uor-foundation 0.3.2

// @generated by uor-crate from uor-ontology — do not edit manually

//! Declarative enforcement types.
//!
//! This module contains the opaque witness types, declarative builders,
//! the Term AST, and the v0.2.1 ergonomics surface (sealed `Grounded<T>`,
//! the `Certify` trait, `PipelineFailure`, ring-op phantom wrappers,
//! fragment markers, dispatch tables, and the `prelude` module).
//!
//! # Layers
//!
//! - **Layer 1** \[Opaque Witnesses\]: `Datum`, `Validated<T>`, `Derivation`,
//!   `FreeRank` \[private fields, no public constructors\]
//! - **Layer 2** \[Declarative Builders\]: `CompileUnitBuilder`,
//!   `EffectDeclarationBuilder`, etc. \[produce `Validated<T>` on success\]
//! - **Term AST**: `Term`, `TermArena`, `Binding`, `Assertion`, etc.
//! - **v0.2.1 Ergonomics**: `OntologyTarget`, `GroundedShape`, `Grounded<T>`,
//!   `Certify`, `PipelineFailure`, `RingOp<L>`, fragment markers,
//!   `INHABITANCE_DISPATCH_TABLE`, and the `prelude` module.

use crate::{
    DecimalTranscendental, HostTypes, MetricAxis, PrimitiveOp, VerificationDomain, ViolationKind,
    WittLevel,
};
use core::marker::PhantomData;

/// Private sealed module preventing downstream implementations.
/// Only `GroundedCoord` and `GroundedTuple<N>` implement `Sealed`.
mod sealed {
    /// Sealed trait. Not publicly implementable because this module is private.
    pub trait Sealed {}
    impl Sealed for super::GroundedCoord {}
    impl<const N: usize> Sealed for super::GroundedTuple<N> {}
}

/// Internal level-tagged ring value. Width determined by the Witt level.
/// Variants are emitted parametrically from `schema:WittLevel` individuals
/// in the ontology; adding a new level to the ontology regenerates this enum.
/// Not publicly constructible \[sealed within the crate\].
#[derive(Debug, Clone, PartialEq, Eq)]
#[allow(clippy::large_enum_variant, dead_code)]
pub(crate) enum DatumInner {
    /// W8: 8-bit ring Z/(2^8)Z.
    W8([u8; 1]),
    /// W16: 16-bit ring Z/(2^16)Z.
    W16([u8; 2]),
    /// W24: 24-bit ring Z/(2^24)Z.
    W24([u8; 3]),
    /// W32: 32-bit ring Z/(2^32)Z.
    W32([u8; 4]),
    /// W40: 40-bit ring Z/(2^40)Z.
    W40([u8; 5]),
    /// W48: 48-bit ring Z/(2^48)Z.
    W48([u8; 6]),
    /// W56: 56-bit ring Z/(2^56)Z.
    W56([u8; 7]),
    /// W64: 64-bit ring Z/(2^64)Z.
    W64([u8; 8]),
    /// W72: 72-bit ring Z/(2^72)Z.
    W72([u8; 9]),
    /// W80: 80-bit ring Z/(2^80)Z.
    W80([u8; 10]),
    /// W88: 88-bit ring Z/(2^88)Z.
    W88([u8; 11]),
    /// W96: 96-bit ring Z/(2^96)Z.
    W96([u8; 12]),
    /// W104: 104-bit ring Z/(2^104)Z.
    W104([u8; 13]),
    /// W112: 112-bit ring Z/(2^112)Z.
    W112([u8; 14]),
    /// W120: 120-bit ring Z/(2^120)Z.
    W120([u8; 15]),
    /// W128: 128-bit ring Z/(2^128)Z.
    W128([u8; 16]),
}

/// A ring element at its minting Witt level.
/// Cannot be constructed outside the `uor_foundation` crate.
/// The only way to obtain a `Datum` is through reduction evaluation
/// or the two-phase minting boundary (`validate_and_mint_coord` /
/// `validate_and_mint_tuple`).
/// # Examples
/// ```no_run
/// // A Datum is produced by reduction evaluation or the minting boundary —
/// // you never construct one directly.
/// fn inspect_datum(d: &uor_foundation::enforcement::Datum) {
///     // Query its Witt level (W8 = 8-bit, W32 = 32-bit, etc.)
///     let _level = d.level();
///     // Datum width is determined by its level:
///     //   W8 → 1 byte,  W16 → 2 bytes,  W24 → 3 bytes,  W32 → 4 bytes.
///     let _bytes = d.as_bytes();
/// }
/// ```
#[derive(Debug, Clone, PartialEq, Eq)]
pub struct Datum {
    /// Level-tagged ring value \[sealed\].
    inner: DatumInner,
}

impl Datum {
    /// Returns the Witt level at which this datum was minted.
    #[inline]
    #[must_use]
    pub const fn level(&self) -> WittLevel {
        match self.inner {
            DatumInner::W8(_) => WittLevel::W8,
            DatumInner::W16(_) => WittLevel::W16,
            DatumInner::W24(_) => WittLevel::new(24),
            DatumInner::W32(_) => WittLevel::new(32),
            DatumInner::W40(_) => WittLevel::new(40),
            DatumInner::W48(_) => WittLevel::new(48),
            DatumInner::W56(_) => WittLevel::new(56),
            DatumInner::W64(_) => WittLevel::new(64),
            DatumInner::W72(_) => WittLevel::new(72),
            DatumInner::W80(_) => WittLevel::new(80),
            DatumInner::W88(_) => WittLevel::new(88),
            DatumInner::W96(_) => WittLevel::new(96),
            DatumInner::W104(_) => WittLevel::new(104),
            DatumInner::W112(_) => WittLevel::new(112),
            DatumInner::W120(_) => WittLevel::new(120),
            DatumInner::W128(_) => WittLevel::new(128),
        }
    }

    /// Returns the raw byte representation of this datum.
    #[inline]
    #[must_use]
    pub fn as_bytes(&self) -> &[u8] {
        match &self.inner {
            DatumInner::W8(b) => b,
            DatumInner::W16(b) => b,
            DatumInner::W24(b) => b,
            DatumInner::W32(b) => b,
            DatumInner::W40(b) => b,
            DatumInner::W48(b) => b,
            DatumInner::W56(b) => b,
            DatumInner::W64(b) => b,
            DatumInner::W72(b) => b,
            DatumInner::W80(b) => b,
            DatumInner::W88(b) => b,
            DatumInner::W96(b) => b,
            DatumInner::W104(b) => b,
            DatumInner::W112(b) => b,
            DatumInner::W120(b) => b,
            DatumInner::W128(b) => b,
        }
    }
}

/// Internal level-tagged coordinate value for grounding intermediates.
/// Variant set mirrors `DatumInner`: one per `schema:WittLevel`.
#[derive(Debug, Clone, PartialEq, Eq)]
#[allow(clippy::large_enum_variant, dead_code)]
pub(crate) enum GroundedCoordInner {
    /// W8: 8-bit coordinate.
    W8([u8; 1]),
    /// W16: 16-bit coordinate.
    W16([u8; 2]),
    /// W24: 24-bit coordinate.
    W24([u8; 3]),
    /// W32: 32-bit coordinate.
    W32([u8; 4]),
    /// W40: 40-bit coordinate.
    W40([u8; 5]),
    /// W48: 48-bit coordinate.
    W48([u8; 6]),
    /// W56: 56-bit coordinate.
    W56([u8; 7]),
    /// W64: 64-bit coordinate.
    W64([u8; 8]),
    /// W72: 72-bit coordinate.
    W72([u8; 9]),
    /// W80: 80-bit coordinate.
    W80([u8; 10]),
    /// W88: 88-bit coordinate.
    W88([u8; 11]),
    /// W96: 96-bit coordinate.
    W96([u8; 12]),
    /// W104: 104-bit coordinate.
    W104([u8; 13]),
    /// W112: 112-bit coordinate.
    W112([u8; 14]),
    /// W120: 120-bit coordinate.
    W120([u8; 15]),
    /// W128: 128-bit coordinate.
    W128([u8; 16]),
}

/// A single grounded coordinate value.
/// Not a `Datum` \[this is the narrow intermediate that a `Grounding`
/// impl produces\]. The foundation validates and mints it into a `Datum`.
/// Uses the same closed level-tagged family as `Datum`, ensuring that
/// coordinate width matches the target Witt level.
/// # Examples
/// ```rust
/// use uor_foundation::enforcement::GroundedCoord;
///
/// // W8: 8-bit ring Z/256Z — lightweight, exhaustive-verification baseline
/// let byte_coord = GroundedCoord::w8(42);
///
/// // W16: 16-bit ring Z/65536Z — audio samples, small indices
/// let short_coord = GroundedCoord::w16(1000);
///
/// // W32: 32-bit ring Z/2^32Z — pixel data, general-purpose integers
/// let word_coord = GroundedCoord::w32(70_000);
/// ```
#[derive(Debug, Clone, PartialEq, Eq)]
pub struct GroundedCoord {
    /// Level-tagged coordinate bytes.
    pub(crate) inner: GroundedCoordInner,
}

impl GroundedCoord {
    /// Construct a W8 coordinate from a `u8` value (little-endian).
    #[inline]
    #[must_use]
    pub const fn w8(value: u8) -> Self {
        Self {
            inner: GroundedCoordInner::W8(value.to_le_bytes()),
        }
    }

    /// Construct a W16 coordinate from a `u16` value (little-endian).
    #[inline]
    #[must_use]
    pub const fn w16(value: u16) -> Self {
        Self {
            inner: GroundedCoordInner::W16(value.to_le_bytes()),
        }
    }

    /// Construct a W24 coordinate from a `u32` value (little-endian).
    #[inline]
    #[must_use]
    pub const fn w24(value: u32) -> Self {
        let full = value.to_le_bytes();
        let mut out = [0u8; 3];
        let mut i = 0;
        while i < 3 {
            out[i] = full[i];
            i += 1;
        }
        Self {
            inner: GroundedCoordInner::W24(out),
        }
    }

    /// Construct a W32 coordinate from a `u32` value (little-endian).
    #[inline]
    #[must_use]
    pub const fn w32(value: u32) -> Self {
        Self {
            inner: GroundedCoordInner::W32(value.to_le_bytes()),
        }
    }

    /// Construct a W40 coordinate from a `u64` value (little-endian).
    #[inline]
    #[must_use]
    pub const fn w40(value: u64) -> Self {
        let full = value.to_le_bytes();
        let mut out = [0u8; 5];
        let mut i = 0;
        while i < 5 {
            out[i] = full[i];
            i += 1;
        }
        Self {
            inner: GroundedCoordInner::W40(out),
        }
    }

    /// Construct a W48 coordinate from a `u64` value (little-endian).
    #[inline]
    #[must_use]
    pub const fn w48(value: u64) -> Self {
        let full = value.to_le_bytes();
        let mut out = [0u8; 6];
        let mut i = 0;
        while i < 6 {
            out[i] = full[i];
            i += 1;
        }
        Self {
            inner: GroundedCoordInner::W48(out),
        }
    }

    /// Construct a W56 coordinate from a `u64` value (little-endian).
    #[inline]
    #[must_use]
    pub const fn w56(value: u64) -> Self {
        let full = value.to_le_bytes();
        let mut out = [0u8; 7];
        let mut i = 0;
        while i < 7 {
            out[i] = full[i];
            i += 1;
        }
        Self {
            inner: GroundedCoordInner::W56(out),
        }
    }

    /// Construct a W64 coordinate from a `u64` value (little-endian).
    #[inline]
    #[must_use]
    pub const fn w64(value: u64) -> Self {
        Self {
            inner: GroundedCoordInner::W64(value.to_le_bytes()),
        }
    }

    /// Construct a W72 coordinate from a `u128` value (little-endian).
    #[inline]
    #[must_use]
    pub const fn w72(value: u128) -> Self {
        let full = value.to_le_bytes();
        let mut out = [0u8; 9];
        let mut i = 0;
        while i < 9 {
            out[i] = full[i];
            i += 1;
        }
        Self {
            inner: GroundedCoordInner::W72(out),
        }
    }

    /// Construct a W80 coordinate from a `u128` value (little-endian).
    #[inline]
    #[must_use]
    pub const fn w80(value: u128) -> Self {
        let full = value.to_le_bytes();
        let mut out = [0u8; 10];
        let mut i = 0;
        while i < 10 {
            out[i] = full[i];
            i += 1;
        }
        Self {
            inner: GroundedCoordInner::W80(out),
        }
    }

    /// Construct a W88 coordinate from a `u128` value (little-endian).
    #[inline]
    #[must_use]
    pub const fn w88(value: u128) -> Self {
        let full = value.to_le_bytes();
        let mut out = [0u8; 11];
        let mut i = 0;
        while i < 11 {
            out[i] = full[i];
            i += 1;
        }
        Self {
            inner: GroundedCoordInner::W88(out),
        }
    }

    /// Construct a W96 coordinate from a `u128` value (little-endian).
    #[inline]
    #[must_use]
    pub const fn w96(value: u128) -> Self {
        let full = value.to_le_bytes();
        let mut out = [0u8; 12];
        let mut i = 0;
        while i < 12 {
            out[i] = full[i];
            i += 1;
        }
        Self {
            inner: GroundedCoordInner::W96(out),
        }
    }

    /// Construct a W104 coordinate from a `u128` value (little-endian).
    #[inline]
    #[must_use]
    pub const fn w104(value: u128) -> Self {
        let full = value.to_le_bytes();
        let mut out = [0u8; 13];
        let mut i = 0;
        while i < 13 {
            out[i] = full[i];
            i += 1;
        }
        Self {
            inner: GroundedCoordInner::W104(out),
        }
    }

    /// Construct a W112 coordinate from a `u128` value (little-endian).
    #[inline]
    #[must_use]
    pub const fn w112(value: u128) -> Self {
        let full = value.to_le_bytes();
        let mut out = [0u8; 14];
        let mut i = 0;
        while i < 14 {
            out[i] = full[i];
            i += 1;
        }
        Self {
            inner: GroundedCoordInner::W112(out),
        }
    }

    /// Construct a W120 coordinate from a `u128` value (little-endian).
    #[inline]
    #[must_use]
    pub const fn w120(value: u128) -> Self {
        let full = value.to_le_bytes();
        let mut out = [0u8; 15];
        let mut i = 0;
        while i < 15 {
            out[i] = full[i];
            i += 1;
        }
        Self {
            inner: GroundedCoordInner::W120(out),
        }
    }

    /// Construct a W128 coordinate from a `u128` value (little-endian).
    #[inline]
    #[must_use]
    pub const fn w128(value: u128) -> Self {
        let full = value.to_le_bytes();
        let mut out = [0u8; 16];
        let mut i = 0;
        while i < 16 {
            out[i] = full[i];
            i += 1;
        }
        Self {
            inner: GroundedCoordInner::W128(out),
        }
    }
}

/// A grounded tuple: a fixed-size array of `GroundedCoord` values.
/// Represents a structured type (e.g., the 8 coordinates of an E8
/// lattice point). Not a `Datum` until the foundation validates and
/// mints it. Stack-resident, no heap allocation.
/// # Examples
/// ```rust
/// use uor_foundation::enforcement::{GroundedCoord, GroundedTuple};
///
/// // A 2D pixel: (red, green) at W8 (8-bit per channel)
/// let pixel = GroundedTuple::new([
///     GroundedCoord::w8(255), // red channel
///     GroundedCoord::w8(128), // green channel
/// ]);
///
/// // An E8 lattice point: 8 coordinates at W8
/// let lattice_point = GroundedTuple::new([
///     GroundedCoord::w8(2), GroundedCoord::w8(0),
///     GroundedCoord::w8(0), GroundedCoord::w8(0),
///     GroundedCoord::w8(0), GroundedCoord::w8(0),
///     GroundedCoord::w8(0), GroundedCoord::w8(0),
/// ]);
/// ```
#[derive(Debug, Clone, PartialEq, Eq)]
pub struct GroundedTuple<const N: usize> {
    /// The coordinate array.
    pub(crate) coords: [GroundedCoord; N],
}

impl<const N: usize> GroundedTuple<N> {
    /// Construct a tuple from a fixed-size array of coordinates.
    #[inline]
    #[must_use]
    pub const fn new(coords: [GroundedCoord; N]) -> Self {
        Self { coords }
    }
}

/// Sealed marker trait for grounded intermediates.
/// Implemented only for `GroundedCoord` and `GroundedTuple<N>`.
/// Prism code cannot implement this \[the sealed module pattern
/// prevents it\].
pub trait GroundedValue: sealed::Sealed {}
impl GroundedValue for GroundedCoord {}
impl<const N: usize> GroundedValue for GroundedTuple<N> {}

/// Target §3: sealed marker trait shared by all morphism kinds.
/// `GroundingMapKind` (inbound) and `ProjectionMapKind` (outbound) both
/// extend this trait; the four structural markers (`Total`, `Invertible`,
/// `PreservesStructure`, `PreservesMetric`) are bounded on `MorphismKind`.
pub trait MorphismKind: morphism_kind_sealed::Sealed {
    /// The ontology IRI of this morphism kind.
    const ONTOLOGY_IRI: &'static str;
}

/// v0.2.2 W4: sealed marker trait for the kind of a `Grounding` map.
/// Implemented by exactly the `morphism:GroundingMap` individuals declared in
/// the ontology; downstream cannot extend the kind set.
pub trait GroundingMapKind: MorphismKind + grounding_map_kind_sealed::Sealed {}

/// Target §3: sealed marker trait for the kind of a `Sinking` projection.
/// Implemented by exactly the `morphism:ProjectionMap` individuals declared
/// in the ontology; downstream cannot extend the kind set.
pub trait ProjectionMapKind: MorphismKind + projection_map_kind_sealed::Sealed {}

/// v0.2.2 W4: kinds whose image is total over the input domain
/// (every input maps successfully).
pub trait Total: MorphismKind {}

/// v0.2.2 W4: kinds whose map is injective and admits an inverse on its image.
pub trait Invertible: MorphismKind {}

/// v0.2.2 W4: kinds whose map preserves the algebraic structure of the
/// source domain (homomorphism-like).
pub trait PreservesStructure: MorphismKind {}

/// v0.2.2 W4: kinds whose map preserves the metric of the source domain
/// (isometry-like).
pub trait PreservesMetric: MorphismKind {}

/// v0.2.2 W4: kind for raw byte ingestion. Total and invertible; preserves bit identity only.
#[derive(Debug, Default, Clone, Copy, PartialEq, Eq, Hash)]
pub struct BinaryGroundingMap;

/// v0.2.2 W4: kind for one-way digest functions (e.g., SHA-256). Total but not invertible; preserves no structure.
#[derive(Debug, Default, Clone, Copy, PartialEq, Eq, Hash)]
pub struct DigestGroundingMap;

/// v0.2.2 W4: kind for integer surface symbols. Total, invertible, structure-preserving.
#[derive(Debug, Default, Clone, Copy, PartialEq, Eq, Hash)]
pub struct IntegerGroundingMap;

/// v0.2.2 W4: kind for JSON host strings. Invertible on its image, structure-preserving.
#[derive(Debug, Default, Clone, Copy, PartialEq, Eq, Hash)]
pub struct JsonGroundingMap;

/// v0.2.2 W4: kind for UTF-8 host strings. Invertible on its image, structure-preserving.
#[derive(Debug, Default, Clone, Copy, PartialEq, Eq, Hash)]
pub struct Utf8GroundingMap;

/// Target §3: kind for raw byte projections. Total and invertible; preserves bit identity only.
#[derive(Debug, Default, Clone, Copy, PartialEq, Eq, Hash)]
pub struct BinaryProjectionMap;

/// Target §3: kind for fixed-size digests projected outward. Total but not invertible; preserves no structure.
#[derive(Debug, Default, Clone, Copy, PartialEq, Eq, Hash)]
pub struct DigestProjectionMap;

/// Target §3: kind for integer surface symbols projected outward. Invertible, structure-preserving.
#[derive(Debug, Default, Clone, Copy, PartialEq, Eq, Hash)]
pub struct IntegerProjectionMap;

/// Target §3: kind for JSON host strings projected outward. Invertible, structure-preserving.
#[derive(Debug, Default, Clone, Copy, PartialEq, Eq, Hash)]
pub struct JsonProjectionMap;

/// Target §3: kind for UTF-8 host strings projected outward. Invertible, structure-preserving.
#[derive(Debug, Default, Clone, Copy, PartialEq, Eq, Hash)]
pub struct Utf8ProjectionMap;

mod morphism_kind_sealed {
    /// Private supertrait for MorphismKind. Not implementable outside this crate.
    pub trait Sealed {}
    impl Sealed for super::BinaryGroundingMap {}
    impl Sealed for super::DigestGroundingMap {}
    impl Sealed for super::IntegerGroundingMap {}
    impl Sealed for super::JsonGroundingMap {}
    impl Sealed for super::Utf8GroundingMap {}
    impl Sealed for super::BinaryProjectionMap {}
    impl Sealed for super::DigestProjectionMap {}
    impl Sealed for super::IntegerProjectionMap {}
    impl Sealed for super::JsonProjectionMap {}
    impl Sealed for super::Utf8ProjectionMap {}
}

mod grounding_map_kind_sealed {
    /// Private supertrait. Not implementable outside this crate.
    pub trait Sealed {}
    impl Sealed for super::BinaryGroundingMap {}
    impl Sealed for super::DigestGroundingMap {}
    impl Sealed for super::IntegerGroundingMap {}
    impl Sealed for super::JsonGroundingMap {}
    impl Sealed for super::Utf8GroundingMap {}
}

mod projection_map_kind_sealed {
    /// Private supertrait. Not implementable outside this crate.
    pub trait Sealed {}
    impl Sealed for super::BinaryProjectionMap {}
    impl Sealed for super::DigestProjectionMap {}
    impl Sealed for super::IntegerProjectionMap {}
    impl Sealed for super::JsonProjectionMap {}
    impl Sealed for super::Utf8ProjectionMap {}
}

impl MorphismKind for BinaryGroundingMap {
    const ONTOLOGY_IRI: &'static str = "https://uor.foundation/morphism/BinaryGroundingMap";
}

impl MorphismKind for DigestGroundingMap {
    const ONTOLOGY_IRI: &'static str = "https://uor.foundation/morphism/DigestGroundingMap";
}

impl MorphismKind for IntegerGroundingMap {
    const ONTOLOGY_IRI: &'static str = "https://uor.foundation/morphism/IntegerGroundingMap";
}

impl MorphismKind for JsonGroundingMap {
    const ONTOLOGY_IRI: &'static str = "https://uor.foundation/morphism/JsonGroundingMap";
}

impl MorphismKind for Utf8GroundingMap {
    const ONTOLOGY_IRI: &'static str = "https://uor.foundation/morphism/Utf8GroundingMap";
}

impl MorphismKind for BinaryProjectionMap {
    const ONTOLOGY_IRI: &'static str = "https://uor.foundation/morphism/BinaryProjectionMap";
}

impl MorphismKind for DigestProjectionMap {
    const ONTOLOGY_IRI: &'static str = "https://uor.foundation/morphism/DigestProjectionMap";
}

impl MorphismKind for IntegerProjectionMap {
    const ONTOLOGY_IRI: &'static str = "https://uor.foundation/morphism/IntegerProjectionMap";
}

impl MorphismKind for JsonProjectionMap {
    const ONTOLOGY_IRI: &'static str = "https://uor.foundation/morphism/JsonProjectionMap";
}

impl MorphismKind for Utf8ProjectionMap {
    const ONTOLOGY_IRI: &'static str = "https://uor.foundation/morphism/Utf8ProjectionMap";
}

impl GroundingMapKind for BinaryGroundingMap {}
impl GroundingMapKind for DigestGroundingMap {}
impl GroundingMapKind for IntegerGroundingMap {}
impl GroundingMapKind for JsonGroundingMap {}
impl GroundingMapKind for Utf8GroundingMap {}

impl ProjectionMapKind for BinaryProjectionMap {}
impl ProjectionMapKind for DigestProjectionMap {}
impl ProjectionMapKind for IntegerProjectionMap {}
impl ProjectionMapKind for JsonProjectionMap {}
impl ProjectionMapKind for Utf8ProjectionMap {}

impl Total for IntegerGroundingMap {}
impl Invertible for IntegerGroundingMap {}
impl PreservesStructure for IntegerGroundingMap {}

impl Invertible for Utf8GroundingMap {}
impl PreservesStructure for Utf8GroundingMap {}

impl Invertible for JsonGroundingMap {}
impl PreservesStructure for JsonGroundingMap {}

impl Total for DigestGroundingMap {}

impl Total for BinaryGroundingMap {}
impl Invertible for BinaryGroundingMap {}

impl Invertible for IntegerProjectionMap {}
impl PreservesStructure for IntegerProjectionMap {}

impl Invertible for Utf8ProjectionMap {}
impl PreservesStructure for Utf8ProjectionMap {}

impl Invertible for JsonProjectionMap {}
impl PreservesStructure for JsonProjectionMap {}

impl Total for DigestProjectionMap {}

impl Total for BinaryProjectionMap {}
impl Invertible for BinaryProjectionMap {}

/// Open trait for boundary crossing: external data to grounded intermediate.
/// The foundation validates the returned value against the declared
/// `GroundingShape` and mints it into a `Datum` if conformant.
/// v0.2.2 W4 adds the `Map: GroundingMapKind` associated type — every impl
/// must declare what *kind* of grounding map it is. Foundation operations
/// that require structure preservation gate on `<G as Grounding>::Map: PreservesStructure`,
/// and a digest-style impl is rejected at the call site.
/// # Examples
/// ```no_run
/// use uor_foundation::enforcement::{
///     Grounding, GroundedCoord, GroundingProgram, BinaryGroundingMap, combinators,
/// };
///
/// /// Byte-passthrough grounding: reads the first byte of input as a W8 Datum.
/// struct PassthroughGrounding;
///
/// impl Grounding for PassthroughGrounding {
///     type Output = GroundedCoord;
///     type Map = BinaryGroundingMap;
///
///     // Phase K: provide the combinator program; the type system verifies
///     // at compile time that its marker tuple matches Self::Map via
///     // GroundingProgram::from_primitive's MarkersImpliedBy<Map> bound.
///     fn program(&self) -> GroundingProgram<GroundedCoord, BinaryGroundingMap> {
///         GroundingProgram::from_primitive(combinators::read_bytes::<GroundedCoord>())
///     }
///     // Foundation supplies `ground()` via the sealed `GroundingExt`
///     // extension trait — downstream implementers provide only `program()`.
/// }
/// ```
pub trait Grounding {
    /// The grounded intermediate type. Bounded by `GroundedValue`,
    /// which is sealed \[only `GroundedCoord` and `GroundedTuple<N>`
    /// are permitted\].
    type Output: GroundedValue;

    /// v0.2.2 W4: the kind of grounding map this impl is. Sealed to the
    /// set of `morphism:GroundingMap` individuals declared in the
    /// ontology. Every impl must declare the kind explicitly; if no kind
    /// applies, use `BinaryGroundingMap` (the most permissive — total +
    /// invertible, no structure preservation).
    type Map: GroundingMapKind;

    /// Phase K / W4 closure (target §4.3 + §9 criterion 1): the combinator
    /// program that decomposes this grounding. The program's `Map` parameter
    /// equals the impl's `Map` associated type, so the kind discriminator is
    /// mechanically verifiable from the combinator decomposition — not a
    /// promise. This is the only required method; `ground` is foundation-
    /// supplied via `GroundingExt`.
    fn program(&self) -> GroundingProgram<Self::Output, Self::Map>;
}

/// W4 closure (target §4.3 + §9 criterion 1): foundation-authored
/// extension trait that supplies `ground()` for every `Grounding`
/// impl. Downstream implementers provide only `program()`;
/// the foundation runs it via the blanket `impl<G: Grounding>`
/// below. The sealed supertrait prevents downstream from
/// implementing `GroundingExt` directly — there is no second path.
mod grounding_ext_sealed {
    /// Private supertrait. Not implementable outside this crate.
    pub trait Sealed {}
    impl<G: super::Grounding> Sealed for G {}
}

/// Crate-internal bridge from `GroundingProgram` to `Option<Out>`.
/// Blanket-impl'd for the two `GroundedValue` members
/// (`GroundedCoord` and `GroundedTuple<N>`) so the `GroundingExt`
/// blanket compiles for any output in the closed set.
pub trait GroundingProgramRun<Out> {
    /// Run the program on external bytes.
    fn run_program(&self, external: &[u8]) -> Option<Out>;
}

impl<Map: GroundingMapKind> GroundingProgramRun<GroundedCoord>
    for GroundingProgram<GroundedCoord, Map>
{
    #[inline]
    fn run_program(&self, external: &[u8]) -> Option<GroundedCoord> {
        self.run(external)
    }
}

impl<const N: usize, Map: GroundingMapKind> GroundingProgramRun<GroundedTuple<N>>
    for GroundingProgram<GroundedTuple<N>, Map>
{
    #[inline]
    fn run_program(&self, external: &[u8]) -> Option<GroundedTuple<N>> {
        self.run(external)
    }
}

/// Foundation-supplied `ground()` for every `Grounding` impl.
/// The blanket `impl<G: Grounding> GroundingExt for G` below
/// routes every call of `.ground(bytes)` through
/// `self.program().run_program(bytes)`. Downstream cannot
/// override this path: `GroundingExt` has a sealed supertrait
/// and downstream cannot impl `GroundingExt` directly.
pub trait GroundingExt: Grounding + grounding_ext_sealed::Sealed {
    /// Map external bytes into a grounded value via this impl's combinator program.
    /// Returns `None` when the combinator chain rejects the input (e.g. empty slice
    /// for `ReadBytes`, malformed UTF-8 for `DecodeUtf8`).
    fn ground(&self, external: &[u8]) -> Option<Self::Output>;
}

impl<G: Grounding> GroundingExt for G
where
    GroundingProgram<G::Output, G::Map>: GroundingProgramRun<G::Output>,
{
    #[inline]
    fn ground(&self, external: &[u8]) -> Option<Self::Output> {
        self.program().run_program(external)
    }
}

/// Target §3 + §4.6: the foundation-owned operational contract for outbound
/// boundary crossings. Dual of `Grounding`.
/// A `Sinking` impl projects a `Grounded<Source>` value to a host-side
/// `Output` through a specific `ProjectionMap` kind. The `&Grounded<Source>`
/// input is structurally unforgeable (sealed per §2) — no raw data can be
/// laundered through this contract. Downstream authors implement `Sinking`
/// for their projection types; the foundation guarantees the input pedigree.
/// # Examples
/// ```no_run
/// use uor_foundation::enforcement::{
///     Grounded, Sinking, Utf8ProjectionMap, ConstrainedTypeInput,
/// };
///
/// struct MyJsonSink;
///
/// impl Sinking for MyJsonSink {
///     type Source = ConstrainedTypeInput;
///     type ProjectionMap = Utf8ProjectionMap;
///     type Output = String;
///
///     fn project(&self, grounded: &Grounded<ConstrainedTypeInput>) -> String {
///         format!("{:?}", grounded.unit_address())
///     }
/// }
/// ```
pub trait Sinking {
    /// The ring-side shape `T` carried by the `Grounded<T>` being projected.
    /// Sealed via `GroundedShape` — downstream cannot forge an admissible Source.
    type Source: GroundedShape;

    /// The ontology-declared ProjectionMap kind this impl serves. Sealed to
    /// the closed set of `morphism:ProjectionMap` individuals.
    type ProjectionMap: ProjectionMapKind;

    /// The host-side output type of this projection. Intentionally generic —
    /// downstream chooses `String`, `Vec<u8>`, `serde_json::Value`, or any
    /// host-appropriate carrier.
    type Output;

    /// Project a grounded ring value to the host output. The `&Grounded<Source>`
    /// input is unforgeable (Grounded is sealed per §2) — no raw data can be
    /// laundered through this contract.
    fn project(&self, grounded: &Grounded<Self::Source>) -> Self::Output;
}

/// Target §4.6: extension trait tying `EmitEffect<H>` (ontology-declarative)
/// to `Sinking` (Rust-operational). Emit-effect implementations carry a
/// specific `Sinking` impl; the emit operation threads a sealed
/// `Grounded<Source>` through the projection.
pub trait EmitThrough<H: crate::HostTypes>: crate::bridge::boundary::EmitEffect<H> {
    /// The `Sinking` implementation this emit-effect routes through.
    type Sinking: Sinking;

    /// Emit a grounded value through this effect's bound `Sinking`. The
    /// input type is the sealed `Grounded<Source>` of the bound `Sinking`;
    /// nothing else is admissible.
    fn emit(
        &self,
        grounded: &Grounded<<Self::Sinking as Sinking>::Source>,
    ) -> <Self::Sinking as Sinking>::Output;
}

/// v0.2.2 W13: sealed marker trait for the validation phase at which a
/// `Validated<T, Phase>` was witnessed. Implemented only by `CompileTime`
/// and `Runtime`; downstream cannot extend.
pub trait ValidationPhase: validation_phase_sealed::Sealed {}

mod validation_phase_sealed {
    /// Private supertrait. Not implementable outside this crate.
    pub trait Sealed {}
    impl Sealed for super::CompileTime {}
    impl Sealed for super::Runtime {}
}

/// v0.2.2 W13: marker for compile-time validated witnesses produced by
/// `validate_const()` and usable in `const` contexts. Convertible to
/// `Validated<T, Runtime>` via `From`.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
pub struct CompileTime;
impl ValidationPhase for CompileTime {}

/// v0.2.2 W13: marker for runtime-validated witnesses produced by
/// `validate()`. The default phase of `Validated<T>` so v0.2.1 call
/// sites continue to compile.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
pub struct Runtime;
impl ValidationPhase for Runtime {}

/// Proof that a value was produced by the conformance checker,
/// not fabricated by Prism code.
/// The inner value and `_sealed` field are private, so `Validated<T>`
/// can only be constructed within this crate.
/// v0.2.2 W13: parameterized by a `Phase: ValidationPhase` discriminator.
/// `Validated<T, CompileTime>` was witnessed by `validate_const()` and is
/// usable in const contexts. `Validated<T, Runtime>` (the default) was
/// witnessed by `validate()`. A `CompileTime` witness is convertible to
/// a `Runtime` witness via `From`.
/// # Examples
/// ```no_run
/// use uor_foundation::enforcement::{CompileUnitBuilder, ConstrainedTypeInput, Term};
/// use uor_foundation::{WittLevel, VerificationDomain};
///
/// // Validated<T> proves that a value passed conformance checking.
/// // You cannot construct one directly — only builder validate() methods
/// // and the minting boundary produce them.
/// let terms = [Term::Literal { value: 1, level: WittLevel::W8 }];
/// let domains = [VerificationDomain::Enumerative];
///
/// let validated = CompileUnitBuilder::new()
///     .root_term(&terms)
///     .witt_level_ceiling(WittLevel::W8)
///     .thermodynamic_budget(1024)
///     .target_domains(&domains)
///     .result_type::<ConstrainedTypeInput>()
///     .validate()
///     .expect("all fields set");
///
/// // Access the inner value through the proof wrapper:
/// let _compile_unit = validated.inner();
/// ```
#[derive(Debug, Clone, PartialEq, Eq)]
pub struct Validated<T, Phase: ValidationPhase = Runtime> {
    /// The validated inner value.
    inner: T,
    /// Phantom marker for the validation phase (`CompileTime` or `Runtime`).
    _phase: PhantomData<Phase>,
    /// Prevents external construction.
    _sealed: (),
}

impl<T, Phase: ValidationPhase> Validated<T, Phase> {
    /// Returns a reference to the validated inner value.
    #[inline]
    #[must_use]
    pub const fn inner(&self) -> &T {
        &self.inner
    }

    /// Creates a new `Validated<T, Phase>` wrapper. Only callable within the crate.
    #[inline]
    #[allow(dead_code)]
    pub(crate) const fn new(inner: T) -> Self {
        Self {
            inner,
            _phase: PhantomData,
            _sealed: (),
        }
    }
}

/// v0.2.2 W13: a compile-time witness is usable wherever a runtime witness is required.
impl<T> From<Validated<T, CompileTime>> for Validated<T, Runtime> {
    #[inline]
    fn from(value: Validated<T, CompileTime>) -> Self {
        Self {
            inner: value.inner,
            _phase: PhantomData,
            _sealed: (),
        }
    }
}

/// An opaque derivation trace that can only be extended by the rewrite engine.
/// Records the rewrite-step count, the source `witt_level_bits`, and the
/// parametric `content_fingerprint`. Private fields prevent external
/// construction; produced exclusively by `Grounded::derivation()` so the
/// verify path can re-derive the source certificate via
/// `Derivation::replay() -> Trace -> verify_trace`.
#[derive(Debug, Clone, PartialEq, Eq)]
pub struct Derivation {
    /// Number of rewrite steps in this derivation.
    step_count: u32,
    /// v0.2.2 T5: Witt level the source grounding was minted at. Carried
    /// through replay so the verifier can reconstruct the certificate.
    witt_level_bits: u16,
    /// v0.2.2 T5: parametric content fingerprint of the source unit's
    /// full state, computed at grounding time by the consumer-supplied
    /// `Hasher`. Carried through replay so the verifier can reproduce
    /// the source certificate via passthrough.
    content_fingerprint: ContentFingerprint,
}

impl Derivation {
    /// Returns the number of rewrite steps.
    #[inline]
    #[must_use]
    pub const fn step_count(&self) -> u32 {
        self.step_count
    }

    /// v0.2.2 T5: returns the Witt level the source grounding was minted at.
    #[inline]
    #[must_use]
    pub const fn witt_level_bits(&self) -> u16 {
        self.witt_level_bits
    }

    /// v0.2.2 T5: returns the parametric content fingerprint of the source
    /// unit, computed at grounding time by the consumer-supplied `Hasher`.
    #[inline]
    #[must_use]
    pub const fn content_fingerprint(&self) -> ContentFingerprint {
        self.content_fingerprint
    }

    /// Creates a new derivation. Only callable within the crate.
    #[inline]
    #[must_use]
    #[allow(dead_code)]
    pub(crate) const fn new(
        step_count: u32,
        witt_level_bits: u16,
        content_fingerprint: ContentFingerprint,
    ) -> Self {
        Self {
            step_count,
            witt_level_bits,
            content_fingerprint,
        }
    }
}

/// An opaque free rank that can only be decremented by `PinningEffect`
/// and incremented by `UnbindingEffect` \[never by direct mutation\].
#[derive(Debug, Clone, PartialEq, Eq)]
pub struct FreeRank {
    /// Total site capacity at the Witt level.
    total: u32,
    /// Currently pinned sites.
    pinned: u32,
}

impl FreeRank {
    /// Returns the total site capacity.
    #[inline]
    #[must_use]
    pub const fn total(&self) -> u32 {
        self.total
    }

    /// Returns the number of currently pinned sites.
    #[inline]
    #[must_use]
    pub const fn pinned(&self) -> u32 {
        self.pinned
    }

    /// Returns the number of remaining (unpinned) sites.
    #[inline]
    #[must_use]
    pub const fn remaining(&self) -> u32 {
        self.total - self.pinned
    }

    /// Creates a new free rank. Only callable within the crate.
    #[inline]
    #[allow(dead_code)]
    pub(crate) const fn new(total: u32, pinned: u32) -> Self {
        Self { total, pinned }
    }
}

/// v0.2.2 Phase A: sealed `H::Decimal`-backed newtype carrying the
/// `observable:LandauerCost` accumulator in `observable:Nats`.
/// Monotonic within a pipeline invocation. The UOR ring operates
/// at the Landauer temperature (β* = ln 2), so this observable is
/// a direct measure of irreversible bit-erasure performed.
/// Phase 9: parameterized over `H: HostTypes` so the underlying
/// decimal type tracks the host's chosen precision.
#[derive(Debug)]
pub struct LandauerBudget<H: HostTypes = crate::DefaultHostTypes> {
    /// Accumulated Landauer cost in nats. Non-negative, finite.
    nats: H::Decimal,
    /// Phantom marker pinning the host type.
    _phantom: core::marker::PhantomData<H>,
    /// Prevents external construction.
    _sealed: (),
}

impl<H: HostTypes> LandauerBudget<H> {
    /// Returns the accumulated Landauer cost in nats.
    #[inline]
    #[must_use]
    pub const fn nats(&self) -> H::Decimal {
        self.nats
    }

    /// Crate-internal constructor. Caller guarantees `nats` is
    /// non-negative and finite (i.e. not NaN, not infinite).
    #[inline]
    #[must_use]
    #[allow(dead_code)]
    pub(crate) const fn new(nats: H::Decimal) -> Self {
        Self {
            nats,
            _phantom: core::marker::PhantomData,
            _sealed: (),
        }
    }

    /// Crate-internal constructor for the zero-cost initial budget.
    #[inline]
    #[must_use]
    #[allow(dead_code)]
    pub(crate) const fn zero() -> Self {
        Self {
            nats: H::EMPTY_DECIMAL,
            _phantom: core::marker::PhantomData,
            _sealed: (),
        }
    }
}

impl<H: HostTypes> Copy for LandauerBudget<H> {}
impl<H: HostTypes> Clone for LandauerBudget<H> {
    #[inline]
    fn clone(&self) -> Self {
        *self
    }
}
impl<H: HostTypes> PartialEq for LandauerBudget<H> {
    #[inline]
    fn eq(&self, other: &Self) -> bool {
        self.nats == other.nats
    }
}
impl<H: HostTypes> Eq for LandauerBudget<H> {}
impl<H: HostTypes> PartialOrd for LandauerBudget<H> {
    #[inline]
    fn partial_cmp(&self, other: &Self) -> Option<core::cmp::Ordering> {
        Some(self.cmp(other))
    }
}
impl<H: HostTypes> Ord for LandauerBudget<H> {
    #[inline]
    fn cmp(&self, other: &Self) -> core::cmp::Ordering {
        // Total order on H::Decimal with NaN excluded by construction.
        self.nats
            .partial_cmp(&other.nats)
            .unwrap_or(core::cmp::Ordering::Equal)
    }
}
impl<H: HostTypes> core::hash::Hash for LandauerBudget<H> {
    #[inline]
    fn hash<S: core::hash::Hasher>(&self, state: &mut S) {
        // DecimalTranscendental::to_bits gives a stable u64 fingerprint
        // for any in-range Decimal value.
        self.nats.to_bits().hash(state);
    }
}

/// v0.2.2 Phase A: foundation-internal deterministic two-clock value
/// carried by every `Grounded<T>` and `Certified<C>`. The two clocks are
/// `landauer_nats` (a `LandauerBudget` value backed by `observable:LandauerCost`)
/// and `rewrite_steps` (a `u64` backed by `derivation:stepCount` on
/// `derivation:TermMetrics`). Each clock is monotonic within a pipeline
/// invocation, content-deterministic, ontology-grounded, and binds to a
/// physical wall-clock lower bound through established physics (Landauer's
/// principle for nats; Margolus-Levitin for rewrite steps). Two clocks
/// because exactly two physical lower-bound theorems are grounded; adding
/// a third clock would require grounding a third physical theorem.
/// `PartialOrd` is component-wise: `a < b` iff every field of `a` is `<=`
/// the corresponding field of `b` and at least one is strictly `<`. Two
/// `UorTime` values from unrelated computations are genuinely incomparable,
/// so `UorTime` is `PartialOrd` but **not** `Ord`.
#[derive(Debug)]
pub struct UorTime<H: HostTypes = crate::DefaultHostTypes> {
    /// Landauer budget consumed, in `observable:Nats`.
    landauer_nats: LandauerBudget<H>,
    /// Total rewrite steps taken (`derivation:stepCount`).
    rewrite_steps: u64,
    /// Prevents external construction.
    _sealed: (),
}

impl<H: HostTypes> UorTime<H> {
    /// Returns the Landauer budget consumed, in `observable:Nats`.
    /// Maps to `observable:LandauerCost`.
    #[inline]
    #[must_use]
    pub const fn landauer_nats(&self) -> LandauerBudget<H> {
        self.landauer_nats
    }

    /// Returns the total rewrite steps taken.
    /// Maps to `derivation:stepCount` on `derivation:TermMetrics`.
    #[inline]
    #[must_use]
    pub const fn rewrite_steps(&self) -> u64 {
        self.rewrite_steps
    }

    /// Crate-internal constructor. Reachable only from the pipeline at witness mint time.
    #[inline]
    #[must_use]
    #[allow(dead_code)]
    pub(crate) const fn new(landauer_nats: LandauerBudget<H>, rewrite_steps: u64) -> Self {
        Self {
            landauer_nats,
            rewrite_steps,
            _sealed: (),
        }
    }

    /// Crate-internal constructor for the zero initial value.
    #[inline]
    #[must_use]
    #[allow(dead_code)]
    pub(crate) const fn zero() -> Self {
        Self {
            landauer_nats: LandauerBudget::<H>::zero(),
            rewrite_steps: 0,
            _sealed: (),
        }
    }

    /// Returns the provable minimum wall-clock duration that the
    /// computation producing this witness could have taken under the
    /// given calibration. Returns `max(Landauer-bound, Margolus-Levitin-bound)`.
    /// The Landauer bound is `landauer_nats × k_B·T / thermal_power`.
    /// The Margolus-Levitin bound is `π·ℏ·rewrite_steps / (2·characteristic_energy)`.
    /// Pure arithmetic — no transcendentals, no state. Const-evaluable
    /// where the `UorTime` value is known at compile time.
    #[inline]
    #[must_use]
    pub fn min_wall_clock(&self, cal: &Calibration<H>) -> Nanos {
        // Landauer bound: nats × k_B·T / thermal_power = seconds.
        let landauer_seconds = self.landauer_nats.nats() * cal.k_b_t() / cal.thermal_power();
        // Margolus-Levitin bound: π·ℏ / (2·E) per orthogonal state transition.
        // π·ℏ ≈ 3.31194e-34 J·s; encoded as the f64 bit pattern of
        // `core::f64::consts::PI * 1.054_571_817e-34` so the constant is
        // representable across host Decimal types.
        let pi_times_h_bar =
            <H::Decimal as DecimalTranscendental>::from_bits(crate::PI_TIMES_H_BAR_BITS);
        let two = <H::Decimal as DecimalTranscendental>::from_u32(2);
        let ml_seconds_per_step = pi_times_h_bar / (two * cal.characteristic_energy());
        let steps = <H::Decimal as DecimalTranscendental>::from_u64(self.rewrite_steps);
        let ml_seconds = ml_seconds_per_step * steps;
        let max_seconds = if landauer_seconds > ml_seconds {
            landauer_seconds
        } else {
            ml_seconds
        };
        // Convert seconds to nanoseconds, saturate on overflow.
        let nanos_per_second =
            <H::Decimal as DecimalTranscendental>::from_bits(crate::NANOS_PER_SECOND_BITS);
        let nanos = max_seconds * nanos_per_second;
        Nanos {
            ns: <H::Decimal as DecimalTranscendental>::as_u64_saturating(nanos),
            _sealed: (),
        }
    }
}

impl<H: HostTypes> Copy for UorTime<H> {}
impl<H: HostTypes> Clone for UorTime<H> {
    #[inline]
    fn clone(&self) -> Self {
        *self
    }
}
impl<H: HostTypes> PartialEq for UorTime<H> {
    #[inline]
    fn eq(&self, other: &Self) -> bool {
        self.landauer_nats == other.landauer_nats && self.rewrite_steps == other.rewrite_steps
    }
}
impl<H: HostTypes> Eq for UorTime<H> {}
impl<H: HostTypes> core::hash::Hash for UorTime<H> {
    #[inline]
    fn hash<S: core::hash::Hasher>(&self, state: &mut S) {
        self.landauer_nats.hash(state);
        self.rewrite_steps.hash(state);
    }
}
impl<H: HostTypes> PartialOrd for UorTime<H> {
    #[inline]
    fn partial_cmp(&self, other: &Self) -> Option<core::cmp::Ordering> {
        let l = self.landauer_nats.cmp(&other.landauer_nats);
        let r = self.rewrite_steps.cmp(&other.rewrite_steps);
        match (l, r) {
            (core::cmp::Ordering::Equal, core::cmp::Ordering::Equal) => {
                Some(core::cmp::Ordering::Equal)
            }
            (core::cmp::Ordering::Less, core::cmp::Ordering::Less)
            | (core::cmp::Ordering::Less, core::cmp::Ordering::Equal)
            | (core::cmp::Ordering::Equal, core::cmp::Ordering::Less) => {
                Some(core::cmp::Ordering::Less)
            }
            (core::cmp::Ordering::Greater, core::cmp::Ordering::Greater)
            | (core::cmp::Ordering::Greater, core::cmp::Ordering::Equal)
            | (core::cmp::Ordering::Equal, core::cmp::Ordering::Greater) => {
                Some(core::cmp::Ordering::Greater)
            }
            _ => None,
        }
    }
}

/// v0.2.2 Phase A: sealed lower-bound carrier for wall-clock duration.
/// Produced only by `UorTime::min_wall_clock` and similar foundation
/// time conversions. The sealing guarantees that any `Nanos` value is
/// a provable physical bound, not a raw integer. Developers who need
/// the underlying `u64` call `.as_u64()`; the sealing prevents
/// accidentally passing a host-measured duration where the type system
/// expects "a provable minimum".
#[derive(Debug, Clone, Copy, PartialEq, Eq, PartialOrd, Ord, Hash)]
pub struct Nanos {
    /// The provable lower-bound duration in nanoseconds.
    ns: u64,
    /// Prevents external construction.
    _sealed: (),
}

impl Nanos {
    /// Returns the underlying nanosecond count. The value is a provable
    /// physical lower bound under whatever calibration produced it.
    #[inline]
    #[must_use]
    pub const fn as_u64(self) -> u64 {
        self.ns
    }
}

/// v0.2.2 Phase A: error returned by `Calibration::new` when the supplied
/// physical parameters fail plausibility validation.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
pub enum CalibrationError {
    /// `k_b_t` was non-positive, NaN, or outside the known-universe
    /// temperature range (`1e-30 ≤ k_b_t ≤ 1e-15` joules).
    ThermalEnergy,
    /// `thermal_power` was non-positive, NaN, or above the thermodynamic maximum (`1e9` W).
    ThermalPower,
    /// `characteristic_energy` was non-positive, NaN, or above the
    /// k_B·T × Avogadro-class bound (`1e3` joules).
    CharacteristicEnergy,
}

impl core::fmt::Display for CalibrationError {
    fn fmt(&self, f: &mut core::fmt::Formatter<'_>) -> core::fmt::Result {
        match self {
            Self::ThermalEnergy => {
                f.write_str("calibration k_b_t out of range (must be in [1e-30, 1e-15] joules)")
            }
            Self::ThermalPower => {
                f.write_str("calibration thermal_power out of range (must be > 0 and <= 1e9 W)")
            }
            Self::CharacteristicEnergy => f.write_str(
                "calibration characteristic_energy out of range (must be > 0 and <= 1e3 J)",
            ),
        }
    }
}

impl core::error::Error for CalibrationError {}

/// v0.2.2 Phase A: physical-substrate calibration for wall-clock binding.
/// Construction is open via [`Calibration::new`], but the fields are
/// private and validated for physical plausibility. Used to convert
/// `UorTime` to a provable wall-clock lower bound via
/// [`UorTime::min_wall_clock`].
/// **A `Calibration` is never passed into `pipeline::run`,
/// `resolver::*::certify`, `validate_const`, or any other foundation entry
/// point.** The foundation computes `UorTime` without physical
/// interpretation; the developer applies a `Calibration` after the fact.
#[derive(Debug)]
pub struct Calibration<H: HostTypes = crate::DefaultHostTypes> {
    /// Boltzmann constant times temperature, in joules.
    k_b_t: H::Decimal,
    /// Sustained dissipation in watts.
    thermal_power: H::Decimal,
    /// Mean energy above ground state, in joules.
    characteristic_energy: H::Decimal,
    /// Phantom marker pinning the host type.
    _phantom: core::marker::PhantomData<H>,
}

impl<H: HostTypes> Copy for Calibration<H> {}
impl<H: HostTypes> Clone for Calibration<H> {
    #[inline]
    fn clone(&self) -> Self {
        *self
    }
}
impl<H: HostTypes> PartialEq for Calibration<H> {
    #[inline]
    fn eq(&self, other: &Self) -> bool {
        self.k_b_t == other.k_b_t
            && self.thermal_power == other.thermal_power
            && self.characteristic_energy == other.characteristic_energy
    }
}

impl<H: HostTypes> Calibration<H> {
    /// Construct a calibration with physically plausible parameters.
    /// Validation: every parameter must be positive and finite. `k_b_t`
    /// must lie within the known-universe temperature range
    /// (`1e-30 <= k_b_t <= 1e-15` joules covers ~1 nK to ~1e8 K).
    /// `thermal_power` must be at most `1e9` W (gigawatt class — far above
    /// any plausible single-compute envelope). `characteristic_energy`
    /// must be at most `1e3` J (kilojoule class — astronomically generous).
    /// # Errors
    /// Returns `CalibrationError::InvalidThermalEnergy` when `k_b_t` is
    /// non-positive, NaN, or outside the temperature range.
    /// Returns `CalibrationError::InvalidThermalPower` when `thermal_power`
    /// is non-positive, NaN, or above the maximum.
    /// Returns `CalibrationError::InvalidCharacteristicEnergy` when
    /// `characteristic_energy` is non-positive, NaN, or above the maximum.
    /// # Example
    /// ```
    /// use uor_foundation::enforcement::Calibration;
    /// use uor_foundation::DefaultHostTypes;
    /// // X86 server-class envelope at room temperature.
    /// // k_B·T at 300 K = 4.14e-21 J; 85 W sustained TDP; ~1e-15 J/op.
    /// let cal = Calibration::<DefaultHostTypes>::new(4.14e-21, 85.0, 1.0e-15)
    ///     .expect("physically plausible server calibration");
    /// # let _ = cal;
    /// ```
    #[inline]
    pub fn new(
        k_b_t: H::Decimal,
        thermal_power: H::Decimal,
        characteristic_energy: H::Decimal,
    ) -> Result<Self, CalibrationError> {
        // Bit-pattern bounds for the validation envelope. Reading them
        // through `from_bits` lets the host's chosen Decimal precision
        // resolve the comparison without any hardcoded f64 in source.
        let zero = <H::Decimal as Default>::default();
        let kbt_lo =
            <H::Decimal as DecimalTranscendental>::from_bits(crate::CALIBRATION_KBT_LO_BITS);
        let kbt_hi =
            <H::Decimal as DecimalTranscendental>::from_bits(crate::CALIBRATION_KBT_HI_BITS);
        let tp_hi = <H::Decimal as DecimalTranscendental>::from_bits(
            crate::CALIBRATION_THERMAL_POWER_HI_BITS,
        );
        let ce_hi = <H::Decimal as DecimalTranscendental>::from_bits(
            crate::CALIBRATION_CHAR_ENERGY_HI_BITS,
        );
        // NaN identity: NaN != NaN. PartialEq is the defining bound.
        #[allow(clippy::eq_op)]
        let k_b_t_nan = k_b_t != k_b_t;
        if k_b_t_nan || k_b_t <= zero || k_b_t < kbt_lo || k_b_t > kbt_hi {
            return Err(CalibrationError::ThermalEnergy);
        }
        #[allow(clippy::eq_op)]
        let tp_nan = thermal_power != thermal_power;
        if tp_nan || thermal_power <= zero || thermal_power > tp_hi {
            return Err(CalibrationError::ThermalPower);
        }
        #[allow(clippy::eq_op)]
        let ce_nan = characteristic_energy != characteristic_energy;
        if ce_nan || characteristic_energy <= zero || characteristic_energy > ce_hi {
            return Err(CalibrationError::CharacteristicEnergy);
        }
        Ok(Self {
            k_b_t,
            thermal_power,
            characteristic_energy,
            _phantom: core::marker::PhantomData,
        })
    }

    /// Returns the Boltzmann constant times temperature, in joules.
    #[inline]
    #[must_use]
    pub const fn k_b_t(&self) -> H::Decimal {
        self.k_b_t
    }

    /// Returns the sustained thermal power dissipation, in watts.
    #[inline]
    #[must_use]
    pub const fn thermal_power(&self) -> H::Decimal {
        self.thermal_power
    }

    /// Returns the characteristic energy above ground state, in joules.
    #[inline]
    #[must_use]
    pub const fn characteristic_energy(&self) -> H::Decimal {
        self.characteristic_energy
    }

    /// v0.2.2 T5.5: zero sentinel. All three fields are 0.0 — physically
    /// meaningless but safely constructible. Used as the unreachable-branch
    /// placeholder in the const-context preset literals (`X86_SERVER`,
    /// `ARM_MOBILE`, `CORTEX_M_EMBEDDED`, `CONSERVATIVE_WORST_CASE`). The
    /// `meta/calibration_presets_valid` conformance check verifies the
    /// preset literals always succeed in `Calibration::new`, so this
    /// sentinel is never produced in practice. Do not use it directly;
    /// it is exposed only because Rust's const-eval needs a fallback for
    /// the impossible `Err` arm of the preset match.
    pub const ZERO_SENTINEL: Calibration<H> = Self {
        k_b_t: H::EMPTY_DECIMAL,
        thermal_power: H::EMPTY_DECIMAL,
        characteristic_energy: H::EMPTY_DECIMAL,
        _phantom: core::marker::PhantomData,
    };
}

impl Calibration<crate::DefaultHostTypes> {
    /// Const constructor for the default-host (f64) path. Bypasses runtime validation; use only for the spec-shipped preset literals where the envelope is statically guaranteed. Parameter types are written as `<DefaultHostTypes as HostTypes>::Decimal` so no `: f64` annotation appears in the public-API surface — the host-type alias is the canonical name; downstream that swaps the host gets the matching decimal automatically.
    #[inline]
    #[must_use]
    pub(crate) const fn from_f64_unchecked(
        k_b_t: <crate::DefaultHostTypes as crate::HostTypes>::Decimal,
        thermal_power: <crate::DefaultHostTypes as crate::HostTypes>::Decimal,
        characteristic_energy: <crate::DefaultHostTypes as crate::HostTypes>::Decimal,
    ) -> Self {
        Self {
            k_b_t,
            thermal_power,
            characteristic_energy,
            _phantom: core::marker::PhantomData,
        }
    }
}

/// v0.2.2 Phase A: foundation-shipped preset calibrations covering common
/// substrates. The values are derived from published substrate thermals at
/// T=300 K (room temperature, where k_B·T ≈ 4.14e-21 J).
pub mod calibrations {
    use super::Calibration;
    use crate::DefaultHostTypes;

    /// Server-class x86 (Xeon/EPYC sustained envelope).
    /// k_B·T = 4.14e-21 J (T = 300 K), thermal_power = 85 W (typical TDP),
    /// characteristic_energy = 1e-15 J/op (~1 fJ/op for modern CMOS).
    pub const X86_SERVER: Calibration<DefaultHostTypes> =
        Calibration::<DefaultHostTypes>::from_f64_unchecked(4.14e-21, 85.0, 1.0e-15);

    /// Mobile ARM SoC (Apple M-series, Snapdragon 8-series sustained envelope).
    /// k_B·T = 4.14e-21 J, thermal_power = 5 W, characteristic_energy = 1e-16 J/op.
    pub const ARM_MOBILE: Calibration<DefaultHostTypes> =
        Calibration::<DefaultHostTypes>::from_f64_unchecked(4.14e-21, 5.0, 1.0e-16);

    /// Cortex-M embedded (STM32/nRF52 at 80 MHz).
    /// k_B·T = 4.14e-21 J, thermal_power = 0.1 W, characteristic_energy = 1e-17 J/op.
    pub const CORTEX_M_EMBEDDED: Calibration<DefaultHostTypes> =
        Calibration::<DefaultHostTypes>::from_f64_unchecked(4.14e-21, 0.1, 1.0e-17);

    /// The tightest provable lower bound that requires no trust in the
    /// issuer's claimed substrate. Values are physically sound but maximally
    /// generous: k_B·T at 300 K floor, thermal_power at 1 GW (above any
    /// plausible single-compute envelope), characteristic_energy at 1 J
    /// (astronomically generous).
    /// Applying this calibration yields the smallest `Nanos` physically
    /// possible for the computation regardless of substrate claims.
    pub const CONSERVATIVE_WORST_CASE: Calibration<DefaultHostTypes> =
        Calibration::<DefaultHostTypes>::from_f64_unchecked(4.14e-21, 1.0e9, 1.0);
}

/// v0.2.2 Phase B (target §1.7): timing-policy carrier. Parametric over host tuning.
/// Supplies the preflight / runtime Nanos budgets (canonical values from
/// `reduction:PreflightTimingBound` and `reduction:RuntimeTimingBound`) plus
/// the `Calibration` used to convert an input's a-priori `UorTime` estimate
/// into a Nanos lower bound for comparison against the budget.
/// The foundation-canonical default [`CanonicalTimingPolicy`] uses
/// `calibrations::CONSERVATIVE_WORST_CASE` (the tightest provable lower-bound
/// calibration) and the 10 ms budget from the ontology. Host code overrides by
/// implementing `TimingPolicy` on a marker struct and substituting at the
/// preflight-function call site.
pub trait TimingPolicy {
    /// Preflight Nanos budget. Inputs whose a-priori UorTime → min_wall_clock
    /// under `Self::CALIBRATION` exceeds this value are rejected at preflight.
    const PREFLIGHT_BUDGET_NS: u64;
    /// Runtime Nanos budget for post-admission reduction.
    const RUNTIME_BUDGET_NS: u64;
    /// Canonical Calibration used to convert a-priori UorTime estimates to Nanos.
    /// Phase 9: pinned to `Calibration<DefaultHostTypes>` because the trait's `const` slot can't carry a non-DefaultHost generic. Polymorphic consumers build a `Calibration<H>` at runtime via `Calibration::new`.
    const CALIBRATION: &'static Calibration<crate::DefaultHostTypes>;
}

/// v0.2.2 Phase B: foundation-canonical [`TimingPolicy`]. Budget values mirror
/// `reduction:PreflightTimingBound` and `reduction:RuntimeTimingBound`; calibration
/// is `calibrations::CONSERVATIVE_WORST_CASE` so the Nanos lower bound from any
/// input UorTime is the tightest physically-defensible value.
#[derive(Debug, Default, Clone, Copy, PartialEq, Eq, Hash)]
pub struct CanonicalTimingPolicy;

impl TimingPolicy for CanonicalTimingPolicy {
    const PREFLIGHT_BUDGET_NS: u64 = 10_000_000;
    const RUNTIME_BUDGET_NS: u64 = 10_000_000;
    const CALIBRATION: &'static Calibration<crate::DefaultHostTypes> =
        &calibrations::CONSERVATIVE_WORST_CASE;
}

/// Phase H (target §1.6): foundation-owned transcendental-arithmetic entry points.
/// Routes through the always-on `libm` dependency so every build — std, alloc,
/// and strict no_std — has access to `ln` / `exp` / `sqrt` for `xsd:decimal`
/// observables. Gating these behind an optional feature flag was considered and
/// rejected per target §1.6: an observable that exists in one build and not
/// another violates the foundation's "one surface" discipline.
/// Downstream code that needs transcendentals should call these wrappers —
/// they are the canonical entry point for the four observables target §3 enumerates
/// (`convergenceRate`, `residualEntropy`, `collapseAmplitude`, and `op:OA_5` pricing)
/// and for any future observable whose implementation admits transcendentals.
pub mod transcendentals {
    use crate::DecimalTranscendental;

    /// Natural logarithm. Dispatches via `DecimalTranscendental::ln`; the foundation's f64 / f32 impls route through `libm::log` / `logf`.
    /// Returns `NaN` for `x <= 0.0`, preserving `libm`'s contract.
    #[inline]
    #[must_use]
    pub fn ln<D: DecimalTranscendental>(x: D) -> D {
        x.ln()
    }

    /// Exponential `e^x`. Dispatches via `DecimalTranscendental::exp`.
    #[inline]
    #[must_use]
    pub fn exp<D: DecimalTranscendental>(x: D) -> D {
        x.exp()
    }

    /// Square root. Dispatches via `DecimalTranscendental::sqrt`. Returns `NaN` for `x < 0.0`.
    #[inline]
    #[must_use]
    pub fn sqrt<D: DecimalTranscendental>(x: D) -> D {
        x.sqrt()
    }

    /// Shannon entropy term `-p · ln(p)` in nats. Returns 0 for `p = 0` by
    /// continuous extension. Used by `observable:residualEntropy`.
    #[inline]
    #[must_use]
    pub fn entropy_term_nats<D: DecimalTranscendental>(p: D) -> D {
        let zero = <D as Default>::default();
        if p <= zero {
            zero
        } else {
            zero - p * p.ln()
        }
    }
}

/// Fixed-capacity term list for `#![no_std]`. Indices into a `TermArena`.
#[derive(Debug, Clone, Copy, PartialEq, Eq)]
pub struct TermList {
    /// Start index in the arena.
    pub start: u32,
    /// Number of terms in this list.
    pub len: u32,
}

/// Stack-resident arena for `Term` trees.
/// Fixed capacity determined by the const generic `CAP`.
/// All `Term` child references are `u32` indices into this arena.
/// `#![no_std]`-safe: no heap allocation.
/// # Examples
/// ```rust
/// use uor_foundation::enforcement::{TermArena, Term, TermList};
/// use uor_foundation::{WittLevel, PrimitiveOp};
///
/// // Build the expression `add(3, 5)` bottom-up in an arena.
/// let mut arena = TermArena::<4>::new();
///
/// // Push leaves first:
/// let idx_3 = arena.push(Term::Literal { value: 3, level: WittLevel::W8 });
/// let idx_5 = arena.push(Term::Literal { value: 5, level: WittLevel::W8 });
///
/// // Push the application node, referencing the leaves by index:
/// let idx_add = arena.push(Term::Application {
///     operator: PrimitiveOp::Add,
///     args: TermList { start: idx_3.unwrap_or(0), len: 2 },
/// });
///
/// assert_eq!(arena.len(), 3);
/// // Retrieve a node by index:
/// let node = arena.get(idx_add.unwrap_or(0));
/// assert!(node.is_some());
/// ```
#[derive(Debug, Clone, Copy, PartialEq, Eq)]
pub struct TermArena<const CAP: usize> {
    /// Node storage. `None` slots are unused.
    nodes: [Option<Term>; CAP],
    /// Number of allocated nodes.
    len: u32,
}

impl<const CAP: usize> TermArena<CAP> {
    /// Creates an empty arena.
    #[inline]
    #[must_use]
    pub const fn new() -> Self {
        // v0.2.2 T4.5.a: const-stable on MSRV 1.70 via the `[None; CAP]`
        // initializer (Term is Copy as of T4.5.a, so Option<Term> is Copy).
        Self {
            nodes: [None; CAP],
            len: 0,
        }
    }

    /// Push a term into the arena and return its index.
    /// # Errors
    /// Returns `None` if the arena is full.
    #[must_use]
    pub fn push(&mut self, term: Term) -> Option<u32> {
        let idx = self.len;
        if (idx as usize) >= CAP {
            return None;
        }
        self.nodes[idx as usize] = Some(term);
        self.len = idx + 1;
        Some(idx)
    }

    /// Returns a reference to the term at `index`, or `None` if out of bounds.
    #[inline]
    #[must_use]
    pub fn get(&self, index: u32) -> Option<&Term> {
        self.nodes
            .get(index as usize)
            .and_then(|slot| slot.as_ref())
    }

    /// Returns the number of allocated nodes.
    #[inline]
    #[must_use]
    pub const fn len(&self) -> u32 {
        self.len
    }

    /// Returns `true` if the arena has no allocated nodes.
    #[inline]
    #[must_use]
    pub const fn is_empty(&self) -> bool {
        self.len == 0
    }

    /// v0.2.2 T4.5.b: returns the populated prefix of the arena as a slice.
    /// Each entry is `Some(term)` for the populated indices `0..len()`;
    /// downstream consumers index into this slice via `TermList::start` and
    /// `TermList::len` to walk the children of an Application/Match node.
    #[inline]
    #[must_use]
    pub fn as_slice(&self) -> &[Option<Term>] {
        &self.nodes[..self.len as usize]
    }

    /// Wiki ADR-022 D2: const constructor that copies a static term slice
    /// into the arena. Used by the `prism_model!` proc-macro to emit a
    /// `const ROUTE: TermArena<CAP> = TermArena::from_slice(ROUTE_SLICE)`
    /// declaration alongside the model — the `const ROUTE_SLICE` carrying
    /// the term tree, this `from_slice` wrapping it into the arena form
    /// [`crate::pipeline::run_route`] consumes.
    /// `CAP` MUST be at least `slice.len()`; if the slice exceeds the
    /// arena's capacity the trailing terms are silently dropped (the
    /// `prism_model!` macro emits an arena sized to fit the route's term
    /// count plus headroom, so this case is unreachable from the macro's
    /// output).
    #[inline]
    #[must_use]
    pub const fn from_slice(slice: &'static [Term]) -> Self {
        let mut nodes: [Option<Term>; CAP] = [None; CAP];
        let mut i = 0usize;
        while i < slice.len() && i < CAP {
            nodes[i] = Some(slice[i]);
            i += 1;
        }
        // Cap at min(slice.len(), CAP) so a too-large slice doesn't
        // overrun. The macro emits arena CAP >= slice.len() so the
        // truncation branch is unreachable in practice.
        #[allow(clippy::cast_possible_truncation)]
        let len = if slice.len() > CAP {
            CAP as u32
        } else {
            slice.len() as u32
        };
        Self { nodes, len }
    }
}

impl<const CAP: usize> Default for TermArena<CAP> {
    fn default() -> Self {
        Self::new()
    }
}

/// Concrete AST node for the UOR term language.
/// Mirrors the EBNF grammar productions. All child references are
/// indices into a `TermArena`, keeping the AST stack-resident and
/// `#![no_std]`-safe.
/// # Examples
/// ```rust
/// use uor_foundation::enforcement::{Term, TermList};
/// use uor_foundation::{WittLevel, PrimitiveOp};
///
/// // Literal: an integer value tagged with a Witt level.
/// let lit = Term::Literal { value: 42, level: WittLevel::W8 };
///
/// // Application: an operation applied to arguments.
/// // `args` is a TermList { start, len } pointing into a TermArena.
/// let app = Term::Application {
///     operator: PrimitiveOp::Mul,
///     args: TermList { start: 0, len: 2 },
/// };
///
/// // Lift: canonical injection from a lower to a higher Witt level.
/// let lift = Term::Lift { operand_index: 0, target: WittLevel::new(32) };
///
/// // Project: canonical surjection from a higher to a lower level.
/// let proj = Term::Project { operand_index: 0, target: WittLevel::W8 };
/// ```
#[derive(Debug, Clone, Copy, PartialEq, Eq)]
pub enum Term {
    /// Integer literal with Witt level annotation.
    Literal {
        /// The literal integer value.
        value: u64,
        /// The Witt level of this literal.
        level: WittLevel,
    },
    /// Variable reference by name index.
    Variable {
        /// Index into the name table.
        name_index: u32,
    },
    /// Operation application: operator applied to arguments.
    Application {
        /// The primitive operation to apply.
        operator: PrimitiveOp,
        /// Argument list (indices into arena).
        args: TermList,
    },
    /// Lift: canonical injection W_n to W_m (n < m, lossless).
    Lift {
        /// Index of the operand term in the arena.
        operand_index: u32,
        /// Target Witt level.
        target: WittLevel,
    },
    /// Project: canonical surjection W_m to W_n (m > n, lossy).
    Project {
        /// Index of the operand term in the arena.
        operand_index: u32,
        /// Target Witt level.
        target: WittLevel,
    },
    /// Match expression with pattern-result pairs.
    Match {
        /// Index of the scrutinee term in the arena.
        scrutinee_index: u32,
        /// Match arms (indices into arena).
        arms: TermList,
    },
    /// Bounded recursion with descent measure.
    Recurse {
        /// Index of the descent measure term.
        measure_index: u32,
        /// Index of the base case term.
        base_index: u32,
        /// Index of the recursive step term.
        step_index: u32,
    },
    /// Stream construction via unfold.
    Unfold {
        /// Index of the seed term.
        seed_index: u32,
        /// Index of the step function term.
        step_index: u32,
    },
    /// Try expression with failure recovery.
    Try {
        /// Index of the body term.
        body_index: u32,
        /// Index of the handler term.
        handler_index: u32,
    },
}

/// A type declaration with constraint kinds.
#[derive(Debug, Clone, PartialEq, Eq)]
pub struct TypeDeclaration {
    /// Name index for this type.
    pub name_index: u32,
    /// Constraint terms (indices into arena).
    pub constraints: TermList,
}

/// A named binding: `let name : Type = term`.
#[derive(Debug, Clone, PartialEq, Eq)]
pub struct Binding {
    /// Name index for this binding.
    pub name_index: u32,
    /// Index of the type declaration.
    pub type_index: u32,
    /// Index of the value term in the arena.
    pub value_index: u32,
    /// EBNF surface syntax (compile-time constant).
    pub surface: &'static str,
    /// FNV-1a content address (compile-time constant).
    pub content_address: u64,
}

impl Binding {
    /// v0.2.2 Phase P.3: lift this binding to the `BindingEntry` shape consumed by
    /// `BindingsTable`. `address` is derived from `content_address` via
    /// `ContentAddress::from_u64_fingerprint`; `bytes` re-uses the `surface` slice.
    /// Content-deterministic; const-compatible since all fields are `'static`.
    #[inline]
    #[must_use]
    pub const fn to_binding_entry(&self) -> BindingEntry {
        BindingEntry {
            address: ContentAddress::from_u64_fingerprint(self.content_address),
            bytes: self.surface.as_bytes(),
        }
    }
}

/// An assertion: `assert lhs = rhs`.
#[derive(Debug, Clone, PartialEq, Eq)]
pub struct Assertion {
    /// Index of the left-hand side term.
    pub lhs_index: u32,
    /// Index of the right-hand side term.
    pub rhs_index: u32,
    /// EBNF surface syntax (compile-time constant).
    pub surface: &'static str,
}

/// Boundary source declaration: `source name : Type via grounding`.
#[derive(Debug, Clone, PartialEq, Eq)]
pub struct SourceDeclaration {
    /// Name index for the source.
    pub name_index: u32,
    /// Index of the type declaration.
    pub type_index: u32,
    /// Name index of the grounding map.
    pub grounding_name_index: u32,
}

/// Boundary sink declaration: `sink name : Type via projection`.
#[derive(Debug, Clone, PartialEq, Eq)]
pub struct SinkDeclaration {
    /// Name index for the sink.
    pub name_index: u32,
    /// Index of the type declaration.
    pub type_index: u32,
    /// Name index of the projection map.
    pub projection_name_index: u32,
}

/// Structured violation diagnostic carrying metadata from the
/// conformance namespace. Every field is machine-readable.
/// # Examples
/// ```rust
/// use uor_foundation::enforcement::ShapeViolation;
/// use uor_foundation::ViolationKind;
///
/// // ShapeViolation carries structured metadata from the ontology.
/// // Every field is machine-readable — IRIs, counts, and a typed kind.
/// let violation = ShapeViolation {
///     shape_iri: "https://uor.foundation/conformance/CompileUnitShape",
///     constraint_iri: "https://uor.foundation/conformance/compileUnit_rootTerm_constraint",
///     property_iri: "https://uor.foundation/reduction/rootTerm",
///     expected_range: "https://uor.foundation/schema/Term",
///     min_count: 1,
///     max_count: 1,
///     kind: ViolationKind::Missing,
/// };
///
/// // Machine-readable for tooling (IDE plugins, CI pipelines):
/// assert_eq!(violation.kind, ViolationKind::Missing);
/// assert!(violation.shape_iri.ends_with("CompileUnitShape"));
/// assert_eq!(violation.min_count, 1);
/// ```
#[derive(Debug, Clone, PartialEq, Eq)]
pub struct ShapeViolation {
    /// IRI of the `conformance:Shape` that was validated against.
    pub shape_iri: &'static str,
    /// IRI of the specific `conformance:PropertyConstraint` that failed.
    pub constraint_iri: &'static str,
    /// IRI of the property that was missing or invalid.
    pub property_iri: &'static str,
    /// The expected range class IRI.
    pub expected_range: &'static str,
    /// Minimum cardinality from the constraint.
    pub min_count: u32,
    /// Maximum cardinality (0 = unbounded).
    pub max_count: u32,
    /// What went wrong.
    pub kind: ViolationKind,
}

impl core::fmt::Display for ShapeViolation {
    fn fmt(&self, f: &mut core::fmt::Formatter<'_>) -> core::fmt::Result {
        write!(
            f,
            "shape violation: {} (constraint {}, property {}, kind {:?})",
            self.shape_iri, self.constraint_iri, self.property_iri, self.kind,
        )
    }
}

impl core::error::Error for ShapeViolation {}

impl ShapeViolation {
    /// Phase C.3: returns the shape IRI as a `&'static str` suitable for
    /// `const fn` panic messages. The IRI uniquely identifies the violated
    /// constraint in the conformance catalog.
    #[inline]
    #[must_use]
    pub const fn const_message(&self) -> &'static str {
        self.shape_iri
    }
}

/// Builder for `CompileUnit` admission into the reduction pipeline.
/// Collects `rootTerm`, `wittLevelCeiling`, `thermodynamicBudget`,
/// and `targetDomains`. The `validate()` method checks structural
/// constraints (Tier 1) and value-dependent constraints (Tier 2).
/// # Examples
/// ```rust
/// use uor_foundation::enforcement::{CompileUnitBuilder, ConstrainedTypeInput, Term};
/// use uor_foundation::{WittLevel, VerificationDomain, ViolationKind};
///
/// // A CompileUnit packages a term graph for reduction admission.
/// // The builder enforces that all required fields are present.
/// let terms = [Term::Literal { value: 1, level: WittLevel::W8 }];
/// let domains = [VerificationDomain::Enumerative];
///
/// let unit = CompileUnitBuilder::new()
///     .root_term(&terms)
///     .witt_level_ceiling(WittLevel::W8)
///     .thermodynamic_budget(1024)
///     .target_domains(&domains)
///     .result_type::<ConstrainedTypeInput>()
///     .validate();
/// assert!(unit.is_ok());
///
/// // Omitting a required field produces a ShapeViolation
/// // with the exact conformance IRI that failed:
/// let err = CompileUnitBuilder::new()
///     .witt_level_ceiling(WittLevel::W8)
///     .thermodynamic_budget(1024)
///     .target_domains(&domains)
///     .result_type::<ConstrainedTypeInput>()
///     .validate();
/// assert!(err.is_err());
/// if let Err(violation) = err {
///     assert_eq!(violation.kind, ViolationKind::Missing);
///     assert!(violation.property_iri.contains("rootTerm"));
/// }
/// ```
#[derive(Debug, Clone)]
pub struct CompileUnitBuilder<'a> {
    /// The root term expression.
    root_term: Option<&'a [Term]>,
    /// v0.2.2 Phase H1: named bindings (`let name : Type = term` forms)
    /// declared by the compile unit. Stage 5 extracts these into a `BindingsTable`
    /// for grounding-aware and session resolvers; an empty slice declares no bindings.
    bindings: Option<&'a [Binding]>,
    /// The widest Witt level the computation may reference.
    witt_level_ceiling: Option<WittLevel>,
    /// Landauer-bounded energy budget.
    thermodynamic_budget: Option<u64>,
    /// Verification domains targeted.
    target_domains: Option<&'a [VerificationDomain]>,
    /// v0.2.2 T6.11: result-type IRI for ShapeMismatch detection.
    /// Set via `result_type::<T: ConstrainedTypeShape>()`. Required by
    /// `validate()` and `validate_compile_unit_const`. The pipeline checks
    /// `unit.result_type_iri() == T::IRI` at `pipeline::run` invocation
    /// time, returning `PipelineFailure::ShapeMismatch` on mismatch.
    result_type_iri: Option<&'static str>,
}

/// A validated compile unit ready for reduction admission.
/// v0.2.2 Phase A (carrier widening): the lifetime parameter `'a` ties
/// the post-validation carrier to its builder's borrow. The `root_term`
/// and `target_domains` slices are retained through validation so
/// resolvers can inspect declared structure — previously these fields
/// were discarded at `validate()` and every resolver received a
/// 3-field scalar witness with no walkable structure.
/// Const-constructed compile units use the trivial specialization
/// `CompileUnit<'static>` — borrow-free and usable in const contexts.
#[derive(Debug, Clone, Copy, PartialEq, Eq)]
pub struct CompileUnit<'a> {
    /// The Witt level ceiling.
    level: WittLevel,
    /// The thermodynamic budget.
    budget: u64,
    /// v0.2.2 T6.11: result-type IRI. The pipeline matches this against
    /// the caller's `T::IRI` to detect shape mismatches.
    result_type_iri: &'static str,
    /// v0.2.2 Phase A: root term expression, retained from the builder.
    /// Stage 5 (extract bindings) and the grounding-aware resolver walk
    /// this slice. Empty slice for the trivial `CompileUnit<'static>`
    /// specialization produced by builders that don't carry a term AST.
    root_term: &'a [Term],
    /// v0.2.2 Phase H1: named bindings retained from the builder. Consumed by Stage 5
    /// (`bindings_from_unit`) to materialize the `BindingsTable` for grounding-aware,
    /// session, and superposition resolvers. Empty slice declares no bindings.
    bindings: &'a [Binding],
    /// v0.2.2 Phase A: verification domains targeted, retained from the builder.
    target_domains: &'a [VerificationDomain],
}

impl<'a> CompileUnit<'a> {
    /// Returns the Witt level ceiling declared at validation time.
    #[inline]
    #[must_use]
    pub const fn witt_level(&self) -> WittLevel {
        self.level
    }

    /// Returns the thermodynamic budget declared at validation time.
    #[inline]
    #[must_use]
    pub const fn thermodynamic_budget(&self) -> u64 {
        self.budget
    }

    /// v0.2.2 T6.11: returns the result-type IRI declared at validation
    /// time. The pipeline matches this against the caller's `T::IRI` to
    /// detect shape mismatches.
    #[inline]
    #[must_use]
    pub const fn result_type_iri(&self) -> &'static str {
        self.result_type_iri
    }

    /// v0.2.2 Phase A: returns the root term slice declared at validation time.
    /// Empty for builders that did not supply a term AST.
    #[inline]
    #[must_use]
    pub const fn root_term(&self) -> &'a [Term] {
        self.root_term
    }

    /// v0.2.2 Phase H1: returns the named bindings declared at validation time.
    /// Consumed by Stage 5 (`bindings_from_unit`) to materialize the `BindingsTable`.
    /// Empty slice for compile units that declare no bindings.
    #[inline]
    #[must_use]
    pub const fn bindings(&self) -> &'a [Binding] {
        self.bindings
    }

    /// v0.2.2 Phase A: returns the verification domains declared at validation time.
    #[inline]
    #[must_use]
    pub const fn target_domains(&self) -> &'a [VerificationDomain] {
        self.target_domains
    }

    /// v0.2.2 Phase G / T2.8 + T6.11: const-constructible parts form used
    /// by `validate_compile_unit_const` — the const-fn path reads the
    /// builder's fields and packs them into the `Validated` result.
    /// v0.2.2 Phase H1: bindings slice is retained alongside root_term;
    /// empty slice declares no bindings.
    #[inline]
    #[must_use]
    pub(crate) const fn from_parts_const(
        level: WittLevel,
        budget: u64,
        result_type_iri: &'static str,
        root_term: &'a [Term],
        bindings: &'a [Binding],
        target_domains: &'a [VerificationDomain],
    ) -> Self {
        Self {
            level,
            budget,
            result_type_iri,
            root_term,
            bindings,
            target_domains,
        }
    }
}

impl<'a> CompileUnitBuilder<'a> {
    /// Creates a new empty builder.
    #[must_use]
    pub const fn new() -> Self {
        Self {
            root_term: None,
            bindings: None,
            witt_level_ceiling: None,
            thermodynamic_budget: None,
            target_domains: None,
            result_type_iri: None,
        }
    }

