The composed write path at scale, the S181 record: `Composer::compose`
    // ran the pure `Dotted::merge`, and `Rhapsody::causal_merge` clones the
    // whole skeleton and rebuilds the whole child index via `from_parts`, so
    // a keystroke at skeleton size k re-touched every woven element. The S116
    // maintained index held on the bare-store `&mut weave` path only (one
    // bucket-insert comparison, the C8 probe's cached count). Closed-form
    // model, the index-cost probe's discipline; this is the number that fired
    // arc 8, and S182 rerouted the facade through the in-place fold
    // (`merge_from`), so the rebuild below is what the pure-merge path still
    // costs, not what the facade pays.
    let per_keystroke_rebuild = scale + 1;
    let session_rebuild_total = scale * (scale + 1) / 2;
    let session_weave_total = scale;
    assert!(
        per_keystroke_rebuild > scale,
        "one composed keystroke re-touches the whole skeleton"
    );
    assert!(
        session_rebuild_total / session_weave_total > 32_000,
        "a composed 65k session re-pays the rebuild tens of thousands of times over the weave path"
    );

    #[cfg(feature = "std")]
    {
        let frame_len = frame.len();
        let floored_context = floored.context().to_bytes().len();
        std::println!("\n=== EDITOR-SCALE PROBE (S181, 65,536 chars) ===");
        std::println!("snapshot frame:            {frame_len} bytes (42 bytes/locus, linear)");
        std::println!("per-render order() visits: {scale} (O(n) per caret re-render)");
        std::println!("floored keystroke context: {floored_context} bytes (scale-invariant)");
        std::println!(
            "owed fragment, one behind:  {owed_skeleton} loci / {owed_frame} bytes (bare owed read)"
        );
        std::println!(
            "witnessed owed, one behind: {witnessed_skeleton} locus / {witnessed_frame} bytes (arc-10 cure)"
        );
        std::println!(
            "composed keystroke rebuild: {per_keystroke_rebuild} entries (weave path: 1); session total {session_rebuild_total} vs {session_weave_total}"
        );
        std::println!("===============================================\n");
    }
}