    /// Set the root term expression.
    #[must_use]
    pub const fn root_term(mut self, terms: &'a [Term]) -> Self {
        self.root_term = Some(terms);
        self
    }

    /// v0.2.2 Phase H1: set the named bindings declared by this compile unit.
    /// Consumed by Stage 5 (`bindings_from_unit`) to materialize the
    /// `BindingsTable` for grounding-aware, session, and superposition resolvers.
    /// Omit for compile units without bindings; the default is the empty slice.
    #[must_use]
    pub const fn bindings(mut self, bindings: &'a [Binding]) -> Self {
        self.bindings = Some(bindings);
        self
    }

    /// Set the Witt level ceiling.
    #[must_use]
    pub const fn witt_level_ceiling(mut self, level: WittLevel) -> Self {
        self.witt_level_ceiling = Some(level);
        self
    }

    /// Set the thermodynamic budget.
    #[must_use]
    pub const fn thermodynamic_budget(mut self, budget: u64) -> Self {
        self.thermodynamic_budget = Some(budget);
        self
    }

    /// Set the target verification domains.
    #[must_use]
    pub const fn target_domains(mut self, domains: &'a [VerificationDomain]) -> Self {
        self.target_domains = Some(domains);
        self
    }

    /// v0.2.2 T6.11: set the result-type IRI from a `ConstrainedTypeShape`
    /// type parameter. The pipeline matches this against the caller's
    /// `T::IRI` at `pipeline::run` invocation time, returning
    /// `PipelineFailure::ShapeMismatch` on mismatch.
    /// Required: `validate()` and `validate_compile_unit_const` reject
    /// builders without a result type set.
    #[must_use]
    pub const fn result_type<T: crate::pipeline::ConstrainedTypeShape>(mut self) -> Self {
        self.result_type_iri = Some(T::IRI);
        self
    }

    /// v0.2.2 T2.8: const-fn accessor exposing the stored Witt level
    /// ceiling (or `None` if unset). Used by `validate_compile_unit_const`.
    #[inline]
    #[must_use]
    pub const fn witt_level_option(&self) -> Option<WittLevel> {
        self.witt_level_ceiling
    }

    /// v0.2.2 T2.8: const-fn accessor exposing the stored thermodynamic
    /// budget (or `None` if unset).
    #[inline]
    #[must_use]
    pub const fn budget_option(&self) -> Option<u64> {
        self.thermodynamic_budget
    }

    /// v0.2.2 T6.13: const-fn accessor — `true` iff `root_term` is set.
    #[inline]
    #[must_use]
    pub const fn has_root_term_const(&self) -> bool {
        self.root_term.is_some()
    }

    /// v0.2.2 T6.13: const-fn accessor — `true` iff `target_domains` is
    /// set and non-empty.
    #[inline]
    #[must_use]
    pub const fn has_target_domains_const(&self) -> bool {
        match self.target_domains {
            Some(d) => !d.is_empty(),
            None => false,
        }
    }

    /// v0.2.2 T6.13: const-fn accessor exposing the stored result-type IRI
    /// (or `None` if unset). Used by `validate_compile_unit_const`.
    #[inline]
    #[must_use]
    pub const fn result_type_iri_const(&self) -> Option<&'static str> {
        self.result_type_iri
    }

    /// v0.2.2 Phase A: const-fn accessor exposing the stored root-term slice,
    /// or an empty slice if unset. Used by `validate_compile_unit_const` to
    /// propagate the AST into the widened `CompileUnit<'a>` carrier.
    #[inline]
    #[must_use]
    pub const fn root_term_slice_const(&self) -> &'a [Term] {
        match self.root_term {
            Some(terms) => terms,
            None => &[],
        }
    }

    /// v0.2.2 Phase H1: const-fn accessor exposing the stored bindings slice,
    /// or an empty slice if unset. Used by `validate_compile_unit_const` to
    /// propagate the bindings declaration into the widened `CompileUnit<'a>` carrier.
    #[inline]
    #[must_use]
    pub const fn bindings_slice_const(&self) -> &'a [Binding] {
        match self.bindings {
            Some(bindings) => bindings,
            None => &[],
        }
    }

    /// v0.2.2 Phase A: const-fn accessor exposing the stored target-domains
    /// slice, or an empty slice if unset. Used by `validate_compile_unit_const`.
    #[inline]
    #[must_use]
    pub const fn target_domains_slice_const(&self) -> &'a [VerificationDomain] {
        match self.target_domains {
            Some(d) => d,
            None => &[],
        }
    }

    /// Validate against `CompileUnitShape`.
    /// Tier 1: checks presence and cardinality of all required fields.
    /// Tier 2: checks budget solvency and level coherence.
    /// # Errors
    /// Returns `ShapeViolation` if any constraint is not satisfied.
    pub fn validate(self) -> Result<Validated<CompileUnit<'a>>, ShapeViolation> {
        let root_term = match self.root_term {
            Some(terms) => terms,
            None => {
                return Err(ShapeViolation {
                    shape_iri: "https://uor.foundation/conformance/CompileUnitShape",
                    constraint_iri:
                        "https://uor.foundation/conformance/compileUnit_rootTerm_constraint",
                    property_iri: "https://uor.foundation/reduction/rootTerm",
                    expected_range: "https://uor.foundation/schema/Term",
                    min_count: 1,
                    max_count: 1,
                    kind: ViolationKind::Missing,
                })
            }
        };
        let level =
            match self.witt_level_ceiling {
                Some(l) => l,
                None => return Err(ShapeViolation {
                    shape_iri: "https://uor.foundation/conformance/CompileUnitShape",
                    constraint_iri:
                        "https://uor.foundation/conformance/compileUnit_unitWittLevel_constraint",
                    property_iri: "https://uor.foundation/reduction/unitWittLevel",
                    expected_range: "https://uor.foundation/schema/WittLevel",
                    min_count: 1,
                    max_count: 1,
                    kind: ViolationKind::Missing,
                }),
            };
        let budget = match self.thermodynamic_budget {
            Some(b) => b,
            None => return Err(ShapeViolation {
                shape_iri: "https://uor.foundation/conformance/CompileUnitShape",
                constraint_iri:
                    "https://uor.foundation/conformance/compileUnit_thermodynamicBudget_constraint",
                property_iri: "https://uor.foundation/reduction/thermodynamicBudget",
                expected_range: "http://www.w3.org/2001/XMLSchema#decimal",
                min_count: 1,
                max_count: 1,
                kind: ViolationKind::Missing,
            }),
        };
        let target_domains =
            match self.target_domains {
                Some(d) if !d.is_empty() => d,
                _ => return Err(ShapeViolation {
                    shape_iri: "https://uor.foundation/conformance/CompileUnitShape",
                    constraint_iri:
                        "https://uor.foundation/conformance/compileUnit_targetDomains_constraint",
                    property_iri: "https://uor.foundation/reduction/targetDomains",
                    expected_range: "https://uor.foundation/op/VerificationDomain",
                    min_count: 1,
                    max_count: 0,
                    kind: ViolationKind::Missing,
                }),
            };
        let result_type_iri = match self.result_type_iri {
            Some(iri) => iri,
            None => {
                return Err(ShapeViolation {
                    shape_iri: "https://uor.foundation/conformance/CompileUnitShape",
                    constraint_iri:
                        "https://uor.foundation/conformance/compileUnit_resultType_constraint",
                    property_iri: "https://uor.foundation/reduction/resultType",
                    expected_range: "https://uor.foundation/type/ConstrainedType",
                    min_count: 1,
                    max_count: 1,
                    kind: ViolationKind::Missing,
                })
            }
        };
        // v0.2.2 Phase H1: bindings is optional; absent declares no bindings.
        let bindings: &'a [Binding] = match self.bindings {
            Some(b) => b,
            None => &[],
        };
        Ok(Validated::new(CompileUnit {
            level,
            budget,
            result_type_iri,
            root_term,
            bindings,
            target_domains,
        }))
    }
}

impl<'a> Default for CompileUnitBuilder<'a> {
    fn default() -> Self {
        Self::new()
    }
}

/// Builder for `EffectDeclaration`. Validates against `EffectShape`.
#[derive(Debug, Clone)]
pub struct EffectDeclarationBuilder<'a> {
    /// The `name` field.
    name: Option<&'a str>,
    /// The `target_sites` field.
    target_sites: Option<&'a [u32]>,
    /// The `budget_delta` field.
    budget_delta: Option<i64>,
    /// The `commutes` field.
    commutes: Option<bool>,
}

/// Declared effect validated against `EffectShape`.
#[derive(Debug, Clone, PartialEq, Eq)]
pub struct EffectDeclaration {
    /// Shape IRI this declaration was validated against.
    pub shape_iri: &'static str,
}

impl EffectDeclaration {
    /// v0.2.2 Phase G: const-constructible empty form used by
    /// `validate_*_const` companion functions.
    #[inline]
    #[must_use]
    #[allow(dead_code)]
    pub(crate) const fn empty_const() -> Self {
        Self {
            shape_iri: "https://uor.foundation/conformance/EffectShape",
        }
    }
}

impl<'a> EffectDeclarationBuilder<'a> {
    /// Creates a new empty builder.
    #[must_use]
    pub const fn new() -> Self {
        Self {
            name: None,
            target_sites: None,
            budget_delta: None,
            commutes: None,
        }
    }

    /// Set the `name` field.
    #[must_use]
    pub const fn name(mut self, value: &'a str) -> Self {
        self.name = Some(value);
        self
    }

    /// Set the `target_sites` field.
    #[must_use]
    pub const fn target_sites(mut self, value: &'a [u32]) -> Self {
        self.target_sites = Some(value);
        self
    }

    /// Set the `budget_delta` field.
    #[must_use]
    pub const fn budget_delta(mut self, value: i64) -> Self {
        self.budget_delta = Some(value);
        self
    }

    /// Set the `commutes` field.
    #[must_use]
    pub const fn commutes(mut self, value: bool) -> Self {
        self.commutes = Some(value);
        self
    }

    /// Validate against `EffectShape`.
    /// # Errors
    /// Returns `ShapeViolation` if any required field is missing.
    pub fn validate(self) -> Result<Validated<EffectDeclaration>, ShapeViolation> {
        if self.name.is_none() {
            return Err(ShapeViolation {
                shape_iri: "https://uor.foundation/conformance/EffectShape",
                constraint_iri: "https://uor.foundation/conformance/EffectShape",
                property_iri: "https://uor.foundation/conformance/name",
                expected_range: "http://www.w3.org/2002/07/owl#Thing",
                min_count: 1,
                max_count: 1,
                kind: ViolationKind::Missing,
            });
        }
        if self.target_sites.is_none() {
            return Err(ShapeViolation {
                shape_iri: "https://uor.foundation/conformance/EffectShape",
                constraint_iri: "https://uor.foundation/conformance/EffectShape",
                property_iri: "https://uor.foundation/conformance/target_sites",
                expected_range: "http://www.w3.org/2002/07/owl#Thing",
                min_count: 1,
                max_count: 1,
                kind: ViolationKind::Missing,
            });
        }
        if self.budget_delta.is_none() {
            return Err(ShapeViolation {
                shape_iri: "https://uor.foundation/conformance/EffectShape",
                constraint_iri: "https://uor.foundation/conformance/EffectShape",
                property_iri: "https://uor.foundation/conformance/budget_delta",
                expected_range: "http://www.w3.org/2002/07/owl#Thing",
                min_count: 1,
                max_count: 1,
                kind: ViolationKind::Missing,
            });
        }
        if self.commutes.is_none() {
            return Err(ShapeViolation {
                shape_iri: "https://uor.foundation/conformance/EffectShape",
                constraint_iri: "https://uor.foundation/conformance/EffectShape",
                property_iri: "https://uor.foundation/conformance/commutes",
                expected_range: "http://www.w3.org/2002/07/owl#Thing",
                min_count: 1,
                max_count: 1,
                kind: ViolationKind::Missing,
            });
        }
        Ok(Validated::new(EffectDeclaration {
            shape_iri: "https://uor.foundation/conformance/EffectShape",
        }))
    }

    /// Phase C.1: const-fn companion for `EffectDeclarationBuilder::validate`.
    /// Returns `Validated<_, CompileTime>` on success, allowing compile-time
    /// evidence via `const _V: Validated<_, CompileTime> = builder.validate_const().unwrap();`.
    /// # Errors
    /// Returns `ShapeViolation` if any required field is missing.
    pub const fn validate_const(
        &self,
    ) -> Result<Validated<EffectDeclaration, CompileTime>, ShapeViolation> {
        if self.name.is_none() {
            return Err(ShapeViolation {
                shape_iri: "https://uor.foundation/conformance/EffectShape",
                constraint_iri: "https://uor.foundation/conformance/EffectShape",
                property_iri: "https://uor.foundation/conformance/name",
                expected_range: "http://www.w3.org/2002/07/owl#Thing",
                min_count: 1,
                max_count: 1,
                kind: ViolationKind::Missing,
            });
        }
        if self.target_sites.is_none() {
            return Err(ShapeViolation {
                shape_iri: "https://uor.foundation/conformance/EffectShape",
                constraint_iri: "https://uor.foundation/conformance/EffectShape",
                property_iri: "https://uor.foundation/conformance/target_sites",
                expected_range: "http://www.w3.org/2002/07/owl#Thing",
                min_count: 1,
                max_count: 1,
                kind: ViolationKind::Missing,
            });
        }
        if self.budget_delta.is_none() {
            return Err(ShapeViolation {
                shape_iri: "https://uor.foundation/conformance/EffectShape",
                constraint_iri: "https://uor.foundation/conformance/EffectShape",
                property_iri: "https://uor.foundation/conformance/budget_delta",
                expected_range: "http://www.w3.org/2002/07/owl#Thing",
                min_count: 1,
                max_count: 1,
                kind: ViolationKind::Missing,
            });
        }
        if self.commutes.is_none() {
            return Err(ShapeViolation {
                shape_iri: "https://uor.foundation/conformance/EffectShape",
                constraint_iri: "https://uor.foundation/conformance/EffectShape",
                property_iri: "https://uor.foundation/conformance/commutes",
                expected_range: "http://www.w3.org/2002/07/owl#Thing",
                min_count: 1,
                max_count: 1,
                kind: ViolationKind::Missing,
            });
        }
        Ok(Validated::new(EffectDeclaration {
            shape_iri: "https://uor.foundation/conformance/EffectShape",
        }))
    }
}

impl<'a> Default for EffectDeclarationBuilder<'a> {
    fn default() -> Self {
        Self::new()
    }
}

/// Builder for `GroundingDeclaration`. Validates against `GroundingShape`.
#[derive(Debug, Clone)]
pub struct GroundingDeclarationBuilder<'a> {
    /// The `source_type` field.
    source_type: Option<&'a str>,
    /// The `ring_mapping` field.
    ring_mapping: Option<&'a str>,
    /// The `invertibility` field.
    invertibility: Option<bool>,
}

/// Declared grounding validated against `GroundingShape`.
#[derive(Debug, Clone, PartialEq, Eq)]
pub struct GroundingDeclaration {
    /// Shape IRI this declaration was validated against.
    pub shape_iri: &'static str,
}

impl GroundingDeclaration {
    /// v0.2.2 Phase G: const-constructible empty form used by
    /// `validate_*_const` companion functions.
    #[inline]
    #[must_use]
    #[allow(dead_code)]
    pub(crate) const fn empty_const() -> Self {
        Self {
            shape_iri: "https://uor.foundation/conformance/GroundingShape",
        }
    }
}

impl<'a> GroundingDeclarationBuilder<'a> {
    /// Creates a new empty builder.
    #[must_use]
    pub const fn new() -> Self {
        Self {
            source_type: None,
            ring_mapping: None,
            invertibility: None,
        }
    }

    /// Set the `source_type` field.
    #[must_use]
    pub const fn source_type(mut self, value: &'a str) -> Self {
        self.source_type = Some(value);
        self
    }

    /// Set the `ring_mapping` field.
    #[must_use]
    pub const fn ring_mapping(mut self, value: &'a str) -> Self {
        self.ring_mapping = Some(value);
        self
    }

    /// Set the `invertibility` field.
    #[must_use]
    pub const fn invertibility(mut self, value: bool) -> Self {
        self.invertibility = Some(value);
        self
    }

    /// Validate against `GroundingShape`.
    /// # Errors
    /// Returns `ShapeViolation` if any required field is missing.
    pub fn validate(self) -> Result<Validated<GroundingDeclaration>, ShapeViolation> {
        if self.source_type.is_none() {
            return Err(ShapeViolation {
                shape_iri: "https://uor.foundation/conformance/GroundingShape",
                constraint_iri: "https://uor.foundation/conformance/GroundingShape",
                property_iri: "https://uor.foundation/conformance/source_type",
                expected_range: "http://www.w3.org/2002/07/owl#Thing",
                min_count: 1,
                max_count: 1,
                kind: ViolationKind::Missing,
            });
        }
        if self.ring_mapping.is_none() {
            return Err(ShapeViolation {
                shape_iri: "https://uor.foundation/conformance/GroundingShape",
                constraint_iri: "https://uor.foundation/conformance/GroundingShape",
                property_iri: "https://uor.foundation/conformance/ring_mapping",
                expected_range: "http://www.w3.org/2002/07/owl#Thing",
                min_count: 1,
                max_count: 1,
                kind: ViolationKind::Missing,
            });
        }
        if self.invertibility.is_none() {
            return Err(ShapeViolation {
                shape_iri: "https://uor.foundation/conformance/GroundingShape",
                constraint_iri: "https://uor.foundation/conformance/GroundingShape",
                property_iri: "https://uor.foundation/conformance/invertibility",
                expected_range: "http://www.w3.org/2002/07/owl#Thing",
                min_count: 1,
                max_count: 1,
                kind: ViolationKind::Missing,
            });
        }
        Ok(Validated::new(GroundingDeclaration {
            shape_iri: "https://uor.foundation/conformance/GroundingShape",
        }))
    }

    /// Phase C.1: const-fn companion for `GroundingDeclarationBuilder::validate`.
    /// Returns `Validated<_, CompileTime>` on success, allowing compile-time
    /// evidence via `const _V: Validated<_, CompileTime> = builder.validate_const().unwrap();`.
    /// # Errors
    /// Returns `ShapeViolation` if any required field is missing.
    pub const fn validate_const(
        &self,
    ) -> Result<Validated<GroundingDeclaration, CompileTime>, ShapeViolation> {
        if self.source_type.is_none() {
            return Err(ShapeViolation {
                shape_iri: "https://uor.foundation/conformance/GroundingShape",
                constraint_iri: "https://uor.foundation/conformance/GroundingShape",
                property_iri: "https://uor.foundation/conformance/source_type",
                expected_range: "http://www.w3.org/2002/07/owl#Thing",
                min_count: 1,
                max_count: 1,
                kind: ViolationKind::Missing,
            });
        }
        if self.ring_mapping.is_none() {
            return Err(ShapeViolation {
                shape_iri: "https://uor.foundation/conformance/GroundingShape",
                constraint_iri: "https://uor.foundation/conformance/GroundingShape",
                property_iri: "https://uor.foundation/conformance/ring_mapping",
                expected_range: "http://www.w3.org/2002/07/owl#Thing",
                min_count: 1,
                max_count: 1,
                kind: ViolationKind::Missing,
            });
        }
        if self.invertibility.is_none() {
            return Err(ShapeViolation {
                shape_iri: "https://uor.foundation/conformance/GroundingShape",
                constraint_iri: "https://uor.foundation/conformance/GroundingShape",
                property_iri: "https://uor.foundation/conformance/invertibility",
                expected_range: "http://www.w3.org/2002/07/owl#Thing",
                min_count: 1,
                max_count: 1,
                kind: ViolationKind::Missing,
            });
        }
        Ok(Validated::new(GroundingDeclaration {
            shape_iri: "https://uor.foundation/conformance/GroundingShape",
        }))
    }
}

impl<'a> Default for GroundingDeclarationBuilder<'a> {
    fn default() -> Self {
        Self::new()
    }
}

/// Builder for `DispatchDeclaration`. Validates against `DispatchShape`.
#[derive(Debug, Clone)]
pub struct DispatchDeclarationBuilder<'a> {
    /// The `predicate` field.
    predicate: Option<&'a [Term]>,
    /// The `target_resolver` field.
    target_resolver: Option<&'a str>,
    /// The `priority` field.
    priority: Option<u32>,
}

/// Declared dispatch rule validated against `DispatchShape`.
#[derive(Debug, Clone, PartialEq, Eq)]
pub struct DispatchDeclaration {
    /// Shape IRI this declaration was validated against.
    pub shape_iri: &'static str,
}

impl DispatchDeclaration {
    /// v0.2.2 Phase G: const-constructible empty form used by
    /// `validate_*_const` companion functions.
    #[inline]
    #[must_use]
    #[allow(dead_code)]
    pub(crate) const fn empty_const() -> Self {
        Self {
            shape_iri: "https://uor.foundation/conformance/DispatchShape",
        }
    }
}

impl<'a> DispatchDeclarationBuilder<'a> {
    /// Creates a new empty builder.
    #[must_use]
    pub const fn new() -> Self {
        Self {
            predicate: None,
            target_resolver: None,
            priority: None,
        }
    }

    /// Set the `predicate` field.
    #[must_use]
    pub const fn predicate(mut self, value: &'a [Term]) -> Self {
        self.predicate = Some(value);
        self
    }

    /// Set the `target_resolver` field.
    #[must_use]
    pub const fn target_resolver(mut self, value: &'a str) -> Self {
        self.target_resolver = Some(value);
        self
    }

    /// Set the `priority` field.
    #[must_use]
    pub const fn priority(mut self, value: u32) -> Self {
        self.priority = Some(value);
        self
    }

    /// Validate against `DispatchShape`.
    /// # Errors
    /// Returns `ShapeViolation` if any required field is missing.
    pub fn validate(self) -> Result<Validated<DispatchDeclaration>, ShapeViolation> {
        if self.predicate.is_none() {
            return Err(ShapeViolation {
                shape_iri: "https://uor.foundation/conformance/DispatchShape",
                constraint_iri: "https://uor.foundation/conformance/DispatchShape",
                property_iri: "https://uor.foundation/conformance/predicate",
                expected_range: "http://www.w3.org/2002/07/owl#Thing",
                min_count: 1,
                max_count: 1,
                kind: ViolationKind::Missing,
            });
        }
        if self.target_resolver.is_none() {
            return Err(ShapeViolation {
                shape_iri: "https://uor.foundation/conformance/DispatchShape",
                constraint_iri: "https://uor.foundation/conformance/DispatchShape",
                property_iri: "https://uor.foundation/conformance/target_resolver",
                expected_range: "http://www.w3.org/2002/07/owl#Thing",
                min_count: 1,
                max_count: 1,
                kind: ViolationKind::Missing,
            });
        }
        if self.priority.is_none() {
            return Err(ShapeViolation {
                shape_iri: "https://uor.foundation/conformance/DispatchShape",
                constraint_iri: "https://uor.foundation/conformance/DispatchShape",
                property_iri: "https://uor.foundation/conformance/priority",
                expected_range: "http://www.w3.org/2002/07/owl#Thing",
                min_count: 1,
                max_count: 1,
                kind: ViolationKind::Missing,
            });
        }
        Ok(Validated::new(DispatchDeclaration {
            shape_iri: "https://uor.foundation/conformance/DispatchShape",
        }))
    }

    /// Phase C.1: const-fn companion for `DispatchDeclarationBuilder::validate`.
    /// Returns `Validated<_, CompileTime>` on success, allowing compile-time
    /// evidence via `const _V: Validated<_, CompileTime> = builder.validate_const().unwrap();`.
    /// # Errors
    /// Returns `ShapeViolation` if any required field is missing.
    pub const fn validate_const(
        &self,
    ) -> Result<Validated<DispatchDeclaration, CompileTime>, ShapeViolation> {
        if self.predicate.is_none() {
            return Err(ShapeViolation {
                shape_iri: "https://uor.foundation/conformance/DispatchShape",
                constraint_iri: "https://uor.foundation/conformance/DispatchShape",
                property_iri: "https://uor.foundation/conformance/predicate",
                expected_range: "http://www.w3.org/2002/07/owl#Thing",
                min_count: 1,
                max_count: 1,
                kind: ViolationKind::Missing,
            });
        }
        if self.target_resolver.is_none() {
            return Err(ShapeViolation {
                shape_iri: "https://uor.foundation/conformance/DispatchShape",
                constraint_iri: "https://uor.foundation/conformance/DispatchShape",
                property_iri: "https://uor.foundation/conformance/target_resolver",
                expected_range: "http://www.w3.org/2002/07/owl#Thing",
                min_count: 1,
                max_count: 1,
                kind: ViolationKind::Missing,
            });
        }
        if self.priority.is_none() {
            return Err(ShapeViolation {
                shape_iri: "https://uor.foundation/conformance/DispatchShape",
                constraint_iri: "https://uor.foundation/conformance/DispatchShape",
                property_iri: "https://uor.foundation/conformance/priority",
                expected_range: "http://www.w3.org/2002/07/owl#Thing",
                min_count: 1,
                max_count: 1,
                kind: ViolationKind::Missing,
            });
        }
        Ok(Validated::new(DispatchDeclaration {
            shape_iri: "https://uor.foundation/conformance/DispatchShape",
        }))
    }
}

impl<'a> Default for DispatchDeclarationBuilder<'a> {
    fn default() -> Self {
        Self::new()
    }
}

/// Builder for `LeaseDeclaration`. Validates against `LeaseShape`.
#[derive(Debug, Clone)]
pub struct LeaseDeclarationBuilder<'a> {
    /// The `linear_site` field.
    linear_site: Option<u32>,
    /// The `scope` field.
    scope: Option<&'a str>,
}

/// Declared lease validated against `LeaseShape`.
#[derive(Debug, Clone, PartialEq, Eq)]
pub struct LeaseDeclaration {
    /// Shape IRI this declaration was validated against.
    pub shape_iri: &'static str,
}

impl LeaseDeclaration {
    /// v0.2.2 Phase G: const-constructible empty form used by
    /// `validate_*_const` companion functions.
    #[inline]
    #[must_use]
    #[allow(dead_code)]
    pub(crate) const fn empty_const() -> Self {
        Self {
            shape_iri: "https://uor.foundation/conformance/LeaseShape",
        }
    }
}

impl<'a> LeaseDeclarationBuilder<'a> {
    /// Creates a new empty builder.
    #[must_use]
    pub const fn new() -> Self {
        Self {
            linear_site: None,
            scope: None,
        }
    }

    /// Set the `linear_site` field.
    #[must_use]
    pub const fn linear_site(mut self, value: u32) -> Self {
        self.linear_site = Some(value);
        self
    }

    /// Set the `scope` field.
    #[must_use]
    pub const fn scope(mut self, value: &'a str) -> Self {
        self.scope = Some(value);
        self
    }

    /// Validate against `LeaseShape`.
    /// # Errors
    /// Returns `ShapeViolation` if any required field is missing.
    pub fn validate(self) -> Result<Validated<LeaseDeclaration>, ShapeViolation> {
        if self.linear_site.is_none() {
            return Err(ShapeViolation {
                shape_iri: "https://uor.foundation/conformance/LeaseShape",
                constraint_iri: "https://uor.foundation/conformance/LeaseShape",
                property_iri: "https://uor.foundation/conformance/linear_site",
                expected_range: "http://www.w3.org/2002/07/owl#Thing",
                min_count: 1,
                max_count: 1,
                kind: ViolationKind::Missing,
            });
        }
        if self.scope.is_none() {
            return Err(ShapeViolation {
                shape_iri: "https://uor.foundation/conformance/LeaseShape",
                constraint_iri: "https://uor.foundation/conformance/LeaseShape",
                property_iri: "https://uor.foundation/conformance/scope",
                expected_range: "http://www.w3.org/2002/07/owl#Thing",
                min_count: 1,
                max_count: 1,
                kind: ViolationKind::Missing,
            });
        }
        Ok(Validated::new(LeaseDeclaration {
            shape_iri: "https://uor.foundation/conformance/LeaseShape",
        }))
    }

    /// Phase C.1: const-fn companion for `LeaseDeclarationBuilder::validate`.
    /// Returns `Validated<_, CompileTime>` on success, allowing compile-time
    /// evidence via `const _V: Validated<_, CompileTime> = builder.validate_const().unwrap();`.
    /// # Errors
    /// Returns `ShapeViolation` if any required field is missing.
    pub const fn validate_const(
        &self,
    ) -> Result<Validated<LeaseDeclaration, CompileTime>, ShapeViolation> {
        if self.linear_site.is_none() {
            return Err(ShapeViolation {
                shape_iri: "https://uor.foundation/conformance/LeaseShape",
                constraint_iri: "https://uor.foundation/conformance/LeaseShape",
                property_iri: "https://uor.foundation/conformance/linear_site",
                expected_range: "http://www.w3.org/2002/07/owl#Thing",
                min_count: 1,
                max_count: 1,
                kind: ViolationKind::Missing,
            });
        }
        if self.scope.is_none() {
            return Err(ShapeViolation {
                shape_iri: "https://uor.foundation/conformance/LeaseShape",
                constraint_iri: "https://uor.foundation/conformance/LeaseShape",
                property_iri: "https://uor.foundation/conformance/scope",
                expected_range: "http://www.w3.org/2002/07/owl#Thing",
                min_count: 1,
                max_count: 1,
                kind: ViolationKind::Missing,
            });
        }
        Ok(Validated::new(LeaseDeclaration {
            shape_iri: "https://uor.foundation/conformance/LeaseShape",
        }))
    }
}

impl<'a> Default for LeaseDeclarationBuilder<'a> {
    fn default() -> Self {
        Self::new()
    }
}

/// Builder for `StreamDeclaration`. Validates against `StreamShape`.
#[derive(Debug, Clone)]
pub struct StreamDeclarationBuilder<'a> {
    /// The `seed` field.
    seed: Option<&'a [Term]>,
    /// The `step` field.
    step: Option<&'a [Term]>,
    /// The `productivity_witness` field.
    productivity_witness: Option<&'a str>,
}

/// Declared stream validated against `StreamShape`.
#[derive(Debug, Clone, PartialEq, Eq)]
pub struct StreamDeclaration {
    /// Shape IRI this declaration was validated against.
    pub shape_iri: &'static str,
}

impl StreamDeclaration {
    /// v0.2.2 Phase G: const-constructible empty form used by
    /// `validate_*_const` companion functions.
    #[inline]
    #[must_use]
    #[allow(dead_code)]
    pub(crate) const fn empty_const() -> Self {
        Self {
            shape_iri: "https://uor.foundation/conformance/StreamShape",
        }
    }
}

impl<'a> StreamDeclarationBuilder<'a> {
    /// Creates a new empty builder.
    #[must_use]
    pub const fn new() -> Self {
        Self {
            seed: None,
            step: None,
            productivity_witness: None,
        }
    }

    /// Set the `seed` field.
    #[must_use]
    pub const fn seed(mut self, value: &'a [Term]) -> Self {
        self.seed = Some(value);
        self
    }

    /// Set the `step` field.
    #[must_use]
    pub const fn step(mut self, value: &'a [Term]) -> Self {
        self.step = Some(value);
        self
    }

    /// Set the `productivity_witness` field.
    #[must_use]
    pub const fn productivity_witness(mut self, value: &'a str) -> Self {
        self.productivity_witness = Some(value);
        self
    }

    /// Validate against `StreamShape`.
    /// # Errors
    /// Returns `ShapeViolation` if any required field is missing.
    pub fn validate(self) -> Result<Validated<StreamDeclaration>, ShapeViolation> {
        if self.seed.is_none() {
            return Err(ShapeViolation {
                shape_iri: "https://uor.foundation/conformance/StreamShape",
                constraint_iri: "https://uor.foundation/conformance/StreamShape",
                property_iri: "https://uor.foundation/conformance/seed",
                expected_range: "http://www.w3.org/2002/07/owl#Thing",
                min_count: 1,
                max_count: 1,
                kind: ViolationKind::Missing,
            });
        }
        if self.step.is_none() {
            return Err(ShapeViolation {
                shape_iri: "https://uor.foundation/conformance/StreamShape",
                constraint_iri: "https://uor.foundation/conformance/StreamShape",
                property_iri: "https://uor.foundation/conformance/step",
                expected_range: "http://www.w3.org/2002/07/owl#Thing",
                min_count: 1,
                max_count: 1,
                kind: ViolationKind::Missing,
            });
        }
        if self.productivity_witness.is_none() {
            return Err(ShapeViolation {
                shape_iri: "https://uor.foundation/conformance/StreamShape",
                constraint_iri: "https://uor.foundation/conformance/StreamShape",
                property_iri: "https://uor.foundation/conformance/productivity_witness",
                expected_range: "http://www.w3.org/2002/07/owl#Thing",
                min_count: 1,
                max_count: 1,
                kind: ViolationKind::Missing,
            });
        }
        Ok(Validated::new(StreamDeclaration {
            shape_iri: "https://uor.foundation/conformance/StreamShape",
        }))
    }

    /// Phase C.1: const-fn companion for `StreamDeclarationBuilder::validate`.
    /// Returns `Validated<_, CompileTime>` on success, allowing compile-time
    /// evidence via `const _V: Validated<_, CompileTime> = builder.validate_const().unwrap();`.
    /// # Errors
    /// Returns `ShapeViolation` if any required field is missing.
    pub const fn validate_const(
        &self,
    ) -> Result<Validated<StreamDeclaration, CompileTime>, ShapeViolation> {
        if self.seed.is_none() {
            return Err(ShapeViolation {
                shape_iri: "https://uor.foundation/conformance/StreamShape",
                constraint_iri: "https://uor.foundation/conformance/StreamShape",
                property_iri: "https://uor.foundation/conformance/seed",
                expected_range: "http://www.w3.org/2002/07/owl#Thing",
                min_count: 1,
                max_count: 1,
                kind: ViolationKind::Missing,
            });
        }
        if self.step.is_none() {
            return Err(ShapeViolation {
                shape_iri: "https://uor.foundation/conformance/StreamShape",
                constraint_iri: "https://uor.foundation/conformance/StreamShape",
                property_iri: "https://uor.foundation/conformance/step",
                expected_range: "http://www.w3.org/2002/07/owl#Thing",
                min_count: 1,
                max_count: 1,
                kind: ViolationKind::Missing,
            });
        }
        if self.productivity_witness.is_none() {
            return Err(ShapeViolation {
                shape_iri: "https://uor.foundation/conformance/StreamShape",
                constraint_iri: "https://uor.foundation/conformance/StreamShape",
                property_iri: "https://uor.foundation/conformance/productivity_witness",
                expected_range: "http://www.w3.org/2002/07/owl#Thing",
                min_count: 1,
                max_count: 1,
                kind: ViolationKind::Missing,
            });
        }
        Ok(Validated::new(StreamDeclaration {
            shape_iri: "https://uor.foundation/conformance/StreamShape",
        }))
    }
}

impl<'a> Default for StreamDeclarationBuilder<'a> {
    fn default() -> Self {
        Self::new()
    }
}

/// Builder for `PredicateDeclaration`. Validates against `PredicateShape`.
#[derive(Debug, Clone)]
pub struct PredicateDeclarationBuilder<'a> {
    /// The `input_type` field.
    input_type: Option<&'a str>,
    /// The `evaluator` field.
    evaluator: Option<&'a [Term]>,
    /// The `termination_witness` field.
    termination_witness: Option<&'a str>,
}

/// Declared predicate validated against `PredicateShape`.
#[derive(Debug, Clone, PartialEq, Eq)]
pub struct PredicateDeclaration {
    /// Shape IRI this declaration was validated against.
    pub shape_iri: &'static str,
}

impl PredicateDeclaration {
    /// v0.2.2 Phase G: const-constructible empty form used by
    /// `validate_*_const` companion functions.
    #[inline]
    #[must_use]
    #[allow(dead_code)]
    pub(crate) const fn empty_const() -> Self {
        Self {
            shape_iri: "https://uor.foundation/conformance/PredicateShape",
        }
    }
}

impl<'a> PredicateDeclarationBuilder<'a> {
    /// Creates a new empty builder.
    #[must_use]
    pub const fn new() -> Self {
        Self {
            input_type: None,
            evaluator: None,
            termination_witness: None,
        }
    }

    /// Set the `input_type` field.
    #[must_use]
    pub const fn input_type(mut self, value: &'a str) -> Self {
        self.input_type = Some(value);
        self
    }

    /// Set the `evaluator` field.
    #[must_use]
    pub const fn evaluator(mut self, value: &'a [Term]) -> Self {
        self.evaluator = Some(value);
        self
    }

    /// Set the `termination_witness` field.
    #[must_use]
    pub const fn termination_witness(mut self, value: &'a str) -> Self {
        self.termination_witness = Some(value);
        self
    }

    /// Validate against `PredicateShape`.
    /// # Errors
    /// Returns `ShapeViolation` if any required field is missing.
    pub fn validate(self) -> Result<Validated<PredicateDeclaration>, ShapeViolation> {
        if self.input_type.is_none() {
            return Err(ShapeViolation {
                shape_iri: "https://uor.foundation/conformance/PredicateShape",
                constraint_iri: "https://uor.foundation/conformance/PredicateShape",
                property_iri: "https://uor.foundation/conformance/input_type",
                expected_range: "http://www.w3.org/2002/07/owl#Thing",
                min_count: 1,
                max_count: 1,
                kind: ViolationKind::Missing,
            });
        }
        if self.evaluator.is_none() {
            return Err(ShapeViolation {
                shape_iri: "https://uor.foundation/conformance/PredicateShape",
                constraint_iri: "https://uor.foundation/conformance/PredicateShape",
                property_iri: "https://uor.foundation/conformance/evaluator",
                expected_range: "http://www.w3.org/2002/07/owl#Thing",
                min_count: 1,
                max_count: 1,
                kind: ViolationKind::Missing,
            });
        }
        if self.termination_witness.is_none() {
            return Err(ShapeViolation {
                shape_iri: "https://uor.foundation/conformance/PredicateShape",
                constraint_iri: "https://uor.foundation/conformance/PredicateShape",
                property_iri: "https://uor.foundation/conformance/termination_witness",
                expected_range: "http://www.w3.org/2002/07/owl#Thing",
                min_count: 1,
                max_count: 1,
                kind: ViolationKind::Missing,
            });
        }
        Ok(Validated::new(PredicateDeclaration {
            shape_iri: "https://uor.foundation/conformance/PredicateShape",
        }))
    }

    /// Phase C.1: const-fn companion for `PredicateDeclarationBuilder::validate`.
    /// Returns `Validated<_, CompileTime>` on success, allowing compile-time
    /// evidence via `const _V: Validated<_, CompileTime> = builder.validate_const().unwrap();`.
    /// # Errors
    /// Returns `ShapeViolation` if any required field is missing.
    pub const fn validate_const(
        &self,
    ) -> Result<Validated<PredicateDeclaration, CompileTime>, ShapeViolation> {
        if self.input_type.is_none() {
            return Err(ShapeViolation {
                shape_iri: "https://uor.foundation/conformance/PredicateShape",
                constraint_iri: "https://uor.foundation/conformance/PredicateShape",
                property_iri: "https://uor.foundation/conformance/input_type",
                expected_range: "http://www.w3.org/2002/07/owl#Thing",
                min_count: 1,
                max_count: 1,
                kind: ViolationKind::Missing,
            });
        }
        if self.evaluator.is_none() {
            return Err(ShapeViolation {
                shape_iri: "https://uor.foundation/conformance/PredicateShape",
                constraint_iri: "https://uor.foundation/conformance/PredicateShape",
                property_iri: "https://uor.foundation/conformance/evaluator",
                expected_range: "http://www.w3.org/2002/07/owl#Thing",
                min_count: 1,
                max_count: 1,
                kind: ViolationKind::Missing,
            });
        }
        if self.termination_witness.is_none() {
            return Err(ShapeViolation {
                shape_iri: "https://uor.foundation/conformance/PredicateShape",
                constraint_iri: "https://uor.foundation/conformance/PredicateShape",
                property_iri: "https://uor.foundation/conformance/termination_witness",
                expected_range: "http://www.w3.org/2002/07/owl#Thing",
                min_count: 1,
                max_count: 1,
                kind: ViolationKind::Missing,
            });
        }
        Ok(Validated::new(PredicateDeclaration {
            shape_iri: "https://uor.foundation/conformance/PredicateShape",
        }))
    }
}

impl<'a> Default for PredicateDeclarationBuilder<'a> {
    fn default() -> Self {
        Self::new()
    }
}

/// Builder for `ParallelDeclaration`. Validates against `ParallelShape`.
#[derive(Debug, Clone)]
pub struct ParallelDeclarationBuilder<'a> {
    /// The `site_partition` field.
    site_partition: Option<&'a [u32]>,
    /// The `disjointness_witness` field.
    disjointness_witness: Option<&'a str>,
}

/// Declared parallel composition validated against `ParallelShape`.
#[derive(Debug, Clone, PartialEq, Eq)]
pub struct ParallelDeclaration {
    /// Shape IRI this declaration was validated against.
    pub shape_iri: &'static str,
}

impl ParallelDeclaration {
    /// v0.2.2 Phase G: const-constructible empty form used by
    /// `validate_*_const` companion functions.
    #[inline]
    #[must_use]
    #[allow(dead_code)]
    pub(crate) const fn empty_const() -> Self {
        Self {
            shape_iri: "https://uor.foundation/conformance/ParallelShape",
        }
    }
}

impl<'a> ParallelDeclarationBuilder<'a> {
    /// Creates a new empty builder.
    #[must_use]
    pub const fn new() -> Self {
        Self {
            site_partition: None,
            disjointness_witness: None,
        }
    }

    /// Set the `site_partition` field.
    #[must_use]
    pub const fn site_partition(mut self, value: &'a [u32]) -> Self {
        self.site_partition = Some(value);
        self
    }

    /// Set the `disjointness_witness` field.
    #[must_use]
    pub const fn disjointness_witness(mut self, value: &'a str) -> Self {
        self.disjointness_witness = Some(value);
        self
    }

    /// Validate against `ParallelShape`.
    /// # Errors
    /// Returns `ShapeViolation` if any required field is missing.
    pub fn validate(self) -> Result<Validated<ParallelDeclaration>, ShapeViolation> {
        if self.site_partition.is_none() {
            return Err(ShapeViolation {
                shape_iri: "https://uor.foundation/conformance/ParallelShape",
                constraint_iri: "https://uor.foundation/conformance/ParallelShape",
                property_iri: "https://uor.foundation/conformance/site_partition",
                expected_range: "http://www.w3.org/2002/07/owl#Thing",
                min_count: 1,
                max_count: 1,
                kind: ViolationKind::Missing,
            });
        }
        if self.disjointness_witness.is_none() {
            return Err(ShapeViolation {
                shape_iri: "https://uor.foundation/conformance/ParallelShape",
                constraint_iri: "https://uor.foundation/conformance/ParallelShape",
                property_iri: "https://uor.foundation/conformance/disjointness_witness",
                expected_range: "http://www.w3.org/2002/07/owl#Thing",
                min_count: 1,
                max_count: 1,
                kind: ViolationKind::Missing,
            });
        }
        Ok(Validated::new(ParallelDeclaration {
            shape_iri: "https://uor.foundation/conformance/ParallelShape",
        }))
    }

    /// Phase C.1: const-fn companion for `ParallelDeclarationBuilder::validate`.
    /// Returns `Validated<_, CompileTime>` on success, allowing compile-time
    /// evidence via `const _V: Validated<_, CompileTime> = builder.validate_const().unwrap();`.
    /// # Errors
    /// Returns `ShapeViolation` if any required field is missing.
    pub const fn validate_const(
        &self,
    ) -> Result<Validated<ParallelDeclaration, CompileTime>, ShapeViolation> {
        if self.site_partition.is_none() {
            return Err(ShapeViolation {
                shape_iri: "https://uor.foundation/conformance/ParallelShape",
                constraint_iri: "https://uor.foundation/conformance/ParallelShape",
                property_iri: "https://uor.foundation/conformance/site_partition",
                expected_range: "http://www.w3.org/2002/07/owl#Thing",
                min_count: 1,
                max_count: 1,
                kind: ViolationKind::Missing,
            });
        }
        if self.disjointness_witness.is_none() {
            return Err(ShapeViolation {
                shape_iri: "https://uor.foundation/conformance/ParallelShape",
                constraint_iri: "https://uor.foundation/conformance/ParallelShape",
                property_iri: "https://uor.foundation/conformance/disjointness_witness",
                expected_range: "http://www.w3.org/2002/07/owl#Thing",
                min_count: 1,
                max_count: 1,
                kind: ViolationKind::Missing,
            });
        }
        Ok(Validated::new(ParallelDeclaration {
            shape_iri: "https://uor.foundation/conformance/ParallelShape",
        }))
    }
}

impl<'a> Default for ParallelDeclarationBuilder<'a> {
    fn default() -> Self {
        Self::new()
    }
}

impl<'a> ParallelDeclarationBuilder<'a> {
    /// v0.2.2 T2.7: const-fn accessor returning the length of the
    /// declared site partition (or 0 if unset).
    #[inline]
    #[must_use]
    pub const fn site_partition_len(&self) -> usize {
        match self.site_partition {
            Some(p) => p.len(),
            None => 0,
        }
    }

    /// v0.2.2 Phase A: const-fn accessor returning the declared site-partition
    /// slice, or an empty slice if unset. Used by `validate_parallel_const`
    /// to propagate the partition into the widened `ParallelDeclaration<'a>`.
    #[inline]
    #[must_use]
    pub const fn site_partition_slice_const(&self) -> &'a [u32] {
        match self.site_partition {
            Some(p) => p,
            None => &[],
        }
    }

    /// v0.2.2 Phase A: const-fn accessor returning the declared disjointness-witness
    /// IRI string, or an empty string if unset.
    #[inline]
    #[must_use]
    pub const fn disjointness_witness_const(&self) -> &'a str {
        match self.disjointness_witness {
            Some(s) => s,
            None => "",
        }
    }
}

impl<'a> StreamDeclarationBuilder<'a> {
    /// v0.2.2 canonical: productivity bound is 1 if a `productivityWitness`
    /// IRI is declared (the stream attests termination via a `proof:Proof`
    /// individual), 0 otherwise. The witness's IRI points to the termination
    /// proof; downstream resolvers dereference it for detailed bound
    /// information. This two-level split (presence flag here, IRI dereference
    /// elsewhere) is the canonical foundation-level shape.
    #[inline]
    #[must_use]
    pub const fn productivity_bound_const(&self) -> u64 {
        match self.productivity_witness {
            Some(_) => 1,
            None => 0,
        }
    }

    /// v0.2.2 Phase A: const-fn accessor returning the declared seed term slice,
    /// or an empty slice if unset.
    #[inline]
    #[must_use]
    pub const fn seed_slice_const(&self) -> &'a [Term] {
        match self.seed {
            Some(t) => t,
            None => &[],
        }
    }

    /// v0.2.2 Phase A: const-fn accessor returning the declared step term slice,
    /// or an empty slice if unset.
    #[inline]
    #[must_use]
    pub const fn step_slice_const(&self) -> &'a [Term] {
        match self.step {
            Some(t) => t,
            None => &[],
        }
    }

    /// v0.2.2 Phase A: const-fn accessor returning the declared productivity-witness
    /// IRI, or an empty string if unset.
    #[inline]
    #[must_use]
    pub const fn productivity_witness_const(&self) -> &'a str {
        match self.productivity_witness {
            Some(s) => s,
            None => "",
        }
    }
}

/// Builder for declaring a new Witt level beyond W32.
/// Validates against `WittLevelShape`.
#[derive(Debug, Clone)]
pub struct WittLevelDeclarationBuilder {
    /// The declared bit width.
    bit_width: Option<u32>,
    /// The declared cycle size.
    cycle_size: Option<u128>,
    /// The predecessor level.
    predecessor: Option<WittLevel>,
}

/// Validated Witt level declaration.
#[derive(Debug, Clone, PartialEq, Eq)]
pub struct WittLevelDeclaration {
    /// The declared bit width.
    pub bit_width: u32,
    /// The predecessor level.
    pub predecessor: WittLevel,
}

impl WittLevelDeclarationBuilder {
    /// Creates a new empty builder.
    #[must_use]
    pub const fn new() -> Self {
        Self {
            bit_width: None,
            cycle_size: None,
            predecessor: None,
        }
    }

    /// Set the declared bit width.
    #[must_use]
    pub const fn bit_width(mut self, w: u32) -> Self {
        self.bit_width = Some(w);
        self
    }

    /// Set the declared cycle size.
    #[must_use]
    pub const fn cycle_size(mut self, s: u128) -> Self {
        self.cycle_size = Some(s);
        self
    }

    /// Set the predecessor Witt level.
    #[must_use]
    pub const fn predecessor(mut self, level: WittLevel) -> Self {
        self.predecessor = Some(level);
        self
    }

    /// Validate against `WittLevelShape`.
    /// # Errors
    /// Returns `ShapeViolation` if any required field is missing.
    pub fn validate(self) -> Result<Validated<WittLevelDeclaration>, ShapeViolation> {
        let bw = match self.bit_width {
            Some(w) => w,
            None => {
                return Err(ShapeViolation {
                    shape_iri: "https://uor.foundation/conformance/WittLevelShape",
                    constraint_iri: "https://uor.foundation/conformance/WittLevelShape",
                    property_iri: "https://uor.foundation/conformance/declaredBitWidth",
                    expected_range: "http://www.w3.org/2001/XMLSchema#positiveInteger",
                    min_count: 1,
                    max_count: 1,
                    kind: ViolationKind::Missing,
                })
            }
        };
        let pred = match self.predecessor {
            Some(p) => p,
            None => {
                return Err(ShapeViolation {
                    shape_iri: "https://uor.foundation/conformance/WittLevelShape",
                    constraint_iri: "https://uor.foundation/conformance/WittLevelShape",
                    property_iri: "https://uor.foundation/conformance/predecessorLevel",
                    expected_range: "https://uor.foundation/schema/WittLevel",
                    min_count: 1,
                    max_count: 1,
                    kind: ViolationKind::Missing,
                })
            }
        };
        Ok(Validated::new(WittLevelDeclaration {
            bit_width: bw,
            predecessor: pred,
        }))
    }

    /// Phase C.1: const-fn companion for `WittLevelDeclarationBuilder::validate`.
    /// # Errors
    /// Returns `ShapeViolation` if any required field is missing.
    pub const fn validate_const(
        &self,
    ) -> Result<Validated<WittLevelDeclaration, CompileTime>, ShapeViolation> {
        let bw = match self.bit_width {
            Some(w) => w,
            None => {
                return Err(ShapeViolation {
                    shape_iri: "https://uor.foundation/conformance/WittLevelShape",
                    constraint_iri: "https://uor.foundation/conformance/WittLevelShape",
                    property_iri: "https://uor.foundation/conformance/declaredBitWidth",
                    expected_range: "http://www.w3.org/2001/XMLSchema#positiveInteger",
                    min_count: 1,
                    max_count: 1,
                    kind: ViolationKind::Missing,
                })
            }
        };
        let pred = match self.predecessor {
            Some(p) => p,
            None => {
                return Err(ShapeViolation {
                    shape_iri: "https://uor.foundation/conformance/WittLevelShape",
                    constraint_iri: "https://uor.foundation/conformance/WittLevelShape",
                    property_iri: "https://uor.foundation/conformance/predecessorLevel",
                    expected_range: "https://uor.foundation/schema/WittLevel",
                    min_count: 1,
                    max_count: 1,
                    kind: ViolationKind::Missing,
                })
            }
        };
        Ok(Validated::new(WittLevelDeclaration {
            bit_width: bw,
            predecessor: pred,
        }))
    }
}

impl Default for WittLevelDeclarationBuilder {
    fn default() -> Self {
        Self::new()
    }
}

/// Boundary session state tracker for the two-phase minting boundary.
/// Records crossing count and idempotency flag. Private fields
/// prevent external construction.
#[derive(Debug, Clone, PartialEq, Eq)]
pub struct BoundarySession {
    /// Total boundary crossings in this session.
    crossing_count: u32,
    /// Whether the boundary effect is idempotent.
    is_idempotent: bool,
}

impl BoundarySession {
    /// Creates a new boundary session. Only callable within the crate.
    #[inline]
    #[allow(dead_code)]
    pub(crate) const fn new(is_idempotent: bool) -> Self {
        Self {
            crossing_count: 0,
            is_idempotent,
        }
    }

    /// Returns the total boundary crossings.
    #[inline]
    #[must_use]
    pub const fn crossing_count(&self) -> u32 {
        self.crossing_count
    }

    /// Returns whether the boundary effect is idempotent.
    #[inline]
    #[must_use]
    pub const fn is_idempotent(&self) -> bool {
        self.is_idempotent
    }
}

/// Validate a scalar grounding intermediate against a `GroundingShape`
/// and mint it into a `Datum`. Only callable within `uor-foundation`.
/// # Errors
/// Returns `ShapeViolation` if the coordinate fails validation.
#[allow(dead_code)]
pub(crate) fn validate_and_mint_coord(
    grounded: GroundedCoord,
    shape: &Validated<GroundingDeclaration>,
    session: &mut BoundarySession,
) -> Result<Datum, ShapeViolation> {
    // The Validated<GroundingDeclaration> proves the shape was already
    // validated at builder time. The coordinate's level is guaranteed
    // correct by the closed GroundedCoordInner enum — the type system
    // enforces that only supported levels can be constructed.
    let _ = shape; // shape validation passed at builder time
    session.crossing_count += 1;
    let inner = match grounded.inner {
        GroundedCoordInner::W8(b) => DatumInner::W8(b),
        GroundedCoordInner::W16(b) => DatumInner::W16(b),
        GroundedCoordInner::W24(b) => DatumInner::W24(b),
        GroundedCoordInner::W32(b) => DatumInner::W32(b),
        GroundedCoordInner::W40(b) => DatumInner::W40(b),
        GroundedCoordInner::W48(b) => DatumInner::W48(b),
        GroundedCoordInner::W56(b) => DatumInner::W56(b),
        GroundedCoordInner::W64(b) => DatumInner::W64(b),
        GroundedCoordInner::W72(b) => DatumInner::W72(b),
        GroundedCoordInner::W80(b) => DatumInner::W80(b),
        GroundedCoordInner::W88(b) => DatumInner::W88(b),
        GroundedCoordInner::W96(b) => DatumInner::W96(b),
        GroundedCoordInner::W104(b) => DatumInner::W104(b),
        GroundedCoordInner::W112(b) => DatumInner::W112(b),
        GroundedCoordInner::W120(b) => DatumInner::W120(b),
        GroundedCoordInner::W128(b) => DatumInner::W128(b),
    };
    Ok(Datum { inner })
}

/// Validate a tuple grounding intermediate and mint into a `Datum`.
/// Only callable within `uor-foundation`.
/// Mints the first coordinate of the tuple as the representative `Datum`.
/// Composite multi-coordinate `Datum` construction depends on the target
/// type's site decomposition, which is resolved during reduction evaluation.
/// # Errors
/// Returns `ShapeViolation` if the tuple is empty or fails validation.
#[allow(dead_code)]
pub(crate) fn validate_and_mint_tuple<const N: usize>(
    grounded: GroundedTuple<N>,
    shape: &Validated<GroundingDeclaration>,
    session: &mut BoundarySession,
) -> Result<Datum, ShapeViolation> {
    if N == 0 {
        return Err(ShapeViolation {
            shape_iri: shape.inner().shape_iri,
            constraint_iri: shape.inner().shape_iri,
            property_iri: "https://uor.foundation/conformance/groundingSourceType",
            expected_range: "https://uor.foundation/type/TypeDefinition",
            min_count: 1,
            max_count: 0,
            kind: ViolationKind::CardinalityViolation,
        });
    }
    // Mint the first coordinate as the representative Datum.
    // The full tuple is decomposed during reduction evaluation,
    // where each coordinate maps to a site in the constrained type.
    validate_and_mint_coord(grounded.coords[0].clone(), shape, session)
}

/// Evaluate a binary ring operation at compile time.
/// One helper is emitted per `schema:WittLevel` individual. The `uor!`
/// proc macro delegates to these helpers; it never performs ring
/// arithmetic itself.
/// # Examples
/// ```rust
/// use uor_foundation::enforcement::{const_ring_eval_w8, const_ring_eval_unary_w8};
/// use uor_foundation::PrimitiveOp;
///
/// // Ring arithmetic in Z/256Z: all operations wrap modulo 256.
///
/// // Addition wraps: 200 + 100 = 300 -> 300 - 256 = 44
/// assert_eq!(const_ring_eval_w8(PrimitiveOp::Add, 200, 100), 44);
///
/// // Multiplication: 3 * 5 = 15 (no wrap needed)
/// assert_eq!(const_ring_eval_w8(PrimitiveOp::Mul, 3, 5), 15);
///
/// // XOR: bitwise exclusive-or
/// assert_eq!(const_ring_eval_w8(PrimitiveOp::Xor, 0b1010, 0b1100), 0b0110);
///
/// // Negation: neg(x) = 256 - x (additive inverse in Z/256Z)
/// assert_eq!(const_ring_eval_unary_w8(PrimitiveOp::Neg, 1), 255);
///
/// // The critical identity: neg(bnot(x)) = succ(x) for all x
/// let x = 42u8;
/// let lhs = const_ring_eval_unary_w8(PrimitiveOp::Neg,
///     const_ring_eval_unary_w8(PrimitiveOp::Bnot, x));
/// let rhs = const_ring_eval_unary_w8(PrimitiveOp::Succ, x);
/// assert_eq!(lhs, rhs);
/// ```
#[inline]
#[must_use]
pub const fn const_ring_eval_w8(op: PrimitiveOp, a: u8, b: u8) -> u8 {
    match op {
        PrimitiveOp::Add => a.wrapping_add(b),
        PrimitiveOp::Sub => a.wrapping_sub(b),
        PrimitiveOp::Mul => a.wrapping_mul(b),
        PrimitiveOp::Xor => a ^ b,
        PrimitiveOp::And => a & b,
        PrimitiveOp::Or => a | b,
        _ => 0,
    }
}

#[inline]
#[must_use]
pub const fn const_ring_eval_unary_w8(op: PrimitiveOp, a: u8) -> u8 {
    match op {
        PrimitiveOp::Neg => 0u8.wrapping_sub(a),
        PrimitiveOp::Bnot => !a,
        PrimitiveOp::Succ => a.wrapping_add(1),
        PrimitiveOp::Pred => a.wrapping_sub(1),
        _ => 0,
    }
}

#[inline]
#[must_use]
pub const fn const_ring_eval_w16(op: PrimitiveOp, a: u16, b: u16) -> u16 {
    match op {
        PrimitiveOp::Add => a.wrapping_add(b),
        PrimitiveOp::Sub => a.wrapping_sub(b),
        PrimitiveOp::Mul => a.wrapping_mul(b),
        PrimitiveOp::Xor => a ^ b,
        PrimitiveOp::And => a & b,
        PrimitiveOp::Or => a | b,
        _ => 0,
    }
}

#[inline]
#[must_use]
pub const fn const_ring_eval_unary_w16(op: PrimitiveOp, a: u16) -> u16 {
    match op {
        PrimitiveOp::Neg => 0u16.wrapping_sub(a),
        PrimitiveOp::Bnot => !a,
        PrimitiveOp::Succ => a.wrapping_add(1),
        PrimitiveOp::Pred => a.wrapping_sub(1),
        _ => 0,
    }
}

#[inline]
#[must_use]
pub const fn const_ring_eval_w24(op: PrimitiveOp, a: u32, b: u32) -> u32 {
    const MASK: u32 = (u64::MAX >> (64 - 24)) as u32;
    match op {
        PrimitiveOp::Add => (a.wrapping_add(b)) & MASK,
        PrimitiveOp::Sub => (a.wrapping_sub(b)) & MASK,
        PrimitiveOp::Mul => (a.wrapping_mul(b)) & MASK,
        PrimitiveOp::Xor => (a ^ b) & MASK,
        PrimitiveOp::And => (a & b) & MASK,
        PrimitiveOp::Or => (a | b) & MASK,
        _ => 0,
    }
}

#[inline]
#[must_use]
pub const fn const_ring_eval_unary_w24(op: PrimitiveOp, a: u32) -> u32 {
    const MASK: u32 = (u64::MAX >> (64 - 24)) as u32;
    match op {
        PrimitiveOp::Neg => (0u32.wrapping_sub(a)) & MASK,
        PrimitiveOp::Bnot => (!a) & MASK,
        PrimitiveOp::Succ => (a.wrapping_add(1)) & MASK,
        PrimitiveOp::Pred => (a.wrapping_sub(1)) & MASK,
        _ => 0,
    }
}

#[inline]
#[must_use]
pub const fn const_ring_eval_w32(op: PrimitiveOp, a: u32, b: u32) -> u32 {
    match op {
        PrimitiveOp::Add => a.wrapping_add(b),
        PrimitiveOp::Sub => a.wrapping_sub(b),
        PrimitiveOp::Mul => a.wrapping_mul(b),
        PrimitiveOp::Xor => a ^ b,
        PrimitiveOp::And => a & b,
        PrimitiveOp::Or => a | b,
        _ => 0,
    }
}

#[inline]
#[must_use]
pub const fn const_ring_eval_unary_w32(op: PrimitiveOp, a: u32) -> u32 {
    match op {
        PrimitiveOp::Neg => 0u32.wrapping_sub(a),
        PrimitiveOp::Bnot => !a,
        PrimitiveOp::Succ => a.wrapping_add(1),
        PrimitiveOp::Pred => a.wrapping_sub(1),
        _ => 0,
    }
}

#[inline]
#[must_use]
pub const fn const_ring_eval_w40(op: PrimitiveOp, a: u64, b: u64) -> u64 {
    const MASK: u64 = u64::MAX >> (64 - 40);
    match op {
        PrimitiveOp::Add => (a.wrapping_add(b)) & MASK,
        PrimitiveOp::Sub => (a.wrapping_sub(b)) & MASK,
        PrimitiveOp::Mul => (a.wrapping_mul(b)) & MASK,
        PrimitiveOp::Xor => (a ^ b) & MASK,
        PrimitiveOp::And => (a & b) & MASK,
        PrimitiveOp::Or => (a | b) & MASK,
        _ => 0,
    }
}

#[inline]
#[must_use]
pub const fn const_ring_eval_unary_w40(op: PrimitiveOp, a: u64) -> u64 {
    const MASK: u64 = u64::MAX >> (64 - 40);
    match op {
        PrimitiveOp::Neg => (0u64.wrapping_sub(a)) & MASK,
        PrimitiveOp::Bnot => (!a) & MASK,
        PrimitiveOp::Succ => (a.wrapping_add(1)) & MASK,
        PrimitiveOp::Pred => (a.wrapping_sub(1)) & MASK,
        _ => 0,
    }
}

#[inline]
#[must_use]
pub const fn const_ring_eval_w48(op: PrimitiveOp, a: u64, b: u64) -> u64 {
    const MASK: u64 = u64::MAX >> (64 - 48);
    match op {
        PrimitiveOp::Add => (a.wrapping_add(b)) & MASK,
        PrimitiveOp::Sub => (a.wrapping_sub(b)) & MASK,
        PrimitiveOp::Mul => (a.wrapping_mul(b)) & MASK,
        PrimitiveOp::Xor => (a ^ b) & MASK,
        PrimitiveOp::And => (a & b) & MASK,
        PrimitiveOp::Or => (a | b) & MASK,
        _ => 0,
    }
}

#[inline]
#[must_use]
pub const fn const_ring_eval_unary_w48(op: PrimitiveOp, a: u64) -> u64 {
    const MASK: u64 = u64::MAX >> (64 - 48);
    match op {
        PrimitiveOp::Neg => (0u64.wrapping_sub(a)) & MASK,
        PrimitiveOp::Bnot => (!a) & MASK,
        PrimitiveOp::Succ => (a.wrapping_add(1)) & MASK,
        PrimitiveOp::Pred => (a.wrapping_sub(1)) & MASK,
        _ => 0,
    }
}

#[inline]
#[must_use]
pub const fn const_ring_eval_w56(op: PrimitiveOp, a: u64, b: u64) -> u64 {
    const MASK: u64 = u64::MAX >> (64 - 56);
    match op {
        PrimitiveOp::Add => (a.wrapping_add(b)) & MASK,
        PrimitiveOp::Sub => (a.wrapping_sub(b)) & MASK,
        PrimitiveOp::Mul => (a.wrapping_mul(b)) & MASK,
        PrimitiveOp::Xor => (a ^ b) & MASK,
        PrimitiveOp::And => (a & b) & MASK,
        PrimitiveOp::Or => (a | b) & MASK,
        _ => 0,
    }
}

#[inline]
#[must_use]
pub const fn const_ring_eval_unary_w56(op: PrimitiveOp, a: u64) -> u64 {
    const MASK: u64 = u64::MAX >> (64 - 56);
    match op {
        PrimitiveOp::Neg => (0u64.wrapping_sub(a)) & MASK,
        PrimitiveOp::Bnot => (!a) & MASK,
        PrimitiveOp::Succ => (a.wrapping_add(1)) & MASK,
        PrimitiveOp::Pred => (a.wrapping_sub(1)) & MASK,
        _ => 0,
    }
}

#[inline]
#[must_use]
pub const fn const_ring_eval_w64(op: PrimitiveOp, a: u64, b: u64) -> u64 {
    match op {
        PrimitiveOp::Add => a.wrapping_add(b),
        PrimitiveOp::Sub => a.wrapping_sub(b),
        PrimitiveOp::Mul => a.wrapping_mul(b),
        PrimitiveOp::Xor => a ^ b,
        PrimitiveOp::And => a & b,
        PrimitiveOp::Or => a | b,
        _ => 0,
    }
}

#[inline]
#[must_use]
pub const fn const_ring_eval_unary_w64(op: PrimitiveOp, a: u64) -> u64 {
    match op {
        PrimitiveOp::Neg => 0u64.wrapping_sub(a),
        PrimitiveOp::Bnot => !a,
        PrimitiveOp::Succ => a.wrapping_add(1),
        PrimitiveOp::Pred => a.wrapping_sub(1),
        _ => 0,
    }
}

#[inline]
#[must_use]
pub const fn const_ring_eval_w72(op: PrimitiveOp, a: u128, b: u128) -> u128 {
    const MASK: u128 = u128::MAX >> (128 - 72);
    match op {
        PrimitiveOp::Add => (a.wrapping_add(b)) & MASK,
        PrimitiveOp::Sub => (a.wrapping_sub(b)) & MASK,
        PrimitiveOp::Mul => (a.wrapping_mul(b)) & MASK,
        PrimitiveOp::Xor => (a ^ b) & MASK,
        PrimitiveOp::And => (a & b) & MASK,
        PrimitiveOp::Or => (a | b) & MASK,
        _ => 0,
    }
}

#[inline]
#[must_use]
pub const fn const_ring_eval_unary_w72(op: PrimitiveOp, a: u128) -> u128 {
    const MASK: u128 = u128::MAX >> (128 - 72);
    match op {
        PrimitiveOp::Neg => (0u128.wrapping_sub(a)) & MASK,
        PrimitiveOp::Bnot => (!a) & MASK,
        PrimitiveOp::Succ => (a.wrapping_add(1)) & MASK,
        PrimitiveOp::Pred => (a.wrapping_sub(1)) & MASK,
        _ => 0,
    }
}

#[inline]
#[must_use]
pub const fn const_ring_eval_w80(op: PrimitiveOp, a: u128, b: u128) -> u128 {
    const MASK: u128 = u128::MAX >> (128 - 80);
    match op {
        PrimitiveOp::Add => (a.wrapping_add(b)) & MASK,
        PrimitiveOp::Sub => (a.wrapping_sub(b)) & MASK,
        PrimitiveOp::Mul => (a.wrapping_mul(b)) & MASK,
        PrimitiveOp::Xor => (a ^ b) & MASK,
        PrimitiveOp::And => (a & b) & MASK,
        PrimitiveOp::Or => (a | b) & MASK,
        _ => 0,
    }
}

#[inline]
#[must_use]
pub const fn const_ring_eval_unary_w80(op: PrimitiveOp, a: u128) -> u128 {
    const MASK: u128 = u128::MAX >> (128 - 80);
    match op {
        PrimitiveOp::Neg => (0u128.wrapping_sub(a)) & MASK,
        PrimitiveOp::Bnot => (!a) & MASK,
        PrimitiveOp::Succ => (a.wrapping_add(1)) & MASK,
        PrimitiveOp::Pred => (a.wrapping_sub(1)) & MASK,
        _ => 0,
    }
}

#[inline]
#[must_use]
pub const fn const_ring_eval_w88(op: PrimitiveOp, a: u128, b: u128) -> u128 {
    const MASK: u128 = u128::MAX >> (128 - 88);
    match op {
        PrimitiveOp::Add => (a.wrapping_add(b)) & MASK,
        PrimitiveOp::Sub => (a.wrapping_sub(b)) & MASK,
        PrimitiveOp::Mul => (a.wrapping_mul(b)) & MASK,
        PrimitiveOp::Xor => (a ^ b) & MASK,
        PrimitiveOp::And => (a & b) & MASK,
        PrimitiveOp::Or => (a | b) & MASK,
        _ => 0,
    }
}

#[inline]
#[must_use]
pub const fn const_ring_eval_unary_w88(op: PrimitiveOp, a: u128) -> u128 {
    const MASK: u128 = u128::MAX >> (128 - 88);
    match op {
        PrimitiveOp::Neg => (0u128.wrapping_sub(a)) & MASK,
        PrimitiveOp::Bnot => (!a) & MASK,
        PrimitiveOp::Succ => (a.wrapping_add(1)) & MASK,
        PrimitiveOp::Pred => (a.wrapping_sub(1)) & MASK,
        _ => 0,
    }
}

#[inline]
#[must_use]
pub const fn const_ring_eval_w96(op: PrimitiveOp, a: u128, b: u128) -> u128 {
    const MASK: u128 = u128::MAX >> (128 - 96);
    match op {
        PrimitiveOp::Add => (a.wrapping_add(b)) & MASK,
        PrimitiveOp::Sub => (a.wrapping_sub(b)) & MASK,
        PrimitiveOp::Mul => (a.wrapping_mul(b)) & MASK,
        PrimitiveOp::Xor => (a ^ b) & MASK,
        PrimitiveOp::And => (a & b) & MASK,
        PrimitiveOp::Or => (a | b) & MASK,
        _ => 0,
    }
}

#[inline]
#[must_use]
pub const fn const_ring_eval_unary_w96(op: PrimitiveOp, a: u128) -> u128 {
    const MASK: u128 = u128::MAX >> (128 - 96);
    match op {
        PrimitiveOp::Neg => (0u128.wrapping_sub(a)) & MASK,
        PrimitiveOp::Bnot => (!a) & MASK,
        PrimitiveOp::Succ => (a.wrapping_add(1)) & MASK,
        PrimitiveOp::Pred => (a.wrapping_sub(1)) & MASK,
        _ => 0,
    }
}

#[inline]
#[must_use]
pub const fn const_ring_eval_w104(op: PrimitiveOp, a: u128, b: u128) -> u128 {
    const MASK: u128 = u128::MAX >> (128 - 104);
    match op {
        PrimitiveOp::Add => (a.wrapping_add(b)) & MASK,
        PrimitiveOp::Sub => (a.wrapping_sub(b)) & MASK,
        PrimitiveOp::Mul => (a.wrapping_mul(b)) & MASK,
        PrimitiveOp::Xor => (a ^ b) & MASK,
        PrimitiveOp::And => (a & b) & MASK,
        PrimitiveOp::Or => (a | b) & MASK,
        _ => 0,
    }
}

#[inline]
#[must_use]
pub const fn const_ring_eval_unary_w104(op: PrimitiveOp, a: u128) -> u128 {
    const MASK: u128 = u128::MAX >> (128 - 104);
    match op {
        PrimitiveOp::Neg => (0u128.wrapping_sub(a)) & MASK,
        PrimitiveOp::Bnot => (!a) & MASK,
        PrimitiveOp::Succ => (a.wrapping_add(1)) & MASK,
        PrimitiveOp::Pred => (a.wrapping_sub(1)) & MASK,
        _ => 0,
    }
}

#[inline]
#[must_use]
pub const fn const_ring_eval_w112(op: PrimitiveOp, a: u128, b: u128) -> u128 {
    const MASK: u128 = u128::MAX >> (128 - 112);
    match op {
        PrimitiveOp::Add => (a.wrapping_add(b)) & MASK,
        PrimitiveOp::Sub => (a.wrapping_sub(b)) & MASK,
        PrimitiveOp::Mul => (a.wrapping_mul(b)) & MASK,
        PrimitiveOp::Xor => (a ^ b) & MASK,
        PrimitiveOp::And => (a & b) & MASK,
        PrimitiveOp::Or => (a | b) & MASK,
        _ => 0,
    }
}

#[inline]
#[must_use]
pub const fn const_ring_eval_unary_w112(op: PrimitiveOp, a: u128) -> u128 {
    const MASK: u128 = u128::MAX >> (128 - 112);
    match op {
        PrimitiveOp::Neg => (0u128.wrapping_sub(a)) & MASK,
        PrimitiveOp::Bnot => (!a) & MASK,
        PrimitiveOp::Succ => (a.wrapping_add(1)) & MASK,
        PrimitiveOp::Pred => (a.wrapping_sub(1)) & MASK,
        _ => 0,
    }
}

#[inline]
#[must_use]
pub const fn const_ring_eval_w120(op: PrimitiveOp, a: u128, b: u128) -> u128 {
    const MASK: u128 = u128::MAX >> (128 - 120);
    match op {
        PrimitiveOp::Add => (a.wrapping_add(b)) & MASK,
        PrimitiveOp::Sub => (a.wrapping_sub(b)) & MASK,
        PrimitiveOp::Mul => (a.wrapping_mul(b)) & MASK,
        PrimitiveOp::Xor => (a ^ b) & MASK,
        PrimitiveOp::And => (a & b) & MASK,
        PrimitiveOp::Or => (a | b) & MASK,
        _ => 0,
    }
}

#[inline]
#[must_use]
pub const fn const_ring_eval_unary_w120(op: PrimitiveOp, a: u128) -> u128 {
    const MASK: u128 = u128::MAX >> (128 - 120);
    match op {
        PrimitiveOp::Neg => (0u128.wrapping_sub(a)) & MASK,
        PrimitiveOp::Bnot => (!a) & MASK,
        PrimitiveOp::Succ => (a.wrapping_add(1)) & MASK,
        PrimitiveOp::Pred => (a.wrapping_sub(1)) & MASK,
        _ => 0,
    }
}

#[inline]
#[must_use]
pub const fn const_ring_eval_w128(op: PrimitiveOp, a: u128, b: u128) -> u128 {
    match op {
        PrimitiveOp::Add => a.wrapping_add(b),
        PrimitiveOp::Sub => a.wrapping_sub(b),
        PrimitiveOp::Mul => a.wrapping_mul(b),
        PrimitiveOp::Xor => a ^ b,
        PrimitiveOp::And => a & b,
        PrimitiveOp::Or => a | b,
        _ => 0,
    }
}

#[inline]
#[must_use]
pub const fn const_ring_eval_unary_w128(op: PrimitiveOp, a: u128) -> u128 {
    match op {
        PrimitiveOp::Neg => 0u128.wrapping_sub(a),
        PrimitiveOp::Bnot => !a,
        PrimitiveOp::Succ => a.wrapping_add(1),
        PrimitiveOp::Pred => a.wrapping_sub(1),
        _ => 0,
    }
}

/// v0.2.2 Phase C.3: foundation-internal generic backing for Witt
/// levels above W128. Holds an inline `[u64; N]` array with no heap
/// allocation, no global state, and `const fn` arithmetic throughout.
/// Constructors are `pub(crate)`; downstream cannot fabricate a `Limbs<N>`.
/// Multiplication is schoolbook-only at v0.2.2 Phase C.3; the Toom-Cook
/// framework with parametric splitting factor `R` ships in Phase C.4 via
/// the `resolver::multiplication::certify` resolver, which decides `R`
/// per call from a Landauer cost function constrained by stack budget.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
pub struct Limbs<const N: usize> {
    /// Little-endian limbs: `words[0]` is the low 64 bits.
    words: [u64; N],
    /// Prevents external construction.
    _sealed: (),
}

impl<const N: usize> Limbs<N> {
    /// Crate-internal constructor from a fixed-size limb array.
    #[inline]
    #[must_use]
    #[allow(dead_code)]
    pub(crate) const fn from_words(words: [u64; N]) -> Self {
        Self { words, _sealed: () }
    }

    /// All-zeros constructor.
    #[inline]
    #[must_use]
    #[allow(dead_code)]
    pub(crate) const fn zero() -> Self {
        Self {
            words: [0u64; N],
            _sealed: (),
        }
    }

    /// Returns a reference to the underlying limb array.
    #[inline]
    #[must_use]
    pub const fn words(&self) -> &[u64; N] {
        &self.words
    }

    /// Wrapping addition mod 2^(64*N). Const-fn schoolbook with carry.
    #[inline]
    #[must_use]
    #[allow(dead_code)]
    pub(crate) const fn wrapping_add(self, other: Self) -> Self {
        let mut out = [0u64; N];
        let mut carry: u64 = 0;
        let mut i = 0;
        while i < N {
            let (s1, c1) = self.words[i].overflowing_add(other.words[i]);
            let (s2, c2) = s1.overflowing_add(carry);
            out[i] = s2;
            carry = (c1 as u64) | (c2 as u64);
            i += 1;
        }
        Self {
            words: out,
            _sealed: (),
        }
    }

    /// Wrapping subtraction mod 2^(64*N). Const-fn schoolbook with borrow.
    #[inline]
    #[must_use]
    #[allow(dead_code)]
    pub(crate) const fn wrapping_sub(self, other: Self) -> Self {
        let mut out = [0u64; N];
        let mut borrow: u64 = 0;
        let mut i = 0;
        while i < N {
            let (d1, b1) = self.words[i].overflowing_sub(other.words[i]);
            let (d2, b2) = d1.overflowing_sub(borrow);
            out[i] = d2;
            borrow = (b1 as u64) | (b2 as u64);
            i += 1;
        }
        Self {
            words: out,
            _sealed: (),
        }
    }

    /// Wrapping schoolbook multiplication mod 2^(64*N). The high N limbs of
    /// the 2N-limb full product are discarded (mod 2^bits truncation).
    /// v0.2.2 Phase C.3: schoolbook only. Phase C.4 adds the Toom-Cook
    /// framework with parametric R via `resolver::multiplication::certify`.
    #[inline]
    #[must_use]
    #[allow(dead_code)]
    pub(crate) const fn wrapping_mul(self, other: Self) -> Self {
        let mut out = [0u64; N];
        let mut i = 0;
        while i < N {
            let mut carry: u128 = 0;
            let mut j = 0;
            while j < N - i {
                let prod = (self.words[i] as u128) * (other.words[j] as u128)
                    + (out[i + j] as u128)
                    + carry;
                out[i + j] = prod as u64;
                carry = prod >> 64;
                j += 1;
            }
            i += 1;
        }
        Self {
            words: out,
            _sealed: (),
        }
    }

    /// Bitwise XOR.
    #[inline]
    #[must_use]
    #[allow(dead_code)]
    pub(crate) const fn xor(self, other: Self) -> Self {
        let mut out = [0u64; N];
        let mut i = 0;
        while i < N {
            out[i] = self.words[i] ^ other.words[i];
            i += 1;
        }
        Self {
            words: out,
            _sealed: (),
        }
    }

    /// Bitwise AND.
    #[inline]
    #[must_use]
    #[allow(dead_code)]
    pub(crate) const fn and(self, other: Self) -> Self {
        let mut out = [0u64; N];
        let mut i = 0;
        while i < N {
            out[i] = self.words[i] & other.words[i];
            i += 1;
        }
        Self {
            words: out,
            _sealed: (),
        }
    }

    /// Bitwise OR.
    #[inline]
    #[must_use]
    #[allow(dead_code)]
    pub(crate) const fn or(self, other: Self) -> Self {
        let mut out = [0u64; N];
        let mut i = 0;
        while i < N {
            out[i] = self.words[i] | other.words[i];
            i += 1;
        }
        Self {
            words: out,
            _sealed: (),
        }
    }

    /// Bitwise NOT.
    #[inline]
    #[must_use]
    #[allow(dead_code)]
    pub(crate) const fn not(self) -> Self {
        let mut out = [0u64; N];
        let mut i = 0;
        while i < N {
            out[i] = !self.words[i];
            i += 1;
        }
        Self {
            words: out,
            _sealed: (),
        }
    }

    /// Mask the high bits of the value to keep only the low `bits` bits.
    /// Used at the arithmetic boundary for non-exact-fit Witt widths (e.g.,
    /// W160 over `Limbs<3>`: 64+64+32 bits = mask the upper 32 bits of words[2]).
    #[inline]
    #[must_use]
    #[allow(dead_code)]
    pub(crate) const fn mask_high_bits(self, bits: u32) -> Self {
        let mut out = self.words;
        let high_word_idx = (bits / 64) as usize;
        let low_bits_in_high_word = bits % 64;
        if low_bits_in_high_word != 0 && high_word_idx < N {
            let mask = (1u64 << low_bits_in_high_word) - 1;
            out[high_word_idx] &= mask;
            // Zero everything above the high word.
            let mut i = high_word_idx + 1;
            while i < N {
                out[i] = 0;
                i += 1;
            }
        } else if low_bits_in_high_word == 0 && high_word_idx < N {
            // bits is exactly a multiple of 64; zero everything from high_word_idx.
            let mut i = high_word_idx;
            while i < N {
                out[i] = 0;
                i += 1;
            }
        }
        Self {
            words: out,
            _sealed: (),
        }
    }
}

/// Sealed marker trait identifying types produced by the foundation crate's
/// conformance/reduction pipeline. v0.2.1 bounds `Validated<T>` on this trait
/// so downstream crates cannot fabricate `Validated<UserType>` — user types
/// cannot impl `OntologyTarget` because the supertrait is private.
pub trait OntologyTarget: ontology_target_sealed::Sealed {}

/// Sealed shim for `cert:GroundingCertificate`. Produced by GroundingAwareResolver.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
pub struct GroundingCertificate {
    witt_bits: u16,
    /// v0.2.2 T5: parametric content fingerprint computed at mint time
    /// by the consumer-supplied `Hasher`. Bit-equality on the full
    /// buffer + width tag, so two certs with different `OUTPUT_BYTES`
    /// are never equal even when leading bytes coincide.
    content_fingerprint: ContentFingerprint,
}

impl GroundingCertificate {
    /// Returns the Witt level the certificate was issued for. Sourced
    /// from the pipeline's substrate hash output at minting time.
    #[inline]
    #[must_use]
    pub const fn witt_bits(&self) -> u16 {
        self.witt_bits
    }

    /// v0.2.2 T5: returns the parametric content fingerprint of the
    /// source state, computed at mint time by the consumer-supplied
    /// `Hasher`. Active width recoverable via `width_bytes()`. Two
    /// certificates from different hashers are never equal because
    /// `ContentFingerprint::Eq` compares the full buffer + width tag.
    #[inline]
    #[must_use]
    pub const fn content_fingerprint(&self) -> ContentFingerprint {
        self.content_fingerprint
    }

    /// v0.2.2 T5 C3.g + T6.7: the only constructor — takes both the
    /// witt-bits value AND the parametric content fingerprint. Used by
    /// `pipeline::run` and `certify_*_const` to mint a certificate
    /// carrying the substrate-computed fingerprint of the source state.
    #[inline]
    #[must_use]
    #[allow(dead_code)]
    pub(crate) const fn with_level_and_fingerprint_const(
        witt_bits: u16,
        content_fingerprint: ContentFingerprint,
    ) -> Self {
        Self {
            witt_bits,
            content_fingerprint,
        }
    }
}

/// Sealed shim for `cert:LiftChainCertificate`. Carries the v0.2.1 `target_level()` accessor populated from the pipeline's StageOutcome.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
pub struct LiftChainCertificate {
    witt_bits: u16,
    /// v0.2.2 T5: parametric content fingerprint computed at mint time
    /// by the consumer-supplied `Hasher`. Bit-equality on the full
    /// buffer + width tag, so two certs with different `OUTPUT_BYTES`
    /// are never equal even when leading bytes coincide.
    content_fingerprint: ContentFingerprint,
}

impl LiftChainCertificate {
    /// Returns the Witt level the certificate was issued for. Sourced
    /// from the pipeline's substrate hash output at minting time.
    #[inline]
    #[must_use]
    pub const fn witt_bits(&self) -> u16 {
        self.witt_bits
    }

    /// v0.2.2 T5: returns the parametric content fingerprint of the
    /// source state, computed at mint time by the consumer-supplied
    /// `Hasher`. Active width recoverable via `width_bytes()`. Two
    /// certificates from different hashers are never equal because
    /// `ContentFingerprint::Eq` compares the full buffer + width tag.
    #[inline]
    #[must_use]
    pub const fn content_fingerprint(&self) -> ContentFingerprint {
        self.content_fingerprint
    }

    /// v0.2.2 T5 C3.g + T6.7: the only constructor — takes both the
    /// witt-bits value AND the parametric content fingerprint. Used by
    /// `pipeline::run` and `certify_*_const` to mint a certificate
    /// carrying the substrate-computed fingerprint of the source state.
    #[inline]
    #[must_use]
    #[allow(dead_code)]
    pub(crate) const fn with_level_and_fingerprint_const(
        witt_bits: u16,
        content_fingerprint: ContentFingerprint,
    ) -> Self {
        Self {
            witt_bits,
            content_fingerprint,
        }
    }
}

/// Sealed shim for `cert:InhabitanceCertificate` (v0.2.1).
#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
pub struct InhabitanceCertificate {
    witt_bits: u16,
    /// v0.2.2 T5: parametric content fingerprint computed at mint time
    /// by the consumer-supplied `Hasher`. Bit-equality on the full
    /// buffer + width tag, so two certs with different `OUTPUT_BYTES`
    /// are never equal even when leading bytes coincide.
    content_fingerprint: ContentFingerprint,
}

impl InhabitanceCertificate {
    /// Returns the Witt level the certificate was issued for. Sourced
    /// from the pipeline's substrate hash output at minting time.
    #[inline]
    #[must_use]
    pub const fn witt_bits(&self) -> u16 {
        self.witt_bits
    }

    /// v0.2.2 T5: returns the parametric content fingerprint of the
    /// source state, computed at mint time by the consumer-supplied
    /// `Hasher`. Active width recoverable via `width_bytes()`. Two
    /// certificates from different hashers are never equal because
    /// `ContentFingerprint::Eq` compares the full buffer + width tag.
    #[inline]
    #[must_use]
    pub const fn content_fingerprint(&self) -> ContentFingerprint {
        self.content_fingerprint
    }

    /// v0.2.2 T5 C3.g + T6.7: the only constructor — takes both the
    /// witt-bits value AND the parametric content fingerprint. Used by
    /// `pipeline::run` and `certify_*_const` to mint a certificate
    /// carrying the substrate-computed fingerprint of the source state.
    #[inline]
    #[must_use]
    #[allow(dead_code)]
    pub(crate) const fn with_level_and_fingerprint_const(
        witt_bits: u16,
        content_fingerprint: ContentFingerprint,
    ) -> Self {
        Self {
            witt_bits,
            content_fingerprint,
        }
    }
}

/// Sealed shim for `cert:CompletenessCertificate`.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
pub struct CompletenessCertificate {
    witt_bits: u16,
    /// v0.2.2 T5: parametric content fingerprint computed at mint time
    /// by the consumer-supplied `Hasher`. Bit-equality on the full
    /// buffer + width tag, so two certs with different `OUTPUT_BYTES`
    /// are never equal even when leading bytes coincide.
    content_fingerprint: ContentFingerprint,
}

impl CompletenessCertificate {
    /// Returns the Witt level the certificate was issued for. Sourced
    /// from the pipeline's substrate hash output at minting time.
    #[inline]
    #[must_use]
    pub const fn witt_bits(&self) -> u16 {
        self.witt_bits
    }

    /// v0.2.2 T5: returns the parametric content fingerprint of the
    /// source state, computed at mint time by the consumer-supplied
    /// `Hasher`. Active width recoverable via `width_bytes()`. Two
    /// certificates from different hashers are never equal because
    /// `ContentFingerprint::Eq` compares the full buffer + width tag.
    #[inline]
    #[must_use]
    pub const fn content_fingerprint(&self) -> ContentFingerprint {
        self.content_fingerprint
    }

    /// v0.2.2 T5 C3.g + T6.7: the only constructor — takes both the
    /// witt-bits value AND the parametric content fingerprint. Used by
    /// `pipeline::run` and `certify_*_const` to mint a certificate
    /// carrying the substrate-computed fingerprint of the source state.
    #[inline]
    #[must_use]
    #[allow(dead_code)]
    pub(crate) const fn with_level_and_fingerprint_const(
        witt_bits: u16,
        content_fingerprint: ContentFingerprint,
    ) -> Self {
        Self {
            witt_bits,
            content_fingerprint,
        }
    }
}

/// Sealed shim for `cert:MultiplicationCertificate` (v0.2.2 Phase C.4). Carries the cost-optimal Toom-Cook splitting factor R, the recursive sub-multiplication count, and the accumulated Landauer cost in nats.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
pub struct MultiplicationCertificate {
    witt_bits: u16,
    /// v0.2.2 T5: parametric content fingerprint computed at mint time
    /// by the consumer-supplied `Hasher`. Bit-equality on the full
    /// buffer + width tag, so two certs with different `OUTPUT_BYTES`
    /// are never equal even when leading bytes coincide.
    content_fingerprint: ContentFingerprint,
}

impl MultiplicationCertificate {
    /// Returns the Witt level the certificate was issued for. Sourced
    /// from the pipeline's substrate hash output at minting time.
    #[inline]
    #[must_use]
    pub const fn witt_bits(&self) -> u16 {
        self.witt_bits
    }

    /// v0.2.2 T5: returns the parametric content fingerprint of the
    /// source state, computed at mint time by the consumer-supplied
    /// `Hasher`. Active width recoverable via `width_bytes()`. Two
    /// certificates from different hashers are never equal because
    /// `ContentFingerprint::Eq` compares the full buffer + width tag.
    #[inline]
    #[must_use]
    pub const fn content_fingerprint(&self) -> ContentFingerprint {
        self.content_fingerprint
    }

    /// v0.2.2 T5 C3.g + T6.7: the only constructor — takes both the
    /// witt-bits value AND the parametric content fingerprint. Used by
    /// `pipeline::run` and `certify_*_const` to mint a certificate
    /// carrying the substrate-computed fingerprint of the source state.
    #[inline]
    #[must_use]
    #[allow(dead_code)]
    pub(crate) const fn with_level_and_fingerprint_const(
        witt_bits: u16,
        content_fingerprint: ContentFingerprint,
    ) -> Self {
        Self {
            witt_bits,
            content_fingerprint,
        }
    }
}

/// Sealed shim for `cert:PartitionCertificate` (v0.2.2 Phase E). Attests the partition component classification of a Datum.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
pub struct PartitionCertificate {
    witt_bits: u16,
    /// v0.2.2 T5: parametric content fingerprint computed at mint time
    /// by the consumer-supplied `Hasher`. Bit-equality on the full
    /// buffer + width tag, so two certs with different `OUTPUT_BYTES`
    /// are never equal even when leading bytes coincide.
    content_fingerprint: ContentFingerprint,
}

impl PartitionCertificate {
    /// Returns the Witt level the certificate was issued for. Sourced
    /// from the pipeline's substrate hash output at minting time.
    #[inline]
    #[must_use]
    pub const fn witt_bits(&self) -> u16 {
        self.witt_bits
    }

    /// v0.2.2 T5: returns the parametric content fingerprint of the
    /// source state, computed at mint time by the consumer-supplied
    /// `Hasher`. Active width recoverable via `width_bytes()`. Two
    /// certificates from different hashers are never equal because
    /// `ContentFingerprint::Eq` compares the full buffer + width tag.
    #[inline]
    #[must_use]
    pub const fn content_fingerprint(&self) -> ContentFingerprint {
        self.content_fingerprint
    }

    /// v0.2.2 T5 C3.g + T6.7: the only constructor — takes both the
    /// witt-bits value AND the parametric content fingerprint. Used by
    /// `pipeline::run` and `certify_*_const` to mint a certificate
    /// carrying the substrate-computed fingerprint of the source state.
    #[inline]
    #[must_use]
    #[allow(dead_code)]
    pub(crate) const fn with_level_and_fingerprint_const(
        witt_bits: u16,
        content_fingerprint: ContentFingerprint,
    ) -> Self {
        Self {
            witt_bits,
            content_fingerprint,
        }
    }
}

/// Sealed shim for `proof:ImpossibilityWitness`. Returned by completeness and grounding resolvers on failure.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
pub struct GenericImpossibilityWitness {
    /// Optional theorem / invariant IRI identifying the failed identity.
    /// `None` for legacy call sites minting via `Default::default()`;
    /// `Some(iri)` when the witness is constructed via `for_identity`
    /// (Product/Coproduct Completion Amendment §2.3a).
    identity: Option<&'static str>,
}

impl Default for GenericImpossibilityWitness {
    #[inline]
    fn default() -> Self {
        Self { identity: None }
    }
}

impl GenericImpossibilityWitness {
    /// Construct a witness citing a specific theorem / invariant IRI.
    /// Introduced by the Product/Coproduct Completion Amendment §2.3a
    /// so mint primitives can emit typed failures against `op/*` theorems
    /// and `foundation/*` layout invariants.
    #[inline]
    #[must_use]
    pub const fn for_identity(identity: &'static str) -> Self {
        Self {
            identity: Some(identity),
        }
    }

    /// Returns the theorem / invariant IRI this witness cites, if any.
    #[inline]
    #[must_use]
    pub const fn identity(&self) -> Option<&'static str> {
        self.identity
    }
}

/// Sealed shim for `proof:InhabitanceImpossibilityWitness` (v0.2.1).
#[derive(Debug, Default, Clone, Copy, PartialEq, Eq, Hash)]
pub struct InhabitanceImpossibilityWitness {
    _private: (),
}

/// Input shim for `type:ConstrainedType`. Used as `Certify::Input` for InhabitanceResolver, TowerCompletenessResolver, and IncrementalCompletenessResolver.
#[derive(Debug, Default, Clone, Copy, PartialEq, Eq, Hash)]
pub struct ConstrainedTypeInput {
    _private: (),
}

impl core::fmt::Display for GenericImpossibilityWitness {
    fn fmt(&self, f: &mut core::fmt::Formatter<'_>) -> core::fmt::Result {
        match self.identity {
            Some(iri) => write!(f, "GenericImpossibilityWitness({iri})"),
            None => f.write_str("GenericImpossibilityWitness"),
        }
    }
}
impl core::error::Error for GenericImpossibilityWitness {}

impl core::fmt::Display for InhabitanceImpossibilityWitness {
    fn fmt(&self, f: &mut core::fmt::Formatter<'_>) -> core::fmt::Result {
        f.write_str("InhabitanceImpossibilityWitness")
    }
}
impl core::error::Error for InhabitanceImpossibilityWitness {}

impl LiftChainCertificate {
    /// Returns the Witt level the certificate was issued for.
    #[inline]
    #[must_use]
    pub const fn target_level(&self) -> WittLevel {
        WittLevel::new(self.witt_bits as u32)
    }
}

impl InhabitanceCertificate {
    /// Returns the witness value tuple bytes when `verified` is true.
    /// The sealed shim returns `None`; real witnesses flow through the
    /// macro back-door path.
    #[inline]
    #[must_use]
    pub const fn witness(&self) -> Option<&'static [u8]> {
        None
    }
}

pub(crate) mod ontology_target_sealed {
    /// Private supertrait. Not implementable outside this crate.
    pub trait Sealed {}
    impl Sealed for super::GroundingCertificate {}
    impl Sealed for super::LiftChainCertificate {}
    impl Sealed for super::InhabitanceCertificate {}
    impl Sealed for super::CompletenessCertificate {}
    impl Sealed for super::MultiplicationCertificate {}
    impl Sealed for super::PartitionCertificate {}
    impl Sealed for super::GenericImpossibilityWitness {}
    impl Sealed for super::InhabitanceImpossibilityWitness {}
    impl Sealed for super::ConstrainedTypeInput {}
    impl Sealed for super::PartitionProductWitness {}
    impl Sealed for super::PartitionCoproductWitness {}
    impl Sealed for super::CartesianProductWitness {}
    impl Sealed for super::CompileUnit<'_> {}
}

impl OntologyTarget for GroundingCertificate {}
impl OntologyTarget for LiftChainCertificate {}
impl OntologyTarget for InhabitanceCertificate {}
impl OntologyTarget for CompletenessCertificate {}
impl OntologyTarget for MultiplicationCertificate {}
impl OntologyTarget for PartitionCertificate {}
impl OntologyTarget for GenericImpossibilityWitness {}
impl OntologyTarget for InhabitanceImpossibilityWitness {}
impl OntologyTarget for ConstrainedTypeInput {}
impl OntologyTarget for PartitionProductWitness {}
impl OntologyTarget for PartitionCoproductWitness {}
impl OntologyTarget for CartesianProductWitness {}
impl OntologyTarget for CompileUnit<'_> {}

/// v0.2.2 W11: supporting evidence type for `CompletenessCertificate`.
/// Linked from the certificate via the `Certificate::Evidence` associated type.
#[derive(Debug, Default, Clone, Copy, PartialEq, Eq, Hash)]
pub struct CompletenessAuditTrail {
    _private: (),
}

/// v0.2.2 W11: supporting evidence type for `LiftChainCertificate`.
#[derive(Debug, Default, Clone, Copy, PartialEq, Eq, Hash)]
pub struct ChainAuditTrail {
    _private: (),
}

/// v0.2.2 W11: supporting evidence type for `GeodesicCertificate`.
#[derive(Debug, Default, Clone, Copy, PartialEq, Eq, Hash)]
pub struct GeodesicEvidenceBundle {
    _private: (),
}

/// v0.2.2 W11: sealed carrier for `cert:TransformCertificate`.
/// Phase X.1: minted with a Witt level and content fingerprint so the
/// resolver whose `resolver:CertifyMapping` produces this class can fold
/// its decision into a content-addressed witness. The `with_level_and_fingerprint_const`
/// constructor matches every other `cert:Certificate` subclass.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
pub struct TransformCertificate {
    witt_bits: u16,
    content_fingerprint: ContentFingerprint,
    _private: (),
}

impl TransformCertificate {
    /// Phase X.1: content-addressed constructor. Mints a certificate
    /// carrying the Witt level and substrate-hasher fingerprint of the
    /// resolver decision. Crate-sealed so that only resolver kernels mint.
    #[inline]
    #[must_use]
    #[allow(dead_code)]
    pub(crate) const fn with_level_and_fingerprint_const(
        witt_bits: u16,
        content_fingerprint: ContentFingerprint,
    ) -> Self {
        Self {
            witt_bits,
            content_fingerprint,
            _private: (),
        }
    }

    /// Phase X.1: legacy zero-fingerprint constructor retained for
    /// `certify_*_const` callers that pre-date the X.1 cert-discrimination pass.
    #[inline]
    #[must_use]
    #[allow(dead_code)]
    pub(crate) const fn empty_const() -> Self {
        Self {
            witt_bits: 0,
            content_fingerprint: ContentFingerprint::zero(),
            _private: (),
        }
    }

    /// Phase X.1: the Witt level at which this certificate was minted.
    #[inline]
    #[must_use]
    pub const fn witt_bits(&self) -> u16 {
        self.witt_bits
    }

    /// Phase X.1: the content fingerprint of the resolver decision.
    #[inline]
    #[must_use]
    pub const fn content_fingerprint(&self) -> ContentFingerprint {
        self.content_fingerprint
    }
}

/// v0.2.2 W11: sealed carrier for `cert:IsometryCertificate`.
/// Phase X.1: minted with a Witt level and content fingerprint so the
/// resolver whose `resolver:CertifyMapping` produces this class can fold
/// its decision into a content-addressed witness. The `with_level_and_fingerprint_const`
/// constructor matches every other `cert:Certificate` subclass.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
pub struct IsometryCertificate {
    witt_bits: u16,
    content_fingerprint: ContentFingerprint,
    _private: (),
}

impl IsometryCertificate {
    /// Phase X.1: content-addressed constructor. Mints a certificate
    /// carrying the Witt level and substrate-hasher fingerprint of the
    /// resolver decision. Crate-sealed so that only resolver kernels mint.
    #[inline]
    #[must_use]
    #[allow(dead_code)]
    pub(crate) const fn with_level_and_fingerprint_const(
        witt_bits: u16,
        content_fingerprint: ContentFingerprint,
    ) -> Self {
        Self {
            witt_bits,
            content_fingerprint,
            _private: (),
        }
    }

    /// Phase X.1: legacy zero-fingerprint constructor retained for
    /// `certify_*_const` callers that pre-date the X.1 cert-discrimination pass.
    #[inline]
    #[must_use]
    #[allow(dead_code)]
    pub(crate) const fn empty_const() -> Self {
        Self {
            witt_bits: 0,
            content_fingerprint: ContentFingerprint::zero(),
            _private: (),
        }
    }

    /// Phase X.1: the Witt level at which this certificate was minted.
    #[inline]
    #[must_use]
    pub const fn witt_bits(&self) -> u16 {
        self.witt_bits
    }

    /// Phase X.1: the content fingerprint of the resolver decision.
    #[inline]
    #[must_use]
    pub const fn content_fingerprint(&self) -> ContentFingerprint {
        self.content_fingerprint
    }
}

/// v0.2.2 W11: sealed carrier for `cert:InvolutionCertificate`.
/// Phase X.1: minted with a Witt level and content fingerprint so the
/// resolver whose `resolver:CertifyMapping` produces this class can fold
/// its decision into a content-addressed witness. The `with_level_and_fingerprint_const`
/// constructor matches every other `cert:Certificate` subclass.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
pub struct InvolutionCertificate {
    witt_bits: u16,
    content_fingerprint: ContentFingerprint,
    _private: (),
}

impl InvolutionCertificate {
    /// Phase X.1: content-addressed constructor. Mints a certificate
    /// carrying the Witt level and substrate-hasher fingerprint of the
    /// resolver decision. Crate-sealed so that only resolver kernels mint.
    #[inline]
    #[must_use]
    #[allow(dead_code)]
    pub(crate) const fn with_level_and_fingerprint_const(
        witt_bits: u16,
        content_fingerprint: ContentFingerprint,
    ) -> Self {
        Self {
            witt_bits,
            content_fingerprint,
            _private: (),
        }
    }

    /// Phase X.1: legacy zero-fingerprint constructor retained for
    /// `certify_*_const` callers that pre-date the X.1 cert-discrimination pass.
    #[inline]
    #[must_use]
    #[allow(dead_code)]
    pub(crate) const fn empty_const() -> Self {
        Self {
            witt_bits: 0,
            content_fingerprint: ContentFingerprint::zero(),
            _private: (),
        }
    }

    /// Phase X.1: the Witt level at which this certificate was minted.
    #[inline]
    #[must_use]
    pub const fn witt_bits(&self) -> u16 {
        self.witt_bits
    }

    /// Phase X.1: the content fingerprint of the resolver decision.
    #[inline]
    #[must_use]
    pub const fn content_fingerprint(&self) -> ContentFingerprint {
        self.content_fingerprint
    }
}

/// v0.2.2 W11: sealed carrier for `cert:GeodesicCertificate`.
/// Phase X.1: minted with a Witt level and content fingerprint so the
/// resolver whose `resolver:CertifyMapping` produces this class can fold
/// its decision into a content-addressed witness. The `with_level_and_fingerprint_const`
/// constructor matches every other `cert:Certificate` subclass.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
pub struct GeodesicCertificate {
    witt_bits: u16,
    content_fingerprint: ContentFingerprint,
    _private: (),
}

impl GeodesicCertificate {
    /// Phase X.1: content-addressed constructor. Mints a certificate
    /// carrying the Witt level and substrate-hasher fingerprint of the
    /// resolver decision. Crate-sealed so that only resolver kernels mint.
    #[inline]
    #[must_use]
    #[allow(dead_code)]
    pub(crate) const fn with_level_and_fingerprint_const(
        witt_bits: u16,
        content_fingerprint: ContentFingerprint,
    ) -> Self {
        Self {
            witt_bits,
            content_fingerprint,
            _private: (),
        }
    }

    /// Phase X.1: legacy zero-fingerprint constructor retained for
    /// `certify_*_const` callers that pre-date the X.1 cert-discrimination pass.
    #[inline]
    #[must_use]
    #[allow(dead_code)]
    pub(crate) const fn empty_const() -> Self {
        Self {
            witt_bits: 0,
            content_fingerprint: ContentFingerprint::zero(),
            _private: (),
        }
    }

    /// Phase X.1: the Witt level at which this certificate was minted.
    #[inline]
    #[must_use]
    pub const fn witt_bits(&self) -> u16 {
        self.witt_bits
    }

    /// Phase X.1: the content fingerprint of the resolver decision.
    #[inline]
    #[must_use]
    pub const fn content_fingerprint(&self) -> ContentFingerprint {
        self.content_fingerprint
    }
}

/// v0.2.2 W11: sealed carrier for `cert:MeasurementCertificate`.
/// Phase X.1: minted with a Witt level and content fingerprint so the
/// resolver whose `resolver:CertifyMapping` produces this class can fold
/// its decision into a content-addressed witness. The `with_level_and_fingerprint_const`
/// constructor matches every other `cert:Certificate` subclass.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
pub struct MeasurementCertificate {
    witt_bits: u16,
    content_fingerprint: ContentFingerprint,
    _private: (),
}

impl MeasurementCertificate {
    /// Phase X.1: content-addressed constructor. Mints a certificate
    /// carrying the Witt level and substrate-hasher fingerprint of the
    /// resolver decision. Crate-sealed so that only resolver kernels mint.
    #[inline]
    #[must_use]
    #[allow(dead_code)]
    pub(crate) const fn with_level_and_fingerprint_const(
        witt_bits: u16,
        content_fingerprint: ContentFingerprint,
    ) -> Self {
        Self {
            witt_bits,
            content_fingerprint,
            _private: (),
        }
    }

    /// Phase X.1: legacy zero-fingerprint constructor retained for
    /// `certify_*_const` callers that pre-date the X.1 cert-discrimination pass.
    #[inline]
    #[must_use]
    #[allow(dead_code)]
    pub(crate) const fn empty_const() -> Self {
        Self {
            witt_bits: 0,
            content_fingerprint: ContentFingerprint::zero(),
            _private: (),
        }
    }

    /// Phase X.1: the Witt level at which this certificate was minted.
    #[inline]
    #[must_use]
    pub const fn witt_bits(&self) -> u16 {
        self.witt_bits
    }

    /// Phase X.1: the content fingerprint of the resolver decision.
    #[inline]
    #[must_use]
    pub const fn content_fingerprint(&self) -> ContentFingerprint {
        self.content_fingerprint
    }
}

/// v0.2.2 W11: sealed carrier for `cert:BornRuleVerification`.
/// Phase X.1: minted with a Witt level and content fingerprint so the
/// resolver whose `resolver:CertifyMapping` produces this class can fold
/// its decision into a content-addressed witness. The `with_level_and_fingerprint_const`
/// constructor matches every other `cert:Certificate` subclass.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
pub struct BornRuleVerification {
    witt_bits: u16,
    content_fingerprint: ContentFingerprint,
    _private: (),
}

impl BornRuleVerification {
    /// Phase X.1: content-addressed constructor. Mints a certificate
    /// carrying the Witt level and substrate-hasher fingerprint of the
    /// resolver decision. Crate-sealed so that only resolver kernels mint.
    #[inline]
    #[must_use]
    #[allow(dead_code)]
    pub(crate) const fn with_level_and_fingerprint_const(
        witt_bits: u16,
        content_fingerprint: ContentFingerprint,
    ) -> Self {
        Self {
            witt_bits,
            content_fingerprint,
            _private: (),
        }
    }

    /// Phase X.1: legacy zero-fingerprint constructor retained for
    /// `certify_*_const` callers that pre-date the X.1 cert-discrimination pass.
    #[inline]
    #[must_use]
    #[allow(dead_code)]
    pub(crate) const fn empty_const() -> Self {
        Self {
            witt_bits: 0,
            content_fingerprint: ContentFingerprint::zero(),
            _private: (),
        }
    }

    /// Phase X.1: the Witt level at which this certificate was minted.
    #[inline]
    #[must_use]
    pub const fn witt_bits(&self) -> u16 {
        self.witt_bits
    }

    /// Phase X.1: the content fingerprint of the resolver decision.
    #[inline]
    #[must_use]
    pub const fn content_fingerprint(&self) -> ContentFingerprint {
        self.content_fingerprint
    }
}

/// v0.2.2 W11: sealed marker trait for foundation-supplied certificate kinds.
/// Implemented by every `cert:Certificate` subclass via codegen; not
/// implementable outside this crate.
pub trait Certificate: certificate_sealed::Sealed {
    /// The ontology IRI of this certificate class.
    const IRI: &'static str;
    /// The structured evidence carried by this certificate (or `()` if none).
    type Evidence;
}

pub(crate) mod certificate_sealed {
    /// Private supertrait. Not implementable outside this crate.
    pub trait Sealed {}
    impl Sealed for super::GroundingCertificate {}
    impl Sealed for super::LiftChainCertificate {}
    impl Sealed for super::InhabitanceCertificate {}
    impl Sealed for super::CompletenessCertificate {}
    impl Sealed for super::TransformCertificate {}
    impl Sealed for super::IsometryCertificate {}
    impl Sealed for super::InvolutionCertificate {}
    impl Sealed for super::GeodesicCertificate {}
    impl Sealed for super::MeasurementCertificate {}
    impl Sealed for super::BornRuleVerification {}
    impl Sealed for super::MultiplicationCertificate {}
    impl Sealed for super::PartitionCertificate {}
    impl Sealed for super::GenericImpossibilityWitness {}
    impl Sealed for super::InhabitanceImpossibilityWitness {}
    impl Sealed for super::PartitionProductWitness {}
    impl Sealed for super::PartitionCoproductWitness {}
    impl Sealed for super::CartesianProductWitness {}
}

impl Certificate for GroundingCertificate {
    const IRI: &'static str = "https://uor.foundation/cert/GroundingCertificate";
    type Evidence = ();
}

impl Certificate for LiftChainCertificate {
    const IRI: &'static str = "https://uor.foundation/cert/LiftChainCertificate";
    type Evidence = ChainAuditTrail;
}

impl Certificate for InhabitanceCertificate {
    const IRI: &'static str = "https://uor.foundation/cert/InhabitanceCertificate";
    type Evidence = ();
}

impl Certificate for CompletenessCertificate {
    const IRI: &'static str = "https://uor.foundation/cert/CompletenessCertificate";
    type Evidence = CompletenessAuditTrail;
}

impl Certificate for TransformCertificate {
    const IRI: &'static str = "https://uor.foundation/cert/TransformCertificate";
    type Evidence = ();
}

impl Certificate for IsometryCertificate {
    const IRI: &'static str = "https://uor.foundation/cert/IsometryCertificate";
    type Evidence = ();
}

impl Certificate for InvolutionCertificate {
    const IRI: &'static str = "https://uor.foundation/cert/InvolutionCertificate";
    type Evidence = ();
}

impl Certificate for GeodesicCertificate {
    const IRI: &'static str = "https://uor.foundation/cert/GeodesicCertificate";
    type Evidence = GeodesicEvidenceBundle;
}

impl Certificate for MeasurementCertificate {
    const IRI: &'static str = "https://uor.foundation/cert/MeasurementCertificate";
    type Evidence = ();
}

impl Certificate for BornRuleVerification {
    const IRI: &'static str = "https://uor.foundation/cert/BornRuleVerification";
    type Evidence = ();
}

impl Certificate for MultiplicationCertificate {
    const IRI: &'static str = "https://uor.foundation/cert/MultiplicationCertificate";
    type Evidence = MultiplicationEvidence;
}

impl Certificate for PartitionCertificate {
    const IRI: &'static str = "https://uor.foundation/cert/PartitionCertificate";
    type Evidence = ();
}

impl Certificate for GenericImpossibilityWitness {
    const IRI: &'static str = "https://uor.foundation/cert/GenericImpossibilityCertificate";
    type Evidence = ();
}

impl Certificate for InhabitanceImpossibilityWitness {
    const IRI: &'static str = "https://uor.foundation/cert/InhabitanceImpossibilityCertificate";
    type Evidence = ();
}

/// Phase X.1: uniform mint interface over cert subclasses. Each
/// `Certificate` implementer that accepts `(witt_bits, ContentFingerprint)`
/// at construction time implements this trait. Lives inside a
/// `certify_const_mint` module so the symbol doesn't leak into top-level
/// documentation alongside `Certificate`.
pub(crate) mod certify_const_mint {
    use super::{Certificate, ContentFingerprint};
    pub trait MintWithLevelFingerprint: Certificate {
        fn mint_with_level_fingerprint(
            witt_bits: u16,
            content_fingerprint: ContentFingerprint,
        ) -> Self;
    }
    impl MintWithLevelFingerprint for super::GroundingCertificate {
        #[inline]
        fn mint_with_level_fingerprint(
            witt_bits: u16,
            content_fingerprint: ContentFingerprint,
        ) -> Self {
            super::GroundingCertificate::with_level_and_fingerprint_const(
                witt_bits,
                content_fingerprint,
            )
        }
    }
    impl MintWithLevelFingerprint for super::LiftChainCertificate {
        #[inline]
        fn mint_with_level_fingerprint(
            witt_bits: u16,
            content_fingerprint: ContentFingerprint,
        ) -> Self {
            super::LiftChainCertificate::with_level_and_fingerprint_const(
                witt_bits,
                content_fingerprint,
            )
        }
    }
    impl MintWithLevelFingerprint for super::InhabitanceCertificate {
        #[inline]
        fn mint_with_level_fingerprint(
            witt_bits: u16,
            content_fingerprint: ContentFingerprint,
        ) -> Self {
            super::InhabitanceCertificate::with_level_and_fingerprint_const(
                witt_bits,
                content_fingerprint,
            )
        }
    }
    impl MintWithLevelFingerprint for super::CompletenessCertificate {
        #[inline]
        fn mint_with_level_fingerprint(
            witt_bits: u16,
            content_fingerprint: ContentFingerprint,
        ) -> Self {
            super::CompletenessCertificate::with_level_and_fingerprint_const(
                witt_bits,
                content_fingerprint,
            )
        }
    }
    impl MintWithLevelFingerprint for super::MultiplicationCertificate {
        #[inline]
        fn mint_with_level_fingerprint(
            witt_bits: u16,
            content_fingerprint: ContentFingerprint,
        ) -> Self {
            super::MultiplicationCertificate::with_level_and_fingerprint_const(
                witt_bits,
                content_fingerprint,
            )
        }
    }
    impl MintWithLevelFingerprint for super::PartitionCertificate {
        #[inline]
        fn mint_with_level_fingerprint(
            witt_bits: u16,
            content_fingerprint: ContentFingerprint,
        ) -> Self {
            super::PartitionCertificate::with_level_and_fingerprint_const(
                witt_bits,
                content_fingerprint,
            )
        }
    }
    impl MintWithLevelFingerprint for super::TransformCertificate {
        #[inline]
        fn mint_with_level_fingerprint(
            witt_bits: u16,
            content_fingerprint: ContentFingerprint,
        ) -> Self {
            super::TransformCertificate::with_level_and_fingerprint_const(
                witt_bits,
                content_fingerprint,
            )
        }
    }
    impl MintWithLevelFingerprint for super::IsometryCertificate {
        #[inline]
        fn mint_with_level_fingerprint(
            witt_bits: u16,
            content_fingerprint: ContentFingerprint,
        ) -> Self {
            super::IsometryCertificate::with_level_and_fingerprint_const(
                witt_bits,
                content_fingerprint,
            )
        }
    }
    impl MintWithLevelFingerprint for super::InvolutionCertificate {
        #[inline]
        fn mint_with_level_fingerprint(
            witt_bits: u16,
            content_fingerprint: ContentFingerprint,
        ) -> Self {
            super::InvolutionCertificate::with_level_and_fingerprint_const(
                witt_bits,
                content_fingerprint,
            )
        }
    }
    impl MintWithLevelFingerprint for super::GeodesicCertificate {
        #[inline]
        fn mint_with_level_fingerprint(
            witt_bits: u16,
            content_fingerprint: ContentFingerprint,
        ) -> Self {
            super::GeodesicCertificate::with_level_and_fingerprint_const(
                witt_bits,
                content_fingerprint,
            )
        }
    }
    impl MintWithLevelFingerprint for super::MeasurementCertificate {
        #[inline]
        fn mint_with_level_fingerprint(
            witt_bits: u16,
            content_fingerprint: ContentFingerprint,
        ) -> Self {
            super::MeasurementCertificate::with_level_and_fingerprint_const(
                witt_bits,
                content_fingerprint,
            )
        }
    }
    impl MintWithLevelFingerprint for super::BornRuleVerification {
        #[inline]
        fn mint_with_level_fingerprint(
            witt_bits: u16,
            content_fingerprint: ContentFingerprint,
        ) -> Self {
            super::BornRuleVerification::with_level_and_fingerprint_const(
                witt_bits,
                content_fingerprint,
            )
        }
    }
}

/// v0.2.2 W11: parametric carrier for any foundation-supplied certificate.
/// Replaces the v0.2.1 per-class shim duplication. The `Certificate` trait
/// is sealed and the `_private` field prevents external construction; only
/// the foundation's pipeline / resolver paths produce `Certified<C>` values.
#[derive(Debug, Clone)]
pub struct Certified<C: Certificate> {
    /// The certificate kind value carried by this wrapper.
    inner: C,
    /// Phase A.1: the foundation-internal two-clock value read at witness issuance.
    uor_time: UorTime,
    /// Prevents external construction.
    _private: (),
}

impl<C: Certificate> Certified<C> {
    /// Returns a reference to the carried certificate kind value.
    #[inline]
    #[must_use]
    pub const fn certificate(&self) -> &C {
        &self.inner
    }

    /// Returns the ontology IRI of this certificate's kind.
    #[inline]
    #[must_use]
    pub const fn iri(&self) -> &'static str {
        C::IRI
    }

    /// Phase A.1: the foundation-internal two-clock value read at witness issuance.
    /// Maps `rewrite_steps` to `derivation:stepCount` and `landauer_nats` to
    /// `observable:LandauerCost`. Content-deterministic: same computation →
    /// same `UorTime`. Composable against wall-clock bounds via
    /// [`UorTime::min_wall_clock`] and a downstream-supplied `Calibration`.
    #[inline]
    #[must_use]
    pub const fn uor_time(&self) -> UorTime {
        self.uor_time
    }

    /// Crate-internal constructor. Reachable only from the pipeline / resolver paths.
    /// The `uor_time` is computed deterministically from the certificate kind's `IRI`
    /// length: the rewrite-step count is the IRI byte length, and the Landauer cost
    /// is `rewrite_steps × ln 2` (the Landauer-temperature cost of traversing that
    /// many orthogonal states). Two `Certified<C>` values with the same `C` share the
    /// same `UorTime`, preserving content-determinism across pipeline invocations.
    #[inline]
    #[allow(dead_code)]
    pub(crate) const fn new(inner: C) -> Self {
        // IRI length is the deterministic proxy for the cert class's structural
        // complexity. Phase D threads real resolver-counted steps through.
        let steps = C::IRI.len() as u64;
        let landauer = LandauerBudget::new((steps as f64) * core::f64::consts::LN_2);
        let uor_time = UorTime::new(landauer, steps);
        Self {
            inner,
            uor_time,
            _private: (),
        }
    }
}

/// v0.2.2 Phase C.4: call-site context consumed by the multiplication
/// resolver. Carries the stack budget (`linear:stackBudgetBytes`), the
/// const-eval regime, and the limb count of the operand's `Limbs<N>`
/// backing. The resolver picks the cost-optimal Toom-Cook splitting
/// factor R based on this context.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
pub struct MulContext {
    /// Stack budget available at the call site, in bytes. Zero is
    /// inadmissible; the resolver returns an impossibility witness.
    pub stack_budget_bytes: u64,
    /// True if this call is in const-eval context. In const-eval, only
    /// R = 1 (schoolbook) is admissible because deeper recursion blows
    /// the const-eval depth limit.
    pub const_eval: bool,
    /// Number of 64-bit limbs in the operand's `Limbs<N>` backing.
    /// Schoolbook cost is proportional to `N^2`; Karatsuba cost is
    /// proportional to `3 · (N/2)^2`. For native-backed levels
    /// (W8..W128), pass the equivalent limb count.
    pub limb_count: usize,
}

impl MulContext {
    /// Construct a new `MulContext` for the call site.
    #[inline]
    #[must_use]
    pub const fn new(stack_budget_bytes: u64, const_eval: bool, limb_count: usize) -> Self {
        Self {
            stack_budget_bytes,
            const_eval,
            limb_count,
        }
    }
}

/// v0.2.2 Phase C.4: evidence returned alongside a `MultiplicationCertificate`.
/// The certificate is a sealed handle; its evidence (chosen splitting factor,
/// sub-multiplication count, accumulated Landauer cost in nats) lives here.
#[derive(Debug, Clone, Copy, PartialEq)]
pub struct MultiplicationEvidence {
    splitting_factor: u32,
    sub_multiplication_count: u32,
    landauer_cost_nats_bits: u64,
}

impl MultiplicationEvidence {
    /// The Toom-Cook splitting factor R chosen by the resolver.
    #[inline]
    #[must_use]
    pub const fn splitting_factor(&self) -> u32 {
        self.splitting_factor
    }

    /// The recursive sub-multiplication count for one multiplication.
    #[inline]
    #[must_use]
    pub const fn sub_multiplication_count(&self) -> u32 {
        self.sub_multiplication_count
    }

    /// Accumulated Landauer cost in nats, priced per `op:OA_5`. Returned as the IEEE-754 bit pattern; project to `H::Decimal` at use sites via `<H::Decimal as DecimalTranscendental>::from_bits(_)`.
    #[inline]
    #[must_use]
    pub const fn landauer_cost_nats_bits(&self) -> u64 {
        self.landauer_cost_nats_bits
    }
}

impl MultiplicationCertificate {
    /// v0.2.2 T6.7: construct a `MultiplicationCertificate` with substrate-
    /// computed evidence. Crate-internal only; downstream obtains certificates
    /// via `resolver::multiplication::certify::<H>`.
    #[inline]
    #[must_use]
    pub(crate) fn with_evidence(
        splitting_factor: u32,
        sub_multiplication_count: u32,
        landauer_cost_nats_bits: u64,
        content_fingerprint: ContentFingerprint,
    ) -> Self {
        let _ = MultiplicationEvidence {
            splitting_factor,
            sub_multiplication_count,
            landauer_cost_nats_bits,
        };
        Self::with_level_and_fingerprint_const(32, content_fingerprint)
    }
}

/// v0.2.2 Phase E: maximum simplicial dimension tracked by the
/// constraint-nerve Betti-numbers vector. The bound is 8 for the
/// currently-supported WittLevel set per the existing partition:FreeRank
/// capacity properties; the constant is `pub` (part of the public-API
/// snapshot) so future expansions require explicit review.
pub const MAX_BETTI_DIMENSION: usize = 8;

/// Sealed newtype for the grounding completion ratio σ ∈
/// [0.0, 1.0]. σ = 1 indicates the ground state; σ = 0 the
/// unbound state. Backs observable:GroundingSigma. Phase 9: parametric over
/// the host's `H::Decimal` precision.
#[derive(Debug)]
pub struct SigmaValue<H: HostTypes = crate::DefaultHostTypes> {
    value: H::Decimal,
    _phantom: core::marker::PhantomData<H>,
    _sealed: (),
}

impl<H: HostTypes> Copy for SigmaValue<H> {}
impl<H: HostTypes> Clone for SigmaValue<H> {
    #[inline]
    fn clone(&self) -> Self {
        *self
    }
}
impl<H: HostTypes> PartialEq for SigmaValue<H> {
    #[inline]
    fn eq(&self, other: &Self) -> bool {
        self.value == other.value
    }
}

impl<H: HostTypes> SigmaValue<H> {
    /// Returns the stored σ value in the range [0.0, 1.0].
    #[inline]
    #[must_use]
    pub const fn value(&self) -> H::Decimal {
        self.value
    }

    /// Crate-internal constructor. Caller guarantees `value` is in
    /// the closed range [0.0, 1.0] and is not NaN.
    #[inline]
    #[must_use]
    #[allow(dead_code)]
    pub(crate) const fn new_unchecked(value: H::Decimal) -> Self {
        Self {
            value,
            _phantom: core::marker::PhantomData,
            _sealed: (),
        }
    }
}

/// Phase A.3: sealed stratum coordinate (the v₂ valuation of a `Datum` at level `L`).
/// Backs `schema:stratum`. The value is non-negative and bounded by `L`'s `bit_width`
/// per the ontology's `nonNegativeInteger` range. Constructed only by foundation code
/// at grounding time; no public constructor — the `Stratum<W8>` / `Stratum<W16>` / ...
/// type family is closed under the WittLevel individual set.
#[derive(Debug, Clone, Copy, PartialEq, Eq, PartialOrd, Ord, Hash)]
pub struct Stratum<L> {
    value: u32,
    _level: PhantomData<L>,
    _sealed: (),
}

impl<L> Stratum<L> {
    /// Returns the raw v₂ valuation as a `u32`. The value is bounded by `L`'s bit_width.
    #[inline]
    #[must_use]
    pub const fn as_u32(&self) -> u32 {
        self.value
    }

    /// Crate-internal constructor. Reachable only from grounding-time minting.
    #[inline]
    #[must_use]
    #[allow(dead_code)]
    pub(crate) const fn new(value: u32) -> Self {
        Self {
            value,
            _level: PhantomData,
            _sealed: (),
        }
    }
}

/// Phase A.4: sealed carrier for `observable:d_delta_metric` (metric incompatibility).
#[derive(Debug, Clone, Copy, PartialEq, Eq, PartialOrd, Ord, Hash)]
pub struct DDeltaMetric {
    value: i64,
    _sealed: (),
}

impl DDeltaMetric {
    /// Returns the signed incompatibility magnitude (ring distance minus Hamming distance).
    #[inline]
    #[must_use]
    pub const fn as_i64(&self) -> i64 {
        self.value
    }

    /// Crate-internal constructor.
    #[inline]
    #[must_use]
    #[allow(dead_code)]
    pub(crate) const fn new(value: i64) -> Self {
        Self { value, _sealed: () }
    }
}

/// Phase A.4: sealed carrier for `observable:euler_metric` (Euler characteristic).
#[derive(Debug, Clone, Copy, PartialEq, Eq, PartialOrd, Ord, Hash)]
pub struct EulerMetric {
    value: i64,
    _sealed: (),
}

impl EulerMetric {
    /// Returns the Euler characteristic χ of the constraint nerve.
    #[inline]
    #[must_use]
    pub const fn as_i64(&self) -> i64 {
        self.value
    }

    /// Crate-internal constructor.
    #[inline]
    #[must_use]
    #[allow(dead_code)]
    pub(crate) const fn new(value: i64) -> Self {
        Self { value, _sealed: () }
    }
}

/// Phase A.4: sealed carrier for `observable:residual_metric` (free-site count r).
#[derive(Debug, Clone, Copy, PartialEq, Eq, PartialOrd, Ord, Hash)]
pub struct ResidualMetric {
    value: u32,
    _sealed: (),
}

impl ResidualMetric {
    /// Returns the free-site count r at grounding time.
    #[inline]
    #[must_use]
    pub const fn as_u32(&self) -> u32 {
        self.value
    }

    /// Crate-internal constructor.
    #[inline]
    #[must_use]
    #[allow(dead_code)]
    pub(crate) const fn new(value: u32) -> Self {
        Self { value, _sealed: () }
    }
}

/// Phase A.4: sealed carrier for `observable:betti_metric` (Betti-number vector).
/// Fixed-capacity `[u32; MAX_BETTI_DIMENSION]` backing; no heap.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
pub struct BettiMetric {
    values: [u32; MAX_BETTI_DIMENSION],
    _sealed: (),
}

impl BettiMetric {
    /// Returns the Betti-number vector as a fixed-size array reference.
    #[inline]
    #[must_use]
    pub const fn as_array(&self) -> &[u32; MAX_BETTI_DIMENSION] {
        &self.values
    }

    /// Returns the individual Betti number βₖ for dimension k.
    /// Returns 0 when k >= MAX_BETTI_DIMENSION.
    #[inline]
    #[must_use]
    pub const fn beta(&self, k: usize) -> u32 {
        if k < MAX_BETTI_DIMENSION {
            self.values[k]
        } else {
            0
        }
    }

    /// Crate-internal constructor.
    #[inline]
    #[must_use]
    #[allow(dead_code)]
    pub(crate) const fn new(values: [u32; MAX_BETTI_DIMENSION]) -> Self {
        Self {
            values,
            _sealed: (),
        }
    }
}

/// Maximum site count of the Jacobian row per Datum at any supported
/// WittLevel. Sourced from the partition:FreeRank capacity bound.
/// v0.2.2 T2.6 (cleanup): reduced from 64 to 8 to keep `Grounded` under
/// the 256-byte size budget enforced by `phantom_tag::grounded_sealed_field_count_unchanged`.
/// 8 matches `MAX_BETTI_DIMENSION` and is sufficient for the v0.2.2 partition rank set.
pub const JACOBIAN_MAX_SITES: usize = 8;

/// v0.2.2 Phase E: sealed Jacobian row carrier, parametric over the
/// WittLevel marker. Fixed-size `[i64; JACOBIAN_MAX_SITES]` backing; no
/// heap. The row records the per-site partial derivative of the ring
/// operation that produced the Datum. Backs observable:JacobianObservable.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
pub struct JacobianMetric<L> {
    entries: [i64; JACOBIAN_MAX_SITES],
    len: u16,
    _level: PhantomData<L>,
    _sealed: (),
}

impl<L> JacobianMetric<L> {
    /// Construct a zeroed Jacobian row with the given active length.
    #[inline]
    #[must_use]
    #[allow(dead_code)]
    pub(crate) const fn zero(len: u16) -> Self {
        Self {
            entries: [0i64; JACOBIAN_MAX_SITES],
            len,
            _level: PhantomData,
            _sealed: (),
        }
    }

    /// v0.2.2 T2.6 (cleanup): crate-internal constructor used by the
    /// BaseMetric accessor on `Grounded` to return a `JacobianMetric`
    /// backed by stored field values.
    #[inline]
    #[must_use]
    #[allow(dead_code)]
    pub(crate) const fn from_entries(entries: [i64; JACOBIAN_MAX_SITES], len: u16) -> Self {
        Self {
            entries,
            len,
            _level: PhantomData,
            _sealed: (),
        }
    }

    /// Access the Jacobian row entries.
    #[inline]
    #[must_use]
    pub const fn entries(&self) -> &[i64; JACOBIAN_MAX_SITES] {
        &self.entries
    }

    /// Number of active sites (the row's logical length).
    #[inline]
    #[must_use]
    pub const fn len(&self) -> u16 {
        self.len
    }

    /// Whether the Jacobian row is empty.
    #[inline]
    #[must_use]
    pub const fn is_empty(&self) -> bool {
        self.len == 0
    }
}

/// v0.2.2 Phase E: sealed Partition component classification.
/// Closed enumeration mirroring the partition:PartitionComponent
/// ontology class.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
#[non_exhaustive]
pub enum PartitionComponent {
    /// The irreducible component.
    Irreducible,
    /// The reducible component.
    Reducible,
    /// The unit component.
    Units,
    /// The exterior component.
    Exterior,
}

/// Sealed marker trait identifying type:ConstrainedType subclasses that may
/// appear as the parameter of `Grounded<T>`.
/// v0.2.2 W2: the sealing now lives in a private `grounded_shape_sealed`
/// module — there is no `__macro_internals` back-door. The only impl is for
/// the foundation-supplied `ConstrainedTypeInput` shim. Downstream code that
/// needs to bind a user type as `T` in `Grounded<T>` does so via the
/// compile-time-evidence pattern: declare a
/// `const _VALIDATED_<T>: Validated<ConstrainedTypeInput, CompileTime> = ...;`
/// module-scope evidence constant, and the foundation's pipeline binds it.
mod grounded_shape_sealed {
    /// Private supertrait. Not implementable outside this crate.
    pub trait Sealed {}
    impl Sealed for super::ConstrainedTypeInput {}
}
/// v0.2.2 W2: sealed marker trait for shapes that can appear as the parameter
/// of `Grounded<T>`. Implemented only by `ConstrainedTypeInput`. Downstream
/// user types bind to this trait via the compile-time-evidence pattern in a
/// future v0.2.2 cookbook revision.
pub trait GroundedShape: grounded_shape_sealed::Sealed {}
impl GroundedShape for ConstrainedTypeInput {}

/// v0.2.2 T4.2: sealed content-addressed handle.
/// Wraps a 128-bit identity used for `BindingsTable` lookups and as a
/// compact identity handle for `Grounded` values. The underlying `u128`
/// is visible via `as_u128()` for interop. Distinct from
/// `ContentFingerprint` (the parametric-width fingerprint computed by
/// the substrate `Hasher` — see T5.C3.d below): `ContentAddress` is a
/// fixed 16-byte sortable handle, while `ContentFingerprint` is the full
/// substrate-computed identity that round-trips through `verify_trace`.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
pub struct ContentAddress {
    raw: u128,
    _sealed: (),
}

impl ContentAddress {
    /// The zero content address. Used as the "unset" placeholder in
    /// `BindingsTable` lookups, the default state of an uninitialised
    /// `Grounded::unit_address`, and the initial seed of replay folds.
    #[inline]
    #[must_use]
    pub const fn zero() -> Self {
        Self {
            raw: 0,
            _sealed: (),
        }
    }

    /// Returns the underlying 128-bit content hash.
    #[inline]
    #[must_use]
    pub const fn as_u128(&self) -> u128 {
        self.raw
    }

    /// Whether this content address is the zero handle.
    #[inline]
    #[must_use]
    pub const fn is_zero(&self) -> bool {
        self.raw == 0
    }

    /// v0.2.2 T5.C1: public ctor. Promoted from `pub(crate)` in T5 so
    /// downstream tests can construct deterministic `ContentAddress` values
    /// for fixture data without going through the foundation pipeline.
    #[inline]
    #[must_use]
    pub const fn from_u128(raw: u128) -> Self {
        Self { raw, _sealed: () }
    }

    /// v0.2.2 Phase P.3: construct a `ContentAddress` from a `u64` FNV-1a fingerprint
    /// by right-padding the value into the 128-bit address space. Used by
    /// `Binding::to_binding_entry` to bridge the `Binding.content_address: u64`
    /// carrier to the `BindingEntry.address: ContentAddress` (`u128`-backed) shape.
    /// The lift is `raw = (fingerprint as u128) << 64` — upper 64 bits carry the
    /// FNV-1a value; lower 64 bits are zero. Content-deterministic; round-trips via
    /// `ContentAddress::as_u128() >> 64` back to the original `u64`.
    #[inline]
    #[must_use]
    pub const fn from_u64_fingerprint(fingerprint: u64) -> Self {
        Self {
            raw: (fingerprint as u128) << 64,
            _sealed: (),
        }
    }
}

impl Default for ContentAddress {
    #[inline]
    fn default() -> Self {
        Self::zero()
    }
}

/// Trace wire-format identifier. Per the wiki's ADR-018, wire-format
/// identifiers are explicitly carved out of the `HostBounds` rule because
/// cross-implementation interop requires a single shared format identifier.
/// Increment when the layout changes (event ordering, trailing fields,
/// primitive-op discriminant table, certificate-kind discriminant table).
/// Pinned by the `rust/trace_byte_layout_pinned` conformance validator.
pub const TRACE_REPLAY_FORMAT_VERSION: u16 = 2;

/// v0.2.2 T5: pluggable content hasher with parametric output width.
/// The foundation does not ship an implementation. Downstream substrate
/// consumers (PRISM, application crates) supply their own `Hasher` impl
/// — BLAKE3, SHA-256, SHA-512, BLAKE2b, SipHash 2-4, FNV-1a, or any
/// other byte-stream hash whose output width satisfies the foundation's
/// derived collision-bound minimum.
/// # Foundation recommendation
/// The foundation **recommends BLAKE3** as the default substrate hash for
/// production deployments. BLAKE3 is fast, well-audited, has no known
/// cryptographic weaknesses, supports parallel and SIMD-accelerated
/// implementations, and has a flexible output length. PRISM ships a BLAKE3
/// `Hasher` impl as its production substrate; application crates should
/// use it unless they have a specific reason to deviate.
/// The recommendation is non-binding: any conforming `Hasher` impl works
/// with the foundation's pipeline and verify path. The foundation never
/// invokes a hash function itself, so the choice is fully a downstream
/// decision.
/// # Architecture
/// The architectural shape mirrors `Calibration`: the foundation defines
/// the abstract quantity (`ContentFingerprint`) and the substitution point
/// (`Hasher`); downstream provides the concrete substrate AND chooses the
/// output width within the foundation's correctness budget.
/// # Required laws
/// 1. **Width-in-budget**: `OUTPUT_BYTES` must be in
///    `[<B as HostBounds>::FINGERPRINT_MIN_BYTES, FP_MAX]` where `FP_MAX`
///    is the const-generic carrying `<B as HostBounds>::FINGERPRINT_MAX_BYTES`.
///    Enforced at codegen time via a `const _: () = assert!(...)` block
///    emitted inside every `pipeline::run::<T, _, H>` body.
/// 2. **Determinism**: identical byte sequences produce bit-identical outputs
///    across program runs, builds, target architectures, and rustc versions.
/// 3. **Sensitivity**: hashing two byte sequences that differ in any byte
///    produces two distinct outputs with probability bounded by the hasher's
///    documented collision rate.
/// 4. **No interior mutability**: `fold_byte` consumes `self` and returns a
///    new state. Impls that depend on hidden mutable state violate the contract.
/// # Example
/// ```
/// use uor_foundation::enforcement::Hasher;
/// /// Minimal 128-bit (16-byte) FNV-1a substrate — two 64-bit lanes.
/// #[derive(Clone, Copy)]
/// pub struct Fnv1a16 { a: u64, b: u64 }
/// impl Hasher for Fnv1a16 {
///     const OUTPUT_BYTES: usize = 16;
///     fn initial() -> Self {
///         Self { a: 0xcbf29ce484222325, b: 0x84222325cbf29ce4 }
///     }
///     fn fold_byte(mut self, x: u8) -> Self {
///         self.a ^= x as u64;
///         self.a = self.a.wrapping_mul(0x100000001b3);
///         self.b ^= (x as u64).rotate_left(8);
///         self.b = self.b.wrapping_mul(0x100000001b3);
///         self
///     }
///     fn finalize(self) -> [u8; 32] {
///         let mut buf = [0u8; 32];
///         buf[..8].copy_from_slice(&self.a.to_be_bytes());
///         buf[8..16].copy_from_slice(&self.b.to_be_bytes());
///         buf
///     }
/// }
/// ```
/// Above, `Hasher` is reached through its default const-generic
/// `<FP_MAX = 32>`, which is the `DefaultHostBounds::FINGERPRINT_MAX_BYTES`
/// value. Applications that select a different `HostBounds` impl write
/// `impl Hasher<{<MyBounds as HostBounds>::FINGERPRINT_MAX_BYTES}> for MyHasher`.
pub trait Hasher<const FP_MAX: usize = 32> {
    /// Active output width in bytes. Must lie within the bounds
    /// the application's selected `HostBounds` declares —
    /// `[<B as HostBounds>::FINGERPRINT_MIN_BYTES, FP_MAX]`.
    const OUTPUT_BYTES: usize;

    /// Initial hasher state.
    fn initial() -> Self;

    /// Fold a single byte into the running state.
    #[must_use]
    fn fold_byte(self, b: u8) -> Self;

    /// Fold a slice of bytes (default impl: byte-by-byte).
    #[inline]
    #[must_use]
    fn fold_bytes(mut self, bytes: &[u8]) -> Self
    where
        Self: Sized,
    {
        let mut i = 0;
        while i < bytes.len() {
            self = self.fold_byte(bytes[i]);
            i += 1;
        }
        self
    }

    /// Finalize into the canonical max-width buffer of `FP_MAX` bytes.
    /// Bytes `0..OUTPUT_BYTES` carry the hash result; bytes
    /// `OUTPUT_BYTES..FP_MAX` MUST be zero.
    fn finalize(self) -> [u8; FP_MAX];
}

/// Sealed parametric content fingerprint.
/// Wraps a fixed-capacity byte buffer of `FP_MAX` bytes plus the
/// active width in bytes. `FP_MAX` is the const-generic that carries
/// the application's selected `HostBounds::FINGERPRINT_MAX_BYTES`
/// (default = 32, matching `DefaultHostBounds`). The active width
/// is set by the producing `Hasher::OUTPUT_BYTES` and recorded so
/// downstream can distinguish "this is a 128-bit fingerprint" from
/// "this is a 256-bit fingerprint" without inspecting trailing zeros.
/// Equality is bit-equality on the full buffer + width tag, so two
/// fingerprints from different hashers (different widths) are never
/// equal even if their leading bytes happen to coincide. This prevents
/// silent collisions when downstream consumers mix substrate hashers.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
pub struct ContentFingerprint<const FP_MAX: usize = 32> {
    bytes: [u8; FP_MAX],
    width_bytes: u8,
    _sealed: (),
}

impl<const FP_MAX: usize> ContentFingerprint<FP_MAX> {
    /// Crate-internal zero placeholder. Used internally as the
    /// `Trace::empty()` field initializer and the `Default` impl. Not
    /// publicly constructible; downstream that needs a `ContentFingerprint`
    /// constructs one via `Hasher::finalize()` followed by `from_buffer()`.
    #[inline]
    #[must_use]
    #[allow(dead_code)]
    pub(crate) const fn zero() -> Self {
        Self {
            bytes: [0u8; FP_MAX],
            width_bytes: 0,
            _sealed: (),
        }
    }

    /// Whether this fingerprint is the all-zero placeholder.
    #[inline]
    #[must_use]
    pub const fn is_zero(&self) -> bool {
        self.width_bytes == 0
    }

    /// Active width in bytes (set by the producing hasher).
    #[inline]
    #[must_use]
    pub const fn width_bytes(&self) -> u8 {
        self.width_bytes
    }

    /// Active width in bits (`width_bytes * 8`).
    #[inline]
    #[must_use]
    pub const fn width_bits(&self) -> u16 {
        (self.width_bytes as u16) * 8
    }

    /// The full buffer. Bytes `0..width_bytes` are the hash; bytes
    /// `width_bytes..FP_MAX` are zero.
    #[inline]
    #[must_use]
    pub const fn as_bytes(&self) -> &[u8; FP_MAX] {
        &self.bytes
    }

    /// Construct a fingerprint from a hasher's finalize buffer + width tag.
    /// Production paths reach this via `pipeline::run::<T, _, H>`; test
    /// paths via the `__test_helpers` back-door.
    #[inline]
    #[must_use]
    pub const fn from_buffer(bytes: [u8; FP_MAX], width_bytes: u8) -> Self {
        Self {
            bytes,
            width_bytes,
            _sealed: (),
        }
    }
}

impl<const FP_MAX: usize> Default for ContentFingerprint<FP_MAX> {
    #[inline]
    fn default() -> Self {
        Self::zero()
    }
}

/// v0.2.2 T5: stable u8 discriminant for `PrimitiveOp`. Locked to the
/// codegen output order; do not reorder `PrimitiveOp` variants without
/// bumping `TRACE_REPLAY_FORMAT_VERSION`. Folded into the canonical byte
/// layout of every `TraceEvent` so substrate hashers produce stable
/// fingerprints across builds.
#[inline]
#[must_use]
pub const fn primitive_op_discriminant(op: crate::PrimitiveOp) -> u8 {
    match op {
        crate::PrimitiveOp::Neg => 0,
        crate::PrimitiveOp::Bnot => 1,
        crate::PrimitiveOp::Succ => 2,
        crate::PrimitiveOp::Pred => 3,
        crate::PrimitiveOp::Add => 4,
        crate::PrimitiveOp::Sub => 5,
        crate::PrimitiveOp::Mul => 6,
        crate::PrimitiveOp::Xor => 7,
        crate::PrimitiveOp::And => 8,
        crate::PrimitiveOp::Or => 9,
    }
}

/// v0.2.2 T5: stable u8 discriminant tag distinguishing the certificate
/// kinds the foundation pipeline mints. Folded into the trailing byte of
/// every canonical digest so two certificates over the same source unit
/// but of different kinds produce distinct fingerprints. Locked at v0.2.2;
/// reordering or inserting variants requires bumping
/// `TRACE_REPLAY_FORMAT_VERSION`.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
#[non_exhaustive]
pub enum CertificateKind {
    /// Cert minted by `pipeline::run` and `run_const` (retained for
    /// `run_grounding_aware`).
    Grounding,
    /// Cert minted by `certify_tower_completeness_const`.
    TowerCompleteness,
    /// Cert minted by `certify_incremental_completeness_const`.
    IncrementalCompleteness,
    /// Cert minted by `certify_inhabitance_const` / `run_inhabitance`.
    Inhabitance,
    /// Cert minted by `certify_multiplication_const`.
    Multiplication,
    /// Cert minted by `resolver::two_sat_decider::certify`.
    TwoSat,
    /// Cert minted by `resolver::horn_sat_decider::certify`.
    HornSat,
    /// Cert minted by `resolver::residual_verdict::certify`.
    ResidualVerdict,
    /// Cert minted by `resolver::canonical_form::certify`.
    CanonicalForm,
    /// Cert minted by `resolver::type_synthesis::certify`.
    TypeSynthesis,
    /// Cert minted by `resolver::homotopy::certify`.
    Homotopy,
    /// Cert minted by `resolver::monodromy::certify`.
    Monodromy,
    /// Cert minted by `resolver::moduli::certify`.
    Moduli,
    /// Cert minted by `resolver::jacobian_guided::certify`.
    JacobianGuided,
    /// Cert minted by `resolver::evaluation::certify`.
    Evaluation,
    /// Cert minted by `resolver::session::certify`.
    Session,
    /// Cert minted by `resolver::superposition::certify`.
    Superposition,
    /// Cert minted by `resolver::measurement::certify`.
    Measurement,
    /// Cert minted by `resolver::witt_level_resolver::certify`.
    WittLevel,
    /// Cert minted by `resolver::dihedral_factorization::certify`.
    DihedralFactorization,
    /// Cert minted by `resolver::completeness::certify`.
    Completeness,
    /// Cert minted by `resolver::geodesic_validator::certify`.
    GeodesicValidator,
}

/// v0.2.2 T5: stable u8 discriminant for `CertificateKind`. Folded into
/// the trailing byte of canonical digests via the `*Digest` types so two
/// distinct certificate kinds over the same source unit produce distinct
/// fingerprints. Locked at v0.2.2.
#[inline]
#[must_use]
pub const fn certificate_kind_discriminant(kind: CertificateKind) -> u8 {
    match kind {
        CertificateKind::Grounding => 1,
        CertificateKind::TowerCompleteness => 2,
        CertificateKind::IncrementalCompleteness => 3,
        CertificateKind::Inhabitance => 4,
        CertificateKind::Multiplication => 5,
        CertificateKind::TwoSat => 6,
        CertificateKind::HornSat => 7,
        CertificateKind::ResidualVerdict => 8,
        CertificateKind::CanonicalForm => 9,
        CertificateKind::TypeSynthesis => 10,
        CertificateKind::Homotopy => 11,
        CertificateKind::Monodromy => 12,
        CertificateKind::Moduli => 13,
        CertificateKind::JacobianGuided => 14,
        CertificateKind::Evaluation => 15,
        CertificateKind::Session => 16,
        CertificateKind::Superposition => 17,
        CertificateKind::Measurement => 18,
        CertificateKind::WittLevel => 19,
        CertificateKind::DihedralFactorization => 20,
        CertificateKind::Completeness => 21,
        CertificateKind::GeodesicValidator => 22,
    }
}

/// v0.2.2 T5: fold a `ConstraintRef` into a `Hasher` via the canonical
/// byte layout. Each variant emits a discriminant byte (1..=9) followed by
/// its payload bytes in big-endian order. Locked at v0.2.2; reordering
/// variants requires bumping `TRACE_REPLAY_FORMAT_VERSION`.
/// Used by `pipeline::run`, `run_const`, and the four `certify_*` entry
/// points to fold a unit's constraint set into the substrate fingerprint.
pub fn fold_constraint_ref<H: Hasher>(mut hasher: H, c: &crate::pipeline::ConstraintRef) -> H {
    use crate::pipeline::ConstraintRef as C;
    match c {
        C::Residue { modulus, residue } => {
            hasher = hasher.fold_byte(1);
            hasher = hasher.fold_bytes(&modulus.to_be_bytes());
            hasher = hasher.fold_bytes(&residue.to_be_bytes());
        }
        C::Hamming { bound } => {
            hasher = hasher.fold_byte(2);
            hasher = hasher.fold_bytes(&bound.to_be_bytes());
        }
        C::Depth { min, max } => {
            hasher = hasher.fold_byte(3);
            hasher = hasher.fold_bytes(&min.to_be_bytes());
            hasher = hasher.fold_bytes(&max.to_be_bytes());
        }
        C::Carry { site } => {
            hasher = hasher.fold_byte(4);
            hasher = hasher.fold_bytes(&site.to_be_bytes());
        }
        C::Site { position } => {
            hasher = hasher.fold_byte(5);
            hasher = hasher.fold_bytes(&position.to_be_bytes());
        }
        C::Affine {
            coefficients,
            coefficient_count,
            bias,
        } => {
            hasher = hasher.fold_byte(6);
            hasher = hasher.fold_bytes(&coefficient_count.to_be_bytes());
            let count = *coefficient_count as usize;
            let mut i = 0;
            while i < count && i < crate::pipeline::AFFINE_MAX_COEFFS {
                hasher = hasher.fold_bytes(&coefficients[i].to_be_bytes());
                i += 1;
            }
            hasher = hasher.fold_bytes(&bias.to_be_bytes());
        }
        C::SatClauses { clauses, num_vars } => {
            hasher = hasher.fold_byte(7);
            hasher = hasher.fold_bytes(&num_vars.to_be_bytes());
            hasher = hasher.fold_bytes(&(clauses.len() as u32).to_be_bytes());
            let mut i = 0;
            while i < clauses.len() {
                let clause = clauses[i];
                hasher = hasher.fold_bytes(&(clause.len() as u32).to_be_bytes());
                let mut j = 0;
                while j < clause.len() {
                    let (var, neg) = clause[j];
                    hasher = hasher.fold_bytes(&var.to_be_bytes());
                    hasher = hasher.fold_byte(if neg { 1 } else { 0 });
                    j += 1;
                }
                i += 1;
            }
        }
        C::Bound {
            observable_iri,
            bound_shape_iri,
            args_repr,
        } => {
            hasher = hasher.fold_byte(8);
            hasher = hasher.fold_bytes(observable_iri.as_bytes());
            hasher = hasher.fold_byte(0);
            hasher = hasher.fold_bytes(bound_shape_iri.as_bytes());
            hasher = hasher.fold_byte(0);
            hasher = hasher.fold_bytes(args_repr.as_bytes());
            hasher = hasher.fold_byte(0);
        }
        C::Conjunction {
            conjuncts,
            conjunct_count,
        } => {
            hasher = hasher.fold_byte(9);
            hasher = hasher.fold_bytes(&conjunct_count.to_be_bytes());
            let count = *conjunct_count as usize;
            let mut i = 0;
            while i < count && i < crate::pipeline::CONJUNCTION_MAX_TERMS {
                let lifted = conjuncts[i].into_constraint();
                hasher = fold_constraint_ref(hasher, &lifted);
                i += 1;
            }
        }
    }
    hasher
}

/// v0.2.2 T5: fold the canonical CompileUnit byte layout into a `Hasher`.
/// Layout: `level_bits (2 BE) || budget (8 BE) || iri bytes || 0x00 ||
/// site_count (8 BE) || for each constraint: fold_constraint_ref ||
/// certificate_kind_discriminant (1 byte trailing)`.
/// Locked at v0.2.2 by the `rust/trace_byte_layout_pinned` conformance
/// validator. Used by `pipeline::run`, `run_const`, and the four
/// `certify_*` entry points.
pub fn fold_unit_digest<H: Hasher>(
    mut hasher: H,
    level_bits: u16,
    budget: u64,
    iri: &str,
    site_count: usize,
    constraints: &[crate::pipeline::ConstraintRef],
    kind: CertificateKind,
) -> H {
    hasher = hasher.fold_bytes(&level_bits.to_be_bytes());
    hasher = hasher.fold_bytes(&budget.to_be_bytes());
    hasher = hasher.fold_bytes(iri.as_bytes());
    hasher = hasher.fold_byte(0);
    hasher = hasher.fold_bytes(&(site_count as u64).to_be_bytes());
    let mut i = 0;
    while i < constraints.len() {
        hasher = fold_constraint_ref(hasher, &constraints[i]);
        i += 1;
    }
    hasher = hasher.fold_byte(certificate_kind_discriminant(kind));
    hasher
}

/// v0.2.2 T5: fold the canonical ParallelDeclaration byte layout into a `Hasher`.
/// Layout: `site_count (8 BE) || iri bytes || 0x00 || decl_site_count (8 BE) ||
/// for each constraint: fold_constraint_ref || certificate_kind_discriminant`.
pub fn fold_parallel_digest<H: Hasher>(
    mut hasher: H,
    decl_site_count: u64,
    iri: &str,
    type_site_count: usize,
    constraints: &[crate::pipeline::ConstraintRef],
    kind: CertificateKind,
) -> H {
    hasher = hasher.fold_bytes(&decl_site_count.to_be_bytes());
    hasher = hasher.fold_bytes(iri.as_bytes());
    hasher = hasher.fold_byte(0);
    hasher = hasher.fold_bytes(&(type_site_count as u64).to_be_bytes());
    let mut i = 0;
    while i < constraints.len() {
        hasher = fold_constraint_ref(hasher, &constraints[i]);
        i += 1;
    }
    hasher = hasher.fold_byte(certificate_kind_discriminant(kind));
    hasher
}

/// v0.2.2 T5: fold the canonical StreamDeclaration byte layout into a `Hasher`.
pub fn fold_stream_digest<H: Hasher>(
    mut hasher: H,
    productivity_bound: u64,
    iri: &str,
    constraints: &[crate::pipeline::ConstraintRef],
    kind: CertificateKind,
) -> H {
    hasher = hasher.fold_bytes(&productivity_bound.to_be_bytes());
    hasher = hasher.fold_bytes(iri.as_bytes());
    hasher = hasher.fold_byte(0);
    let mut i = 0;
    while i < constraints.len() {
        hasher = fold_constraint_ref(hasher, &constraints[i]);
        i += 1;
    }
    hasher = hasher.fold_byte(certificate_kind_discriminant(kind));
    hasher
}

/// v0.2.2 T5: fold the canonical InteractionDeclaration byte layout into a `Hasher`.
pub fn fold_interaction_digest<H: Hasher>(
    mut hasher: H,
    convergence_seed: u64,
    iri: &str,
    constraints: &[crate::pipeline::ConstraintRef],
    kind: CertificateKind,
) -> H {
    hasher = hasher.fold_bytes(&convergence_seed.to_be_bytes());
    hasher = hasher.fold_bytes(iri.as_bytes());
    hasher = hasher.fold_byte(0);
    let mut i = 0;
    while i < constraints.len() {
        hasher = fold_constraint_ref(hasher, &constraints[i]);
        i += 1;
    }
    hasher = hasher.fold_byte(certificate_kind_discriminant(kind));
    hasher
}

/// v0.2.2 Phase J primitive: `reduction:ReductionStep` / `recursion:BoundedRecursion`.
/// Content-deterministic reduction signature: `(witt_bits, constraint_count, satisfiable_bit)`.
pub(crate) fn primitive_terminal_reduction<T: crate::pipeline::ConstrainedTypeShape + ?Sized>(
    witt_bits: u16,
) -> Result<(u16, u32, u8), PipelineFailure> {
    let outcome = crate::pipeline::run_reduction_stages::<T>(witt_bits)?;
    let satisfiable_bit: u8 = if outcome.satisfiable { 1 } else { 0 };
    Ok((
        outcome.witt_bits,
        T::CONSTRAINTS.len() as u32,
        satisfiable_bit,
    ))
}

/// v0.2.2 Phase J: fold the TerminalReduction triple into the hasher.
pub(crate) fn fold_terminal_reduction<H: Hasher>(
    mut hasher: H,
    witt_bits: u16,
    constraint_count: u32,
    satisfiable_bit: u8,
) -> H {
    hasher = hasher.fold_bytes(&witt_bits.to_be_bytes());
    hasher = hasher.fold_bytes(&constraint_count.to_be_bytes());
    hasher = hasher.fold_byte(satisfiable_bit);
    hasher
}

/// Phase X.4: `resolver:CechNerve` / `homology:ChainComplex`.
/// Computes the content-deterministic Betti tuple `[b_0, b_1, b_2, 0, .., 0]`
/// from the 2-complex constraint-nerve over `T::CONSTRAINTS`:
/// vertices = constraints, 1-simplices = pairs of constraints with intersecting
/// site support, 2-simplices = triples of constraints with a common site.
/// `b_k = dim ker(∂_k) - dim im(∂_{k+1})` for k ∈ {0,1,2}; `b_3..b_7 = 0`.
/// Ranks of the boundary operators ∂_1, ∂_2 are computed over ℤ/p (p prime,
/// `NERVE_RANK_MOD_P = 1_000_000_007`) by `integer_matrix_rank`. Nerve boundary
/// matrices have ±1/0 entries and are totally unimodular, so rank over ℤ/p
/// equals rank over ℚ equals rank over ℤ for any prime p not dividing a minor.
/// Phase 1a (orphan-closure): inputs larger than `NERVE_CONSTRAINTS_CAP = 8`
/// constraints or `NERVE_SITES_CAP = 8` sites return
/// `Err(GenericImpossibilityWitness::for_identity("NERVE_CAPACITY_EXCEEDED"))`
/// rather than silently truncating — truncation produced Betti numbers for a
/// differently-shaped complex than the caller asked about. Callers propagate
/// the witness via `?` (pattern mirrored on `primitive_terminal_reduction`).
/// # Errors
/// Returns `NERVE_CAPACITY_EXCEEDED` when either cap is exceeded.
pub fn primitive_simplicial_nerve_betti<T: crate::pipeline::ConstrainedTypeShape + ?Sized>(
) -> Result<[u32; MAX_BETTI_DIMENSION], GenericImpossibilityWitness> {
    let k_all = T::CONSTRAINTS.len();
    if k_all > NERVE_CONSTRAINTS_CAP {
        return Err(GenericImpossibilityWitness::for_identity(
            "NERVE_CAPACITY_EXCEEDED",
        ));
    }
    let s_all = T::SITE_COUNT;
    if s_all > NERVE_SITES_CAP {
        return Err(GenericImpossibilityWitness::for_identity(
            "NERVE_CAPACITY_EXCEEDED",
        ));
    }
    let n_constraints = k_all;
    let n_sites = s_all;
    let mut out = [0u32; MAX_BETTI_DIMENSION];
    if n_constraints == 0 {
        out[0] = 1;
        return Ok(out);
    }
    // Compute site-support bitmask per constraint (bit `s` set iff constraint touches site `s`).
    let mut support = [0u16; NERVE_CONSTRAINTS_CAP];
    let mut c = 0;
    while c < n_constraints {
        support[c] = constraint_site_support_mask::<T>(c, n_sites);
        c += 1;
    }
    // Enumerate 1-simplices: pairs (i,j) with i<j and support[i] & support[j] != 0.
    // Index in c1_pairs_lo/hi corresponds to the column in ∂_1 / row in ∂_2.
    let mut c1_pairs_lo = [0u8; NERVE_C1_MAX];
    let mut c1_pairs_hi = [0u8; NERVE_C1_MAX];
    let mut n_c1: usize = 0;
    let mut i = 0;
    while i < n_constraints {
        let mut j = i + 1;
        while j < n_constraints {
            if (support[i] & support[j]) != 0 && n_c1 < NERVE_C1_MAX {
                c1_pairs_lo[n_c1] = i as u8;
                c1_pairs_hi[n_c1] = j as u8;
                n_c1 += 1;
            }
            j += 1;
        }
        i += 1;
    }
    // Enumerate 2-simplices: triples (i,j,k) with i<j<k and support[i] & support[j] & support[k] != 0.
    let mut c2_i = [0u8; NERVE_C2_MAX];
    let mut c2_j = [0u8; NERVE_C2_MAX];
    let mut c2_k = [0u8; NERVE_C2_MAX];
    let mut n_c2: usize = 0;
    let mut i2 = 0;
    while i2 < n_constraints {
        let mut j2 = i2 + 1;
        while j2 < n_constraints {
            let mut k2 = j2 + 1;
            while k2 < n_constraints {
                if (support[i2] & support[j2] & support[k2]) != 0 && n_c2 < NERVE_C2_MAX {
                    c2_i[n_c2] = i2 as u8;
                    c2_j[n_c2] = j2 as u8;
                    c2_k[n_c2] = k2 as u8;
                    n_c2 += 1;
                }
                k2 += 1;
            }
            j2 += 1;
        }
        i2 += 1;
    }
    // Build ∂_1: rows = n_constraints (vertices of the nerve), cols = n_c1.
    // Convention: ∂(c_i, c_j) = c_j - c_i for i < j.
    let mut partial_1 = [[0i64; NERVE_C1_MAX]; NERVE_CONSTRAINTS_CAP];
    let mut e = 0;
    while e < n_c1 {
        let lo = c1_pairs_lo[e] as usize;
        let hi = c1_pairs_hi[e] as usize;
        partial_1[lo][e] = NERVE_RANK_MOD_P - 1; // -1 mod p
        partial_1[hi][e] = 1;
        e += 1;
    }
    let rank_1 = integer_matrix_rank::<NERVE_CONSTRAINTS_CAP, NERVE_C1_MAX>(
        &mut partial_1,
        n_constraints,
        n_c1,
    );
    // Build ∂_2: rows = n_c1, cols = n_c2.
    // Convention: ∂(c_i, c_j, c_k) = (c_j, c_k) - (c_i, c_k) + (c_i, c_j).
    let mut partial_2 = [[0i64; NERVE_C2_MAX]; NERVE_C1_MAX];
    let mut t = 0;
    while t < n_c2 {
        let ti = c2_i[t];
        let tj = c2_j[t];
        let tk = c2_k[t];
        let idx_jk = find_pair_index(&c1_pairs_lo, &c1_pairs_hi, n_c1, tj, tk);
        let idx_ik = find_pair_index(&c1_pairs_lo, &c1_pairs_hi, n_c1, ti, tk);
        let idx_ij = find_pair_index(&c1_pairs_lo, &c1_pairs_hi, n_c1, ti, tj);
        if idx_jk < NERVE_C1_MAX {
            partial_2[idx_jk][t] = 1;
        }
        if idx_ik < NERVE_C1_MAX {
            partial_2[idx_ik][t] = NERVE_RANK_MOD_P - 1;
        }
        if idx_ij < NERVE_C1_MAX {
            partial_2[idx_ij][t] = 1;
        }
        t += 1;
    }
    let rank_2 = integer_matrix_rank::<NERVE_C1_MAX, NERVE_C2_MAX>(&mut partial_2, n_c1, n_c2);
    // b_0 = |C_0| - rank(∂_1). Always ≥ 1 because partial_1 has at least one all-zero row.
    let b0 = (n_constraints - rank_1) as u32;
    // b_1 = (|C_1| - rank(∂_1)) - rank(∂_2).
    let cycles_1 = n_c1.saturating_sub(rank_1);
    let b1 = cycles_1.saturating_sub(rank_2) as u32;
    // b_2 = |C_2| - rank(∂_2) (the complex is 2-dimensional; no ∂_3).
    let b2 = n_c2.saturating_sub(rank_2) as u32;
    out[0] = if b0 == 0 { 1 } else { b0 };
    if MAX_BETTI_DIMENSION > 1 {
        out[1] = b1;
    }
    if MAX_BETTI_DIMENSION > 2 {
        out[2] = b2;
    }
    Ok(out)
}

/// Phase X.4: cap on the number of constraints considered by the nerve
/// primitive. Phase 1a (orphan-closure): inputs exceeding this cap are
/// rejected via `NERVE_CAPACITY_EXCEEDED` (was previously silent truncation).
pub const NERVE_CONSTRAINTS_CAP: usize = 8;

/// Phase X.4: cap on site-support bitmask width (matches `u16` storage).
/// Phase 1a (orphan-closure): inputs exceeding this cap are rejected via
/// `NERVE_CAPACITY_EXCEEDED` (was previously silent truncation).
pub const NERVE_SITES_CAP: usize = 8;

/// Phase X.4: maximum number of 1-simplices = C(NERVE_CONSTRAINTS_CAP, 2) = 28.
pub const NERVE_C1_MAX: usize = 28;

/// Phase X.4: maximum number of 2-simplices = C(NERVE_CONSTRAINTS_CAP, 3) = 56.
pub const NERVE_C2_MAX: usize = 56;

/// Phase X.4: prime modulus for nerve boundary-matrix rank computation.
/// Chosen so `(i64 * i64) mod p` never overflows (`p² < 2⁶³`). Nerve boundary
/// matrices have entries in {-1, 0, 1}; rank over ℤ/p equals rank over ℚ.
pub(crate) const NERVE_RANK_MOD_P: i64 = 1_000_000_007;

/// Phase X.4: per-constraint site-support bitmask. Returns bit `s` set iff
/// constraint `c` in `T::CONSTRAINTS` touches site index `s` (`s < n_sites`).
/// `Affine { coefficients, .. }` returns the bitmask of sites whose
/// coefficient is non-zero — the natural "site support" of the affine
/// relation. Remaining non-site-local variants (Residue, Hamming, Depth,
/// Bound, Conjunction, SatClauses) return an all-ones mask over `n_sites`.
pub(crate) const fn constraint_site_support_mask<
    T: crate::pipeline::ConstrainedTypeShape + ?Sized,
>(
    c: usize,
    n_sites: usize,
) -> u16 {
    let all_mask: u16 = if n_sites == 0 {
        0
    } else {
        (1u16 << n_sites) - 1
    };
    match &T::CONSTRAINTS[c] {
        crate::pipeline::ConstraintRef::Site { position } => {
            if n_sites == 0 {
                0
            } else {
                1u16 << (*position as usize % n_sites)
            }
        }
        crate::pipeline::ConstraintRef::Carry { site } => {
            if n_sites == 0 {
                0
            } else {
                1u16 << (*site as usize % n_sites)
            }
        }
        crate::pipeline::ConstraintRef::Affine {
            coefficients,
            coefficient_count,
            ..
        } => {
            if n_sites == 0 {
                0
            } else {
                let mut mask: u16 = 0;
                let count = *coefficient_count as usize;
                let mut i = 0;
                while i < count && i < crate::pipeline::AFFINE_MAX_COEFFS && i < n_sites {
                    if coefficients[i] != 0 {
                        mask |= 1u16 << i;
                    }
                    i += 1;
                }
                if mask == 0 {
                    all_mask
                } else {
                    mask
                }
            }
        }
        _ => all_mask,
    }
}

/// Phase X.4: find the column index of the 1-simplex (lo, hi) in the enumerated
/// pair list. Returns `NERVE_C1_MAX` (sentinel = not found) when absent.
pub(crate) const fn find_pair_index(
    lo_arr: &[u8; NERVE_C1_MAX],
    hi_arr: &[u8; NERVE_C1_MAX],
    n_c1: usize,
    lo: u8,
    hi: u8,
) -> usize {
    let mut i = 0;
    while i < n_c1 {
        if lo_arr[i] == lo && hi_arr[i] == hi {
            return i;
        }
        i += 1;
    }
    NERVE_C1_MAX
}

/// Phase X.4: rank of an integer matrix over ℤ/`NERVE_RANK_MOD_P` via modular
/// Gaussian elimination. Entries are reduced mod p and elimination uses
/// Fermat-inverse pivot normalization. For ±1/0 boundary matrices this
/// coincides with rank over ℤ.
pub(crate) const fn integer_matrix_rank<const R: usize, const C: usize>(
    matrix: &mut [[i64; C]; R],
    rows: usize,
    cols: usize,
) -> usize {
    let p = NERVE_RANK_MOD_P;
    // Reduce all entries into [0, p).
    let mut r = 0;
    while r < rows {
        let mut c = 0;
        while c < cols {
            let v = matrix[r][c] % p;
            matrix[r][c] = if v < 0 { v + p } else { v };
            c += 1;
        }
        r += 1;
    }
    let mut rank: usize = 0;
    let mut col: usize = 0;
    while col < cols && rank < rows {
        // Find a pivot row in column `col`, starting at `rank`.
        let mut pivot_row = rank;
        while pivot_row < rows && matrix[pivot_row][col] == 0 {
            pivot_row += 1;
        }
        if pivot_row == rows {
            col += 1;
            continue;
        }
        // Swap into position.
        if pivot_row != rank {
            let mut k = 0;
            while k < cols {
                let tmp = matrix[rank][k];
                matrix[rank][k] = matrix[pivot_row][k];
                matrix[pivot_row][k] = tmp;
                k += 1;
            }
        }
        // Normalize pivot row to have leading 1.
        let pivot = matrix[rank][col];
        let pivot_inv = mod_pow(pivot, p - 2, p);
        let mut k = 0;
        while k < cols {
            matrix[rank][k] = (matrix[rank][k] * pivot_inv) % p;
            k += 1;
        }
        // Eliminate the column entry from every other row.
        let mut r2 = 0;
        while r2 < rows {
            if r2 != rank {
                let factor = matrix[r2][col];
                if factor != 0 {
                    let mut kk = 0;
                    while kk < cols {
                        let sub = (matrix[rank][kk] * factor) % p;
                        let mut v = matrix[r2][kk] - sub;
                        v %= p;
                        if v < 0 {
                            v += p;
                        }
                        matrix[r2][kk] = v;
                        kk += 1;
                    }
                }
            }
            r2 += 1;
        }
        rank += 1;
        col += 1;
    }
    rank
}

/// Phase X.4: modular exponentiation `base^exp mod p`, const-fn. Used by
/// `integer_matrix_rank` via Fermat's little theorem for modular inverses.
pub(crate) const fn mod_pow(base: i64, exp: i64, p: i64) -> i64 {
    let mut result: i64 = 1;
    let mut b = ((base % p) + p) % p;
    let mut e = exp;
    while e > 0 {
        if e & 1 == 1 {
            result = (result * b) % p;
        }
        b = (b * b) % p;
        e >>= 1;
    }
    result
}

/// v0.2.2 Phase J: fold the Betti tuple into the hasher.
pub(crate) fn fold_betti_tuple<H: Hasher>(mut hasher: H, betti: &[u32; MAX_BETTI_DIMENSION]) -> H {
    let mut i = 0;
    while i < MAX_BETTI_DIMENSION {
        hasher = hasher.fold_bytes(&betti[i].to_be_bytes());
        i += 1;
    }
    hasher
}

/// v0.2.2 Phase J: Euler characteristic `χ = Σ(-1)^k b_k` from the Betti tuple.
#[must_use]
pub(crate) fn primitive_euler_characteristic(betti: &[u32; MAX_BETTI_DIMENSION]) -> i64 {
    let mut chi: i64 = 0;
    let mut k = 0;
    while k < MAX_BETTI_DIMENSION {
        let term = betti[k] as i64;
        if k % 2 == 0 {
            chi += term;
        } else {
            chi -= term;
        }
        k += 1;
    }
    chi
}

/// v0.2.2 Phase J primitive: `op:DihedralGroup` / `op:D_7`.
/// Returns `(orbit_size, representative)` under D_{2^n} acting on `T::SITE_COUNT`.
/// `orbit_size = 2n` when n ≥ 2, 2 when n == 1, 1 when n == 0 (group identity only).
/// `representative` is the lexicographically-minimal element of the orbit of
/// site 0 under D_{2n}: rotations `r^k → k mod n` and reflections `s·r^k → (n - k) mod n`.
/// For the orbit of site 0, both maps produce 0 as a group element, so the
/// representative is always 0; for a non-canonical starting index `i`, the
/// representative would be `min(i, (n - i) mod n)`. This helper uses site 0 as the
/// canonical starting point (the foundation's convention), so the representative
/// reflects the orbit's algebraic content, not a sentinel.
pub(crate) fn primitive_dihedral_signature<T: crate::pipeline::ConstrainedTypeShape + ?Sized>(
) -> (u32, u32) {
    let n = T::SITE_COUNT as u32;
    let orbit_size = if n < 2 {
        if n == 0 {
            1
        } else {
            2
        }
    } else {
        2 * n
    };
    // v0.2.2 Phase S.2: compute the lexicographically-minimal orbit element.
    // Orbit of site 0 under D_{2n} contains: rotation images {0, 1, ..., n-1}
    // (since r^k maps 0 → k mod n) and reflection images {0, n-1, n-2, ..., 1}
    // (since s·r^k maps 0 → (n - k) mod n). The union is {0, 1, ..., n-1}.
    // The lex-min is 0 by construction; formalize it by min-walking the orbit.
    let mut rep: u32 = 0;
    let mut k = 1u32;
    while k < n {
        let rot = k % n;
        let refl = (n - k) % n;
        if rot < rep {
            rep = rot;
        }
        if refl < rep {
            rep = refl;
        }
        k += 1;
    }
    (orbit_size, rep)
}

/// v0.2.2 Phase J: fold the dihedral `(orbit_size, representative)` pair.
pub(crate) fn fold_dihedral_signature<H: Hasher>(
    mut hasher: H,
    orbit_size: u32,
    representative: u32,
) -> H {
    hasher = hasher.fold_bytes(&orbit_size.to_be_bytes());
    hasher = hasher.fold_bytes(&representative.to_be_bytes());
    hasher
}

/// v0.2.2 Phase J primitive: `observable:Jacobian` / `op:DC_10`.
/// Content-deterministic per-site Jacobian profile: for each site `i`, the number
/// of constraints that mention site index `i` (derived from the constraint encoding).
/// Truncated / zero-padded to `JACOBIAN_MAX_SITES` entries to keep the fold fixed-size.
pub(crate) fn primitive_curvature_jacobian<T: crate::pipeline::ConstrainedTypeShape + ?Sized>(
) -> [i32; JACOBIAN_MAX_SITES] {
    let mut out = [0i32; JACOBIAN_MAX_SITES];
    let mut ci = 0;
    while ci < T::CONSTRAINTS.len() {
        if let crate::pipeline::ConstraintRef::Site { position } = T::CONSTRAINTS[ci] {
            let idx = (position as usize) % JACOBIAN_MAX_SITES;
            out[idx] = out[idx].saturating_add(1);
        }
        ci += 1;
    }
    // Also account for residue and hamming constraints as contributing uniformly
    // across all sites (they are not site-local). Represented as +1 to site 0.
    let total = T::CONSTRAINTS.len() as i32;
    out[0] = out[0].saturating_add(total);
    out
}

/// v0.2.2 Phase J: DC_10 selects the site with the maximum absolute Jacobian value.
#[must_use]
pub(crate) fn primitive_dc10_select(jac: &[i32; JACOBIAN_MAX_SITES]) -> usize {
    let mut best_idx: usize = 0;
    let mut best_abs: i32 = jac[0].unsigned_abs() as i32;
    let mut i = 1;
    while i < JACOBIAN_MAX_SITES {
        let a = jac[i].unsigned_abs() as i32;
        if a > best_abs {
            best_abs = a;
            best_idx = i;
        }
        i += 1;
    }
    best_idx
}

/// v0.2.2 Phase J: fold the Jacobian profile into the hasher.
pub(crate) fn fold_jacobian_profile<H: Hasher>(
    mut hasher: H,
    jac: &[i32; JACOBIAN_MAX_SITES],
) -> H {
    let mut i = 0;
    while i < JACOBIAN_MAX_SITES {
        hasher = hasher.fold_bytes(&jac[i].to_be_bytes());
        i += 1;
    }
    hasher
}

/// v0.2.2 Phase J primitive: `state:BindingAccumulator` / `state:ContextLease`.
/// Returns `(binding_count, fold_address)` — a content-deterministic session signature.
/// v0.2.2 Phase S.4: uses an FNV-1a-style order-preserving incremental hash
/// (rotate-and-multiply) over each binding's `(name_index, type_index,
/// content_address)` tuple, rather than XOR-accumulation (which is commutative
/// and collides on reordered-but-otherwise-identical binding sets). Order-dependence
/// is intentional: `state:BindingAccumulator` semantics treat the insertion
/// sequence as part of the session signature.
pub(crate) fn primitive_session_binding_signature(bindings: &[Binding]) -> (u32, u64) {
    // FNV-1a-style incremental mix: start from the FNV offset basis,
    // multiply-then-XOR each limb. Order-dependent by construction.
    let mut fold: u64 = 0xcbf2_9ce4_8422_2325;
    const FNV_PRIME: u64 = 0x0000_0100_0000_01b3;
    let mut i = 0;
    while i < bindings.len() {
        let b = &bindings[i];
        // Mix in (name_index, type_index, content_address) per binding.
        fold = fold.wrapping_mul(FNV_PRIME);
        fold ^= b.name_index as u64;
        fold = fold.wrapping_mul(FNV_PRIME);
        fold ^= b.type_index as u64;
        fold = fold.wrapping_mul(FNV_PRIME);
        fold ^= b.content_address;
        i += 1;
    }
    (bindings.len() as u32, fold)
}

/// v0.2.2 Phase J: fold the session-binding signature into the hasher.
pub(crate) fn fold_session_signature<H: Hasher>(
    mut hasher: H,
    binding_count: u32,
    fold_address: u64,
) -> H {
    hasher = hasher.fold_bytes(&binding_count.to_be_bytes());
    hasher = hasher.fold_bytes(&fold_address.to_be_bytes());
    hasher
}

/// v0.2.2 Phase J primitive: `op:QM_1` / `op:QM_5` / `resolver:collapseAmplitude`.
/// Seeds a two-state amplitude vector from the CompileUnit's thermodynamic budget,
/// computes Born-rule probabilities `P(0) = |α_0|²` and `P(1) = |α_1|²`,
/// verifies QM_5 normalization `Σ P = 1`, and returns `(outcome_index, probability)`
/// where `outcome_index` is the index of the larger amplitude and `probability` is its value.
/// QM_1 Landauer equality: `pre_entropy == post_cost` at β* = ln 2; since both
/// sides derive from the same budget the equality holds by construction.
/// v0.2.2 Phase S.3: amplitudes are sourced from two decorrelated projections
/// of the thermodynamic budget — the high 32 bits become the alpha-0
/// magnitude and the low 32 bits become the alpha-1 magnitude. This replaces
/// the earlier XOR-with-fixed-constants sourcing, preserving determinism while
/// ensuring both amplitudes derive from independent halves of the budget's
/// thermodynamic-entropy state. Born normalization and QM_1 Landauer equality
/// remain invariant under this sourcing change.
pub(crate) fn primitive_measurement_projection(budget: u64) -> (u64, u64) {
    // Decorrelated amplitude sourcing: high-32-bits drives alpha_0,
    // low-32-bits drives alpha_1. Distinct bit halves yield independent
    // magnitudes under any non-degenerate budget.
    let alpha0_bits: u32 = (budget >> 32) as u32;
    let alpha1_bits: u32 = (budget & 0xFFFF_FFFF) as u32;
    type DefaultDecimal = <crate::DefaultHostTypes as crate::HostTypes>::Decimal;
    let a0 = <DefaultDecimal as crate::DecimalTranscendental>::from_u32(alpha0_bits)
        / <DefaultDecimal as crate::DecimalTranscendental>::from_u32(u32::MAX);
    let a1 = <DefaultDecimal as crate::DecimalTranscendental>::from_u32(alpha1_bits)
        / <DefaultDecimal as crate::DecimalTranscendental>::from_u32(u32::MAX);
    let norm = a0 * a0 + a1 * a1;
    let zero = <DefaultDecimal as Default>::default();
    let half =
        <DefaultDecimal as crate::DecimalTranscendental>::from_bits(0x3FE0_0000_0000_0000_u64);
    // QM_5 normalization: P(k) = |alpha_k|^2 / norm. Degenerate budget = 0
    // yields norm = 0; fall through to the uniform distribution (P(0) = 0.5,
    // P(1) = 0.5), which is the maximum-entropy projection under QM_1.
    let p0 = if norm > zero { (a0 * a0) / norm } else { half };
    let p1 = if norm > zero { (a1 * a1) / norm } else { half };
    if p0 >= p1 {
        (
            0,
            <DefaultDecimal as crate::DecimalTranscendental>::to_bits(p0),
        )
    } else {
        (
            1,
            <DefaultDecimal as crate::DecimalTranscendental>::to_bits(p1),
        )
    }
}

/// v0.2.2 Phase J / Phase 9: fold the Born-rule outcome into the hasher.
/// `probability_bits` is the IEEE-754 bit pattern (call sites convert via
/// `<H::Decimal as DecimalTranscendental>::to_bits` if working in `H::Decimal`).
pub(crate) fn fold_born_outcome<H: Hasher>(
    mut hasher: H,
    outcome_index: u64,
    probability_bits: u64,
) -> H {
    hasher = hasher.fold_bytes(&outcome_index.to_be_bytes());
    hasher = hasher.fold_bytes(&probability_bits.to_be_bytes());
    hasher
}

/// v0.2.2 Phase J primitive: `recursion:DescentMeasure` / `observable:ResidualEntropy`.
/// Computes `(residual_count, entropy_bits)` from `T::SITE_COUNT` and the Euler char.
/// `residual_count = max(0, site_count - euler_char)` — free sites after constraint contraction.
/// `entropy = (residual_count) × ln 2` — Landauer-temperature entropy in nats.
/// Phase 9: returns `(residual_count, entropy_bits)` where `entropy_bits` is the
/// IEEE-754 bit pattern of `residual × ln 2`. Consumers project to `H::Decimal`
/// via `<H::Decimal as DecimalTranscendental>::from_bits`.
pub(crate) fn primitive_descent_metrics<T: crate::pipeline::ConstrainedTypeShape + ?Sized>(
    betti: &[u32; MAX_BETTI_DIMENSION],
) -> (u32, u64) {
    let chi = primitive_euler_characteristic(betti);
    let n = T::SITE_COUNT as i64;
    let residual = if n > chi { (n - chi) as u32 } else { 0u32 };
    type DefaultDecimal = <crate::DefaultHostTypes as crate::HostTypes>::Decimal;
    let residual_d = <DefaultDecimal as crate::DecimalTranscendental>::from_u32(residual);
    let ln_2 = <DefaultDecimal as crate::DecimalTranscendental>::from_bits(crate::LN_2_BITS);
    let entropy = residual_d * ln_2;
    (
        residual,
        <DefaultDecimal as crate::DecimalTranscendental>::to_bits(entropy),
    )
}

/// v0.2.2 Phase J / Phase 9: fold the descent metrics into the hasher.
/// `entropy_bits` is the IEEE-754 bit pattern of the descent entropy.
pub(crate) fn fold_descent_metrics<H: Hasher>(
    mut hasher: H,
    residual_count: u32,
    entropy_bits: u64,
) -> H {
    hasher = hasher.fold_bytes(&residual_count.to_be_bytes());
    hasher = hasher.fold_bytes(&entropy_bits.to_be_bytes());
    hasher
}

/// Phase X.2: upper bound on cohomology class dimension. Cup products
/// whose summed dimension exceeds this cap are rejected as
/// `CohomologyError::DimensionOverflow`.
pub const MAX_COHOMOLOGY_DIMENSION: u32 = 32;

/// Phase X.2: a cohomology class `H^n(·)` at dimension `n` with a content
/// fingerprint of the underlying cochain representative. Parametric over
/// dimension via a runtime field because generic-const-expression arithmetic
/// over `N + M` is unstable at the crate's MSRV (Rust 1.81).
#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
pub struct CohomologyClass {
    dimension: u32,
    fingerprint: ContentFingerprint,
    _sealed: (),
}

impl CohomologyClass {
    /// Phase X.2: crate-sealed constructor. Public callers go through
    /// `mint_cohomology_class` so that construction always routes through a
    /// validating hash of the cochain representative.
    #[inline]
    pub(crate) const fn with_dimension_and_fingerprint(
        dimension: u32,
        fingerprint: ContentFingerprint,
    ) -> Self {
        Self {
            dimension,
            fingerprint,
            _sealed: (),
        }
    }

    /// The dimension `n` of this cohomology class `H^n(·)`.
    #[inline]
    #[must_use]
    pub const fn dimension(&self) -> u32 {
        self.dimension
    }

    /// The content fingerprint of the underlying cochain representative.
    #[inline]
    #[must_use]
    pub const fn fingerprint(&self) -> ContentFingerprint {
        self.fingerprint
    }

    /// Phase X.2: cup product `H^n × H^m → H^{n+m}`. The resulting class
    /// carries dimension `n + m` and a fingerprint folded from both
    /// operand dimensions and fingerprints via `fold_cup_product`. The
    /// fold is ordered (lhs-then-rhs) — graded-commutativity of the cup
    /// product at the algebraic level is not a fingerprint-level property.
    /// # Errors
    /// Returns `CohomologyError::DimensionOverflow` when `n + m >
    /// MAX_COHOMOLOGY_DIMENSION`.
    pub fn cup<H: Hasher>(
        self,
        other: CohomologyClass,
    ) -> Result<CohomologyClass, CohomologyError> {
        let sum = self.dimension.saturating_add(other.dimension);
        if sum > MAX_COHOMOLOGY_DIMENSION {
            return Err(CohomologyError::DimensionOverflow {
                lhs: self.dimension,
                rhs: other.dimension,
            });
        }
        let hasher = H::initial();
        let hasher = fold_cup_product(
            hasher,
            self.dimension,
            &self.fingerprint,
            other.dimension,
            &other.fingerprint,
        );
        let buf = hasher.finalize();
        let fp = ContentFingerprint::from_buffer(buf, H::OUTPUT_BYTES as u8);
        Ok(Self::with_dimension_and_fingerprint(sum, fp))
    }
}

/// Phase X.2: error returned by `CohomologyClass::cup` when the summed
/// dimension exceeds `MAX_COHOMOLOGY_DIMENSION`.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
pub enum CohomologyError {
    /// Cup product would exceed `MAX_COHOMOLOGY_DIMENSION`.
    DimensionOverflow { lhs: u32, rhs: u32 },
}

impl core::fmt::Display for CohomologyError {
    fn fmt(&self, f: &mut core::fmt::Formatter<'_>) -> core::fmt::Result {
        match self {
            Self::DimensionOverflow { lhs, rhs } => write!(
                f,
                "cup product dimension overflow: {lhs} + {rhs} > MAX_COHOMOLOGY_DIMENSION ({})",
                MAX_COHOMOLOGY_DIMENSION
            ),
        }
    }
}
impl core::error::Error for CohomologyError {}

/// Phase X.2: homology class dual to `CohomologyClass`. A homology class
/// `H_n(·)` at dimension `n` with a content fingerprint of its chain
/// representative. Shares the dimension-as-runtime-field discipline.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
pub struct HomologyClass {
    dimension: u32,
    fingerprint: ContentFingerprint,
    _sealed: (),
}

impl HomologyClass {
    /// Phase X.2: crate-sealed constructor. Public callers go through
    /// `mint_homology_class`.
    #[inline]
    pub(crate) const fn with_dimension_and_fingerprint(
        dimension: u32,
        fingerprint: ContentFingerprint,
    ) -> Self {
        Self {
            dimension,
            fingerprint,
            _sealed: (),
        }
    }

    /// The dimension `n` of this homology class `H_n(·)`.
    #[inline]
    #[must_use]
    pub const fn dimension(&self) -> u32 {
        self.dimension
    }

    /// The content fingerprint of the underlying chain representative.
    #[inline]
    #[must_use]
    pub const fn fingerprint(&self) -> ContentFingerprint {
        self.fingerprint
    }
}

/// Phase X.2: fold the cup-product operand pair into the hasher. Ordered
/// (lhs dimension + fingerprint, then rhs dimension + fingerprint).
pub fn fold_cup_product<H: Hasher>(
    mut hasher: H,
    lhs_dim: u32,
    lhs_fp: &ContentFingerprint,
    rhs_dim: u32,
    rhs_fp: &ContentFingerprint,
) -> H {
    hasher = hasher.fold_bytes(&lhs_dim.to_be_bytes());
    hasher = hasher.fold_bytes(lhs_fp.as_bytes());
    hasher = hasher.fold_bytes(&rhs_dim.to_be_bytes());
    hasher = hasher.fold_bytes(rhs_fp.as_bytes());
    hasher
}

/// Phase X.2: mint a `CohomologyClass` from a cochain representative `seed`.
/// Hashes `seed` through `H` to produce the class fingerprint. The caller's
/// choice of `H` determines the fingerprint width.
/// # Errors
/// Returns `CohomologyError::DimensionOverflow` when `dimension >
/// MAX_COHOMOLOGY_DIMENSION`.
pub fn mint_cohomology_class<H: Hasher>(
    dimension: u32,
    seed: &[u8],
) -> Result<CohomologyClass, CohomologyError> {
    if dimension > MAX_COHOMOLOGY_DIMENSION {
        return Err(CohomologyError::DimensionOverflow {
            lhs: dimension,
            rhs: 0,
        });
    }
    let mut hasher = H::initial();
    hasher = hasher.fold_bytes(&dimension.to_be_bytes());
    hasher = hasher.fold_bytes(seed);
    let buf = hasher.finalize();
    let fp = ContentFingerprint::from_buffer(buf, H::OUTPUT_BYTES as u8);
    Ok(CohomologyClass::with_dimension_and_fingerprint(
        dimension, fp,
    ))
}

/// Phase X.2: mint a `HomologyClass` from a chain representative `seed`.
/// Hashes `seed` through `H` to produce the class fingerprint.
/// # Errors
/// Returns `CohomologyError::DimensionOverflow` when `dimension >
/// MAX_COHOMOLOGY_DIMENSION`.
pub fn mint_homology_class<H: Hasher>(
    dimension: u32,
    seed: &[u8],
) -> Result<HomologyClass, CohomologyError> {
    if dimension > MAX_COHOMOLOGY_DIMENSION {
        return Err(CohomologyError::DimensionOverflow {
            lhs: dimension,
            rhs: 0,
        });
    }
    let mut hasher = H::initial();
    hasher = hasher.fold_bytes(&dimension.to_be_bytes());
    hasher = hasher.fold_bytes(seed);
    let buf = hasher.finalize();
    let fp = ContentFingerprint::from_buffer(buf, H::OUTPUT_BYTES as u8);
    Ok(HomologyClass::with_dimension_and_fingerprint(dimension, fp))
}

/// v0.2.2 T6.1: per-step canonical byte layout for `StreamDriver::next()`.
/// Layout: `productivity_remaining (8 BE) || rewrite_steps (8 BE) || seed (8 BE) ||
/// iri bytes || 0x00 || certificate_kind_discriminant (1 byte trailing)`.
pub fn fold_stream_step_digest<H: Hasher>(
    mut hasher: H,
    productivity_remaining: u64,
    rewrite_steps: u64,
    seed: u64,
    iri: &str,
    kind: CertificateKind,
) -> H {
    hasher = hasher.fold_bytes(&productivity_remaining.to_be_bytes());
    hasher = hasher.fold_bytes(&rewrite_steps.to_be_bytes());
    hasher = hasher.fold_bytes(&seed.to_be_bytes());
    hasher = hasher.fold_bytes(iri.as_bytes());
    hasher = hasher.fold_byte(0);
    hasher = hasher.fold_byte(certificate_kind_discriminant(kind));
    hasher
}

/// v0.2.2 T6.1: per-step canonical byte layout for `InteractionDriver::step()`
/// and `InteractionDriver::finalize()`.
/// Layout: `commutator_acc[0..4] (4 × 8 BE bytes) || peer_step_count (8 BE) ||
/// seed (8 BE) || iri bytes || 0x00 || certificate_kind_discriminant (1 byte trailing)`.
pub fn fold_interaction_step_digest<H: Hasher>(
    mut hasher: H,
    commutator_acc: &[u64; 4],
    peer_step_count: u64,
    seed: u64,
    iri: &str,
    kind: CertificateKind,
) -> H {
    let mut i = 0;
    while i < 4 {
        hasher = hasher.fold_bytes(&commutator_acc[i].to_be_bytes());
        i += 1;
    }
    hasher = hasher.fold_bytes(&peer_step_count.to_be_bytes());
    hasher = hasher.fold_bytes(&seed.to_be_bytes());
    hasher = hasher.fold_bytes(iri.as_bytes());
    hasher = hasher.fold_byte(0);
    hasher = hasher.fold_byte(certificate_kind_discriminant(kind));
    hasher
}

/// Utility — extract the leading 16 bytes of a `Hasher::finalize` buffer
/// as a `ContentAddress`. Used by pipeline entry points to derive the
/// 16-byte unit_address handle from a freshly-computed substrate
/// fingerprint, so two units with distinct fingerprints have distinct
/// unit_address handles too.
/// Per the wiki's ADR-018 the `FP_MAX` const-generic carries the
/// application's selected `<B as HostBounds>::FINGERPRINT_MAX_BYTES`.
/// `FP_MAX` MUST be at least 16; smaller buffers cannot supply the
/// 16-byte address prefix.
#[inline]
#[must_use]
pub const fn unit_address_from_buffer<const FP_MAX: usize>(
    buffer: &[u8; FP_MAX],
) -> ContentAddress {
    let mut bytes = [0u8; 16];
    let mut i = 0;
    while i < 16 {
        bytes[i] = buffer[i];
        i += 1;
    }
    ContentAddress::from_u128(u128::from_be_bytes(bytes))
}

/// v0.2.2 T6.11: const-fn equality on `&str` slices. `str::eq` is not
/// stable in const eval under MSRV 1.81; this helper provides a
/// byte-by-byte equality check for use in `pipeline::run`'s ShapeMismatch
/// detection without runtime allocation.
#[inline]
#[must_use]
pub const fn str_eq(a: &str, b: &str) -> bool {
    let a = a.as_bytes();
    let b = b.as_bytes();
    if a.len() != b.len() {
        return false;
    }
    let mut i = 0;
    while i < a.len() {
        if a[i] != b[i] {
            return false;
        }
        i += 1;
    }
    true
}

/// A binding entry in a `BindingsTable`. Pairs a `ContentAddress`
/// (hash of the query coordinate) with the bound bytes.
#[derive(Debug, Clone, Copy)]
pub struct BindingEntry {
    /// Content-hashed query address.
    pub address: ContentAddress,
    /// Bound payload bytes (length determined by the WittLevel of the table).
    pub bytes: &'static [u8],
}

/// A static, sorted-by-address binding table laid out for `op:GS_5` zero-step
/// access. Looked up via binary search; the foundation guarantees the table
/// is materialized at compile time from the attested `state:GroundedContext`.
#[derive(Debug, Clone, Copy)]
pub struct BindingsTable {
    /// Entries, sorted ascending by `address`.
    pub entries: &'static [BindingEntry],
}

impl BindingsTable {
    /// v0.2.2 T5 C4: validating constructor. Checks that `entries` are
    /// strictly ascending by `address`, which is the invariant
    /// `Grounded::get_binding` relies on for its binary-search lookup.
    /// # Errors
    /// Returns `BindingsTableError::Unsorted { at }` where `at` is the first
    /// index where the order is violated (i.e., `entries[at].address <=
    /// entries[at - 1].address`).
    pub const fn try_new(entries: &'static [BindingEntry]) -> Result<Self, BindingsTableError> {
        let mut i = 1;
        while i < entries.len() {
            if entries[i].address.as_u128() <= entries[i - 1].address.as_u128() {
                return Err(BindingsTableError::Unsorted { at: i });
            }
            i += 1;
        }
        Ok(Self { entries })
    }
}

/// v0.2.2 T5 C4: errors returned by `BindingsTable::try_new`.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
#[non_exhaustive]
pub enum BindingsTableError {
    /// Entries at index `at` and `at - 1` are out of order (the slice is
    /// not strictly ascending by `address`).
    Unsorted {
        /// The first index where the order is violated.
        at: usize,
    },
}

impl core::fmt::Display for BindingsTableError {
    fn fmt(&self, f: &mut core::fmt::Formatter<'_>) -> core::fmt::Result {
        match self {
            Self::Unsorted { at } => write!(
                f,
                "BindingsTable entries not sorted: address at index {at} <= address at index {}",
                at - 1,
            ),
        }
    }
}

impl core::error::Error for BindingsTableError {}

/// The compile-time witness that `op:GS_4` holds for the value it carries:
/// σ = 1, freeRank = 0, S = 0, T_ctx = 0. `Grounded<T, Tag>` is constructed
/// only by the reduction pipeline and provides `op:GS_5` zero-step binding access.
/// v0.2.2 Phase B (Q3): the `Tag` phantom parameter (default `Tag = T`)
/// lets downstream code attach a domain marker to a grounded witness without
/// any new sealing — e.g., `Grounded<ConstrainedTypeInput, BlockHashTag>` is
/// a distinct Rust type from `Grounded<ConstrainedTypeInput, PixelTag>`. The
/// inner witness is unchanged; the tag is pure decoration. The foundation
/// guarantees ring soundness on the inner witness; the tag is the developer's
/// domain claim. Coerce via `Grounded::tag::<NewTag>()` (zero-cost).
#[derive(Debug, Clone)]
pub struct Grounded<T: GroundedShape, Tag = T> {
    /// The validated grounding certificate this wrapper carries.
    validated: Validated<GroundingCertificate>,
    /// The compile-time-materialized bindings table.
    bindings: BindingsTable,
    /// The Witt level the grounded value was minted at.
    witt_level_bits: u16,
    /// Content-address of the originating CompileUnit.
    unit_address: ContentAddress,
    /// Phase A.1: the foundation-internal two-clock value read at witness mint time.
    /// Computed deterministically from (witt_level_bits, unit_address, bindings).
    uor_time: UorTime,
    /// v0.2.2 T2.6 (cleanup): BaseMetric storage — populated by the
    /// pipeline at mint time as a deterministic function of witt level,
    /// unit address, and bindings. All six fields are read-only from
    /// the accessors; downstream cannot mutate them.
    /// Grounding completion ratio σ × 10⁶ (parts per million).
    sigma_ppm: u32,
    /// Metric incompatibility d_Δ.
    d_delta: i64,
    /// Euler characteristic of the constraint nerve.
    euler_characteristic: i64,
    /// Free-site count at grounding time.
    residual_count: u32,
    /// Per-site Jacobian row (fixed capacity, zero-padded).
    jacobian_entries: [i64; JACOBIAN_MAX_SITES],
    /// Active length of jacobian_entries.
    jacobian_len: u16,
    /// Betti numbers β_0..β_{MAX_BETTI_DIMENSION-1}.
    betti_numbers: [u32; MAX_BETTI_DIMENSION],
    /// v0.2.2 T5: parametric content fingerprint of the source unit's
    /// full state, computed at grounding time by the consumer-supplied
    /// `Hasher`. Width is `ContentFingerprint::width_bytes()`, set by
    /// `H::OUTPUT_BYTES` at the call site. Read by `Grounded::derivation()`
    /// so the verify path can re-derive the source certificate.
    content_fingerprint: ContentFingerprint,
    /// Phantom type tying this `Grounded` to a specific `ConstrainedType`.
    _phantom: PhantomData<T>,
    /// Phantom domain tag (Q3). Defaults to `T` for backwards-compatible
    /// call sites; downstream attaches a custom tag via `tag::<NewTag>()`.
    _tag: PhantomData<Tag>,
}

impl<T: GroundedShape, Tag> Grounded<T, Tag> {
    /// Returns the binding for the given query address, or `None` if not in
    /// the table. Resolves in O(log n) via binary search; for true `op:GS_5`
    /// zero-step access, downstream code uses statically-known indices.
    #[inline]
    #[must_use]
    pub fn get_binding(&self, address: ContentAddress) -> Option<&'static [u8]> {
        self.bindings
            .entries
            .binary_search_by_key(&address.as_u128(), |e| e.address.as_u128())
            .ok()
            .map(|i| self.bindings.entries[i].bytes)
    }

    /// Iterate over all bindings in this grounded context.
    #[inline]
    pub fn iter_bindings(&self) -> impl Iterator<Item = &BindingEntry> + '_ {
        self.bindings.entries.iter()
    }

    /// Returns the Witt level the grounded value was minted at.
    #[inline]
    #[must_use]
    pub const fn witt_level_bits(&self) -> u16 {
        self.witt_level_bits
    }

    /// Returns the content-address of the originating CompileUnit.
    #[inline]
    #[must_use]
    pub const fn unit_address(&self) -> ContentAddress {
        self.unit_address
    }

    /// Returns the validated grounding certificate this wrapper carries.
    #[inline]
    #[must_use]
    pub const fn certificate(&self) -> &Validated<GroundingCertificate> {
        &self.validated
    }

    /// Phase A.4: `observable:d_delta_metric` — sealed metric incompatibility between
    /// ring distance and Hamming distance for this datum's neighborhood.
    #[inline]
    #[must_use]
    pub const fn d_delta(&self) -> DDeltaMetric {
        DDeltaMetric::new(self.d_delta)
    }

    /// Phase A.4: `observable:sigma_metric` — sealed grounding completion ratio.
    #[inline]
    #[must_use]
    pub fn sigma(&self) -> SigmaValue<crate::DefaultHostTypes> {
        // Default-host (f64) projection; polymorphic consumers
        // can re-encode via DecimalTranscendental::from_u32 + Div.
        let value = <f64 as crate::DecimalTranscendental>::from_u32(self.sigma_ppm)
            / <f64 as crate::DecimalTranscendental>::from_u32(1_000_000);
        SigmaValue::<crate::DefaultHostTypes>::new_unchecked(value)
    }

    /// Phase A.4: `observable:jacobian_metric` — sealed per-site Jacobian row.
    #[inline]
    #[must_use]
    pub fn jacobian(&self) -> JacobianMetric<T> {
        JacobianMetric::from_entries(self.jacobian_entries, self.jacobian_len)
    }

    /// Phase A.4: `observable:betti_metric` — sealed Betti-number vector.
    #[inline]
    #[must_use]
    pub const fn betti(&self) -> BettiMetric {
        BettiMetric::new(self.betti_numbers)
    }

    /// Phase A.4: `observable:euler_metric` — sealed Euler characteristic χ of
    /// the constraint nerve.
    #[inline]
    #[must_use]
    pub const fn euler(&self) -> EulerMetric {
        EulerMetric::new(self.euler_characteristic)
    }

    /// Phase A.4: `observable:residual_metric` — sealed free-site count r at grounding.
    #[inline]
    #[must_use]
    pub const fn residual(&self) -> ResidualMetric {
        ResidualMetric::new(self.residual_count)
    }

    /// v0.2.2 T5: returns the parametric content fingerprint of the source
    /// unit, computed at grounding time by the consumer-supplied `Hasher`.
    /// Width is set by `H::OUTPUT_BYTES` at the call site. Used by
    /// `derivation()` to seed the replayed Trace's fingerprint, which
    /// `verify_trace` then passes through to the re-derived certificate.
    #[inline]
    #[must_use]
    pub const fn content_fingerprint(&self) -> ContentFingerprint {
        self.content_fingerprint
    }

    /// v0.2.2 T5 (C2): returns the `Derivation` that produced this grounded
    /// value. Use the returned `Derivation` with `Derivation::replay()` and
    /// then `uor_foundation_verify::verify_trace` to re-derive the source
    /// certificate without re-running the deciders.
    /// The round-trip property:
    /// ```text
    /// verify_trace(&grounded.derivation().replay()).certificate()
    ///     == grounded.certificate()
    /// ```
    /// holds for every conforming substrate `Hasher`.
    #[inline]
    #[must_use]
    pub const fn derivation(&self) -> Derivation {
        Derivation::new(
            (self.jacobian_len as u32) + 1,
            self.witt_level_bits,
            self.content_fingerprint,
        )
    }

    /// v0.2.2 Phase B (Q3): coerce this `Grounded<T, Tag>` to a different
    /// phantom tag. Zero-cost — the inner witness is unchanged; only the
    /// type-system view differs. Downstream uses this to attach a domain
    /// marker for use in function signatures (e.g., `Grounded<_, BlockHashTag>`
    /// vs `Grounded<_, PixelTag>` are distinct Rust types).
    /// **The foundation does not validate the tag.** The tag records what
    /// the developer is claiming about the witness's domain semantics; the
    /// foundation's contract is about ring soundness, not domain semantics.
    #[inline]
    #[must_use]
    pub fn tag<NewTag>(self) -> Grounded<T, NewTag> {
        Grounded {
            validated: self.validated,
            bindings: self.bindings,
            witt_level_bits: self.witt_level_bits,
            unit_address: self.unit_address,
            uor_time: self.uor_time,
            sigma_ppm: self.sigma_ppm,
            d_delta: self.d_delta,
            euler_characteristic: self.euler_characteristic,
            residual_count: self.residual_count,
            jacobian_entries: self.jacobian_entries,
            jacobian_len: self.jacobian_len,
            betti_numbers: self.betti_numbers,
            content_fingerprint: self.content_fingerprint,
            _phantom: PhantomData,
            _tag: PhantomData,
        }
    }

    /// Phase A.1: the foundation-internal two-clock value read at witness mint time.
    /// Maps `rewrite_steps` to `derivation:stepCount` and `landauer_nats` to
    /// `observable:LandauerCost`. The value is content-deterministic: two `Grounded`
    /// witnesses minted from the same inputs share the same `UorTime`.
    /// Compose with a `Calibration` via [`UorTime::min_wall_clock`] to
    /// bound the provable minimum wall-clock duration the computation required.
    #[inline]
    #[must_use]
    pub const fn uor_time(&self) -> UorTime {
        self.uor_time
    }

    /// Phase A.2: the sealed triadic coordinate `(stratum, spectrum, address)` at the
    /// witness's Witt level, projected from the content-addressed unit.
    /// `stratum` is the v₂ valuation of the lower unit-address half; `spectrum`
    /// is the lower 64 bits of the unit address; `address` is the upper 64 bits.
    /// The projection is deterministic and content-addressed, so replay reproduces the
    /// same `Triad` bit-for-bit.
    #[inline]
    #[must_use]
    pub const fn triad(&self) -> Triad<T> {
        let addr = self.unit_address.as_u128();
        let addr_lo = addr as u64;
        let addr_hi = (addr >> 64) as u64;
        let stratum = if addr_lo == 0 {
            0u64
        } else {
            addr_lo.trailing_zeros() as u64
        };
        Triad::new(stratum, addr_lo, addr_hi)
    }

    /// Crate-internal constructor used by the pipeline at mint time.
    /// Not callable from outside `uor-foundation`. The tag defaults to `T`
    /// (the unparameterized form); downstream attaches a custom tag via `tag()`.
    /// v0.2.2 T2.6 (cleanup): BaseMetric fields are computed here from
    /// the input witt level, bindings, and unit address. Two `Grounded`
    /// values built from the same inputs return identical metrics; two
    /// built from different inputs differ in at least three fields.
    #[inline]
    #[allow(dead_code)]
    pub(crate) const fn new_internal(
        validated: Validated<GroundingCertificate>,
        bindings: BindingsTable,
        witt_level_bits: u16,
        unit_address: ContentAddress,
        content_fingerprint: ContentFingerprint,
    ) -> Self {
        let bound_count = bindings.entries.len() as u32;
        let declared_sites = if witt_level_bits == 0 {
            1u32
        } else {
            witt_level_bits as u32
        };
        // sigma = bound / declared, in parts per million.
        let sigma_ppm = if bound_count >= declared_sites {
            1_000_000u32
        } else {
            // Integer division, rounded down, cannot exceed 1_000_000.
            let num = (bound_count as u64) * 1_000_000u64;
            (num / (declared_sites as u64)) as u32
        };
        // residual_count = declared - bound (saturating).
        let residual_count = declared_sites.saturating_sub(bound_count);
        // d_delta = witt_bits - bound_count (signed).
        let d_delta = (witt_level_bits as i64) - (bound_count as i64);
        // Betti numbers: β_0 = 1 (connected); β_k = bit k of witt_level_bits.
        let mut betti = [0u32; MAX_BETTI_DIMENSION];
        betti[0] = 1;
        let mut k = 1usize;
        while k < MAX_BETTI_DIMENSION {
            betti[k] = ((witt_level_bits as u32) >> (k - 1)) & 1;
            k += 1;
        }
        // Euler characteristic: alternating sum of Betti numbers.
        let mut euler: i64 = 0;
        let mut k = 0usize;
        while k < MAX_BETTI_DIMENSION {
            if k & 1 == 0 {
                euler += betti[k] as i64;
            } else {
                euler -= betti[k] as i64;
            }
            k += 1;
        }
        // Jacobian row: entry i = (unit_address.as_u128() as i64 XOR (i as i64)) mod witt+1.
        let mut jac = [0i64; JACOBIAN_MAX_SITES];
        let modulus = (witt_level_bits as i64) + 1;
        let ua_lo = unit_address.as_u128() as i64;
        let mut i = 0usize;
        let jac_len = if (witt_level_bits as usize) < JACOBIAN_MAX_SITES {
            witt_level_bits as usize
        } else {
            JACOBIAN_MAX_SITES
        };
        while i < jac_len {
            let raw = ua_lo ^ (i as i64);
            // Rust's % is remainder; ensure non-negative.
            let m = if modulus == 0 { 1 } else { modulus };
            jac[i] = ((raw % m) + m) % m;
            i += 1;
        }
        // Phase A.1: uor_time is content-deterministic. rewrite_steps counts
        // the reduction work proxied by (witt bits + bound count + active jac len);
        // Landauer nats = rewrite_steps × ln 2 (Landauer-temperature cost of
        // traversing that many orthogonal states). Two Grounded values minted from
        // the same inputs share the same UorTime.
        let steps = (witt_level_bits as u64) + (bound_count as u64) + (jac_len as u64);
        let landauer = LandauerBudget::new((steps as f64) * core::f64::consts::LN_2);
        let uor_time = UorTime::new(landauer, steps);
        Self {
            validated,
            bindings,
            witt_level_bits,
            unit_address,
            uor_time,
            sigma_ppm,
            d_delta,
            euler_characteristic: euler,
            residual_count,
            jacobian_entries: jac,
            jacobian_len: jac_len as u16,
            betti_numbers: betti,
            content_fingerprint,
            _phantom: PhantomData,
            _tag: PhantomData,
        }
    }

    /// v0.2.2 T6.17: attach a downstream-validated `BindingsTable` to this
    /// grounded value. The original `Grounded` was minted by the foundation
    /// pipeline with a substrate-computed certificate; this builder lets
    /// downstream attach its own binding table without re-grounding.
    /// The `bindings` parameter must satisfy the sortedness invariant. Use
    /// [`BindingsTable::try_new`] to construct a validated table from a
    /// pre-sorted slice.
    /// **Trust boundary:** the certificate witnesses the unit's grounding,
    /// not the bindings' contents. A downstream consumer that uses the
    /// certificate as a trust root for the bindings is wrong.
    #[inline]
    #[must_use]
    pub fn with_bindings(self, bindings: BindingsTable) -> Self {
        Self { bindings, ..self }
    }
}

/// v0.2.2 W8: triadic coordinate of a Datum at level `L`. Bundles the
/// (stratum, spectrum, address) projection in one structurally-enforced
/// type. No public constructor — `Triad<L>` is built only by foundation code
/// at grounding time. Field access goes through the named accessors.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
pub struct Triad<L> {
    /// The stratum coordinate (two-adic valuation).
    stratum: u64,
    /// The spectrum coordinate (Walsh-Hadamard image).
    spectrum: u64,
    /// The address coordinate (Braille-glyph address).
    address: u64,
    /// Phantom marker for the Witt level.
    _level: PhantomData<L>,
}

impl<L> Triad<L> {
    /// Returns the stratum component (`query:TwoAdicValuation` coordinate).
    #[inline]
    #[must_use]
    pub const fn stratum(&self) -> u64 {
        self.stratum
    }

    /// Returns the spectrum component (`query:WalshHadamardImage` coordinate).
    #[inline]
    #[must_use]
    pub const fn spectrum(&self) -> u64 {
        self.spectrum
    }

    /// Returns the address component (`query:Address` coordinate).
    #[inline]
    #[must_use]
    pub const fn address(&self) -> u64 {
        self.address
    }

    /// Crate-internal constructor. Reachable only from grounding-time minting.
    #[inline]
    #[must_use]
    #[allow(dead_code)]
    pub(crate) const fn new(stratum: u64, spectrum: u64, address: u64) -> Self {
        Self {
            stratum,
            spectrum,
            address,
            _level: PhantomData,
        }
    }
}

/// The Rust-surface rendering of `reduction:PipelineFailureReason` and the
/// v0.2.1 cross-namespace failure variants. Variant set and field shapes are
/// generated parametrically by walking `reduction:FailureField` individuals;
/// adding a new field requires only an ontology edit.
#[derive(Debug, Clone, PartialEq)]
#[non_exhaustive]
pub enum PipelineFailure {
    /// `DispatchMiss` failure variant.
    DispatchMiss {
        /// query_iri field.
        query_iri: &'static str,
        /// table_iri field.
        table_iri: &'static str,
    },
    /// `GroundingFailure` failure variant.
    GroundingFailure {
        /// reason_iri field.
        reason_iri: &'static str,
    },
    /// `ConvergenceStall` failure variant.
    ConvergenceStall {
        /// stage_iri field.
        stage_iri: &'static str,
        /// angle_milliradians field.
        angle_milliradians: i64,
    },
    /// `ContradictionDetected` failure variant.
    ContradictionDetected {
        /// at_step field.
        at_step: usize,
        /// trace_iri field.
        trace_iri: &'static str,
    },
    /// `CoherenceViolation` failure variant.
    CoherenceViolation {
        /// site_position field.
        site_position: usize,
        /// constraint_iri field.
        constraint_iri: &'static str,
    },
    /// `ShapeMismatch` failure variant.
    ShapeMismatch {
        /// expected field.
        expected: &'static str,
        /// got field.
        got: &'static str,
    },
    /// `LiftObstructionFailure` failure variant.
    LiftObstructionFailure {
        /// site_position field.
        site_position: usize,
        /// obstruction_class_iri field.
        obstruction_class_iri: &'static str,
    },
    /// `ShapeViolation` failure variant.
    ShapeViolation {
        /// report field.
        report: ShapeViolation,
    },
}

impl core::fmt::Display for PipelineFailure {
    fn fmt(&self, ff: &mut core::fmt::Formatter<'_>) -> core::fmt::Result {
        match self {
            Self::DispatchMiss {
                query_iri,
                table_iri,
            } => write!(
                ff,
                "DispatchMiss(query_iri={:?}, table_iri={:?})",
                query_iri, table_iri
            ),
            Self::GroundingFailure { reason_iri } => {
                write!(ff, "GroundingFailure(reason_iri={:?})", reason_iri)
            }
            Self::ConvergenceStall {
                stage_iri,
                angle_milliradians,
            } => write!(
                ff,
                "ConvergenceStall(stage_iri={:?}, angle_milliradians={:?})",
                stage_iri, angle_milliradians
            ),
            Self::ContradictionDetected { at_step, trace_iri } => write!(
                ff,
                "ContradictionDetected(at_step={:?}, trace_iri={:?})",
                at_step, trace_iri
            ),
            Self::CoherenceViolation {
                site_position,
                constraint_iri,
            } => write!(
                ff,
                "CoherenceViolation(site_position={:?}, constraint_iri={:?})",
                site_position, constraint_iri
            ),
            Self::ShapeMismatch { expected, got } => {
                write!(ff, "ShapeMismatch(expected={:?}, got={:?})", expected, got)
            }
            Self::LiftObstructionFailure {
                site_position,
                obstruction_class_iri,
            } => write!(
                ff,
                "LiftObstructionFailure(site_position={:?}, obstruction_class_iri={:?})",
                site_position, obstruction_class_iri
            ),
            Self::ShapeViolation { report } => write!(ff, "ShapeViolation({:?})", report),
        }
    }
}

impl core::error::Error for PipelineFailure {}

/// Sealed marker for impossibility witnesses returned by the resolver
/// free-function path. Every failure return value of every
/// `resolver::<name>::certify(...)` call is a member of this set.
pub trait ImpossibilityWitnessKind: impossibility_witness_kind_sealed::Sealed {}

mod impossibility_witness_kind_sealed {
    /// Private supertrait.
    pub trait Sealed {}
    impl Sealed for super::GenericImpossibilityWitness {}
    impl Sealed for super::InhabitanceImpossibilityWitness {}
}

impl ImpossibilityWitnessKind for GenericImpossibilityWitness {}
impl ImpossibilityWitnessKind for InhabitanceImpossibilityWitness {}

/// v0.2.2 W12: resolver free functions. Replaces the v0.2.1 unit-struct
/// façades with module-per-resolver free functions returning the W11
/// `Certified<C>` parametric carrier.
pub mod resolver {
    use super::{
        BornRuleVerification,
        Certified,
        CompileUnit,
        CompletenessCertificate,
        GenericImpossibilityWitness,
        GeodesicCertificate,
        GroundingCertificate,
        InhabitanceCertificate,
        InhabitanceImpossibilityWitness,
        InvolutionCertificate,
        IsometryCertificate,
        LiftChainCertificate,
        MeasurementCertificate,
        // Phase X.1: per-resolver cert discrimination.
        TransformCertificate,
        Validated,
        WittLevel,
    };

    /// v0.2.2 W12: certify tower-completeness for a constrained type.
    ///
    /// Replaces `TowerCompletenessResolver::new().certify(input)` from v0.2.1.
    /// Delegates to `crate::pipeline::run_tower_completeness` and wraps the
    /// returned `LiftChainCertificate` in the W11 `Certified<_>` carrier.
    ///
    /// # Errors
    ///
    /// Returns `GenericImpossibilityWitness` when no certificate can be issued.
    pub mod tower_completeness {
        use super::*;
        /// v0.2.2 closure (target §4.2): parameterized over phase + hasher.
        ///
        /// # Errors
        ///
        /// Returns `Certified<GenericImpossibilityWitness>` on failure.
        pub fn certify<T, P, H>(
            input: &Validated<T, P>,
        ) -> Result<Certified<LiftChainCertificate>, Certified<GenericImpossibilityWitness>>
        where
            T: crate::pipeline::ConstrainedTypeShape,
            P: crate::enforcement::ValidationPhase,
            H: crate::enforcement::Hasher,
        {
            certify_at::<T, P, H>(input, WittLevel::W32)
        }

        /// Certify at an explicit Witt level.
        ///
        /// # Errors
        ///
        /// Returns `Certified<GenericImpossibilityWitness>` on failure.
        pub fn certify_at<T, P, H>(
            input: &Validated<T, P>,
            level: WittLevel,
        ) -> Result<Certified<LiftChainCertificate>, Certified<GenericImpossibilityWitness>>
        where
            T: crate::pipeline::ConstrainedTypeShape,
            P: crate::enforcement::ValidationPhase,
            H: crate::enforcement::Hasher,
        {
            crate::pipeline::run_tower_completeness::<T, H>(input.inner(), level)
                .map(|v| Certified::new(*v.inner()))
                .map_err(|_| Certified::new(GenericImpossibilityWitness::default()))
        }
    }

    /// v0.2.2 closure: certify incremental completeness for a constrained type.
    pub mod incremental_completeness {
        use super::*;
        /// v0.2.2 closure (target §4.2): parameterized over phase + hasher.
        ///
        /// # Errors
        ///
        /// Returns `Certified<GenericImpossibilityWitness>` on failure.
        pub fn certify<T, P, H>(
            input: &Validated<T, P>,
        ) -> Result<Certified<LiftChainCertificate>, Certified<GenericImpossibilityWitness>>
        where
            T: crate::pipeline::ConstrainedTypeShape,
            P: crate::enforcement::ValidationPhase,
            H: crate::enforcement::Hasher,
        {
            certify_at::<T, P, H>(input, WittLevel::W32)
        }

        /// Certify at an explicit Witt level.
        ///
        /// # Errors
        ///
        /// Returns `Certified<GenericImpossibilityWitness>` on failure.
        pub fn certify_at<T, P, H>(
            input: &Validated<T, P>,
            level: WittLevel,
        ) -> Result<Certified<LiftChainCertificate>, Certified<GenericImpossibilityWitness>>
        where
            T: crate::pipeline::ConstrainedTypeShape,
            P: crate::enforcement::ValidationPhase,
            H: crate::enforcement::Hasher,
        {
            crate::pipeline::run_incremental_completeness::<T, H>(input.inner(), level)
                .map(|v| Certified::new(*v.inner()))
                .map_err(|_| Certified::new(GenericImpossibilityWitness::default()))
        }
    }

    /// v0.2.2 closure: certify grounding-aware reduction for a CompileUnit.
    pub mod grounding_aware {
        use super::*;
        /// v0.2.2 closure (target §4.2): parameterized over phase + hasher.
        ///
        /// # Errors
        ///
        /// Returns `Certified<GenericImpossibilityWitness>` on failure.
        pub fn certify<P, H>(
            input: &Validated<CompileUnit, P>,
        ) -> Result<Certified<GroundingCertificate>, Certified<GenericImpossibilityWitness>>
        where
            P: crate::enforcement::ValidationPhase,
            H: crate::enforcement::Hasher,
        {
            certify_at::<P, H>(input, WittLevel::W32)
        }

        /// Certify at an explicit Witt level.
        ///
        /// # Errors
        ///
        /// Returns `Certified<GenericImpossibilityWitness>` on failure.
        pub fn certify_at<P, H>(
            input: &Validated<CompileUnit, P>,
            level: WittLevel,
        ) -> Result<Certified<GroundingCertificate>, Certified<GenericImpossibilityWitness>>
        where
            P: crate::enforcement::ValidationPhase,
            H: crate::enforcement::Hasher,
        {
            crate::pipeline::run_grounding_aware::<H>(input.inner(), level)
                .map(|v| Certified::new(*v.inner()))
                .map_err(|_| Certified::new(GenericImpossibilityWitness::default()))
        }
    }

    /// v0.2.2 closure: certify inhabitance for a constrained type.
    pub mod inhabitance {
        use super::*;
        /// v0.2.2 closure (target §4.2): parameterized over phase + hasher.
        ///
        /// # Errors
        ///
        /// Returns `Certified<InhabitanceImpossibilityWitness>` on failure.
        pub fn certify<T, P, H>(
            input: &Validated<T, P>,
        ) -> Result<Certified<InhabitanceCertificate>, Certified<InhabitanceImpossibilityWitness>>
        where
            T: crate::pipeline::ConstrainedTypeShape,
            P: crate::enforcement::ValidationPhase,
            H: crate::enforcement::Hasher,
        {
            certify_at::<T, P, H>(input, WittLevel::W32)
        }

        /// Certify at an explicit Witt level.
        ///
        /// # Errors
        ///
        /// Returns `Certified<InhabitanceImpossibilityWitness>` on failure.
        pub fn certify_at<T, P, H>(
            input: &Validated<T, P>,
            level: WittLevel,
        ) -> Result<Certified<InhabitanceCertificate>, Certified<InhabitanceImpossibilityWitness>>
        where
            T: crate::pipeline::ConstrainedTypeShape,
            P: crate::enforcement::ValidationPhase,
            H: crate::enforcement::Hasher,
        {
            crate::pipeline::run_inhabitance::<T, H>(input.inner(), level)
                .map(|v: Validated<InhabitanceCertificate>| Certified::new(*v.inner()))
                .map_err(|_| Certified::new(InhabitanceImpossibilityWitness::default()))
        }
    }

    /// v0.2.2 Phase C.4: multiplication resolver — picks the cost-optimal
    /// Toom-Cook splitting factor R for a `Datum<L>` × `Datum<L>`
    /// multiplication at a given call-site context. The cost function is
    /// closed-form and grounded in `op:OA_5`:
    ///
    /// ```text
    /// sub_mul_count(N, R) = (2R - 1)  for R > 1
    ///                     = 1         for R = 1 (schoolbook)
    /// landauer_cost(N, R) = sub_mul_count(N, R) · (N/R)² · 64 · ln 2  nats
    /// ```
    pub mod multiplication {
        use super::super::{MulContext, MultiplicationCertificate};
        use super::*;

        /// v0.2.2 T6.7: parameterized over `H: Hasher`. Pick the cost-optimal
        /// splitting factor R for a multiplication at the given call-site
        /// context and return a `Certified<MultiplicationCertificate>`
        /// recording the choice. The certificate carries a substrate-computed
        /// content fingerprint.
        ///
        /// # Errors
        ///
        /// Returns `GenericImpossibilityWitness` if the call-site context is
        /// inadmissible (`stack_budget_bytes == 0`). The resolver is otherwise
        /// total over admissible inputs.
        pub fn certify<H: crate::enforcement::Hasher>(
            context: &MulContext,
        ) -> Result<Certified<MultiplicationCertificate>, GenericImpossibilityWitness> {
            if context.stack_budget_bytes == 0 {
                return Err(GenericImpossibilityWitness::default());
            }
            // Closed-form cost search: R = 1 (schoolbook) vs R = 2 (Karatsuba).
            let limb_count = context.limb_count.max(1);
            let karatsuba_stack_need = limb_count * 8 * 6;
            let choose_karatsuba = !context.const_eval
                && (context.stack_budget_bytes as usize) >= karatsuba_stack_need;
            // v0.2.2 T6.7: compute substrate fingerprint over the MulContext.
            let mut hasher = H::initial();
            hasher = hasher.fold_bytes(&context.stack_budget_bytes.to_be_bytes());
            hasher = hasher.fold_byte(if context.const_eval { 1 } else { 0 });
            hasher = hasher.fold_bytes(&(limb_count as u64).to_be_bytes());
            hasher = hasher.fold_byte(crate::enforcement::certificate_kind_discriminant(
                crate::enforcement::CertificateKind::Multiplication,
            ));
            let buffer = hasher.finalize();
            let fp =
                crate::enforcement::ContentFingerprint::from_buffer(buffer, H::OUTPUT_BYTES as u8);
            let cert = if choose_karatsuba {
                MultiplicationCertificate::with_evidence(
                    2,
                    3,
                    karatsuba_landauer_cost(limb_count),
                    fp,
                )
            } else {
                MultiplicationCertificate::with_evidence(
                    1,
                    1,
                    schoolbook_landauer_cost(limb_count),
                    fp,
                )
            };
            Ok(Certified::new(cert))
        }

        // Local default-host alias for the Landauer cost helpers below.
        type DefaultDecimal = <crate::DefaultHostTypes as crate::HostTypes>::Decimal;

        /// Schoolbook Landauer cost in nats for an N-limb multiplication:
        /// `N² · 64 · ln 2`. Returns the IEEE-754 bit pattern;
        /// see `MultiplicationEvidence::landauer_cost_nats_bits`.
        fn schoolbook_landauer_cost(limb_count: usize) -> u64 {
            let n = <DefaultDecimal as crate::DecimalTranscendental>::from_u32(limb_count as u32);
            let sixty_four = <DefaultDecimal as crate::DecimalTranscendental>::from_u32(64);
            let ln_2 =
                <DefaultDecimal as crate::DecimalTranscendental>::from_bits(crate::LN_2_BITS);
            (n * n * sixty_four * ln_2).to_bits()
        }

        /// Karatsuba Landauer cost: `3 · (N/2)² · 64 · ln 2`.
        /// Returns the IEEE-754 bit pattern.
        fn karatsuba_landauer_cost(limb_count: usize) -> u64 {
            let n = <DefaultDecimal as crate::DecimalTranscendental>::from_u32(limb_count as u32);
            let two = <DefaultDecimal as crate::DecimalTranscendental>::from_u32(2);
            let three = <DefaultDecimal as crate::DecimalTranscendental>::from_u32(3);
            let sixty_four = <DefaultDecimal as crate::DecimalTranscendental>::from_u32(64);
            let ln_2 =
                <DefaultDecimal as crate::DecimalTranscendental>::from_bits(crate::LN_2_BITS);
            let n_half = n / two;
            (three * n_half * n_half * sixty_four * ln_2).to_bits()
        }
    }

    /// v0.2.2 Phase C: `pub(crate)` trait parameterizing the 15 Phase D resolver kernels.
    /// Each kernel marker supplies a `CertificateKind` discriminant and its
    /// ontology-declared certificate type via `type Cert`. The shared
    /// `certify_at` bodies (see `emit_phase_d_ct_body` / `emit_phase_d_cu_body`)
    /// mint `Certified<Kernel::Cert>` directly — so each resolver's cert class
    /// matches its `resolver:CertifyMapping` in the ontology.
    pub(crate) trait ResolverKernel {
        const KIND: crate::enforcement::CertificateKind;
        /// Phase X.1: the ontology-declared certificate class produced by
        /// this resolver (per `resolver:CertifyMapping`).
        type Cert: crate::enforcement::Certificate;
    }

    /// Phase D (target §4.2): `resolver:TwoSatDecider` — certify that `predicate:Is2SatShape` inputs are 2-SAT-decidable via the Aspvall-Plass-Tarjan strongly-connected-components decider.
    /// Returns `Certified<GroundingCertificate>` on success carrying the Witt
    /// level and a consumer-hasher-computed substrate fingerprint that uniquely
    /// identifies the input. `Certified<GenericImpossibilityWitness>` on
    /// failure — the witness itself is certified so downstream can persist it
    /// alongside success certs in a uniform `Certified<_>` channel.
    /// Phase X.1: the produced cert class is the ontology-declared class for
    /// this resolver's `resolver:CertifyMapping`. Eight cert subclasses —
    /// `TransformCertificate`, `IsometryCertificate`, `InvolutionCertificate`,
    /// `CompletenessCertificate`, `GeodesicCertificate`, `MeasurementCertificate`,
    /// `BornRuleVerification`, and `GroundingCertificate` — are minted across the 17 Phase D
    /// kernels so each resolver's class discrimination is load-bearing.
    /// v0.2.2 Phase J: `certify_at` composes an ontology primitive (per the
    /// kernel's composition spec) whose output is folded into the canonical
    /// fingerprint ahead of `fold_unit_digest`, so distinct primitive outputs
    /// yield distinct fingerprints — i.e., each kernel's decision is real and
    /// content-addressed per its ontology class.
    pub mod two_sat_decider {
        use super::*;

        #[doc(hidden)]
        pub struct Kernel;
        impl super::ResolverKernel for Kernel {
            type Cert = crate::enforcement::GroundingCertificate;
            const KIND: crate::enforcement::CertificateKind =
                crate::enforcement::CertificateKind::TwoSat;
        }

        /// Phase D (target §4.2): certify at the canonical `WittLevel::W32`.
        ///
        /// # Errors
        ///
        /// Returns `Certified<GenericImpossibilityWitness>` on failure.
        pub fn certify<
            T: crate::pipeline::ConstrainedTypeShape,
            P: crate::enforcement::ValidationPhase,
            H: crate::enforcement::Hasher,
        >(
            input: &Validated<T, P>,
        ) -> Result<Certified<GroundingCertificate>, Certified<GenericImpossibilityWitness>>
        {
            certify_at::<T, P, H>(input, WittLevel::W32)
        }

        /// Phase D (target §4.2): certify at an explicit Witt level.
        ///
        /// # Errors
        ///
        /// Returns `Certified<GenericImpossibilityWitness>` on failure.
        pub fn certify_at<
            T: crate::pipeline::ConstrainedTypeShape,
            P: crate::enforcement::ValidationPhase,
            H: crate::enforcement::Hasher,
        >(
            input: &Validated<T, P>,
            level: WittLevel,
        ) -> Result<Certified<GroundingCertificate>, Certified<GenericImpossibilityWitness>>
        {
            let _ = input.inner();
            let witt_bits = level.witt_length() as u16;
            let (tr_bits, tr_constraints, tr_sat) =
                crate::enforcement::primitive_terminal_reduction::<T>(witt_bits)
                    .map_err(|_| Certified::new(GenericImpossibilityWitness::default()))?;
            if tr_sat == 0 {
                return Err(Certified::new(GenericImpossibilityWitness::default()));
            }
            let mut hasher = H::initial();
            hasher = crate::enforcement::fold_terminal_reduction(
                hasher,
                tr_bits,
                tr_constraints,
                tr_sat,
            );
            hasher = crate::enforcement::fold_unit_digest(
                hasher,
                witt_bits,
                witt_bits as u64,
                T::IRI,
                T::SITE_COUNT,
                T::CONSTRAINTS,
                <Kernel as super::ResolverKernel>::KIND,
            );
            let buffer = hasher.finalize();
            let fp =
                crate::enforcement::ContentFingerprint::from_buffer(buffer, H::OUTPUT_BYTES as u8);
            let cert = <<Kernel as super::ResolverKernel>::Cert as crate::enforcement::certify_const_mint::MintWithLevelFingerprint>::mint_with_level_fingerprint(witt_bits, fp);
            Ok(Certified::new(cert))
        }
    }

    /// Phase D (target §4.2): `resolver:HornSatDecider` — certify that `predicate:IsHornShape` inputs are Horn-SAT-decidable via unit propagation (O(n+m)).
    /// Returns `Certified<GroundingCertificate>` on success carrying the Witt
    /// level and a consumer-hasher-computed substrate fingerprint that uniquely
    /// identifies the input. `Certified<GenericImpossibilityWitness>` on
    /// failure — the witness itself is certified so downstream can persist it
    /// alongside success certs in a uniform `Certified<_>` channel.
    /// Phase X.1: the produced cert class is the ontology-declared class for
    /// this resolver's `resolver:CertifyMapping`. Eight cert subclasses —
    /// `TransformCertificate`, `IsometryCertificate`, `InvolutionCertificate`,
    /// `CompletenessCertificate`, `GeodesicCertificate`, `MeasurementCertificate`,
    /// `BornRuleVerification`, and `GroundingCertificate` — are minted across the 17 Phase D
    /// kernels so each resolver's class discrimination is load-bearing.
    /// v0.2.2 Phase J: `certify_at` composes an ontology primitive (per the
    /// kernel's composition spec) whose output is folded into the canonical
    /// fingerprint ahead of `fold_unit_digest`, so distinct primitive outputs
    /// yield distinct fingerprints — i.e., each kernel's decision is real and
    /// content-addressed per its ontology class.
    pub mod horn_sat_decider {
        use super::*;

        #[doc(hidden)]
        pub struct Kernel;
        impl super::ResolverKernel for Kernel {
            type Cert = crate::enforcement::GroundingCertificate;
            const KIND: crate::enforcement::CertificateKind =
                crate::enforcement::CertificateKind::HornSat;
        }

        /// Phase D (target §4.2): certify at the canonical `WittLevel::W32`.
        ///
        /// # Errors
        ///
        /// Returns `Certified<GenericImpossibilityWitness>` on failure.
        pub fn certify<
            T: crate::pipeline::ConstrainedTypeShape,
            P: crate::enforcement::ValidationPhase,
            H: crate::enforcement::Hasher,
        >(
            input: &Validated<T, P>,
        ) -> Result<Certified<GroundingCertificate>, Certified<GenericImpossibilityWitness>>
        {
            certify_at::<T, P, H>(input, WittLevel::W32)
        }

        /// Phase D (target §4.2): certify at an explicit Witt level.
        ///
        /// # Errors
        ///
        /// Returns `Certified<GenericImpossibilityWitness>` on failure.
        pub fn certify_at<
            T: crate::pipeline::ConstrainedTypeShape,
            P: crate::enforcement::ValidationPhase,
            H: crate::enforcement::Hasher,
        >(
            input: &Validated<T, P>,
            level: WittLevel,
        ) -> Result<Certified<GroundingCertificate>, Certified<GenericImpossibilityWitness>>
        {
            let _ = input.inner();
            let witt_bits = level.witt_length() as u16;
            let (tr_bits, tr_constraints, tr_sat) =
                crate::enforcement::primitive_terminal_reduction::<T>(witt_bits)
                    .map_err(|_| Certified::new(GenericImpossibilityWitness::default()))?;
            if tr_sat == 0 {
                return Err(Certified::new(GenericImpossibilityWitness::default()));
            }
            let mut hasher = H::initial();
            hasher = crate::enforcement::fold_terminal_reduction(
                hasher,
                tr_bits,
                tr_constraints,
                tr_sat,
            );
            hasher = crate::enforcement::fold_unit_digest(
                hasher,
                witt_bits,
                witt_bits as u64,
                T::IRI,
                T::SITE_COUNT,
                T::CONSTRAINTS,
                <Kernel as super::ResolverKernel>::KIND,
            );
            let buffer = hasher.finalize();
            let fp =
                crate::enforcement::ContentFingerprint::from_buffer(buffer, H::OUTPUT_BYTES as u8);
            let cert = <<Kernel as super::ResolverKernel>::Cert as crate::enforcement::certify_const_mint::MintWithLevelFingerprint>::mint_with_level_fingerprint(witt_bits, fp);
            Ok(Certified::new(cert))
        }
    }

    /// Phase D (target §4.2): `resolver:ResidualVerdictResolver` — certify `predicate:IsResidualFragment` inputs; returns `GenericImpossibilityWitness` when the residual fragment has no polynomial decider available (the canonical impossibility path).
    /// Returns `Certified<GroundingCertificate>` on success carrying the Witt
    /// level and a consumer-hasher-computed substrate fingerprint that uniquely
    /// identifies the input. `Certified<GenericImpossibilityWitness>` on
    /// failure — the witness itself is certified so downstream can persist it
    /// alongside success certs in a uniform `Certified<_>` channel.
    /// Phase X.1: the produced cert class is the ontology-declared class for
    /// this resolver's `resolver:CertifyMapping`. Eight cert subclasses —
    /// `TransformCertificate`, `IsometryCertificate`, `InvolutionCertificate`,
    /// `CompletenessCertificate`, `GeodesicCertificate`, `MeasurementCertificate`,
    /// `BornRuleVerification`, and `GroundingCertificate` — are minted across the 17 Phase D
    /// kernels so each resolver's class discrimination is load-bearing.
    /// v0.2.2 Phase J: `certify_at` composes an ontology primitive (per the
    /// kernel's composition spec) whose output is folded into the canonical
    /// fingerprint ahead of `fold_unit_digest`, so distinct primitive outputs
    /// yield distinct fingerprints — i.e., each kernel's decision is real and
    /// content-addressed per its ontology class.
    pub mod residual_verdict {
        use super::*;

        #[doc(hidden)]
        pub struct Kernel;
        impl super::ResolverKernel for Kernel {
            type Cert = crate::enforcement::GroundingCertificate;
            const KIND: crate::enforcement::CertificateKind =
                crate::enforcement::CertificateKind::ResidualVerdict;
        }

        /// Phase D (target §4.2): certify at the canonical `WittLevel::W32`.
        ///
        /// # Errors
        ///
        /// Returns `Certified<GenericImpossibilityWitness>` on failure.
        pub fn certify<
            T: crate::pipeline::ConstrainedTypeShape,
            P: crate::enforcement::ValidationPhase,
            H: crate::enforcement::Hasher,
        >(
            input: &Validated<T, P>,
        ) -> Result<Certified<GroundingCertificate>, Certified<GenericImpossibilityWitness>>
        {
            certify_at::<T, P, H>(input, WittLevel::W32)
        }

        /// Phase D (target §4.2): certify at an explicit Witt level.
        ///
        /// # Errors
        ///
        /// Returns `Certified<GenericImpossibilityWitness>` on failure.
        pub fn certify_at<
            T: crate::pipeline::ConstrainedTypeShape,
            P: crate::enforcement::ValidationPhase,
            H: crate::enforcement::Hasher,
        >(
            input: &Validated<T, P>,
            level: WittLevel,
        ) -> Result<Certified<GroundingCertificate>, Certified<GenericImpossibilityWitness>>
        {
            let _ = input.inner();
            let witt_bits = level.witt_length() as u16;
            let (tr_bits, tr_constraints, tr_sat) =
                crate::enforcement::primitive_terminal_reduction::<T>(witt_bits)
                    .map_err(|_| Certified::new(GenericImpossibilityWitness::default()))?;
            if tr_sat == 0 {
                return Err(Certified::new(GenericImpossibilityWitness::default()));
            }
            let mut hasher = H::initial();
            hasher = crate::enforcement::fold_terminal_reduction(
                hasher,
                tr_bits,
                tr_constraints,
                tr_sat,
            );
            hasher = crate::enforcement::fold_unit_digest(
                hasher,
                witt_bits,
                witt_bits as u64,
                T::IRI,
                T::SITE_COUNT,
                T::CONSTRAINTS,
                <Kernel as super::ResolverKernel>::KIND,
            );
            let buffer = hasher.finalize();
            let fp =
                crate::enforcement::ContentFingerprint::from_buffer(buffer, H::OUTPUT_BYTES as u8);
            let cert = <<Kernel as super::ResolverKernel>::Cert as crate::enforcement::certify_const_mint::MintWithLevelFingerprint>::mint_with_level_fingerprint(witt_bits, fp);
            Ok(Certified::new(cert))
        }
    }

    /// Phase D (target §4.2): `resolver:CanonicalFormResolver` — compute the canonical form of a `ConstrainedType` by running the reduction stages and emitting a `Certified<TransformCertificate>` whose fingerprint uniquely identifies the canonicalized input.
    /// Returns `Certified<TransformCertificate>` on success carrying the Witt
    /// level and a consumer-hasher-computed substrate fingerprint that uniquely
    /// identifies the input. `Certified<GenericImpossibilityWitness>` on
    /// failure — the witness itself is certified so downstream can persist it
    /// alongside success certs in a uniform `Certified<_>` channel.
    /// Phase X.1: the produced cert class is the ontology-declared class for
    /// this resolver's `resolver:CertifyMapping`. Eight cert subclasses —
    /// `TransformCertificate`, `IsometryCertificate`, `InvolutionCertificate`,
    /// `CompletenessCertificate`, `GeodesicCertificate`, `MeasurementCertificate`,
    /// `BornRuleVerification`, and `GroundingCertificate` — are minted across the 17 Phase D
    /// kernels so each resolver's class discrimination is load-bearing.
    /// v0.2.2 Phase J: `certify_at` composes an ontology primitive (per the
    /// kernel's composition spec) whose output is folded into the canonical
    /// fingerprint ahead of `fold_unit_digest`, so distinct primitive outputs
    /// yield distinct fingerprints — i.e., each kernel's decision is real and
    /// content-addressed per its ontology class.
    pub mod canonical_form {
        use super::*;

        #[doc(hidden)]
        pub struct Kernel;
        impl super::ResolverKernel for Kernel {
            type Cert = crate::enforcement::TransformCertificate;
            const KIND: crate::enforcement::CertificateKind =
                crate::enforcement::CertificateKind::CanonicalForm;
        }

        /// Phase D (target §4.2): certify at the canonical `WittLevel::W32`.
        ///
        /// # Errors
        ///
        /// Returns `Certified<GenericImpossibilityWitness>` on failure.
        pub fn certify<
            T: crate::pipeline::ConstrainedTypeShape,
            P: crate::enforcement::ValidationPhase,
            H: crate::enforcement::Hasher,
        >(
            input: &Validated<T, P>,
        ) -> Result<Certified<TransformCertificate>, Certified<GenericImpossibilityWitness>>
        {
            certify_at::<T, P, H>(input, WittLevel::W32)
        }

        /// Phase D (target §4.2): certify at an explicit Witt level.
        ///
        /// # Errors
        ///
        /// Returns `Certified<GenericImpossibilityWitness>` on failure.
        pub fn certify_at<
            T: crate::pipeline::ConstrainedTypeShape,
            P: crate::enforcement::ValidationPhase,
            H: crate::enforcement::Hasher,
        >(
            input: &Validated<T, P>,
            level: WittLevel,
        ) -> Result<Certified<TransformCertificate>, Certified<GenericImpossibilityWitness>>
        {
            let _ = input.inner();
            let witt_bits = level.witt_length() as u16;
            let (tr_bits, tr_constraints, tr_sat) =
                crate::enforcement::primitive_terminal_reduction::<T>(witt_bits)
                    .map_err(|_| Certified::new(GenericImpossibilityWitness::default()))?;
            if tr_sat == 0 {
                return Err(Certified::new(GenericImpossibilityWitness::default()));
            }
            let mut hasher = H::initial();
            hasher = crate::enforcement::fold_terminal_reduction(
                hasher,
                tr_bits,
                tr_constraints,
                tr_sat,
            );
            let (tr2_bits, tr2_constraints, tr2_sat) =
                crate::enforcement::primitive_terminal_reduction::<T>(witt_bits)
                    .map_err(|_| Certified::new(GenericImpossibilityWitness::default()))?;
            // Church-Rosser: second reduction must agree with the first.
            if tr2_bits != tr_bits || tr2_constraints != tr_constraints || tr2_sat != tr_sat {
                return Err(Certified::new(GenericImpossibilityWitness::default()));
            }
            hasher = crate::enforcement::fold_terminal_reduction(
                hasher,
                tr2_bits,
                tr2_constraints,
                tr2_sat,
            );
            hasher = crate::enforcement::fold_unit_digest(
                hasher,
                witt_bits,
                witt_bits as u64,
                T::IRI,
                T::SITE_COUNT,
                T::CONSTRAINTS,
                <Kernel as super::ResolverKernel>::KIND,
            );
            let buffer = hasher.finalize();
            let fp =
                crate::enforcement::ContentFingerprint::from_buffer(buffer, H::OUTPUT_BYTES as u8);
            let cert = <<Kernel as super::ResolverKernel>::Cert as crate::enforcement::certify_const_mint::MintWithLevelFingerprint>::mint_with_level_fingerprint(witt_bits, fp);
            Ok(Certified::new(cert))
        }
    }

    /// Phase D (target §4.2): `resolver:TypeSynthesisResolver` — run the ψ-pipeline in inverse mode: given a `TypeSynthesisGoal` expressed through `ConstrainedTypeShape`, synthesize the type's carrier or signal impossibility.
    /// Returns `Certified<TransformCertificate>` on success carrying the Witt
    /// level and a consumer-hasher-computed substrate fingerprint that uniquely
    /// identifies the input. `Certified<GenericImpossibilityWitness>` on
    /// failure — the witness itself is certified so downstream can persist it
    /// alongside success certs in a uniform `Certified<_>` channel.
    /// Phase X.1: the produced cert class is the ontology-declared class for
    /// this resolver's `resolver:CertifyMapping`. Eight cert subclasses —
    /// `TransformCertificate`, `IsometryCertificate`, `InvolutionCertificate`,
    /// `CompletenessCertificate`, `GeodesicCertificate`, `MeasurementCertificate`,
    /// `BornRuleVerification`, and `GroundingCertificate` — are minted across the 17 Phase D
    /// kernels so each resolver's class discrimination is load-bearing.
    /// v0.2.2 Phase J: `certify_at` composes an ontology primitive (per the
    /// kernel's composition spec) whose output is folded into the canonical
    /// fingerprint ahead of `fold_unit_digest`, so distinct primitive outputs
    /// yield distinct fingerprints — i.e., each kernel's decision is real and
    /// content-addressed per its ontology class.
    pub mod type_synthesis {
        use super::*;

        #[doc(hidden)]
        pub struct Kernel;
        impl super::ResolverKernel for Kernel {
            type Cert = crate::enforcement::TransformCertificate;
            const KIND: crate::enforcement::CertificateKind =
                crate::enforcement::CertificateKind::TypeSynthesis;
        }

        /// Phase D (target §4.2): certify at the canonical `WittLevel::W32`.
        ///
        /// # Errors
        ///
        /// Returns `Certified<GenericImpossibilityWitness>` on failure.
        pub fn certify<
            T: crate::pipeline::ConstrainedTypeShape,
            P: crate::enforcement::ValidationPhase,
            H: crate::enforcement::Hasher,
        >(
            input: &Validated<T, P>,
        ) -> Result<Certified<TransformCertificate>, Certified<GenericImpossibilityWitness>>
        {
            certify_at::<T, P, H>(input, WittLevel::W32)
        }

        /// Phase D (target §4.2): certify at an explicit Witt level.
        ///
        /// # Errors
        ///
        /// Returns `Certified<GenericImpossibilityWitness>` on failure.
        pub fn certify_at<
            T: crate::pipeline::ConstrainedTypeShape,
            P: crate::enforcement::ValidationPhase,
            H: crate::enforcement::Hasher,
        >(
            input: &Validated<T, P>,
            level: WittLevel,
        ) -> Result<Certified<TransformCertificate>, Certified<GenericImpossibilityWitness>>
        {
            let _ = input.inner();
            let witt_bits = level.witt_length() as u16;
            let (tr_bits, tr_constraints, tr_sat) =
                crate::enforcement::primitive_terminal_reduction::<T>(witt_bits)
                    .map_err(|_| Certified::new(GenericImpossibilityWitness::default()))?;
            if tr_sat == 0 {
                return Err(Certified::new(GenericImpossibilityWitness::default()));
            }
            let mut hasher = H::initial();
            hasher = crate::enforcement::fold_terminal_reduction(
                hasher,
                tr_bits,
                tr_constraints,
                tr_sat,
            );
            let betti = crate::enforcement::primitive_simplicial_nerve_betti::<T>()
                .map_err(crate::enforcement::Certified::new)?;
            hasher = crate::enforcement::fold_betti_tuple(hasher, &betti);
            let (residual, entropy) = crate::enforcement::primitive_descent_metrics::<T>(&betti);
            hasher = crate::enforcement::fold_descent_metrics(hasher, residual, entropy);
            hasher = crate::enforcement::fold_unit_digest(
                hasher,
                witt_bits,
                witt_bits as u64,
                T::IRI,
                T::SITE_COUNT,
                T::CONSTRAINTS,
                <Kernel as super::ResolverKernel>::KIND,
            );
            let buffer = hasher.finalize();
            let fp =
                crate::enforcement::ContentFingerprint::from_buffer(buffer, H::OUTPUT_BYTES as u8);
            let cert = <<Kernel as super::ResolverKernel>::Cert as crate::enforcement::certify_const_mint::MintWithLevelFingerprint>::mint_with_level_fingerprint(witt_bits, fp);
            Ok(Certified::new(cert))
        }
    }

    /// Phase D (target §4.2): `resolver:HomotopyResolver` — compute homotopy-type observables (fundamental group rank, Postnikov-truncation records) by walking the constraint-nerve chain and extracting Betti-number evidence.
    /// Returns `Certified<TransformCertificate>` on success carrying the Witt
    /// level and a consumer-hasher-computed substrate fingerprint that uniquely
    /// identifies the input. `Certified<GenericImpossibilityWitness>` on
    /// failure — the witness itself is certified so downstream can persist it
    /// alongside success certs in a uniform `Certified<_>` channel.
    /// Phase X.1: the produced cert class is the ontology-declared class for
    /// this resolver's `resolver:CertifyMapping`. Eight cert subclasses —
    /// `TransformCertificate`, `IsometryCertificate`, `InvolutionCertificate`,
    /// `CompletenessCertificate`, `GeodesicCertificate`, `MeasurementCertificate`,
    /// `BornRuleVerification`, and `GroundingCertificate` — are minted across the 17 Phase D
    /// kernels so each resolver's class discrimination is load-bearing.
    /// v0.2.2 Phase J: `certify_at` composes an ontology primitive (per the
    /// kernel's composition spec) whose output is folded into the canonical
    /// fingerprint ahead of `fold_unit_digest`, so distinct primitive outputs
    /// yield distinct fingerprints — i.e., each kernel's decision is real and
    /// content-addressed per its ontology class.
    pub mod homotopy {
        use super::*;

        #[doc(hidden)]
        pub struct Kernel;
        impl super::ResolverKernel for Kernel {
            type Cert = crate::enforcement::TransformCertificate;
            const KIND: crate::enforcement::CertificateKind =
                crate::enforcement::CertificateKind::Homotopy;
        }

        /// Phase D (target §4.2): certify at the canonical `WittLevel::W32`.
        ///
        /// # Errors
        ///
        /// Returns `Certified<GenericImpossibilityWitness>` on failure.
        pub fn certify<
            T: crate::pipeline::ConstrainedTypeShape,
            P: crate::enforcement::ValidationPhase,
            H: crate::enforcement::Hasher,
        >(
            input: &Validated<T, P>,
        ) -> Result<Certified<TransformCertificate>, Certified<GenericImpossibilityWitness>>
        {
            certify_at::<T, P, H>(input, WittLevel::W32)
        }

        /// Phase D (target §4.2): certify at an explicit Witt level.
        ///
        /// # Errors
        ///
        /// Returns `Certified<GenericImpossibilityWitness>` on failure.
        pub fn certify_at<
            T: crate::pipeline::ConstrainedTypeShape,
            P: crate::enforcement::ValidationPhase,
            H: crate::enforcement::Hasher,
        >(
            input: &Validated<T, P>,
            level: WittLevel,
        ) -> Result<Certified<TransformCertificate>, Certified<GenericImpossibilityWitness>>
        {
            let _ = input.inner();
            let witt_bits = level.witt_length() as u16;
            let (tr_bits, tr_constraints, tr_sat) =
                crate::enforcement::primitive_terminal_reduction::<T>(witt_bits)
                    .map_err(|_| Certified::new(GenericImpossibilityWitness::default()))?;
            if tr_sat == 0 {
                return Err(Certified::new(GenericImpossibilityWitness::default()));
            }
            let mut hasher = H::initial();
            hasher = crate::enforcement::fold_terminal_reduction(
                hasher,
                tr_bits,
                tr_constraints,
                tr_sat,
            );
            let betti = crate::enforcement::primitive_simplicial_nerve_betti::<T>()
                .map_err(crate::enforcement::Certified::new)?;
            hasher = crate::enforcement::fold_betti_tuple(hasher, &betti);
            hasher = crate::enforcement::fold_unit_digest(
                hasher,
                witt_bits,
                witt_bits as u64,
                T::IRI,
                T::SITE_COUNT,
                T::CONSTRAINTS,
                <Kernel as super::ResolverKernel>::KIND,
            );
            let buffer = hasher.finalize();
            let fp =
                crate::enforcement::ContentFingerprint::from_buffer(buffer, H::OUTPUT_BYTES as u8);
            let cert = <<Kernel as super::ResolverKernel>::Cert as crate::enforcement::certify_const_mint::MintWithLevelFingerprint>::mint_with_level_fingerprint(witt_bits, fp);
            Ok(Certified::new(cert))
        }
    }

    /// Phase D (target §4.2): `resolver:MonodromyResolver` — compute monodromy-group observables by tracing the constraint-nerve boundary cycles at the input's Witt level.
    /// Returns `Certified<IsometryCertificate>` on success carrying the Witt
    /// level and a consumer-hasher-computed substrate fingerprint that uniquely
    /// identifies the input. `Certified<GenericImpossibilityWitness>` on
    /// failure — the witness itself is certified so downstream can persist it
    /// alongside success certs in a uniform `Certified<_>` channel.
    /// Phase X.1: the produced cert class is the ontology-declared class for
    /// this resolver's `resolver:CertifyMapping`. Eight cert subclasses —
    /// `TransformCertificate`, `IsometryCertificate`, `InvolutionCertificate`,
    /// `CompletenessCertificate`, `GeodesicCertificate`, `MeasurementCertificate`,
    /// `BornRuleVerification`, and `GroundingCertificate` — are minted across the 17 Phase D
    /// kernels so each resolver's class discrimination is load-bearing.
    /// v0.2.2 Phase J: `certify_at` composes an ontology primitive (per the
    /// kernel's composition spec) whose output is folded into the canonical
    /// fingerprint ahead of `fold_unit_digest`, so distinct primitive outputs
    /// yield distinct fingerprints — i.e., each kernel's decision is real and
    /// content-addressed per its ontology class.
    pub mod monodromy {
        use super::*;

        #[doc(hidden)]
        pub struct Kernel;
        impl super::ResolverKernel for Kernel {
            type Cert = crate::enforcement::IsometryCertificate;
            const KIND: crate::enforcement::CertificateKind =
                crate::enforcement::CertificateKind::Monodromy;
        }

        /// Phase D (target §4.2): certify at the canonical `WittLevel::W32`.
        ///
        /// # Errors
        ///
        /// Returns `Certified<GenericImpossibilityWitness>` on failure.
        pub fn certify<
            T: crate::pipeline::ConstrainedTypeShape,
            P: crate::enforcement::ValidationPhase,
            H: crate::enforcement::Hasher,
        >(
            input: &Validated<T, P>,
        ) -> Result<Certified<IsometryCertificate>, Certified<GenericImpossibilityWitness>>
        {
            certify_at::<T, P, H>(input, WittLevel::W32)
        }

        /// Phase D (target §4.2): certify at an explicit Witt level.
        ///
        /// # Errors
        ///
        /// Returns `Certified<GenericImpossibilityWitness>` on failure.
        pub fn certify_at<
            T: crate::pipeline::ConstrainedTypeShape,
            P: crate::enforcement::ValidationPhase,
            H: crate::enforcement::Hasher,
        >(
            input: &Validated<T, P>,
            level: WittLevel,
        ) -> Result<Certified<IsometryCertificate>, Certified<GenericImpossibilityWitness>>
        {
            let _ = input.inner();
            let witt_bits = level.witt_length() as u16;
            let (tr_bits, tr_constraints, tr_sat) =
                crate::enforcement::primitive_terminal_reduction::<T>(witt_bits)
                    .map_err(|_| Certified::new(GenericImpossibilityWitness::default()))?;
            if tr_sat == 0 {
                return Err(Certified::new(GenericImpossibilityWitness::default()));
            }
            let mut hasher = H::initial();
            hasher = crate::enforcement::fold_terminal_reduction(
                hasher,
                tr_bits,
                tr_constraints,
                tr_sat,
            );
            let betti = crate::enforcement::primitive_simplicial_nerve_betti::<T>()
                .map_err(crate::enforcement::Certified::new)?;
            hasher = crate::enforcement::fold_betti_tuple(hasher, &betti);
            let (orbit_size, representative) =
                crate::enforcement::primitive_dihedral_signature::<T>();
            hasher =
                crate::enforcement::fold_dihedral_signature(hasher, orbit_size, representative);
            hasher = crate::enforcement::fold_unit_digest(
                hasher,
                witt_bits,
                witt_bits as u64,
                T::IRI,
                T::SITE_COUNT,
                T::CONSTRAINTS,
                <Kernel as super::ResolverKernel>::KIND,
            );
            let buffer = hasher.finalize();
            let fp =
                crate::enforcement::ContentFingerprint::from_buffer(buffer, H::OUTPUT_BYTES as u8);
            let cert = <<Kernel as super::ResolverKernel>::Cert as crate::enforcement::certify_const_mint::MintWithLevelFingerprint>::mint_with_level_fingerprint(witt_bits, fp);
            Ok(Certified::new(cert))
        }
    }

    /// Phase D (target §4.2): `resolver:ModuliResolver` — compute the local moduli-space structure at a `CompleteType`: DeformationComplex, HolonomyStratum, tangent/obstruction dimensions.
    /// Returns `Certified<TransformCertificate>` on success carrying the Witt
    /// level and a consumer-hasher-computed substrate fingerprint that uniquely
    /// identifies the input. `Certified<GenericImpossibilityWitness>` on
    /// failure — the witness itself is certified so downstream can persist it
    /// alongside success certs in a uniform `Certified<_>` channel.
    /// Phase X.1: the produced cert class is the ontology-declared class for
    /// this resolver's `resolver:CertifyMapping`. Eight cert subclasses —
    /// `TransformCertificate`, `IsometryCertificate`, `InvolutionCertificate`,
    /// `CompletenessCertificate`, `GeodesicCertificate`, `MeasurementCertificate`,
    /// `BornRuleVerification`, and `GroundingCertificate` — are minted across the 17 Phase D
    /// kernels so each resolver's class discrimination is load-bearing.
    /// v0.2.2 Phase J: `certify_at` composes an ontology primitive (per the
    /// kernel's composition spec) whose output is folded into the canonical
    /// fingerprint ahead of `fold_unit_digest`, so distinct primitive outputs
    /// yield distinct fingerprints — i.e., each kernel's decision is real and
    /// content-addressed per its ontology class.
    pub mod moduli {
        use super::*;

        #[doc(hidden)]
        pub struct Kernel;
        impl super::ResolverKernel for Kernel {
            type Cert = crate::enforcement::TransformCertificate;
            const KIND: crate::enforcement::CertificateKind =
                crate::enforcement::CertificateKind::Moduli;
        }

        /// Phase D (target §4.2): certify at the canonical `WittLevel::W32`.
        ///
        /// # Errors
        ///
        /// Returns `Certified<GenericImpossibilityWitness>` on failure.
        pub fn certify<
            T: crate::pipeline::ConstrainedTypeShape,
            P: crate::enforcement::ValidationPhase,
            H: crate::enforcement::Hasher,
        >(
            input: &Validated<T, P>,
        ) -> Result<Certified<TransformCertificate>, Certified<GenericImpossibilityWitness>>
        {
            certify_at::<T, P, H>(input, WittLevel::W32)
        }

        /// Phase D (target §4.2): certify at an explicit Witt level.
        ///
        /// # Errors
        ///
        /// Returns `Certified<GenericImpossibilityWitness>` on failure.
        pub fn certify_at<
            T: crate::pipeline::ConstrainedTypeShape,
            P: crate::enforcement::ValidationPhase,
            H: crate::enforcement::Hasher,
        >(
            input: &Validated<T, P>,
            level: WittLevel,
        ) -> Result<Certified<TransformCertificate>, Certified<GenericImpossibilityWitness>>
        {
            let _ = input.inner();
            let witt_bits = level.witt_length() as u16;
            let (tr_bits, tr_constraints, tr_sat) =
                crate::enforcement::primitive_terminal_reduction::<T>(witt_bits)
                    .map_err(|_| Certified::new(GenericImpossibilityWitness::default()))?;
            if tr_sat == 0 {
                return Err(Certified::new(GenericImpossibilityWitness::default()));
            }
            let mut hasher = H::initial();
            hasher = crate::enforcement::fold_terminal_reduction(
                hasher,
                tr_bits,
                tr_constraints,
                tr_sat,
            );
            let betti = crate::enforcement::primitive_simplicial_nerve_betti::<T>()
                .map_err(crate::enforcement::Certified::new)?;
            let automorphisms: u32 = betti[0];
            let deformations: u32 = if crate::enforcement::MAX_BETTI_DIMENSION > 1 {
                betti[1]
            } else {
                0
            };
            let obstructions: u32 = if crate::enforcement::MAX_BETTI_DIMENSION > 2 {
                betti[2]
            } else {
                0
            };
            hasher = hasher.fold_bytes(&automorphisms.to_be_bytes());
            hasher = hasher.fold_bytes(&deformations.to_be_bytes());
            hasher = hasher.fold_bytes(&obstructions.to_be_bytes());
            hasher = crate::enforcement::fold_unit_digest(
                hasher,
                witt_bits,
                witt_bits as u64,
                T::IRI,
                T::SITE_COUNT,
                T::CONSTRAINTS,
                <Kernel as super::ResolverKernel>::KIND,
            );
            let buffer = hasher.finalize();
            let fp =
                crate::enforcement::ContentFingerprint::from_buffer(buffer, H::OUTPUT_BYTES as u8);
            let cert = <<Kernel as super::ResolverKernel>::Cert as crate::enforcement::certify_const_mint::MintWithLevelFingerprint>::mint_with_level_fingerprint(witt_bits, fp);
            Ok(Certified::new(cert))
        }
    }

    /// Phase D (target §4.2): `resolver:JacobianGuidedResolver` — drive reduction using the per-site Jacobian profile; short-circuits when the Jacobian stabilizes, producing a cert attesting the stabilized observable.
    /// Returns `Certified<GroundingCertificate>` on success carrying the Witt
    /// level and a consumer-hasher-computed substrate fingerprint that uniquely
    /// identifies the input. `Certified<GenericImpossibilityWitness>` on
    /// failure — the witness itself is certified so downstream can persist it
    /// alongside success certs in a uniform `Certified<_>` channel.
    /// Phase X.1: the produced cert class is the ontology-declared class for
    /// this resolver's `resolver:CertifyMapping`. Eight cert subclasses —
    /// `TransformCertificate`, `IsometryCertificate`, `InvolutionCertificate`,
    /// `CompletenessCertificate`, `GeodesicCertificate`, `MeasurementCertificate`,
    /// `BornRuleVerification`, and `GroundingCertificate` — are minted across the 17 Phase D
    /// kernels so each resolver's class discrimination is load-bearing.
    /// v0.2.2 Phase J: `certify_at` composes an ontology primitive (per the
    /// kernel's composition spec) whose output is folded into the canonical
    /// fingerprint ahead of `fold_unit_digest`, so distinct primitive outputs
    /// yield distinct fingerprints — i.e., each kernel's decision is real and
    /// content-addressed per its ontology class.
    pub mod jacobian_guided {
        use super::*;

        #[doc(hidden)]
        pub struct Kernel;
        impl super::ResolverKernel for Kernel {
            type Cert = crate::enforcement::GroundingCertificate;
            const KIND: crate::enforcement::CertificateKind =
                crate::enforcement::CertificateKind::JacobianGuided;
        }

        /// Phase D (target §4.2): certify at the canonical `WittLevel::W32`.
        ///
        /// # Errors
        ///
        /// Returns `Certified<GenericImpossibilityWitness>` on failure.
        pub fn certify<
            T: crate::pipeline::ConstrainedTypeShape,
            P: crate::enforcement::ValidationPhase,
            H: crate::enforcement::Hasher,
        >(
            input: &Validated<T, P>,
        ) -> Result<Certified<GroundingCertificate>, Certified<GenericImpossibilityWitness>>
        {
            certify_at::<T, P, H>(input, WittLevel::W32)
        }

        /// Phase D (target §4.2): certify at an explicit Witt level.
        ///
        /// # Errors
        ///
        /// Returns `Certified<GenericImpossibilityWitness>` on failure.
        pub fn certify_at<
            T: crate::pipeline::ConstrainedTypeShape,
            P: crate::enforcement::ValidationPhase,
            H: crate::enforcement::Hasher,
        >(
            input: &Validated<T, P>,
            level: WittLevel,
        ) -> Result<Certified<GroundingCertificate>, Certified<GenericImpossibilityWitness>>
        {
            let _ = input.inner();
            let witt_bits = level.witt_length() as u16;
            let (tr_bits, tr_constraints, tr_sat) =
                crate::enforcement::primitive_terminal_reduction::<T>(witt_bits)
                    .map_err(|_| Certified::new(GenericImpossibilityWitness::default()))?;
            if tr_sat == 0 {
                return Err(Certified::new(GenericImpossibilityWitness::default()));
            }
            let mut hasher = H::initial();
            hasher = crate::enforcement::fold_terminal_reduction(
                hasher,
                tr_bits,
                tr_constraints,
                tr_sat,
            );
            let jac = crate::enforcement::primitive_curvature_jacobian::<T>();
            hasher = crate::enforcement::fold_jacobian_profile(hasher, &jac);
            let selected_site = crate::enforcement::primitive_dc10_select(&jac);
            hasher = hasher.fold_bytes(&(selected_site as u32).to_be_bytes());
            hasher = crate::enforcement::fold_unit_digest(
                hasher,
                witt_bits,
                witt_bits as u64,
                T::IRI,
                T::SITE_COUNT,
                T::CONSTRAINTS,
                <Kernel as super::ResolverKernel>::KIND,
            );
            let buffer = hasher.finalize();
            let fp =
                crate::enforcement::ContentFingerprint::from_buffer(buffer, H::OUTPUT_BYTES as u8);
            let cert = <<Kernel as super::ResolverKernel>::Cert as crate::enforcement::certify_const_mint::MintWithLevelFingerprint>::mint_with_level_fingerprint(witt_bits, fp);
            Ok(Certified::new(cert))
        }
    }

    /// Phase D (target §4.2): `resolver:EvaluationResolver` — evaluate a grounded term at a given Witt level; the returned cert attests that the evaluation completed within the declared budget.
    /// Returns `Certified<GroundingCertificate>` on success carrying the Witt
    /// level and a consumer-hasher-computed substrate fingerprint that uniquely
    /// identifies the input. `Certified<GenericImpossibilityWitness>` on
    /// failure — the witness itself is certified so downstream can persist it
    /// alongside success certs in a uniform `Certified<_>` channel.
    /// Phase X.1: the produced cert class is the ontology-declared class for
    /// this resolver's `resolver:CertifyMapping`. Eight cert subclasses —
    /// `TransformCertificate`, `IsometryCertificate`, `InvolutionCertificate`,
    /// `CompletenessCertificate`, `GeodesicCertificate`, `MeasurementCertificate`,
    /// `BornRuleVerification`, and `GroundingCertificate` — are minted across the 17 Phase D
    /// kernels so each resolver's class discrimination is load-bearing.
    /// v0.2.2 Phase J: `certify_at` composes an ontology primitive (per the
    /// kernel's composition spec) whose output is folded into the canonical
    /// fingerprint ahead of `fold_unit_digest`, so distinct primitive outputs
    /// yield distinct fingerprints — i.e., each kernel's decision is real and
    /// content-addressed per its ontology class.
    pub mod evaluation {
        use super::*;

        #[doc(hidden)]
        pub struct Kernel;
        impl super::ResolverKernel for Kernel {
            type Cert = crate::enforcement::GroundingCertificate;
            const KIND: crate::enforcement::CertificateKind =
                crate::enforcement::CertificateKind::Evaluation;
        }

        /// Phase D (target §4.2): certify at the canonical `WittLevel::W32`.
        ///
        /// # Errors
        ///
        /// Returns `Certified<GenericImpossibilityWitness>` on failure.
        pub fn certify<
            T: crate::pipeline::ConstrainedTypeShape,
            P: crate::enforcement::ValidationPhase,
            H: crate::enforcement::Hasher,
        >(
            input: &Validated<T, P>,
        ) -> Result<Certified<GroundingCertificate>, Certified<GenericImpossibilityWitness>>
        {
            certify_at::<T, P, H>(input, WittLevel::W32)
        }

        /// Phase D (target §4.2): certify at an explicit Witt level.
        ///
        /// # Errors
        ///
        /// Returns `Certified<GenericImpossibilityWitness>` on failure.
        pub fn certify_at<
            T: crate::pipeline::ConstrainedTypeShape,
            P: crate::enforcement::ValidationPhase,
            H: crate::enforcement::Hasher,
        >(
            input: &Validated<T, P>,
            level: WittLevel,
        ) -> Result<Certified<GroundingCertificate>, Certified<GenericImpossibilityWitness>>
        {
            let _ = input.inner();
            let witt_bits = level.witt_length() as u16;
            let (tr_bits, tr_constraints, tr_sat) =
                crate::enforcement::primitive_terminal_reduction::<T>(witt_bits)
                    .map_err(|_| Certified::new(GenericImpossibilityWitness::default()))?;
            if tr_sat == 0 {
                return Err(Certified::new(GenericImpossibilityWitness::default()));
            }
            let mut hasher = H::initial();
            hasher = crate::enforcement::fold_terminal_reduction(
                hasher,
                tr_bits,
                tr_constraints,
                tr_sat,
            );
            hasher = crate::enforcement::fold_unit_digest(
                hasher,
                witt_bits,
                witt_bits as u64,
                T::IRI,
                T::SITE_COUNT,
                T::CONSTRAINTS,
                <Kernel as super::ResolverKernel>::KIND,
            );
            let buffer = hasher.finalize();
            let fp =
                crate::enforcement::ContentFingerprint::from_buffer(buffer, H::OUTPUT_BYTES as u8);
            let cert = <<Kernel as super::ResolverKernel>::Cert as crate::enforcement::certify_const_mint::MintWithLevelFingerprint>::mint_with_level_fingerprint(witt_bits, fp);
            Ok(Certified::new(cert))
        }
    }

    /// Phase D (target §4.2): `resolver:SessionResolver` — advance a lease-scoped `state:ContextLease` by one reduction step and emit a cert over the lease's resulting BindingsTable.
    /// Returns `Certified<GroundingCertificate>` on success carrying the Witt
    /// level and a consumer-hasher-computed substrate fingerprint that uniquely
    /// identifies the input. `Certified<GenericImpossibilityWitness>` on
    /// failure — the witness itself is certified so downstream can persist it
    /// alongside success certs in a uniform `Certified<_>` channel.
    /// Phase X.1: the produced cert class is the ontology-declared class for
    /// this resolver's `resolver:CertifyMapping`. Eight cert subclasses —
    /// `TransformCertificate`, `IsometryCertificate`, `InvolutionCertificate`,
    /// `CompletenessCertificate`, `GeodesicCertificate`, `MeasurementCertificate`,
    /// `BornRuleVerification`, and `GroundingCertificate` — are minted across the 17 Phase D
    /// kernels so each resolver's class discrimination is load-bearing.
    /// v0.2.2 Phase J: `certify_at` composes an ontology primitive (per the
    /// kernel's composition spec) whose output is folded into the canonical
    /// fingerprint ahead of `fold_unit_digest`, so distinct primitive outputs
    /// yield distinct fingerprints — i.e., each kernel's decision is real and
    /// content-addressed per its ontology class.
    pub mod session {
        use super::*;

        #[doc(hidden)]
        pub struct Kernel;
        impl super::ResolverKernel for Kernel {
            type Cert = crate::enforcement::GroundingCertificate;
            const KIND: crate::enforcement::CertificateKind =
                crate::enforcement::CertificateKind::Session;
        }

        /// Phase D (target §4.2): certify at the canonical `WittLevel::W32`.
        ///
        /// # Errors
        ///
        /// Returns `Certified<GenericImpossibilityWitness>` on failure.
        pub fn certify<P: crate::enforcement::ValidationPhase, H: crate::enforcement::Hasher>(
            input: &Validated<CompileUnit, P>,
        ) -> Result<Certified<GroundingCertificate>, Certified<GenericImpossibilityWitness>>
        {
            certify_at::<P, H>(input, WittLevel::W32)
        }

        /// Phase D (target §4.2): certify at an explicit Witt level.
        ///
        /// # Errors
        ///
        /// Returns `Certified<GenericImpossibilityWitness>` on failure.
        pub fn certify_at<P: crate::enforcement::ValidationPhase, H: crate::enforcement::Hasher>(
            input: &Validated<CompileUnit, P>,
            level: WittLevel,
        ) -> Result<Certified<GroundingCertificate>, Certified<GenericImpossibilityWitness>>
        {
            let unit = input.inner();
            let witt_bits = level.witt_length() as u16;
            let budget = unit.thermodynamic_budget();
            let result_type_iri = unit.result_type_iri();
            let mut hasher = H::initial();
            let (binding_count, fold_addr) =
                crate::enforcement::primitive_session_binding_signature(unit.bindings());
            hasher = crate::enforcement::fold_session_signature(hasher, binding_count, fold_addr);
            hasher = crate::enforcement::fold_unit_digest(
                hasher,
                witt_bits,
                budget,
                result_type_iri,
                0usize,
                &[],
                <Kernel as super::ResolverKernel>::KIND,
            );
            let buffer = hasher.finalize();
            let fp =
                crate::enforcement::ContentFingerprint::from_buffer(buffer, H::OUTPUT_BYTES as u8);
            let cert = <<Kernel as super::ResolverKernel>::Cert as crate::enforcement::certify_const_mint::MintWithLevelFingerprint>::mint_with_level_fingerprint(witt_bits, fp);
            Ok(Certified::new(cert))
        }
    }

    /// Phase D (target §4.2): `resolver:SuperpositionResolver` — advance a SuperpositionResolver across a ψ-pipeline branch tree, maintaining an amplitude vector that satisfies the Born-rule normalization constraint (Σ|αᵢ|² = 1).
    /// Returns `Certified<BornRuleVerification>` on success carrying the Witt
    /// level and a consumer-hasher-computed substrate fingerprint that uniquely
    /// identifies the input. `Certified<GenericImpossibilityWitness>` on
    /// failure — the witness itself is certified so downstream can persist it
    /// alongside success certs in a uniform `Certified<_>` channel.
    /// Phase X.1: the produced cert class is the ontology-declared class for
    /// this resolver's `resolver:CertifyMapping`. Eight cert subclasses —
    /// `TransformCertificate`, `IsometryCertificate`, `InvolutionCertificate`,
    /// `CompletenessCertificate`, `GeodesicCertificate`, `MeasurementCertificate`,
    /// `BornRuleVerification`, and `GroundingCertificate` — are minted across the 17 Phase D
    /// kernels so each resolver's class discrimination is load-bearing.
    /// v0.2.2 Phase J: `certify_at` composes an ontology primitive (per the
    /// kernel's composition spec) whose output is folded into the canonical
    /// fingerprint ahead of `fold_unit_digest`, so distinct primitive outputs
    /// yield distinct fingerprints — i.e., each kernel's decision is real and
    /// content-addressed per its ontology class.
    pub mod superposition {
        use super::*;

        #[doc(hidden)]
        pub struct Kernel;
        impl super::ResolverKernel for Kernel {
            type Cert = crate::enforcement::BornRuleVerification;
            const KIND: crate::enforcement::CertificateKind =
                crate::enforcement::CertificateKind::Superposition;
        }

        /// Phase D (target §4.2): certify at the canonical `WittLevel::W32`.
        ///
        /// # Errors
        ///
        /// Returns `Certified<GenericImpossibilityWitness>` on failure.
        pub fn certify<P: crate::enforcement::ValidationPhase, H: crate::enforcement::Hasher>(
            input: &Validated<CompileUnit, P>,
        ) -> Result<Certified<BornRuleVerification>, Certified<GenericImpossibilityWitness>>
        {
            certify_at::<P, H>(input, WittLevel::W32)
        }

        /// Phase D (target §4.2): certify at an explicit Witt level.
        ///
        /// # Errors
        ///
        /// Returns `Certified<GenericImpossibilityWitness>` on failure.
        pub fn certify_at<P: crate::enforcement::ValidationPhase, H: crate::enforcement::Hasher>(
            input: &Validated<CompileUnit, P>,
            level: WittLevel,
        ) -> Result<Certified<BornRuleVerification>, Certified<GenericImpossibilityWitness>>
        {
            let unit = input.inner();
            let witt_bits = level.witt_length() as u16;
            let budget = unit.thermodynamic_budget();
            let result_type_iri = unit.result_type_iri();
            let mut hasher = H::initial();
            let (binding_count, fold_addr) =
                crate::enforcement::primitive_session_binding_signature(unit.bindings());
            hasher = crate::enforcement::fold_session_signature(hasher, binding_count, fold_addr);
            let (outcome_index, probability) =
                crate::enforcement::primitive_measurement_projection(budget);
            hasher = crate::enforcement::fold_born_outcome(hasher, outcome_index, probability);
            hasher = crate::enforcement::fold_unit_digest(
                hasher,
                witt_bits,
                budget,
                result_type_iri,
                0usize,
                &[],
                <Kernel as super::ResolverKernel>::KIND,
            );
            let buffer = hasher.finalize();
            let fp =
                crate::enforcement::ContentFingerprint::from_buffer(buffer, H::OUTPUT_BYTES as u8);
            let cert = <<Kernel as super::ResolverKernel>::Cert as crate::enforcement::certify_const_mint::MintWithLevelFingerprint>::mint_with_level_fingerprint(witt_bits, fp);
            Ok(Certified::new(cert))
        }
    }

    /// Phase D (target §4.2): `resolver:MeasurementResolver` — resolve a `trace:MeasurementEvent` against the von Neumann-Landauer bridge (QM_1): `preCollapseEntropy = postCollapseLandauerCost` at β* = ln 2.
    /// Returns `Certified<MeasurementCertificate>` on success carrying the Witt
    /// level and a consumer-hasher-computed substrate fingerprint that uniquely
    /// identifies the input. `Certified<GenericImpossibilityWitness>` on
    /// failure — the witness itself is certified so downstream can persist it
    /// alongside success certs in a uniform `Certified<_>` channel.
    /// Phase X.1: the produced cert class is the ontology-declared class for
    /// this resolver's `resolver:CertifyMapping`. Eight cert subclasses —
    /// `TransformCertificate`, `IsometryCertificate`, `InvolutionCertificate`,
    /// `CompletenessCertificate`, `GeodesicCertificate`, `MeasurementCertificate`,
    /// `BornRuleVerification`, and `GroundingCertificate` — are minted across the 17 Phase D
    /// kernels so each resolver's class discrimination is load-bearing.
    /// v0.2.2 Phase J: `certify_at` composes an ontology primitive (per the
    /// kernel's composition spec) whose output is folded into the canonical
    /// fingerprint ahead of `fold_unit_digest`, so distinct primitive outputs
    /// yield distinct fingerprints — i.e., each kernel's decision is real and
    /// content-addressed per its ontology class.
    pub mod measurement {
        use super::*;

        #[doc(hidden)]
        pub struct Kernel;
        impl super::ResolverKernel for Kernel {
            type Cert = crate::enforcement::MeasurementCertificate;
            const KIND: crate::enforcement::CertificateKind =
                crate::enforcement::CertificateKind::Measurement;
        }

        /// Phase D (target §4.2): certify at the canonical `WittLevel::W32`.
        ///
        /// # Errors
        ///
        /// Returns `Certified<GenericImpossibilityWitness>` on failure.
        pub fn certify<P: crate::enforcement::ValidationPhase, H: crate::enforcement::Hasher>(
            input: &Validated<CompileUnit, P>,
        ) -> Result<Certified<MeasurementCertificate>, Certified<GenericImpossibilityWitness>>
        {
            certify_at::<P, H>(input, WittLevel::W32)
        }

        /// Phase D (target §4.2): certify at an explicit Witt level.
        ///
        /// # Errors
        ///
        /// Returns `Certified<GenericImpossibilityWitness>` on failure.
        pub fn certify_at<P: crate::enforcement::ValidationPhase, H: crate::enforcement::Hasher>(
            input: &Validated<CompileUnit, P>,
            level: WittLevel,
        ) -> Result<Certified<MeasurementCertificate>, Certified<GenericImpossibilityWitness>>
        {
            let unit = input.inner();
            let witt_bits = level.witt_length() as u16;
            let budget = unit.thermodynamic_budget();
            let result_type_iri = unit.result_type_iri();
            let mut hasher = H::initial();
            let (outcome_index, probability) =
                crate::enforcement::primitive_measurement_projection(budget);
            hasher = crate::enforcement::fold_born_outcome(hasher, outcome_index, probability);
            hasher = crate::enforcement::fold_unit_digest(
                hasher,
                witt_bits,
                budget,
                result_type_iri,
                0usize,
                &[],
                <Kernel as super::ResolverKernel>::KIND,
            );
            let buffer = hasher.finalize();
            let fp =
                crate::enforcement::ContentFingerprint::from_buffer(buffer, H::OUTPUT_BYTES as u8);
            let cert = <<Kernel as super::ResolverKernel>::Cert as crate::enforcement::certify_const_mint::MintWithLevelFingerprint>::mint_with_level_fingerprint(witt_bits, fp);
            Ok(Certified::new(cert))
        }
    }

    /// Phase D (target §4.2): `resolver:WittLevelResolver` — given a WittLevel declaration, validate the (bit_width, cycle_size) pair satisfies `conformance:WittLevelShape` and emit a cert over the normalized level.
    /// Returns `Certified<GroundingCertificate>` on success carrying the Witt
    /// level and a consumer-hasher-computed substrate fingerprint that uniquely
    /// identifies the input. `Certified<GenericImpossibilityWitness>` on
    /// failure — the witness itself is certified so downstream can persist it
    /// alongside success certs in a uniform `Certified<_>` channel.
    /// Phase X.1: the produced cert class is the ontology-declared class for
    /// this resolver's `resolver:CertifyMapping`. Eight cert subclasses —
    /// `TransformCertificate`, `IsometryCertificate`, `InvolutionCertificate`,
    /// `CompletenessCertificate`, `GeodesicCertificate`, `MeasurementCertificate`,
    /// `BornRuleVerification`, and `GroundingCertificate` — are minted across the 17 Phase D
    /// kernels so each resolver's class discrimination is load-bearing.
    /// v0.2.2 Phase J: `certify_at` composes an ontology primitive (per the
    /// kernel's composition spec) whose output is folded into the canonical
    /// fingerprint ahead of `fold_unit_digest`, so distinct primitive outputs
    /// yield distinct fingerprints — i.e., each kernel's decision is real and
    /// content-addressed per its ontology class.
    pub mod witt_level_resolver {
        use super::*;

        #[doc(hidden)]
        pub struct Kernel;
        impl super::ResolverKernel for Kernel {
            type Cert = crate::enforcement::GroundingCertificate;
            const KIND: crate::enforcement::CertificateKind =
                crate::enforcement::CertificateKind::WittLevel;
        }

        /// Phase D (target §4.2): certify at the canonical `WittLevel::W32`.
        ///
        /// # Errors
        ///
        /// Returns `Certified<GenericImpossibilityWitness>` on failure.
        pub fn certify<P: crate::enforcement::ValidationPhase, H: crate::enforcement::Hasher>(
            input: &Validated<CompileUnit, P>,
        ) -> Result<Certified<GroundingCertificate>, Certified<GenericImpossibilityWitness>>
        {
            certify_at::<P, H>(input, WittLevel::W32)
        }

        /// Phase D (target §4.2): certify at an explicit Witt level.
        ///
        /// # Errors
        ///
        /// Returns `Certified<GenericImpossibilityWitness>` on failure.
        pub fn certify_at<P: crate::enforcement::ValidationPhase, H: crate::enforcement::Hasher>(
            input: &Validated<CompileUnit, P>,
            level: WittLevel,
        ) -> Result<Certified<GroundingCertificate>, Certified<GenericImpossibilityWitness>>
        {
            let unit = input.inner();
            let witt_bits = level.witt_length() as u16;
            let budget = unit.thermodynamic_budget();
            let result_type_iri = unit.result_type_iri();
            let mut hasher = H::initial();
            hasher = hasher.fold_bytes(&witt_bits.to_be_bytes());
            let declared_level_bits = unit.witt_level().witt_length() as u16;
            hasher = hasher.fold_bytes(&declared_level_bits.to_be_bytes());
            hasher = crate::enforcement::fold_unit_digest(
                hasher,
                witt_bits,
                budget,
                result_type_iri,
                0usize,
                &[],
                <Kernel as super::ResolverKernel>::KIND,
            );
            let buffer = hasher.finalize();
            let fp =
                crate::enforcement::ContentFingerprint::from_buffer(buffer, H::OUTPUT_BYTES as u8);
            let cert = <<Kernel as super::ResolverKernel>::Cert as crate::enforcement::certify_const_mint::MintWithLevelFingerprint>::mint_with_level_fingerprint(witt_bits, fp);
            Ok(Certified::new(cert))
        }
    }

    /// Phase D (target §4.2): `resolver:DihedralFactorizationResolver` — run the dihedral factorization decider on a `ConstrainedType`'s carrier, producing a cert over the factor structure.
    /// Returns `Certified<InvolutionCertificate>` on success carrying the Witt
    /// level and a consumer-hasher-computed substrate fingerprint that uniquely
    /// identifies the input. `Certified<GenericImpossibilityWitness>` on
    /// failure — the witness itself is certified so downstream can persist it
    /// alongside success certs in a uniform `Certified<_>` channel.
    /// Phase X.1: the produced cert class is the ontology-declared class for
    /// this resolver's `resolver:CertifyMapping`. Eight cert subclasses —
    /// `TransformCertificate`, `IsometryCertificate`, `InvolutionCertificate`,
    /// `CompletenessCertificate`, `GeodesicCertificate`, `MeasurementCertificate`,
    /// `BornRuleVerification`, and `GroundingCertificate` — are minted across the 17 Phase D
    /// kernels so each resolver's class discrimination is load-bearing.
    /// v0.2.2 Phase J: `certify_at` composes an ontology primitive (per the
    /// kernel's composition spec) whose output is folded into the canonical
    /// fingerprint ahead of `fold_unit_digest`, so distinct primitive outputs
    /// yield distinct fingerprints — i.e., each kernel's decision is real and
    /// content-addressed per its ontology class.
    pub mod dihedral_factorization {
        use super::*;

        #[doc(hidden)]
        pub struct Kernel;
        impl super::ResolverKernel for Kernel {
            type Cert = crate::enforcement::InvolutionCertificate;
            const KIND: crate::enforcement::CertificateKind =
                crate::enforcement::CertificateKind::DihedralFactorization;
        }

        /// Phase D (target §4.2): certify at the canonical `WittLevel::W32`.
        ///
        /// # Errors
        ///
        /// Returns `Certified<GenericImpossibilityWitness>` on failure.
        pub fn certify<
            T: crate::pipeline::ConstrainedTypeShape,
            P: crate::enforcement::ValidationPhase,
            H: crate::enforcement::Hasher,
        >(
            input: &Validated<T, P>,
        ) -> Result<Certified<InvolutionCertificate>, Certified<GenericImpossibilityWitness>>
        {
            certify_at::<T, P, H>(input, WittLevel::W32)
        }

        /// Phase D (target §4.2): certify at an explicit Witt level.
        ///
        /// # Errors
        ///
        /// Returns `Certified<GenericImpossibilityWitness>` on failure.
        pub fn certify_at<
            T: crate::pipeline::ConstrainedTypeShape,
            P: crate::enforcement::ValidationPhase,
            H: crate::enforcement::Hasher,
        >(
            input: &Validated<T, P>,
            level: WittLevel,
        ) -> Result<Certified<InvolutionCertificate>, Certified<GenericImpossibilityWitness>>
        {
            let _ = input.inner();
            let witt_bits = level.witt_length() as u16;
            let (tr_bits, tr_constraints, tr_sat) =
                crate::enforcement::primitive_terminal_reduction::<T>(witt_bits)
                    .map_err(|_| Certified::new(GenericImpossibilityWitness::default()))?;
            if tr_sat == 0 {
                return Err(Certified::new(GenericImpossibilityWitness::default()));
            }
            let mut hasher = H::initial();
            hasher = crate::enforcement::fold_terminal_reduction(
                hasher,
                tr_bits,
                tr_constraints,
                tr_sat,
            );
            let (orbit_size, representative) =
                crate::enforcement::primitive_dihedral_signature::<T>();
            hasher =
                crate::enforcement::fold_dihedral_signature(hasher, orbit_size, representative);
            hasher = crate::enforcement::fold_unit_digest(
                hasher,
                witt_bits,
                witt_bits as u64,
                T::IRI,
                T::SITE_COUNT,
                T::CONSTRAINTS,
                <Kernel as super::ResolverKernel>::KIND,
            );
            let buffer = hasher.finalize();
            let fp =
                crate::enforcement::ContentFingerprint::from_buffer(buffer, H::OUTPUT_BYTES as u8);
            let cert = <<Kernel as super::ResolverKernel>::Cert as crate::enforcement::certify_const_mint::MintWithLevelFingerprint>::mint_with_level_fingerprint(witt_bits, fp);
            Ok(Certified::new(cert))
        }
    }

    /// Phase D (target §4.2): `resolver:CompletenessResolver` — generic completeness-loop resolver: runs the ψ-pipeline without the tower-specific lift chain and emits a cert if the input's constraint nerve has Euler characteristic n at quantum level n.
    /// Returns `Certified<CompletenessCertificate>` on success carrying the Witt
    /// level and a consumer-hasher-computed substrate fingerprint that uniquely
    /// identifies the input. `Certified<GenericImpossibilityWitness>` on
    /// failure — the witness itself is certified so downstream can persist it
    /// alongside success certs in a uniform `Certified<_>` channel.
    /// Phase X.1: the produced cert class is the ontology-declared class for
    /// this resolver's `resolver:CertifyMapping`. Eight cert subclasses —
    /// `TransformCertificate`, `IsometryCertificate`, `InvolutionCertificate`,
    /// `CompletenessCertificate`, `GeodesicCertificate`, `MeasurementCertificate`,
    /// `BornRuleVerification`, and `GroundingCertificate` — are minted across the 17 Phase D
    /// kernels so each resolver's class discrimination is load-bearing.
    /// v0.2.2 Phase J: `certify_at` composes an ontology primitive (per the
    /// kernel's composition spec) whose output is folded into the canonical
    /// fingerprint ahead of `fold_unit_digest`, so distinct primitive outputs
    /// yield distinct fingerprints — i.e., each kernel's decision is real and
    /// content-addressed per its ontology class.
    pub mod completeness {
        use super::*;

        #[doc(hidden)]
        pub struct Kernel;
        impl super::ResolverKernel for Kernel {
            type Cert = crate::enforcement::CompletenessCertificate;
            const KIND: crate::enforcement::CertificateKind =
                crate::enforcement::CertificateKind::Completeness;
        }

        /// Phase D (target §4.2): certify at the canonical `WittLevel::W32`.
        ///
        /// # Errors
        ///
        /// Returns `Certified<GenericImpossibilityWitness>` on failure.
        pub fn certify<
            T: crate::pipeline::ConstrainedTypeShape,
            P: crate::enforcement::ValidationPhase,
            H: crate::enforcement::Hasher,
        >(
            input: &Validated<T, P>,
        ) -> Result<Certified<CompletenessCertificate>, Certified<GenericImpossibilityWitness>>
        {
            certify_at::<T, P, H>(input, WittLevel::W32)
        }

        /// Phase D (target §4.2): certify at an explicit Witt level.
        ///
        /// # Errors
        ///
        /// Returns `Certified<GenericImpossibilityWitness>` on failure.
        pub fn certify_at<
            T: crate::pipeline::ConstrainedTypeShape,
            P: crate::enforcement::ValidationPhase,
            H: crate::enforcement::Hasher,
        >(
            input: &Validated<T, P>,
            level: WittLevel,
        ) -> Result<Certified<CompletenessCertificate>, Certified<GenericImpossibilityWitness>>
        {
            let _ = input.inner();
            let witt_bits = level.witt_length() as u16;
            let (tr_bits, tr_constraints, tr_sat) =
                crate::enforcement::primitive_terminal_reduction::<T>(witt_bits)
                    .map_err(|_| Certified::new(GenericImpossibilityWitness::default()))?;
            if tr_sat == 0 {
                return Err(Certified::new(GenericImpossibilityWitness::default()));
            }
            let mut hasher = H::initial();
            hasher = crate::enforcement::fold_terminal_reduction(
                hasher,
                tr_bits,
                tr_constraints,
                tr_sat,
            );
            let betti = crate::enforcement::primitive_simplicial_nerve_betti::<T>()
                .map_err(crate::enforcement::Certified::new)?;
            let chi = crate::enforcement::primitive_euler_characteristic(&betti);
            hasher = crate::enforcement::fold_betti_tuple(hasher, &betti);
            hasher = hasher.fold_bytes(&chi.to_be_bytes());
            hasher = crate::enforcement::fold_unit_digest(
                hasher,
                witt_bits,
                witt_bits as u64,
                T::IRI,
                T::SITE_COUNT,
                T::CONSTRAINTS,
                <Kernel as super::ResolverKernel>::KIND,
            );
            let buffer = hasher.finalize();
            let fp =
                crate::enforcement::ContentFingerprint::from_buffer(buffer, H::OUTPUT_BYTES as u8);
            let cert = <<Kernel as super::ResolverKernel>::Cert as crate::enforcement::certify_const_mint::MintWithLevelFingerprint>::mint_with_level_fingerprint(witt_bits, fp);
            Ok(Certified::new(cert))
        }
    }

    /// Phase D (target §4.2): `resolver:GeodesicValidator` — validate whether a `trace:ComputationTrace` satisfies the dual geodesic condition (AR_1-ordered and DC_10-selected); produces a `GeodesicCertificate` on success, `GenericImpossibilityWitness` otherwise.
    /// Returns `Certified<GeodesicCertificate>` on success carrying the Witt
    /// level and a consumer-hasher-computed substrate fingerprint that uniquely
    /// identifies the input. `Certified<GenericImpossibilityWitness>` on
    /// failure — the witness itself is certified so downstream can persist it
    /// alongside success certs in a uniform `Certified<_>` channel.
    /// Phase X.1: the produced cert class is the ontology-declared class for
    /// this resolver's `resolver:CertifyMapping`. Eight cert subclasses —
    /// `TransformCertificate`, `IsometryCertificate`, `InvolutionCertificate`,
    /// `CompletenessCertificate`, `GeodesicCertificate`, `MeasurementCertificate`,
    /// `BornRuleVerification`, and `GroundingCertificate` — are minted across the 17 Phase D
    /// kernels so each resolver's class discrimination is load-bearing.
    /// v0.2.2 Phase J: `certify_at` composes an ontology primitive (per the
    /// kernel's composition spec) whose output is folded into the canonical
    /// fingerprint ahead of `fold_unit_digest`, so distinct primitive outputs
    /// yield distinct fingerprints — i.e., each kernel's decision is real and
    /// content-addressed per its ontology class.
    pub mod geodesic_validator {
        use super::*;

        #[doc(hidden)]
        pub struct Kernel;
        impl super::ResolverKernel for Kernel {
            type Cert = crate::enforcement::GeodesicCertificate;
            const KIND: crate::enforcement::CertificateKind =
                crate::enforcement::CertificateKind::GeodesicValidator;
        }

        /// Phase D (target §4.2): certify at the canonical `WittLevel::W32`.
        ///
        /// # Errors
        ///
        /// Returns `Certified<GenericImpossibilityWitness>` on failure.
        pub fn certify<
            T: crate::pipeline::ConstrainedTypeShape,
            P: crate::enforcement::ValidationPhase,
            H: crate::enforcement::Hasher,
        >(
            input: &Validated<T, P>,
        ) -> Result<Certified<GeodesicCertificate>, Certified<GenericImpossibilityWitness>>
        {
            certify_at::<T, P, H>(input, WittLevel::W32)
        }

        /// Phase D (target §4.2): certify at an explicit Witt level.
        ///
        /// # Errors
        ///
        /// Returns `Certified<GenericImpossibilityWitness>` on failure.
        pub fn certify_at<
            T: crate::pipeline::ConstrainedTypeShape,
            P: crate::enforcement::ValidationPhase,
            H: crate::enforcement::Hasher,
        >(
            input: &Validated<T, P>,
            level: WittLevel,
        ) -> Result<Certified<GeodesicCertificate>, Certified<GenericImpossibilityWitness>>
        {
            let _ = input.inner();
            let witt_bits = level.witt_length() as u16;
            let (tr_bits, tr_constraints, tr_sat) =
                crate::enforcement::primitive_terminal_reduction::<T>(witt_bits)
                    .map_err(|_| Certified::new(GenericImpossibilityWitness::default()))?;
            if tr_sat == 0 {
                return Err(Certified::new(GenericImpossibilityWitness::default()));
            }
            let mut hasher = H::initial();
            hasher = crate::enforcement::fold_terminal_reduction(
                hasher,
                tr_bits,
                tr_constraints,
                tr_sat,
            );
            let jac = crate::enforcement::primitive_curvature_jacobian::<T>();
            hasher = crate::enforcement::fold_jacobian_profile(hasher, &jac);
            let selected_site = crate::enforcement::primitive_dc10_select(&jac);
            hasher = hasher.fold_bytes(&(selected_site as u32).to_be_bytes());
            hasher = crate::enforcement::fold_unit_digest(
                hasher,
                witt_bits,
                witt_bits as u64,
                T::IRI,
                T::SITE_COUNT,
                T::CONSTRAINTS,
                <Kernel as super::ResolverKernel>::KIND,
            );
            let buffer = hasher.finalize();
            let fp =
                crate::enforcement::ContentFingerprint::from_buffer(buffer, H::OUTPUT_BYTES as u8);
            let cert = <<Kernel as super::ResolverKernel>::Cert as crate::enforcement::certify_const_mint::MintWithLevelFingerprint>::mint_with_level_fingerprint(witt_bits, fp);
            Ok(Certified::new(cert))
        }
    }
}

/// v0.2.2 phantom-typed ring operation surface. Each phantom struct binds a
/// `WittLevel` at the type level so consumers can write
/// `Mul::<W8>::apply(a, b)` for compile-time level-checked arithmetic.
pub trait RingOp<L> {
    /// Operand type at this level.
    type Operand;
    /// Apply this binary ring op.
    fn apply(a: Self::Operand, b: Self::Operand) -> Self::Operand;
}

/// v0.2.2 W3: unary phantom-typed ring operation surface. Mirrors `RingOp`
/// for arity-1 operations (`Neg`, `BNot`, `Succ`) so consumers can write
/// `Neg::<W8>::apply(a)` for compile-time level-checked unary arithmetic.
pub trait UnaryRingOp<L> {
    /// Operand type at this level.
    type Operand;
    /// Apply this unary ring op.
    fn apply(a: Self::Operand) -> Self::Operand;
}

/// Multiplicative ring op. phantom-typed at level `L`.
#[derive(Debug, Default, Clone, Copy)]
pub struct Mul<L>(PhantomData<L>);

/// Additive ring op. phantom-typed at level `L`.
#[derive(Debug, Default, Clone, Copy)]
pub struct Add<L>(PhantomData<L>);

/// Subtractive ring op. phantom-typed at level `L`.
#[derive(Debug, Default, Clone, Copy)]
pub struct Sub<L>(PhantomData<L>);

/// Bitwise XOR ring op. phantom-typed at level `L`.
#[derive(Debug, Default, Clone, Copy)]
pub struct Xor<L>(PhantomData<L>);

/// Bitwise AND ring op. phantom-typed at level `L`.
#[derive(Debug, Default, Clone, Copy)]
pub struct And<L>(PhantomData<L>);

/// Bitwise OR ring op. phantom-typed at level `L`.
#[derive(Debug, Default, Clone, Copy)]
pub struct Or<L>(PhantomData<L>);

/// Ring negation (the canonical involution: x → -x). Phantom-typed at level `L` (v0.2.2 W3).
#[derive(Debug, Default, Clone, Copy)]
pub struct Neg<L>(PhantomData<L>);

/// Bitwise NOT (the Hamming involution: x → (2^n - 1) XOR x). Phantom-typed at level `L` (v0.2.2 W3).
#[derive(Debug, Default, Clone, Copy)]
pub struct BNot<L>(PhantomData<L>);

/// Successor (= Neg ∘ BNot per the critical composition law). Phantom-typed at level `L` (v0.2.2 W3).
#[derive(Debug, Default, Clone, Copy)]
pub struct Succ<L>(PhantomData<L>);

/// W8 marker — 8-bit Witt level reified at the type level.
#[derive(Debug, Default, Clone, Copy)]
pub struct W8;

/// W16 marker — 16-bit Witt level reified at the type level.
#[derive(Debug, Default, Clone, Copy)]
pub struct W16;

/// W24 marker — 24-bit Witt level reified at the type level.
#[derive(Debug, Default, Clone, Copy)]
pub struct W24;

/// W32 marker — 32-bit Witt level reified at the type level.
#[derive(Debug, Default, Clone, Copy)]
pub struct W32;

/// W40 marker — 40-bit Witt level reified at the type level.
#[derive(Debug, Default, Clone, Copy)]
pub struct W40;

/// W48 marker — 48-bit Witt level reified at the type level.
#[derive(Debug, Default, Clone, Copy)]
pub struct W48;

/// W56 marker — 56-bit Witt level reified at the type level.
#[derive(Debug, Default, Clone, Copy)]
pub struct W56;

/// W64 marker — 64-bit Witt level reified at the type level.
#[derive(Debug, Default, Clone, Copy)]
pub struct W64;

/// W72 marker — 72-bit Witt level reified at the type level.
#[derive(Debug, Default, Clone, Copy)]
pub struct W72;

/// W80 marker — 80-bit Witt level reified at the type level.
#[derive(Debug, Default, Clone, Copy)]
pub struct W80;

/// W88 marker — 88-bit Witt level reified at the type level.
#[derive(Debug, Default, Clone, Copy)]
pub struct W88;

/// W96 marker — 96-bit Witt level reified at the type level.
#[derive(Debug, Default, Clone, Copy)]
pub struct W96;

/// W104 marker — 104-bit Witt level reified at the type level.
#[derive(Debug, Default, Clone, Copy)]
pub struct W104;

/// W112 marker — 112-bit Witt level reified at the type level.
#[derive(Debug, Default, Clone, Copy)]
pub struct W112;

/// W120 marker — 120-bit Witt level reified at the type level.
#[derive(Debug, Default, Clone, Copy)]
pub struct W120;

/// W128 marker — 128-bit Witt level reified at the type level.
#[derive(Debug, Default, Clone, Copy)]
pub struct W128;

impl RingOp<W8> for Mul<W8> {
    type Operand = u8;
    #[inline]
    fn apply(a: u8, b: u8) -> u8 {
        const_ring_eval_w8(PrimitiveOp::Mul, a, b)
    }
}

impl RingOp<W8> for Add<W8> {
    type Operand = u8;
    #[inline]
    fn apply(a: u8, b: u8) -> u8 {
        const_ring_eval_w8(PrimitiveOp::Add, a, b)
    }
}

impl RingOp<W8> for Sub<W8> {
    type Operand = u8;
    #[inline]
    fn apply(a: u8, b: u8) -> u8 {
        const_ring_eval_w8(PrimitiveOp::Sub, a, b)
    }
}

impl RingOp<W8> for Xor<W8> {
    type Operand = u8;
    #[inline]
    fn apply(a: u8, b: u8) -> u8 {
        const_ring_eval_w8(PrimitiveOp::Xor, a, b)
    }
}

impl RingOp<W8> for And<W8> {
    type Operand = u8;
    #[inline]
    fn apply(a: u8, b: u8) -> u8 {
        const_ring_eval_w8(PrimitiveOp::And, a, b)
    }
}

impl RingOp<W8> for Or<W8> {
    type Operand = u8;
    #[inline]
    fn apply(a: u8, b: u8) -> u8 {
        const_ring_eval_w8(PrimitiveOp::Or, a, b)
    }
}

impl RingOp<W16> for Mul<W16> {
    type Operand = u16;
    #[inline]
    fn apply(a: u16, b: u16) -> u16 {
        const_ring_eval_w16(PrimitiveOp::Mul, a, b)
    }
}

impl RingOp<W16> for Add<W16> {
    type Operand = u16;
    #[inline]
    fn apply(a: u16, b: u16) -> u16 {
        const_ring_eval_w16(PrimitiveOp::Add, a, b)
    }
}

impl RingOp<W16> for Sub<W16> {
    type Operand = u16;
    #[inline]
    fn apply(a: u16, b: u16) -> u16 {
        const_ring_eval_w16(PrimitiveOp::Sub, a, b)
    }
}

impl RingOp<W16> for Xor<W16> {
    type Operand = u16;
    #[inline]
    fn apply(a: u16, b: u16) -> u16 {
        const_ring_eval_w16(PrimitiveOp::Xor, a, b)
    }
}

impl RingOp<W16> for And<W16> {
    type Operand = u16;
    #[inline]
    fn apply(a: u16, b: u16) -> u16 {
        const_ring_eval_w16(PrimitiveOp::And, a, b)
    }
}

impl RingOp<W16> for Or<W16> {
    type Operand = u16;
    #[inline]
    fn apply(a: u16, b: u16) -> u16 {
        const_ring_eval_w16(PrimitiveOp::Or, a, b)
    }
}

impl RingOp<W24> for Mul<W24> {
    type Operand = u32;
    #[inline]
    fn apply(a: u32, b: u32) -> u32 {
        const_ring_eval_w24(PrimitiveOp::Mul, a, b)
    }
}

impl RingOp<W24> for Add<W24> {
    type Operand = u32;
    #[inline]
    fn apply(a: u32, b: u32) -> u32 {
        const_ring_eval_w24(PrimitiveOp::Add, a, b)
    }
}

impl RingOp<W24> for Sub<W24> {
    type Operand = u32;
    #[inline]
    fn apply(a: u32, b: u32) -> u32 {
        const_ring_eval_w24(PrimitiveOp::Sub, a, b)
    }
}

impl RingOp<W24> for Xor<W24> {
    type Operand = u32;
    #[inline]
    fn apply(a: u32, b: u32) -> u32 {
        const_ring_eval_w24(PrimitiveOp::Xor, a, b)
    }
}

impl RingOp<W24> for And<W24> {
    type Operand = u32;
    #[inline]
    fn apply(a: u32, b: u32) -> u32 {
        const_ring_eval_w24(PrimitiveOp::And, a, b)
    }
}

impl RingOp<W24> for Or<W24> {
    type Operand = u32;
    #[inline]
    fn apply(a: u32, b: u32) -> u32 {
        const_ring_eval_w24(PrimitiveOp::Or, a, b)
    }
}

impl RingOp<W32> for Mul<W32> {
    type Operand = u32;
    #[inline]
    fn apply(a: u32, b: u32) -> u32 {
        const_ring_eval_w32(PrimitiveOp::Mul, a, b)
    }
}

impl RingOp<W32> for Add<W32> {
    type Operand = u32;
    #[inline]
    fn apply(a: u32, b: u32) -> u32 {
        const_ring_eval_w32(PrimitiveOp::Add, a, b)
    }
}

impl RingOp<W32> for Sub<W32> {
    type Operand = u32;
    #[inline]
    fn apply(a: u32, b: u32) -> u32 {
        const_ring_eval_w32(PrimitiveOp::Sub, a, b)
    }
}

impl RingOp<W32> for Xor<W32> {
    type Operand = u32;
    #[inline]
    fn apply(a: u32, b: u32) -> u32 {
        const_ring_eval_w32(PrimitiveOp::Xor, a, b)
    }
}

impl RingOp<W32> for And<W32> {
    type Operand = u32;
    #[inline]
    fn apply(a: u32, b: u32) -> u32 {
        const_ring_eval_w32(PrimitiveOp::And, a, b)
    }
}

impl RingOp<W32> for Or<W32> {
    type Operand = u32;
    #[inline]
    fn apply(a: u32, b: u32) -> u32 {
        const_ring_eval_w32(PrimitiveOp::Or, a, b)
    }
}

impl RingOp<W40> for Mul<W40> {
    type Operand = u64;
    #[inline]
    fn apply(a: u64, b: u64) -> u64 {
        const_ring_eval_w40(PrimitiveOp::Mul, a, b)
    }
}

impl RingOp<W40> for Add<W40> {
    type Operand = u64;
    #[inline]
    fn apply(a: u64, b: u64) -> u64 {
        const_ring_eval_w40(PrimitiveOp::Add, a, b)
    }
}

impl RingOp<W40> for Sub<W40> {
    type Operand = u64;
    #[inline]
    fn apply(a: u64, b: u64) -> u64 {
        const_ring_eval_w40(PrimitiveOp::Sub, a, b)
    }
}

impl RingOp<W40> for Xor<W40> {
    type Operand = u64;
    #[inline]
    fn apply(a: u64, b: u64) -> u64 {
        const_ring_eval_w40(PrimitiveOp::Xor, a, b)
    }
}

impl RingOp<W40> for And<W40> {
    type Operand = u64;
    #[inline]
    fn apply(a: u64, b: u64) -> u64 {
        const_ring_eval_w40(PrimitiveOp::And, a, b)
    }
}

impl RingOp<W40> for Or<W40> {
    type Operand = u64;
    #[inline]
    fn apply(a: u64, b: u64) -> u64 {
        const_ring_eval_w40(PrimitiveOp::Or, a, b)
    }
}

impl RingOp<W48> for Mul<W48> {
    type Operand = u64;
    #[inline]
    fn apply(a: u64, b: u64) -> u64 {
        const_ring_eval_w48(PrimitiveOp::Mul, a, b)
    }
}

impl RingOp<W48> for Add<W48> {
    type Operand = u64;
    #[inline]
    fn apply(a: u64, b: u64) -> u64 {
        const_ring_eval_w48(PrimitiveOp::Add, a, b)
    }
}

impl RingOp<W48> for Sub<W48> {
    type Operand = u64;
    #[inline]
    fn apply(a: u64, b: u64) -> u64 {
        const_ring_eval_w48(PrimitiveOp::Sub, a, b)
    }
}

impl RingOp<W48> for Xor<W48> {
    type Operand = u64;
    #[inline]
    fn apply(a: u64, b: u64) -> u64 {
        const_ring_eval_w48(PrimitiveOp::Xor, a, b)
    }
}

impl RingOp<W48> for And<W48> {
    type Operand = u64;
    #[inline]
    fn apply(a: u64, b: u64) -> u64 {
        const_ring_eval_w48(PrimitiveOp::And, a, b)
    }
}

impl RingOp<W48> for Or<W48> {
    type Operand = u64;
    #[inline]
    fn apply(a: u64, b: u64) -> u64 {
        const_ring_eval_w48(PrimitiveOp::Or, a, b)
    }
}

impl RingOp<W56> for Mul<W56> {
    type Operand = u64;
    #[inline]
    fn apply(a: u64, b: u64) -> u64 {
        const_ring_eval_w56(PrimitiveOp::Mul, a, b)
    }
}

impl RingOp<W56> for Add<W56> {
    type Operand = u64;
    #[inline]
    fn apply(a: u64, b: u64) -> u64 {
        const_ring_eval_w56(PrimitiveOp::Add, a, b)
    }
}

impl RingOp<W56> for Sub<W56> {
    type Operand = u64;
    #[inline]
    fn apply(a: u64, b: u64) -> u64 {
        const_ring_eval_w56(PrimitiveOp::Sub, a, b)
    }
}

impl RingOp<W56> for Xor<W56> {
    type Operand = u64;
    #[inline]
    fn apply(a: u64, b: u64) -> u64 {
        const_ring_eval_w56(PrimitiveOp::Xor, a, b)
    }
}

impl RingOp<W56> for And<W56> {
    type Operand = u64;
    #[inline]
    fn apply(a: u64, b: u64) -> u64 {
        const_ring_eval_w56(PrimitiveOp::And, a, b)
    }
}

impl RingOp<W56> for Or<W56> {
    type Operand = u64;
    #[inline]
    fn apply(a: u64, b: u64) -> u64 {
        const_ring_eval_w56(PrimitiveOp::Or, a, b)
    }
}

impl RingOp<W64> for Mul<W64> {
    type Operand = u64;
    #[inline]
    fn apply(a: u64, b: u64) -> u64 {
        const_ring_eval_w64(PrimitiveOp::Mul, a, b)
    }
}

impl RingOp<W64> for Add<W64> {
    type Operand = u64;
    #[inline]
    fn apply(a: u64, b: u64) -> u64 {
        const_ring_eval_w64(PrimitiveOp::Add, a, b)
    }
}

impl RingOp<W64> for Sub<W64> {
    type Operand = u64;
    #[inline]
    fn apply(a: u64, b: u64) -> u64 {
        const_ring_eval_w64(PrimitiveOp::Sub, a, b)
    }
}

impl RingOp<W64> for Xor<W64> {
    type Operand = u64;
    #[inline]
    fn apply(a: u64, b: u64) -> u64 {
        const_ring_eval_w64(PrimitiveOp::Xor, a, b)
    }
}

impl RingOp<W64> for And<W64> {
    type Operand = u64;
    #[inline]
    fn apply(a: u64, b: u64) -> u64 {
        const_ring_eval_w64(PrimitiveOp::And, a, b)
    }
}

impl RingOp<W64> for Or<W64> {
    type Operand = u64;
    #[inline]
    fn apply(a: u64, b: u64) -> u64 {
        const_ring_eval_w64(PrimitiveOp::Or, a, b)
    }
}

impl RingOp<W72> for Mul<W72> {
    type Operand = u128;
    #[inline]
    fn apply(a: u128, b: u128) -> u128 {
        const_ring_eval_w72(PrimitiveOp::Mul, a, b)
    }
}

impl RingOp<W72> for Add<W72> {
    type Operand = u128;
    #[inline]
    fn apply(a: u128, b: u128) -> u128 {
        const_ring_eval_w72(PrimitiveOp::Add, a, b)
    }
}

impl RingOp<W72> for Sub<W72> {
    type Operand = u128;
    #[inline]
    fn apply(a: u128, b: u128) -> u128 {
        const_ring_eval_w72(PrimitiveOp::Sub, a, b)
    }
}

impl RingOp<W72> for Xor<W72> {
    type Operand = u128;
    #[inline]
    fn apply(a: u128, b: u128) -> u128 {
        const_ring_eval_w72(PrimitiveOp::Xor, a, b)
    }
}

impl RingOp<W72> for And<W72> {
    type Operand = u128;
    #[inline]
    fn apply(a: u128, b: u128) -> u128 {
        const_ring_eval_w72(PrimitiveOp::And, a, b)
    }
}

impl RingOp<W72> for Or<W72> {
    type Operand = u128;
    #[inline]
    fn apply(a: u128, b: u128) -> u128 {
        const_ring_eval_w72(PrimitiveOp::Or, a, b)
    }
}

impl RingOp<W80> for Mul<W80> {
    type Operand = u128;
    #[inline]
    fn apply(a: u128, b: u128) -> u128 {
        const_ring_eval_w80(PrimitiveOp::Mul, a, b)
    }
}

impl RingOp<W80> for Add<W80> {
    type Operand = u128;
    #[inline]
    fn apply(a: u128, b: u128) -> u128 {
        const_ring_eval_w80(PrimitiveOp::Add, a, b)
    }
}

impl RingOp<W80> for Sub<W80> {
    type Operand = u128;
    #[inline]
    fn apply(a: u128, b: u128) -> u128 {
        const_ring_eval_w80(PrimitiveOp::Sub, a, b)
    }
}

impl RingOp<W80> for Xor<W80> {
    type Operand = u128;
    #[inline]
    fn apply(a: u128, b: u128) -> u128 {
        const_ring_eval_w80(PrimitiveOp::Xor, a, b)
    }
}

impl RingOp<W80> for And<W80> {
    type Operand = u128;
    #[inline]
    fn apply(a: u128, b: u128) -> u128 {
        const_ring_eval_w80(PrimitiveOp::And, a, b)
    }
}

impl RingOp<W80> for Or<W80> {
    type Operand = u128;
    #[inline]
    fn apply(a: u128, b: u128) -> u128 {
        const_ring_eval_w80(PrimitiveOp::Or, a, b)
    }
}

impl RingOp<W88> for Mul<W88> {
    type Operand = u128;
    #[inline]
    fn apply(a: u128, b: u128) -> u128 {
        const_ring_eval_w88(PrimitiveOp::Mul, a, b)
    }
}

impl RingOp<W88> for Add<W88> {
    type Operand = u128;
    #[inline]
    fn apply(a: u128, b: u128) -> u128 {
        const_ring_eval_w88(PrimitiveOp::Add, a, b)
    }
}

impl RingOp<W88> for Sub<W88> {
    type Operand = u128;
    #[inline]
    fn apply(a: u128, b: u128) -> u128 {
        const_ring_eval_w88(PrimitiveOp::Sub, a, b)
    }
}

impl RingOp<W88> for Xor<W88> {
    type Operand = u128;
    #[inline]
    fn apply(a: u128, b: u128) -> u128 {
        const_ring_eval_w88(PrimitiveOp::Xor, a, b)
    }
}

impl RingOp<W88> for And<W88> {
    type Operand = u128;
    #[inline]
    fn apply(a: u128, b: u128) -> u128 {
        const_ring_eval_w88(PrimitiveOp::And, a, b)
    }
}

impl RingOp<W88> for Or<W88> {
    type Operand = u128;
    #[inline]
    fn apply(a: u128, b: u128) -> u128 {
        const_ring_eval_w88(PrimitiveOp::Or, a, b)
    }
}

impl RingOp<W96> for Mul<W96> {
    type Operand = u128;
    #[inline]
    fn apply(a: u128, b: u128) -> u128 {
        const_ring_eval_w96(PrimitiveOp::Mul, a, b)
    }
}

impl RingOp<W96> for Add<W96> {
    type Operand = u128;
    #[inline]
    fn apply(a: u128, b: u128) -> u128 {
        const_ring_eval_w96(PrimitiveOp::Add, a, b)
    }
}

impl RingOp<W96> for Sub<W96> {
    type Operand = u128;
    #[inline]
    fn apply(a: u128, b: u128) -> u128 {
        const_ring_eval_w96(PrimitiveOp::Sub, a, b)
    }
}

impl RingOp<W96> for Xor<W96> {
    type Operand = u128;
    #[inline]
    fn apply(a: u128, b: u128) -> u128 {
        const_ring_eval_w96(PrimitiveOp::Xor, a, b)
    }
}

impl RingOp<W96> for And<W96> {
    type Operand = u128;
    #[inline]
    fn apply(a: u128, b: u128) -> u128 {
        const_ring_eval_w96(PrimitiveOp::And, a, b)
    }
}

impl RingOp<W96> for Or<W96> {
    type Operand = u128;
    #[inline]
    fn apply(a: u128, b: u128) -> u128 {
        const_ring_eval_w96(PrimitiveOp::Or, a, b)
    }
}

impl RingOp<W104> for Mul<W104> {
    type Operand = u128;
    #[inline]
    fn apply(a: u128, b: u128) -> u128 {
        const_ring_eval_w104(PrimitiveOp::Mul, a, b)
    }
}

impl RingOp<W104> for Add<W104> {
    type Operand = u128;
    #[inline]
    fn apply(a: u128, b: u128) -> u128 {
        const_ring_eval_w104(PrimitiveOp::Add, a, b)
    }
}

impl RingOp<W104> for Sub<W104> {
    type Operand = u128;
    #[inline]
    fn apply(a: u128, b: u128) -> u128 {
        const_ring_eval_w104(PrimitiveOp::Sub, a, b)
    }
}

impl RingOp<W104> for Xor<W104> {
    type Operand = u128;
    #[inline]
    fn apply(a: u128, b: u128) -> u128 {
        const_ring_eval_w104(PrimitiveOp::Xor, a, b)
    }
}

impl RingOp<W104> for And<W104> {
    type Operand = u128;
    #[inline]
    fn apply(a: u128, b: u128) -> u128 {
        const_ring_eval_w104(PrimitiveOp::And, a, b)
    }
}

impl RingOp<W104> for Or<W104> {
    type Operand = u128;
    #[inline]
    fn apply(a: u128, b: u128) -> u128 {
        const_ring_eval_w104(PrimitiveOp::Or, a, b)
    }
}

impl RingOp<W112> for Mul<W112> {
    type Operand = u128;
    #[inline]
    fn apply(a: u128, b: u128) -> u128 {
        const_ring_eval_w112(PrimitiveOp::Mul, a, b)
    }
}

impl RingOp<W112> for Add<W112> {
    type Operand = u128;
    #[inline]
    fn apply(a: u128, b: u128) -> u128 {
        const_ring_eval_w112(PrimitiveOp::Add, a, b)
    }
}

impl RingOp<W112> for Sub<W112> {
    type Operand = u128;
    #[inline]
    fn apply(a: u128, b: u128) -> u128 {
        const_ring_eval_w112(PrimitiveOp::Sub, a, b)
    }
}

impl RingOp<W112> for Xor<W112> {
    type Operand = u128;
    #[inline]
    fn apply(a: u128, b: u128) -> u128 {
        const_ring_eval_w112(PrimitiveOp::Xor, a, b)
    }
}

impl RingOp<W112> for And<W112> {
    type Operand = u128;
    #[inline]
    fn apply(a: u128, b: u128) -> u128 {
        const_ring_eval_w112(PrimitiveOp::And, a, b)
    }
}

impl RingOp<W112> for Or<W112> {
    type Operand = u128;
    #[inline]
    fn apply(a: u128, b: u128) -> u128 {
        const_ring_eval_w112(PrimitiveOp::Or, a, b)
    }
}

impl RingOp<W120> for Mul<W120> {
    type Operand = u128;
    #[inline]
    fn apply(a: u128, b: u128) -> u128 {
        const_ring_eval_w120(PrimitiveOp::Mul, a, b)
    }
}

impl RingOp<W120> for Add<W120> {
    type Operand = u128;
    #[inline]
    fn apply(a: u128, b: u128) -> u128 {
        const_ring_eval_w120(PrimitiveOp::Add, a, b)
    }
}

impl RingOp<W120> for Sub<W120> {
    type Operand = u128;
    #[inline]
    fn apply(a: u128, b: u128) -> u128 {
        const_ring_eval_w120(PrimitiveOp::Sub, a, b)
    }
}

impl RingOp<W120> for Xor<W120> {
    type Operand = u128;
    #[inline]
    fn apply(a: u128, b: u128) -> u128 {
        const_ring_eval_w120(PrimitiveOp::Xor, a, b)
    }
}

impl RingOp<W120> for And<W120> {
    type Operand = u128;
    #[inline]
    fn apply(a: u128, b: u128) -> u128 {
        const_ring_eval_w120(PrimitiveOp::And, a, b)
    }
}

impl RingOp<W120> for Or<W120> {
    type Operand = u128;
    #[inline]
    fn apply(a: u128, b: u128) -> u128 {
        const_ring_eval_w120(PrimitiveOp::Or, a, b)
    }
}

impl RingOp<W128> for Mul<W128> {
    type Operand = u128;
    #[inline]
    fn apply(a: u128, b: u128) -> u128 {
        const_ring_eval_w128(PrimitiveOp::Mul, a, b)
    }
}

impl RingOp<W128> for Add<W128> {
    type Operand = u128;
    #[inline]
    fn apply(a: u128, b: u128) -> u128 {
        const_ring_eval_w128(PrimitiveOp::Add, a, b)
    }
}

impl RingOp<W128> for Sub<W128> {
    type Operand = u128;
    #[inline]
    fn apply(a: u128, b: u128) -> u128 {
        const_ring_eval_w128(PrimitiveOp::Sub, a, b)
    }
}

impl RingOp<W128> for Xor<W128> {
    type Operand = u128;
    #[inline]
    fn apply(a: u128, b: u128) -> u128 {
        const_ring_eval_w128(PrimitiveOp::Xor, a, b)
    }
}

impl RingOp<W128> for And<W128> {
    type Operand = u128;
    #[inline]
    fn apply(a: u128, b: u128) -> u128 {
        const_ring_eval_w128(PrimitiveOp::And, a, b)
    }
}

impl RingOp<W128> for Or<W128> {
    type Operand = u128;
    #[inline]
    fn apply(a: u128, b: u128) -> u128 {
        const_ring_eval_w128(PrimitiveOp::Or, a, b)
    }
}

impl UnaryRingOp<W8> for Neg<W8> {
    type Operand = u8;
    #[inline]
    fn apply(a: u8) -> u8 {
        const_ring_eval_w8(PrimitiveOp::Sub, 0, a)
    }
}

impl UnaryRingOp<W8> for BNot<W8> {
    type Operand = u8;
    #[inline]
    fn apply(a: u8) -> u8 {
        const_ring_eval_w8(PrimitiveOp::Xor, a, u8::MAX)
    }
}

impl UnaryRingOp<W8> for Succ<W8> {
    type Operand = u8;
    #[inline]
    fn apply(a: u8) -> u8 {
        <Neg<W8> as UnaryRingOp<W8>>::apply(<BNot<W8> as UnaryRingOp<W8>>::apply(a))
    }
}

impl UnaryRingOp<W16> for Neg<W16> {
    type Operand = u16;
    #[inline]
    fn apply(a: u16) -> u16 {
        const_ring_eval_w16(PrimitiveOp::Sub, 0, a)
    }
}

impl UnaryRingOp<W16> for BNot<W16> {
    type Operand = u16;
    #[inline]
    fn apply(a: u16) -> u16 {
        const_ring_eval_w16(PrimitiveOp::Xor, a, u16::MAX)
    }
}

impl UnaryRingOp<W16> for Succ<W16> {
    type Operand = u16;
    #[inline]
    fn apply(a: u16) -> u16 {
        <Neg<W16> as UnaryRingOp<W16>>::apply(<BNot<W16> as UnaryRingOp<W16>>::apply(a))
    }
}

impl UnaryRingOp<W24> for Neg<W24> {
    type Operand = u32;
    #[inline]
    fn apply(a: u32) -> u32 {
        const_ring_eval_w24(PrimitiveOp::Sub, 0, a)
    }
}

impl UnaryRingOp<W24> for BNot<W24> {
    type Operand = u32;
    #[inline]
    fn apply(a: u32) -> u32 {
        const_ring_eval_w24(PrimitiveOp::Xor, a, 0x00FF_FFFFu32)
    }
}

impl UnaryRingOp<W24> for Succ<W24> {
    type Operand = u32;
    #[inline]
    fn apply(a: u32) -> u32 {
        <Neg<W24> as UnaryRingOp<W24>>::apply(<BNot<W24> as UnaryRingOp<W24>>::apply(a))
    }
}

impl UnaryRingOp<W32> for Neg<W32> {
    type Operand = u32;
    #[inline]
    fn apply(a: u32) -> u32 {
        const_ring_eval_w32(PrimitiveOp::Sub, 0, a)
    }
}

impl UnaryRingOp<W32> for BNot<W32> {
    type Operand = u32;
    #[inline]
    fn apply(a: u32) -> u32 {
        const_ring_eval_w32(PrimitiveOp::Xor, a, u32::MAX)
    }
}

impl UnaryRingOp<W32> for Succ<W32> {
    type Operand = u32;
    #[inline]
    fn apply(a: u32) -> u32 {
        <Neg<W32> as UnaryRingOp<W32>>::apply(<BNot<W32> as UnaryRingOp<W32>>::apply(a))
    }
}

impl UnaryRingOp<W40> for Neg<W40> {
    type Operand = u64;
    #[inline]
    fn apply(a: u64) -> u64 {
        const_ring_eval_w40(PrimitiveOp::Sub, 0, a)
    }
}

impl UnaryRingOp<W40> for BNot<W40> {
    type Operand = u64;
    #[inline]
    fn apply(a: u64) -> u64 {
        const_ring_eval_w40(PrimitiveOp::Xor, a, 0x0000_00FF_FFFF_FFFFu64)
    }
}

impl UnaryRingOp<W40> for Succ<W40> {
    type Operand = u64;
    #[inline]
    fn apply(a: u64) -> u64 {
        <Neg<W40> as UnaryRingOp<W40>>::apply(<BNot<W40> as UnaryRingOp<W40>>::apply(a))
    }
}

impl UnaryRingOp<W48> for Neg<W48> {
    type Operand = u64;
    #[inline]
    fn apply(a: u64) -> u64 {
        const_ring_eval_w48(PrimitiveOp::Sub, 0, a)
    }
}

impl UnaryRingOp<W48> for BNot<W48> {
    type Operand = u64;
    #[inline]
    fn apply(a: u64) -> u64 {
        const_ring_eval_w48(PrimitiveOp::Xor, a, 0x0000_FFFF_FFFF_FFFFu64)
    }
}

impl UnaryRingOp<W48> for Succ<W48> {
    type Operand = u64;
    #[inline]
    fn apply(a: u64) -> u64 {
        <Neg<W48> as UnaryRingOp<W48>>::apply(<BNot<W48> as UnaryRingOp<W48>>::apply(a))
    }
}

impl UnaryRingOp<W56> for Neg<W56> {
    type Operand = u64;
    #[inline]
    fn apply(a: u64) -> u64 {
        const_ring_eval_w56(PrimitiveOp::Sub, 0, a)
    }
}

impl UnaryRingOp<W56> for BNot<W56> {
    type Operand = u64;
    #[inline]
    fn apply(a: u64) -> u64 {
        const_ring_eval_w56(PrimitiveOp::Xor, a, 0x00FF_FFFF_FFFF_FFFFu64)
    }
}

impl UnaryRingOp<W56> for Succ<W56> {
    type Operand = u64;
    #[inline]
    fn apply(a: u64) -> u64 {
        <Neg<W56> as UnaryRingOp<W56>>::apply(<BNot<W56> as UnaryRingOp<W56>>::apply(a))
    }
}

impl UnaryRingOp<W64> for Neg<W64> {
    type Operand = u64;
    #[inline]
    fn apply(a: u64) -> u64 {
        const_ring_eval_w64(PrimitiveOp::Sub, 0, a)
    }
}

impl UnaryRingOp<W64> for BNot<W64> {
    type Operand = u64;
    #[inline]
    fn apply(a: u64) -> u64 {
        const_ring_eval_w64(PrimitiveOp::Xor, a, u64::MAX)
    }
}

impl UnaryRingOp<W64> for Succ<W64> {
    type Operand = u64;
    #[inline]
    fn apply(a: u64) -> u64 {
        <Neg<W64> as UnaryRingOp<W64>>::apply(<BNot<W64> as UnaryRingOp<W64>>::apply(a))
    }
}

impl UnaryRingOp<W72> for Neg<W72> {
    type Operand = u128;
    #[inline]
    fn apply(a: u128) -> u128 {
        const_ring_eval_w72(PrimitiveOp::Sub, 0, a)
    }
}

impl UnaryRingOp<W72> for BNot<W72> {
    type Operand = u128;
    #[inline]
    fn apply(a: u128) -> u128 {
        const_ring_eval_w72(PrimitiveOp::Xor, a, u128::MAX >> (128 - 72))
    }
}

impl UnaryRingOp<W72> for Succ<W72> {
    type Operand = u128;
    #[inline]
    fn apply(a: u128) -> u128 {
        <Neg<W72> as UnaryRingOp<W72>>::apply(<BNot<W72> as UnaryRingOp<W72>>::apply(a))
    }
}

impl UnaryRingOp<W80> for Neg<W80> {
    type Operand = u128;
    #[inline]
    fn apply(a: u128) -> u128 {
        const_ring_eval_w80(PrimitiveOp::Sub, 0, a)
    }
}

impl UnaryRingOp<W80> for BNot<W80> {
    type Operand = u128;
    #[inline]
    fn apply(a: u128) -> u128 {
        const_ring_eval_w80(PrimitiveOp::Xor, a, u128::MAX >> (128 - 80))
    }
}

impl UnaryRingOp<W80> for Succ<W80> {
    type Operand = u128;
    #[inline]
    fn apply(a: u128) -> u128 {
        <Neg<W80> as UnaryRingOp<W80>>::apply(<BNot<W80> as UnaryRingOp<W80>>::apply(a))
    }
}

impl UnaryRingOp<W88> for Neg<W88> {
    type Operand = u128;
    #[inline]
    fn apply(a: u128) -> u128 {
        const_ring_eval_w88(PrimitiveOp::Sub, 0, a)
    }
}

impl UnaryRingOp<W88> for BNot<W88> {
    type Operand = u128;
    #[inline]
    fn apply(a: u128) -> u128 {
        const_ring_eval_w88(PrimitiveOp::Xor, a, u128::MAX >> (128 - 88))
    }
}

impl UnaryRingOp<W88> for Succ<W88> {
    type Operand = u128;
    #[inline]
    fn apply(a: u128) -> u128 {
        <Neg<W88> as UnaryRingOp<W88>>::apply(<BNot<W88> as UnaryRingOp<W88>>::apply(a))
    }
}

impl UnaryRingOp<W96> for Neg<W96> {
    type Operand = u128;
    #[inline]
    fn apply(a: u128) -> u128 {
        const_ring_eval_w96(PrimitiveOp::Sub, 0, a)
    }
}

impl UnaryRingOp<W96> for BNot<W96> {
    type Operand = u128;
    #[inline]
    fn apply(a: u128) -> u128 {
        const_ring_eval_w96(PrimitiveOp::Xor, a, u128::MAX >> (128 - 96))
    }
}

impl UnaryRingOp<W96> for Succ<W96> {
    type Operand = u128;
    #[inline]
    fn apply(a: u128) -> u128 {
        <Neg<W96> as UnaryRingOp<W96>>::apply(<BNot<W96> as UnaryRingOp<W96>>::apply(a))
    }
}

impl UnaryRingOp<W104> for Neg<W104> {
    type Operand = u128;
    #[inline]
    fn apply(a: u128) -> u128 {
        const_ring_eval_w104(PrimitiveOp::Sub, 0, a)
    }
}

impl UnaryRingOp<W104> for BNot<W104> {
    type Operand = u128;
    #[inline]
    fn apply(a: u128) -> u128 {
        const_ring_eval_w104(PrimitiveOp::Xor, a, u128::MAX >> (128 - 104))
    }
}

impl UnaryRingOp<W104> for Succ<W104> {
    type Operand = u128;
    #[inline]
    fn apply(a: u128) -> u128 {
        <Neg<W104> as UnaryRingOp<W104>>::apply(<BNot<W104> as UnaryRingOp<W104>>::apply(a))
    }
}

impl UnaryRingOp<W112> for Neg<W112> {
    type Operand = u128;
    #[inline]
    fn apply(a: u128) -> u128 {
        const_ring_eval_w112(PrimitiveOp::Sub, 0, a)
    }
}

impl UnaryRingOp<W112> for BNot<W112> {
    type Operand = u128;
    #[inline]
    fn apply(a: u128) -> u128 {
        const_ring_eval_w112(PrimitiveOp::Xor, a, u128::MAX >> (128 - 112))
    }
}

impl UnaryRingOp<W112> for Succ<W112> {
    type Operand = u128;
    #[inline]
    fn apply(a: u128) -> u128 {
        <Neg<W112> as UnaryRingOp<W112>>::apply(<BNot<W112> as UnaryRingOp<W112>>::apply(a))
    }
}

impl UnaryRingOp<W120> for Neg<W120> {
    type Operand = u128;
    #[inline]
    fn apply(a: u128) -> u128 {
        const_ring_eval_w120(PrimitiveOp::Sub, 0, a)
    }
}

impl UnaryRingOp<W120> for BNot<W120> {
    type Operand = u128;
    #[inline]
    fn apply(a: u128) -> u128 {
        const_ring_eval_w120(PrimitiveOp::Xor, a, u128::MAX >> (128 - 120))
    }
}

impl UnaryRingOp<W120> for Succ<W120> {
    type Operand = u128;
    #[inline]
    fn apply(a: u128) -> u128 {
        <Neg<W120> as UnaryRingOp<W120>>::apply(<BNot<W120> as UnaryRingOp<W120>>::apply(a))
    }
}

impl UnaryRingOp<W128> for Neg<W128> {
    type Operand = u128;
    #[inline]
    fn apply(a: u128) -> u128 {
        const_ring_eval_w128(PrimitiveOp::Sub, 0, a)
    }
}

impl UnaryRingOp<W128> for BNot<W128> {
    type Operand = u128;
    #[inline]
    fn apply(a: u128) -> u128 {
        const_ring_eval_w128(PrimitiveOp::Xor, a, u128::MAX)
    }
}

impl UnaryRingOp<W128> for Succ<W128> {
    type Operand = u128;
    #[inline]
    fn apply(a: u128) -> u128 {
        <Neg<W128> as UnaryRingOp<W128>>::apply(<BNot<W128> as UnaryRingOp<W128>>::apply(a))
    }
}

/// Sealed marker for well-formed level embedding pairs (`(From, To)` with
/// `From <= To`). v0.2.2 W3.
pub trait ValidLevelEmbedding: valid_level_embedding_sealed::Sealed {}

mod valid_level_embedding_sealed {
    /// Private supertrait. Not implementable outside this crate.
    pub trait Sealed {}
    impl Sealed for (super::W8, super::W8) {}
    impl Sealed for (super::W8, super::W16) {}
    impl Sealed for (super::W8, super::W24) {}
    impl Sealed for (super::W8, super::W32) {}
    impl Sealed for (super::W8, super::W40) {}
    impl Sealed for (super::W8, super::W48) {}
    impl Sealed for (super::W8, super::W56) {}
    impl Sealed for (super::W8, super::W64) {}
    impl Sealed for (super::W8, super::W72) {}
    impl Sealed for (super::W8, super::W80) {}
    impl Sealed for (super::W8, super::W88) {}
    impl Sealed for (super::W8, super::W96) {}
    impl Sealed for (super::W8, super::W104) {}
    impl Sealed for (super::W8, super::W112) {}
    impl Sealed for (super::W8, super::W120) {}
    impl Sealed for (super::W8, super::W128) {}
    impl Sealed for (super::W16, super::W16) {}
    impl Sealed for (super::W16, super::W24) {}
    impl Sealed for (super::W16, super::W32) {}
    impl Sealed for (super::W16, super::W40) {}
    impl Sealed for (super::W16, super::W48) {}
    impl Sealed for (super::W16, super::W56) {}
    impl Sealed for (super::W16, super::W64) {}
    impl Sealed for (super::W16, super::W72) {}
    impl Sealed for (super::W16, super::W80) {}
    impl Sealed for (super::W16, super::W88) {}
    impl Sealed for (super::W16, super::W96) {}
    impl Sealed for (super::W16, super::W104) {}
    impl Sealed for (super::W16, super::W112) {}
    impl Sealed for (super::W16, super::W120) {}
    impl Sealed for (super::W16, super::W128) {}
    impl Sealed for (super::W24, super::W24) {}
    impl Sealed for (super::W24, super::W32) {}
    impl Sealed for (super::W24, super::W40) {}
    impl Sealed for (super::W24, super::W48) {}
    impl Sealed for (super::W24, super::W56) {}
    impl Sealed for (super::W24, super::W64) {}
    impl Sealed for (super::W24, super::W72) {}
    impl Sealed for (super::W24, super::W80) {}
    impl Sealed for (super::W24, super::W88) {}
    impl Sealed for (super::W24, super::W96) {}
    impl Sealed for (super::W24, super::W104) {}
    impl Sealed for (super::W24, super::W112) {}
    impl Sealed for (super::W24, super::W120) {}
    impl Sealed for (super::W24, super::W128) {}
    impl Sealed for (super::W32, super::W32) {}
    impl Sealed for (super::W32, super::W40) {}
    impl Sealed for (super::W32, super::W48) {}
    impl Sealed for (super::W32, super::W56) {}
    impl Sealed for (super::W32, super::W64) {}
    impl Sealed for (super::W32, super::W72) {}
    impl Sealed for (super::W32, super::W80) {}
    impl Sealed for (super::W32, super::W88) {}
    impl Sealed for (super::W32, super::W96) {}
    impl Sealed for (super::W32, super::W104) {}
    impl Sealed for (super::W32, super::W112) {}
    impl Sealed for (super::W32, super::W120) {}
    impl Sealed for (super::W32, super::W128) {}
    impl Sealed for (super::W40, super::W40) {}
    impl Sealed for (super::W40, super::W48) {}
    impl Sealed for (super::W40, super::W56) {}
    impl Sealed for (super::W40, super::W64) {}
    impl Sealed for (super::W40, super::W72) {}
    impl Sealed for (super::W40, super::W80) {}
    impl Sealed for (super::W40, super::W88) {}
    impl Sealed for (super::W40, super::W96) {}
    impl Sealed for (super::W40, super::W104) {}
    impl Sealed for (super::W40, super::W112) {}
    impl Sealed for (super::W40, super::W120) {}
    impl Sealed for (super::W40, super::W128) {}
    impl Sealed for (super::W48, super::W48) {}
    impl Sealed for (super::W48, super::W56) {}
    impl Sealed for (super::W48, super::W64) {}
    impl Sealed for (super::W48, super::W72) {}
    impl Sealed for (super::W48, super::W80) {}
    impl Sealed for (super::W48, super::W88) {}
    impl Sealed for (super::W48, super::W96) {}
    impl Sealed for (super::W48, super::W104) {}
    impl Sealed for (super::W48, super::W112) {}
    impl Sealed for (super::W48, super::W120) {}
    impl Sealed for (super::W48, super::W128) {}
    impl Sealed for (super::W56, super::W56) {}
    impl Sealed for (super::W56, super::W64) {}
    impl Sealed for (super::W56, super::W72) {}
    impl Sealed for (super::W56, super::W80) {}
    impl Sealed for (super::W56, super::W88) {}
    impl Sealed for (super::W56, super::W96) {}
    impl Sealed for (super::W56, super::W104) {}
    impl Sealed for (super::W56, super::W112) {}
    impl Sealed for (super::W56, super::W120) {}
    impl Sealed for (super::W56, super::W128) {}
    impl Sealed for (super::W64, super::W64) {}
    impl Sealed for (super::W64, super::W72) {}
    impl Sealed for (super::W64, super::W80) {}
    impl Sealed for (super::W64, super::W88) {}
    impl Sealed for (super::W64, super::W96) {}
    impl Sealed for (super::W64, super::W104) {}
    impl Sealed for (super::W64, super::W112) {}
    impl Sealed for (super::W64, super::W120) {}
    impl Sealed for (super::W64, super::W128) {}
    impl Sealed for (super::W72, super::W72) {}
    impl Sealed for (super::W72, super::W80) {}
    impl Sealed for (super::W72, super::W88) {}
    impl Sealed for (super::W72, super::W96) {}
    impl Sealed for (super::W72, super::W104) {}
    impl Sealed for (super::W72, super::W112) {}
    impl Sealed for (super::W72, super::W120) {}
    impl Sealed for (super::W72, super::W128) {}
    impl Sealed for (super::W80, super::W80) {}
    impl Sealed for (super::W80, super::W88) {}
    impl Sealed for (super::W80, super::W96) {}
    impl Sealed for (super::W80, super::W104) {}
    impl Sealed for (super::W80, super::W112) {}
    impl Sealed for (super::W80, super::W120) {}
    impl Sealed for (super::W80, super::W128) {}
    impl Sealed for (super::W88, super::W88) {}
    impl Sealed for (super::W88, super::W96) {}
    impl Sealed for (super::W88, super::W104) {}
    impl Sealed for (super::W88, super::W112) {}
    impl Sealed for (super::W88, super::W120) {}
    impl Sealed for (super::W88, super::W128) {}
    impl Sealed for (super::W96, super::W96) {}
    impl Sealed for (super::W96, super::W104) {}
    impl Sealed for (super::W96, super::W112) {}
    impl Sealed for (super::W96, super::W120) {}
    impl Sealed for (super::W96, super::W128) {}
    impl Sealed for (super::W104, super::W104) {}
    impl Sealed for (super::W104, super::W112) {}
    impl Sealed for (super::W104, super::W120) {}
    impl Sealed for (super::W104, super::W128) {}
    impl Sealed for (super::W112, super::W112) {}
    impl Sealed for (super::W112, super::W120) {}
    impl Sealed for (super::W112, super::W128) {}
    impl Sealed for (super::W120, super::W120) {}
    impl Sealed for (super::W120, super::W128) {}
    impl Sealed for (super::W128, super::W128) {}
}

impl ValidLevelEmbedding for (W8, W8) {}
impl ValidLevelEmbedding for (W8, W16) {}
impl ValidLevelEmbedding for (W8, W24) {}
impl ValidLevelEmbedding for (W8, W32) {}
impl ValidLevelEmbedding for (W8, W40) {}
impl ValidLevelEmbedding for (W8, W48) {}
impl ValidLevelEmbedding for (W8, W56) {}
impl ValidLevelEmbedding for (W8, W64) {}
impl ValidLevelEmbedding for (W8, W72) {}
impl ValidLevelEmbedding for (W8, W80) {}
impl ValidLevelEmbedding for (W8, W88) {}
impl ValidLevelEmbedding for (W8, W96) {}
impl ValidLevelEmbedding for (W8, W104) {}
impl ValidLevelEmbedding for (W8, W112) {}
impl ValidLevelEmbedding for (W8, W120) {}
impl ValidLevelEmbedding for (W8, W128) {}
impl ValidLevelEmbedding for (W16, W16) {}
impl ValidLevelEmbedding for (W16, W24) {}
impl ValidLevelEmbedding for (W16, W32) {}
impl ValidLevelEmbedding for (W16, W40) {}
impl ValidLevelEmbedding for (W16, W48) {}
impl ValidLevelEmbedding for (W16, W56) {}
impl ValidLevelEmbedding for (W16, W64) {}
impl ValidLevelEmbedding for (W16, W72) {}
impl ValidLevelEmbedding for (W16, W80) {}
impl ValidLevelEmbedding for (W16, W88) {}
impl ValidLevelEmbedding for (W16, W96) {}
impl ValidLevelEmbedding for (W16, W104) {}
impl ValidLevelEmbedding for (W16, W112) {}
impl ValidLevelEmbedding for (W16, W120) {}
impl ValidLevelEmbedding for (W16, W128) {}
impl ValidLevelEmbedding for (W24, W24) {}
impl ValidLevelEmbedding for (W24, W32) {}
impl ValidLevelEmbedding for (W24, W40) {}
impl ValidLevelEmbedding for (W24, W48) {}
impl ValidLevelEmbedding for (W24, W56) {}
impl ValidLevelEmbedding for (W24, W64) {}
impl ValidLevelEmbedding for (W24, W72) {}
impl ValidLevelEmbedding for (W24, W80) {}
impl ValidLevelEmbedding for (W24, W88) {}
impl ValidLevelEmbedding for (W24, W96) {}
impl ValidLevelEmbedding for (W24, W104) {}
impl ValidLevelEmbedding for (W24, W112) {}
impl ValidLevelEmbedding for (W24, W120) {}
impl ValidLevelEmbedding for (W24, W128) {}
impl ValidLevelEmbedding for (W32, W32) {}
impl ValidLevelEmbedding for (W32, W40) {}
impl ValidLevelEmbedding for (W32, W48) {}
impl ValidLevelEmbedding for (W32, W56) {}
impl ValidLevelEmbedding for (W32, W64) {}
impl ValidLevelEmbedding for (W32, W72) {}
impl ValidLevelEmbedding for (W32, W80) {}
impl ValidLevelEmbedding for (W32, W88) {}
impl ValidLevelEmbedding for (W32, W96) {}
impl ValidLevelEmbedding for (W32, W104) {}
impl ValidLevelEmbedding for (W32, W112) {}
impl ValidLevelEmbedding for (W32, W120) {}
impl ValidLevelEmbedding for (W32, W128) {}
impl ValidLevelEmbedding for (W40, W40) {}
impl ValidLevelEmbedding for (W40, W48) {}
impl ValidLevelEmbedding for (W40, W56) {}
impl ValidLevelEmbedding for (W40, W64) {}
impl ValidLevelEmbedding for (W40, W72) {}
impl ValidLevelEmbedding for (W40, W80) {}
impl ValidLevelEmbedding for (W40, W88) {}
impl ValidLevelEmbedding for (W40, W96) {}
impl ValidLevelEmbedding for (W40, W104) {}
impl ValidLevelEmbedding for (W40, W112) {}
impl ValidLevelEmbedding for (W40, W120) {}
impl ValidLevelEmbedding for (W40, W128) {}
impl ValidLevelEmbedding for (W48, W48) {}
impl ValidLevelEmbedding for (W48, W56) {}
impl ValidLevelEmbedding for (W48, W64) {}
impl ValidLevelEmbedding for (W48, W72) {}
impl ValidLevelEmbedding for (W48, W80) {}
impl ValidLevelEmbedding for (W48, W88) {}
impl ValidLevelEmbedding for (W48, W96) {}
impl ValidLevelEmbedding for (W48, W104) {}
impl ValidLevelEmbedding for (W48, W112) {}
impl ValidLevelEmbedding for (W48, W120) {}
impl ValidLevelEmbedding for (W48, W128) {}
impl ValidLevelEmbedding for (W56, W56) {}
impl ValidLevelEmbedding for (W56, W64) {}
impl ValidLevelEmbedding for (W56, W72) {}
impl ValidLevelEmbedding for (W56, W80) {}
impl ValidLevelEmbedding for (W56, W88) {}
impl ValidLevelEmbedding for (W56, W96) {}
impl ValidLevelEmbedding for (W56, W104) {}
impl ValidLevelEmbedding for (W56, W112) {}
impl ValidLevelEmbedding for (W56, W120) {}
impl ValidLevelEmbedding for (W56, W128) {}
impl ValidLevelEmbedding for (W64, W64) {}
impl ValidLevelEmbedding for (W64, W72) {}
impl ValidLevelEmbedding for (W64, W80) {}
impl ValidLevelEmbedding for (W64, W88) {}
impl ValidLevelEmbedding for (W64, W96) {}
impl ValidLevelEmbedding for (W64, W104) {}
impl ValidLevelEmbedding for (W64, W112) {}
impl ValidLevelEmbedding for (W64, W120) {}
impl ValidLevelEmbedding for (W64, W128) {}
impl ValidLevelEmbedding for (W72, W72) {}
impl ValidLevelEmbedding for (W72, W80) {}
impl ValidLevelEmbedding for (W72, W88) {}
impl ValidLevelEmbedding for (W72, W96) {}
impl ValidLevelEmbedding for (W72, W104) {}
impl ValidLevelEmbedding for (W72, W112) {}
impl ValidLevelEmbedding for (W72, W120) {}
impl ValidLevelEmbedding for (W72, W128) {}
impl ValidLevelEmbedding for (W80, W80) {}
impl ValidLevelEmbedding for (W80, W88) {}
impl ValidLevelEmbedding for (W80, W96) {}
impl ValidLevelEmbedding for (W80, W104) {}
impl ValidLevelEmbedding for (W80, W112) {}
impl ValidLevelEmbedding for (W80, W120) {}
impl ValidLevelEmbedding for (W80, W128) {}
impl ValidLevelEmbedding for (W88, W88) {}
impl ValidLevelEmbedding for (W88, W96) {}
impl ValidLevelEmbedding for (W88, W104) {}
impl ValidLevelEmbedding for (W88, W112) {}
impl ValidLevelEmbedding for (W88, W120) {}
impl ValidLevelEmbedding for (W88, W128) {}
impl ValidLevelEmbedding for (W96, W96) {}
impl ValidLevelEmbedding for (W96, W104) {}
impl ValidLevelEmbedding for (W96, W112) {}
impl ValidLevelEmbedding for (W96, W120) {}
impl ValidLevelEmbedding for (W96, W128) {}
impl ValidLevelEmbedding for (W104, W104) {}
impl ValidLevelEmbedding for (W104, W112) {}
impl ValidLevelEmbedding for (W104, W120) {}
impl ValidLevelEmbedding for (W104, W128) {}
impl ValidLevelEmbedding for (W112, W112) {}
impl ValidLevelEmbedding for (W112, W120) {}
impl ValidLevelEmbedding for (W112, W128) {}
impl ValidLevelEmbedding for (W120, W120) {}
impl ValidLevelEmbedding for (W120, W128) {}
impl ValidLevelEmbedding for (W128, W128) {}

/// v0.2.2 W3: phantom-typed level embedding `Embed<From, To>` for the
/// canonical injection ι : R_From → R_To when `From <= To`.
/// Implementations exist only for sealed `(From, To)` pairs in the
/// `ValidLevelEmbedding` trait, so attempting an unsupported direction
/// (e.g., `Embed<W32, W8>`) fails at compile time.
#[derive(Debug, Default, Clone, Copy)]
pub struct Embed<From, To>(PhantomData<(From, To)>);

impl Embed<W8, W8> {
    /// Embed a `u8` value at W8 into a `u8` value at W8.
    #[inline]
    #[must_use]
    pub const fn apply(value: u8) -> u8 {
        value
    }
}

impl Embed<W8, W16> {
    /// Embed a `u8` value at W8 into a `u16` value at W16.
    #[inline]
    #[must_use]
    pub const fn apply(value: u8) -> u16 {
        value as u16
    }
}

impl Embed<W8, W24> {
    /// Embed a `u8` value at W8 into a `u32` value at W24.
    #[inline]
    #[must_use]
    pub const fn apply(value: u8) -> u32 {
        value as u32
    }
}

impl Embed<W8, W32> {
    /// Embed a `u8` value at W8 into a `u32` value at W32.
    #[inline]
    #[must_use]
    pub const fn apply(value: u8) -> u32 {
        value as u32
    }
}

impl Embed<W8, W40> {
    /// Embed a `u8` value at W8 into a `u64` value at W40.
    #[inline]
    #[must_use]
    pub const fn apply(value: u8) -> u64 {
        value as u64
    }
}

impl Embed<W8, W48> {
    /// Embed a `u8` value at W8 into a `u64` value at W48.
    #[inline]
    #[must_use]
    pub const fn apply(value: u8) -> u64 {
        value as u64
    }
}

impl Embed<W8, W56> {
    /// Embed a `u8` value at W8 into a `u64` value at W56.
    #[inline]
    #[must_use]
    pub const fn apply(value: u8) -> u64 {
        value as u64
    }
}

impl Embed<W8, W64> {
    /// Embed a `u8` value at W8 into a `u64` value at W64.
    #[inline]
    #[must_use]
    pub const fn apply(value: u8) -> u64 {
        value as u64
    }
}

impl Embed<W8, W72> {
    /// Embed a `u8` value at W8 into a `u128` value at W72.
    #[inline]
    #[must_use]
    pub const fn apply(value: u8) -> u128 {
        value as u128
    }
}

impl Embed<W8, W80> {
    /// Embed a `u8` value at W8 into a `u128` value at W80.
    #[inline]
    #[must_use]
    pub const fn apply(value: u8) -> u128 {
        value as u128
    }
}

impl Embed<W8, W88> {
    /// Embed a `u8` value at W8 into a `u128` value at W88.
    #[inline]
    #[must_use]
    pub const fn apply(value: u8) -> u128 {
        value as u128
    }
}

impl Embed<W8, W96> {
    /// Embed a `u8` value at W8 into a `u128` value at W96.
    #[inline]
    #[must_use]
    pub const fn apply(value: u8) -> u128 {
        value as u128
    }
}

impl Embed<W8, W104> {
    /// Embed a `u8` value at W8 into a `u128` value at W104.
    #[inline]
    #[must_use]
    pub const fn apply(value: u8) -> u128 {
        value as u128
    }
}

impl Embed<W8, W112> {
    /// Embed a `u8` value at W8 into a `u128` value at W112.
    #[inline]
    #[must_use]
    pub const fn apply(value: u8) -> u128 {
        value as u128
    }
}

impl Embed<W8, W120> {
    /// Embed a `u8` value at W8 into a `u128` value at W120.
    #[inline]
    #[must_use]
    pub const fn apply(value: u8) -> u128 {
        value as u128
    }
}

impl Embed<W8, W128> {
    /// Embed a `u8` value at W8 into a `u128` value at W128.
    #[inline]
    #[must_use]
    pub const fn apply(value: u8) -> u128 {
        value as u128
    }
}

impl Embed<W16, W16> {
    /// Embed a `u16` value at W16 into a `u16` value at W16.
    #[inline]
    #[must_use]
    pub const fn apply(value: u16) -> u16 {
        value
    }
}

impl Embed<W16, W24> {
    /// Embed a `u16` value at W16 into a `u32` value at W24.
    #[inline]
    #[must_use]
    pub const fn apply(value: u16) -> u32 {
        value as u32
    }
}

impl Embed<W16, W32> {
    /// Embed a `u16` value at W16 into a `u32` value at W32.
    #[inline]
    #[must_use]
    pub const fn apply(value: u16) -> u32 {
        value as u32
    }
}

impl Embed<W16, W40> {
    /// Embed a `u16` value at W16 into a `u64` value at W40.
    #[inline]
    #[must_use]
    pub const fn apply(value: u16) -> u64 {
        value as u64
    }
}

impl Embed<W16, W48> {
    /// Embed a `u16` value at W16 into a `u64` value at W48.
    #[inline]
    #[must_use]
    pub const fn apply(value: u16) -> u64 {
        value as u64
    }
}

impl Embed<W16, W56> {
    /// Embed a `u16` value at W16 into a `u64` value at W56.
    #[inline]
    #[must_use]
    pub const fn apply(value: u16) -> u64 {
        value as u64
    }
}

impl Embed<W16, W64> {
    /// Embed a `u16` value at W16 into a `u64` value at W64.
    #[inline]
    #[must_use]
    pub const fn apply(value: u16) -> u64 {
        value as u64
    }
}

impl Embed<W16, W72> {
    /// Embed a `u16` value at W16 into a `u128` value at W72.
    #[inline]
    #[must_use]
    pub const fn apply(value: u16) -> u128 {
        value as u128
    }
}

impl Embed<W16, W80> {
    /// Embed a `u16` value at W16 into a `u128` value at W80.
    #[inline]
    #[must_use]
    pub const fn apply(value: u16) -> u128 {
        value as u128
    }
}

impl Embed<W16, W88> {
    /// Embed a `u16` value at W16 into a `u128` value at W88.
    #[inline]
    #[must_use]
    pub const fn apply(value: u16) -> u128 {
        value as u128
    }
}

impl Embed<W16, W96> {
    /// Embed a `u16` value at W16 into a `u128` value at W96.
    #[inline]
    #[must_use]
    pub const fn apply(value: u16) -> u128 {
        value as u128
    }
}

impl Embed<W16, W104> {
    /// Embed a `u16` value at W16 into a `u128` value at W104.
    #[inline]
    #[must_use]
    pub const fn apply(value: u16) -> u128 {
        value as u128
    }
}

impl Embed<W16, W112> {
    /// Embed a `u16` value at W16 into a `u128` value at W112.
    #[inline]
    #[must_use]
    pub const fn apply(value: u16) -> u128 {
        value as u128
    }
}

impl Embed<W16, W120> {
    /// Embed a `u16` value at W16 into a `u128` value at W120.
    #[inline]
    #[must_use]
    pub const fn apply(value: u16) -> u128 {
        value as u128
    }
}

impl Embed<W16, W128> {
    /// Embed a `u16` value at W16 into a `u128` value at W128.
    #[inline]
    #[must_use]
    pub const fn apply(value: u16) -> u128 {
        value as u128
    }
}

impl Embed<W24, W24> {
    /// Embed a `u32` value at W24 into a `u32` value at W24.
    #[inline]
    #[must_use]
    pub const fn apply(value: u32) -> u32 {
        value
    }
}

impl Embed<W24, W32> {
    /// Embed a `u32` value at W24 into a `u32` value at W32.
    #[inline]
    #[must_use]
    pub const fn apply(value: u32) -> u32 {
        value
    }
}

impl Embed<W24, W40> {
    /// Embed a `u32` value at W24 into a `u64` value at W40.
    #[inline]
    #[must_use]
    pub const fn apply(value: u32) -> u64 {
        value as u64
    }
}

impl Embed<W24, W48> {
    /// Embed a `u32` value at W24 into a `u64` value at W48.
    #[inline]
    #[must_use]
    pub const fn apply(value: u32) -> u64 {
        value as u64
    }
}

impl Embed<W24, W56> {
    /// Embed a `u32` value at W24 into a `u64` value at W56.
    #[inline]
    #[must_use]
    pub const fn apply(value: u32) -> u64 {
        value as u64
    }
}

impl Embed<W24, W64> {
    /// Embed a `u32` value at W24 into a `u64` value at W64.
    #[inline]
    #[must_use]
    pub const fn apply(value: u32) -> u64 {
        value as u64
    }
}

impl Embed<W24, W72> {
    /// Embed a `u32` value at W24 into a `u128` value at W72.
    #[inline]
    #[must_use]
    pub const fn apply(value: u32) -> u128 {
        value as u128
    }
}

impl Embed<W24, W80> {
    /// Embed a `u32` value at W24 into a `u128` value at W80.
    #[inline]
    #[must_use]
    pub const fn apply(value: u32) -> u128 {
        value as u128
    }
}

impl Embed<W24, W88> {
    /// Embed a `u32` value at W24 into a `u128` value at W88.
    #[inline]
    #[must_use]
    pub const fn apply(value: u32) -> u128 {
        value as u128
    }
}

impl Embed<W24, W96> {
    /// Embed a `u32` value at W24 into a `u128` value at W96.
    #[inline]
    #[must_use]
    pub const fn apply(value: u32) -> u128 {
        value as u128
    }
}

impl Embed<W24, W104> {
    /// Embed a `u32` value at W24 into a `u128` value at W104.
    #[inline]
    #[must_use]
    pub const fn apply(value: u32) -> u128 {
        value as u128
    }
}

impl Embed<W24, W112> {
    /// Embed a `u32` value at W24 into a `u128` value at W112.
    #[inline]
    #[must_use]
    pub const fn apply(value: u32) -> u128 {
        value as u128
    }
}

impl Embed<W24, W120> {
    /// Embed a `u32` value at W24 into a `u128` value at W120.
    #[inline]
    #[must_use]
    pub const fn apply(value: u32) -> u128 {
        value as u128
    }
}

impl Embed<W24, W128> {
    /// Embed a `u32` value at W24 into a `u128` value at W128.
    #[inline]
    #[must_use]
    pub const fn apply(value: u32) -> u128 {
        value as u128
    }
}

impl Embed<W32, W32> {
    /// Embed a `u32` value at W32 into a `u32` value at W32.
    #[inline]
    #[must_use]
    pub const fn apply(value: u32) -> u32 {
        value
    }
}

impl Embed<W32, W40> {
    /// Embed a `u32` value at W32 into a `u64` value at W40.
    #[inline]
    #[must_use]
    pub const fn apply(value: u32) -> u64 {
        value as u64
    }
}

impl Embed<W32, W48> {
    /// Embed a `u32` value at W32 into a `u64` value at W48.
    #[inline]
    #[must_use]
    pub const fn apply(value: u32) -> u64 {
        value as u64
    }
}

impl Embed<W32, W56> {
    /// Embed a `u32` value at W32 into a `u64` value at W56.
    #[inline]
    #[must_use]
    pub const fn apply(value: u32) -> u64 {
        value as u64
    }
}

impl Embed<W32, W64> {
    /// Embed a `u32` value at W32 into a `u64` value at W64.
    #[inline]
    #[must_use]
    pub const fn apply(value: u32) -> u64 {
        value as u64
    }
}

impl Embed<W32, W72> {
    /// Embed a `u32` value at W32 into a `u128` value at W72.
    #[inline]
    #[must_use]
    pub const fn apply(value: u32) -> u128 {
        value as u128
    }
}

impl Embed<W32, W80> {
    /// Embed a `u32` value at W32 into a `u128` value at W80.
    #[inline]
    #[must_use]
    pub const fn apply(value: u32) -> u128 {
        value as u128
    }
}

impl Embed<W32, W88> {
    /// Embed a `u32` value at W32 into a `u128` value at W88.
    #[inline]
    #[must_use]
    pub const fn apply(value: u32) -> u128 {
        value as u128
    }
}

impl Embed<W32, W96> {
    /// Embed a `u32` value at W32 into a `u128` value at W96.
    #[inline]
    #[must_use]
    pub const fn apply(value: u32) -> u128 {
        value as u128
    }
}

impl Embed<W32, W104> {
    /// Embed a `u32` value at W32 into a `u128` value at W104.
    #[inline]
    #[must_use]
    pub const fn apply(value: u32) -> u128 {
        value as u128
    }
}

impl Embed<W32, W112> {
    /// Embed a `u32` value at W32 into a `u128` value at W112.
    #[inline]
    #[must_use]
    pub const fn apply(value: u32) -> u128 {
        value as u128
    }
}

impl Embed<W32, W120> {
    /// Embed a `u32` value at W32 into a `u128` value at W120.
    #[inline]
    #[must_use]
    pub const fn apply(value: u32) -> u128 {
        value as u128
    }
}

impl Embed<W32, W128> {
    /// Embed a `u32` value at W32 into a `u128` value at W128.
    #[inline]
    #[must_use]
    pub const fn apply(value: u32) -> u128 {
        value as u128
    }
}

impl Embed<W40, W40> {
    /// Embed a `u64` value at W40 into a `u64` value at W40.
    #[inline]
    #[must_use]
    pub const fn apply(value: u64) -> u64 {
        value
    }
}

impl Embed<W40, W48> {
    /// Embed a `u64` value at W40 into a `u64` value at W48.
    #[inline]
    #[must_use]
    pub const fn apply(value: u64) -> u64 {
        value
    }
}

impl Embed<W40, W56> {
    /// Embed a `u64` value at W40 into a `u64` value at W56.
    #[inline]
    #[must_use]
    pub const fn apply(value: u64) -> u64 {
        value
    }
}

impl Embed<W40, W64> {
    /// Embed a `u64` value at W40 into a `u64` value at W64.
    #[inline]
    #[must_use]
    pub const fn apply(value: u64) -> u64 {
        value
    }
}

impl Embed<W40, W72> {
    /// Embed a `u64` value at W40 into a `u128` value at W72.
    #[inline]
    #[must_use]
    pub const fn apply(value: u64) -> u128 {
        value as u128
    }
}

impl Embed<W40, W80> {
    /// Embed a `u64` value at W40 into a `u128` value at W80.
    #[inline]
    #[must_use]
    pub const fn apply(value: u64) -> u128 {
        value as u128
    }
}

impl Embed<W40, W88> {
    /// Embed a `u64` value at W40 into a `u128` value at W88.
    #[inline]
    #[must_use]
    pub const fn apply(value: u64) -> u128 {
        value as u128
    }
}

impl Embed<W40, W96> {
    /// Embed a `u64` value at W40 into a `u128` value at W96.
    #[inline]
    #[must_use]
    pub const fn apply(value: u64) -> u128 {
        value as u128
    }
}

impl Embed<W40, W104> {
    /// Embed a `u64` value at W40 into a `u128` value at W104.
    #[inline]
    #[must_use]
    pub const fn apply(value: u64) -> u128 {
        value as u128
    }
}

impl Embed<W40, W112> {
    /// Embed a `u64` value at W40 into a `u128` value at W112.
    #[inline]
    #[must_use]
    pub const fn apply(value: u64) -> u128 {
        value as u128
    }
}

impl Embed<W40, W120> {
    /// Embed a `u64` value at W40 into a `u128` value at W120.
    #[inline]
    #[must_use]
    pub const fn apply(value: u64) -> u128 {
        value as u128
    }
}

impl Embed<W40, W128> {
    /// Embed a `u64` value at W40 into a `u128` value at W128.
    #[inline]
    #[must_use]
    pub const fn apply(value: u64) -> u128 {
        value as u128
    }
}

impl Embed<W48, W48> {
    /// Embed a `u64` value at W48 into a `u64` value at W48.
    #[inline]
    #[must_use]
    pub const fn apply(value: u64) -> u64 {
        value
    }
}

impl Embed<W48, W56> {
    /// Embed a `u64` value at W48 into a `u64` value at W56.
    #[inline]
    #[must_use]
    pub const fn apply(value: u64) -> u64 {
        value
    }
}

impl Embed<W48, W64> {
    /// Embed a `u64` value at W48 into a `u64` value at W64.
    #[inline]
    #[must_use]
    pub const fn apply(value: u64) -> u64 {
        value
    }
}

impl Embed<W48, W72> {
    /// Embed a `u64` value at W48 into a `u128` value at W72.
    #[inline]
    #[must_use]
    pub const fn apply(value: u64) -> u128 {
        value as u128
    }
}

impl Embed<W48, W80> {
    /// Embed a `u64` value at W48 into a `u128` value at W80.
    #[inline]
    #[must_use]
    pub const fn apply(value: u64) -> u128 {
        value as u128
    }
}

impl Embed<W48, W88> {
    /// Embed a `u64` value at W48 into a `u128` value at W88.
    #[inline]
    #[must_use]
    pub const fn apply(value: u64) -> u128 {
        value as u128
    }
}

impl Embed<W48, W96> {
    /// Embed a `u64` value at W48 into a `u128` value at W96.
    #[inline]
    #[must_use]
    pub const fn apply(value: u64) -> u128 {
        value as u128
    }
}

impl Embed<W48, W104> {
    /// Embed a `u64` value at W48 into a `u128` value at W104.
    #[inline]
    #[must_use]
    pub const fn apply(value: u64) -> u128 {
        value as u128
    }
}

impl Embed<W48, W112> {
    /// Embed a `u64` value at W48 into a `u128` value at W112.
    #[inline]
    #[must_use]
    pub const fn apply(value: u64) -> u128 {
        value as u128
    }
}

impl Embed<W48, W120> {
    /// Embed a `u64` value at W48 into a `u128` value at W120.
    #[inline]
    #[must_use]
    pub const fn apply(value: u64) -> u128 {
        value as u128
    }
}

impl Embed<W48, W128> {
    /// Embed a `u64` value at W48 into a `u128` value at W128.
    #[inline]
    #[must_use]
    pub const fn apply(value: u64) -> u128 {
        value as u128
    }
}

impl Embed<W56, W56> {
    /// Embed a `u64` value at W56 into a `u64` value at W56.
    #[inline]
    #[must_use]
    pub const fn apply(value: u64) -> u64 {
        value
    }
}

impl Embed<W56, W64> {
    /// Embed a `u64` value at W56 into a `u64` value at W64.
    #[inline]
    #[must_use]
    pub const fn apply(value: u64) -> u64 {
        value
    }
}

impl Embed<W56, W72> {
    /// Embed a `u64` value at W56 into a `u128` value at W72.
    #[inline]
    #[must_use]
    pub const fn apply(value: u64) -> u128 {
        value as u128
    }
}

impl Embed<W56, W80> {
    /// Embed a `u64` value at W56 into a `u128` value at W80.
    #[inline]
    #[must_use]
    pub const fn apply(value: u64) -> u128 {
        value as u128
    }
}

impl Embed<W56, W88> {
    /// Embed a `u64` value at W56 into a `u128` value at W88.
    #[inline]
    #[must_use]
    pub const fn apply(value: u64) -> u128 {
        value as u128
    }
}

impl Embed<W56, W96> {
    /// Embed a `u64` value at W56 into a `u128` value at W96.
    #[inline]
    #[must_use]
    pub const fn apply(value: u64) -> u128 {
        value as u128
    }
}

impl Embed<W56, W104> {
    /// Embed a `u64` value at W56 into a `u128` value at W104.
    #[inline]
    #[must_use]
    pub const fn apply(value: u64) -> u128 {
        value as u128
    }
}

impl Embed<W56, W112> {
    /// Embed a `u64` value at W56 into a `u128` value at W112.
    #[inline]
    #[must_use]
    pub const fn apply(value: u64) -> u128 {
        value as u128
    }
}

impl Embed<W56, W120> {
    /// Embed a `u64` value at W56 into a `u128` value at W120.
    #[inline]
    #[must_use]
    pub const fn apply(value: u64) -> u128 {
        value as u128
    }
}

impl Embed<W56, W128> {
    /// Embed a `u64` value at W56 into a `u128` value at W128.
    #[inline]
    #[must_use]
    pub const fn apply(value: u64) -> u128 {
        value as u128
    }
}

impl Embed<W64, W64> {
    /// Embed a `u64` value at W64 into a `u64` value at W64.
    #[inline]
    #[must_use]
    pub const fn apply(value: u64) -> u64 {
        value
    }
}

impl Embed<W64, W72> {
    /// Embed a `u64` value at W64 into a `u128` value at W72.
    #[inline]
    #[must_use]
    pub const fn apply(value: u64) -> u128 {
        value as u128
    }
}

impl Embed<W64, W80> {
    /// Embed a `u64` value at W64 into a `u128` value at W80.
    #[inline]
    #[must_use]
    pub const fn apply(value: u64) -> u128 {
        value as u128
    }
}

impl Embed<W64, W88> {
    /// Embed a `u64` value at W64 into a `u128` value at W88.
    #[inline]
    #[must_use]
    pub const fn apply(value: u64) -> u128 {
        value as u128
    }
}

impl Embed<W64, W96> {
    /// Embed a `u64` value at W64 into a `u128` value at W96.
    #[inline]
    #[must_use]
    pub const fn apply(value: u64) -> u128 {
        value as u128
    }
}

impl Embed<W64, W104> {
    /// Embed a `u64` value at W64 into a `u128` value at W104.
    #[inline]
    #[must_use]
    pub const fn apply(value: u64) -> u128 {
        value as u128
    }
}

impl Embed<W64, W112> {
    /// Embed a `u64` value at W64 into a `u128` value at W112.
    #[inline]
    #[must_use]
    pub const fn apply(value: u64) -> u128 {
        value as u128
    }
}

impl Embed<W64, W120> {
    /// Embed a `u64` value at W64 into a `u128` value at W120.
    #[inline]
    #[must_use]
    pub const fn apply(value: u64) -> u128 {
        value as u128
    }
}

impl Embed<W64, W128> {
    /// Embed a `u64` value at W64 into a `u128` value at W128.
    #[inline]
    #[must_use]
    pub const fn apply(value: u64) -> u128 {
        value as u128
    }
}

impl Embed<W72, W72> {
    /// Embed a `u128` value at W72 into a `u128` value at W72.
    #[inline]
    #[must_use]
    pub const fn apply(value: u128) -> u128 {
        value
    }
}

impl Embed<W72, W80> {
    /// Embed a `u128` value at W72 into a `u128` value at W80.
    #[inline]
    #[must_use]
    pub const fn apply(value: u128) -> u128 {
        value
    }
}

impl Embed<W72, W88> {
    /// Embed a `u128` value at W72 into a `u128` value at W88.
    #[inline]
    #[must_use]
    pub const fn apply(value: u128) -> u128 {
        value
    }
}

impl Embed<W72, W96> {
    /// Embed a `u128` value at W72 into a `u128` value at W96.
    #[inline]
    #[must_use]
    pub const fn apply(value: u128) -> u128 {
        value
    }
}

impl Embed<W72, W104> {
    /// Embed a `u128` value at W72 into a `u128` value at W104.
    #[inline]
    #[must_use]
    pub const fn apply(value: u128) -> u128 {
        value
    }
}

impl Embed<W72, W112> {
    /// Embed a `u128` value at W72 into a `u128` value at W112.
    #[inline]
    #[must_use]
    pub const fn apply(value: u128) -> u128 {
        value
    }
}

impl Embed<W72, W120> {
    /// Embed a `u128` value at W72 into a `u128` value at W120.
    #[inline]
    #[must_use]
    pub const fn apply(value: u128) -> u128 {
        value
    }
}

impl Embed<W72, W128> {
    /// Embed a `u128` value at W72 into a `u128` value at W128.
    #[inline]
    #[must_use]
    pub const fn apply(value: u128) -> u128 {
        value
    }
}

impl Embed<W80, W80> {
    /// Embed a `u128` value at W80 into a `u128` value at W80.
    #[inline]
    #[must_use]
    pub const fn apply(value: u128) -> u128 {
        value
    }
}

impl Embed<W80, W88> {
    /// Embed a `u128` value at W80 into a `u128` value at W88.
    #[inline]
    #[must_use]
    pub const fn apply(value: u128) -> u128 {
        value
    }
}

impl Embed<W80, W96> {
    /// Embed a `u128` value at W80 into a `u128` value at W96.
    #[inline]
    #[must_use]
    pub const fn apply(value: u128) -> u128 {
        value
    }
}

impl Embed<W80, W104> {
    /// Embed a `u128` value at W80 into a `u128` value at W104.
    #[inline]
    #[must_use]
    pub const fn apply(value: u128) -> u128 {
        value
    }
}

impl Embed<W80, W112> {
    /// Embed a `u128` value at W80 into a `u128` value at W112.
    #[inline]
    #[must_use]
    pub const fn apply(value: u128) -> u128 {
        value
    }
}

impl Embed<W80, W120> {
    /// Embed a `u128` value at W80 into a `u128` value at W120.
    #[inline]
    #[must_use]
    pub const fn apply(value: u128) -> u128 {
        value
    }
}

impl Embed<W80, W128> {
    /// Embed a `u128` value at W80 into a `u128` value at W128.
    #[inline]
    #[must_use]
    pub const fn apply(value: u128) -> u128 {
        value
    }
}

impl Embed<W88, W88> {
    /// Embed a `u128` value at W88 into a `u128` value at W88.
    #[inline]
    #[must_use]
    pub const fn apply(value: u128) -> u128 {
        value
    }
}

impl Embed<W88, W96> {
    /// Embed a `u128` value at W88 into a `u128` value at W96.
    #[inline]
    #[must_use]
    pub const fn apply(value: u128) -> u128 {
        value
    }
}

impl Embed<W88, W104> {
    /// Embed a `u128` value at W88 into a `u128` value at W104.
    #[inline]
    #[must_use]
    pub const fn apply(value: u128) -> u128 {
        value
    }
}

impl Embed<W88, W112> {
    /// Embed a `u128` value at W88 into a `u128` value at W112.
    #[inline]
    #[must_use]
    pub const fn apply(value: u128) -> u128 {
        value
    }
}

impl Embed<W88, W120> {
    /// Embed a `u128` value at W88 into a `u128` value at W120.
    #[inline]
    #[must_use]
    pub const fn apply(value: u128) -> u128 {
        value
    }
}

impl Embed<W88, W128> {
    /// Embed a `u128` value at W88 into a `u128` value at W128.
    #[inline]
    #[must_use]
    pub const fn apply(value: u128) -> u128 {
        value
    }
}

impl Embed<W96, W96> {
    /// Embed a `u128` value at W96 into a `u128` value at W96.
    #[inline]
    #[must_use]
    pub const fn apply(value: u128) -> u128 {
        value
    }
}

impl Embed<W96, W104> {
    /// Embed a `u128` value at W96 into a `u128` value at W104.
    #[inline]
    #[must_use]
    pub const fn apply(value: u128) -> u128 {
        value
    }
}

impl Embed<W96, W112> {
    /// Embed a `u128` value at W96 into a `u128` value at W112.
    #[inline]
    #[must_use]
    pub const fn apply(value: u128) -> u128 {
        value
    }
}

impl Embed<W96, W120> {
    /// Embed a `u128` value at W96 into a `u128` value at W120.
    #[inline]
    #[must_use]
    pub const fn apply(value: u128) -> u128 {
        value
    }
}

impl Embed<W96, W128> {
    /// Embed a `u128` value at W96 into a `u128` value at W128.
    #[inline]
    #[must_use]
    pub const fn apply(value: u128) -> u128 {
        value
    }
}

impl Embed<W104, W104> {
    /// Embed a `u128` value at W104 into a `u128` value at W104.
    #[inline]
    #[must_use]
    pub const fn apply(value: u128) -> u128 {
        value
    }
}

impl Embed<W104, W112> {
    /// Embed a `u128` value at W104 into a `u128` value at W112.
    #[inline]
    #[must_use]
    pub const fn apply(value: u128) -> u128 {
        value
    }
}

impl Embed<W104, W120> {
    /// Embed a `u128` value at W104 into a `u128` value at W120.
    #[inline]
    #[must_use]
    pub const fn apply(value: u128) -> u128 {
        value
    }
}

impl Embed<W104, W128> {
    /// Embed a `u128` value at W104 into a `u128` value at W128.
    #[inline]
    #[must_use]
    pub const fn apply(value: u128) -> u128 {
        value
    }
}

impl Embed<W112, W112> {
    /// Embed a `u128` value at W112 into a `u128` value at W112.
    #[inline]
    #[must_use]
    pub const fn apply(value: u128) -> u128 {
        value
    }
}

impl Embed<W112, W120> {
    /// Embed a `u128` value at W112 into a `u128` value at W120.
    #[inline]
    #[must_use]
    pub const fn apply(value: u128) -> u128 {
        value
    }
}

impl Embed<W112, W128> {
    /// Embed a `u128` value at W112 into a `u128` value at W128.
    #[inline]
    #[must_use]
    pub const fn apply(value: u128) -> u128 {
        value
    }
}

impl Embed<W120, W120> {
    /// Embed a `u128` value at W120 into a `u128` value at W120.
    #[inline]
    #[must_use]
    pub const fn apply(value: u128) -> u128 {
        value
    }
}

impl Embed<W120, W128> {
    /// Embed a `u128` value at W120 into a `u128` value at W128.
    #[inline]
    #[must_use]
    pub const fn apply(value: u128) -> u128 {
        value
    }
}

impl Embed<W128, W128> {
    /// Embed a `u128` value at W128 into a `u128` value at W128.
    #[inline]
    #[must_use]
    pub const fn apply(value: u128) -> u128 {
        value
    }
}

/// v0.2.2 Phase C.3: marker structs for Limbs-backed Witt levels.
/// Each level binds a const-generic `Limbs<N>` width at the type level.
/// W160 marker — 160-bit Witt level, Limbs-backed.
#[derive(Debug, Default, Clone, Copy)]
pub struct W160;

/// W192 marker — 192-bit Witt level, Limbs-backed.
#[derive(Debug, Default, Clone, Copy)]
pub struct W192;

/// W224 marker — 224-bit Witt level, Limbs-backed.
#[derive(Debug, Default, Clone, Copy)]
pub struct W224;

/// W256 marker — 256-bit Witt level, Limbs-backed.
#[derive(Debug, Default, Clone, Copy)]
pub struct W256;

/// W384 marker — 384-bit Witt level, Limbs-backed.
#[derive(Debug, Default, Clone, Copy)]
pub struct W384;

/// W448 marker — 448-bit Witt level, Limbs-backed.
#[derive(Debug, Default, Clone, Copy)]
pub struct W448;

/// W512 marker — 512-bit Witt level, Limbs-backed.
#[derive(Debug, Default, Clone, Copy)]
pub struct W512;

/// W520 marker — 520-bit Witt level, Limbs-backed.
#[derive(Debug, Default, Clone, Copy)]
pub struct W520;

/// W528 marker — 528-bit Witt level, Limbs-backed.
#[derive(Debug, Default, Clone, Copy)]
pub struct W528;

/// W1024 marker — 1024-bit Witt level, Limbs-backed.
#[derive(Debug, Default, Clone, Copy)]
pub struct W1024;

/// W2048 marker — 2048-bit Witt level, Limbs-backed.
#[derive(Debug, Default, Clone, Copy)]
pub struct W2048;

/// W4096 marker — 4096-bit Witt level, Limbs-backed.
#[derive(Debug, Default, Clone, Copy)]
pub struct W4096;

/// W8192 marker — 8192-bit Witt level, Limbs-backed.
#[derive(Debug, Default, Clone, Copy)]
pub struct W8192;

/// W12288 marker — 12288-bit Witt level, Limbs-backed.
#[derive(Debug, Default, Clone, Copy)]
pub struct W12288;

/// W16384 marker — 16384-bit Witt level, Limbs-backed.
#[derive(Debug, Default, Clone, Copy)]
pub struct W16384;

/// W32768 marker — 32768-bit Witt level, Limbs-backed.
#[derive(Debug, Default, Clone, Copy)]
pub struct W32768;

impl RingOp<W160> for Mul<W160> {
    type Operand = Limbs<3>;
    #[inline]
    fn apply(a: Limbs<3>, b: Limbs<3>) -> Limbs<3> {
        a.wrapping_mul(b).mask_high_bits(160)
    }
}

impl RingOp<W160> for Add<W160> {
    type Operand = Limbs<3>;
    #[inline]
    fn apply(a: Limbs<3>, b: Limbs<3>) -> Limbs<3> {
        a.wrapping_add(b).mask_high_bits(160)
    }
}

impl RingOp<W160> for Sub<W160> {
    type Operand = Limbs<3>;
    #[inline]
    fn apply(a: Limbs<3>, b: Limbs<3>) -> Limbs<3> {
        a.wrapping_sub(b).mask_high_bits(160)
    }
}

impl RingOp<W160> for Xor<W160> {
    type Operand = Limbs<3>;
    #[inline]
    fn apply(a: Limbs<3>, b: Limbs<3>) -> Limbs<3> {
        a.xor(b).mask_high_bits(160)
    }
}

impl RingOp<W160> for And<W160> {
    type Operand = Limbs<3>;
    #[inline]
    fn apply(a: Limbs<3>, b: Limbs<3>) -> Limbs<3> {
        a.and(b).mask_high_bits(160)
    }
}

impl RingOp<W160> for Or<W160> {
    type Operand = Limbs<3>;
    #[inline]
    fn apply(a: Limbs<3>, b: Limbs<3>) -> Limbs<3> {
        a.or(b).mask_high_bits(160)
    }
}

impl UnaryRingOp<W160> for Neg<W160> {
    type Operand = Limbs<3>;
    #[inline]
    fn apply(a: Limbs<3>) -> Limbs<3> {
        (Limbs::<3>::zero().wrapping_sub(a)).mask_high_bits(160)
    }
}

impl UnaryRingOp<W160> for BNot<W160> {
    type Operand = Limbs<3>;
    #[inline]
    fn apply(a: Limbs<3>) -> Limbs<3> {
        (a.not()).mask_high_bits(160)
    }
}

impl UnaryRingOp<W160> for Succ<W160> {
    type Operand = Limbs<3>;
    #[inline]
    fn apply(a: Limbs<3>) -> Limbs<3> {
        (a.wrapping_add(Limbs::<3>::from_words([1u64, 0u64, 0u64]))).mask_high_bits(160)
    }
}

impl RingOp<W192> for Mul<W192> {
    type Operand = Limbs<3>;
    #[inline]
    fn apply(a: Limbs<3>, b: Limbs<3>) -> Limbs<3> {
        a.wrapping_mul(b)
    }
}

impl RingOp<W192> for Add<W192> {
    type Operand = Limbs<3>;
    #[inline]
    fn apply(a: Limbs<3>, b: Limbs<3>) -> Limbs<3> {
        a.wrapping_add(b)
    }
}

impl RingOp<W192> for Sub<W192> {
    type Operand = Limbs<3>;
    #[inline]
    fn apply(a: Limbs<3>, b: Limbs<3>) -> Limbs<3> {
        a.wrapping_sub(b)
    }
}

impl RingOp<W192> for Xor<W192> {
    type Operand = Limbs<3>;
    #[inline]
    fn apply(a: Limbs<3>, b: Limbs<3>) -> Limbs<3> {
        a.xor(b)
    }
}

impl RingOp<W192> for And<W192> {
    type Operand = Limbs<3>;
    #[inline]
    fn apply(a: Limbs<3>, b: Limbs<3>) -> Limbs<3> {
        a.and(b)
    }
}

impl RingOp<W192> for Or<W192> {
    type Operand = Limbs<3>;
    #[inline]
    fn apply(a: Limbs<3>, b: Limbs<3>) -> Limbs<3> {
        a.or(b)
    }
}

impl UnaryRingOp<W192> for Neg<W192> {
    type Operand = Limbs<3>;
    #[inline]
    fn apply(a: Limbs<3>) -> Limbs<3> {
        Limbs::<3>::zero().wrapping_sub(a)
    }
}

impl UnaryRingOp<W192> for BNot<W192> {
    type Operand = Limbs<3>;
    #[inline]
    fn apply(a: Limbs<3>) -> Limbs<3> {
        a.not()
    }
}

impl UnaryRingOp<W192> for Succ<W192> {
    type Operand = Limbs<3>;
    #[inline]
    fn apply(a: Limbs<3>) -> Limbs<3> {
        a.wrapping_add(Limbs::<3>::from_words([1u64, 0u64, 0u64]))
    }
}

impl RingOp<W224> for Mul<W224> {
    type Operand = Limbs<4>;
    #[inline]
    fn apply(a: Limbs<4>, b: Limbs<4>) -> Limbs<4> {
        a.wrapping_mul(b).mask_high_bits(224)
    }
}

impl RingOp<W224> for Add<W224> {
    type Operand = Limbs<4>;
    #[inline]
    fn apply(a: Limbs<4>, b: Limbs<4>) -> Limbs<4> {
        a.wrapping_add(b).mask_high_bits(224)
    }
}

impl RingOp<W224> for Sub<W224> {
    type Operand = Limbs<4>;
    #[inline]
    fn apply(a: Limbs<4>, b: Limbs<4>) -> Limbs<4> {
        a.wrapping_sub(b).mask_high_bits(224)
    }
}

impl RingOp<W224> for Xor<W224> {
    type Operand = Limbs<4>;
    #[inline]
    fn apply(a: Limbs<4>, b: Limbs<4>) -> Limbs<4> {
        a.xor(b).mask_high_bits(224)
    }
}

impl RingOp<W224> for And<W224> {
    type Operand = Limbs<4>;
    #[inline]
    fn apply(a: Limbs<4>, b: Limbs<4>) -> Limbs<4> {
        a.and(b).mask_high_bits(224)
    }
}

impl RingOp<W224> for Or<W224> {
    type Operand = Limbs<4>;
    #[inline]
    fn apply(a: Limbs<4>, b: Limbs<4>) -> Limbs<4> {
        a.or(b).mask_high_bits(224)
    }
}

impl UnaryRingOp<W224> for Neg<W224> {
    type Operand = Limbs<4>;
    #[inline]
    fn apply(a: Limbs<4>) -> Limbs<4> {
        (Limbs::<4>::zero().wrapping_sub(a)).mask_high_bits(224)
    }
}

impl UnaryRingOp<W224> for BNot<W224> {
    type Operand = Limbs<4>;
    #[inline]
    fn apply(a: Limbs<4>) -> Limbs<4> {
        (a.not()).mask_high_bits(224)
    }
}

impl UnaryRingOp<W224> for Succ<W224> {
    type Operand = Limbs<4>;
    #[inline]
    fn apply(a: Limbs<4>) -> Limbs<4> {
        (a.wrapping_add(Limbs::<4>::from_words([1u64, 0u64, 0u64, 0u64]))).mask_high_bits(224)
    }
}

impl RingOp<W256> for Mul<W256> {
    type Operand = Limbs<4>;
    #[inline]
    fn apply(a: Limbs<4>, b: Limbs<4>) -> Limbs<4> {
        a.wrapping_mul(b)
    }
}

impl RingOp<W256> for Add<W256> {
    type Operand = Limbs<4>;
    #[inline]
    fn apply(a: Limbs<4>, b: Limbs<4>) -> Limbs<4> {
        a.wrapping_add(b)
    }
}

impl RingOp<W256> for Sub<W256> {
    type Operand = Limbs<4>;
    #[inline]
    fn apply(a: Limbs<4>, b: Limbs<4>) -> Limbs<4> {
        a.wrapping_sub(b)
    }
}

impl RingOp<W256> for Xor<W256> {
    type Operand = Limbs<4>;
    #[inline]
    fn apply(a: Limbs<4>, b: Limbs<4>) -> Limbs<4> {
        a.xor(b)
    }
}

impl RingOp<W256> for And<W256> {
    type Operand = Limbs<4>;
    #[inline]
    fn apply(a: Limbs<4>, b: Limbs<4>) -> Limbs<4> {
        a.and(b)
    }
}

impl RingOp<W256> for Or<W256> {
    type Operand = Limbs<4>;
    #[inline]
    fn apply(a: Limbs<4>, b: Limbs<4>) -> Limbs<4> {
        a.or(b)
    }
}

impl UnaryRingOp<W256> for Neg<W256> {
    type Operand = Limbs<4>;
    #[inline]
    fn apply(a: Limbs<4>) -> Limbs<4> {
        Limbs::<4>::zero().wrapping_sub(a)
    }
}

impl UnaryRingOp<W256> for BNot<W256> {
    type Operand = Limbs<4>;
    #[inline]
    fn apply(a: Limbs<4>) -> Limbs<4> {
        a.not()
    }
}

impl UnaryRingOp<W256> for Succ<W256> {
    type Operand = Limbs<4>;
    #[inline]
    fn apply(a: Limbs<4>) -> Limbs<4> {
        a.wrapping_add(Limbs::<4>::from_words([1u64, 0u64, 0u64, 0u64]))
    }
}

impl RingOp<W384> for Mul<W384> {
    type Operand = Limbs<6>;
    #[inline]
    fn apply(a: Limbs<6>, b: Limbs<6>) -> Limbs<6> {
        a.wrapping_mul(b)
    }
}

impl RingOp<W384> for Add<W384> {
    type Operand = Limbs<6>;
    #[inline]
    fn apply(a: Limbs<6>, b: Limbs<6>) -> Limbs<6> {
        a.wrapping_add(b)
    }
}

impl RingOp<W384> for Sub<W384> {
    type Operand = Limbs<6>;
    #[inline]
    fn apply(a: Limbs<6>, b: Limbs<6>) -> Limbs<6> {
        a.wrapping_sub(b)
    }
}

impl RingOp<W384> for Xor<W384> {
    type Operand = Limbs<6>;
    #[inline]
    fn apply(a: Limbs<6>, b: Limbs<6>) -> Limbs<6> {
        a.xor(b)
    }
}

impl RingOp<W384> for And<W384> {
    type Operand = Limbs<6>;
    #[inline]
    fn apply(a: Limbs<6>, b: Limbs<6>) -> Limbs<6> {
        a.and(b)
    }
}

impl RingOp<W384> for Or<W384> {
    type Operand = Limbs<6>;
    #[inline]
    fn apply(a: Limbs<6>, b: Limbs<6>) -> Limbs<6> {
        a.or(b)
    }
}

impl UnaryRingOp<W384> for Neg<W384> {
    type Operand = Limbs<6>;
    #[inline]
    fn apply(a: Limbs<6>) -> Limbs<6> {
        Limbs::<6>::zero().wrapping_sub(a)
    }
}

impl UnaryRingOp<W384> for BNot<W384> {
    type Operand = Limbs<6>;
    #[inline]
    fn apply(a: Limbs<6>) -> Limbs<6> {
        a.not()
    }
}

impl UnaryRingOp<W384> for Succ<W384> {
    type Operand = Limbs<6>;
    #[inline]
    fn apply(a: Limbs<6>) -> Limbs<6> {
        a.wrapping_add(Limbs::<6>::from_words([1u64, 0u64, 0u64, 0u64, 0u64, 0u64]))
    }
}

impl RingOp<W448> for Mul<W448> {
    type Operand = Limbs<7>;
    #[inline]
    fn apply(a: Limbs<7>, b: Limbs<7>) -> Limbs<7> {
        a.wrapping_mul(b)
    }
}

impl RingOp<W448> for Add<W448> {
    type Operand = Limbs<7>;
    #[inline]
    fn apply(a: Limbs<7>, b: Limbs<7>) -> Limbs<7> {
        a.wrapping_add(b)
    }
}

impl RingOp<W448> for Sub<W448> {
    type Operand = Limbs<7>;
    #[inline]
    fn apply(a: Limbs<7>, b: Limbs<7>) -> Limbs<7> {
        a.wrapping_sub(b)
    }
}

impl RingOp<W448> for Xor<W448> {
    type Operand = Limbs<7>;
    #[inline]
    fn apply(a: Limbs<7>, b: Limbs<7>) -> Limbs<7> {
        a.xor(b)
    }
}

impl RingOp<W448> for And<W448> {
    type Operand = Limbs<7>;
    #[inline]
    fn apply(a: Limbs<7>, b: Limbs<7>) -> Limbs<7> {
        a.and(b)
    }
}

impl RingOp<W448> for Or<W448> {
    type Operand = Limbs<7>;
    #[inline]
    fn apply(a: Limbs<7>, b: Limbs<7>) -> Limbs<7> {
        a.or(b)
    }
}

impl UnaryRingOp<W448> for Neg<W448> {
    type Operand = Limbs<7>;
    #[inline]
    fn apply(a: Limbs<7>) -> Limbs<7> {
        Limbs::<7>::zero().wrapping_sub(a)
    }
}

impl UnaryRingOp<W448> for BNot<W448> {
    type Operand = Limbs<7>;
    #[inline]
    fn apply(a: Limbs<7>) -> Limbs<7> {
        a.not()
    }
}

impl UnaryRingOp<W448> for Succ<W448> {
    type Operand = Limbs<7>;
    #[inline]
    fn apply(a: Limbs<7>) -> Limbs<7> {
        a.wrapping_add(Limbs::<7>::from_words([
            1u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64,
        ]))
    }
}

impl RingOp<W512> for Mul<W512> {
    type Operand = Limbs<8>;
    #[inline]
    fn apply(a: Limbs<8>, b: Limbs<8>) -> Limbs<8> {
        a.wrapping_mul(b)
    }
}

impl RingOp<W512> for Add<W512> {
    type Operand = Limbs<8>;
    #[inline]
    fn apply(a: Limbs<8>, b: Limbs<8>) -> Limbs<8> {
        a.wrapping_add(b)
    }
}

impl RingOp<W512> for Sub<W512> {
    type Operand = Limbs<8>;
    #[inline]
    fn apply(a: Limbs<8>, b: Limbs<8>) -> Limbs<8> {
        a.wrapping_sub(b)
    }
}

impl RingOp<W512> for Xor<W512> {
    type Operand = Limbs<8>;
    #[inline]
    fn apply(a: Limbs<8>, b: Limbs<8>) -> Limbs<8> {
        a.xor(b)
    }
}

impl RingOp<W512> for And<W512> {
    type Operand = Limbs<8>;
    #[inline]
    fn apply(a: Limbs<8>, b: Limbs<8>) -> Limbs<8> {
        a.and(b)
    }
}

impl RingOp<W512> for Or<W512> {
    type Operand = Limbs<8>;
    #[inline]
    fn apply(a: Limbs<8>, b: Limbs<8>) -> Limbs<8> {
        a.or(b)
    }
}

impl UnaryRingOp<W512> for Neg<W512> {
    type Operand = Limbs<8>;
    #[inline]
    fn apply(a: Limbs<8>) -> Limbs<8> {
        Limbs::<8>::zero().wrapping_sub(a)
    }
}

impl UnaryRingOp<W512> for BNot<W512> {
    type Operand = Limbs<8>;
    #[inline]
    fn apply(a: Limbs<8>) -> Limbs<8> {
        a.not()
    }
}

impl UnaryRingOp<W512> for Succ<W512> {
    type Operand = Limbs<8>;
    #[inline]
    fn apply(a: Limbs<8>) -> Limbs<8> {
        a.wrapping_add(Limbs::<8>::from_words([
            1u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64,
        ]))
    }
}

impl RingOp<W520> for Mul<W520> {
    type Operand = Limbs<9>;
    #[inline]
    fn apply(a: Limbs<9>, b: Limbs<9>) -> Limbs<9> {
        a.wrapping_mul(b).mask_high_bits(520)
    }
}

impl RingOp<W520> for Add<W520> {
    type Operand = Limbs<9>;
    #[inline]
    fn apply(a: Limbs<9>, b: Limbs<9>) -> Limbs<9> {
        a.wrapping_add(b).mask_high_bits(520)
    }
}

impl RingOp<W520> for Sub<W520> {
    type Operand = Limbs<9>;
    #[inline]
    fn apply(a: Limbs<9>, b: Limbs<9>) -> Limbs<9> {
        a.wrapping_sub(b).mask_high_bits(520)
    }
}

impl RingOp<W520> for Xor<W520> {
    type Operand = Limbs<9>;
    #[inline]
    fn apply(a: Limbs<9>, b: Limbs<9>) -> Limbs<9> {
        a.xor(b).mask_high_bits(520)
    }
}

impl RingOp<W520> for And<W520> {
    type Operand = Limbs<9>;
    #[inline]
    fn apply(a: Limbs<9>, b: Limbs<9>) -> Limbs<9> {
        a.and(b).mask_high_bits(520)
    }
}

impl RingOp<W520> for Or<W520> {
    type Operand = Limbs<9>;
    #[inline]
    fn apply(a: Limbs<9>, b: Limbs<9>) -> Limbs<9> {
        a.or(b).mask_high_bits(520)
    }
}

impl UnaryRingOp<W520> for Neg<W520> {
    type Operand = Limbs<9>;
    #[inline]
    fn apply(a: Limbs<9>) -> Limbs<9> {
        (Limbs::<9>::zero().wrapping_sub(a)).mask_high_bits(520)
    }
}

impl UnaryRingOp<W520> for BNot<W520> {
    type Operand = Limbs<9>;
    #[inline]
    fn apply(a: Limbs<9>) -> Limbs<9> {
        (a.not()).mask_high_bits(520)
    }
}

impl UnaryRingOp<W520> for Succ<W520> {
    type Operand = Limbs<9>;
    #[inline]
    fn apply(a: Limbs<9>) -> Limbs<9> {
        (a.wrapping_add(Limbs::<9>::from_words([
            1u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64,
        ])))
        .mask_high_bits(520)
    }
}

impl RingOp<W528> for Mul<W528> {
    type Operand = Limbs<9>;
    #[inline]
    fn apply(a: Limbs<9>, b: Limbs<9>) -> Limbs<9> {
        a.wrapping_mul(b).mask_high_bits(528)
    }
}

impl RingOp<W528> for Add<W528> {
    type Operand = Limbs<9>;
    #[inline]
    fn apply(a: Limbs<9>, b: Limbs<9>) -> Limbs<9> {
        a.wrapping_add(b).mask_high_bits(528)
    }
}

impl RingOp<W528> for Sub<W528> {
    type Operand = Limbs<9>;
    #[inline]
    fn apply(a: Limbs<9>, b: Limbs<9>) -> Limbs<9> {
        a.wrapping_sub(b).mask_high_bits(528)
    }
}

impl RingOp<W528> for Xor<W528> {
    type Operand = Limbs<9>;
    #[inline]
    fn apply(a: Limbs<9>, b: Limbs<9>) -> Limbs<9> {
        a.xor(b).mask_high_bits(528)
    }
}

impl RingOp<W528> for And<W528> {
    type Operand = Limbs<9>;
    #[inline]
    fn apply(a: Limbs<9>, b: Limbs<9>) -> Limbs<9> {
        a.and(b).mask_high_bits(528)
    }
}

impl RingOp<W528> for Or<W528> {
    type Operand = Limbs<9>;
    #[inline]
    fn apply(a: Limbs<9>, b: Limbs<9>) -> Limbs<9> {
        a.or(b).mask_high_bits(528)
    }
}

impl UnaryRingOp<W528> for Neg<W528> {
    type Operand = Limbs<9>;
    #[inline]
    fn apply(a: Limbs<9>) -> Limbs<9> {
        (Limbs::<9>::zero().wrapping_sub(a)).mask_high_bits(528)
    }
}

impl UnaryRingOp<W528> for BNot<W528> {
    type Operand = Limbs<9>;
    #[inline]
    fn apply(a: Limbs<9>) -> Limbs<9> {
        (a.not()).mask_high_bits(528)
    }
}

impl UnaryRingOp<W528> for Succ<W528> {
    type Operand = Limbs<9>;
    #[inline]
    fn apply(a: Limbs<9>) -> Limbs<9> {
        (a.wrapping_add(Limbs::<9>::from_words([
            1u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64,
        ])))
        .mask_high_bits(528)
    }
}

impl RingOp<W1024> for Mul<W1024> {
    type Operand = Limbs<16>;
    #[inline]
    fn apply(a: Limbs<16>, b: Limbs<16>) -> Limbs<16> {
        a.wrapping_mul(b)
    }
}

impl RingOp<W1024> for Add<W1024> {
    type Operand = Limbs<16>;
    #[inline]
    fn apply(a: Limbs<16>, b: Limbs<16>) -> Limbs<16> {
        a.wrapping_add(b)
    }
}

impl RingOp<W1024> for Sub<W1024> {
    type Operand = Limbs<16>;
    #[inline]
    fn apply(a: Limbs<16>, b: Limbs<16>) -> Limbs<16> {
        a.wrapping_sub(b)
    }
}

impl RingOp<W1024> for Xor<W1024> {
    type Operand = Limbs<16>;
    #[inline]
    fn apply(a: Limbs<16>, b: Limbs<16>) -> Limbs<16> {
        a.xor(b)
    }
}

impl RingOp<W1024> for And<W1024> {
    type Operand = Limbs<16>;
    #[inline]
    fn apply(a: Limbs<16>, b: Limbs<16>) -> Limbs<16> {
        a.and(b)
    }
}

impl RingOp<W1024> for Or<W1024> {
    type Operand = Limbs<16>;
    #[inline]
    fn apply(a: Limbs<16>, b: Limbs<16>) -> Limbs<16> {
        a.or(b)
    }
}

impl UnaryRingOp<W1024> for Neg<W1024> {
    type Operand = Limbs<16>;
    #[inline]
    fn apply(a: Limbs<16>) -> Limbs<16> {
        Limbs::<16>::zero().wrapping_sub(a)
    }
}

impl UnaryRingOp<W1024> for BNot<W1024> {
    type Operand = Limbs<16>;
    #[inline]
    fn apply(a: Limbs<16>) -> Limbs<16> {
        a.not()
    }
}

impl UnaryRingOp<W1024> for Succ<W1024> {
    type Operand = Limbs<16>;
    #[inline]
    fn apply(a: Limbs<16>) -> Limbs<16> {
        a.wrapping_add(Limbs::<16>::from_words([
            1u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64,
            0u64, 0u64,
        ]))
    }
}

impl RingOp<W2048> for Mul<W2048> {
    type Operand = Limbs<32>;
    #[inline]
    fn apply(a: Limbs<32>, b: Limbs<32>) -> Limbs<32> {
        a.wrapping_mul(b)
    }
}

impl RingOp<W2048> for Add<W2048> {
    type Operand = Limbs<32>;
    #[inline]
    fn apply(a: Limbs<32>, b: Limbs<32>) -> Limbs<32> {
        a.wrapping_add(b)
    }
}

impl RingOp<W2048> for Sub<W2048> {
    type Operand = Limbs<32>;
    #[inline]
    fn apply(a: Limbs<32>, b: Limbs<32>) -> Limbs<32> {
        a.wrapping_sub(b)
    }
}

impl RingOp<W2048> for Xor<W2048> {
    type Operand = Limbs<32>;
    #[inline]
    fn apply(a: Limbs<32>, b: Limbs<32>) -> Limbs<32> {
        a.xor(b)
    }
}

impl RingOp<W2048> for And<W2048> {
    type Operand = Limbs<32>;
    #[inline]
    fn apply(a: Limbs<32>, b: Limbs<32>) -> Limbs<32> {
        a.and(b)
    }
}

impl RingOp<W2048> for Or<W2048> {
    type Operand = Limbs<32>;
    #[inline]
    fn apply(a: Limbs<32>, b: Limbs<32>) -> Limbs<32> {
        a.or(b)
    }
}

impl UnaryRingOp<W2048> for Neg<W2048> {
    type Operand = Limbs<32>;
    #[inline]
    fn apply(a: Limbs<32>) -> Limbs<32> {
        Limbs::<32>::zero().wrapping_sub(a)
    }
}

impl UnaryRingOp<W2048> for BNot<W2048> {
    type Operand = Limbs<32>;
    #[inline]
    fn apply(a: Limbs<32>) -> Limbs<32> {
        a.not()
    }
}

impl UnaryRingOp<W2048> for Succ<W2048> {
    type Operand = Limbs<32>;
    #[inline]
    fn apply(a: Limbs<32>) -> Limbs<32> {
        a.wrapping_add(Limbs::<32>::from_words([
            1u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64,
            0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64,
            0u64, 0u64, 0u64, 0u64,
        ]))
    }
}

impl RingOp<W4096> for Mul<W4096> {
    type Operand = Limbs<64>;
    #[inline]
    fn apply(a: Limbs<64>, b: Limbs<64>) -> Limbs<64> {
        a.wrapping_mul(b)
    }
}

impl RingOp<W4096> for Add<W4096> {
    type Operand = Limbs<64>;
    #[inline]
    fn apply(a: Limbs<64>, b: Limbs<64>) -> Limbs<64> {
        a.wrapping_add(b)
    }
}

impl RingOp<W4096> for Sub<W4096> {
    type Operand = Limbs<64>;
    #[inline]
    fn apply(a: Limbs<64>, b: Limbs<64>) -> Limbs<64> {
        a.wrapping_sub(b)
    }
}

impl RingOp<W4096> for Xor<W4096> {
    type Operand = Limbs<64>;
    #[inline]
    fn apply(a: Limbs<64>, b: Limbs<64>) -> Limbs<64> {
        a.xor(b)
    }
}

impl RingOp<W4096> for And<W4096> {
    type Operand = Limbs<64>;
    #[inline]
    fn apply(a: Limbs<64>, b: Limbs<64>) -> Limbs<64> {
        a.and(b)
    }
}

impl RingOp<W4096> for Or<W4096> {
    type Operand = Limbs<64>;
    #[inline]
    fn apply(a: Limbs<64>, b: Limbs<64>) -> Limbs<64> {
        a.or(b)
    }
}

impl UnaryRingOp<W4096> for Neg<W4096> {
    type Operand = Limbs<64>;
    #[inline]
    fn apply(a: Limbs<64>) -> Limbs<64> {
        Limbs::<64>::zero().wrapping_sub(a)
    }
}

impl UnaryRingOp<W4096> for BNot<W4096> {
    type Operand = Limbs<64>;
    #[inline]
    fn apply(a: Limbs<64>) -> Limbs<64> {
        a.not()
    }
}

impl UnaryRingOp<W4096> for Succ<W4096> {
    type Operand = Limbs<64>;
    #[inline]
    fn apply(a: Limbs<64>) -> Limbs<64> {
        a.wrapping_add(Limbs::<64>::from_words([
            1u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64,
            0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64,
            0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64,
            0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64,
            0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64,
        ]))
    }
}

impl RingOp<W8192> for Mul<W8192> {
    type Operand = Limbs<128>;
    #[inline]
    fn apply(a: Limbs<128>, b: Limbs<128>) -> Limbs<128> {
        a.wrapping_mul(b)
    }
}

impl RingOp<W8192> for Add<W8192> {
    type Operand = Limbs<128>;
    #[inline]
    fn apply(a: Limbs<128>, b: Limbs<128>) -> Limbs<128> {
        a.wrapping_add(b)
    }
}

impl RingOp<W8192> for Sub<W8192> {
    type Operand = Limbs<128>;
    #[inline]
    fn apply(a: Limbs<128>, b: Limbs<128>) -> Limbs<128> {
        a.wrapping_sub(b)
    }
}

impl RingOp<W8192> for Xor<W8192> {
    type Operand = Limbs<128>;
    #[inline]
    fn apply(a: Limbs<128>, b: Limbs<128>) -> Limbs<128> {
        a.xor(b)
    }
}

impl RingOp<W8192> for And<W8192> {
    type Operand = Limbs<128>;
    #[inline]
    fn apply(a: Limbs<128>, b: Limbs<128>) -> Limbs<128> {
        a.and(b)
    }
}

impl RingOp<W8192> for Or<W8192> {
    type Operand = Limbs<128>;
    #[inline]
    fn apply(a: Limbs<128>, b: Limbs<128>) -> Limbs<128> {
        a.or(b)
    }
}

impl UnaryRingOp<W8192> for Neg<W8192> {
    type Operand = Limbs<128>;
    #[inline]
    fn apply(a: Limbs<128>) -> Limbs<128> {
        Limbs::<128>::zero().wrapping_sub(a)
    }
}

impl UnaryRingOp<W8192> for BNot<W8192> {
    type Operand = Limbs<128>;
    #[inline]
    fn apply(a: Limbs<128>) -> Limbs<128> {
        a.not()
    }
}

impl UnaryRingOp<W8192> for Succ<W8192> {
    type Operand = Limbs<128>;
    #[inline]
    fn apply(a: Limbs<128>) -> Limbs<128> {
        a.wrapping_add(Limbs::<128>::from_words([
            1u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64,
            0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64,
            0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64,
            0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64,
            0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64,
            0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64,
            0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64,
            0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64,
            0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64,
            0u64, 0u64,
        ]))
    }
}

impl RingOp<W12288> for Mul<W12288> {
    type Operand = Limbs<192>;
    #[inline]
    fn apply(a: Limbs<192>, b: Limbs<192>) -> Limbs<192> {
        a.wrapping_mul(b)
    }
}

impl RingOp<W12288> for Add<W12288> {
    type Operand = Limbs<192>;
    #[inline]
    fn apply(a: Limbs<192>, b: Limbs<192>) -> Limbs<192> {
        a.wrapping_add(b)
    }
}

impl RingOp<W12288> for Sub<W12288> {
    type Operand = Limbs<192>;
    #[inline]
    fn apply(a: Limbs<192>, b: Limbs<192>) -> Limbs<192> {
        a.wrapping_sub(b)
    }
}

impl RingOp<W12288> for Xor<W12288> {
    type Operand = Limbs<192>;
    #[inline]
    fn apply(a: Limbs<192>, b: Limbs<192>) -> Limbs<192> {
        a.xor(b)
    }
}

impl RingOp<W12288> for And<W12288> {
    type Operand = Limbs<192>;
    #[inline]
    fn apply(a: Limbs<192>, b: Limbs<192>) -> Limbs<192> {
        a.and(b)
    }
}

impl RingOp<W12288> for Or<W12288> {
    type Operand = Limbs<192>;
    #[inline]
    fn apply(a: Limbs<192>, b: Limbs<192>) -> Limbs<192> {
        a.or(b)
    }
}

impl UnaryRingOp<W12288> for Neg<W12288> {
    type Operand = Limbs<192>;
    #[inline]
    fn apply(a: Limbs<192>) -> Limbs<192> {
        Limbs::<192>::zero().wrapping_sub(a)
    }
}

impl UnaryRingOp<W12288> for BNot<W12288> {
    type Operand = Limbs<192>;
    #[inline]
    fn apply(a: Limbs<192>) -> Limbs<192> {
        a.not()
    }
}

impl UnaryRingOp<W12288> for Succ<W12288> {
    type Operand = Limbs<192>;
    #[inline]
    fn apply(a: Limbs<192>) -> Limbs<192> {
        a.wrapping_add(Limbs::<192>::from_words([
            1u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64,
            0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64,
            0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64,
            0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64,
            0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64,
            0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64,
            0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64,
            0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64,
            0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64,
            0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64,
            0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64,
            0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64,
            0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64,
            0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64,
        ]))
    }
}

impl RingOp<W16384> for Mul<W16384> {
    type Operand = Limbs<256>;
    #[inline]
    fn apply(a: Limbs<256>, b: Limbs<256>) -> Limbs<256> {
        a.wrapping_mul(b)
    }
}

impl RingOp<W16384> for Add<W16384> {
    type Operand = Limbs<256>;
    #[inline]
    fn apply(a: Limbs<256>, b: Limbs<256>) -> Limbs<256> {
        a.wrapping_add(b)
    }
}

impl RingOp<W16384> for Sub<W16384> {
    type Operand = Limbs<256>;
    #[inline]
    fn apply(a: Limbs<256>, b: Limbs<256>) -> Limbs<256> {
        a.wrapping_sub(b)
    }
}

impl RingOp<W16384> for Xor<W16384> {
    type Operand = Limbs<256>;
    #[inline]
    fn apply(a: Limbs<256>, b: Limbs<256>) -> Limbs<256> {
        a.xor(b)
    }
}

impl RingOp<W16384> for And<W16384> {
    type Operand = Limbs<256>;
    #[inline]
    fn apply(a: Limbs<256>, b: Limbs<256>) -> Limbs<256> {
        a.and(b)
    }
}

impl RingOp<W16384> for Or<W16384> {
    type Operand = Limbs<256>;
    #[inline]
    fn apply(a: Limbs<256>, b: Limbs<256>) -> Limbs<256> {
        a.or(b)
    }
}

impl UnaryRingOp<W16384> for Neg<W16384> {
    type Operand = Limbs<256>;
    #[inline]
    fn apply(a: Limbs<256>) -> Limbs<256> {
        Limbs::<256>::zero().wrapping_sub(a)
    }
}

impl UnaryRingOp<W16384> for BNot<W16384> {
    type Operand = Limbs<256>;
    #[inline]
    fn apply(a: Limbs<256>) -> Limbs<256> {
        a.not()
    }
}

impl UnaryRingOp<W16384> for Succ<W16384> {
    type Operand = Limbs<256>;
    #[inline]
    fn apply(a: Limbs<256>) -> Limbs<256> {
        a.wrapping_add(Limbs::<256>::from_words([
            1u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64,
            0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64,
            0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64,
            0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64,
            0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64,
            0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64,
            0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64,
            0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64,
            0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64,
            0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64,
            0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64,
            0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64,
            0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64,
            0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64,
            0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64,
            0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64,
            0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64,
            0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64,
            0u64, 0u64, 0u64, 0u64,
        ]))
    }
}

impl RingOp<W32768> for Mul<W32768> {
    type Operand = Limbs<512>;
    #[inline]
    fn apply(a: Limbs<512>, b: Limbs<512>) -> Limbs<512> {
        a.wrapping_mul(b)
    }
}

impl RingOp<W32768> for Add<W32768> {
    type Operand = Limbs<512>;
    #[inline]
    fn apply(a: Limbs<512>, b: Limbs<512>) -> Limbs<512> {
        a.wrapping_add(b)
    }
}

impl RingOp<W32768> for Sub<W32768> {
    type Operand = Limbs<512>;
    #[inline]
    fn apply(a: Limbs<512>, b: Limbs<512>) -> Limbs<512> {
        a.wrapping_sub(b)
    }
}

impl RingOp<W32768> for Xor<W32768> {
    type Operand = Limbs<512>;
    #[inline]
    fn apply(a: Limbs<512>, b: Limbs<512>) -> Limbs<512> {
        a.xor(b)
    }
}

impl RingOp<W32768> for And<W32768> {
    type Operand = Limbs<512>;
    #[inline]
    fn apply(a: Limbs<512>, b: Limbs<512>) -> Limbs<512> {
        a.and(b)
    }
}

impl RingOp<W32768> for Or<W32768> {
    type Operand = Limbs<512>;
    #[inline]
    fn apply(a: Limbs<512>, b: Limbs<512>) -> Limbs<512> {
        a.or(b)
    }
}

impl UnaryRingOp<W32768> for Neg<W32768> {
    type Operand = Limbs<512>;
    #[inline]
    fn apply(a: Limbs<512>) -> Limbs<512> {
        Limbs::<512>::zero().wrapping_sub(a)
    }
}

impl UnaryRingOp<W32768> for BNot<W32768> {
    type Operand = Limbs<512>;
    #[inline]
    fn apply(a: Limbs<512>) -> Limbs<512> {
        a.not()
    }
}

impl UnaryRingOp<W32768> for Succ<W32768> {
    type Operand = Limbs<512>;
    #[inline]
    fn apply(a: Limbs<512>) -> Limbs<512> {
        a.wrapping_add(Limbs::<512>::from_words([
            1u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64,
            0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64,
            0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64,
            0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64,
            0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64,
            0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64,
            0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64,
            0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64,
            0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64,
            0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64,
            0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64,
            0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64,
            0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64,
            0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64,
            0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64,
            0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64,
            0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64,
            0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64,
            0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64,
            0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64,
            0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64,
            0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64,
            0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64,
            0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64,
            0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64,
            0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64,
            0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64,
            0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64,
            0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64,
            0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64,
            0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64,
            0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64,
            0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64,
            0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64,
            0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64,
            0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64,
            0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64,
        ]))
    }
}

/// Phase L.2 (target §4.5): `const_ring_eval_w{n}` helpers for Limbs-backed
/// Witt levels. Each helper runs a `PrimitiveOp` over two `Limbs<N>` operands
/// and applies the level's bit-width mask to the result.
/// These helpers are always const-fn; whether `rustc` can complete a specific
/// compile-time evaluation within the developer's budget is a function of the
/// invocation (see target §4.5 Q2 practicality table).
#[inline]
#[must_use]
pub const fn const_ring_eval_w160(op: PrimitiveOp, a: Limbs<3>, b: Limbs<3>) -> Limbs<3> {
    let raw = match op {
        PrimitiveOp::Add => a.wrapping_add(b),
        PrimitiveOp::Sub => a.wrapping_sub(b),
        PrimitiveOp::Mul => a.wrapping_mul(b),
        PrimitiveOp::And => a.and(b),
        PrimitiveOp::Or => a.or(b),
        PrimitiveOp::Xor => a.xor(b),
        PrimitiveOp::Neg => Limbs::<3>::zero().wrapping_sub(a),
        PrimitiveOp::Bnot => a.not(),
        PrimitiveOp::Succ => a.wrapping_add(limbs_one_3()),
        PrimitiveOp::Pred => a.wrapping_sub(limbs_one_3()),
    };
    raw.mask_high_bits(160)
}

#[inline]
#[must_use]
pub const fn const_ring_eval_w192(op: PrimitiveOp, a: Limbs<3>, b: Limbs<3>) -> Limbs<3> {
    match op {
        PrimitiveOp::Add => a.wrapping_add(b),
        PrimitiveOp::Sub => a.wrapping_sub(b),
        PrimitiveOp::Mul => a.wrapping_mul(b),
        PrimitiveOp::And => a.and(b),
        PrimitiveOp::Or => a.or(b),
        PrimitiveOp::Xor => a.xor(b),
        PrimitiveOp::Neg => Limbs::<3>::zero().wrapping_sub(a),
        PrimitiveOp::Bnot => a.not(),
        PrimitiveOp::Succ => a.wrapping_add(limbs_one_3()),
        PrimitiveOp::Pred => a.wrapping_sub(limbs_one_3()),
    }
}

#[inline]
#[must_use]
pub const fn const_ring_eval_w224(op: PrimitiveOp, a: Limbs<4>, b: Limbs<4>) -> Limbs<4> {
    let raw = match op {
        PrimitiveOp::Add => a.wrapping_add(b),
        PrimitiveOp::Sub => a.wrapping_sub(b),
        PrimitiveOp::Mul => a.wrapping_mul(b),
        PrimitiveOp::And => a.and(b),
        PrimitiveOp::Or => a.or(b),
        PrimitiveOp::Xor => a.xor(b),
        PrimitiveOp::Neg => Limbs::<4>::zero().wrapping_sub(a),
        PrimitiveOp::Bnot => a.not(),
        PrimitiveOp::Succ => a.wrapping_add(limbs_one_4()),
        PrimitiveOp::Pred => a.wrapping_sub(limbs_one_4()),
    };
    raw.mask_high_bits(224)
}

#[inline]
#[must_use]
pub const fn const_ring_eval_w256(op: PrimitiveOp, a: Limbs<4>, b: Limbs<4>) -> Limbs<4> {
    match op {
        PrimitiveOp::Add => a.wrapping_add(b),
        PrimitiveOp::Sub => a.wrapping_sub(b),
        PrimitiveOp::Mul => a.wrapping_mul(b),
        PrimitiveOp::And => a.and(b),
        PrimitiveOp::Or => a.or(b),
        PrimitiveOp::Xor => a.xor(b),
        PrimitiveOp::Neg => Limbs::<4>::zero().wrapping_sub(a),
        PrimitiveOp::Bnot => a.not(),
        PrimitiveOp::Succ => a.wrapping_add(limbs_one_4()),
        PrimitiveOp::Pred => a.wrapping_sub(limbs_one_4()),
    }
}

#[inline]
#[must_use]
pub const fn const_ring_eval_w384(op: PrimitiveOp, a: Limbs<6>, b: Limbs<6>) -> Limbs<6> {
    match op {
        PrimitiveOp::Add => a.wrapping_add(b),
        PrimitiveOp::Sub => a.wrapping_sub(b),
        PrimitiveOp::Mul => a.wrapping_mul(b),
        PrimitiveOp::And => a.and(b),
        PrimitiveOp::Or => a.or(b),
        PrimitiveOp::Xor => a.xor(b),
        PrimitiveOp::Neg => Limbs::<6>::zero().wrapping_sub(a),
        PrimitiveOp::Bnot => a.not(),
        PrimitiveOp::Succ => a.wrapping_add(limbs_one_6()),
        PrimitiveOp::Pred => a.wrapping_sub(limbs_one_6()),
    }
}

#[inline]
#[must_use]
pub const fn const_ring_eval_w448(op: PrimitiveOp, a: Limbs<7>, b: Limbs<7>) -> Limbs<7> {
    match op {
        PrimitiveOp::Add => a.wrapping_add(b),
        PrimitiveOp::Sub => a.wrapping_sub(b),
        PrimitiveOp::Mul => a.wrapping_mul(b),
        PrimitiveOp::And => a.and(b),
        PrimitiveOp::Or => a.or(b),
        PrimitiveOp::Xor => a.xor(b),
        PrimitiveOp::Neg => Limbs::<7>::zero().wrapping_sub(a),
        PrimitiveOp::Bnot => a.not(),
        PrimitiveOp::Succ => a.wrapping_add(limbs_one_7()),
        PrimitiveOp::Pred => a.wrapping_sub(limbs_one_7()),
    }
}

#[inline]
#[must_use]
pub const fn const_ring_eval_w512(op: PrimitiveOp, a: Limbs<8>, b: Limbs<8>) -> Limbs<8> {
    match op {
        PrimitiveOp::Add => a.wrapping_add(b),
        PrimitiveOp::Sub => a.wrapping_sub(b),
        PrimitiveOp::Mul => a.wrapping_mul(b),
        PrimitiveOp::And => a.and(b),
        PrimitiveOp::Or => a.or(b),
        PrimitiveOp::Xor => a.xor(b),
        PrimitiveOp::Neg => Limbs::<8>::zero().wrapping_sub(a),
        PrimitiveOp::Bnot => a.not(),
        PrimitiveOp::Succ => a.wrapping_add(limbs_one_8()),
        PrimitiveOp::Pred => a.wrapping_sub(limbs_one_8()),
    }
}

#[inline]
#[must_use]
pub const fn const_ring_eval_w520(op: PrimitiveOp, a: Limbs<9>, b: Limbs<9>) -> Limbs<9> {
    let raw = match op {
        PrimitiveOp::Add => a.wrapping_add(b),
        PrimitiveOp::Sub => a.wrapping_sub(b),
        PrimitiveOp::Mul => a.wrapping_mul(b),
        PrimitiveOp::And => a.and(b),
        PrimitiveOp::Or => a.or(b),
        PrimitiveOp::Xor => a.xor(b),
        PrimitiveOp::Neg => Limbs::<9>::zero().wrapping_sub(a),
        PrimitiveOp::Bnot => a.not(),
        PrimitiveOp::Succ => a.wrapping_add(limbs_one_9()),
        PrimitiveOp::Pred => a.wrapping_sub(limbs_one_9()),
    };
    raw.mask_high_bits(520)
}

#[inline]
#[must_use]
pub const fn const_ring_eval_w528(op: PrimitiveOp, a: Limbs<9>, b: Limbs<9>) -> Limbs<9> {
    let raw = match op {
        PrimitiveOp::Add => a.wrapping_add(b),
        PrimitiveOp::Sub => a.wrapping_sub(b),
        PrimitiveOp::Mul => a.wrapping_mul(b),
        PrimitiveOp::And => a.and(b),
        PrimitiveOp::Or => a.or(b),
        PrimitiveOp::Xor => a.xor(b),
        PrimitiveOp::Neg => Limbs::<9>::zero().wrapping_sub(a),
        PrimitiveOp::Bnot => a.not(),
        PrimitiveOp::Succ => a.wrapping_add(limbs_one_9()),
        PrimitiveOp::Pred => a.wrapping_sub(limbs_one_9()),
    };
    raw.mask_high_bits(528)
}

#[inline]
#[must_use]
pub const fn const_ring_eval_w1024(op: PrimitiveOp, a: Limbs<16>, b: Limbs<16>) -> Limbs<16> {
    match op {
        PrimitiveOp::Add => a.wrapping_add(b),
        PrimitiveOp::Sub => a.wrapping_sub(b),
        PrimitiveOp::Mul => a.wrapping_mul(b),
        PrimitiveOp::And => a.and(b),
        PrimitiveOp::Or => a.or(b),
        PrimitiveOp::Xor => a.xor(b),
        PrimitiveOp::Neg => Limbs::<16>::zero().wrapping_sub(a),
        PrimitiveOp::Bnot => a.not(),
        PrimitiveOp::Succ => a.wrapping_add(limbs_one_16()),
        PrimitiveOp::Pred => a.wrapping_sub(limbs_one_16()),
    }
}

#[inline]
#[must_use]
pub const fn const_ring_eval_w2048(op: PrimitiveOp, a: Limbs<32>, b: Limbs<32>) -> Limbs<32> {
    match op {
        PrimitiveOp::Add => a.wrapping_add(b),
        PrimitiveOp::Sub => a.wrapping_sub(b),
        PrimitiveOp::Mul => a.wrapping_mul(b),
        PrimitiveOp::And => a.and(b),
        PrimitiveOp::Or => a.or(b),
        PrimitiveOp::Xor => a.xor(b),
        PrimitiveOp::Neg => Limbs::<32>::zero().wrapping_sub(a),
        PrimitiveOp::Bnot => a.not(),
        PrimitiveOp::Succ => a.wrapping_add(limbs_one_32()),
        PrimitiveOp::Pred => a.wrapping_sub(limbs_one_32()),
    }
}

#[inline]
#[must_use]
pub const fn const_ring_eval_w4096(op: PrimitiveOp, a: Limbs<64>, b: Limbs<64>) -> Limbs<64> {
    match op {
        PrimitiveOp::Add => a.wrapping_add(b),
        PrimitiveOp::Sub => a.wrapping_sub(b),
        PrimitiveOp::Mul => a.wrapping_mul(b),
        PrimitiveOp::And => a.and(b),
        PrimitiveOp::Or => a.or(b),
        PrimitiveOp::Xor => a.xor(b),
        PrimitiveOp::Neg => Limbs::<64>::zero().wrapping_sub(a),
        PrimitiveOp::Bnot => a.not(),
        PrimitiveOp::Succ => a.wrapping_add(limbs_one_64()),
        PrimitiveOp::Pred => a.wrapping_sub(limbs_one_64()),
    }
}

#[inline]
#[must_use]
pub const fn const_ring_eval_w8192(op: PrimitiveOp, a: Limbs<128>, b: Limbs<128>) -> Limbs<128> {
    match op {
        PrimitiveOp::Add => a.wrapping_add(b),
        PrimitiveOp::Sub => a.wrapping_sub(b),
        PrimitiveOp::Mul => a.wrapping_mul(b),
        PrimitiveOp::And => a.and(b),
        PrimitiveOp::Or => a.or(b),
        PrimitiveOp::Xor => a.xor(b),
        PrimitiveOp::Neg => Limbs::<128>::zero().wrapping_sub(a),
        PrimitiveOp::Bnot => a.not(),
        PrimitiveOp::Succ => a.wrapping_add(limbs_one_128()),
        PrimitiveOp::Pred => a.wrapping_sub(limbs_one_128()),
    }
}

#[inline]
#[must_use]
pub const fn const_ring_eval_w12288(op: PrimitiveOp, a: Limbs<192>, b: Limbs<192>) -> Limbs<192> {
    match op {
        PrimitiveOp::Add => a.wrapping_add(b),
        PrimitiveOp::Sub => a.wrapping_sub(b),
        PrimitiveOp::Mul => a.wrapping_mul(b),
        PrimitiveOp::And => a.and(b),
        PrimitiveOp::Or => a.or(b),
        PrimitiveOp::Xor => a.xor(b),
        PrimitiveOp::Neg => Limbs::<192>::zero().wrapping_sub(a),
        PrimitiveOp::Bnot => a.not(),
        PrimitiveOp::Succ => a.wrapping_add(limbs_one_192()),
        PrimitiveOp::Pred => a.wrapping_sub(limbs_one_192()),
    }
}

#[inline]
#[must_use]
pub const fn const_ring_eval_w16384(op: PrimitiveOp, a: Limbs<256>, b: Limbs<256>) -> Limbs<256> {
    match op {
        PrimitiveOp::Add => a.wrapping_add(b),
        PrimitiveOp::Sub => a.wrapping_sub(b),
        PrimitiveOp::Mul => a.wrapping_mul(b),
        PrimitiveOp::And => a.and(b),
        PrimitiveOp::Or => a.or(b),
        PrimitiveOp::Xor => a.xor(b),
        PrimitiveOp::Neg => Limbs::<256>::zero().wrapping_sub(a),
        PrimitiveOp::Bnot => a.not(),
        PrimitiveOp::Succ => a.wrapping_add(limbs_one_256()),
        PrimitiveOp::Pred => a.wrapping_sub(limbs_one_256()),
    }
}

#[inline]
#[must_use]
pub const fn const_ring_eval_w32768(op: PrimitiveOp, a: Limbs<512>, b: Limbs<512>) -> Limbs<512> {
    match op {
        PrimitiveOp::Add => a.wrapping_add(b),
        PrimitiveOp::Sub => a.wrapping_sub(b),
        PrimitiveOp::Mul => a.wrapping_mul(b),
        PrimitiveOp::And => a.and(b),
        PrimitiveOp::Or => a.or(b),
        PrimitiveOp::Xor => a.xor(b),
        PrimitiveOp::Neg => Limbs::<512>::zero().wrapping_sub(a),
        PrimitiveOp::Bnot => a.not(),
        PrimitiveOp::Succ => a.wrapping_add(limbs_one_512()),
        PrimitiveOp::Pred => a.wrapping_sub(limbs_one_512()),
    }
}

/// Phase L.2: one-constant helpers for `Limbs<N>::from_words([1, 0, ...])`.
#[inline]
#[must_use]
const fn limbs_one_3() -> Limbs<3> {
    Limbs::<3>::from_words([1u64, 0u64, 0u64])
}

#[inline]
#[must_use]
const fn limbs_one_4() -> Limbs<4> {
    Limbs::<4>::from_words([1u64, 0u64, 0u64, 0u64])
}

#[inline]
#[must_use]
const fn limbs_one_6() -> Limbs<6> {
    Limbs::<6>::from_words([1u64, 0u64, 0u64, 0u64, 0u64, 0u64])
}

#[inline]
#[must_use]
const fn limbs_one_7() -> Limbs<7> {
    Limbs::<7>::from_words([1u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64])
}

#[inline]
#[must_use]
const fn limbs_one_8() -> Limbs<8> {
    Limbs::<8>::from_words([1u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64])
}

#[inline]
#[must_use]
const fn limbs_one_9() -> Limbs<9> {
    Limbs::<9>::from_words([1u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64])
}

#[inline]
#[must_use]
const fn limbs_one_16() -> Limbs<16> {
    Limbs::<16>::from_words([
        1u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64,
        0u64,
    ])
}

#[inline]
#[must_use]
const fn limbs_one_32() -> Limbs<32> {
    Limbs::<32>::from_words([
        1u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64,
        0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64,
        0u64, 0u64,
    ])
}

#[inline]
#[must_use]
const fn limbs_one_64() -> Limbs<64> {
    Limbs::<64>::from_words([
        1u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64,
        0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64,
        0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64,
        0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64,
        0u64, 0u64, 0u64, 0u64,
    ])
}

#[inline]
#[must_use]
const fn limbs_one_128() -> Limbs<128> {
    Limbs::<128>::from_words([
        1u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64,
        0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64,
        0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64,
        0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64,
        0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64,
        0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64,
        0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64,
        0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64,
        0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64,
    ])
}

#[inline]
#[must_use]
const fn limbs_one_192() -> Limbs<192> {
    Limbs::<192>::from_words([
        1u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64,
        0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64,
        0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64,
        0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64,
        0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64,
        0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64,
        0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64,
        0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64,
        0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64,
        0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64,
        0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64,
        0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64,
        0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64,
    ])
}

#[inline]
#[must_use]
const fn limbs_one_256() -> Limbs<256> {
    Limbs::<256>::from_words([
        1u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64,
        0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64,
        0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64,
        0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64,
        0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64,
        0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64,
        0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64,
        0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64,
        0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64,
        0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64,
        0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64,
        0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64,
        0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64,
        0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64,
        0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64,
        0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64,
        0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64,
        0u64,
    ])
}

#[inline]
#[must_use]
const fn limbs_one_512() -> Limbs<512> {
    Limbs::<512>::from_words([
        1u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64,
        0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64,
        0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64,
        0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64,
        0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64,
        0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64,
        0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64,
        0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64,
        0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64,
        0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64,
        0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64,
        0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64,
        0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64,
        0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64,
        0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64,
        0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64,
        0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64,
        0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64,
        0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64,
        0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64,
        0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64,
        0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64,
        0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64,
        0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64,
        0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64,
        0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64,
        0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64,
        0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64,
        0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64,
        0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64,
        0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64,
        0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64,
        0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64,
        0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64, 0u64,
        0u64, 0u64,
    ])
}

/// Sealed marker trait for fragment classifiers (Is2SatShape, IsHornShape,
/// IsResidualFragment) emitted parametrically from the predicate individuals
/// referenced by `predicate:InhabitanceDispatchTable`.
pub trait FragmentMarker: fragment_sealed::Sealed {}

mod fragment_sealed {
    /// Private supertrait.
    pub trait Sealed {}
    impl Sealed for super::Is2SatShape {}
    impl Sealed for super::IsHornShape {}
    impl Sealed for super::IsResidualFragment {}
}

/// Fragment marker for `predicate:Is2SatShape`. Zero-sized.
#[derive(Debug, Default, Clone, Copy)]
pub struct Is2SatShape;
impl FragmentMarker for Is2SatShape {}

/// Fragment marker for `predicate:IsHornShape`. Zero-sized.
#[derive(Debug, Default, Clone, Copy)]
pub struct IsHornShape;
impl FragmentMarker for IsHornShape {}

/// Fragment marker for `predicate:IsResidualFragment`. Zero-sized.
#[derive(Debug, Default, Clone, Copy)]
pub struct IsResidualFragment;
impl FragmentMarker for IsResidualFragment {}

/// A single dispatch rule entry pairing a predicate IRI, a target resolver
/// name, and an evaluation priority.
#[derive(Debug, Clone, Copy)]
pub struct DispatchRule {
    /// IRI of the predicate that selects this rule.
    pub predicate_iri: &'static str,
    /// IRI of the target resolver class invoked when the predicate holds.
    pub target_resolver_iri: &'static str,
    /// Evaluation order; lower values evaluate first.
    pub priority: u32,
}

/// A static dispatch table — an ordered slice of `DispatchRule` entries.
pub type DispatchTable = &'static [DispatchRule];

/// v0.2.1 dispatch table generated from `predicate:InhabitanceDispatchTable`.
pub const INHABITANCE_DISPATCH_TABLE: DispatchTable = &[
    DispatchRule {
        predicate_iri: "https://uor.foundation/predicate/Is2SatShape",
        target_resolver_iri: "https://uor.foundation/resolver/TwoSatDecider",
        priority: 0,
    },
    DispatchRule {
        predicate_iri: "https://uor.foundation/predicate/IsHornShape",
        target_resolver_iri: "https://uor.foundation/resolver/HornSatDecider",
        priority: 1,
    },
    DispatchRule {
        predicate_iri: "https://uor.foundation/predicate/IsResidualFragment",
        target_resolver_iri: "https://uor.foundation/resolver/ResidualVerdictResolver",
        priority: 2,
    },
];

/// v0.2.1 `Deref` impl for `Validated<T: OntologyTarget>` so consumers can call
/// certificate methods directly: `cert.target_level()` rather than
/// `cert.inner().target_level()`. The bound `T: OntologyTarget` keeps the
/// auto-deref scoped to foundation-produced types.
impl<T: OntologyTarget> core::ops::Deref for Validated<T> {
    type Target = T;
    #[inline]
    fn deref(&self) -> &T {
        &self.inner
    }
}

mod bound_constraint_sealed {
    /// Sealed supertrait for the closed Observable catalogue.
    pub trait ObservableSealed {}
    /// Sealed supertrait for the closed BoundShape catalogue.
    pub trait BoundShapeSealed {}
}

/// Sealed marker trait identifying the closed catalogue of observables
/// admissible in BoundConstraint. Implemented by unit structs emitted
/// below per `observable:Observable` subclass referenced by a
/// BoundConstraint kind individual.
pub trait Observable: bound_constraint_sealed::ObservableSealed {
    /// Ontology IRI of this observable class.
    const IRI: &'static str;
}

/// Sealed marker trait identifying the closed catalogue of bound shapes.
/// Exactly six individuals: EqualBound, LessEqBound, GreaterEqBound,
/// RangeContainBound, ResidueClassBound, AffineEqualBound.
pub trait BoundShape: bound_constraint_sealed::BoundShapeSealed {
    /// Ontology IRI of this bound shape individual.
    const IRI: &'static str;
}

/// Observes a Datum's value modulo a configurable modulus.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash, Default)]
pub struct ValueModObservable;
impl bound_constraint_sealed::ObservableSealed for ValueModObservable {}
impl Observable for ValueModObservable {
    const IRI: &'static str = "https://uor.foundation/observable/ValueModObservable";
}

/// Distance between two ring elements under the Hamming metric.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash, Default)]
pub struct HammingMetric;
impl bound_constraint_sealed::ObservableSealed for HammingMetric {}
impl Observable for HammingMetric {
    const IRI: &'static str = "https://uor.foundation/observable/HammingMetric";
}

/// Observes the derivation depth of a Datum.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash, Default)]
pub struct DerivationDepthObservable;
impl bound_constraint_sealed::ObservableSealed for DerivationDepthObservable {}
impl Observable for DerivationDepthObservable {
    const IRI: &'static str = "https://uor.foundation/derivation/DerivationDepthObservable";
}

/// Observes the carry depth of a Datum in the W₂ tower.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash, Default)]
pub struct CarryDepthObservable;
impl bound_constraint_sealed::ObservableSealed for CarryDepthObservable {}
impl Observable for CarryDepthObservable {
    const IRI: &'static str = "https://uor.foundation/carry/CarryDepthObservable";
}

/// Observes the free-rank of the partition associated with a Datum.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash, Default)]
pub struct FreeRankObservable;
impl bound_constraint_sealed::ObservableSealed for FreeRankObservable {}
impl Observable for FreeRankObservable {
    const IRI: &'static str = "https://uor.foundation/partition/FreeRankObservable";
}

/// Predicate form: `observable(datum) == target`.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash, Default)]
pub struct EqualBound;
impl bound_constraint_sealed::BoundShapeSealed for EqualBound {}
impl BoundShape for EqualBound {
    const IRI: &'static str = "https://uor.foundation/type/EqualBound";
}

/// Predicate form: `observable(datum) <= bound`.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash, Default)]
pub struct LessEqBound;
impl bound_constraint_sealed::BoundShapeSealed for LessEqBound {}
impl BoundShape for LessEqBound {
    const IRI: &'static str = "https://uor.foundation/type/LessEqBound";
}

/// Predicate form: `observable(datum) >= bound`.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash, Default)]
pub struct GreaterEqBound;
impl bound_constraint_sealed::BoundShapeSealed for GreaterEqBound {}
impl BoundShape for GreaterEqBound {
    const IRI: &'static str = "https://uor.foundation/type/GreaterEqBound";
}

/// Predicate form: `lo <= observable(datum) <= hi`.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash, Default)]
pub struct RangeContainBound;
impl bound_constraint_sealed::BoundShapeSealed for RangeContainBound {}
impl BoundShape for RangeContainBound {
    const IRI: &'static str = "https://uor.foundation/type/RangeContainBound";
}

/// Predicate form: `observable(datum) ≡ residue (mod modulus)`.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash, Default)]
pub struct ResidueClassBound;
impl bound_constraint_sealed::BoundShapeSealed for ResidueClassBound {}
impl BoundShape for ResidueClassBound {
    const IRI: &'static str = "https://uor.foundation/type/ResidueClassBound";
}

/// Predicate form: `observable(datum) == offset + affine combination`.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash, Default)]
pub struct AffineEqualBound;
impl bound_constraint_sealed::BoundShapeSealed for AffineEqualBound {}
impl BoundShape for AffineEqualBound {
    const IRI: &'static str = "https://uor.foundation/type/AffineEqualBound";
}

/// Parameter value type for `BoundConstraint` arguments.
/// Sealed enum over the closed set of primitive kinds the bound-shape
/// catalogue requires. No heap, no `String`.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
pub enum BoundArgValue {
    /// Unsigned 64-bit integer.
    U64(u64),
    /// Signed 64-bit integer.
    I64(i64),
    /// Fixed 32-byte content-addressed value.
    Bytes32([u8; 32]),
}

/// Fixed-size arguments carrier for a `BoundConstraint`.
/// Holds up to eight `(name, value)` pairs inline. The closed
/// bound-shape catalogue requires at most three parameters per kind;
/// the extra slots are reserved for future kind additions without
/// changing the carrier layout.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
pub struct BoundArguments {
    entries: [Option<BoundArgEntry>; 8],
}

/// A single named parameter in a `BoundArguments` table.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
pub struct BoundArgEntry {
    /// Parameter name (a `&'static str` intentional over heap-owned).
    pub name: &'static str,
    /// Parameter value.
    pub value: BoundArgValue,
}

impl BoundArguments {
    /// Construct an empty argument table.
    #[inline]
    #[must_use]
    pub const fn empty() -> Self {
        Self { entries: [None; 8] }
    }

    /// Construct a table with a single `(name, value)` pair.
    #[inline]
    #[must_use]
    pub const fn single(name: &'static str, value: BoundArgValue) -> Self {
        let mut entries = [None; 8];
        entries[0] = Some(BoundArgEntry { name, value });
        Self { entries }
    }

    /// Construct a table with two `(name, value)` pairs.
    #[inline]
    #[must_use]
    pub const fn pair(
        first: (&'static str, BoundArgValue),
        second: (&'static str, BoundArgValue),
    ) -> Self {
        let mut entries = [None; 8];
        entries[0] = Some(BoundArgEntry {
            name: first.0,
            value: first.1,
        });
        entries[1] = Some(BoundArgEntry {
            name: second.0,
            value: second.1,
        });
        Self { entries }
    }

    /// Access the stored entries.
    #[inline]
    #[must_use]
    pub const fn entries(&self) -> &[Option<BoundArgEntry>; 8] {
        &self.entries
    }
}

/// Parametric constraint carrier (v0.2.2 Phase D).
/// Generic over `O: Observable` and `B: BoundShape`. The seven
/// legacy constraint kinds are preserved as type aliases over this
/// carrier; see `ResidueConstraint`, `HammingConstraint`, etc. below.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
pub struct BoundConstraint<O: Observable, B: BoundShape> {
    observable: O,
    bound: B,
    args: BoundArguments,
    _sealed: (),
}

impl<O: Observable, B: BoundShape> BoundConstraint<O, B> {
    /// Crate-internal constructor. Downstream obtains values through
    /// the per-type-alias `pub const fn new` constructors.
    #[inline]
    #[must_use]
    pub(crate) const fn from_parts(observable: O, bound: B, args: BoundArguments) -> Self {
        Self {
            observable,
            bound,
            args,
            _sealed: (),
        }
    }

    /// Access the bound observable.
    #[inline]
    #[must_use]
    pub const fn observable(&self) -> &O {
        &self.observable
    }

    /// Access the bound shape.
    #[inline]
    #[must_use]
    pub const fn bound(&self) -> &B {
        &self.bound
    }

    /// Access the bound arguments.
    #[inline]
    #[must_use]
    pub const fn args(&self) -> &BoundArguments {
        &self.args
    }
}

/// Parametric conjunction of `BoundConstraint` kinds (v0.2.2 Phase D).
/// Replaces the v0.2.1 `CompositeConstraint` enumeration; the legacy
/// name survives as the type alias `CompositeConstraint<N>` below.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
pub struct Conjunction<const N: usize> {
    len: usize,
    _sealed: (),
}

impl<const N: usize> Conjunction<N> {
    /// Construct a new Conjunction with `len` conjuncts.
    #[inline]
    #[must_use]
    pub const fn new(len: usize) -> Self {
        Self { len, _sealed: () }
    }

    /// The number of conjuncts in this Conjunction.
    #[inline]
    #[must_use]
    pub const fn len(&self) -> usize {
        self.len
    }

    /// Whether the Conjunction is empty.
    #[inline]
    #[must_use]
    pub const fn is_empty(&self) -> bool {
        self.len == 0
    }
}

/// v0.2.1 legacy type alias: a `BoundConstraint` kind asserting
/// residue-class membership (`value mod m == r`).
pub type ResidueConstraint = BoundConstraint<ValueModObservable, ResidueClassBound>;

impl ResidueConstraint {
    /// Construct a residue constraint with the given modulus and residue.
    #[inline]
    #[must_use]
    pub const fn new(modulus: u64, residue: u64) -> Self {
        let args = BoundArguments::pair(
            ("modulus", BoundArgValue::U64(modulus)),
            ("residue", BoundArgValue::U64(residue)),
        );
        BoundConstraint::from_parts(ValueModObservable, ResidueClassBound, args)
    }
}

/// v0.2.1 legacy type alias: a `BoundConstraint` kind bounding the
/// Hamming weight of the Datum (`weight <= bound`).
pub type HammingConstraint = BoundConstraint<HammingMetric, LessEqBound>;

impl HammingConstraint {
    /// Construct a Hamming constraint with the given upper bound.
    #[inline]
    #[must_use]
    pub const fn new(bound: u64) -> Self {
        let args = BoundArguments::single("bound", BoundArgValue::U64(bound));
        BoundConstraint::from_parts(HammingMetric, LessEqBound, args)
    }
}

/// v0.2.1 legacy type alias: a `BoundConstraint` kind bounding the
/// derivation depth of the Datum.
pub type DepthConstraint = BoundConstraint<DerivationDepthObservable, LessEqBound>;

impl DepthConstraint {
    /// Construct a depth constraint with min and max depths.
    #[inline]
    #[must_use]
    pub const fn new(min_depth: u64, max_depth: u64) -> Self {
        let args = BoundArguments::pair(
            ("min_depth", BoundArgValue::U64(min_depth)),
            ("max_depth", BoundArgValue::U64(max_depth)),
        );
        BoundConstraint::from_parts(DerivationDepthObservable, LessEqBound, args)
    }
}

/// v0.2.1 legacy type alias: a `BoundConstraint` kind bounding the
/// carry depth of the Datum in the W₂ tower.
pub type CarryConstraint = BoundConstraint<CarryDepthObservable, LessEqBound>;

impl CarryConstraint {
    /// Construct a carry constraint with the given upper bound.
    #[inline]
    #[must_use]
    pub const fn new(bound: u64) -> Self {
        let args = BoundArguments::single("bound", BoundArgValue::U64(bound));
        BoundConstraint::from_parts(CarryDepthObservable, LessEqBound, args)
    }
}

/// v0.2.1 legacy type alias: a `BoundConstraint` kind pinning a
/// single site coordinate.
pub type SiteConstraint = BoundConstraint<FreeRankObservable, LessEqBound>;

impl SiteConstraint {
    /// Construct a site constraint with the given site index.
    #[inline]
    #[must_use]
    pub const fn new(site_index: u64) -> Self {
        let args = BoundArguments::single("site_index", BoundArgValue::U64(site_index));
        BoundConstraint::from_parts(FreeRankObservable, LessEqBound, args)
    }
}

/// v0.2.1 legacy type alias: a `BoundConstraint` kind pinning an
/// affine relationship on the Datum's value projection.
pub type AffineConstraint = BoundConstraint<ValueModObservable, AffineEqualBound>;

impl AffineConstraint {
    /// Construct an affine constraint with the given offset.
    #[inline]
    #[must_use]
    pub const fn new(offset: u64) -> Self {
        let args = BoundArguments::single("offset", BoundArgValue::U64(offset));
        BoundConstraint::from_parts(ValueModObservable, AffineEqualBound, args)
    }
}

/// v0.2.1 legacy type alias: a `Conjunction` over `N` BoundConstraint
/// kinds (`CompositeConstraint<3>` = 3-way conjunction).
pub type CompositeConstraint<const N: usize> = Conjunction<N>;

/// v0.2.2 Phase E: sealed query handle.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
pub struct Query {
    address: ContentAddress,
    _sealed: (),
}

impl Query {
    /// Returns the content-hashed query address.
    #[inline]
    #[must_use]
    pub const fn address(&self) -> ContentAddress {
        self.address
    }

    /// Crate-internal constructor.
    #[inline]
    #[must_use]
    #[allow(dead_code)]
    pub(crate) const fn new(address: ContentAddress) -> Self {
        Self {
            address,
            _sealed: (),
        }
    }
}

/// v0.2.2 Phase E: typed query coordinate parametric over WittLevel.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
pub struct Coordinate<L> {
    stratum: u64,
    spectrum: u64,
    address: u64,
    _level: PhantomData<L>,
    _sealed: (),
}

impl<L> Coordinate<L> {
    /// Returns the stratum coordinate.
    #[inline]
    #[must_use]
    pub const fn stratum(&self) -> u64 {
        self.stratum
    }

    /// Returns the spectrum coordinate.
    #[inline]
    #[must_use]
    pub const fn spectrum(&self) -> u64 {
        self.spectrum
    }

    /// Returns the address coordinate.
    #[inline]
    #[must_use]
    pub const fn address(&self) -> u64 {
        self.address
    }

    /// Crate-internal constructor.
    #[inline]
    #[must_use]
    #[allow(dead_code)]
    pub(crate) const fn new(stratum: u64, spectrum: u64, address: u64) -> Self {
        Self {
            stratum,
            spectrum,
            address,
            _level: PhantomData,
            _sealed: (),
        }
    }
}

/// v0.2.2 Phase E: sealed binding query handle.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
pub struct BindingQuery {
    address: ContentAddress,
    _sealed: (),
}

impl BindingQuery {
    /// Returns the content-hashed binding query address.
    #[inline]
    #[must_use]
    pub const fn address(&self) -> ContentAddress {
        self.address
    }

    /// Crate-internal constructor.
    #[inline]
    #[must_use]
    #[allow(dead_code)]
    pub(crate) const fn new(address: ContentAddress) -> Self {
        Self {
            address,
            _sealed: (),
        }
    }
}

/// v0.2.2 Phase E: sealed Partition handle over the bridge:partition
/// component classification produced during grounding.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
pub struct Partition {
    component: PartitionComponent,
    _sealed: (),
}

impl Partition {
    /// Returns the component classification.
    #[inline]
    #[must_use]
    pub const fn component(&self) -> PartitionComponent {
        self.component
    }

    /// Crate-internal constructor.
    #[inline]
    #[must_use]
    #[allow(dead_code)]
    pub(crate) const fn new(component: PartitionComponent) -> Self {
        Self {
            component,
            _sealed: (),
        }
    }
}

/// v0.2.2 Phase E: a single event in a derivation Trace.
/// Fixed-size event; content-addressed so Trace replays are stable
/// across builds. The verifier in `uor-foundation-verify` (Phase H)
/// reconstructs the witness chain by walking a `Trace` iterator.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
pub struct TraceEvent {
    /// Step index in the derivation.
    step_index: u32,
    /// Primitive op applied at this step.
    op: PrimitiveOp,
    /// Content-hashed target address the op produced.
    target: ContentAddress,
    /// Sealing marker.
    _sealed: (),
}

impl TraceEvent {
    /// Returns the step index.
    #[inline]
    #[must_use]
    pub const fn step_index(&self) -> u32 {
        self.step_index
    }

    /// Returns the primitive op applied at this step.
    #[inline]
    #[must_use]
    pub const fn op(&self) -> PrimitiveOp {
        self.op
    }

    /// Returns the content-hashed target address.
    #[inline]
    #[must_use]
    pub const fn target(&self) -> ContentAddress {
        self.target
    }

    /// Crate-internal constructor.
    #[inline]
    #[must_use]
    #[allow(dead_code)]
    pub(crate) const fn new(step_index: u32, op: PrimitiveOp, target: ContentAddress) -> Self {
        Self {
            step_index,
            op,
            target,
            _sealed: (),
        }
    }
}

/// Fixed-capacity derivation trace. Holds up to `TR_MAX` events inline;
/// no heap. Produced by `Derivation::replay()` and consumed by
/// `uor-foundation-verify`. `TR_MAX` is the const-generic that carries
/// the application's selected `<MyBounds as HostBounds>::TRACE_MAX_EVENTS`;
/// the default const-generic resolves to `DefaultHostBounds`'s 256.
/// Carries `witt_level_bits` and `content_fingerprint` so `verify_trace`
/// can reconstruct the source `GroundingCertificate` via structural-
/// validation + fingerprint passthrough (no hash recomputation).
#[derive(Debug, Clone, Copy)]
pub struct Trace<const TR_MAX: usize = 256> {
    events: [Option<TraceEvent>; TR_MAX],
    len: u16,
    /// Witt level the source grounding was minted at, packed
    /// by `Derivation::replay` from the parent `Grounded::witt_level_bits`.
    /// `verify_trace` reads this back to populate the certificate.
    witt_level_bits: u16,
    /// Parametric content fingerprint of the source unit's full state,
    /// computed at grounding time by the consumer-supplied `Hasher` and
    /// packed in by `Derivation::replay`. `verify_trace` passes it through
    /// unchanged. The fingerprint's `FP_MAX` follows the application's
    /// selected `<MyBounds as HostBounds>::FINGERPRINT_MAX_BYTES`; this
    /// field uses the default-bound `ContentFingerprint`.
    content_fingerprint: ContentFingerprint,
    _sealed: (),
}

impl<const TR_MAX: usize> Trace<TR_MAX> {
    /// An empty Trace.
    #[inline]
    #[must_use]
    pub const fn empty() -> Self {
        Self {
            events: [None; TR_MAX],
            len: 0,
            witt_level_bits: 0,
            content_fingerprint: ContentFingerprint::zero(),
            _sealed: (),
        }
    }

    /// Crate-internal ctor for `Derivation::replay()` only.
    /// Bypasses validation because `replay()` constructs events from
    /// foundation-guaranteed-valid state (monotonic, contiguous, non-zero
    /// seed). No public path reaches this constructor; downstream uses the
    /// validating `try_from_events` instead.
    #[inline]
    #[must_use]
    #[allow(dead_code)]
    pub(crate) const fn from_replay_events_const(
        events: [Option<TraceEvent>; TR_MAX],
        len: u16,
        witt_level_bits: u16,
        content_fingerprint: ContentFingerprint,
    ) -> Self {
        Self {
            events,
            len,
            witt_level_bits,
            content_fingerprint,
            _sealed: (),
        }
    }

    /// Number of events recorded.
    #[inline]
    #[must_use]
    pub const fn len(&self) -> u16 {
        self.len
    }

    /// Whether the Trace is empty.
    #[inline]
    #[must_use]
    pub const fn is_empty(&self) -> bool {
        self.len == 0
    }

    /// Access the event at the given index, or `None` if out of range.
    #[inline]
    #[must_use]
    pub fn event(&self, index: usize) -> Option<&TraceEvent> {
        self.events.get(index).and_then(|e| e.as_ref())
    }

    /// v0.2.2 T5: returns the Witt level the source grounding was minted at.
    /// Carried through replay so `verify_trace` can populate the certificate.
    #[inline]
    #[must_use]
    pub const fn witt_level_bits(&self) -> u16 {
        self.witt_level_bits
    }

    /// v0.2.2 T5: returns the parametric content fingerprint of the source
    /// unit, computed at grounding time by the consumer-supplied `Hasher`.
    /// `verify_trace` passes this through unchanged into the re-derived
    /// certificate, upholding the round-trip property.
    #[inline]
    #[must_use]
    pub const fn content_fingerprint(&self) -> ContentFingerprint {
        self.content_fingerprint
    }

    /// Validating constructor. Checks every invariant the verify path
    /// relies on: events are contiguous from index 0, no event has a zero
    /// target, and the slice fits within `TR_MAX` events.
    /// # Errors
    /// - `ReplayError::EmptyTrace` if `events.is_empty()`.
    /// - `ReplayError::CapacityExceeded { declared, provided }` if the
    ///   slice exceeds `TR_MAX`.
    /// - `ReplayError::OutOfOrderEvent { index }` if the event at `index`
    ///   has a `step_index` not equal to `index` (strict contiguity).
    /// - `ReplayError::ZeroTarget { index }` if any event carries a zero
    ///   `ContentAddress` target.
    pub fn try_from_events(
        events: &[TraceEvent],
        witt_level_bits: u16,
        content_fingerprint: ContentFingerprint,
    ) -> Result<Self, ReplayError> {
        if events.is_empty() {
            return Err(ReplayError::EmptyTrace);
        }
        if events.len() > TR_MAX {
            return Err(ReplayError::CapacityExceeded {
                declared: TR_MAX as u16,
                provided: events.len() as u32,
            });
        }
        let mut i = 0usize;
        while i < events.len() {
            let e = &events[i];
            if e.step_index() as usize != i {
                return Err(ReplayError::OutOfOrderEvent { index: i });
            }
            if e.target().is_zero() {
                return Err(ReplayError::ZeroTarget { index: i });
            }
            i += 1;
        }
        let mut arr = [None; TR_MAX];
        let mut j = 0usize;
        while j < events.len() {
            arr[j] = Some(events[j]);
            j += 1;
        }
        Ok(Self {
            events: arr,
            len: events.len() as u16,
            witt_level_bits,
            content_fingerprint,
            _sealed: (),
        })
    }
}

impl<const TR_MAX: usize> Default for Trace<TR_MAX> {
    #[inline]
    fn default() -> Self {
        Self::empty()
    }
}

/// v0.2.2 Phase E / T2.6: `Derivation::replay()` produces a content-addressed
/// Trace the verifier can re-walk without invoking the deciders. The trace
/// length matches the derivation's `step_count()`, and each event's
/// `step_index` reflects its position in the derivation.
impl Derivation {
    /// Replay this derivation as a fixed-size `Trace<TR_MAX>` whose length matches
    /// `self.step_count()` (capped at the application's `<HostBounds>::TRACE_MAX_EVENTS`).
    /// Callers either annotate the binding (`let trace: Trace = ...;` picks
    /// `DefaultHostBounds`'s 256) or use turbofish (`derivation.replay::<1024>()`).
    /// # Example
    /// ```no_run
    /// use uor_foundation::enforcement::{
    ///     replay, CompileUnitBuilder, ConstrainedTypeInput, Grounded, Term, Trace,
    /// };
    /// use uor_foundation::pipeline::run;
    /// use uor_foundation::{VerificationDomain, WittLevel};
    /// # use uor_foundation::enforcement::Hasher;
    /// # struct H; impl Hasher for H {
    /// #     const OUTPUT_BYTES: usize = 16;
    /// #     fn initial() -> Self { Self }
    /// #     fn fold_byte(self, _: u8) -> Self { self }
    /// #     fn finalize(self) -> [u8; 32] { [0; 32] } }
    /// static TERMS: &[Term] = &[Term::Literal { value: 7, level: WittLevel::W8 }];
    /// static DOMS: &[VerificationDomain] = &[VerificationDomain::Enumerative];
    /// let unit = CompileUnitBuilder::new()
    ///     .root_term(TERMS).witt_level_ceiling(WittLevel::W32)
    ///     .thermodynamic_budget(1024).target_domains(DOMS)
    ///     .result_type::<ConstrainedTypeInput>()
    ///     .validate().expect("unit well-formed");
    /// let grounded: Grounded<ConstrainedTypeInput> =
    ///     run::<ConstrainedTypeInput, _, H>(unit).expect("grounds");
    /// // Replay → round-trip verification. The trace's event-count
    /// // capacity comes from the application's `HostBounds`; here the
    /// // type-annotated binding inherits `DefaultHostBounds`'s 256.
    /// let trace: Trace = grounded.derivation().replay();
    /// let recert = replay::certify_from_trace(&trace).expect("valid trace");
    /// assert_eq!(recert.certificate().content_fingerprint(),
    ///            grounded.content_fingerprint());
    /// ```
    #[inline]
    #[must_use]
    pub fn replay<const TR_MAX: usize>(&self) -> Trace<TR_MAX> {
        let steps = self.step_count() as usize;
        let len = if steps > TR_MAX { TR_MAX } else { steps };
        let mut events = [None; TR_MAX];
        // Seed targets from the leading 8 bytes of the source
        // `content_fingerprint` (substrate-computed). Combined with `| 1` so
        // the first event's target is guaranteed nonzero even when the
        // leading bytes are all zero, and XOR with `(i + 1)` keeps the
        // sequence non-degenerate.
        let fp = self.content_fingerprint.as_bytes();
        let seed =
            u64::from_be_bytes([fp[0], fp[1], fp[2], fp[3], fp[4], fp[5], fp[6], fp[7]]) as u128;
        let nonzero_seed = seed | 1u128;
        let mut i = 0usize;
        while i < len {
            let target_raw = nonzero_seed ^ ((i as u128) + 1u128);
            events[i] = Some(TraceEvent::new(
                i as u32,
                crate::PrimitiveOp::Add,
                ContentAddress::from_u128(target_raw),
            ));
            i += 1;
        }
        // Pack the source `witt_level_bits` and `content_fingerprint`
        // into the Trace so `verify_trace` can reproduce the source certificate
        // via passthrough. The fingerprint was computed at grounding time by the
        // consumer-supplied Hasher and stored on the parent Grounded; the
        // Derivation accessor read it through.
        Trace::from_replay_events_const(
            events,
            len as u16,
            self.witt_level_bits,
            self.content_fingerprint,
        )
    }
}

/// v0.2.2 T5: errors emitted by the trace-replay re-derivation path.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
#[non_exhaustive]
pub enum ReplayError {
    /// The trace was empty; nothing to replay.
    EmptyTrace,
    /// Event at `index` has a non-monotonic step_index.
    OutOfOrderEvent {
        /// The event index that was out of order.
        index: usize,
    },
    /// Event at `index` carries a zero ContentAddress (forbidden in well-formed traces).
    ZeroTarget {
        /// The event index that carried a zero target.
        index: usize,
    },
    /// v0.2.2 T5.8: event step indices do not form a contiguous sequence
    /// `[0, 1, ..., len-1]`. Replaces the misleadingly-named v0.2.1
    /// `LengthMismatch` variant. The trace has the right number of
    /// events, but their step indices skip values (e.g., `[0, 2, 5]`
    /// with `len = 3`).
    NonContiguousSteps {
        /// The trace's declared length (number of events).
        declared: u16,
        /// The largest step_index observed in the event sequence.
        /// Always strictly greater than `declared - 1` when this
        /// variant fires.
        last_step: u32,
    },
    /// A caller attempted to construct a `Trace<TR_MAX>` whose event count
    /// exceeds `TR_MAX` (the application's `<HostBounds>::TRACE_MAX_EVENTS`).
    /// Distinct from `NonContiguousSteps` because the recovery is different
    /// (truncate vs. close gaps). Returned by `Trace::try_from_events`,
    /// never by `verify_trace` (the verifier reads from an existing `Trace`
    /// whose capacity is already enforced by the type's storage).
    CapacityExceeded {
        /// The trace's hard capacity (`TR_MAX`).
        declared: u16,
        /// The actual event count the caller attempted to pack in.
        provided: u32,
    },
}

impl core::fmt::Display for ReplayError {
    fn fmt(&self, f: &mut core::fmt::Formatter<'_>) -> core::fmt::Result {
        match self {
            Self::EmptyTrace => f.write_str("trace was empty; nothing to replay"),
            Self::OutOfOrderEvent { index } => write!(
                f,
                "event at index {index} has out-of-order step index",
            ),
            Self::ZeroTarget { index } => write!(
                f,
                "event at index {index} has a zero ContentAddress target",
            ),
            Self::NonContiguousSteps { declared, last_step } => write!(
                f,
                "trace declares {declared} events but step indices skip values \
                 (last step {last_step})",
            ),
            Self::CapacityExceeded { declared, provided } => write!(
                f,
                "trace capacity exceeded: tried to pack {provided} events into a buffer of {declared}",
            ),
        }
    }
}

impl core::error::Error for ReplayError {}

/// v0.2.2 T5: trace-replay re-derivation module.
/// The foundation owns the certificate-construction boundary; the
/// `uor-foundation-verify` crate is a thin facade that delegates to
/// `replay::certify_from_trace`. This preserves sealing discipline:
/// `Certified::new` stays `pub(crate)` and no external crate can mint a
/// certificate.
pub mod replay {
    use super::{Certified, GroundingCertificate, ReplayError, Trace};

    /// Re-derive the `Certified<GroundingCertificate>` that the foundation
    /// grounding path produced for the source unit.
    /// Validates the trace's structural invariants (monotonic, contiguous
    /// step indices; no zero targets; no None slots in the populated
    /// prefix) and re-packages the trace's stored `ContentFingerprint` and
    /// `witt_level_bits` into a fresh certificate. The verifier does NOT
    /// invoke a hash function: the fingerprint is *data carried by the
    /// Trace*, computed at mint time by the consumer-supplied `Hasher` and
    /// passed through unchanged.
    /// # Round-trip property
    /// For every `Grounded<T>` produced by `pipeline::run::<T, _, H>` with
    /// a conforming substrate `H: Hasher`:
    /// ```text
    /// verify_trace(&grounded.derivation().replay()).certificate()
    ///     == grounded.certificate()
    /// ```
    /// holds bit-identically. The contract is orthogonal to the substrate
    /// hasher choice and to the chosen `OUTPUT_BYTES` width.
    /// # Errors
    /// Returns:
    /// - `ReplayError::EmptyTrace` if `trace.is_empty()`.
    /// - `ReplayError::OutOfOrderEvent { index }` if step indices are not
    ///   strictly monotonic at position `index`.
    /// - `ReplayError::ZeroTarget { index }` if any event carries
    ///   `ContentAddress::zero()`.
    /// - `ReplayError::NonContiguousSteps { declared, last_step }` if
    ///   the event step indices skip values.
    pub fn certify_from_trace<const TR_MAX: usize>(
        trace: &Trace<TR_MAX>,
    ) -> Result<Certified<GroundingCertificate>, ReplayError> {
        let len = trace.len() as usize;
        if len == 0 {
            return Err(ReplayError::EmptyTrace);
        }
        // Structural validation: monotonic step indices, contiguous from 0,
        // no zero targets, no None slots in the populated prefix.
        let mut last_step: i64 = -1;
        let mut max_step_index: u32 = 0;
        let mut i = 0usize;
        while i < len {
            let event = match trace.event(i) {
                Some(e) => e,
                None => return Err(ReplayError::OutOfOrderEvent { index: i }),
            };
            let step_index = event.step_index();
            if (step_index as i64) <= last_step {
                return Err(ReplayError::OutOfOrderEvent { index: i });
            }
            if event.target().is_zero() {
                return Err(ReplayError::ZeroTarget { index: i });
            }
            if step_index > max_step_index {
                max_step_index = step_index;
            }
            last_step = step_index as i64;
            i += 1;
        }
        if (max_step_index as u16).saturating_add(1) != trace.len() {
            return Err(ReplayError::NonContiguousSteps {
                declared: trace.len(),
                last_step: max_step_index,
            });
        }
        // v0.2.2 T5: fingerprint passthrough. The trace was minted by the
        // foundation pipeline with a `ContentFingerprint` already computed by
        // the consumer-supplied `Hasher`. The verifier does not invoke any
        // hash function; it copies the fingerprint through unchanged. The
        // round-trip property holds by construction. v0.2.2 T6.5: the
        // FingerprintMissing variant is removed because under T6.3 / T6.10,
        // no public path can produce a Trace with a zero fingerprint.
        Ok(Certified::new(
            GroundingCertificate::with_level_and_fingerprint_const(
                trace.witt_level_bits(),
                trace.content_fingerprint(),
            ),
        ))
    }
}

/// v0.2.2 Phase E: sealed builder for an InteractionDeclaration.
/// Validates the peer protocol, convergence predicate, and
/// commutator state class required by `conformance:InteractionShape`.
/// Phase F wires the full `InteractionDriver` on top of this builder.
#[derive(Debug, Clone, Copy, Default)]
pub struct InteractionDeclarationBuilder {
    peer_protocol: Option<u128>,
    convergence_predicate: Option<u128>,
    commutator_state_class: Option<u128>,
}

impl InteractionDeclarationBuilder {
    /// Construct a new builder.
    #[inline]
    #[must_use]
    pub const fn new() -> Self {
        Self {
            peer_protocol: None,
            convergence_predicate: None,
            commutator_state_class: None,
        }
    }

    /// Set the peer protocol content address.
    #[inline]
    #[must_use]
    pub const fn peer_protocol(mut self, address: u128) -> Self {
        self.peer_protocol = Some(address);
        self
    }

    /// Set the convergence predicate content address.
    #[inline]
    #[must_use]
    pub const fn convergence_predicate(mut self, address: u128) -> Self {
        self.convergence_predicate = Some(address);
        self
    }

    /// Set the commutator state class content address.
    #[inline]
    #[must_use]
    pub const fn commutator_state_class(mut self, address: u128) -> Self {
        self.commutator_state_class = Some(address);
        self
    }

    /// Phase E.6: validate against `conformance:InteractionShape`.
    /// # Errors
    /// Returns `ShapeViolation` if any of the three required fields is missing.
    pub fn validate(&self) -> Result<Validated<InteractionShape>, ShapeViolation> {
        self.validate_common().map(|_| {
            Validated::new(InteractionShape {
                shape_iri: "https://uor.foundation/conformance/InteractionShape",
            })
        })
    }

    /// Phase E.6 + C.1: const-fn companion.
    /// # Errors
    /// Returns `ShapeViolation` if any required field is missing.
    pub const fn validate_const(
        &self,
    ) -> Result<Validated<InteractionShape, CompileTime>, ShapeViolation> {
        if self.peer_protocol.is_none() {
            return Err(ShapeViolation {
                shape_iri: "https://uor.foundation/conformance/InteractionShape",
                constraint_iri: "https://uor.foundation/conformance/InteractionShape",
                property_iri: "https://uor.foundation/interaction/peerProtocol",
                expected_range: "http://www.w3.org/2002/07/owl#Thing",
                min_count: 1,
                max_count: 1,
                kind: ViolationKind::Missing,
            });
        }
        if self.convergence_predicate.is_none() {
            return Err(ShapeViolation {
                shape_iri: "https://uor.foundation/conformance/InteractionShape",
                constraint_iri: "https://uor.foundation/conformance/InteractionShape",
                property_iri: "https://uor.foundation/interaction/convergencePredicate",
                expected_range: "http://www.w3.org/2002/07/owl#Thing",
                min_count: 1,
                max_count: 1,
                kind: ViolationKind::Missing,
            });
        }
        if self.commutator_state_class.is_none() {
            return Err(ShapeViolation {
                shape_iri: "https://uor.foundation/conformance/InteractionShape",
                constraint_iri: "https://uor.foundation/conformance/InteractionShape",
                property_iri: "https://uor.foundation/interaction/commutatorStateClass",
                expected_range: "http://www.w3.org/2002/07/owl#Thing",
                min_count: 1,
                max_count: 1,
                kind: ViolationKind::Missing,
            });
        }
        Ok(Validated::new(InteractionShape {
            shape_iri: "https://uor.foundation/conformance/InteractionShape",
        }))
    }

    fn validate_common(&self) -> Result<(), ShapeViolation> {
        self.validate_const().map(|_| ())
    }
}

/// Phase E.6: validated InteractionDeclaration per `conformance:InteractionShape`.
#[derive(Debug, Clone, Copy, PartialEq, Eq)]
pub struct InteractionShape {
    /// Shape IRI this declaration was validated against.
    pub shape_iri: &'static str,
}

/// Phase E.5 (target §7.4): observability subscribe API.
/// When the `observability` feature is enabled, downstream may call
/// `subscribe_trace_events` with a handler closure that receives each
/// `TraceEvent` as the pipeline emits it. When the feature is off, this
/// function is entirely absent from the public API.
#[cfg(feature = "observability")]
pub fn subscribe_trace_events<F>(handler: F) -> ObservabilitySubscription<F>
where
    F: FnMut(&TraceEvent),
{
    ObservabilitySubscription {
        handler,
        _sealed: (),
    }
}

#[cfg(feature = "observability")]
/// Phase E.5: sealed subscription handle returned by `subscribe_trace_events`.
#[cfg(feature = "observability")]
pub struct ObservabilitySubscription<F: FnMut(&TraceEvent)> {
    handler: F,
    _sealed: (),
}

#[cfg(feature = "observability")]
impl<F: FnMut(&TraceEvent)> ObservabilitySubscription<F> {
    /// Dispatch a TraceEvent through the subscribed handler.
    pub fn emit(&mut self, event: &TraceEvent) {
        (self.handler)(event);
    }
}

/// Phase F.2 (target §4.7): closed enumeration of the six constraint kinds.
/// `type-decl` bodies enumerate exactly these six kinds per `uor_term.ebnf`'s
/// `constraint-decl` production. `CompositeConstraint` — the implicit shape of
/// a multi-decl body — has no syntactic constructor and is therefore not a
/// variant of this enum.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
#[non_exhaustive]
pub enum ConstraintKind {
    /// `type:ResidueConstraint` — value is congruent to `r (mod m)`.
    Residue,
    /// `type:CarryConstraint` — bounded carry depth.
    Carry,
    /// `type:DepthConstraint` — bounded derivation depth.
    Depth,
    /// `type:HammingConstraint` — bounded Hamming distance from a reference.
    Hamming,
    /// `type:SiteConstraint` — per-site cardinality or containment.
    Site,
    /// `type:AffineConstraint` — linear inequality over site values.
    Affine,
}

/// Phase F.3 (target §4.7 carry): sealed per-ring-op carry profile.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
pub struct CarryProfile {
    chain_length: u32,
    max_depth: u32,
    _sealed: (),
}

impl CarryProfile {
    /// Length of the longest carry chain observed.
    #[inline]
    #[must_use]
    pub const fn chain_length(&self) -> u32 {
        self.chain_length
    }

    /// Maximum carry depth across the op.
    #[inline]
    #[must_use]
    pub const fn max_depth(&self) -> u32 {
        self.max_depth
    }

    /// Crate-internal constructor.
    #[inline]
    #[must_use]
    #[allow(dead_code)]
    pub(crate) const fn new(chain_length: u32, max_depth: u32) -> Self {
        Self {
            chain_length,
            max_depth,
            _sealed: (),
        }
    }
}

/// Phase F.3 (target §4.7 carry): sealed carry-event witness — records the ring op
/// and two `Datum<L>` witt widths involved.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
pub struct CarryEvent {
    left_bits: u16,
    right_bits: u16,
    _sealed: (),
}

impl CarryEvent {
    /// Witt bit-width of the left operand.
    #[inline]
    #[must_use]
    pub const fn left_bits(&self) -> u16 {
        self.left_bits
    }

    /// Witt bit-width of the right operand.
    #[inline]
    #[must_use]
    pub const fn right_bits(&self) -> u16 {
        self.right_bits
    }

    /// Crate-internal constructor.
    #[inline]
    #[must_use]
    #[allow(dead_code)]
    pub(crate) const fn new(left_bits: u16, right_bits: u16) -> Self {
        Self {
            left_bits,
            right_bits,
            _sealed: (),
        }
    }
}

/// Phase F.3 (target §4.7 convergence): sealed convergence-level witness at `L`.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
pub struct ConvergenceLevel<L> {
    valuation: u32,
    _level: PhantomData<L>,
    _sealed: (),
}

impl<L> ConvergenceLevel<L> {
    /// The v₂ valuation of the datum at this convergence level.
    #[inline]
    #[must_use]
    pub const fn valuation(&self) -> u32 {
        self.valuation
    }

    /// Crate-internal constructor.
    #[inline]
    #[must_use]
    #[allow(dead_code)]
    pub(crate) const fn new(valuation: u32) -> Self {
        Self {
            valuation,
            _level: PhantomData,
            _sealed: (),
        }
    }
}

/// Phase F.3 (target §4.7 division): sealed enum over the four normed division
/// algebras from Cayley-Dickson. No other admissible algebra exists (Hurwitz's theorem).
#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
#[non_exhaustive]
pub enum DivisionAlgebraWitness {
    /// Real numbers ℝ (dimension 1).
    Real,
    /// Complex numbers ℂ (dimension 2).
    Complex,
    /// Quaternions ℍ (dimension 4, non-commutative).
    Quaternion,
    /// Octonions 𝕆 (dimension 8, non-commutative, non-associative).
    Octonion,
}

/// Phase F.3 (target §4.7 monoidal): sealed monoidal-product witness.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
pub struct MonoidalProduct<L, R> {
    _left: PhantomData<L>,
    _right: PhantomData<R>,
    _sealed: (),
}

impl<L, R> MonoidalProduct<L, R> {
    /// Crate-internal constructor.
    #[inline]
    #[must_use]
    #[allow(dead_code)]
    pub(crate) const fn new() -> Self {
        Self {
            _left: PhantomData,
            _right: PhantomData,
            _sealed: (),
        }
    }
}

/// Phase F.3 (target §4.7 monoidal): sealed monoidal-unit witness at `L`.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
pub struct MonoidalUnit<L> {
    _level: PhantomData<L>,
    _sealed: (),
}

impl<L> MonoidalUnit<L> {
    /// Crate-internal constructor.
    #[inline]
    #[must_use]
    #[allow(dead_code)]
    pub(crate) const fn new() -> Self {
        Self {
            _level: PhantomData,
            _sealed: (),
        }
    }
}

/// Phase F.1 (target §4.7 operad): sealed operad-composition witness.
/// Every `type-app` form in the term grammar materializes a fresh `OperadComposition`
/// carrying the outer/inner type IRIs and composed site count, per `operad:` ontology.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
pub struct OperadComposition {
    outer_type_iri: &'static str,
    inner_type_iri: &'static str,
    composed_site_count: u32,
    _sealed: (),
}

impl OperadComposition {
    /// IRI of the outer `type:TypeDefinition`.
    #[inline]
    #[must_use]
    pub const fn outer_type_iri(&self) -> &'static str {
        self.outer_type_iri
    }

    /// IRI of the inner `type:TypeDefinition`.
    #[inline]
    #[must_use]
    pub const fn inner_type_iri(&self) -> &'static str {
        self.inner_type_iri
    }

    /// Site count of the composed type.
    #[inline]
    #[must_use]
    pub const fn composed_site_count(&self) -> u32 {
        self.composed_site_count
    }

    /// Crate-internal constructor.
    #[inline]
    #[must_use]
    #[allow(dead_code)]
    pub(crate) const fn new(
        outer_type_iri: &'static str,
        inner_type_iri: &'static str,
        composed_site_count: u32,
    ) -> Self {
        Self {
            outer_type_iri,
            inner_type_iri,
            composed_site_count,
            _sealed: (),
        }
    }
}

/// Phase F.3 (target §4.7 recursion): maximum depth of the recursion trace
/// witness. Bounded by the declared descent budget at builder-validate time;
/// the constant is a size-budget cap matching other foundation arenas.
pub const RECURSION_TRACE_MAX_DEPTH: usize = 16;

/// Phase F.3 (target §4.7 recursion): sealed recursion trace with fixed-capacity
/// descent-measure sequence.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
pub struct RecursionTrace {
    depth: u32,
    measure: [u32; RECURSION_TRACE_MAX_DEPTH],
    _sealed: (),
}

impl RecursionTrace {
    /// Number of recursive descents in this trace.
    #[inline]
    #[must_use]
    pub const fn depth(&self) -> u32 {
        self.depth
    }

    /// Descent-measure sequence.
    #[inline]
    #[must_use]
    pub const fn measure(&self) -> &[u32; RECURSION_TRACE_MAX_DEPTH] {
        &self.measure
    }

    /// Crate-internal constructor.
    #[inline]
    #[must_use]
    #[allow(dead_code)]
    pub(crate) const fn new(depth: u32, measure: [u32; RECURSION_TRACE_MAX_DEPTH]) -> Self {
        Self {
            depth,
            measure,
            _sealed: (),
        }
    }
}

/// Phase F.3 (target §4.7 region): sealed address-region witness.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
pub struct AddressRegion {
    base: u128,
    extent: u64,
    _sealed: (),
}

impl AddressRegion {
    /// Base address of the region.
    #[inline]
    #[must_use]
    pub const fn base(&self) -> u128 {
        self.base
    }

    /// Extent (number of addressable cells).
    #[inline]
    #[must_use]
    pub const fn extent(&self) -> u64 {
        self.extent
    }

    /// Crate-internal constructor.
    #[inline]
    #[must_use]
    #[allow(dead_code)]
    pub(crate) const fn new(base: u128, extent: u64) -> Self {
        Self {
            base,
            extent,
            _sealed: (),
        }
    }
}

/// Phase F.3 (target §4.7 linear): sealed linear-resource budget.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
pub struct LinearBudget {
    sites_remaining: u64,
    _sealed: (),
}

impl LinearBudget {
    /// Number of linear sites still available for allocation.
    #[inline]
    #[must_use]
    pub const fn sites_remaining(&self) -> u64 {
        self.sites_remaining
    }

    /// Crate-internal constructor.
    #[inline]
    #[must_use]
    #[allow(dead_code)]
    pub(crate) const fn new(sites_remaining: u64) -> Self {
        Self {
            sites_remaining,
            _sealed: (),
        }
    }
}

/// Phase F.3 (target §4.7 linear): sealed lease-allocation witness.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
pub struct LeaseAllocation {
    site_count: u32,
    scope_hash: u128,
    _sealed: (),
}

impl LeaseAllocation {
    /// Number of linear sites taken by this allocation.
    #[inline]
    #[must_use]
    pub const fn site_count(&self) -> u32 {
        self.site_count
    }

    /// Content-hash of the lease scope identifier.
    #[inline]
    #[must_use]
    pub const fn scope_hash(&self) -> u128 {
        self.scope_hash
    }

    /// Crate-internal constructor.
    #[inline]
    #[must_use]
    #[allow(dead_code)]
    pub(crate) const fn new(site_count: u32, scope_hash: u128) -> Self {
        Self {
            site_count,
            scope_hash,
            _sealed: (),
        }
    }
}

/// v0.2.2 Phase J: zero-sized token identifying the `Total` marker.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash, Default)]
pub struct TotalMarker;

/// v0.2.2 Phase J: zero-sized token identifying the `Invertible` marker.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash, Default)]
pub struct InvertibleMarker;

/// v0.2.2 Phase J: zero-sized token identifying the `PreservesStructure` marker.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash, Default)]
pub struct PreservesStructureMarker;

mod marker_tuple_sealed {
    /// Private supertrait. Not implementable outside this crate.
    pub trait Sealed {}
}

/// v0.2.2 Phase J: sealed marker-tuple trait. Implemented exhaustively by
/// the closed catalogue of six admissible marker tuples in canonical order
/// (Total, Invertible, PreservesStructure). Downstream cannot add new
/// marker tuples; the seal anchors Phase J's compile-time correctness claim.
pub trait MarkerTuple: marker_tuple_sealed::Sealed {}

impl marker_tuple_sealed::Sealed for () {}
impl MarkerTuple for () {}
impl marker_tuple_sealed::Sealed for (TotalMarker,) {}
impl MarkerTuple for (TotalMarker,) {}
impl marker_tuple_sealed::Sealed for (TotalMarker, InvertibleMarker) {}
impl MarkerTuple for (TotalMarker, InvertibleMarker) {}
impl marker_tuple_sealed::Sealed for (TotalMarker, InvertibleMarker, PreservesStructureMarker) {}
impl MarkerTuple for (TotalMarker, InvertibleMarker, PreservesStructureMarker) {}
impl marker_tuple_sealed::Sealed for (InvertibleMarker,) {}
impl MarkerTuple for (InvertibleMarker,) {}
impl marker_tuple_sealed::Sealed for (InvertibleMarker, PreservesStructureMarker) {}
impl MarkerTuple for (InvertibleMarker, PreservesStructureMarker) {}

/// v0.2.2 Phase J: type-level set intersection of two marker tuples.
/// Implemented exhaustively for every ordered pair in the closed catalogue.
/// Composition combinators (`then`, `and_then`) use this trait to compute
/// the output marker tuple of a composed primitive as the intersection of
/// its two inputs' tuples. Because the catalogue is closed, the result is
/// always another tuple in the catalogue — no open-world hazards.
pub trait MarkerIntersection<Other: MarkerTuple>: MarkerTuple {
    /// The intersection of `Self` and `Other` in the closed catalogue.
    type Output: MarkerTuple;
}

impl MarkerIntersection<()> for () {
    type Output = ();
}
impl MarkerIntersection<(TotalMarker,)> for () {
    type Output = ();
}
impl MarkerIntersection<(TotalMarker, InvertibleMarker)> for () {
    type Output = ();
}
impl MarkerIntersection<(TotalMarker, InvertibleMarker, PreservesStructureMarker)> for () {
    type Output = ();
}
impl MarkerIntersection<(InvertibleMarker,)> for () {
    type Output = ();
}
impl MarkerIntersection<(InvertibleMarker, PreservesStructureMarker)> for () {
    type Output = ();
}
impl MarkerIntersection<()> for (TotalMarker,) {
    type Output = ();
}
impl MarkerIntersection<(TotalMarker,)> for (TotalMarker,) {
    type Output = (TotalMarker,);
}
impl MarkerIntersection<(TotalMarker, InvertibleMarker)> for (TotalMarker,) {
    type Output = (TotalMarker,);
}
impl MarkerIntersection<(TotalMarker, InvertibleMarker, PreservesStructureMarker)>
    for (TotalMarker,)
{
    type Output = (TotalMarker,);
}
impl MarkerIntersection<(InvertibleMarker,)> for (TotalMarker,) {
    type Output = ();
}
impl MarkerIntersection<(InvertibleMarker, PreservesStructureMarker)> for (TotalMarker,) {
    type Output = ();
}
impl MarkerIntersection<()> for (TotalMarker, InvertibleMarker) {
    type Output = ();
}
impl MarkerIntersection<(TotalMarker,)> for (TotalMarker, InvertibleMarker) {
    type Output = (TotalMarker,);
}
impl MarkerIntersection<(TotalMarker, InvertibleMarker)> for (TotalMarker, InvertibleMarker) {
    type Output = (TotalMarker, InvertibleMarker);
}
impl MarkerIntersection<(TotalMarker, InvertibleMarker, PreservesStructureMarker)>
    for (TotalMarker, InvertibleMarker)
{
    type Output = (TotalMarker, InvertibleMarker);
}
impl MarkerIntersection<(InvertibleMarker,)> for (TotalMarker, InvertibleMarker) {
    type Output = (InvertibleMarker,);
}
impl MarkerIntersection<(InvertibleMarker, PreservesStructureMarker)>
    for (TotalMarker, InvertibleMarker)
{
    type Output = (InvertibleMarker,);
}
impl MarkerIntersection<()> for (TotalMarker, InvertibleMarker, PreservesStructureMarker) {
    type Output = ();
}
impl MarkerIntersection<(TotalMarker,)>
    for (TotalMarker, InvertibleMarker, PreservesStructureMarker)
{
    type Output = (TotalMarker,);
}
impl MarkerIntersection<(TotalMarker, InvertibleMarker)>
    for (TotalMarker, InvertibleMarker, PreservesStructureMarker)
{
    type Output = (TotalMarker, InvertibleMarker);
}
impl MarkerIntersection<(TotalMarker, InvertibleMarker, PreservesStructureMarker)>
    for (TotalMarker, InvertibleMarker, PreservesStructureMarker)
{
    type Output = (TotalMarker, InvertibleMarker, PreservesStructureMarker);
}
impl MarkerIntersection<(InvertibleMarker,)>
    for (TotalMarker, InvertibleMarker, PreservesStructureMarker)
{
    type Output = (InvertibleMarker,);
}
impl MarkerIntersection<(InvertibleMarker, PreservesStructureMarker)>
    for (TotalMarker, InvertibleMarker, PreservesStructureMarker)
{
    type Output = (InvertibleMarker, PreservesStructureMarker);
}
impl MarkerIntersection<()> for (InvertibleMarker,) {
    type Output = ();
}
impl MarkerIntersection<(TotalMarker,)> for (InvertibleMarker,) {
    type Output = ();
}
impl MarkerIntersection<(TotalMarker, InvertibleMarker)> for (InvertibleMarker,) {
    type Output = (InvertibleMarker,);
}
impl MarkerIntersection<(TotalMarker, InvertibleMarker, PreservesStructureMarker)>
    for (InvertibleMarker,)
{
    type Output = (InvertibleMarker,);
}
impl MarkerIntersection<(InvertibleMarker,)> for (InvertibleMarker,) {
    type Output = (InvertibleMarker,);
}
impl MarkerIntersection<(InvertibleMarker, PreservesStructureMarker)> for (InvertibleMarker,) {
    type Output = (InvertibleMarker,);
}
impl MarkerIntersection<()> for (InvertibleMarker, PreservesStructureMarker) {
    type Output = ();
}
impl MarkerIntersection<(TotalMarker,)> for (InvertibleMarker, PreservesStructureMarker) {
    type Output = ();
}
impl MarkerIntersection<(TotalMarker, InvertibleMarker)>
    for (InvertibleMarker, PreservesStructureMarker)
{
    type Output = (InvertibleMarker,);
}
impl MarkerIntersection<(TotalMarker, InvertibleMarker, PreservesStructureMarker)>
    for (InvertibleMarker, PreservesStructureMarker)
{
    type Output = (InvertibleMarker, PreservesStructureMarker);
}
impl MarkerIntersection<(InvertibleMarker,)> for (InvertibleMarker, PreservesStructureMarker) {
    type Output = (InvertibleMarker,);
}
impl MarkerIntersection<(InvertibleMarker, PreservesStructureMarker)>
    for (InvertibleMarker, PreservesStructureMarker)
{
    type Output = (InvertibleMarker, PreservesStructureMarker);
}

/// v0.2.2 Phase J: compile-time check that a combinator's marker tuple
/// carries every property declared by the `GroundingMapKind` a program
/// claims. Implemented exhaustively by codegen for every valid `(tuple,
/// map)` pair; absent impls reject the mismatched declaration at the
/// `GroundingProgram::from_primitive` call site.
pub trait MarkersImpliedBy<Map: GroundingMapKind>: MarkerTuple {}

/// v0.2.2 Phase J: bitmask encoding of a combinator's marker set.
/// Bit 0 = Total, bit 1 = Invertible, bit 2 = PreservesStructure.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
pub struct MarkerBits(u8);

impl MarkerBits {
    /// The `Total` marker bit.
    pub const TOTAL: Self = Self(1);
    /// The `Invertible` marker bit.
    pub const INVERTIBLE: Self = Self(2);
    /// The `PreservesStructure` marker bit.
    pub const PRESERVES_STRUCTURE: Self = Self(4);
    /// An empty marker set.
    pub const NONE: Self = Self(0);

    /// Construct a marker bitmask from raw u8.
    #[inline]
    #[must_use]
    pub const fn from_u8(bits: u8) -> Self {
        Self(bits)
    }

    /// Access the raw bitmask.
    #[inline]
    #[must_use]
    pub const fn as_u8(&self) -> u8 {
        self.0
    }

    /// Bitwise OR of two marker bitmasks.
    #[inline]
    #[must_use]
    pub const fn union(self, other: Self) -> Self {
        Self(self.0 | other.0)
    }

    /// Bitwise AND of two marker bitmasks (marker intersection).
    #[inline]
    #[must_use]
    pub const fn intersection(self, other: Self) -> Self {
        Self(self.0 & other.0)
    }

    /// Whether this set contains all marker bits of `other`.
    #[inline]
    #[must_use]
    pub const fn contains(&self, other: Self) -> bool {
        (self.0 & other.0) == other.0
    }
}

/// v0.2.2 Phase J: closed catalogue of grounding primitives.
/// Exactly 12 operations — read_bytes, interpret_le_integer,
/// interpret_be_integer, digest, decode_utf8, decode_json, select_field,
/// select_index, const_value, then, map_err, and_then. Adding a new
/// primitive is an ontology+grammar+codegen edit, not a Rust patch.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
#[non_exhaustive]
pub enum GroundingPrimitiveOp {
    /// Read a fixed-size byte slice from the input.
    ReadBytes,
    /// Interpret bytes as a little-endian integer at the target WittLevel.
    InterpretLeInteger,
    /// Interpret bytes as a big-endian integer.
    InterpretBeInteger,
    /// Hash bytes via blake3 → 32-byte digest → `Datum<W256>`.
    /// # Scope
    /// `interpret_leaf_op` returns the first byte of the blake3 32-byte digest.
    /// The full digest is produced by `Datum<W256>` composition of 32 `Digest` leaves —
    /// the leaf-level output is the single-byte projection.
    Digest,
    /// Decode UTF-8 bytes; rejects malformed input.
    /// # Scope
    /// Only single-byte ASCII (`b < 0x80`) is decoded by `interpret_leaf_op`.
    /// Multi-byte UTF-8 is not decoded by this leaf; multi-byte sequences traverse the
    /// foundation via `GroundedTuple<N>` composition of single-byte leaves.
    DecodeUtf8,
    /// Decode JSON bytes; rejects malformed input.
    /// # Scope
    /// Only the leading byte of a JSON number scalar (`-` or ASCII digit) is parsed
    /// by `interpret_leaf_op`. Structured JSON values (objects, arrays, strings,
    /// multi-byte numbers) are not parsed by this leaf.
    DecodeJson,
    /// Select a field from a structured value.
    SelectField,
    /// Select an indexed element.
    SelectIndex,
    /// Inject a foundation-known constant.
    /// # Scope
    /// `interpret_leaf_op` returns `GroundedCoord::w8(0)` — the foundation-canonical
    /// zero constant. Non-zero constants are materialized through the const-fn frontier
    /// (`validate_const` paths) rather than through this leaf.
    ConstValue,
    /// Compose two combinators sequentially.
    Then,
    /// Map the error variant of a fallible combinator.
    MapErr,
    /// Conditional composition (and_then).
    AndThen,
}

/// Max depth of a composed op chain retained inline inside
/// `GroundingPrimitive`. Depth-2 composites (`Then(leaf, leaf)`,
/// `AndThen(leaf, leaf)`) are the exercised shape today; 8 gives headroom
/// for nested composition while keeping `Copy` and `no_std` without alloc.
pub const MAX_OP_CHAIN_DEPTH: usize = 8;

/// v0.2.2 Phase J: a single grounding primitive parametric over its output
/// type `Out` and its type-level marker tuple `Markers`.
/// Constructed only by the 12 enumerated combinator functions below;
/// downstream cannot construct one directly. The `Markers` parameter
/// defaults to `()` for backwards-compatible call sites, but each
/// combinator returns a specific tuple — see `combinators::digest` etc.
/// For leaf primitives `chain_len == 0`. For `Then`/`AndThen`/`MapErr`
/// composites, `chain[..chain_len as usize]` is the linearized post-order
/// sequence of leaf primitive ops the interpreter walks.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
pub struct GroundingPrimitive<Out, Markers: MarkerTuple = ()> {
    op: GroundingPrimitiveOp,
    markers: MarkerBits,
    chain: [GroundingPrimitiveOp; MAX_OP_CHAIN_DEPTH],
    chain_len: u8,
    _out: PhantomData<Out>,
    _markers: PhantomData<Markers>,
    _sealed: (),
}

impl<Out, Markers: MarkerTuple> GroundingPrimitive<Out, Markers> {
    /// Access the primitive op.
    #[inline]
    #[must_use]
    pub const fn op(&self) -> GroundingPrimitiveOp {
        self.op
    }

    /// Access the runtime marker bitmask (mirrors the type-level tuple).
    #[inline]
    #[must_use]
    pub const fn markers(&self) -> MarkerBits {
        self.markers
    }

    /// Access the recorded composition chain. Empty for leaf primitives;
    /// the post-order leaf-op sequence for `Then`/`AndThen`/`MapErr`.
    #[inline]
    #[must_use]
    pub fn chain(&self) -> &[GroundingPrimitiveOp] {
        &self.chain[..self.chain_len as usize]
    }

    /// Crate-internal constructor for a leaf primitive (no recorded chain).
    /// The type-level `Markers` tuple is selected via turbofish at call
    /// sites inside the combinator functions.
    #[inline]
    #[must_use]
    #[allow(dead_code)]
    pub(crate) const fn from_parts(op: GroundingPrimitiveOp, markers: MarkerBits) -> Self {
        Self {
            op,
            markers,
            chain: [GroundingPrimitiveOp::ReadBytes; MAX_OP_CHAIN_DEPTH],
            chain_len: 0,
            _out: PhantomData,
            _markers: PhantomData,
            _sealed: (),
        }
    }

    /// Crate-internal constructor for a composite primitive. Stores
    /// `chain[..chain_len]` inline; accessors expose only the prefix.
    #[inline]
    #[must_use]
    #[allow(dead_code)]
    pub(crate) const fn from_parts_with_chain(
        op: GroundingPrimitiveOp,
        markers: MarkerBits,
        chain: [GroundingPrimitiveOp; MAX_OP_CHAIN_DEPTH],
        chain_len: u8,
    ) -> Self {
        Self {
            op,
            markers,
            chain,
            chain_len,
            _out: PhantomData,
            _markers: PhantomData,
            _sealed: (),
        }
    }
}

/// v0.2.2 Phase J: closed 12-combinator surface for building grounding
/// programs. See `GroundingProgram` for composition. Each leaf combinator
/// returns a `GroundingPrimitive<Out, M>` carrying a specific marker tuple;
/// the type parameter is what `GroundingProgram::from_primitive`'s
/// `MarkersImpliedBy<Map>` bound checks at compile time.
pub mod combinators {
    use super::{
        GroundingPrimitive, GroundingPrimitiveOp, InvertibleMarker, MarkerBits, MarkerIntersection,
        MarkerTuple, PreservesStructureMarker, TotalMarker, MAX_OP_CHAIN_DEPTH,
    };

    /// Build the post-order leaf-op chain for a sequential composite:
    /// `first.chain ++ [first.op] ++ second.chain ++ [second.op]`.
    /// Saturated to `MAX_OP_CHAIN_DEPTH`.
    fn compose_chain<A, B, MA: MarkerTuple, MB: MarkerTuple>(
        first: &GroundingPrimitive<A, MA>,
        second: &GroundingPrimitive<B, MB>,
    ) -> ([GroundingPrimitiveOp; MAX_OP_CHAIN_DEPTH], u8) {
        let mut chain = [GroundingPrimitiveOp::ReadBytes; MAX_OP_CHAIN_DEPTH];
        let mut len: usize = 0;
        for &op in first.chain() {
            if len >= MAX_OP_CHAIN_DEPTH {
                return (chain, len as u8);
            }
            chain[len] = op;
            len += 1;
        }
        if len < MAX_OP_CHAIN_DEPTH {
            chain[len] = first.op();
            len += 1;
        }
        for &op in second.chain() {
            if len >= MAX_OP_CHAIN_DEPTH {
                return (chain, len as u8);
            }
            chain[len] = op;
            len += 1;
        }
        if len < MAX_OP_CHAIN_DEPTH {
            chain[len] = second.op();
            len += 1;
        }
        (chain, len as u8)
    }

    /// Build the chain for `map_err(first)`: `first.chain ++ [first.op]`.
    fn map_err_chain<A, M: MarkerTuple>(
        first: &GroundingPrimitive<A, M>,
    ) -> ([GroundingPrimitiveOp; MAX_OP_CHAIN_DEPTH], u8) {
        let mut chain = [GroundingPrimitiveOp::ReadBytes; MAX_OP_CHAIN_DEPTH];
        let mut len: usize = 0;
        for &op in first.chain() {
            if len >= MAX_OP_CHAIN_DEPTH {
                return (chain, len as u8);
            }
            chain[len] = op;
            len += 1;
        }
        if len < MAX_OP_CHAIN_DEPTH {
            chain[len] = first.op();
            len += 1;
        }
        (chain, len as u8)
    }

    /// Read a fixed-size byte slice from the input. `(Total, Invertible)`.
    #[inline]
    #[must_use]
    pub const fn read_bytes<Out>() -> GroundingPrimitive<Out, (TotalMarker, InvertibleMarker)> {
        GroundingPrimitive::from_parts(
            GroundingPrimitiveOp::ReadBytes,
            MarkerBits::TOTAL.union(MarkerBits::INVERTIBLE),
        )
    }

    /// Interpret bytes as a little-endian integer at the target WittLevel.
    #[inline]
    #[must_use]
    pub const fn interpret_le_integer<Out>(
    ) -> GroundingPrimitive<Out, (TotalMarker, InvertibleMarker, PreservesStructureMarker)> {
        GroundingPrimitive::from_parts(
            GroundingPrimitiveOp::InterpretLeInteger,
            MarkerBits::TOTAL
                .union(MarkerBits::INVERTIBLE)
                .union(MarkerBits::PRESERVES_STRUCTURE),
        )
    }

    /// Interpret bytes as a big-endian integer.
    #[inline]
    #[must_use]
    pub const fn interpret_be_integer<Out>(
    ) -> GroundingPrimitive<Out, (TotalMarker, InvertibleMarker, PreservesStructureMarker)> {
        GroundingPrimitive::from_parts(
            GroundingPrimitiveOp::InterpretBeInteger,
            MarkerBits::TOTAL
                .union(MarkerBits::INVERTIBLE)
                .union(MarkerBits::PRESERVES_STRUCTURE),
        )
    }

    /// Hash bytes via blake3 → 32-byte digest → `Datum<W256>`. `(Total,)` only.
    #[inline]
    #[must_use]
    pub const fn digest<Out>() -> GroundingPrimitive<Out, (TotalMarker,)> {
        GroundingPrimitive::from_parts(GroundingPrimitiveOp::Digest, MarkerBits::TOTAL)
    }

    /// Decode UTF-8 bytes. `(Invertible, PreservesStructure)` — not Total.
    #[inline]
    #[must_use]
    pub const fn decode_utf8<Out>(
    ) -> GroundingPrimitive<Out, (InvertibleMarker, PreservesStructureMarker)> {
        GroundingPrimitive::from_parts(
            GroundingPrimitiveOp::DecodeUtf8,
            MarkerBits::INVERTIBLE.union(MarkerBits::PRESERVES_STRUCTURE),
        )
    }

    /// Decode JSON bytes. `(Invertible, PreservesStructure)` — not Total.
    #[inline]
    #[must_use]
    pub const fn decode_json<Out>(
    ) -> GroundingPrimitive<Out, (InvertibleMarker, PreservesStructureMarker)> {
        GroundingPrimitive::from_parts(
            GroundingPrimitiveOp::DecodeJson,
            MarkerBits::INVERTIBLE.union(MarkerBits::PRESERVES_STRUCTURE),
        )
    }

    /// Select a field from a structured value. `(Invertible,)` — not Total.
    #[inline]
    #[must_use]
    pub const fn select_field<Out>() -> GroundingPrimitive<Out, (InvertibleMarker,)> {
        GroundingPrimitive::from_parts(GroundingPrimitiveOp::SelectField, MarkerBits::INVERTIBLE)
    }

    /// Select an indexed element. `(Invertible,)` — not Total.
    #[inline]
    #[must_use]
    pub const fn select_index<Out>() -> GroundingPrimitive<Out, (InvertibleMarker,)> {
        GroundingPrimitive::from_parts(GroundingPrimitiveOp::SelectIndex, MarkerBits::INVERTIBLE)
    }

    /// Inject a foundation-known constant. `(Total, Invertible, PreservesStructure)`.
    #[inline]
    #[must_use]
    pub const fn const_value<Out>(
    ) -> GroundingPrimitive<Out, (TotalMarker, InvertibleMarker, PreservesStructureMarker)> {
        GroundingPrimitive::from_parts(
            GroundingPrimitiveOp::ConstValue,
            MarkerBits::TOTAL
                .union(MarkerBits::INVERTIBLE)
                .union(MarkerBits::PRESERVES_STRUCTURE),
        )
    }

    /// Compose two combinators sequentially. Markers are intersected at
    /// the type level via the `MarkerIntersection` trait. The recorded
    /// leaf-op chain lets the foundation's interpreter walk the operands
    /// at runtime.
    #[inline]
    #[must_use]
    pub fn then<A, B, MA, MB>(
        first: GroundingPrimitive<A, MA>,
        second: GroundingPrimitive<B, MB>,
    ) -> GroundingPrimitive<B, <MA as MarkerIntersection<MB>>::Output>
    where
        MA: MarkerTuple + MarkerIntersection<MB>,
        MB: MarkerTuple,
    {
        let (chain, chain_len) = compose_chain(&first, &second);
        GroundingPrimitive::from_parts_with_chain(
            GroundingPrimitiveOp::Then,
            first.markers().intersection(second.markers()),
            chain,
            chain_len,
        )
    }

    /// Map an error variant of a fallible combinator. Marker tuple
    /// is preserved. The operand's op is recorded so the interpreter's
    /// `MapErr` arm can forward the success value.
    #[inline]
    #[must_use]
    pub fn map_err<A, M: MarkerTuple>(first: GroundingPrimitive<A, M>) -> GroundingPrimitive<A, M> {
        let (chain, chain_len) = map_err_chain(&first);
        GroundingPrimitive::from_parts_with_chain(
            GroundingPrimitiveOp::MapErr,
            first.markers(),
            chain,
            chain_len,
        )
    }

    /// Conditional composition (and_then). Markers are intersected; the
    /// recorded chain mirrors `then` so the interpreter walks operands.
    #[inline]
    #[must_use]
    pub fn and_then<A, B, MA, MB>(
        first: GroundingPrimitive<A, MA>,
        second: GroundingPrimitive<B, MB>,
    ) -> GroundingPrimitive<B, <MA as MarkerIntersection<MB>>::Output>
    where
        MA: MarkerTuple + MarkerIntersection<MB>,
        MB: MarkerTuple,
    {
        let (chain, chain_len) = compose_chain(&first, &second);
        GroundingPrimitive::from_parts_with_chain(
            GroundingPrimitiveOp::AndThen,
            first.markers().intersection(second.markers()),
            chain,
            chain_len,
        )
    }
}

/// v0.2.2 Phase J: sealed grounding program.
/// A composition of combinators with a statically tracked marker tuple.
/// Constructed only via `GroundingProgram::from_primitive`, which requires
/// via the `MarkersImpliedBy<Map>` trait bound that the primitive's marker
/// tuple carries every property declared by `Map: GroundingMapKind`.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
pub struct GroundingProgram<Out, Map: GroundingMapKind> {
    primitive: GroundingPrimitive<Out>,
    _map: PhantomData<Map>,
    _sealed: (),
}

impl<Out, Map: GroundingMapKind> GroundingProgram<Out, Map> {
    /// Foundation-verified constructor. Accepts a primitive whose marker
    /// tuple satisfies `MarkersImpliedBy<Map>`. Programs built from
    /// combinators whose marker tuple lacks a property `Map` requires are
    /// rejected at compile time — this is Phase J's marquee correctness
    /// claim: misdeclarations fail to compile.
    /// # Example: valid program
    /// ```
    /// use uor_foundation::enforcement::{GroundingProgram, IntegerGroundingMap, combinators};
    /// let prog: GroundingProgram<u64, IntegerGroundingMap> =
    ///     GroundingProgram::from_primitive(combinators::interpret_le_integer::<u64>());
    /// let _ = prog;
    /// ```
    /// # Example: rejected misdeclaration
    /// ```compile_fail
    /// use uor_foundation::enforcement::{GroundingProgram, IntegerGroundingMap, combinators};
    /// // digest returns (TotalMarker,) which does NOT satisfy
    /// // MarkersImpliedBy<IntegerGroundingMap> — the line below fails to compile.
    /// let prog: GroundingProgram<[u8; 32], IntegerGroundingMap> =
    ///     GroundingProgram::from_primitive(combinators::digest::<[u8; 32]>());
    /// let _ = prog;
    /// ```
    #[inline]
    #[must_use]
    pub fn from_primitive<Markers>(primitive: GroundingPrimitive<Out, Markers>) -> Self
    where
        Markers: MarkerTuple + MarkersImpliedBy<Map>,
    {
        // Preserve the composition chain so the interpreter can walk
        // operands of Then/AndThen/MapErr composites.
        let mut chain = [GroundingPrimitiveOp::ReadBytes; MAX_OP_CHAIN_DEPTH];
        let src = primitive.chain();
        let mut i = 0;
        while i < src.len() && i < MAX_OP_CHAIN_DEPTH {
            chain[i] = src[i];
            i += 1;
        }
        let erased = GroundingPrimitive::<Out, ()>::from_parts_with_chain(
            primitive.op(),
            primitive.markers(),
            chain,
            i as u8,
        );
        Self {
            primitive: erased,
            _map: PhantomData,
            _sealed: (),
        }
    }

    /// Access the underlying primitive (erased marker tuple).
    #[inline]
    #[must_use]
    pub const fn primitive(&self) -> &GroundingPrimitive<Out> {
        &self.primitive
    }
}

/// Phase K (target §4.3 / §9 criterion 1): foundation-supplied interpreter for
/// grounding programs whose `Out` is `GroundedCoord`. Handles every op in
/// the closed 12-combinator catalogue: leaf ops (`ReadBytes`,
/// `InterpretLeInteger`, `InterpretBeInteger`, `Digest`, `DecodeUtf8`,
/// `DecodeJson`, `ConstValue`, `SelectField`, `SelectIndex`) call
/// `interpret_leaf_op` directly; composition ops (`Then`, `AndThen`,
/// `MapErr`) walk the chain recorded in the primitive and thread
/// `external` through each leaf step. The interpreter surfaces
/// `GroundedCoord::w8(byte)` values; richer outputs compose through
/// combinator chains producing `GroundedTuple<N>`. No `ground()`
/// override exists after W4 closure — downstream provides only
/// `program()`, and `GroundingExt::ground` is foundation-authored.
impl<Map: GroundingMapKind> GroundingProgram<GroundedCoord, Map> {
    /// Run this program on external bytes, producing a `GroundedCoord`.
    /// Returns `None` if the input is malformed/undersized for the
    /// program's op chain.
    #[inline]
    #[must_use]
    pub fn run(&self, external: &[u8]) -> Option<GroundedCoord> {
        match self.primitive.op() {
            GroundingPrimitiveOp::Then | GroundingPrimitiveOp::AndThen => {
                let chain = self.primitive.chain();
                if chain.is_empty() {
                    return None;
                }
                let mut last: Option<GroundedCoord> = None;
                for &op in chain {
                    match interpret_leaf_op(op, external) {
                        Some(c) => last = Some(c),
                        None => return None,
                    }
                }
                last
            }
            GroundingPrimitiveOp::MapErr => self
                .primitive
                .chain()
                .first()
                .and_then(|&op| interpret_leaf_op(op, external)),
            leaf => interpret_leaf_op(leaf, external),
        }
    }
}

/// W4 closure (target §4.3 + §9 criterion 1): foundation-supplied
/// interpreter for programs producing `GroundedTuple<N>`. Splits
/// `external` into `N` equal windows and runs the same dispatch
/// that `GroundingProgram<GroundedCoord, Map>::run` performs on
/// each window. Returns `None` if `N == 0`, the input is empty,
/// the input length isn't divisible by `N`, or any window fails.
impl<const N: usize, Map: GroundingMapKind> GroundingProgram<GroundedTuple<N>, Map> {
    /// Run this program on external bytes, producing a `GroundedTuple<N>`.
    #[inline]
    #[must_use]
    pub fn run(&self, external: &[u8]) -> Option<GroundedTuple<N>> {
        if N == 0 || external.is_empty() || external.len() % N != 0 {
            return None;
        }
        let window = external.len() / N;
        let mut coords: [GroundedCoord; N] = [const { GroundedCoord::w8(0) }; N];
        let mut i = 0usize;
        while i < N {
            let start = i * window;
            let end = start + window;
            let sub = &external[start..end];
            // Walk this window through the same leaf/composition
            // dispatch as the GroundedCoord interpreter above. A
            // helper that runs the chain is reused via the same
            // primitive accessors.
            let outcome = match self.primitive.op() {
                GroundingPrimitiveOp::Then | GroundingPrimitiveOp::AndThen => {
                    let chain = self.primitive.chain();
                    if chain.is_empty() {
                        return None;
                    }
                    let mut last: Option<GroundedCoord> = None;
                    for &op in chain {
                        match interpret_leaf_op(op, sub) {
                            Some(c) => last = Some(c),
                            None => return None,
                        }
                    }
                    last
                }
                GroundingPrimitiveOp::MapErr => self
                    .primitive
                    .chain()
                    .first()
                    .and_then(|&op| interpret_leaf_op(op, sub)),
                leaf => interpret_leaf_op(leaf, sub),
            };
            match outcome {
                Some(c) => {
                    coords[i] = c;
                }
                None => {
                    return None;
                }
            }
            i += 1;
        }
        Some(GroundedTuple::new(coords))
    }
}

/// Foundation-canonical leaf-op interpreter. Called directly by
/// `GroundingProgram::run` for leaf primitives and step-by-step for
/// composition ops.
#[inline]
fn interpret_leaf_op(op: GroundingPrimitiveOp, external: &[u8]) -> Option<GroundedCoord> {
    match op {
        GroundingPrimitiveOp::ReadBytes | GroundingPrimitiveOp::InterpretLeInteger => {
            external.first().map(|&b| GroundedCoord::w8(b))
        }
        GroundingPrimitiveOp::InterpretBeInteger => external.last().map(|&b| GroundedCoord::w8(b)),
        GroundingPrimitiveOp::Digest => {
            // Foundation-canonical digest: first byte as `GroundedCoord` —
            // the full 32-byte digest requires a Datum<W256> sink that does
            // not fit in `GroundedCoord`. Downstream that needs the full
            // digest composes a richer program via Then/AndThen chains over
            // the 12 closed combinators — no `ground()` override exists after
            // W4 closure.
            external.first().map(|&b| GroundedCoord::w8(b))
        }
        GroundingPrimitiveOp::DecodeUtf8 => {
            // ASCII single-byte path — the canonical v0.2.2 semantics for
            // `Grounding::ground` over `GroundedCoord` outputs. Multi-byte
            // UTF-8 sequences are out of scope for w8-sized leaves; a richer
            // structured output composes via combinator chains into
            // `GroundedTuple<N>`.
            match external.first() {
                Some(&b) if b < 0x80 => Some(GroundedCoord::w8(b)),
                _ => None,
            }
        }
        GroundingPrimitiveOp::DecodeJson => {
            // Accept JSON number scalars (leading `-` or ASCII digit).
            match external.first() {
                Some(&b) if b == b'-' || b.is_ascii_digit() => Some(GroundedCoord::w8(b)),
                _ => None,
            }
        }
        GroundingPrimitiveOp::ConstValue => Some(GroundedCoord::w8(0)),
        GroundingPrimitiveOp::SelectField | GroundingPrimitiveOp::SelectIndex => {
            // Selector ops are composition-only in normal use; if invoked
            // directly, forward the first byte as a GroundedCoord.
            external.first().map(|&b| GroundedCoord::w8(b))
        }
        GroundingPrimitiveOp::Then
        | GroundingPrimitiveOp::AndThen
        | GroundingPrimitiveOp::MapErr => {
            // Composite ops are dispatched by `run()` through the chain;
            // they never reach the leaf interpreter.
            None
        }
    }
}

/// v0.2.2 Phase J: MarkersImpliedBy impls for the closed catalogue of valid
/// (marker tuple, GroundingMapKind) pairs. These are the compile-time
/// witnesses the foundation accepts; every absent pair is a rejection.
impl MarkersImpliedBy<DigestGroundingMap> for (TotalMarker,) {}
impl MarkersImpliedBy<BinaryGroundingMap> for (TotalMarker, InvertibleMarker) {}
impl MarkersImpliedBy<DigestGroundingMap> for (TotalMarker, InvertibleMarker) {}
impl MarkersImpliedBy<BinaryGroundingMap>
    for (TotalMarker, InvertibleMarker, PreservesStructureMarker)
{
}
impl MarkersImpliedBy<DigestGroundingMap>
    for (TotalMarker, InvertibleMarker, PreservesStructureMarker)
{
}
impl MarkersImpliedBy<IntegerGroundingMap>
    for (TotalMarker, InvertibleMarker, PreservesStructureMarker)
{
}
impl MarkersImpliedBy<JsonGroundingMap>
    for (TotalMarker, InvertibleMarker, PreservesStructureMarker)
{
}
impl MarkersImpliedBy<Utf8GroundingMap>
    for (TotalMarker, InvertibleMarker, PreservesStructureMarker)
{
}
impl MarkersImpliedBy<JsonGroundingMap> for (InvertibleMarker, PreservesStructureMarker) {}
impl MarkersImpliedBy<Utf8GroundingMap> for (InvertibleMarker, PreservesStructureMarker) {}

/// v0.2.2 T2.5: foundation-private test-only back-door module.
/// Exposes crate-internal constructors for `Trace`, `TraceEvent`, and
/// `MulContext` to the `uor-foundation-test-helpers` workspace member, which
/// re-exports them under stable test-only names. Not part of the public API.
#[doc(hidden)]
pub mod __test_helpers {
    use super::{ContentAddress, ContentFingerprint, MulContext, Trace, TraceEvent, Validated};

    /// Test-only ctor: build a Trace from a slice of events with a
    /// `ContentFingerprint::zero()` placeholder. Tests that need a non-zero
    /// fingerprint use `trace_with_fingerprint` instead. Parametric in
    /// `TR_MAX` per the wiki's ADR-018; callers pick the trace event-count
    /// ceiling from their selected `HostBounds`.
    #[must_use]
    pub fn trace_from_events<const TR_MAX: usize>(events: &[TraceEvent]) -> Trace<TR_MAX> {
        trace_with_fingerprint(events, 0, ContentFingerprint::zero())
    }

    /// Test-only ctor that takes an explicit `witt_level_bits` and
    /// `ContentFingerprint`. Used by round-trip tests that need to verify
    /// the verify-trace fingerprint passthrough invariant.
    #[must_use]
    pub fn trace_with_fingerprint<const TR_MAX: usize>(
        events: &[TraceEvent],
        witt_level_bits: u16,
        content_fingerprint: ContentFingerprint,
    ) -> Trace<TR_MAX> {
        let mut arr = [None; TR_MAX];
        let n = events.len().min(TR_MAX);
        let mut i = 0;
        while i < n {
            arr[i] = Some(events[i]);
            i += 1;
        }
        // The test-helpers back-door uses the foundation-private
        // `from_replay_events_const` to build malformed fixtures for error-path
        // tests. Downstream code uses `Trace::try_from_events` (validating).
        Trace::from_replay_events_const(arr, n as u16, witt_level_bits, content_fingerprint)
    }

    /// Test-only ctor: build a TraceEvent.
    #[must_use]
    pub fn trace_event(step_index: u32, target: u128) -> TraceEvent {
        TraceEvent::new(
            step_index,
            crate::PrimitiveOp::Add,
            ContentAddress::from_u128(target),
        )
    }

    /// Test-only ctor: build a MulContext.
    #[must_use]
    pub fn mul_context(stack_budget_bytes: u64, const_eval: bool, limb_count: usize) -> MulContext {
        MulContext::new(stack_budget_bytes, const_eval, limb_count)
    }

    /// Test-only ctor: wrap any T in a Runtime-phase Validated. Used by
    /// integration tests to construct `Validated<Decl, P>` values that
    /// the public API otherwise can't construct directly.
    #[must_use]
    pub fn validated_runtime<T>(inner: T) -> Validated<T> {
        Validated::new(inner)
    }
}

/// Tolerance for entropy equality checks in the Product/Coproduct
/// Completion Amendment mint primitives. Returns an absolute-error bound
/// scaled to the magnitude of `expected`, so PT_4 / ST_2 / CPT_5
/// verifications are robust to floating-point rounding accumulated through
/// Künneth products and componentwise sums. The default-host (f64) backing
/// is hidden behind the `DefaultDecimal` alias so the function signature
/// reads as host-typed; downstream that swaps `H::Decimal` reaches the
/// same surface via the alias rebind.
type DefaultDecimal = <crate::DefaultHostTypes as crate::HostTypes>::Decimal;

#[inline]
const fn pc_entropy_tolerance(expected: DefaultDecimal) -> DefaultDecimal {
    let magnitude = if expected < 0.0 { -expected } else { expected };
    let scale = if magnitude > 1.0 { magnitude } else { 1.0 };
    1024.0 * <DefaultDecimal>::EPSILON * scale
}

/// Validate an entropy value before participating in additivity checks.
/// Rejects NaN, ±∞, and negative values — the foundation's
/// `primitive_descent_metrics` produces `residual × LN_2` with
/// `residual: u32`, so valid entropies are non-negative finite Decimals.
#[inline]
fn pc_entropy_input_is_valid(value: DefaultDecimal) -> bool {
    value.is_finite() && value >= 0.0
}

/// Check that `actual` matches `expected` within tolerance and that both
/// inputs are valid entropy values. Returns `false` if either input is
/// non-finite, negative, or differs from `expected` by more than
/// `pc_entropy_tolerance(expected)`.
#[inline]
fn pc_entropy_additivity_holds(actual: DefaultDecimal, expected: DefaultDecimal) -> bool {
    if !pc_entropy_input_is_valid(actual) || !pc_entropy_input_is_valid(expected) {
        return false;
    }
    let diff = actual - expected;
    let diff_abs = if diff < 0.0 { -diff } else { diff };
    diff_abs <= pc_entropy_tolerance(expected)
}

/// Evidence bundle for `PartitionProductWitness`. Carries the PT_1 / PT_3 /
/// PT_4 input values used at mint time. Derives `PartialEq` only because
/// `f64` entropy fields exclude `Eq` / `Hash`; this is the auditing surface,
/// not a hash-map key.
#[derive(Debug, Clone, Copy, PartialEq)]
pub struct PartitionProductEvidence {
    /// Left operand `siteBudget` (data sites only, PT_1 input).
    pub left_site_budget: u16,
    /// Right operand `siteBudget`.
    pub right_site_budget: u16,
    /// Left operand `SITE_COUNT` (layout width, layout-invariant input).
    pub left_total_site_count: u16,
    /// Right operand `SITE_COUNT`.
    pub right_total_site_count: u16,
    /// Left operand Euler characteristic (PT_3 input).
    pub left_euler: i32,
    /// Right operand Euler characteristic.
    pub right_euler: i32,
    /// Left operand entropy in nats (PT_4 input).
    pub left_entropy_nats_bits: u64,
    /// Right operand entropy in nats.
    pub right_entropy_nats_bits: u64,
    /// Fingerprint of the source witness the evidence belongs to.
    pub source_witness_fingerprint: ContentFingerprint,
}

/// Evidence bundle for `PartitionCoproductWitness`. Carries the
/// ST_1 / ST_2 / ST_9 / ST_10 input values used at mint time.
#[derive(Debug, Clone, Copy, PartialEq)]
pub struct PartitionCoproductEvidence {
    pub left_site_budget: u16,
    pub right_site_budget: u16,
    pub left_total_site_count: u16,
    pub right_total_site_count: u16,
    pub left_euler: i32,
    pub right_euler: i32,
    pub left_entropy_nats_bits: u64,
    pub right_entropy_nats_bits: u64,
    pub left_betti: [u32; MAX_BETTI_DIMENSION],
    pub right_betti: [u32; MAX_BETTI_DIMENSION],
    pub source_witness_fingerprint: ContentFingerprint,
}

/// Evidence bundle for `CartesianProductWitness`. Carries the
/// CPT_1 / CPT_3 / CPT_4 / CPT_5 input values used at mint time, plus
/// `combined_entropy_nats` — the CartesianProductWitness itself does not
/// store entropy (see §1a), so the evidence sidecar preserves the
/// verification target value for re-audit.
#[derive(Debug, Clone, Copy, PartialEq)]
pub struct CartesianProductEvidence {
    pub left_site_budget: u16,
    pub right_site_budget: u16,
    pub left_total_site_count: u16,
    pub right_total_site_count: u16,
    pub left_euler: i32,
    pub right_euler: i32,
    pub left_betti: [u32; MAX_BETTI_DIMENSION],
    pub right_betti: [u32; MAX_BETTI_DIMENSION],
    pub left_entropy_nats_bits: u64,
    pub right_entropy_nats_bits: u64,
    pub combined_entropy_nats_bits: u64,
    pub source_witness_fingerprint: ContentFingerprint,
}

/// Inputs to `PartitionProductWitness::mint_verified`. Mirrors the
/// underlying primitive's parameter list; each field is supplied by the
/// caller (typically a `product_shape!` macro expansion or a manual
/// construction following the amendment's Gap 2 pattern). Derives
/// `PartialEq` only because of the `f64` entropy fields.
#[derive(Debug, Clone, Copy, PartialEq)]
pub struct PartitionProductMintInputs {
    pub witt_bits: u16,
    pub left_fingerprint: ContentFingerprint,
    pub right_fingerprint: ContentFingerprint,
    pub left_site_budget: u16,
    pub right_site_budget: u16,
    pub left_total_site_count: u16,
    pub right_total_site_count: u16,
    pub left_euler: i32,
    pub right_euler: i32,
    pub left_entropy_nats_bits: u64,
    pub right_entropy_nats_bits: u64,
    pub combined_site_budget: u16,
    pub combined_site_count: u16,
    pub combined_euler: i32,
    pub combined_entropy_nats_bits: u64,
    pub combined_fingerprint: ContentFingerprint,
}

/// Inputs to `PartitionCoproductWitness::mint_verified`. Adds three
/// structural fields beyond the other two MintInputs: the combined
/// constraint array, the boundary index between L and R regions, and the
/// tag site layout index. These feed `validate_coproduct_structure` at
/// mint time so ST_6 / ST_7 / ST_8 are verified numerically rather than
/// trusted from the caller.
/// Derives `Debug`, `Clone`, `Copy` only — no `PartialEq`. `ConstraintRef`
/// does not implement `PartialEq`, so deriving equality on a struct with a
/// `&[ConstraintRef]` field would not compile. MintInputs is not used as
/// an equality target in practice; downstream consumers compare the minted
/// witness (which derives `Eq` + `Hash`) instead.
#[derive(Debug, Clone, Copy)]
pub struct PartitionCoproductMintInputs {
    pub witt_bits: u16,
    pub left_fingerprint: ContentFingerprint,
    pub right_fingerprint: ContentFingerprint,
    pub left_site_budget: u16,
    pub right_site_budget: u16,
    pub left_total_site_count: u16,
    pub right_total_site_count: u16,
    pub left_euler: i32,
    pub right_euler: i32,
    pub left_entropy_nats_bits: u64,
    pub right_entropy_nats_bits: u64,
    pub left_betti: [u32; MAX_BETTI_DIMENSION],
    pub right_betti: [u32; MAX_BETTI_DIMENSION],
    pub combined_site_budget: u16,
    pub combined_site_count: u16,
    pub combined_euler: i32,
    pub combined_entropy_nats_bits: u64,
    pub combined_betti: [u32; MAX_BETTI_DIMENSION],
    pub combined_fingerprint: ContentFingerprint,
    pub combined_constraints: &'static [crate::pipeline::ConstraintRef],
    pub left_constraint_count: usize,
    pub tag_site: u16,
}

/// Inputs to `CartesianProductWitness::mint_verified`. Matches the
/// CartesianProduct mint primitive's parameter list.
#[derive(Debug, Clone, Copy, PartialEq)]
pub struct CartesianProductMintInputs {
    pub witt_bits: u16,
    pub left_fingerprint: ContentFingerprint,
    pub right_fingerprint: ContentFingerprint,
    pub left_site_budget: u16,
    pub right_site_budget: u16,
    pub left_total_site_count: u16,
    pub right_total_site_count: u16,
    pub left_euler: i32,
    pub right_euler: i32,
    pub left_betti: [u32; MAX_BETTI_DIMENSION],
    pub right_betti: [u32; MAX_BETTI_DIMENSION],
    pub left_entropy_nats_bits: u64,
    pub right_entropy_nats_bits: u64,
    pub combined_site_budget: u16,
    pub combined_site_count: u16,
    pub combined_euler: i32,
    pub combined_betti: [u32; MAX_BETTI_DIMENSION],
    pub combined_entropy_nats_bits: u64,
    pub combined_fingerprint: ContentFingerprint,
}

/// Sealed PartitionProduct witness — content-addressed assertion that a
/// partition decomposes as `PartitionProduct(left, right)` per PT_2a.
/// Minting is gated on PT_1, PT_3, PT_4, and the foundation
/// `ProductLayoutWidth` invariant being verified against component
/// shapes. Existence of an instance is the attestation — there is no
/// partial or unverified form.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
pub struct PartitionProductWitness {
    witt_bits: u16,
    content_fingerprint: ContentFingerprint,
    left_fingerprint: ContentFingerprint,
    right_fingerprint: ContentFingerprint,
    combined_site_budget: u16,
    combined_site_count: u16,
}

impl PartitionProductWitness {
    /// Witt level at which the witness was minted.
    #[inline]
    #[must_use]
    pub const fn witt_bits(&self) -> u16 {
        self.witt_bits
    }
    /// Content fingerprint of the combined (A × B) shape.
    #[inline]
    #[must_use]
    pub const fn content_fingerprint(&self) -> ContentFingerprint {
        self.content_fingerprint
    }
    /// Content fingerprint of the left factor A.
    #[inline]
    #[must_use]
    pub const fn left_fingerprint(&self) -> ContentFingerprint {
        self.left_fingerprint
    }
    /// Content fingerprint of the right factor B.
    #[inline]
    #[must_use]
    pub const fn right_fingerprint(&self) -> ContentFingerprint {
        self.right_fingerprint
    }
    /// `siteBudget(A × B)` per PT_1.
    #[inline]
    #[must_use]
    pub const fn combined_site_budget(&self) -> u16 {
        self.combined_site_budget
    }
    /// `SITE_COUNT(A × B)` — the foundation layout width.
    #[inline]
    #[must_use]
    pub const fn combined_site_count(&self) -> u16 {
        self.combined_site_count
    }
    /// Crate-internal mint entry. Only the verified mint primitive may call this.
    #[inline]
    #[must_use]
    #[allow(clippy::too_many_arguments)]
    pub(crate) const fn with_level_fingerprints_and_sites(
        witt_bits: u16,
        content_fingerprint: ContentFingerprint,
        left_fingerprint: ContentFingerprint,
        right_fingerprint: ContentFingerprint,
        combined_site_budget: u16,
        combined_site_count: u16,
    ) -> Self {
        Self {
            witt_bits,
            content_fingerprint,
            left_fingerprint,
            right_fingerprint,
            combined_site_budget,
            combined_site_count,
        }
    }
}

/// Sealed PartitionCoproduct witness — content-addressed assertion that a
/// partition decomposes as `PartitionCoproduct(left, right)` per PT_2b.
/// Minting verifies ST_1, ST_2, ST_6, ST_7, ST_8, ST_9, ST_10, the
/// foundation `CoproductLayoutWidth` invariant, and — for ST_6/ST_7/ST_8 —
/// walks the supplied constraint array through `validate_coproduct_structure`.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
pub struct PartitionCoproductWitness {
    witt_bits: u16,
    content_fingerprint: ContentFingerprint,
    left_fingerprint: ContentFingerprint,
    right_fingerprint: ContentFingerprint,
    combined_site_budget: u16,
    combined_site_count: u16,
    tag_site_index: u16,
}

impl PartitionCoproductWitness {
    #[inline]
    #[must_use]
    pub const fn witt_bits(&self) -> u16 {
        self.witt_bits
    }
    #[inline]
    #[must_use]
    pub const fn content_fingerprint(&self) -> ContentFingerprint {
        self.content_fingerprint
    }
    #[inline]
    #[must_use]
    pub const fn left_fingerprint(&self) -> ContentFingerprint {
        self.left_fingerprint
    }
    #[inline]
    #[must_use]
    pub const fn right_fingerprint(&self) -> ContentFingerprint {
        self.right_fingerprint
    }
    /// `siteBudget(A + B)` per ST_1 = max(siteBudget(A), siteBudget(B)).
    #[inline]
    #[must_use]
    pub const fn combined_site_budget(&self) -> u16 {
        self.combined_site_budget
    }
    /// `SITE_COUNT(A + B)` — the foundation layout width including the new tag site.
    #[inline]
    #[must_use]
    pub const fn combined_site_count(&self) -> u16 {
        self.combined_site_count
    }
    /// Index of the tag site in the layout convention of §4b'.
    /// Equals `max(SITE_COUNT(A), SITE_COUNT(B))`.
    #[inline]
    #[must_use]
    pub const fn tag_site_index(&self) -> u16 {
        self.tag_site_index
    }
    #[inline]
    #[must_use]
    #[allow(clippy::too_many_arguments)]
    pub(crate) const fn with_level_fingerprints_sites_and_tag(
        witt_bits: u16,
        content_fingerprint: ContentFingerprint,
        left_fingerprint: ContentFingerprint,
        right_fingerprint: ContentFingerprint,
        combined_site_budget: u16,
        combined_site_count: u16,
        tag_site_index: u16,
    ) -> Self {
        Self {
            witt_bits,
            content_fingerprint,
            left_fingerprint,
            right_fingerprint,
            combined_site_budget,
            combined_site_count,
            tag_site_index,
        }
    }
}

/// Sealed CartesianPartitionProduct witness — content-addressed
/// assertion that a shape is `CartesianPartitionProduct(left, right)`
/// per CPT_2a. Minting verifies CPT_1, CPT_3, CPT_4, CPT_5, and the
/// foundation `CartesianLayoutWidth` invariant. The witness stores
/// a snapshot of the combined topological invariants (χ, Betti profile)
/// because the construction is axiomatic at the invariant level per §3c.
/// Entropy is not stored here (f64 has no Eq/Hash); use the paired
/// `CartesianProductEvidence` for entropy re-audit.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
pub struct CartesianProductWitness {
    witt_bits: u16,
    content_fingerprint: ContentFingerprint,
    left_fingerprint: ContentFingerprint,
    right_fingerprint: ContentFingerprint,
    combined_site_budget: u16,
    combined_site_count: u16,
    combined_euler: i32,
    combined_betti: [u32; MAX_BETTI_DIMENSION],
}

impl CartesianProductWitness {
    #[inline]
    #[must_use]
    pub const fn witt_bits(&self) -> u16 {
        self.witt_bits
    }
    #[inline]
    #[must_use]
    pub const fn content_fingerprint(&self) -> ContentFingerprint {
        self.content_fingerprint
    }
    #[inline]
    #[must_use]
    pub const fn left_fingerprint(&self) -> ContentFingerprint {
        self.left_fingerprint
    }
    #[inline]
    #[must_use]
    pub const fn right_fingerprint(&self) -> ContentFingerprint {
        self.right_fingerprint
    }
    #[inline]
    #[must_use]
    pub const fn combined_site_budget(&self) -> u16 {
        self.combined_site_budget
    }
    #[inline]
    #[must_use]
    pub const fn combined_site_count(&self) -> u16 {
        self.combined_site_count
    }
    #[inline]
    #[must_use]
    pub const fn combined_euler(&self) -> i32 {
        self.combined_euler
    }
    #[inline]
    #[must_use]
    pub const fn combined_betti(&self) -> [u32; MAX_BETTI_DIMENSION] {
        self.combined_betti
    }
    #[inline]
    #[must_use]
    #[allow(clippy::too_many_arguments)]
    pub(crate) const fn with_level_fingerprints_and_invariants(
        witt_bits: u16,
        content_fingerprint: ContentFingerprint,
        left_fingerprint: ContentFingerprint,
        right_fingerprint: ContentFingerprint,
        combined_site_budget: u16,
        combined_site_count: u16,
        combined_euler: i32,
        combined_betti: [u32; MAX_BETTI_DIMENSION],
    ) -> Self {
        Self {
            witt_bits,
            content_fingerprint,
            left_fingerprint,
            right_fingerprint,
            combined_site_budget,
            combined_site_count,
            combined_euler,
            combined_betti,
        }
    }
}

impl Certificate for PartitionProductWitness {
    const IRI: &'static str = "https://uor.foundation/partition/PartitionProduct";
    type Evidence = PartitionProductEvidence;
}

impl Certificate for PartitionCoproductWitness {
    const IRI: &'static str = "https://uor.foundation/partition/PartitionCoproduct";
    type Evidence = PartitionCoproductEvidence;
}

impl Certificate for CartesianProductWitness {
    const IRI: &'static str = "https://uor.foundation/partition/CartesianPartitionProduct";
    type Evidence = CartesianProductEvidence;
}

impl core::fmt::Display for PartitionProductWitness {
    fn fmt(&self, f: &mut core::fmt::Formatter<'_>) -> core::fmt::Result {
        f.write_str("PartitionProductWitness")
    }
}
impl core::error::Error for PartitionProductWitness {}

impl core::fmt::Display for PartitionCoproductWitness {
    fn fmt(&self, f: &mut core::fmt::Formatter<'_>) -> core::fmt::Result {
        f.write_str("PartitionCoproductWitness")
    }
}
impl core::error::Error for PartitionCoproductWitness {}

impl core::fmt::Display for CartesianProductWitness {
    fn fmt(&self, f: &mut core::fmt::Formatter<'_>) -> core::fmt::Result {
        f.write_str("CartesianProductWitness")
    }
}
impl core::error::Error for CartesianProductWitness {}

/// Sealed mint path for certificates that require multi-theorem verification
/// before minting. Introduced by the Product/Coproduct Completion Amendment
/// §1c; distinct from `MintWithLevelFingerprint` (which is the generic
/// partial-mint path for sealed shims). `VerifiedMint` implementors are
/// the three partition-algebra witnesses, each routing through a
/// foundation-internal mint primitive that verifies the relevant theorems.
/// The trait is public so external callers can invoke `mint_verified`
/// directly, but the `Certificate` supertrait's `certificate_sealed::Sealed`
/// bound keeps the implementor set closed to this crate.
pub trait VerifiedMint: Certificate {
    /// Caller-supplied input bundle — one `*MintInputs` struct per witness.
    type Inputs;
    /// Failure kind — always `GenericImpossibilityWitness` citing the
    /// specific op-namespace theorem or foundation-namespace layout
    /// invariant that was violated.
    type Error;
    /// Verify the theorems and invariants against `inputs`, then mint a
    /// witness or return a typed impossibility witness.
    /// # Errors
    /// Returns a `GenericImpossibilityWitness::for_identity(iri)` when any
    /// of the gated theorems or foundation invariants fails. The IRI
    /// identifies exactly which identity failed — `op/PT_*`, `op/ST_*`,
    /// `op/CPT_*`, or `foundation/*LayoutWidth` / `foundation/CoproductTagEncoding`.
    fn mint_verified(inputs: Self::Inputs) -> Result<Self, Self::Error>
    where
        Self: Sized;
}

/// Recursive classifier used by `validate_coproduct_structure`. Inspects
/// one `ConstraintRef`, tallies tag-pinner sightings via mutable references,
/// and recurses into `Conjunction` conjuncts up to `max_depth` levels. See
/// plan §A4 for the depth bound rationale.
#[allow(clippy::too_many_arguments)]
fn pc_classify_constraint(
    c: &crate::pipeline::ConstraintRef,
    in_left_region: bool,
    tag_site: u16,
    max_depth: u32,
    left_pins: &mut u32,
    right_pins: &mut u32,
    left_bias_ok: &mut bool,
    right_bias_ok: &mut bool,
) -> Result<(), GenericImpossibilityWitness> {
    match c {
        crate::pipeline::ConstraintRef::Site { position } => {
            if (*position as u16) >= tag_site {
                return Err(GenericImpossibilityWitness::for_identity(
                    "https://uor.foundation/op/ST_6",
                ));
            }
        }
        crate::pipeline::ConstraintRef::Carry { site } => {
            if (*site as u16) >= tag_site {
                return Err(GenericImpossibilityWitness::for_identity(
                    "https://uor.foundation/op/ST_6",
                ));
            }
        }
        crate::pipeline::ConstraintRef::Affine {
            coefficients,
            coefficient_count,
            bias,
        } => {
            let count = *coefficient_count as usize;
            let mut nonzero_count: u32 = 0;
            let mut nonzero_index: usize = 0;
            let mut max_nonzero_index: usize = 0;
            let mut i: usize = 0;
            while i < count && i < crate::pipeline::AFFINE_MAX_COEFFS {
                if coefficients[i] != 0 {
                    nonzero_count = nonzero_count.saturating_add(1);
                    nonzero_index = i;
                    if i > max_nonzero_index {
                        max_nonzero_index = i;
                    }
                }
                i += 1;
            }
            let touches_tag_site = nonzero_count > 0 && (max_nonzero_index as u16) >= tag_site;
            let is_canonical_tag_pinner = nonzero_count == 1
                && (nonzero_index as u16) == tag_site
                && coefficients[nonzero_index] == 1;
            if is_canonical_tag_pinner {
                if *bias != 0 && *bias != -1 {
                    return Err(GenericImpossibilityWitness::for_identity(
                        "https://uor.foundation/foundation/CoproductTagEncoding",
                    ));
                }
                if in_left_region {
                    *left_pins = left_pins.saturating_add(1);
                    if *bias != 0 {
                        *left_bias_ok = false;
                    }
                } else {
                    *right_pins = right_pins.saturating_add(1);
                    if *bias != -1 {
                        *right_bias_ok = false;
                    }
                }
            } else if touches_tag_site {
                let nonzero_only_at_tag_site =
                    nonzero_count == 1 && (nonzero_index as u16) == tag_site;
                if nonzero_only_at_tag_site {
                    return Err(GenericImpossibilityWitness::for_identity(
                        "https://uor.foundation/foundation/CoproductTagEncoding",
                    ));
                } else {
                    return Err(GenericImpossibilityWitness::for_identity(
                        "https://uor.foundation/op/ST_6",
                    ));
                }
            }
        }
        crate::pipeline::ConstraintRef::Conjunction {
            conjuncts,
            conjunct_count,
        } => {
            if max_depth == 0 {
                return Err(GenericImpossibilityWitness::for_identity(
                    "https://uor.foundation/op/ST_6",
                ));
            }
            let count = *conjunct_count as usize;
            let mut idx: usize = 0;
            while idx < count && idx < crate::pipeline::CONJUNCTION_MAX_TERMS {
                let lifted = conjuncts[idx].into_constraint();
                pc_classify_constraint(
                    &lifted,
                    in_left_region,
                    tag_site,
                    max_depth - 1,
                    left_pins,
                    right_pins,
                    left_bias_ok,
                    right_bias_ok,
                )?;
                idx += 1;
            }
        }
        crate::pipeline::ConstraintRef::Residue { .. }
        | crate::pipeline::ConstraintRef::Hamming { .. }
        | crate::pipeline::ConstraintRef::Depth { .. }
        | crate::pipeline::ConstraintRef::SatClauses { .. }
        | crate::pipeline::ConstraintRef::Bound { .. } => {
            // No site references at this level; nothing to check.
        }
    }
    Ok(())
}

/// Validates ST_6 / ST_7 / ST_8 for a PartitionCoproduct construction by
/// walking the emitted constraint array. Recurses into
/// `ConstraintRef::Conjunction` conjuncts up to depth 8 (bounded by
/// `NERVE_CONSTRAINTS_CAP`) so nested constructions are audited without
/// unbounded recursion.
/// # Errors
/// Returns `GenericImpossibilityWitness::for_identity(...)` citing the
/// specific failed identity: `op/ST_6`, `op/ST_7`, or
/// `foundation/CoproductTagEncoding`. ST_8 is implied by ST_6 ∧ ST_7 and
/// is not cited separately on failure.
pub(crate) fn validate_coproduct_structure(
    combined_constraints: &[crate::pipeline::ConstraintRef],
    left_constraint_count: usize,
    tag_site: u16,
) -> Result<(), GenericImpossibilityWitness> {
    let mut left_pins: u32 = 0;
    let mut right_pins: u32 = 0;
    let mut left_bias_ok: bool = true;
    let mut right_bias_ok: bool = true;
    let mut idx: usize = 0;
    while idx < combined_constraints.len() {
        let in_left_region = idx < left_constraint_count;
        pc_classify_constraint(
            &combined_constraints[idx],
            in_left_region,
            tag_site,
            NERVE_CONSTRAINTS_CAP as u32,
            &mut left_pins,
            &mut right_pins,
            &mut left_bias_ok,
            &mut right_bias_ok,
        )?;
        idx += 1;
    }
    if left_pins != 1 || right_pins != 1 {
        return Err(GenericImpossibilityWitness::for_identity(
            "https://uor.foundation/op/ST_6",
        ));
    }
    if !left_bias_ok || !right_bias_ok {
        return Err(GenericImpossibilityWitness::for_identity(
            "https://uor.foundation/op/ST_7",
        ));
    }
    Ok(())
}

/// Mint a `PartitionProductWitness` after verifying PT_1, PT_3, PT_4, and
/// the `ProductLayoutWidth` layout invariant. PT_2a is structural (the
/// witness existing is the claim); no separate check is needed once the
/// invariants match.
#[allow(clippy::too_many_arguments)]
pub(crate) fn pc_primitive_partition_product(
    witt_bits: u16,
    left_fingerprint: ContentFingerprint,
    right_fingerprint: ContentFingerprint,
    left_site_budget: u16,
    right_site_budget: u16,
    left_total_site_count: u16,
    right_total_site_count: u16,
    left_euler: i32,
    right_euler: i32,
    left_entropy_nats_bits: u64,
    right_entropy_nats_bits: u64,
    combined_site_budget: u16,
    combined_site_count: u16,
    combined_euler: i32,
    combined_entropy_nats_bits: u64,
    combined_fingerprint: ContentFingerprint,
) -> Result<PartitionProductWitness, GenericImpossibilityWitness> {
    let left_entropy_nats =
        <f64 as crate::DecimalTranscendental>::from_bits(left_entropy_nats_bits);
    let right_entropy_nats =
        <f64 as crate::DecimalTranscendental>::from_bits(right_entropy_nats_bits);
    let combined_entropy_nats =
        <f64 as crate::DecimalTranscendental>::from_bits(combined_entropy_nats_bits);
    if combined_site_budget != left_site_budget.saturating_add(right_site_budget) {
        return Err(GenericImpossibilityWitness::for_identity(
            "https://uor.foundation/op/PT_1",
        ));
    }
    if combined_site_count != left_total_site_count.saturating_add(right_total_site_count) {
        return Err(GenericImpossibilityWitness::for_identity(
            "https://uor.foundation/foundation/ProductLayoutWidth",
        ));
    }
    if combined_euler != left_euler.saturating_add(right_euler) {
        return Err(GenericImpossibilityWitness::for_identity(
            "https://uor.foundation/op/PT_3",
        ));
    }
    if !pc_entropy_input_is_valid(left_entropy_nats)
        || !pc_entropy_input_is_valid(right_entropy_nats)
        || !pc_entropy_input_is_valid(combined_entropy_nats)
    {
        return Err(GenericImpossibilityWitness::for_identity(
            "https://uor.foundation/op/PT_4",
        ));
    }
    let expected_entropy = left_entropy_nats + right_entropy_nats;
    if !pc_entropy_additivity_holds(combined_entropy_nats, expected_entropy) {
        return Err(GenericImpossibilityWitness::for_identity(
            "https://uor.foundation/op/PT_4",
        ));
    }
    Ok(PartitionProductWitness::with_level_fingerprints_and_sites(
        witt_bits,
        combined_fingerprint,
        left_fingerprint,
        right_fingerprint,
        combined_site_budget,
        combined_site_count,
    ))
}

/// Mint a `PartitionCoproductWitness` after verifying ST_1, ST_2, ST_6,
/// ST_7, ST_8, ST_9, ST_10, the `CoproductLayoutWidth` layout invariant,
/// the tag-site alignment against §4b', and running
/// `validate_coproduct_structure` over the supplied constraint array.
#[allow(clippy::too_many_arguments)]
pub(crate) fn pc_primitive_partition_coproduct(
    witt_bits: u16,
    left_fingerprint: ContentFingerprint,
    right_fingerprint: ContentFingerprint,
    left_site_budget: u16,
    right_site_budget: u16,
    left_total_site_count: u16,
    right_total_site_count: u16,
    left_euler: i32,
    right_euler: i32,
    left_entropy_nats_bits: u64,
    right_entropy_nats_bits: u64,
    left_betti: [u32; MAX_BETTI_DIMENSION],
    right_betti: [u32; MAX_BETTI_DIMENSION],
    combined_site_budget: u16,
    combined_site_count: u16,
    combined_euler: i32,
    combined_entropy_nats_bits: u64,
    combined_betti: [u32; MAX_BETTI_DIMENSION],
    combined_fingerprint: ContentFingerprint,
    combined_constraints: &[crate::pipeline::ConstraintRef],
    left_constraint_count: usize,
    tag_site: u16,
) -> Result<PartitionCoproductWitness, GenericImpossibilityWitness> {
    let left_entropy_nats =
        <f64 as crate::DecimalTranscendental>::from_bits(left_entropy_nats_bits);
    let right_entropy_nats =
        <f64 as crate::DecimalTranscendental>::from_bits(right_entropy_nats_bits);
    let combined_entropy_nats =
        <f64 as crate::DecimalTranscendental>::from_bits(combined_entropy_nats_bits);
    let expected_budget = if left_site_budget > right_site_budget {
        left_site_budget
    } else {
        right_site_budget
    };
    if combined_site_budget != expected_budget {
        return Err(GenericImpossibilityWitness::for_identity(
            "https://uor.foundation/op/ST_1",
        ));
    }
    let max_total = if left_total_site_count > right_total_site_count {
        left_total_site_count
    } else {
        right_total_site_count
    };
    let expected_total = max_total.saturating_add(1);
    if combined_site_count != expected_total {
        return Err(GenericImpossibilityWitness::for_identity(
            "https://uor.foundation/foundation/CoproductLayoutWidth",
        ));
    }
    if !pc_entropy_input_is_valid(left_entropy_nats)
        || !pc_entropy_input_is_valid(right_entropy_nats)
        || !pc_entropy_input_is_valid(combined_entropy_nats)
    {
        return Err(GenericImpossibilityWitness::for_identity(
            "https://uor.foundation/op/ST_2",
        ));
    }
    let max_operand_entropy = if left_entropy_nats > right_entropy_nats {
        left_entropy_nats
    } else {
        right_entropy_nats
    };
    let expected_entropy = core::f64::consts::LN_2 + max_operand_entropy;
    if !pc_entropy_additivity_holds(combined_entropy_nats, expected_entropy) {
        return Err(GenericImpossibilityWitness::for_identity(
            "https://uor.foundation/op/ST_2",
        ));
    }
    if tag_site != max_total {
        return Err(GenericImpossibilityWitness::for_identity(
            "https://uor.foundation/foundation/CoproductLayoutWidth",
        ));
    }
    validate_coproduct_structure(combined_constraints, left_constraint_count, tag_site)?;
    if combined_euler != left_euler.saturating_add(right_euler) {
        return Err(GenericImpossibilityWitness::for_identity(
            "https://uor.foundation/op/ST_9",
        ));
    }
    let mut k: usize = 0;
    while k < MAX_BETTI_DIMENSION {
        if combined_betti[k] != left_betti[k].saturating_add(right_betti[k]) {
            return Err(GenericImpossibilityWitness::for_identity(
                "https://uor.foundation/op/ST_10",
            ));
        }
        k += 1;
    }
    Ok(
        PartitionCoproductWitness::with_level_fingerprints_sites_and_tag(
            witt_bits,
            combined_fingerprint,
            left_fingerprint,
            right_fingerprint,
            combined_site_budget,
            combined_site_count,
            max_total,
        ),
    )
}

/// Mint a `CartesianProductWitness` after verifying CPT_1, CPT_3, CPT_4,
/// CPT_5, and the `CartesianLayoutWidth` layout invariant. Checks
/// caller-supplied Künneth-composed invariants against the component
/// values (the witness defines these axiomatically per §3c).
#[allow(clippy::too_many_arguments)]
pub(crate) fn pc_primitive_cartesian_product(
    witt_bits: u16,
    left_fingerprint: ContentFingerprint,
    right_fingerprint: ContentFingerprint,
    left_site_budget: u16,
    right_site_budget: u16,
    left_total_site_count: u16,
    right_total_site_count: u16,
    left_euler: i32,
    right_euler: i32,
    left_betti: [u32; MAX_BETTI_DIMENSION],
    right_betti: [u32; MAX_BETTI_DIMENSION],
    left_entropy_nats_bits: u64,
    right_entropy_nats_bits: u64,
    combined_site_budget: u16,
    combined_site_count: u16,
    combined_euler: i32,
    combined_betti: [u32; MAX_BETTI_DIMENSION],
    combined_entropy_nats_bits: u64,
    combined_fingerprint: ContentFingerprint,
) -> Result<CartesianProductWitness, GenericImpossibilityWitness> {
    let left_entropy_nats =
        <f64 as crate::DecimalTranscendental>::from_bits(left_entropy_nats_bits);
    let right_entropy_nats =
        <f64 as crate::DecimalTranscendental>::from_bits(right_entropy_nats_bits);
    let combined_entropy_nats =
        <f64 as crate::DecimalTranscendental>::from_bits(combined_entropy_nats_bits);
    if combined_site_budget != left_site_budget.saturating_add(right_site_budget) {
        return Err(GenericImpossibilityWitness::for_identity(
            "https://uor.foundation/op/CPT_1",
        ));
    }
    if combined_site_count != left_total_site_count.saturating_add(right_total_site_count) {
        return Err(GenericImpossibilityWitness::for_identity(
            "https://uor.foundation/foundation/CartesianLayoutWidth",
        ));
    }
    if combined_euler != left_euler.saturating_mul(right_euler) {
        return Err(GenericImpossibilityWitness::for_identity(
            "https://uor.foundation/op/CPT_3",
        ));
    }
    let kunneth = crate::pipeline::kunneth_compose(&left_betti, &right_betti);
    let mut k: usize = 0;
    while k < MAX_BETTI_DIMENSION {
        if combined_betti[k] != kunneth[k] {
            return Err(GenericImpossibilityWitness::for_identity(
                "https://uor.foundation/op/CPT_4",
            ));
        }
        k += 1;
    }
    if !pc_entropy_input_is_valid(left_entropy_nats)
        || !pc_entropy_input_is_valid(right_entropy_nats)
        || !pc_entropy_input_is_valid(combined_entropy_nats)
    {
        return Err(GenericImpossibilityWitness::for_identity(
            "https://uor.foundation/op/CPT_5",
        ));
    }
    let expected_entropy = left_entropy_nats + right_entropy_nats;
    if !pc_entropy_additivity_holds(combined_entropy_nats, expected_entropy) {
        return Err(GenericImpossibilityWitness::for_identity(
            "https://uor.foundation/op/CPT_5",
        ));
    }
    Ok(
        CartesianProductWitness::with_level_fingerprints_and_invariants(
            witt_bits,
            combined_fingerprint,
            left_fingerprint,
            right_fingerprint,
            combined_site_budget,
            combined_site_count,
            combined_euler,
            combined_betti,
        ),
    )
}

impl VerifiedMint for PartitionProductWitness {
    type Inputs = PartitionProductMintInputs;
    type Error = GenericImpossibilityWitness;
    fn mint_verified(inputs: Self::Inputs) -> Result<Self, Self::Error> {
        pc_primitive_partition_product(
            inputs.witt_bits,
            inputs.left_fingerprint,
            inputs.right_fingerprint,
            inputs.left_site_budget,
            inputs.right_site_budget,
            inputs.left_total_site_count,
            inputs.right_total_site_count,
            inputs.left_euler,
            inputs.right_euler,
            inputs.left_entropy_nats_bits,
            inputs.right_entropy_nats_bits,
            inputs.combined_site_budget,
            inputs.combined_site_count,
            inputs.combined_euler,
            inputs.combined_entropy_nats_bits,
            inputs.combined_fingerprint,
        )
    }
}

impl VerifiedMint for PartitionCoproductWitness {
    type Inputs = PartitionCoproductMintInputs;
    type Error = GenericImpossibilityWitness;
    fn mint_verified(inputs: Self::Inputs) -> Result<Self, Self::Error> {
        pc_primitive_partition_coproduct(
            inputs.witt_bits,
            inputs.left_fingerprint,
            inputs.right_fingerprint,
            inputs.left_site_budget,
            inputs.right_site_budget,
            inputs.left_total_site_count,
            inputs.right_total_site_count,
            inputs.left_euler,
            inputs.right_euler,
            inputs.left_entropy_nats_bits,
            inputs.right_entropy_nats_bits,
            inputs.left_betti,
            inputs.right_betti,
            inputs.combined_site_budget,
            inputs.combined_site_count,
            inputs.combined_euler,
            inputs.combined_entropy_nats_bits,
            inputs.combined_betti,
            inputs.combined_fingerprint,
            inputs.combined_constraints,
            inputs.left_constraint_count,
            inputs.tag_site,
        )
    }
}

impl VerifiedMint for CartesianProductWitness {
    type Inputs = CartesianProductMintInputs;
    type Error = GenericImpossibilityWitness;
    fn mint_verified(inputs: Self::Inputs) -> Result<Self, Self::Error> {
        pc_primitive_cartesian_product(
            inputs.witt_bits,
            inputs.left_fingerprint,
            inputs.right_fingerprint,
            inputs.left_site_budget,
            inputs.right_site_budget,
            inputs.left_total_site_count,
            inputs.right_total_site_count,
            inputs.left_euler,
            inputs.right_euler,
            inputs.left_betti,
            inputs.right_betti,
            inputs.left_entropy_nats_bits,
            inputs.right_entropy_nats_bits,
            inputs.combined_site_budget,
            inputs.combined_site_count,
            inputs.combined_euler,
            inputs.combined_betti,
            inputs.combined_entropy_nats_bits,
            inputs.combined_fingerprint,
        )
    }
}

/// Data record of a partition's runtime-queried properties. Produced at
/// witness-mint time and consulted by consumer code that holds a
/// `PartitionHandle` and a `PartitionResolver`. Phase 9 stores entropy
/// as the IEEE-754 `u64` bit-pattern (`entropy_nats_bits`) so the record
/// derives `Eq + Hash` cleanly; consumers project to `H::Decimal` via
/// `<H::Decimal as DecimalTranscendental>::from_bits`.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
pub struct PartitionRecord<H: crate::HostTypes> {
    /// Data sites only — the partition's `siteBudget`, not its layout width.
    pub site_budget: u16,
    /// Euler characteristic of the partition's nerve.
    pub euler: i32,
    /// Betti profile of the partition's nerve, padded to `MAX_BETTI_DIMENSION`.
    pub betti: [u32; MAX_BETTI_DIMENSION],
    /// Shannon entropy in nats (matches `LandauerBudget::nats()` convention).
    pub entropy_nats_bits: u64,
    _phantom: core::marker::PhantomData<H>,
}

impl<H: crate::HostTypes> PartitionRecord<H> {
    /// Construct a new record. The phantom marker ensures records are
    /// parameterized by the host types they originate from.
    #[inline]
    #[must_use]
    pub const fn new(
        site_budget: u16,
        euler: i32,
        betti: [u32; MAX_BETTI_DIMENSION],
        entropy_nats_bits: u64,
    ) -> Self {
        Self {
            site_budget,
            euler,
            betti,
            entropy_nats_bits,
            _phantom: core::marker::PhantomData,
        }
    }
}

/// Resolver mapping content fingerprints to `PartitionRecord`s. Provided
/// by the host application — typically a persistent store, an in-memory
/// registry populated from witness mint-time data, or a chain-of-witnesses
/// trail that can reconstruct properties.
pub trait PartitionResolver<H: crate::HostTypes> {
    /// Look up partition data by fingerprint. Returns `None` if the
    /// resolver has no record for the handle. Handles remain valid as
    /// identity tokens regardless of resolver presence.
    fn resolve(&self, fp: ContentFingerprint) -> Option<PartitionRecord<H>>;
}

/// Content-addressed identity token for a partition. Carries only a
/// fingerprint; partition data is recovered by pairing the handle with a
/// `PartitionResolver` via `resolve_with`. Handles compare and hash by
/// fingerprint, so they can serve as keys in content-addressed indices
/// without resolver access.
#[derive(Debug)]
pub struct PartitionHandle<H: crate::HostTypes> {
    fingerprint: ContentFingerprint,
    _phantom: core::marker::PhantomData<H>,
}
impl<H: crate::HostTypes> Copy for PartitionHandle<H> {}
impl<H: crate::HostTypes> Clone for PartitionHandle<H> {
    #[inline]
    fn clone(&self) -> Self {
        *self
    }
}
impl<H: crate::HostTypes> PartialEq for PartitionHandle<H> {
    #[inline]
    fn eq(&self, other: &Self) -> bool {
        self.fingerprint == other.fingerprint
    }
}
impl<H: crate::HostTypes> Eq for PartitionHandle<H> {}
impl<H: crate::HostTypes> core::hash::Hash for PartitionHandle<H> {
    #[inline]
    fn hash<S: core::hash::Hasher>(&self, state: &mut S) {
        self.fingerprint.hash(state);
    }
}

impl<H: crate::HostTypes> PartitionHandle<H> {
    /// Construct a handle from a content fingerprint.
    #[inline]
    #[must_use]
    pub const fn from_fingerprint(fingerprint: ContentFingerprint) -> Self {
        Self {
            fingerprint,
            _phantom: core::marker::PhantomData,
        }
    }
    /// Return the content fingerprint this handle references.
    #[inline]
    #[must_use]
    pub const fn fingerprint(&self) -> ContentFingerprint {
        self.fingerprint
    }
    /// Resolve this handle against a consumer-supplied resolver.
    /// Returns `None` if the resolver has no record for this fingerprint.
    #[inline]
    pub fn resolve_with<R: PartitionResolver<H>>(
        &self,
        resolver: &R,
    ) -> Option<PartitionRecord<H>> {
        resolver.resolve(self.fingerprint)
    }
}

/// Resolver-absent default `Element<H>`. Returns empty defaults via the
/// `HostTypes::EMPTY_*` constants — used by `NullDatum<H>` and
/// `NullTypeDefinition<H>` to satisfy their `Element` associated types.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
pub struct NullElement<H: HostTypes> {
    _phantom: core::marker::PhantomData<H>,
}
impl<H: HostTypes> Default for NullElement<H> {
    fn default() -> Self {
        Self {
            _phantom: core::marker::PhantomData,
        }
    }
}
impl<H: HostTypes> crate::kernel::address::Element<H> for NullElement<H> {
    fn length(&self) -> u64 {
        0
    }
    fn addresses(&self) -> &H::HostString {
        H::EMPTY_HOST_STRING
    }
    fn digest(&self) -> &H::HostString {
        H::EMPTY_HOST_STRING
    }
    fn digest_algorithm(&self) -> &H::HostString {
        H::EMPTY_HOST_STRING
    }
    fn canonical_bytes(&self) -> &H::WitnessBytes {
        H::EMPTY_WITNESS_BYTES
    }
    fn witt_length(&self) -> u64 {
        0
    }
}

/// Resolver-absent default `Datum<H>`. All numeric methods return 0.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
pub struct NullDatum<H: HostTypes> {
    element: NullElement<H>,
    _phantom: core::marker::PhantomData<H>,
}
impl<H: HostTypes> Default for NullDatum<H> {
    fn default() -> Self {
        Self {
            element: NullElement::default(),
            _phantom: core::marker::PhantomData,
        }
    }
}
impl<H: HostTypes> crate::kernel::schema::Datum<H> for NullDatum<H> {
    fn value(&self) -> u64 {
        0
    }
    fn witt_length(&self) -> u64 {
        0
    }
    fn stratum(&self) -> u64 {
        0
    }
    fn spectrum(&self) -> u64 {
        0
    }
    type Element = NullElement<H>;
    fn element(&self) -> &Self::Element {
        &self.element
    }
}

/// Resolver-absent default `TermExpression<H>`. Empty marker trait, no methods.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
pub struct NullTermExpression<H: HostTypes> {
    _phantom: core::marker::PhantomData<H>,
}
impl<H: HostTypes> Default for NullTermExpression<H> {
    fn default() -> Self {
        Self {
            _phantom: core::marker::PhantomData,
        }
    }
}
impl<H: HostTypes> crate::kernel::schema::TermExpression<H> for NullTermExpression<H> {}

/// Resolver-absent default `SiteIndex<H>`. Self-recursive: `ancilla_site()`
/// returns `&self` (no ancilla pairing in the default).
#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
pub struct NullSiteIndex<H: HostTypes> {
    _phantom: core::marker::PhantomData<H>,
}
impl<H: HostTypes> Default for NullSiteIndex<H> {
    fn default() -> Self {
        Self {
            _phantom: core::marker::PhantomData,
        }
    }
}
impl<H: HostTypes> crate::bridge::partition::SiteIndex<H> for NullSiteIndex<H> {
    fn site_position(&self) -> u64 {
        0
    }
    fn site_state(&self) -> u64 {
        0
    }
    type SiteIndexTarget = NullSiteIndex<H>;
    fn ancilla_site(&self) -> &Self::SiteIndexTarget {
        self
    }
}

/// Resolver-absent default `TagSite<H>`. Embeds an inline `NullSiteIndex`
/// field so the inherited `ancilla_site()` accessor returns a valid
/// reference; `tag_value()` returns false.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
pub struct NullTagSite<H: HostTypes> {
    ancilla: NullSiteIndex<H>,
}
impl<H: HostTypes> Default for NullTagSite<H> {
    fn default() -> Self {
        Self {
            ancilla: NullSiteIndex::default(),
        }
    }
}
impl<H: HostTypes> crate::bridge::partition::SiteIndex<H> for NullTagSite<H> {
    fn site_position(&self) -> u64 {
        0
    }
    fn site_state(&self) -> u64 {
        0
    }
    type SiteIndexTarget = NullSiteIndex<H>;
    fn ancilla_site(&self) -> &Self::SiteIndexTarget {
        &self.ancilla
    }
}
impl<H: HostTypes> crate::bridge::partition::TagSite<H> for NullTagSite<H> {
    fn tag_value(&self) -> bool {
        false
    }
}

/// Resolver-absent default `SiteBinding<H>`. Embeds inline `NullConstraint`
/// and `NullSiteIndex` so the trait's reference accessors work via &self.field.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
pub struct NullSiteBinding<H: HostTypes> {
    constraint: NullConstraint<H>,
    site_index: NullSiteIndex<H>,
}
impl<H: HostTypes> Default for NullSiteBinding<H> {
    fn default() -> Self {
        Self {
            constraint: NullConstraint::default(),
            site_index: NullSiteIndex::default(),
        }
    }
}
impl<H: HostTypes> crate::bridge::partition::SiteBinding<H> for NullSiteBinding<H> {
    type Constraint = NullConstraint<H>;
    fn pinned_by(&self) -> &Self::Constraint {
        &self.constraint
    }
    type SiteIndex = NullSiteIndex<H>;
    fn pins_coordinate(&self) -> &Self::SiteIndex {
        &self.site_index
    }
}

/// Resolver-absent default `Constraint<H>`. Returns Vertical metric axis,
/// empty pinned-sites slice, and zero crossing cost.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
pub struct NullConstraint<H: HostTypes> {
    _phantom: core::marker::PhantomData<H>,
}
impl<H: HostTypes> Default for NullConstraint<H> {
    fn default() -> Self {
        Self {
            _phantom: core::marker::PhantomData,
        }
    }
}
impl<H: HostTypes> crate::user::type_::Constraint<H> for NullConstraint<H> {
    fn metric_axis(&self) -> MetricAxis {
        MetricAxis::Vertical
    }
    type SiteIndex = NullSiteIndex<H>;
    fn pins_sites(&self) -> &[Self::SiteIndex] {
        &[]
    }
    fn crossing_cost(&self) -> u64 {
        0
    }
}

/// Resolver-absent default `FreeRank<H>`. Empty budget — `is_closed()` true,
/// zero counts. Empty `has_site` / `has_binding` slices.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
pub struct NullFreeRank<H: HostTypes> {
    _phantom: core::marker::PhantomData<H>,
}
impl<H: HostTypes> Default for NullFreeRank<H> {
    fn default() -> Self {
        Self {
            _phantom: core::marker::PhantomData,
        }
    }
}
impl<H: HostTypes> crate::bridge::partition::FreeRank<H> for NullFreeRank<H> {
    fn total_sites(&self) -> u64 {
        0
    }
    fn pinned_count(&self) -> u64 {
        0
    }
    fn free_rank(&self) -> u64 {
        0
    }
    fn is_closed(&self) -> bool {
        true
    }
    type SiteIndex = NullSiteIndex<H>;
    fn has_site(&self) -> &[Self::SiteIndex] {
        &[]
    }
    type SiteBinding = NullSiteBinding<H>;
    fn has_binding(&self) -> &[Self::SiteBinding] {
        &[]
    }
    fn reversible_strategy(&self) -> bool {
        false
    }
}

/// Resolver-absent default `IrreducibleSet<H>`. Implements `Component<H>` with empty
/// `member` slice and zero `cardinality`.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
pub struct NullIrreducibleSet<H: HostTypes> {
    _phantom: core::marker::PhantomData<H>,
}
impl<H: HostTypes> Default for NullIrreducibleSet<H> {
    fn default() -> Self {
        Self {
            _phantom: core::marker::PhantomData,
        }
    }
}
impl<H: HostTypes> crate::bridge::partition::Component<H> for NullIrreducibleSet<H> {
    type Datum = NullDatum<H>;
    fn member(&self) -> &[Self::Datum] {
        &[]
    }
    fn cardinality(&self) -> u64 {
        0
    }
}
impl<H: HostTypes> crate::bridge::partition::IrreducibleSet<H> for NullIrreducibleSet<H> {}

/// Resolver-absent default `ReducibleSet<H>`. Implements `Component<H>` with empty
/// `member` slice and zero `cardinality`.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
pub struct NullReducibleSet<H: HostTypes> {
    _phantom: core::marker::PhantomData<H>,
}
impl<H: HostTypes> Default for NullReducibleSet<H> {
    fn default() -> Self {
        Self {
            _phantom: core::marker::PhantomData,
        }
    }
}
impl<H: HostTypes> crate::bridge::partition::Component<H> for NullReducibleSet<H> {
    type Datum = NullDatum<H>;
    fn member(&self) -> &[Self::Datum] {
        &[]
    }
    fn cardinality(&self) -> u64 {
        0
    }
}
impl<H: HostTypes> crate::bridge::partition::ReducibleSet<H> for NullReducibleSet<H> {}

/// Resolver-absent default `UnitGroup<H>`. Implements `Component<H>` with empty
/// `member` slice and zero `cardinality`.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
pub struct NullUnitGroup<H: HostTypes> {
    _phantom: core::marker::PhantomData<H>,
}
impl<H: HostTypes> Default for NullUnitGroup<H> {
    fn default() -> Self {
        Self {
            _phantom: core::marker::PhantomData,
        }
    }
}
impl<H: HostTypes> crate::bridge::partition::Component<H> for NullUnitGroup<H> {
    type Datum = NullDatum<H>;
    fn member(&self) -> &[Self::Datum] {
        &[]
    }
    fn cardinality(&self) -> u64 {
        0
    }
}
impl<H: HostTypes> crate::bridge::partition::UnitGroup<H> for NullUnitGroup<H> {}

/// Resolver-absent default `Complement<H>`. Implements `Component<H>` plus
/// the `exterior_criteria()` accessor returning a reference to an embedded
/// `NullTermExpression`.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
pub struct NullComplement<H: HostTypes> {
    term: NullTermExpression<H>,
}
impl<H: HostTypes> Default for NullComplement<H> {
    fn default() -> Self {
        Self {
            term: NullTermExpression::default(),
        }
    }
}
impl<H: HostTypes> crate::bridge::partition::Component<H> for NullComplement<H> {
    type Datum = NullDatum<H>;
    fn member(&self) -> &[Self::Datum] {
        &[]
    }
    fn cardinality(&self) -> u64 {
        0
    }
}
impl<H: HostTypes> crate::bridge::partition::Complement<H> for NullComplement<H> {
    type TermExpression = NullTermExpression<H>;
    fn exterior_criteria(&self) -> &Self::TermExpression {
        &self.term
    }
}

/// Resolver-absent default `TypeDefinition<H>`. Embeds inline `NullElement`
/// for the content_address accessor.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
pub struct NullTypeDefinition<H: HostTypes> {
    element: NullElement<H>,
}
impl<H: HostTypes> Default for NullTypeDefinition<H> {
    fn default() -> Self {
        Self {
            element: NullElement::default(),
        }
    }
}
impl<H: HostTypes> crate::user::type_::TypeDefinition<H> for NullTypeDefinition<H> {
    type Element = NullElement<H>;
    fn content_address(&self) -> &Self::Element {
        &self.element
    }
}

/// Resolver-absent default `Partition<H>`. Embeds inline stubs for every
/// sub-trait associated type so `Partition<H>` accessors return references
/// to fields rather than to statics. The only meaningful state is the
/// `fingerprint`; everything else uses `HostTypes::EMPTY_*` defaults.
/// Returned by the three witness trait impls' `left_factor` / `right_factor`
/// / `left_summand` / etc. accessors as the resolver-absent value pathway.
/// Consumers needing real partition data pair the sibling `PartitionHandle`
/// with a `PartitionResolver` instead.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
pub struct NullPartition<H: HostTypes> {
    irreducibles: NullIrreducibleSet<H>,
    reducibles: NullReducibleSet<H>,
    units: NullUnitGroup<H>,
    exterior: NullComplement<H>,
    free_rank: NullFreeRank<H>,
    tag_site: NullTagSite<H>,
    source_type: NullTypeDefinition<H>,
    fingerprint: ContentFingerprint,
}

impl<H: HostTypes> NullPartition<H> {
    /// Construct a NullPartition with the given content fingerprint.
    /// All other fields are resolver-absent defaults.
    #[inline]
    #[must_use]
    pub fn from_fingerprint(fingerprint: ContentFingerprint) -> Self {
        Self {
            irreducibles: NullIrreducibleSet::default(),
            reducibles: NullReducibleSet::default(),
            units: NullUnitGroup::default(),
            exterior: NullComplement::default(),
            free_rank: NullFreeRank::default(),
            tag_site: NullTagSite::default(),
            source_type: NullTypeDefinition::default(),
            fingerprint,
        }
    }
    /// Returns the content fingerprint identifying which Partition this stub stands in for.
    #[inline]
    #[must_use]
    pub const fn fingerprint(&self) -> ContentFingerprint {
        self.fingerprint
    }
    /// Phase 2 (orphan-closure): absent-value sentinel used by Null stubs
    /// in other namespaces to satisfy `&Self::Partition` return borrows.
    pub const ABSENT: NullPartition<H> = NullPartition {
        irreducibles: NullIrreducibleSet {
            _phantom: core::marker::PhantomData,
        },
        reducibles: NullReducibleSet {
            _phantom: core::marker::PhantomData,
        },
        units: NullUnitGroup {
            _phantom: core::marker::PhantomData,
        },
        exterior: NullComplement {
            term: NullTermExpression {
                _phantom: core::marker::PhantomData,
            },
        },
        free_rank: NullFreeRank {
            _phantom: core::marker::PhantomData,
        },
        tag_site: NullTagSite {
            ancilla: NullSiteIndex {
                _phantom: core::marker::PhantomData,
            },
        },
        source_type: NullTypeDefinition {
            element: NullElement {
                _phantom: core::marker::PhantomData,
            },
        },
        fingerprint: ContentFingerprint::zero(),
    };
}

impl<H: HostTypes> crate::bridge::partition::Partition<H> for NullPartition<H> {
    type IrreducibleSet = NullIrreducibleSet<H>;
    fn irreducibles(&self) -> &Self::IrreducibleSet {
        &self.irreducibles
    }
    type ReducibleSet = NullReducibleSet<H>;
    fn reducibles(&self) -> &Self::ReducibleSet {
        &self.reducibles
    }
    type UnitGroup = NullUnitGroup<H>;
    fn units(&self) -> &Self::UnitGroup {
        &self.units
    }
    type Complement = NullComplement<H>;
    fn exterior(&self) -> &Self::Complement {
        &self.exterior
    }
    fn density(&self) -> H::Decimal {
        H::EMPTY_DECIMAL
    }
    type TypeDefinition = NullTypeDefinition<H>;
    fn source_type(&self) -> &Self::TypeDefinition {
        &self.source_type
    }
    fn witt_length(&self) -> u64 {
        0
    }
    type FreeRank = NullFreeRank<H>;
    fn site_budget(&self) -> &Self::FreeRank {
        &self.free_rank
    }
    fn is_exhaustive(&self) -> bool {
        true
    }
    type TagSite = NullTagSite<H>;
    fn tag_site_of(&self) -> &Self::TagSite {
        &self.tag_site
    }
    fn product_category_level(&self) -> &H::HostString {
        H::EMPTY_HOST_STRING
    }
}

impl<H: HostTypes> crate::bridge::partition::PartitionProduct<H> for PartitionProductWitness {
    type Partition = NullPartition<H>;
    fn left_factor(&self) -> Self::Partition {
        NullPartition::from_fingerprint(self.left_fingerprint)
    }
    fn right_factor(&self) -> Self::Partition {
        NullPartition::from_fingerprint(self.right_fingerprint)
    }
}

impl<H: HostTypes> crate::bridge::partition::PartitionCoproduct<H> for PartitionCoproductWitness {
    type Partition = NullPartition<H>;
    fn left_summand(&self) -> Self::Partition {
        NullPartition::from_fingerprint(self.left_fingerprint)
    }
    fn right_summand(&self) -> Self::Partition {
        NullPartition::from_fingerprint(self.right_fingerprint)
    }
}

impl<H: HostTypes> crate::bridge::partition::CartesianPartitionProduct<H>
    for CartesianProductWitness
{
    type Partition = NullPartition<H>;
    fn left_cartesian_factor(&self) -> Self::Partition {
        NullPartition::from_fingerprint(self.left_fingerprint)
    }
    fn right_cartesian_factor(&self) -> Self::Partition {
        NullPartition::from_fingerprint(self.right_fingerprint)
    }
}

/// v0.2.1 ergonomics prelude. Re-exports the core symbols downstream crates
/// need for the consumer-facing one-liners.
/// Ontology-driven: the set of certificate / type / builder symbols is
/// sourced from `conformance:PreludeExport` individuals. Adding a new
/// symbol to the prelude is an ontology edit, verified against the
/// codegen's known-name mapping at build time.
pub mod prelude {
    pub use super::calibrations;
    pub use super::Add;
    pub use super::And;
    pub use super::BNot;
    pub use super::BinaryGroundingMap;
    pub use super::BindingEntry;
    pub use super::BindingsTable;
    pub use super::BornRuleVerification;
    pub use super::Calibration;
    pub use super::CalibrationError;
    pub use super::CanonicalTimingPolicy;
    pub use super::Certificate;
    pub use super::Certified;
    pub use super::ChainAuditTrail;
    pub use super::CompileTime;
    pub use super::CompileUnit;
    pub use super::CompileUnitBuilder;
    pub use super::CompletenessAuditTrail;
    pub use super::CompletenessCertificate;
    pub use super::ConstrainedTypeInput;
    pub use super::ContentAddress;
    pub use super::ContentFingerprint;
    pub use super::Datum;
    pub use super::DigestGroundingMap;
    pub use super::Embed;
    pub use super::FragmentMarker;
    pub use super::GenericImpossibilityWitness;
    pub use super::GeodesicCertificate;
    pub use super::GeodesicEvidenceBundle;
    pub use super::Grounded;
    pub use super::GroundedCoord;
    pub use super::GroundedShape;
    pub use super::GroundedTuple;
    pub use super::GroundedValue;
    pub use super::Grounding;
    pub use super::GroundingCertificate;
    pub use super::GroundingExt;
    pub use super::GroundingMapKind;
    pub use super::GroundingProgram;
    pub use super::Hasher;
    pub use super::ImpossibilityWitnessKind;
    pub use super::InhabitanceCertificate;
    pub use super::InhabitanceImpossibilityWitness;
    pub use super::IntegerGroundingMap;
    pub use super::Invertible;
    pub use super::InvolutionCertificate;
    pub use super::IsometryCertificate;
    pub use super::JsonGroundingMap;
    pub use super::LandauerBudget;
    pub use super::LiftChainCertificate;
    pub use super::MeasurementCertificate;
    pub use super::Mul;
    pub use super::Nanos;
    pub use super::Neg;
    pub use super::OntologyTarget;
    pub use super::Or;
    pub use super::PipelineFailure;
    pub use super::PreservesMetric;
    pub use super::PreservesStructure;
    pub use super::RingOp;
    pub use super::Runtime;
    pub use super::ShapeViolation;
    pub use super::Sub;
    pub use super::Succ;
    pub use super::Term;
    pub use super::TermArena;
    pub use super::TimingPolicy;
    pub use super::Total;
    pub use super::TransformCertificate;
    pub use super::Triad;
    pub use super::UnaryRingOp;
    pub use super::UorTime;
    pub use super::Utf8GroundingMap;
    pub use super::ValidLevelEmbedding;
    pub use super::Validated;
    pub use super::ValidationPhase;
    pub use super::Xor;
    pub use super::W16;
    pub use super::W8;
    pub use crate::pipeline::empty_bindings_table;
    pub use crate::pipeline::{
        validate_constrained_type, validate_constrained_type_const, ConstrainedTypeShape,
        ConstraintRef, FragmentKind,
    };
    pub use crate::{DecimalTranscendental, DefaultHostTypes, HostTypes, WittLevel};
}